xmrig | 4f73b0021d439a7c9d8c75e02c792138e048925b1cfd0930a1ef6970178378a6

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
Size 2.9MB
Sample240526-v6mkpseb6v
SHA256 4f73b0021d439a7c9d8c75e02c792138e048925b1cfd0930a1ef6970178378a6
MD5 18f5d149f022f07a4b013ea1a2d20fd0
SHA1 ad2538411d70939eef87ea62fa5d3c701a21a89d
SHA512 98ba78f9a8750e3c7101f83c3a9356343837d7f3b487c0b55ff7c5b7f2c3dd20eeea22398617c7cce2186479566b636fb143fe05172fd76dc13f632e1a49c4f6
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Y7:NABR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 12936 created 1500	12936	WerFaultSecure.exe	78
PID 13644 created 1500	13644	WerFaultSecure.exe	78

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/5032-118-0x00007FF643170000-0x00007FF643562000-memory.dmp	xmrig
behavioral2/memory/1224-127-0x00007FF7D3E80000-0x00007FF7D4272000-memory.dmp	xmrig
behavioral2/memory/4252-134-0x00007FF75AFC0000-0x00007FF75B3B2000-memory.dmp	xmrig
behavioral2/memory/2252-143-0x00007FF7246B0000-0x00007FF724AA2000-memory.dmp	xmrig
behavioral2/memory/1804-147-0x00007FF79C5C0000-0x00007FF79C9B2000-memory.dmp	xmrig
behavioral2/memory/1876-152-0x00007FF718DE0000-0x00007FF7191D2000-memory.dmp	xmrig
behavioral2/memory/4396-204-0x00007FF7469B0000-0x00007FF746DA2000-memory.dmp	xmrig
behavioral2/memory/2320-153-0x00007FF6CA510000-0x00007FF6CA902000-memory.dmp	xmrig
behavioral2/memory/2020-151-0x00007FF697280000-0x00007FF697672000-memory.dmp	xmrig
behavioral2/memory/2596-150-0x00007FF641010000-0x00007FF641402000-memory.dmp	xmrig
behavioral2/memory/4924-149-0x00007FF72DD00000-0x00007FF72E0F2000-memory.dmp	xmrig
behavioral2/memory/3312-148-0x00007FF7E08B0000-0x00007FF7E0CA2000-memory.dmp	xmrig
behavioral2/memory/2504-146-0x00007FF7DA6D0000-0x00007FF7DAAC2000-memory.dmp	xmrig
behavioral2/memory/1316-145-0x00007FF6B3EA0000-0x00007FF6B4292000-memory.dmp	xmrig
behavioral2/memory/2084-144-0x00007FF62ADC0000-0x00007FF62B1B2000-memory.dmp	xmrig
behavioral2/memory/4972-142-0x00007FF796B60000-0x00007FF796F52000-memory.dmp	xmrig
behavioral2/memory/2384-135-0x00007FF7A60F0000-0x00007FF7A64E2000-memory.dmp	xmrig
behavioral2/memory/2856-133-0x00007FF651D80000-0x00007FF652172000-memory.dmp	xmrig
behavioral2/memory/4760-104-0x00007FF782A40000-0x00007FF782E32000-memory.dmp	xmrig
behavioral2/memory/2580-97-0x00007FF622830000-0x00007FF622C22000-memory.dmp	xmrig
behavioral2/memory/4236-81-0x00007FF725530000-0x00007FF725922000-memory.dmp	xmrig
behavioral2/memory/4624-70-0x00007FF63F4C0000-0x00007FF63F8B2000-memory.dmp	xmrig
behavioral2/memory/2764-58-0x00007FF71F2B0000-0x00007FF71F6A2000-memory.dmp	xmrig
behavioral2/memory/4964-11-0x00007FF6D10B0000-0x00007FF6D14A2000-memory.dmp	xmrig
behavioral2/memory/4624-2809-0x00007FF63F4C0000-0x00007FF63F8B2000-memory.dmp	xmrig
behavioral2/memory/4236-2814-0x00007FF725530000-0x00007FF725922000-memory.dmp	xmrig
behavioral2/memory/2504-2818-0x00007FF7DA6D0000-0x00007FF7DAAC2000-memory.dmp	xmrig
behavioral2/memory/2580-2826-0x00007FF622830000-0x00007FF622C22000-memory.dmp	xmrig
behavioral2/memory/5032-2840-0x00007FF643170000-0x00007FF643562000-memory.dmp	xmrig
behavioral2/memory/1224-2838-0x00007FF7D3E80000-0x00007FF7D4272000-memory.dmp	xmrig
behavioral2/memory/2856-2837-0x00007FF651D80000-0x00007FF652172000-memory.dmp	xmrig
behavioral2/memory/4760-2833-0x00007FF782A40000-0x00007FF782E32000-memory.dmp	xmrig
behavioral2/memory/1804-2830-0x00007FF79C5C0000-0x00007FF79C9B2000-memory.dmp	xmrig
behavioral2/memory/2596-2850-0x00007FF641010000-0x00007FF641402000-memory.dmp	xmrig
behavioral2/memory/3312-2847-0x00007FF7E08B0000-0x00007FF7E0CA2000-memory.dmp	xmrig
behavioral2/memory/4252-2857-0x00007FF75AFC0000-0x00007FF75B3B2000-memory.dmp	xmrig
behavioral2/memory/2384-2860-0x00007FF7A60F0000-0x00007FF7A64E2000-memory.dmp	xmrig
behavioral2/memory/4972-2862-0x00007FF796B60000-0x00007FF796F52000-memory.dmp	xmrig
behavioral2/memory/4924-2854-0x00007FF72DD00000-0x00007FF72E0F2000-memory.dmp	xmrig
behavioral2/memory/5000-2984-0x00007FF63BC40000-0x00007FF63C032000-memory.dmp	xmrig
behavioral2/memory/2020-2881-0x00007FF697280000-0x00007FF697672000-memory.dmp	xmrig
behavioral2/memory/1876-2875-0x00007FF718DE0000-0x00007FF7191D2000-memory.dmp	xmrig
behavioral2/memory/2252-2873-0x00007FF7246B0000-0x00007FF724AA2000-memory.dmp	xmrig
behavioral2/memory/4396-2871-0x00007FF7469B0000-0x00007FF746DA2000-memory.dmp	xmrig
behavioral2/memory/2320-2866-0x00007FF6CA510000-0x00007FF6CA902000-memory.dmp	xmrig
behavioral2/memory/2084-2869-0x00007FF62ADC0000-0x00007FF62B1B2000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	2436	powershell.exe
13	2436	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2436	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4964	TbgmnxQ.exe
1316	ObJJxEH.exe
2764	KsoeIJX.exe
4624	PxAawDA.exe
4236	GIYoOJF.exe
2504	IxTKGwB.exe
2580	iATggLR.exe
4760	HGSrsLL.exe
5032	nFWMJmJ.exe
1224	kpvqNPP.exe
2856	XVbLZyP.exe
1804	GIRuoPF.exe
3312	lAixylv.exe
4252	nSajIKd.exe
2384	SpFwjLh.exe
4924	KfJjWNd.exe
2596	sVaiUUm.exe
4972	raCDYZA.exe
2252	CWTYLYt.exe
2020	unqpSSK.exe
1876	hBYmSWb.exe
2084	BJcirgv.exe
2320	JWxJuCQ.exe
4396	UqNoRZH.exe
2280	LdHPeAZ.exe
1668	gjTeOuT.exe
1972	VOEzGBR.exe
1648	etHsdVY.exe
2452	DLVEdod.exe
220	qkMRKyM.exe
1016	ZmdVaaV.exe
1932	yHpTaXI.exe
1548	uOxEzaL.exe
1244	QoGSmwS.exe
1632	unryjNn.exe
2756	HqwqWmF.exe
4620	mHSZFbt.exe
3868	QqZjhSC.exe
3300	RrfUpYK.exe
1432	dqLiuBN.exe
4256	Qiiuggt.exe
2068	WDVkuFs.exe
2760	vimCYCX.exe
2412	BIWVORK.exe
2880	AyTyoXW.exe
3756	djKyizq.exe
332	NaJWyfb.exe
764	SGbjJUg.exe
1508	bTrRrqS.exe
5092	wQImPQN.exe
3880	mzLiiBA.exe
4616	sMaSBrF.exe
3996	wWyxLlR.exe
4696	uFNEifw.exe
4684	JThZHyu.exe
3856	LUvxOvv.exe
4728	SyIPXDg.exe
2516	knkCUYc.exe
5012	TqlNDth.exe
5028	zZCNSsg.exe
2076	WSCrNqb.exe
1504	FRYDYKT.exe
4460	dsRZFTK.exe
4960	CVUKPkt.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5000-0-0x00007FF63BC40000-0x00007FF63C032000-memory.dmp	upx
behavioral2/files/0x000700000002341b-8.dat	upx
behavioral2/files/0x000700000002341c-23.dat	upx
behavioral2/files/0x000700000002341e-32.dat	upx
behavioral2/files/0x000700000002341f-38.dat	upx
behavioral2/files/0x0007000000023422-55.dat	upx
behavioral2/files/0x0007000000023429-80.dat	upx
behavioral2/files/0x0007000000023424-94.dat	upx
behavioral2/files/0x0008000000023426-103.dat	upx
behavioral2/memory/5032-118-0x00007FF643170000-0x00007FF643562000-memory.dmp	upx
behavioral2/memory/1224-127-0x00007FF7D3E80000-0x00007FF7D4272000-memory.dmp	upx
behavioral2/memory/4252-134-0x00007FF75AFC0000-0x00007FF75B3B2000-memory.dmp	upx
behavioral2/memory/2252-143-0x00007FF7246B0000-0x00007FF724AA2000-memory.dmp	upx
behavioral2/memory/1804-147-0x00007FF79C5C0000-0x00007FF79C9B2000-memory.dmp	upx
behavioral2/memory/1876-152-0x00007FF718DE0000-0x00007FF7191D2000-memory.dmp	upx
behavioral2/files/0x0007000000023431-166.dat	upx
behavioral2/files/0x0007000000023432-184.dat	upx
behavioral2/files/0x000700000002343b-202.dat	upx
behavioral2/memory/4396-204-0x00007FF7469B0000-0x00007FF746DA2000-memory.dmp	upx
behavioral2/files/0x000700000002343a-201.dat	upx
behavioral2/files/0x0007000000023439-200.dat	upx
behavioral2/files/0x0007000000023438-199.dat	upx
behavioral2/files/0x0007000000023437-198.dat	upx
behavioral2/files/0x0007000000023436-197.dat	upx
behavioral2/files/0x0007000000023433-195.dat	upx
behavioral2/files/0x0007000000023435-194.dat	upx
behavioral2/files/0x0007000000023434-175.dat	upx
behavioral2/files/0x0007000000023430-170.dat	upx
behavioral2/files/0x000700000002342f-160.dat	upx
behavioral2/memory/2320-153-0x00007FF6CA510000-0x00007FF6CA902000-memory.dmp	upx
behavioral2/memory/2020-151-0x00007FF697280000-0x00007FF697672000-memory.dmp	upx
behavioral2/memory/2596-150-0x00007FF641010000-0x00007FF641402000-memory.dmp	upx
behavioral2/memory/4924-149-0x00007FF72DD00000-0x00007FF72E0F2000-memory.dmp	upx
behavioral2/memory/3312-148-0x00007FF7E08B0000-0x00007FF7E0CA2000-memory.dmp	upx
behavioral2/memory/2504-146-0x00007FF7DA6D0000-0x00007FF7DAAC2000-memory.dmp	upx
behavioral2/memory/1316-145-0x00007FF6B3EA0000-0x00007FF6B4292000-memory.dmp	upx
behavioral2/memory/2084-144-0x00007FF62ADC0000-0x00007FF62B1B2000-memory.dmp	upx
behavioral2/memory/4972-142-0x00007FF796B60000-0x00007FF796F52000-memory.dmp	upx
behavioral2/files/0x000700000002342e-140.dat	upx
behavioral2/files/0x000700000002342c-138.dat	upx
behavioral2/files/0x000700000002342d-136.dat	upx
behavioral2/memory/2384-135-0x00007FF7A60F0000-0x00007FF7A64E2000-memory.dmp	upx
behavioral2/memory/2856-133-0x00007FF651D80000-0x00007FF652172000-memory.dmp	upx
behavioral2/files/0x0008000000023425-130.dat	upx
behavioral2/files/0x0008000000023417-123.dat	upx
behavioral2/files/0x0007000000023428-114.dat	upx
behavioral2/files/0x000700000002342a-111.dat	upx
behavioral2/files/0x000700000002342b-107.dat	upx
behavioral2/files/0x0007000000023427-105.dat	upx
behavioral2/memory/4760-104-0x00007FF782A40000-0x00007FF782E32000-memory.dmp	upx
behavioral2/memory/2580-97-0x00007FF622830000-0x00007FF622C22000-memory.dmp	upx
behavioral2/files/0x0007000000023423-86.dat	upx
behavioral2/memory/4236-81-0x00007FF725530000-0x00007FF725922000-memory.dmp	upx
behavioral2/files/0x0007000000023420-71.dat	upx
behavioral2/memory/4624-70-0x00007FF63F4C0000-0x00007FF63F8B2000-memory.dmp	upx
behavioral2/files/0x0007000000023421-82.dat	upx
behavioral2/memory/2764-58-0x00007FF71F2B0000-0x00007FF71F6A2000-memory.dmp	upx
behavioral2/files/0x000700000002341d-28.dat	upx
behavioral2/files/0x000700000002341a-16.dat	upx
behavioral2/memory/4964-11-0x00007FF6D10B0000-0x00007FF6D14A2000-memory.dmp	upx
behavioral2/files/0x0008000000023416-6.dat	upx
behavioral2/memory/4624-2809-0x00007FF63F4C0000-0x00007FF63F8B2000-memory.dmp	upx
behavioral2/memory/4236-2814-0x00007FF725530000-0x00007FF725922000-memory.dmp	upx
behavioral2/memory/2504-2818-0x00007FF7DA6D0000-0x00007FF7DAAC2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vZGufNL.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\PRxGfvf.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\LIrSusG.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ldQJMfI.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\yjrZCLl.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\RrucvAD.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\faGzxgL.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\gKiCbbh.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\IRnxtEs.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\nMBDaJg.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\YyxLmYS.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\VFgRjbm.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\QEvVirx.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\cxqTdbK.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\StkoEbo.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\HiJYZtD.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\YdnLKXf.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\DRkDxLU.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\jOLorts.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\SeZUNxB.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\JZsbtJA.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\PeepSVq.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\vKjcoDu.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ZPedoRP.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\BeOJddW.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\gbgTYoc.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\JraYTMY.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\iXybrJo.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\CaNJrLx.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\dXLMNwJ.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\YUrwJXw.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\SSkuVIM.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\vupwVWf.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\CtgEgLq.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\aaODcZf.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\eiwSISX.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\LqaTyXP.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\PjyRxXA.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\LwiawHk.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\AXFxVGL.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\cLBaASR.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\pSzSVTQ.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\kxHvvhF.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ypAZeMJ.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\PaiEufM.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\vXZYNgM.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\kWfpBTn.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\GxiQUEz.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\QSQPhkt.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\svhwqjW.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\lEIFIlh.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\SsqKBrr.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\iZlPiQP.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\EBzXXOv.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\owyBtCS.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\igQGatY.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\mevFbqv.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\eNhzRAE.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\TGwvAMZ.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ctkssBU.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\TaLsGFl.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\QETDpAU.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\CGZcNpY.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
File created	C:\Windows\System\ZPOIJGV.exe	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2436	powershell.exe
2436	powershell.exe
2436	powershell.exe
3400	WerFaultSecure.exe
3400	WerFaultSecure.exe
13680	WerFaultSecure.exe
13680	WerFaultSecure.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2436	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 2436	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	83
PID 5000 wrote to memory of 2436	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	83
PID 5000 wrote to memory of 4964	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	84
PID 5000 wrote to memory of 4964	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	84
PID 5000 wrote to memory of 1316	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	85
PID 5000 wrote to memory of 1316	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	85
PID 5000 wrote to memory of 2764	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	86
PID 5000 wrote to memory of 2764	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	86
PID 5000 wrote to memory of 4624	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	87
PID 5000 wrote to memory of 4624	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	87
PID 5000 wrote to memory of 4236	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	88
PID 5000 wrote to memory of 4236	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	88
PID 5000 wrote to memory of 2504	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	89
PID 5000 wrote to memory of 2504	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	89
PID 5000 wrote to memory of 2580	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	90
PID 5000 wrote to memory of 2580	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	90
PID 5000 wrote to memory of 4760	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	91
PID 5000 wrote to memory of 4760	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	91
PID 5000 wrote to memory of 5032	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	92
PID 5000 wrote to memory of 5032	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	92
PID 5000 wrote to memory of 1224	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	93
PID 5000 wrote to memory of 1224	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	93
PID 5000 wrote to memory of 2856	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	94
PID 5000 wrote to memory of 2856	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	94
PID 5000 wrote to memory of 1804	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	95
PID 5000 wrote to memory of 1804	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	95
PID 5000 wrote to memory of 3312	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	96
PID 5000 wrote to memory of 3312	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	96
PID 5000 wrote to memory of 4252	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	97
PID 5000 wrote to memory of 4252	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	97
PID 5000 wrote to memory of 2384	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	98
PID 5000 wrote to memory of 2384	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	98
PID 5000 wrote to memory of 4924	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	99
PID 5000 wrote to memory of 4924	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	99
PID 5000 wrote to memory of 2596	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	100
PID 5000 wrote to memory of 2596	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	100
PID 5000 wrote to memory of 4972	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	101
PID 5000 wrote to memory of 4972	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	101
PID 5000 wrote to memory of 2252	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	102
PID 5000 wrote to memory of 2252	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	102
PID 5000 wrote to memory of 2020	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	103
PID 5000 wrote to memory of 2020	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	103
PID 5000 wrote to memory of 1876	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	104
PID 5000 wrote to memory of 1876	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	104
PID 5000 wrote to memory of 2084	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	105
PID 5000 wrote to memory of 2084	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	105
PID 5000 wrote to memory of 2320	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	106
PID 5000 wrote to memory of 2320	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	106
PID 5000 wrote to memory of 4396	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	107
PID 5000 wrote to memory of 4396	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	107
PID 5000 wrote to memory of 2280	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	108
PID 5000 wrote to memory of 2280	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	108
PID 5000 wrote to memory of 1668	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	109
PID 5000 wrote to memory of 1668	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	109
PID 5000 wrote to memory of 1972	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	110
PID 5000 wrote to memory of 1972	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	110
PID 5000 wrote to memory of 1648	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	111
PID 5000 wrote to memory of 1648	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	111
PID 5000 wrote to memory of 2452	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	112
PID 5000 wrote to memory of 2452	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	112
PID 5000 wrote to memory of 220	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	113
PID 5000 wrote to memory of 220	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	113
PID 5000 wrote to memory of 1016	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	114
PID 5000 wrote to memory of 1016	5000	18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe	114

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
1⤵
PID:1500
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 1500 -s 1540
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3400
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 1500 -s 336
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:13680

C:\Users\Admin\AppData\Local\Temp\18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\18f5d149f022f07a4b013ea1a2d20fd0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2436" "2920" "2848" "2924" "0" "0" "2928" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:4980
- C:\Windows\System\TbgmnxQ.exe
  C:\Windows\System\TbgmnxQ.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\ObJJxEH.exe
  C:\Windows\System\ObJJxEH.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\KsoeIJX.exe
  C:\Windows\System\KsoeIJX.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\PxAawDA.exe
  C:\Windows\System\PxAawDA.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\GIYoOJF.exe
  C:\Windows\System\GIYoOJF.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\IxTKGwB.exe
  C:\Windows\System\IxTKGwB.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\iATggLR.exe
  C:\Windows\System\iATggLR.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\HGSrsLL.exe
  C:\Windows\System\HGSrsLL.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\nFWMJmJ.exe
  C:\Windows\System\nFWMJmJ.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\kpvqNPP.exe
  C:\Windows\System\kpvqNPP.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\XVbLZyP.exe
  C:\Windows\System\XVbLZyP.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\GIRuoPF.exe
  C:\Windows\System\GIRuoPF.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\lAixylv.exe
  C:\Windows\System\lAixylv.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\nSajIKd.exe
  C:\Windows\System\nSajIKd.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\SpFwjLh.exe
  C:\Windows\System\SpFwjLh.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\KfJjWNd.exe
  C:\Windows\System\KfJjWNd.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\sVaiUUm.exe
  C:\Windows\System\sVaiUUm.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\raCDYZA.exe
  C:\Windows\System\raCDYZA.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\CWTYLYt.exe
  C:\Windows\System\CWTYLYt.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\unqpSSK.exe
  C:\Windows\System\unqpSSK.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\hBYmSWb.exe
  C:\Windows\System\hBYmSWb.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\BJcirgv.exe
  C:\Windows\System\BJcirgv.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\JWxJuCQ.exe
  C:\Windows\System\JWxJuCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\UqNoRZH.exe
  C:\Windows\System\UqNoRZH.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\LdHPeAZ.exe
  C:\Windows\System\LdHPeAZ.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\gjTeOuT.exe
  C:\Windows\System\gjTeOuT.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\VOEzGBR.exe
  C:\Windows\System\VOEzGBR.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\etHsdVY.exe
  C:\Windows\System\etHsdVY.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\DLVEdod.exe
  C:\Windows\System\DLVEdod.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\qkMRKyM.exe
  C:\Windows\System\qkMRKyM.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\ZmdVaaV.exe
  C:\Windows\System\ZmdVaaV.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\yHpTaXI.exe
  C:\Windows\System\yHpTaXI.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\uOxEzaL.exe
  C:\Windows\System\uOxEzaL.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\QoGSmwS.exe
  C:\Windows\System\QoGSmwS.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\unryjNn.exe
  C:\Windows\System\unryjNn.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\HqwqWmF.exe
  C:\Windows\System\HqwqWmF.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\mHSZFbt.exe
  C:\Windows\System\mHSZFbt.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\QqZjhSC.exe
  C:\Windows\System\QqZjhSC.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\RrfUpYK.exe
  C:\Windows\System\RrfUpYK.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\dqLiuBN.exe
  C:\Windows\System\dqLiuBN.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\Qiiuggt.exe
  C:\Windows\System\Qiiuggt.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\WDVkuFs.exe
  C:\Windows\System\WDVkuFs.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\vimCYCX.exe
  C:\Windows\System\vimCYCX.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\BIWVORK.exe
  C:\Windows\System\BIWVORK.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\AyTyoXW.exe
  C:\Windows\System\AyTyoXW.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\NaJWyfb.exe
  C:\Windows\System\NaJWyfb.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\djKyizq.exe
  C:\Windows\System\djKyizq.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\SGbjJUg.exe
  C:\Windows\System\SGbjJUg.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\bTrRrqS.exe
  C:\Windows\System\bTrRrqS.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\wQImPQN.exe
  C:\Windows\System\wQImPQN.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\mzLiiBA.exe
  C:\Windows\System\mzLiiBA.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\sMaSBrF.exe
  C:\Windows\System\sMaSBrF.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\wWyxLlR.exe
  C:\Windows\System\wWyxLlR.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\uFNEifw.exe
  C:\Windows\System\uFNEifw.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\JThZHyu.exe
  C:\Windows\System\JThZHyu.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\LUvxOvv.exe
  C:\Windows\System\LUvxOvv.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\SyIPXDg.exe
  C:\Windows\System\SyIPXDg.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\knkCUYc.exe
  C:\Windows\System\knkCUYc.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\TqlNDth.exe
  C:\Windows\System\TqlNDth.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\zZCNSsg.exe
  C:\Windows\System\zZCNSsg.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\WSCrNqb.exe
  C:\Windows\System\WSCrNqb.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\FRYDYKT.exe
  C:\Windows\System\FRYDYKT.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\dsRZFTK.exe
  C:\Windows\System\dsRZFTK.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\CVUKPkt.exe
  C:\Windows\System\CVUKPkt.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\PzjOeus.exe
  C:\Windows\System\PzjOeus.exe
  2⤵
  PID:4036
- C:\Windows\System\jQhwxQB.exe
  C:\Windows\System\jQhwxQB.exe
  2⤵
  PID:2744
- C:\Windows\System\RhkepJv.exe
  C:\Windows\System\RhkepJv.exe
  2⤵
  PID:2136
- C:\Windows\System\EJclYBU.exe
  C:\Windows\System\EJclYBU.exe
  2⤵
  PID:2124
- C:\Windows\System\VsFoGIB.exe
  C:\Windows\System\VsFoGIB.exe
  2⤵
  PID:2992
- C:\Windows\System\bemkYDV.exe
  C:\Windows\System\bemkYDV.exe
  2⤵
  PID:548
- C:\Windows\System\GMWfOzZ.exe
  C:\Windows\System\GMWfOzZ.exe
  2⤵
  PID:1724
- C:\Windows\System\fbdcFqm.exe
  C:\Windows\System\fbdcFqm.exe
  2⤵
  PID:3388
- C:\Windows\System\fCbUUCE.exe
  C:\Windows\System\fCbUUCE.exe
  2⤵
  PID:3548
- C:\Windows\System\NtvTZxi.exe
  C:\Windows\System\NtvTZxi.exe
  2⤵
  PID:4116
- C:\Windows\System\OveGFhX.exe
  C:\Windows\System\OveGFhX.exe
  2⤵
  PID:3340
- C:\Windows\System\ZKzXMpI.exe
  C:\Windows\System\ZKzXMpI.exe
  2⤵
  PID:2204
- C:\Windows\System\vHpXUtC.exe
  C:\Windows\System\vHpXUtC.exe
  2⤵
  PID:4272
- C:\Windows\System\iyOKNsH.exe
  C:\Windows\System\iyOKNsH.exe
  2⤵
  PID:228
- C:\Windows\System\JjQLPkX.exe
  C:\Windows\System\JjQLPkX.exe
  2⤵
  PID:2944
- C:\Windows\System\kelBgZa.exe
  C:\Windows\System\kelBgZa.exe
  2⤵
  PID:556
- C:\Windows\System\ONZydhy.exe
  C:\Windows\System\ONZydhy.exe
  2⤵
  PID:1120
- C:\Windows\System\orOosqs.exe
  C:\Windows\System\orOosqs.exe
  2⤵
  PID:4052
- C:\Windows\System\QSgXNbx.exe
  C:\Windows\System\QSgXNbx.exe
  2⤵
  PID:3280
- C:\Windows\System\hpNiWBk.exe
  C:\Windows\System\hpNiWBk.exe
  2⤵
  PID:944
- C:\Windows\System\IMMOEFk.exe
  C:\Windows\System\IMMOEFk.exe
  2⤵
  PID:4504
- C:\Windows\System\vFbwHwe.exe
  C:\Windows\System\vFbwHwe.exe
  2⤵
  PID:4796
- C:\Windows\System\cHeSyrY.exe
  C:\Windows\System\cHeSyrY.exe
  2⤵
  PID:3240
- C:\Windows\System\CMTHxdc.exe
  C:\Windows\System\CMTHxdc.exe
  2⤵
  PID:1376
- C:\Windows\System\HzpFYNx.exe
  C:\Windows\System\HzpFYNx.exe
  2⤵
  PID:3436
- C:\Windows\System\bwbZvdZ.exe
  C:\Windows\System\bwbZvdZ.exe
  2⤵
  PID:3752
- C:\Windows\System\nmPNfSk.exe
  C:\Windows\System\nmPNfSk.exe
  2⤵
  PID:4480
- C:\Windows\System\IELLsgM.exe
  C:\Windows\System\IELLsgM.exe
  2⤵
  PID:4668
- C:\Windows\System\zqLkGpT.exe
  C:\Windows\System\zqLkGpT.exe
  2⤵
  PID:3384
- C:\Windows\System\dBqBShH.exe
  C:\Windows\System\dBqBShH.exe
  2⤵
  PID:2540
- C:\Windows\System\fctIQDG.exe
  C:\Windows\System\fctIQDG.exe
  2⤵
  PID:5072
- C:\Windows\System\hKsdavO.exe
  C:\Windows\System\hKsdavO.exe
  2⤵
  PID:4212
- C:\Windows\System\NYAfyKs.exe
  C:\Windows\System\NYAfyKs.exe
  2⤵
  PID:1636
- C:\Windows\System\BcjjDIK.exe
  C:\Windows\System\BcjjDIK.exe
  2⤵
  PID:3900
- C:\Windows\System\FjjnuNB.exe
  C:\Windows\System\FjjnuNB.exe
  2⤵
  PID:3852
- C:\Windows\System\UvckyOG.exe
  C:\Windows\System\UvckyOG.exe
  2⤵
  PID:4136
- C:\Windows\System\EblsZnx.exe
  C:\Windows\System\EblsZnx.exe
  2⤵
  PID:5124
- C:\Windows\System\rAPVEEn.exe
  C:\Windows\System\rAPVEEn.exe
  2⤵
  PID:5152
- C:\Windows\System\jCnpSIy.exe
  C:\Windows\System\jCnpSIy.exe
  2⤵
  PID:5188
- C:\Windows\System\eCHcoMy.exe
  C:\Windows\System\eCHcoMy.exe
  2⤵
  PID:5212
- C:\Windows\System\GrVAicM.exe
  C:\Windows\System\GrVAicM.exe
  2⤵
  PID:5232
- C:\Windows\System\xXVwRgz.exe
  C:\Windows\System\xXVwRgz.exe
  2⤵
  PID:5256
- C:\Windows\System\wlHokyn.exe
  C:\Windows\System\wlHokyn.exe
  2⤵
  PID:5280
- C:\Windows\System\JFiwdvH.exe
  C:\Windows\System\JFiwdvH.exe
  2⤵
  PID:5308
- C:\Windows\System\fcepfTr.exe
  C:\Windows\System\fcepfTr.exe
  2⤵
  PID:5340
- C:\Windows\System\OJbWFJw.exe
  C:\Windows\System\OJbWFJw.exe
  2⤵
  PID:5356
- C:\Windows\System\YLcpTuJ.exe
  C:\Windows\System\YLcpTuJ.exe
  2⤵
  PID:5384
- C:\Windows\System\ezOUTRF.exe
  C:\Windows\System\ezOUTRF.exe
  2⤵
  PID:5420
- C:\Windows\System\xxKpEyn.exe
  C:\Windows\System\xxKpEyn.exe
  2⤵
  PID:5444
- C:\Windows\System\WIBMdhD.exe
  C:\Windows\System\WIBMdhD.exe
  2⤵
  PID:5464
- C:\Windows\System\lGtWejq.exe
  C:\Windows\System\lGtWejq.exe
  2⤵
  PID:5492
- C:\Windows\System\eyJIRhD.exe
  C:\Windows\System\eyJIRhD.exe
  2⤵
  PID:5516
- C:\Windows\System\CiJBZZm.exe
  C:\Windows\System\CiJBZZm.exe
  2⤵
  PID:5540
- C:\Windows\System\QmoLGVh.exe
  C:\Windows\System\QmoLGVh.exe
  2⤵
  PID:5564
- C:\Windows\System\WyzcGIa.exe
  C:\Windows\System\WyzcGIa.exe
  2⤵
  PID:5588
- C:\Windows\System\doyUkem.exe
  C:\Windows\System\doyUkem.exe
  2⤵
  PID:5612
- C:\Windows\System\cnBLMZw.exe
  C:\Windows\System\cnBLMZw.exe
  2⤵
  PID:5636
- C:\Windows\System\CoscAxi.exe
  C:\Windows\System\CoscAxi.exe
  2⤵
  PID:5664
- C:\Windows\System\HBLpvLF.exe
  C:\Windows\System\HBLpvLF.exe
  2⤵
  PID:5688
- C:\Windows\System\LrIOLbX.exe
  C:\Windows\System\LrIOLbX.exe
  2⤵
  PID:5712
- C:\Windows\System\qQpjlCa.exe
  C:\Windows\System\qQpjlCa.exe
  2⤵
  PID:5736
- C:\Windows\System\ZhAhetp.exe
  C:\Windows\System\ZhAhetp.exe
  2⤵
  PID:5760
- C:\Windows\System\OzNMTLl.exe
  C:\Windows\System\OzNMTLl.exe
  2⤵
  PID:5784
- C:\Windows\System\HcJnTwT.exe
  C:\Windows\System\HcJnTwT.exe
  2⤵
  PID:5816
- C:\Windows\System\xrZkbUf.exe
  C:\Windows\System\xrZkbUf.exe
  2⤵
  PID:5836
- C:\Windows\System\oSoCJnA.exe
  C:\Windows\System\oSoCJnA.exe
  2⤵
  PID:5860
- C:\Windows\System\VgdAFcf.exe
  C:\Windows\System\VgdAFcf.exe
  2⤵
  PID:5888
- C:\Windows\System\dkQrhmq.exe
  C:\Windows\System\dkQrhmq.exe
  2⤵
  PID:5916
- C:\Windows\System\KIwqJaN.exe
  C:\Windows\System\KIwqJaN.exe
  2⤵
  PID:5940
- C:\Windows\System\VJRyXUj.exe
  C:\Windows\System\VJRyXUj.exe
  2⤵
  PID:5964
- C:\Windows\System\QCImxUU.exe
  C:\Windows\System\QCImxUU.exe
  2⤵
  PID:5988
- C:\Windows\System\oBuvZLx.exe
  C:\Windows\System\oBuvZLx.exe
  2⤵
  PID:6016
- C:\Windows\System\bqYMhrK.exe
  C:\Windows\System\bqYMhrK.exe
  2⤵
  PID:6044
- C:\Windows\System\KVdeNVK.exe
  C:\Windows\System\KVdeNVK.exe
  2⤵
  PID:6064
- C:\Windows\System\aZeegKA.exe
  C:\Windows\System\aZeegKA.exe
  2⤵
  PID:6088
- C:\Windows\System\WmAklTl.exe
  C:\Windows\System\WmAklTl.exe
  2⤵
  PID:6108
- C:\Windows\System\nXKLZEC.exe
  C:\Windows\System\nXKLZEC.exe
  2⤵
  PID:6132
- C:\Windows\System\ltGzLWU.exe
  C:\Windows\System\ltGzLWU.exe
  2⤵
  PID:4800
- C:\Windows\System\PznlppL.exe
  C:\Windows\System\PznlppL.exe
  2⤵
  PID:1984
- C:\Windows\System\TjHQdfP.exe
  C:\Windows\System\TjHQdfP.exe
  2⤵
  PID:4792
- C:\Windows\System\foNFOEE.exe
  C:\Windows\System\foNFOEE.exe
  2⤵
  PID:3292
- C:\Windows\System\DdcvfxZ.exe
  C:\Windows\System\DdcvfxZ.exe
  2⤵
  PID:5348
- C:\Windows\System\zyTAnRl.exe
  C:\Windows\System\zyTAnRl.exe
  2⤵
  PID:5304
- C:\Windows\System\vtbLmtr.exe
  C:\Windows\System\vtbLmtr.exe
  2⤵
  PID:5324
- C:\Windows\System\VAxZCKq.exe
  C:\Windows\System\VAxZCKq.exe
  2⤵
  PID:5228
- C:\Windows\System\oADnvcg.exe
  C:\Windows\System\oADnvcg.exe
  2⤵
  PID:5276
- C:\Windows\System\jpifMRb.exe
  C:\Windows\System\jpifMRb.exe
  2⤵
  PID:5480
- C:\Windows\System\YWsWNvl.exe
  C:\Windows\System\YWsWNvl.exe
  2⤵
  PID:5608
- C:\Windows\System\OgsLfrQ.exe
  C:\Windows\System\OgsLfrQ.exe
  2⤵
  PID:5500
- C:\Windows\System\zGmWHrn.exe
  C:\Windows\System\zGmWHrn.exe
  2⤵
  PID:5780
- C:\Windows\System\lhMwvFb.exe
  C:\Windows\System\lhMwvFb.exe
  2⤵
  PID:5548
- C:\Windows\System\RxitDTJ.exe
  C:\Windows\System\RxitDTJ.exe
  2⤵
  PID:5632
- C:\Windows\System\siYpvpt.exe
  C:\Windows\System\siYpvpt.exe
  2⤵
  PID:6056
- C:\Windows\System\XgMEisA.exe
  C:\Windows\System\XgMEisA.exe
  2⤵
  PID:5408
- C:\Windows\System\fUAzPxu.exe
  C:\Windows\System\fUAzPxu.exe
  2⤵
  PID:5908
- C:\Windows\System\YdcRKUA.exe
  C:\Windows\System\YdcRKUA.exe
  2⤵
  PID:2852
- C:\Windows\System\rIeifms.exe
  C:\Windows\System\rIeifms.exe
  2⤵
  PID:3232
- C:\Windows\System\XLLBxuK.exe
  C:\Windows\System\XLLBxuK.exe
  2⤵
  PID:5460
- C:\Windows\System\CnaJnrv.exe
  C:\Windows\System\CnaJnrv.exe
  2⤵
  PID:1896
- C:\Windows\System\BLsGgCp.exe
  C:\Windows\System\BLsGgCp.exe
  2⤵
  PID:5796
- C:\Windows\System\zQvkPKR.exe
  C:\Windows\System\zQvkPKR.exe
  2⤵
  PID:6160
- C:\Windows\System\dAiWPvS.exe
  C:\Windows\System\dAiWPvS.exe
  2⤵
  PID:6184
- C:\Windows\System\rzMGQBL.exe
  C:\Windows\System\rzMGQBL.exe
  2⤵
  PID:6208
- C:\Windows\System\oipPKkf.exe
  C:\Windows\System\oipPKkf.exe
  2⤵
  PID:6232
- C:\Windows\System\PWwadpR.exe
  C:\Windows\System\PWwadpR.exe
  2⤵
  PID:6256
- C:\Windows\System\tMeRoOS.exe
  C:\Windows\System\tMeRoOS.exe
  2⤵
  PID:6296
- C:\Windows\System\DMnfPlU.exe
  C:\Windows\System\DMnfPlU.exe
  2⤵
  PID:6320
- C:\Windows\System\oZpHhxI.exe
  C:\Windows\System\oZpHhxI.exe
  2⤵
  PID:6348
- C:\Windows\System\neUKGFh.exe
  C:\Windows\System\neUKGFh.exe
  2⤵
  PID:6384
- C:\Windows\System\KXlVGEf.exe
  C:\Windows\System\KXlVGEf.exe
  2⤵
  PID:6404
- C:\Windows\System\hhzbJSu.exe
  C:\Windows\System\hhzbJSu.exe
  2⤵
  PID:6428
- C:\Windows\System\kLvmgxi.exe
  C:\Windows\System\kLvmgxi.exe
  2⤵
  PID:6456
- C:\Windows\System\lROQuea.exe
  C:\Windows\System\lROQuea.exe
  2⤵
  PID:6480
- C:\Windows\System\tAsEOwl.exe
  C:\Windows\System\tAsEOwl.exe
  2⤵
  PID:6500
- C:\Windows\System\Mwpctos.exe
  C:\Windows\System\Mwpctos.exe
  2⤵
  PID:6528
- C:\Windows\System\bUUoazQ.exe
  C:\Windows\System\bUUoazQ.exe
  2⤵
  PID:6552
- C:\Windows\System\qCdmTDz.exe
  C:\Windows\System\qCdmTDz.exe
  2⤵
  PID:6580
- C:\Windows\System\sKEpKcX.exe
  C:\Windows\System\sKEpKcX.exe
  2⤵
  PID:6604
- C:\Windows\System\KQerCqg.exe
  C:\Windows\System\KQerCqg.exe
  2⤵
  PID:6628
- C:\Windows\System\AowNFTd.exe
  C:\Windows\System\AowNFTd.exe
  2⤵
  PID:6660
- C:\Windows\System\lLyWZft.exe
  C:\Windows\System\lLyWZft.exe
  2⤵
  PID:6680
- C:\Windows\System\UaGIcAU.exe
  C:\Windows\System\UaGIcAU.exe
  2⤵
  PID:6704
- C:\Windows\System\cSMbTfY.exe
  C:\Windows\System\cSMbTfY.exe
  2⤵
  PID:6728
- C:\Windows\System\qopuBbT.exe
  C:\Windows\System\qopuBbT.exe
  2⤵
  PID:6764
- C:\Windows\System\wiDNHle.exe
  C:\Windows\System\wiDNHle.exe
  2⤵
  PID:6784
- C:\Windows\System\ZggjWlh.exe
  C:\Windows\System\ZggjWlh.exe
  2⤵
  PID:6808
- C:\Windows\System\SowPSjV.exe
  C:\Windows\System\SowPSjV.exe
  2⤵
  PID:6828
- C:\Windows\System\IQZyfja.exe
  C:\Windows\System\IQZyfja.exe
  2⤵
  PID:6856
- C:\Windows\System\LlAfkHX.exe
  C:\Windows\System\LlAfkHX.exe
  2⤵
  PID:6884
- C:\Windows\System\mwdZvRa.exe
  C:\Windows\System\mwdZvRa.exe
  2⤵
  PID:6904
- C:\Windows\System\nORnEJn.exe
  C:\Windows\System\nORnEJn.exe
  2⤵
  PID:6932
- C:\Windows\System\GJQxHxO.exe
  C:\Windows\System\GJQxHxO.exe
  2⤵
  PID:6956
- C:\Windows\System\EBRWPiu.exe
  C:\Windows\System\EBRWPiu.exe
  2⤵
  PID:6976
- C:\Windows\System\mKTPPZj.exe
  C:\Windows\System\mKTPPZj.exe
  2⤵
  PID:7000
- C:\Windows\System\abHBtpE.exe
  C:\Windows\System\abHBtpE.exe
  2⤵
  PID:7024
- C:\Windows\System\KotjUng.exe
  C:\Windows\System\KotjUng.exe
  2⤵
  PID:7048
- C:\Windows\System\llJsDMK.exe
  C:\Windows\System\llJsDMK.exe
  2⤵
  PID:7076
- C:\Windows\System\Rzqefvx.exe
  C:\Windows\System\Rzqefvx.exe
  2⤵
  PID:7100
- C:\Windows\System\rMZkjCU.exe
  C:\Windows\System\rMZkjCU.exe
  2⤵
  PID:7124
- C:\Windows\System\zGStrKw.exe
  C:\Windows\System\zGStrKw.exe
  2⤵
  PID:7148
- C:\Windows\System\oItVZhC.exe
  C:\Windows\System\oItVZhC.exe
  2⤵
  PID:5456
- C:\Windows\System\miyBXFq.exe
  C:\Windows\System\miyBXFq.exe
  2⤵
  PID:5580
- C:\Windows\System\QjKHwTR.exe
  C:\Windows\System\QjKHwTR.exe
  2⤵
  PID:5880
- C:\Windows\System\roLJSHc.exe
  C:\Windows\System\roLJSHc.exe
  2⤵
  PID:6180
- C:\Windows\System\DmpZtGs.exe
  C:\Windows\System\DmpZtGs.exe
  2⤵
  PID:5140
- C:\Windows\System\WTdjhoV.exe
  C:\Windows\System\WTdjhoV.exe
  2⤵
  PID:5872
- C:\Windows\System\oPADQxx.exe
  C:\Windows\System\oPADQxx.exe
  2⤵
  PID:6376
- C:\Windows\System\LUSQEyl.exe
  C:\Windows\System\LUSQEyl.exe
  2⤵
  PID:5912
- C:\Windows\System\PsBEnJP.exe
  C:\Windows\System\PsBEnJP.exe
  2⤵
  PID:6312
- C:\Windows\System\AlHhoSf.exe
  C:\Windows\System\AlHhoSf.exe
  2⤵
  PID:6620
- C:\Windows\System\FajwWHB.exe
  C:\Windows\System\FajwWHB.exe
  2⤵
  PID:6424
- C:\Windows\System\ItXkEkC.exe
  C:\Windows\System\ItXkEkC.exe
  2⤵
  PID:6476
- C:\Windows\System\JTbVzKg.exe
  C:\Windows\System\JTbVzKg.exe
  2⤵
  PID:6516
- C:\Windows\System\QEvVirx.exe
  C:\Windows\System\QEvVirx.exe
  2⤵
  PID:6308
- C:\Windows\System\EiPouWr.exe
  C:\Windows\System\EiPouWr.exe
  2⤵
  PID:6576
- C:\Windows\System\mVWIcbJ.exe
  C:\Windows\System\mVWIcbJ.exe
  2⤵
  PID:6776
- C:\Windows\System\GfCwoLy.exe
  C:\Windows\System\GfCwoLy.exe
  2⤵
  PID:6800
- C:\Windows\System\YmqQkQr.exe
  C:\Windows\System\YmqQkQr.exe
  2⤵
  PID:6700
- C:\Windows\System\PnAWnTb.exe
  C:\Windows\System\PnAWnTb.exe
  2⤵
  PID:7044
- C:\Windows\System\IyvjlRn.exe
  C:\Windows\System\IyvjlRn.exe
  2⤵
  PID:6804
- C:\Windows\System\MsNEBzJ.exe
  C:\Windows\System\MsNEBzJ.exe
  2⤵
  PID:7140
- C:\Windows\System\KsBZZbX.exe
  C:\Windows\System\KsBZZbX.exe
  2⤵
  PID:6008
- C:\Windows\System\otbVkzV.exe
  C:\Windows\System\otbVkzV.exe
  2⤵
  PID:6916
- C:\Windows\System\wSsPfPi.exe
  C:\Windows\System\wSsPfPi.exe
  2⤵
  PID:7016
- C:\Windows\System\IBgCpku.exe
  C:\Windows\System\IBgCpku.exe
  2⤵
  PID:6420
- C:\Windows\System\pHlTMqb.exe
  C:\Windows\System\pHlTMqb.exe
  2⤵
  PID:6464
- C:\Windows\System\LzczjfT.exe
  C:\Windows\System\LzczjfT.exe
  2⤵
  PID:6720
- C:\Windows\System\eLqoHUM.exe
  C:\Windows\System\eLqoHUM.exe
  2⤵
  PID:7192
- C:\Windows\System\fErPFnQ.exe
  C:\Windows\System\fErPFnQ.exe
  2⤵
  PID:7220
- C:\Windows\System\iBdUuiR.exe
  C:\Windows\System\iBdUuiR.exe
  2⤵
  PID:7252
- C:\Windows\System\zDloEKc.exe
  C:\Windows\System\zDloEKc.exe
  2⤵
  PID:7272
- C:\Windows\System\rMRFlUi.exe
  C:\Windows\System\rMRFlUi.exe
  2⤵
  PID:7296
- C:\Windows\System\UJkksKH.exe
  C:\Windows\System\UJkksKH.exe
  2⤵
  PID:7324
- C:\Windows\System\JErVQLl.exe
  C:\Windows\System\JErVQLl.exe
  2⤵
  PID:7348
- C:\Windows\System\OReJJKB.exe
  C:\Windows\System\OReJJKB.exe
  2⤵
  PID:7376
- C:\Windows\System\PdeSLHc.exe
  C:\Windows\System\PdeSLHc.exe
  2⤵
  PID:7400
- C:\Windows\System\lcuXBAD.exe
  C:\Windows\System\lcuXBAD.exe
  2⤵
  PID:7424
- C:\Windows\System\GcSVuhc.exe
  C:\Windows\System\GcSVuhc.exe
  2⤵
  PID:7444
- C:\Windows\System\ygkQHPW.exe
  C:\Windows\System\ygkQHPW.exe
  2⤵
  PID:7468
- C:\Windows\System\soHtIOm.exe
  C:\Windows\System\soHtIOm.exe
  2⤵
  PID:7496
- C:\Windows\System\OuMsfgR.exe
  C:\Windows\System\OuMsfgR.exe
  2⤵
  PID:7524
- C:\Windows\System\QhELsUc.exe
  C:\Windows\System\QhELsUc.exe
  2⤵
  PID:7544
- C:\Windows\System\CltFwAc.exe
  C:\Windows\System\CltFwAc.exe
  2⤵
  PID:7568
- C:\Windows\System\UWYPqMQ.exe
  C:\Windows\System\UWYPqMQ.exe
  2⤵
  PID:7592
- C:\Windows\System\dNXOIGR.exe
  C:\Windows\System\dNXOIGR.exe
  2⤵
  PID:7616
- C:\Windows\System\YUyCONi.exe
  C:\Windows\System\YUyCONi.exe
  2⤵
  PID:7644
- C:\Windows\System\SeKitaw.exe
  C:\Windows\System\SeKitaw.exe
  2⤵
  PID:7668
- C:\Windows\System\MTXOIvW.exe
  C:\Windows\System\MTXOIvW.exe
  2⤵
  PID:7692
- C:\Windows\System\upihlKa.exe
  C:\Windows\System\upihlKa.exe
  2⤵
  PID:7724
- C:\Windows\System\clQAWSj.exe
  C:\Windows\System\clQAWSj.exe
  2⤵
  PID:7748
- C:\Windows\System\WYcCjTs.exe
  C:\Windows\System\WYcCjTs.exe
  2⤵
  PID:7776
- C:\Windows\System\fBfqKBU.exe
  C:\Windows\System\fBfqKBU.exe
  2⤵
  PID:7800
- C:\Windows\System\LZDNGWq.exe
  C:\Windows\System\LZDNGWq.exe
  2⤵
  PID:7828
- C:\Windows\System\GnYtRJt.exe
  C:\Windows\System\GnYtRJt.exe
  2⤵
  PID:7852
- C:\Windows\System\dCbUaBg.exe
  C:\Windows\System\dCbUaBg.exe
  2⤵
  PID:7868
- C:\Windows\System\FJIKTAt.exe
  C:\Windows\System\FJIKTAt.exe
  2⤵
  PID:7884
- C:\Windows\System\DfkHUAG.exe
  C:\Windows\System\DfkHUAG.exe
  2⤵
  PID:7908
- C:\Windows\System\SmasNnp.exe
  C:\Windows\System\SmasNnp.exe
  2⤵
  PID:7932
- C:\Windows\System\LKFzHDH.exe
  C:\Windows\System\LKFzHDH.exe
  2⤵
  PID:7964
- C:\Windows\System\lIKMiyb.exe
  C:\Windows\System\lIKMiyb.exe
  2⤵
  PID:7992
- C:\Windows\System\PaSPJux.exe
  C:\Windows\System\PaSPJux.exe
  2⤵
  PID:8020
- C:\Windows\System\xwQgAFo.exe
  C:\Windows\System\xwQgAFo.exe
  2⤵
  PID:8044
- C:\Windows\System\JoqYkFl.exe
  C:\Windows\System\JoqYkFl.exe
  2⤵
  PID:8064
- C:\Windows\System\rEkVLld.exe
  C:\Windows\System\rEkVLld.exe
  2⤵
  PID:8088
- C:\Windows\System\NRaoNeJ.exe
  C:\Windows\System\NRaoNeJ.exe
  2⤵
  PID:8116
- C:\Windows\System\vZGufNL.exe
  C:\Windows\System\vZGufNL.exe
  2⤵
  PID:8140
- C:\Windows\System\wchAoqB.exe
  C:\Windows\System\wchAoqB.exe
  2⤵
  PID:8164
- C:\Windows\System\sSFMpPl.exe
  C:\Windows\System\sSFMpPl.exe
  2⤵
  PID:5828
- C:\Windows\System\XSNcwWG.exe
  C:\Windows\System\XSNcwWG.exe
  2⤵
  PID:5556
- C:\Windows\System\TKXpHZK.exe
  C:\Windows\System\TKXpHZK.exe
  2⤵
  PID:5972
- C:\Windows\System\RZsXcHC.exe
  C:\Windows\System\RZsXcHC.exe
  2⤵
  PID:6824
- C:\Windows\System\rRtAbTp.exe
  C:\Windows\System\rRtAbTp.exe
  2⤵
  PID:5596
- C:\Windows\System\LBCavEB.exe
  C:\Windows\System\LBCavEB.exe
  2⤵
  PID:6268
- C:\Windows\System\HBPPrEp.exe
  C:\Windows\System\HBPPrEp.exe
  2⤵
  PID:6696
- C:\Windows\System\pOwcWGk.exe
  C:\Windows\System\pOwcWGk.exe
  2⤵
  PID:1552
- C:\Windows\System\YdnLKXf.exe
  C:\Windows\System\YdnLKXf.exe
  2⤵
  PID:6496
- C:\Windows\System\aZiiQxD.exe
  C:\Windows\System\aZiiQxD.exe
  2⤵
  PID:7368
- C:\Windows\System\DLCSAuH.exe
  C:\Windows\System\DLCSAuH.exe
  2⤵
  PID:7440
- C:\Windows\System\RrdSYPu.exe
  C:\Windows\System\RrdSYPu.exe
  2⤵
  PID:6396
- C:\Windows\System\SsqKBrr.exe
  C:\Windows\System\SsqKBrr.exe
  2⤵
  PID:7228
- C:\Windows\System\ZkfoPwI.exe
  C:\Windows\System\ZkfoPwI.exe
  2⤵
  PID:6944
- C:\Windows\System\UaFfHxI.exe
  C:\Windows\System\UaFfHxI.exe
  2⤵
  PID:7356
- C:\Windows\System\SYYdQin.exe
  C:\Windows\System\SYYdQin.exe
  2⤵
  PID:7792
- C:\Windows\System\qvouPol.exe
  C:\Windows\System\qvouPol.exe
  2⤵
  PID:7904
- C:\Windows\System\cBIOEdx.exe
  C:\Windows\System\cBIOEdx.exe
  2⤵
  PID:7536
- C:\Windows\System\WFtaEfE.exe
  C:\Windows\System\WFtaEfE.exe
  2⤵
  PID:7564
- C:\Windows\System\PSGTXfz.exe
  C:\Windows\System\PSGTXfz.exe
  2⤵
  PID:8008
- C:\Windows\System\HbwIXAu.exe
  C:\Windows\System\HbwIXAu.exe
  2⤵
  PID:7312
- C:\Windows\System\lXCeOff.exe
  C:\Windows\System\lXCeOff.exe
  2⤵
  PID:7788
- C:\Windows\System\ZNcwCvu.exe
  C:\Windows\System\ZNcwCvu.exe
  2⤵
  PID:7824
- C:\Windows\System\RGtrDZB.exe
  C:\Windows\System\RGtrDZB.exe
  2⤵
  PID:7880
- C:\Windows\System\uxgfuuR.exe
  C:\Windows\System\uxgfuuR.exe
  2⤵
  PID:3500
- C:\Windows\System\OkKADGZ.exe
  C:\Windows\System\OkKADGZ.exe
  2⤵
  PID:6508
- C:\Windows\System\RPzFfdh.exe
  C:\Windows\System\RPzFfdh.exe
  2⤵
  PID:7640
- C:\Windows\System\PvZvBSB.exe
  C:\Windows\System\PvZvBSB.exe
  2⤵
  PID:7176
- C:\Windows\System\AxZrjEm.exe
  C:\Windows\System\AxZrjEm.exe
  2⤵
  PID:6796
- C:\Windows\System\TgzAFFJ.exe
  C:\Windows\System\TgzAFFJ.exe
  2⤵
  PID:7732
- C:\Windows\System\LHmngzZ.exe
  C:\Windows\System\LHmngzZ.exe
  2⤵
  PID:7588
- C:\Windows\System\yYdOVna.exe
  C:\Windows\System\yYdOVna.exe
  2⤵
  PID:6844
- C:\Windows\System\CLEPODF.exe
  C:\Windows\System\CLEPODF.exe
  2⤵
  PID:8216
- C:\Windows\System\wtOepNa.exe
  C:\Windows\System\wtOepNa.exe
  2⤵
  PID:8240
- C:\Windows\System\vupwVWf.exe
  C:\Windows\System\vupwVWf.exe
  2⤵
  PID:8264
- C:\Windows\System\AAsxdFs.exe
  C:\Windows\System\AAsxdFs.exe
  2⤵
  PID:8292
- C:\Windows\System\zbCxMln.exe
  C:\Windows\System\zbCxMln.exe
  2⤵
  PID:8316
- C:\Windows\System\gEgNPAj.exe
  C:\Windows\System\gEgNPAj.exe
  2⤵
  PID:8332
- C:\Windows\System\XeoIPUr.exe
  C:\Windows\System\XeoIPUr.exe
  2⤵
  PID:8348
- C:\Windows\System\UskkaMb.exe
  C:\Windows\System\UskkaMb.exe
  2⤵
  PID:8364
- C:\Windows\System\pbOTtWb.exe
  C:\Windows\System\pbOTtWb.exe
  2⤵
  PID:8392
- C:\Windows\System\QeAdrmf.exe
  C:\Windows\System\QeAdrmf.exe
  2⤵
  PID:8420
- C:\Windows\System\RoYlUmd.exe
  C:\Windows\System\RoYlUmd.exe
  2⤵
  PID:8440
- C:\Windows\System\VgfLHcL.exe
  C:\Windows\System\VgfLHcL.exe
  2⤵
  PID:8464
- C:\Windows\System\aRxyQcj.exe
  C:\Windows\System\aRxyQcj.exe
  2⤵
  PID:8488
- C:\Windows\System\yJYOqjm.exe
  C:\Windows\System\yJYOqjm.exe
  2⤵
  PID:8512
- C:\Windows\System\WhYYcrD.exe
  C:\Windows\System\WhYYcrD.exe
  2⤵
  PID:8536
- C:\Windows\System\oDgUxRF.exe
  C:\Windows\System\oDgUxRF.exe
  2⤵
  PID:8560
- C:\Windows\System\bGuwnVS.exe
  C:\Windows\System\bGuwnVS.exe
  2⤵
  PID:8580
- C:\Windows\System\roGzamz.exe
  C:\Windows\System\roGzamz.exe
  2⤵
  PID:8616
- C:\Windows\System\TiFwSoX.exe
  C:\Windows\System\TiFwSoX.exe
  2⤵
  PID:8640
- C:\Windows\System\wOzazsc.exe
  C:\Windows\System\wOzazsc.exe
  2⤵
  PID:8676
- C:\Windows\System\vzEHcEx.exe
  C:\Windows\System\vzEHcEx.exe
  2⤵
  PID:8696
- C:\Windows\System\LWdVJxX.exe
  C:\Windows\System\LWdVJxX.exe
  2⤵
  PID:8720
- C:\Windows\System\OpdoXxR.exe
  C:\Windows\System\OpdoXxR.exe
  2⤵
  PID:8744
- C:\Windows\System\AkMtmGE.exe
  C:\Windows\System\AkMtmGE.exe
  2⤵
  PID:8768
- C:\Windows\System\mMOQcUG.exe
  C:\Windows\System\mMOQcUG.exe
  2⤵
  PID:8792
- C:\Windows\System\IWfOtlp.exe
  C:\Windows\System\IWfOtlp.exe
  2⤵
  PID:8820
- C:\Windows\System\eiFkBlM.exe
  C:\Windows\System\eiFkBlM.exe
  2⤵
  PID:8840
- C:\Windows\System\JJFZUWt.exe
  C:\Windows\System\JJFZUWt.exe
  2⤵
  PID:8868
- C:\Windows\System\akqAPVg.exe
  C:\Windows\System\akqAPVg.exe
  2⤵
  PID:8892
- C:\Windows\System\oqqUrMZ.exe
  C:\Windows\System\oqqUrMZ.exe
  2⤵
  PID:8920
- C:\Windows\System\SIWaddW.exe
  C:\Windows\System\SIWaddW.exe
  2⤵
  PID:8936
- C:\Windows\System\jlgKdiY.exe
  C:\Windows\System\jlgKdiY.exe
  2⤵
  PID:8960
- C:\Windows\System\mcOccJj.exe
  C:\Windows\System\mcOccJj.exe
  2⤵
  PID:8992
- C:\Windows\System\hRJGZKb.exe
  C:\Windows\System\hRJGZKb.exe
  2⤵
  PID:9016
- C:\Windows\System\NeMRoYG.exe
  C:\Windows\System\NeMRoYG.exe
  2⤵
  PID:9044
- C:\Windows\System\ALJFHli.exe
  C:\Windows\System\ALJFHli.exe
  2⤵
  PID:9072
- C:\Windows\System\PBZYjFi.exe
  C:\Windows\System\PBZYjFi.exe
  2⤵
  PID:9096
- C:\Windows\System\viqdeNq.exe
  C:\Windows\System\viqdeNq.exe
  2⤵
  PID:9120
- C:\Windows\System\anHMWmN.exe
  C:\Windows\System\anHMWmN.exe
  2⤵
  PID:9144
- C:\Windows\System\FBpAfuB.exe
  C:\Windows\System\FBpAfuB.exe
  2⤵
  PID:9168
- C:\Windows\System\eVywPNQ.exe
  C:\Windows\System\eVywPNQ.exe
  2⤵
  PID:9192
- C:\Windows\System\TpCbGJM.exe
  C:\Windows\System\TpCbGJM.exe
  2⤵
  PID:9212
- C:\Windows\System\GmzEZYC.exe
  C:\Windows\System\GmzEZYC.exe
  2⤵
  PID:8184
- C:\Windows\System\OoIOVyy.exe
  C:\Windows\System\OoIOVyy.exe
  2⤵
  PID:6560
- C:\Windows\System\YxWDsFT.exe
  C:\Windows\System\YxWDsFT.exe
  2⤵
  PID:7164
- C:\Windows\System\dOmaBHu.exe
  C:\Windows\System\dOmaBHu.exe
  2⤵
  PID:8080
- C:\Windows\System\QtfNzfU.exe
  C:\Windows\System\QtfNzfU.exe
  2⤵
  PID:8260
- C:\Windows\System\YJlPmuB.exe
  C:\Windows\System\YJlPmuB.exe
  2⤵
  PID:8344
- C:\Windows\System\EQzmhtI.exe
  C:\Windows\System\EQzmhtI.exe
  2⤵
  PID:8480
- C:\Windows\System\cWLzYDj.exe
  C:\Windows\System\cWLzYDj.exe
  2⤵
  PID:8572
- C:\Windows\System\bjjlyJE.exe
  C:\Windows\System\bjjlyJE.exe
  2⤵
  PID:8652
- C:\Windows\System\PhnKKJe.exe
  C:\Windows\System\PhnKKJe.exe
  2⤵
  PID:7688
- C:\Windows\System\FygBUSr.exe
  C:\Windows\System\FygBUSr.exe
  2⤵
  PID:8760
- C:\Windows\System\wCOoimH.exe
  C:\Windows\System\wCOoimH.exe
  2⤵
  PID:7384
- C:\Windows\System\lpvUMHv.exe
  C:\Windows\System\lpvUMHv.exe
  2⤵
  PID:8304
- C:\Windows\System\DbSPUwJ.exe
  C:\Windows\System\DbSPUwJ.exe
  2⤵
  PID:8932
- C:\Windows\System\PXcjBvS.exe
  C:\Windows\System\PXcjBvS.exe
  2⤵
  PID:7576
- C:\Windows\System\FbBJJJc.exe
  C:\Windows\System\FbBJJJc.exe
  2⤵
  PID:9220
- C:\Windows\System\xKCobmU.exe
  C:\Windows\System\xKCobmU.exe
  2⤵
  PID:9240
- C:\Windows\System\BgHvdNK.exe
  C:\Windows\System\BgHvdNK.exe
  2⤵
  PID:9268
- C:\Windows\System\tBNBmss.exe
  C:\Windows\System\tBNBmss.exe
  2⤵
  PID:9292
- C:\Windows\System\eozddzn.exe
  C:\Windows\System\eozddzn.exe
  2⤵
  PID:9316
- C:\Windows\System\wxwSEjz.exe
  C:\Windows\System\wxwSEjz.exe
  2⤵
  PID:9340
- C:\Windows\System\ZmgLXVS.exe
  C:\Windows\System\ZmgLXVS.exe
  2⤵
  PID:9364
- C:\Windows\System\XqLaMXW.exe
  C:\Windows\System\XqLaMXW.exe
  2⤵
  PID:9392
- C:\Windows\System\CFGQLos.exe
  C:\Windows\System\CFGQLos.exe
  2⤵
  PID:9420
- C:\Windows\System\WMjYDEN.exe
  C:\Windows\System\WMjYDEN.exe
  2⤵
  PID:9444
- C:\Windows\System\nwnnRuD.exe
  C:\Windows\System\nwnnRuD.exe
  2⤵
  PID:9472
- C:\Windows\System\GAxFQSq.exe
  C:\Windows\System\GAxFQSq.exe
  2⤵
  PID:9496
- C:\Windows\System\vhjnCyg.exe
  C:\Windows\System\vhjnCyg.exe
  2⤵
  PID:9532
- C:\Windows\System\hCkJMZM.exe
  C:\Windows\System\hCkJMZM.exe
  2⤵
  PID:9552
- C:\Windows\System\mmPBlMX.exe
  C:\Windows\System\mmPBlMX.exe
  2⤵
  PID:9588
- C:\Windows\System\veWRoky.exe
  C:\Windows\System\veWRoky.exe
  2⤵
  PID:9604
- C:\Windows\System\aKyTAmn.exe
  C:\Windows\System\aKyTAmn.exe
  2⤵
  PID:9624
- C:\Windows\System\nvkSFVL.exe
  C:\Windows\System\nvkSFVL.exe
  2⤵
  PID:9652
- C:\Windows\System\NyhGbAX.exe
  C:\Windows\System\NyhGbAX.exe
  2⤵
  PID:9676
- C:\Windows\System\mRHldVy.exe
  C:\Windows\System\mRHldVy.exe
  2⤵
  PID:9700
- C:\Windows\System\HNstNNu.exe
  C:\Windows\System\HNstNNu.exe
  2⤵
  PID:9724
- C:\Windows\System\TjtZyQi.exe
  C:\Windows\System\TjtZyQi.exe
  2⤵
  PID:9748
- C:\Windows\System\apVWUio.exe
  C:\Windows\System\apVWUio.exe
  2⤵
  PID:9772
- C:\Windows\System\dAcEksl.exe
  C:\Windows\System\dAcEksl.exe
  2⤵
  PID:9792
- C:\Windows\System\mStAizS.exe
  C:\Windows\System\mStAizS.exe
  2⤵
  PID:9820
- C:\Windows\System\oDAveVS.exe
  C:\Windows\System\oDAveVS.exe
  2⤵
  PID:9848
- C:\Windows\System\BbBaEdd.exe
  C:\Windows\System\BbBaEdd.exe
  2⤵
  PID:9872
- C:\Windows\System\hEckloX.exe
  C:\Windows\System\hEckloX.exe
  2⤵
  PID:9900
- C:\Windows\System\wVAOwhE.exe
  C:\Windows\System\wVAOwhE.exe
  2⤵
  PID:9924
- C:\Windows\System\hPwwmIY.exe
  C:\Windows\System\hPwwmIY.exe
  2⤵
  PID:9948
- C:\Windows\System\HcDDRhj.exe
  C:\Windows\System\HcDDRhj.exe
  2⤵
  PID:9968
- C:\Windows\System\vsXtcIJ.exe
  C:\Windows\System\vsXtcIJ.exe
  2⤵
  PID:9988
- C:\Windows\System\wAYgiEX.exe
  C:\Windows\System\wAYgiEX.exe
  2⤵
  PID:10020
- C:\Windows\System\IVgtALD.exe
  C:\Windows\System\IVgtALD.exe
  2⤵
  PID:10044
- C:\Windows\System\RuaYsiu.exe
  C:\Windows\System\RuaYsiu.exe
  2⤵
  PID:10068
- C:\Windows\System\cTMMNaW.exe
  C:\Windows\System\cTMMNaW.exe
  2⤵
  PID:10092
- C:\Windows\System\IRPjpWh.exe
  C:\Windows\System\IRPjpWh.exe
  2⤵
  PID:10116
- C:\Windows\System\tBzKgqP.exe
  C:\Windows\System\tBzKgqP.exe
  2⤵
  PID:10148
- C:\Windows\System\ekDCHqg.exe
  C:\Windows\System\ekDCHqg.exe
  2⤵
  PID:10172
- C:\Windows\System\GXsaFBk.exe
  C:\Windows\System\GXsaFBk.exe
  2⤵
  PID:10196
- C:\Windows\System\PTlgHzN.exe
  C:\Windows\System\PTlgHzN.exe
  2⤵
  PID:10220
- C:\Windows\System\IWHiPqj.exe
  C:\Windows\System\IWHiPqj.exe
  2⤵
  PID:8456
- C:\Windows\System\ESxcJVH.exe
  C:\Windows\System\ESxcJVH.exe
  2⤵
  PID:9004
- C:\Windows\System\ZwIjQzS.exe
  C:\Windows\System\ZwIjQzS.exe
  2⤵
  PID:9052
- C:\Windows\System\opEGZYU.exe
  C:\Windows\System\opEGZYU.exe
  2⤵
  PID:6952
- C:\Windows\System\LcHBXZH.exe
  C:\Windows\System\LcHBXZH.exe
  2⤵
  PID:7916
- C:\Windows\System\xGabVyF.exe
  C:\Windows\System\xGabVyF.exe
  2⤵
  PID:9184
- C:\Windows\System\tKburWV.exe
  C:\Windows\System\tKburWV.exe
  2⤵
  PID:9200
- C:\Windows\System\XQZfNOr.exe
  C:\Windows\System\XQZfNOr.exe
  2⤵
  PID:8096
- C:\Windows\System\iuKMWMh.exe
  C:\Windows\System\iuKMWMh.exe
  2⤵
  PID:8740
- C:\Windows\System\BHGnefy.exe
  C:\Windows\System\BHGnefy.exe
  2⤵
  PID:6200
- C:\Windows\System\ylWNISd.exe
  C:\Windows\System\ylWNISd.exe
  2⤵
  PID:8232
- C:\Windows\System\eZvenJg.exe
  C:\Windows\System\eZvenJg.exe
  2⤵
  PID:8904
- C:\Windows\System\WjRLsdR.exe
  C:\Windows\System\WjRLsdR.exe
  2⤵
  PID:7948
- C:\Windows\System\yDlcmCZ.exe
  C:\Windows\System\yDlcmCZ.exe
  2⤵
  PID:9228
- C:\Windows\System\guEJZay.exe
  C:\Windows\System\guEJZay.exe
  2⤵
  PID:8532
- C:\Windows\System\qtWUtmP.exe
  C:\Windows\System\qtWUtmP.exe
  2⤵
  PID:9348
- C:\Windows\System\ONjWIaN.exe
  C:\Windows\System\ONjWIaN.exe
  2⤵
  PID:9128
- C:\Windows\System\koWjQmE.exe
  C:\Windows\System\koWjQmE.exe
  2⤵
  PID:9436
- C:\Windows\System\iNAejNb.exe
  C:\Windows\System\iNAejNb.exe
  2⤵
  PID:8200
- C:\Windows\System\DRkDxLU.exe
  C:\Windows\System\DRkDxLU.exe
  2⤵
  PID:9612
- C:\Windows\System\PrqYhRH.exe
  C:\Windows\System\PrqYhRH.exe
  2⤵
  PID:9672
- C:\Windows\System\sHLSuEb.exe
  C:\Windows\System\sHLSuEb.exe
  2⤵
  PID:9788
- C:\Windows\System\mevFbqv.exe
  C:\Windows\System\mevFbqv.exe
  2⤵
  PID:9892
- C:\Windows\System\yVUBpMy.exe
  C:\Windows\System\yVUBpMy.exe
  2⤵
  PID:10252
- C:\Windows\System\NtQoaaE.exe
  C:\Windows\System\NtQoaaE.exe
  2⤵
  PID:10276
- C:\Windows\System\smnNUKK.exe
  C:\Windows\System\smnNUKK.exe
  2⤵
  PID:10300
- C:\Windows\System\oHtWzBF.exe
  C:\Windows\System\oHtWzBF.exe
  2⤵
  PID:10328
- C:\Windows\System\XBCkEMl.exe
  C:\Windows\System\XBCkEMl.exe
  2⤵
  PID:10356
- C:\Windows\System\VVTcNtD.exe
  C:\Windows\System\VVTcNtD.exe
  2⤵
  PID:10380
- C:\Windows\System\LygUNHv.exe
  C:\Windows\System\LygUNHv.exe
  2⤵
  PID:10412
- C:\Windows\System\tRZzuRY.exe
  C:\Windows\System\tRZzuRY.exe
  2⤵
  PID:10436
- C:\Windows\System\gIuadDz.exe
  C:\Windows\System\gIuadDz.exe
  2⤵
  PID:10460
- C:\Windows\System\ZiDeYGE.exe
  C:\Windows\System\ZiDeYGE.exe
  2⤵
  PID:10484
- C:\Windows\System\rygjVJV.exe
  C:\Windows\System\rygjVJV.exe
  2⤵
  PID:10508
- C:\Windows\System\UERoSOP.exe
  C:\Windows\System\UERoSOP.exe
  2⤵
  PID:10528
- C:\Windows\System\jwAavPy.exe
  C:\Windows\System\jwAavPy.exe
  2⤵
  PID:10548
- C:\Windows\System\WMwahjX.exe
  C:\Windows\System\WMwahjX.exe
  2⤵
  PID:10572
- C:\Windows\System\yeOOyBq.exe
  C:\Windows\System\yeOOyBq.exe
  2⤵
  PID:10600
- C:\Windows\System\DJIYGwd.exe
  C:\Windows\System\DJIYGwd.exe
  2⤵
  PID:10628
- C:\Windows\System\UEbRWfF.exe
  C:\Windows\System\UEbRWfF.exe
  2⤵
  PID:10656
- C:\Windows\System\mAaIJeS.exe
  C:\Windows\System\mAaIJeS.exe
  2⤵
  PID:10692
- C:\Windows\System\iIeCbDz.exe
  C:\Windows\System\iIeCbDz.exe
  2⤵
  PID:10716
- C:\Windows\System\hklJIkT.exe
  C:\Windows\System\hklJIkT.exe
  2⤵
  PID:10740
- C:\Windows\System\AWSqIDy.exe
  C:\Windows\System\AWSqIDy.exe
  2⤵
  PID:10760
- C:\Windows\System\DMxdenS.exe
  C:\Windows\System\DMxdenS.exe
  2⤵
  PID:10792
- C:\Windows\System\zRBvcxV.exe
  C:\Windows\System\zRBvcxV.exe
  2⤵
  PID:10812
- C:\Windows\System\XPphIuH.exe
  C:\Windows\System\XPphIuH.exe
  2⤵
  PID:10840
- C:\Windows\System\QXoVAcn.exe
  C:\Windows\System\QXoVAcn.exe
  2⤵
  PID:10864
- C:\Windows\System\nnVFRGd.exe
  C:\Windows\System\nnVFRGd.exe
  2⤵
  PID:10884
- C:\Windows\System\bcxkHRN.exe
  C:\Windows\System\bcxkHRN.exe
  2⤵
  PID:10912
- C:\Windows\System\RcxAQto.exe
  C:\Windows\System\RcxAQto.exe
  2⤵
  PID:10932
- C:\Windows\System\yAyELwR.exe
  C:\Windows\System\yAyELwR.exe
  2⤵
  PID:10948
- C:\Windows\System\TvUIDsU.exe
  C:\Windows\System\TvUIDsU.exe
  2⤵
  PID:10972
- C:\Windows\System\FDiouVE.exe
  C:\Windows\System\FDiouVE.exe
  2⤵
  PID:10988
- C:\Windows\System\KCrToWl.exe
  C:\Windows\System\KCrToWl.exe
  2⤵
  PID:11008
- C:\Windows\System\jxWzxsA.exe
  C:\Windows\System\jxWzxsA.exe
  2⤵
  PID:11048
- C:\Windows\System\AVYAPNn.exe
  C:\Windows\System\AVYAPNn.exe
  2⤵
  PID:11072
- C:\Windows\System\DUitaUf.exe
  C:\Windows\System\DUitaUf.exe
  2⤵
  PID:11092
- C:\Windows\System\ZFeTUba.exe
  C:\Windows\System\ZFeTUba.exe
  2⤵
  PID:11128
- C:\Windows\System\qgbOuGi.exe
  C:\Windows\System\qgbOuGi.exe
  2⤵
  PID:11152
- C:\Windows\System\ztTWszW.exe
  C:\Windows\System\ztTWszW.exe
  2⤵
  PID:11172
- C:\Windows\System\TGOjaif.exe
  C:\Windows\System\TGOjaif.exe
  2⤵
  PID:11208
- C:\Windows\System\GjtGyhq.exe
  C:\Windows\System\GjtGyhq.exe
  2⤵
  PID:11228
- C:\Windows\System\AnFieoq.exe
  C:\Windows\System\AnFieoq.exe
  2⤵
  PID:11256
- C:\Windows\System\UrEdKfY.exe
  C:\Windows\System\UrEdKfY.exe
  2⤵
  PID:9956
- C:\Windows\System\FeDNGjX.exe
  C:\Windows\System\FeDNGjX.exe
  2⤵
  PID:9996
- C:\Windows\System\SVreubp.exe
  C:\Windows\System\SVreubp.exe
  2⤵
  PID:9256
- C:\Windows\System\zfQwKCW.exe
  C:\Windows\System\zfQwKCW.exe
  2⤵
  PID:11088
- C:\Windows\System\UordBJH.exe
  C:\Windows\System\UordBJH.exe
  2⤵
  PID:10308
- C:\Windows\System\TaLLIbO.exe
  C:\Windows\System\TaLLIbO.exe
  2⤵
  PID:9964
- C:\Windows\System\JneqThb.exe
  C:\Windows\System\JneqThb.exe
  2⤵
  PID:10580
- C:\Windows\System\iaoTiLY.exe
  C:\Windows\System\iaoTiLY.exe
  2⤵
  PID:10644
- C:\Windows\System\UngZtLv.exe
  C:\Windows\System\UngZtLv.exe
  2⤵
  PID:10708
- C:\Windows\System\BSKORLe.exe
  C:\Windows\System\BSKORLe.exe
  2⤵
  PID:9484
- C:\Windows\System\jfOtFJJ.exe
  C:\Windows\System\jfOtFJJ.exe
  2⤵
  PID:10752
- C:\Windows\System\tMmnbCb.exe
  C:\Windows\System\tMmnbCb.exe
  2⤵
  PID:10772
- C:\Windows\System\ojgZbLJ.exe
  C:\Windows\System\ojgZbLJ.exe
  2⤵
  PID:10832
- C:\Windows\System\GhNGqvr.exe
  C:\Windows\System\GhNGqvr.exe
  2⤵
  PID:10876
- C:\Windows\System\xhftlNN.exe
  C:\Windows\System\xhftlNN.exe
  2⤵
  PID:10960
- C:\Windows\System\AruBrpJ.exe
  C:\Windows\System\AruBrpJ.exe
  2⤵
  PID:10060
- C:\Windows\System\xwmMRhS.exe
  C:\Windows\System\xwmMRhS.exe
  2⤵
  PID:9932
- C:\Windows\System\isDhlRD.exe
  C:\Windows\System\isDhlRD.exe
  2⤵
  PID:11296
- C:\Windows\System\yiheCgs.exe
  C:\Windows\System\yiheCgs.exe
  2⤵
  PID:11320
- C:\Windows\System\EVNkDXB.exe
  C:\Windows\System\EVNkDXB.exe
  2⤵
  PID:11348
- C:\Windows\System\otprqzg.exe
  C:\Windows\System\otprqzg.exe
  2⤵
  PID:11372
- C:\Windows\System\gpwROAb.exe
  C:\Windows\System\gpwROAb.exe
  2⤵
  PID:11396
- C:\Windows\System\xmskxwR.exe
  C:\Windows\System\xmskxwR.exe
  2⤵
  PID:11420
- C:\Windows\System\bJAJSVx.exe
  C:\Windows\System\bJAJSVx.exe
  2⤵
  PID:11452
- C:\Windows\System\HZoWgYg.exe
  C:\Windows\System\HZoWgYg.exe
  2⤵
  PID:11496
- C:\Windows\System\UYSceOD.exe
  C:\Windows\System\UYSceOD.exe
  2⤵
  PID:11512
- C:\Windows\System\PQBagLI.exe
  C:\Windows\System\PQBagLI.exe
  2⤵
  PID:11536
- C:\Windows\System\VimhvYv.exe
  C:\Windows\System\VimhvYv.exe
  2⤵
  PID:11652
- C:\Windows\System\AcJtQSd.exe
  C:\Windows\System\AcJtQSd.exe
  2⤵
  PID:11668
- C:\Windows\System\sNXAJKH.exe
  C:\Windows\System\sNXAJKH.exe
  2⤵
  PID:11684
- C:\Windows\System\RJceKtO.exe
  C:\Windows\System\RJceKtO.exe
  2⤵
  PID:11704
- C:\Windows\System\QuWktWh.exe
  C:\Windows\System\QuWktWh.exe
  2⤵
  PID:11732
- C:\Windows\System\KpJyZKD.exe
  C:\Windows\System\KpJyZKD.exe
  2⤵
  PID:11756
- C:\Windows\System\dnjlwjQ.exe
  C:\Windows\System\dnjlwjQ.exe
  2⤵
  PID:11784
- C:\Windows\System\ZvUzQQK.exe
  C:\Windows\System\ZvUzQQK.exe
  2⤵
  PID:11808
- C:\Windows\System\svDHwiQ.exe
  C:\Windows\System\svDHwiQ.exe
  2⤵
  PID:11828
- C:\Windows\System\GtZarBs.exe
  C:\Windows\System\GtZarBs.exe
  2⤵
  PID:11852
- C:\Windows\System\iVpfoSH.exe
  C:\Windows\System\iVpfoSH.exe
  2⤵
  PID:11868
- C:\Windows\System\DtklDeF.exe
  C:\Windows\System\DtklDeF.exe
  2⤵
  PID:11904
- C:\Windows\System\AJdzFkl.exe
  C:\Windows\System\AJdzFkl.exe
  2⤵
  PID:11928
- C:\Windows\System\SBnJYjl.exe
  C:\Windows\System\SBnJYjl.exe
  2⤵
  PID:11956
- C:\Windows\System\xnNwOlj.exe
  C:\Windows\System\xnNwOlj.exe
  2⤵
  PID:11984
- C:\Windows\System\UCcbPWG.exe
  C:\Windows\System\UCcbPWG.exe
  2⤵
  PID:12016
- C:\Windows\System\PnKULjW.exe
  C:\Windows\System\PnKULjW.exe
  2⤵
  PID:12036
- C:\Windows\System\KQyETGh.exe
  C:\Windows\System\KQyETGh.exe
  2⤵
  PID:12060
- C:\Windows\System\vXZYNgM.exe
  C:\Windows\System\vXZYNgM.exe
  2⤵
  PID:12080
- C:\Windows\System\DGHATyi.exe
  C:\Windows\System\DGHATyi.exe
  2⤵
  PID:12104
- C:\Windows\System\VenJDyW.exe
  C:\Windows\System\VenJDyW.exe
  2⤵
  PID:12136
- C:\Windows\System\TlREbkM.exe
  C:\Windows\System\TlREbkM.exe
  2⤵
  PID:12156
- C:\Windows\System\RmsHiwy.exe
  C:\Windows\System\RmsHiwy.exe
  2⤵
  PID:12192
- C:\Windows\System\xWNEEXb.exe
  C:\Windows\System\xWNEEXb.exe
  2⤵
  PID:12212
- C:\Windows\System\epafRBq.exe
  C:\Windows\System\epafRBq.exe
  2⤵
  PID:12236
- C:\Windows\System\bNLzJwn.exe
  C:\Windows\System\bNLzJwn.exe
  2⤵
  PID:12268
- C:\Windows\System\zhJFspb.exe
  C:\Windows\System\zhJFspb.exe
  2⤵
  PID:3508
- C:\Windows\System\GjZoWQA.exe
  C:\Windows\System\GjZoWQA.exe
  2⤵
  PID:11196
- C:\Windows\System\udboEBG.exe
  C:\Windows\System\udboEBG.exe
  2⤵
  PID:10588
- C:\Windows\System\gNntBxL.exe
  C:\Windows\System\gNntBxL.exe
  2⤵
  PID:8692
- C:\Windows\System\pGPLEWY.exe
  C:\Windows\System\pGPLEWY.exe
  2⤵
  PID:6240
- C:\Windows\System\WBEdjZX.exe
  C:\Windows\System\WBEdjZX.exe
  2⤵
  PID:10836
- C:\Windows\System\Mrccilu.exe
  C:\Windows\System\Mrccilu.exe
  2⤵
  PID:11144
- C:\Windows\System\ongiJWH.exe
  C:\Windows\System\ongiJWH.exe
  2⤵
  PID:10680
- C:\Windows\System\caaPPHA.exe
  C:\Windows\System\caaPPHA.exe
  2⤵
  PID:10652
- C:\Windows\System\MTQbizs.exe
  C:\Windows\System\MTQbizs.exe
  2⤵
  PID:8604
- C:\Windows\System\UVJUqec.exe
  C:\Windows\System\UVJUqec.exe
  2⤵
  PID:7292
- C:\Windows\System\qVfVAnB.exe
  C:\Windows\System\qVfVAnB.exe
  2⤵
  PID:9912
- C:\Windows\System\jOLorts.exe
  C:\Windows\System\jOLorts.exe
  2⤵
  PID:11528
- C:\Windows\System\zVLFtWR.exe
  C:\Windows\System\zVLFtWR.exe
  2⤵
  PID:11488
- C:\Windows\System\nXqgHLQ.exe
  C:\Windows\System\nXqgHLQ.exe
  2⤵
  PID:11360
- C:\Windows\System\MvANoqZ.exe
  C:\Windows\System\MvANoqZ.exe
  2⤵
  PID:11680
- C:\Windows\System\wUYNxpm.exe
  C:\Windows\System\wUYNxpm.exe
  2⤵
  PID:11752
- C:\Windows\System\eZIMBHU.exe
  C:\Windows\System\eZIMBHU.exe
  2⤵
  PID:11772
- C:\Windows\System\MOATzsb.exe
  C:\Windows\System\MOATzsb.exe
  2⤵
  PID:11816
- C:\Windows\System\TFXAgNi.exe
  C:\Windows\System\TFXAgNi.exe
  2⤵
  PID:11356
- C:\Windows\System\OtIfIGy.exe
  C:\Windows\System\OtIfIGy.exe
  2⤵
  PID:11884
- C:\Windows\System\XUiCrsb.exe
  C:\Windows\System\XUiCrsb.exe
  2⤵
  PID:11508
- C:\Windows\System\oHLerNd.exe
  C:\Windows\System\oHLerNd.exe
  2⤵
  PID:12056
- C:\Windows\System\RWbiKKi.exe
  C:\Windows\System\RWbiKKi.exe
  2⤵
  PID:11100
- C:\Windows\System\JxGfAQj.exe
  C:\Windows\System\JxGfAQj.exe
  2⤵
  PID:12152
- C:\Windows\System\bAwafuo.exe
  C:\Windows\System\bAwafuo.exe
  2⤵
  PID:12232
- C:\Windows\System\cvxhfNp.exe
  C:\Windows\System\cvxhfNp.exe
  2⤵
  PID:11924
- C:\Windows\System\OUyscTn.exe
  C:\Windows\System\OUyscTn.exe
  2⤵
  PID:9040
- C:\Windows\System\BwnVVji.exe
  C:\Windows\System\BwnVVji.exe
  2⤵
  PID:10808
- C:\Windows\System\tpFhWks.exe
  C:\Windows\System\tpFhWks.exe
  2⤵
  PID:12096
- C:\Windows\System\qWkCkKO.exe
  C:\Windows\System\qWkCkKO.exe
  2⤵
  PID:12180
- C:\Windows\System\ppZSAlk.exe
  C:\Windows\System\ppZSAlk.exe
  2⤵
  PID:11864
- C:\Windows\System\HyawakR.exe
  C:\Windows\System\HyawakR.exe
  2⤵
  PID:12312
- C:\Windows\System\daSJpdf.exe
  C:\Windows\System\daSJpdf.exe
  2⤵
  PID:12332
- C:\Windows\System\DYYhztb.exe
  C:\Windows\System\DYYhztb.exe
  2⤵
  PID:12352
- C:\Windows\System\GtWxaiM.exe
  C:\Windows\System\GtWxaiM.exe
  2⤵
  PID:12372
- C:\Windows\System\yaehgYV.exe
  C:\Windows\System\yaehgYV.exe
  2⤵
  PID:12396
- C:\Windows\System\RAizmhx.exe
  C:\Windows\System\RAizmhx.exe
  2⤵
  PID:12416
- C:\Windows\System\rkFfsye.exe
  C:\Windows\System\rkFfsye.exe
  2⤵
  PID:12440
- C:\Windows\System\XFoPcVN.exe
  C:\Windows\System\XFoPcVN.exe
  2⤵
  PID:12464
- C:\Windows\System\UfXIqWJ.exe
  C:\Windows\System\UfXIqWJ.exe
  2⤵
  PID:12496
- C:\Windows\System\JxWmxFg.exe
  C:\Windows\System\JxWmxFg.exe
  2⤵
  PID:12524
- C:\Windows\System\bqDZqDU.exe
  C:\Windows\System\bqDZqDU.exe
  2⤵
  PID:12548
- C:\Windows\System\slljgZr.exe
  C:\Windows\System\slljgZr.exe
  2⤵
  PID:12576
- C:\Windows\System\YugpWYD.exe
  C:\Windows\System\YugpWYD.exe
  2⤵
  PID:12600
- C:\Windows\System\VwgpAKg.exe
  C:\Windows\System\VwgpAKg.exe
  2⤵
  PID:12628
- C:\Windows\System\yrBuJJz.exe
  C:\Windows\System\yrBuJJz.exe
  2⤵
  PID:12648
- C:\Windows\System\ltJGfMT.exe
  C:\Windows\System\ltJGfMT.exe
  2⤵
  PID:12672
- C:\Windows\System\RHosfER.exe
  C:\Windows\System\RHosfER.exe
  2⤵
  PID:12700
- C:\Windows\System\plyrLcJ.exe
  C:\Windows\System\plyrLcJ.exe
  2⤵
  PID:12728
- C:\Windows\System\YNyBhzP.exe
  C:\Windows\System\YNyBhzP.exe
  2⤵
  PID:12752
- C:\Windows\System\bqlyiqE.exe
  C:\Windows\System\bqlyiqE.exe
  2⤵
  PID:12772
- C:\Windows\System\gziIAxj.exe
  C:\Windows\System\gziIAxj.exe
  2⤵
  PID:12796
- C:\Windows\System\SWqBwmH.exe
  C:\Windows\System\SWqBwmH.exe
  2⤵
  PID:12820
- C:\Windows\System\oNgDIOz.exe
  C:\Windows\System\oNgDIOz.exe
  2⤵
  PID:12848
- C:\Windows\System\VyzzhJR.exe
  C:\Windows\System\VyzzhJR.exe
  2⤵
  PID:12864
- C:\Windows\System\etulrYt.exe
  C:\Windows\System\etulrYt.exe
  2⤵
  PID:12892
- C:\Windows\System\DInRzLR.exe
  C:\Windows\System\DInRzLR.exe
  2⤵
  PID:12044
- C:\Windows\System\WXtjvxA.exe
  C:\Windows\System\WXtjvxA.exe
  2⤵
  PID:12148
- C:\Windows\System\wWFkJvy.exe
  C:\Windows\System\wWFkJvy.exe
  2⤵
  PID:11740
- C:\Windows\System\EkEvCCO.exe
  C:\Windows\System\EkEvCCO.exe
  2⤵
  PID:12120
- C:\Windows\System\WTDKaSX.exe
  C:\Windows\System\WTDKaSX.exe
  2⤵
  PID:12860
- C:\Windows\System\yhWJsFG.exe
  C:\Windows\System\yhWJsFG.exe
  2⤵
  PID:13048
- C:\Windows\System\gVpMegZ.exe
  C:\Windows\System\gVpMegZ.exe
  2⤵
  PID:12784
- C:\Windows\System\CCeSaAr.exe
  C:\Windows\System\CCeSaAr.exe
  2⤵
  PID:13088
- C:\Windows\System\WEPWMwP.exe
  C:\Windows\System\WEPWMwP.exe
  2⤵
  PID:13124
- C:\Windows\System\DgMMOGO.exe
  C:\Windows\System\DgMMOGO.exe
  2⤵
  PID:13168
- C:\Windows\System\VNMOUJi.exe
  C:\Windows\System\VNMOUJi.exe
  2⤵
  PID:11820
- C:\Windows\System\JNvPIvo.exe
  C:\Windows\System\JNvPIvo.exe
  2⤵
  PID:12208
- C:\Windows\System\yiWcqvj.exe
  C:\Windows\System\yiWcqvj.exe
  2⤵
  PID:12768
- C:\Windows\System\EGPAXAX.exe
  C:\Windows\System\EGPAXAX.exe
  2⤵
  PID:3024
- C:\Windows\System\KqXwyqp.exe
  C:\Windows\System\KqXwyqp.exe
  2⤵
  PID:13076
- C:\Windows\System\AGkbJMR.exe
  C:\Windows\System\AGkbJMR.exe
  2⤵
  PID:13276
- C:\Windows\System\ETCXpHF.exe
  C:\Windows\System\ETCXpHF.exe
  2⤵
  PID:10040
- C:\Windows\System\rKwefJZ.exe
  C:\Windows\System\rKwefJZ.exe
  2⤵
  PID:10292
- C:\Windows\System\GiksbFm.exe
  C:\Windows\System\GiksbFm.exe
  2⤵
  PID:11616
- C:\Windows\System\kQWjFVh.exe
  C:\Windows\System\kQWjFVh.exe
  2⤵
  PID:13284
- C:\Windows\System\ORhiUlz.exe
  C:\Windows\System\ORhiUlz.exe
  2⤵
  PID:11660
- C:\Windows\System\nTGODrI.exe
  C:\Windows\System\nTGODrI.exe
  2⤵
  PID:12412
- C:\Windows\System\qwuaGyG.exe
  C:\Windows\System\qwuaGyG.exe
  2⤵
  PID:12568
- C:\Windows\System\snarwZn.exe
  C:\Windows\System\snarwZn.exe
  2⤵
  PID:12668
- C:\Windows\System\lmIfyRj.exe
  C:\Windows\System\lmIfyRj.exe
  2⤵
  PID:7460
- C:\Windows\System\qWyEwVp.exe
  C:\Windows\System\qWyEwVp.exe
  2⤵
  PID:11792
- C:\Windows\System\bbMNEFj.exe
  C:\Windows\System\bbMNEFj.exe
  2⤵
  PID:13012
- C:\Windows\System\ApxOCiK.exe
  C:\Windows\System\ApxOCiK.exe
  2⤵
  PID:11408
- C:\Windows\System\kxVsruH.exe
  C:\Windows\System\kxVsruH.exe
  2⤵
  PID:12688
- C:\Windows\System\RCDJpDS.exe
  C:\Windows\System\RCDJpDS.exe
  2⤵
  PID:1628
- C:\Windows\System\DDwlnff.exe
  C:\Windows\System\DDwlnff.exe
  2⤵
  PID:13116
- C:\Windows\System\NWYiNJT.exe
  C:\Windows\System\NWYiNJT.exe
  2⤵
  PID:12804
- C:\Windows\System\MntQGVz.exe
  C:\Windows\System\MntQGVz.exe
  2⤵
  PID:980
- C:\Windows\System\NLNehrq.exe
  C:\Windows\System\NLNehrq.exe
  2⤵
  PID:10612
- C:\Windows\System\wPwlEuq.exe
  C:\Windows\System\wPwlEuq.exe
  2⤵
  PID:12948
- C:\Windows\System\HMYYJNg.exe
  C:\Windows\System\HMYYJNg.exe
  2⤵
  PID:5016
- C:\Windows\System\dcWtqOO.exe
  C:\Windows\System\dcWtqOO.exe
  2⤵
  PID:8980
- C:\Windows\System\edEgVaK.exe
  C:\Windows\System\edEgVaK.exe
  2⤵
  PID:4536
- C:\Windows\System\nWHLpaP.exe
  C:\Windows\System\nWHLpaP.exe
  2⤵
  PID:8864
- C:\Windows\System\ApOYfXU.exe
  C:\Windows\System\ApOYfXU.exe
  2⤵
  PID:452
- C:\Windows\System\mbCNfGq.exe
  C:\Windows\System\mbCNfGq.exe
  2⤵
  PID:4308
- C:\Windows\System\cmDEOAO.exe
  C:\Windows\System\cmDEOAO.exe
  2⤵
  PID:4732
- C:\Windows\System\oBfXhJS.exe
  C:\Windows\System\oBfXhJS.exe
  2⤵
  PID:12028
- C:\Windows\System\wYnWPov.exe
  C:\Windows\System\wYnWPov.exe
  2⤵
  PID:12640
- C:\Windows\System\lXKhBgC.exe
  C:\Windows\System\lXKhBgC.exe
  2⤵
  PID:428
- C:\Windows\System\AzARMdQ.exe
  C:\Windows\System\AzARMdQ.exe
  2⤵
  PID:2720
- C:\Windows\System\eLNZTEG.exe
  C:\Windows\System\eLNZTEG.exe
  2⤵
  PID:12584
- C:\Windows\System\KBtNzKx.exe
  C:\Windows\System\KBtNzKx.exe
  2⤵
  PID:12664
- C:\Windows\System\SoIrenx.exe
  C:\Windows\System\SoIrenx.exe
  2⤵
  PID:5080
- C:\Windows\System\ykHSXmz.exe
  C:\Windows\System\ykHSXmz.exe
  2⤵
  PID:3952
- C:\Windows\System\fDDEHQs.exe
  C:\Windows\System\fDDEHQs.exe
  2⤵
  PID:3616
- C:\Windows\System\bJdYVvn.exe
  C:\Windows\System\bJdYVvn.exe
  2⤵
  PID:3092
- C:\Windows\System\pYwrCuk.exe
  C:\Windows\System\pYwrCuk.exe
  2⤵
  PID:12964
- C:\Windows\System\lrmhwKw.exe
  C:\Windows\System\lrmhwKw.exe
  2⤵
  PID:11912
- C:\Windows\System\foOljnf.exe
  C:\Windows\System\foOljnf.exe
  2⤵
  PID:13296
- C:\Windows\System\NeJRwXS.exe
  C:\Windows\System\NeJRwXS.exe
  2⤵
  PID:1168
- C:\Windows\System\TYgQARp.exe
  C:\Windows\System\TYgQARp.exe
  2⤵
  PID:1768
- C:\Windows\System\ystVpzl.exe
  C:\Windows\System\ystVpzl.exe
  2⤵
  PID:12380
- C:\Windows\System\mnQDlIm.exe
  C:\Windows\System\mnQDlIm.exe
  2⤵
  PID:12920
- C:\Windows\System\WeRSXMP.exe
  C:\Windows\System\WeRSXMP.exe
  2⤵
  PID:376
- C:\Windows\System\pzrjSCc.exe
  C:\Windows\System\pzrjSCc.exe
  2⤵
  PID:3084
- C:\Windows\System\jxGUYIf.exe
  C:\Windows\System\jxGUYIf.exe
  2⤵
  PID:12304
- C:\Windows\System\jMlxTgs.exe
  C:\Windows\System\jMlxTgs.exe
  2⤵
  PID:12712
- C:\Windows\System\JWEMllk.exe
  C:\Windows\System\JWEMllk.exe
  2⤵
  PID:12692
- C:\Windows\System\ALMMIiS.exe
  C:\Windows\System\ALMMIiS.exe
  2⤵
  PID:4068
- C:\Windows\System\JpaXWnQ.exe
  C:\Windows\System\JpaXWnQ.exe
  2⤵
  PID:2608
- C:\Windows\System\SGOuvIU.exe
  C:\Windows\System\SGOuvIU.exe
  2⤵
  PID:3260
- C:\Windows\System\DDxahBE.exe
  C:\Windows\System\DDxahBE.exe
  2⤵
  PID:1696
- C:\Windows\System\nrJfXFU.exe
  C:\Windows\System\nrJfXFU.exe
  2⤵
  PID:2512
- C:\Windows\System\ZJnmhvq.exe
  C:\Windows\System\ZJnmhvq.exe
  2⤵
  PID:392
- C:\Windows\System\cAmmYjE.exe
  C:\Windows\System\cAmmYjE.exe
  2⤵
  PID:11936
- C:\Windows\System\PxUVRVM.exe
  C:\Windows\System\PxUVRVM.exe
  2⤵
  PID:3468
- C:\Windows\System\QMOrpcc.exe
  C:\Windows\System\QMOrpcc.exe
  2⤵
  PID:3724
- C:\Windows\System\IJQHnNc.exe
  C:\Windows\System\IJQHnNc.exe
  2⤵
  PID:2844
- C:\Windows\System\hqyaXXZ.exe
  C:\Windows\System\hqyaXXZ.exe
  2⤵
  PID:12832
- C:\Windows\System\iPhyfpA.exe
  C:\Windows\System\iPhyfpA.exe
  2⤵
  PID:11520
- C:\Windows\System\JvEPjZc.exe
  C:\Windows\System\JvEPjZc.exe
  2⤵
  PID:12556
- C:\Windows\System\vhbVveu.exe
  C:\Windows\System\vhbVveu.exe
  2⤵
  PID:1240
- C:\Windows\System\xzBqZjr.exe
  C:\Windows\System\xzBqZjr.exe
  2⤵
  PID:4892
- C:\Windows\System\UrrPUou.exe
  C:\Windows\System\UrrPUou.exe
  2⤵
  PID:4464
- C:\Windows\System\hPZOGOE.exe
  C:\Windows\System\hPZOGOE.exe
  2⤵
  PID:13184
- C:\Windows\System\EcDuCNB.exe
  C:\Windows\System\EcDuCNB.exe
  2⤵
  PID:12988
- C:\Windows\System\NBDNOkM.exe
  C:\Windows\System\NBDNOkM.exe
  2⤵
  PID:3220
- C:\Windows\System\YZSvyCU.exe
  C:\Windows\System\YZSvyCU.exe
  2⤵
  PID:12880
- C:\Windows\System\eLQylMg.exe
  C:\Windows\System\eLQylMg.exe
  2⤵
  PID:10140
- C:\Windows\System\wgSvZXF.exe
  C:\Windows\System\wgSvZXF.exe
  2⤵
  PID:12680
- C:\Windows\System\SGDZdcW.exe
  C:\Windows\System\SGDZdcW.exe
  2⤵
  PID:1032
- C:\Windows\System\PEfMzlN.exe
  C:\Windows\System\PEfMzlN.exe
  2⤵
  PID:1908
- C:\Windows\System\kjXdFLH.exe
  C:\Windows\System\kjXdFLH.exe
  2⤵
  PID:5064
- C:\Windows\System\KZeyIiz.exe
  C:\Windows\System\KZeyIiz.exe
  2⤵
  PID:4216
- C:\Windows\System\VjdAUJW.exe
  C:\Windows\System\VjdAUJW.exe
  2⤵
  PID:2308
- C:\Windows\System\bHZtEBA.exe
  C:\Windows\System\bHZtEBA.exe
  2⤵
  PID:3448
- C:\Windows\System\gsbJkhv.exe
  C:\Windows\System\gsbJkhv.exe
  2⤵
  PID:2820
- C:\Windows\System\CtdDMcY.exe
  C:\Windows\System\CtdDMcY.exe
  2⤵
  PID:3392
- C:\Windows\System\WVmEczl.exe
  C:\Windows\System\WVmEczl.exe
  2⤵
  PID:4940
- C:\Windows\System\yKTnmrd.exe
  C:\Windows\System\yKTnmrd.exe
  2⤵
  PID:4596
- C:\Windows\System\DZpIcXG.exe
  C:\Windows\System\DZpIcXG.exe
  2⤵
  PID:3656
- C:\Windows\System\RnAorVv.exe
  C:\Windows\System\RnAorVv.exe
  2⤵
  PID:4808
- C:\Windows\System\BvHxLlJ.exe
  C:\Windows\System\BvHxLlJ.exe
  2⤵
  PID:1856
- C:\Windows\System\oFEhGFe.exe
  C:\Windows\System\oFEhGFe.exe
  2⤵
  PID:13172
- C:\Windows\System\zvZVCMR.exe
  C:\Windows\System\zvZVCMR.exe
  2⤵
  PID:13000
- C:\Windows\System\MyJfhYW.exe
  C:\Windows\System\MyJfhYW.exe
  2⤵
  PID:3028
- C:\Windows\System\mDmHQMl.exe
  C:\Windows\System\mDmHQMl.exe
  2⤵
  PID:12292
- C:\Windows\System\HkMZGtr.exe
  C:\Windows\System\HkMZGtr.exe
  2⤵
  PID:12912
- C:\Windows\System\DljCLOM.exe
  C:\Windows\System\DljCLOM.exe
  2⤵
  PID:12404
- C:\Windows\System\gHixGkB.exe
  C:\Windows\System\gHixGkB.exe
  2⤵
  PID:4060
- C:\Windows\System\nVBvfHb.exe
  C:\Windows\System\nVBvfHb.exe
  2⤵
  PID:3080
- C:\Windows\System\SCwkaMm.exe
  C:\Windows\System\SCwkaMm.exe
  2⤵
  PID:1084
- C:\Windows\System\fhmEuAP.exe
  C:\Windows\System\fhmEuAP.exe
  2⤵
  PID:12616
- C:\Windows\System\AaGbDUz.exe
  C:\Windows\System\AaGbDUz.exe
  2⤵
  PID:408
- C:\Windows\System\CCJVxkO.exe
  C:\Windows\System\CCJVxkO.exe
  2⤵
  PID:1904
- C:\Windows\System\wgDYeFx.exe
  C:\Windows\System\wgDYeFx.exe
  2⤵
  PID:2432
- C:\Windows\System\OfXZvEg.exe
  C:\Windows\System\OfXZvEg.exe
  2⤵
  PID:4984
- C:\Windows\System\BFGgQOb.exe
  C:\Windows\System\BFGgQOb.exe
  2⤵
  PID:832
- C:\Windows\System\xaQygfG.exe
  C:\Windows\System\xaQygfG.exe
  2⤵
  PID:2724
- C:\Windows\System\SoeQzYz.exe
  C:\Windows\System\SoeQzYz.exe
  2⤵
  PID:4436
- C:\Windows\System\STUjNCW.exe
  C:\Windows\System\STUjNCW.exe
  2⤵
  PID:3960
- C:\Windows\System\JmYLQRO.exe
  C:\Windows\System\JmYLQRO.exe
  2⤵
  PID:11676
- C:\Windows\System\svKrxDd.exe
  C:\Windows\System\svKrxDd.exe
  2⤵
  PID:3344
- C:\Windows\System\VfFuLuZ.exe
  C:\Windows\System\VfFuLuZ.exe
  2⤵
  PID:212
- C:\Windows\System\cFYPrxf.exe
  C:\Windows\System\cFYPrxf.exe
  2⤵
  PID:4708
- C:\Windows\System\cVJKLlB.exe
  C:\Windows\System\cVJKLlB.exe
  2⤵
  PID:2276
- C:\Windows\System\OMIClFS.exe
  C:\Windows\System\OMIClFS.exe
  2⤵
  PID:3928
- C:\Windows\System\iHhwXpX.exe
  C:\Windows\System\iHhwXpX.exe
  2⤵
  PID:12936
- C:\Windows\System\ZyMLWGC.exe
  C:\Windows\System\ZyMLWGC.exe
  2⤵
  PID:736
- C:\Windows\System\aKPTBzK.exe
  C:\Windows\System\aKPTBzK.exe
  2⤵
  PID:2472
- C:\Windows\System\wADFryA.exe
  C:\Windows\System\wADFryA.exe
  2⤵
  PID:2872
- C:\Windows\System\EsBoWhV.exe
  C:\Windows\System\EsBoWhV.exe
  2⤵
  PID:12888
- C:\Windows\System\chULgTO.exe
  C:\Windows\System\chULgTO.exe
  2⤵
  PID:2312
- C:\Windows\System\dnePehU.exe
  C:\Windows\System\dnePehU.exe
  2⤵
  PID:12644
- C:\Windows\System\hOSZMxV.exe
  C:\Windows\System\hOSZMxV.exe
  2⤵
  PID:11712
- C:\Windows\System\YFNTgIV.exe
  C:\Windows\System\YFNTgIV.exe
  2⤵
  PID:912
- C:\Windows\System\xHfjBcy.exe
  C:\Windows\System\xHfjBcy.exe
  2⤵
  PID:12300
- C:\Windows\System\RVaBtaJ.exe
  C:\Windows\System\RVaBtaJ.exe
  2⤵
  PID:5036
- C:\Windows\System\YytlMjl.exe
  C:\Windows\System\YytlMjl.exe
  2⤵
  PID:3440
- C:\Windows\System\SxfJmfm.exe
  C:\Windows\System\SxfJmfm.exe
  2⤵
  PID:12984
- C:\Windows\System\OEiMLfz.exe
  C:\Windows\System\OEiMLfz.exe
  2⤵
  PID:3020
- C:\Windows\System\uEhCTbV.exe
  C:\Windows\System\uEhCTbV.exe
  2⤵
  PID:4672
- C:\Windows\System\tBtBnxR.exe
  C:\Windows\System\tBtBnxR.exe
  2⤵
  PID:400
- C:\Windows\System\ARyNzZI.exe
  C:\Windows\System\ARyNzZI.exe
  2⤵
  PID:2288
- C:\Windows\System\esTlGZu.exe
  C:\Windows\System\esTlGZu.exe
  2⤵
  PID:3324
- C:\Windows\System\NKNKYpy.exe
  C:\Windows\System\NKNKYpy.exe
  2⤵
  PID:3984
- C:\Windows\System\ugSURRa.exe
  C:\Windows\System\ugSURRa.exe
  2⤵
  PID:12764
- C:\Windows\System\UzwIDHu.exe
  C:\Windows\System\UzwIDHu.exe
  2⤵
  PID:12328
- C:\Windows\System\SKHuhFL.exe
  C:\Windows\System\SKHuhFL.exe
  2⤵
  PID:3248
- C:\Windows\System\lmdfXIn.exe
  C:\Windows\System\lmdfXIn.exe
  2⤵
  PID:2028
- C:\Windows\System\sajkVuN.exe
  C:\Windows\System\sajkVuN.exe
  2⤵
  PID:4744
- C:\Windows\System\Adihmnl.exe
  C:\Windows\System\Adihmnl.exe
  2⤵
  PID:3716
- C:\Windows\System\BJcDUXS.exe
  C:\Windows\System\BJcDUXS.exe
  2⤵
  PID:3964
- C:\Windows\System\KqQMYSI.exe
  C:\Windows\System\KqQMYSI.exe
  2⤵
  PID:12512
- C:\Windows\System\xpDfsEU.exe
  C:\Windows\System\xpDfsEU.exe
  2⤵
  PID:3840
- C:\Windows\System\bQxDJcG.exe
  C:\Windows\System\bQxDJcG.exe
  2⤵
  PID:4160
- C:\Windows\System\DhJtxay.exe
  C:\Windows\System\DhJtxay.exe
  2⤵
  PID:3372
- C:\Windows\System\vtOWwgc.exe
  C:\Windows\System\vtOWwgc.exe
  2⤵
  PID:4804
- C:\Windows\System\DehQTQS.exe
  C:\Windows\System\DehQTQS.exe
  2⤵
  PID:3660
- C:\Windows\System\yAMeefH.exe
  C:\Windows\System\yAMeefH.exe
  2⤵
  PID:2900
- C:\Windows\System\HfoTUUT.exe
  C:\Windows\System\HfoTUUT.exe
  2⤵
  PID:2620
- C:\Windows\System\ZfoZxUE.exe
  C:\Windows\System\ZfoZxUE.exe
  2⤵
  PID:1880
- C:\Windows\System\EtMNfdl.exe
  C:\Windows\System\EtMNfdl.exe
  2⤵
  PID:4884
- C:\Windows\System\WDoJsJu.exe
  C:\Windows\System\WDoJsJu.exe
  2⤵
  PID:12924
- C:\Windows\System\gJPWdql.exe
  C:\Windows\System\gJPWdql.exe
  2⤵
  PID:540
- C:\Windows\System\dwLAlHz.exe
  C:\Windows\System\dwLAlHz.exe
  2⤵
  PID:2968
- C:\Windows\System\KKVUTKM.exe
  C:\Windows\System\KKVUTKM.exe
  2⤵
  PID:628
- C:\Windows\System\sidDYBh.exe
  C:\Windows\System\sidDYBh.exe
  2⤵
  PID:1948
- C:\Windows\System\CUHmWSC.exe
  C:\Windows\System\CUHmWSC.exe
  2⤵
  PID:1112
- C:\Windows\System\feqBJOt.exe
  C:\Windows\System\feqBJOt.exe
  2⤵
  PID:2036
- C:\Windows\System\fHXhAMe.exe
  C:\Windows\System\fHXhAMe.exe
  2⤵
  PID:5076
- C:\Windows\System\XvHrujo.exe
  C:\Windows\System\XvHrujo.exe
  2⤵
  PID:4528
- C:\Windows\System\dXKvgOe.exe
  C:\Windows\System\dXKvgOe.exe
  2⤵
  PID:3352
- C:\Windows\System\OHWKZTo.exe
  C:\Windows\System\OHWKZTo.exe
  2⤵
  PID:3604
- C:\Windows\System\sehJmce.exe
  C:\Windows\System\sehJmce.exe
  2⤵
  PID:3712
- C:\Windows\System\trdPdGi.exe
  C:\Windows\System\trdPdGi.exe
  2⤵
  PID:11860
- C:\Windows\System\sGpYrhi.exe
  C:\Windows\System\sGpYrhi.exe
  2⤵
  PID:11604
- C:\Windows\System\kxVQueE.exe
  C:\Windows\System\kxVQueE.exe
  2⤵
  PID:13328
- C:\Windows\System\VXdOQnj.exe
  C:\Windows\System\VXdOQnj.exe
  2⤵
  PID:13344
- C:\Windows\System\aKpZUNR.exe
  C:\Windows\System\aKpZUNR.exe
  2⤵
  PID:13360
- C:\Windows\System\TzClyQk.exe
  C:\Windows\System\TzClyQk.exe
  2⤵
  PID:13376
- C:\Windows\System\EQOenWz.exe
  C:\Windows\System\EQOenWz.exe
  2⤵
  PID:13396
- C:\Windows\System\XSkaoRM.exe
  C:\Windows\System\XSkaoRM.exe
  2⤵
  PID:13412
- C:\Windows\System\BBlnOFh.exe
  C:\Windows\System\BBlnOFh.exe
  2⤵
  PID:13428
- C:\Windows\System\pSnYbjb.exe
  C:\Windows\System\pSnYbjb.exe
  2⤵
  PID:13444
- C:\Windows\System\KhVpsyr.exe
  C:\Windows\System\KhVpsyr.exe
  2⤵
  PID:13460
- C:\Windows\System\lDZnkYW.exe
  C:\Windows\System\lDZnkYW.exe
  2⤵
  PID:13476
- C:\Windows\System\CNQurRo.exe
  C:\Windows\System\CNQurRo.exe
  2⤵
  PID:13492
- C:\Windows\System\LlPvDez.exe
  C:\Windows\System\LlPvDez.exe
  2⤵
  PID:13508
- C:\Windows\System\qfyXYXE.exe
  C:\Windows\System\qfyXYXE.exe
  2⤵
  PID:13532
- C:\Windows\System\nnDdvtr.exe
  C:\Windows\System\nnDdvtr.exe
  2⤵
  PID:13564
- C:\Windows\System\vyOTrTd.exe
  C:\Windows\System\vyOTrTd.exe
  2⤵
  PID:13592
- C:\Windows\System\WBUoJmP.exe
  C:\Windows\System\WBUoJmP.exe
  2⤵
  PID:13620
- C:\Windows\System\wcLVOxT.exe
  C:\Windows\System\wcLVOxT.exe
  2⤵
  PID:13636
- C:\Windows\System\aoFCPel.exe
  C:\Windows\System\aoFCPel.exe
  2⤵
  PID:13672
- C:\Windows\System\flBBzUm.exe
  C:\Windows\System\flBBzUm.exe
  2⤵
  PID:13700
- C:\Windows\System\bMHHPmJ.exe
  C:\Windows\System\bMHHPmJ.exe
  2⤵
  PID:13724
- C:\Windows\System\jFAqglF.exe
  C:\Windows\System\jFAqglF.exe
  2⤵
  PID:13740
- C:\Windows\System\KEYROma.exe
  C:\Windows\System\KEYROma.exe
  2⤵
  PID:13756
- C:\Windows\System\MYKJqrl.exe
  C:\Windows\System\MYKJqrl.exe
  2⤵
  PID:13772
- C:\Windows\System\tWehzqy.exe
  C:\Windows\System\tWehzqy.exe
  2⤵
  PID:13788
- C:\Windows\System\NhptEIa.exe
  C:\Windows\System\NhptEIa.exe
  2⤵
  PID:13804
- C:\Windows\System\WZYtsfd.exe
  C:\Windows\System\WZYtsfd.exe
  2⤵
  PID:13844
- C:\Windows\System\WOQIXFB.exe
  C:\Windows\System\WOQIXFB.exe
  2⤵
  PID:13868
- C:\Windows\System\LDBMUpz.exe
  C:\Windows\System\LDBMUpz.exe
  2⤵
  PID:13884
- C:\Windows\System\gWiIohL.exe
  C:\Windows\System\gWiIohL.exe
  2⤵
  PID:13912
- C:\Windows\System\oWkGqXx.exe
  C:\Windows\System\oWkGqXx.exe
  2⤵
  PID:13928
- C:\Windows\System\JRtNxMf.exe
  C:\Windows\System\JRtNxMf.exe
  2⤵
  PID:13956
- C:\Windows\System\ddojGfW.exe
  C:\Windows\System\ddojGfW.exe
  2⤵
  PID:13972
- C:\Windows\System\wjEbpVd.exe
  C:\Windows\System\wjEbpVd.exe
  2⤵
  PID:13988
- C:\Windows\System\BnWVELp.exe
  C:\Windows\System\BnWVELp.exe
  2⤵
  PID:14004
- C:\Windows\System\lFpnEwC.exe
  C:\Windows\System\lFpnEwC.exe
  2⤵
  PID:14020
- C:\Windows\System\FeckPlW.exe
  C:\Windows\System\FeckPlW.exe
  2⤵
  PID:14036
- C:\Windows\System\eZcRChn.exe
  C:\Windows\System\eZcRChn.exe
  2⤵
  PID:14052
- C:\Windows\System\OkhdCow.exe
  C:\Windows\System\OkhdCow.exe
  2⤵
  PID:14068
- C:\Windows\System\bnckGWo.exe
  C:\Windows\System\bnckGWo.exe
  2⤵
  PID:14084
- C:\Windows\System\kzoNgLW.exe
  C:\Windows\System\kzoNgLW.exe
  2⤵
  PID:14100
- C:\Windows\System\ElrMWHt.exe
  C:\Windows\System\ElrMWHt.exe
  2⤵
  PID:14136
- C:\Windows\System\TxElSNI.exe
  C:\Windows\System\TxElSNI.exe
  2⤵
  PID:14152
- C:\Windows\System\pJuYXCm.exe
  C:\Windows\System\pJuYXCm.exe
  2⤵
  PID:14172
- C:\Windows\System\piQZWmr.exe
  C:\Windows\System\piQZWmr.exe
  2⤵
  PID:14188
- C:\Windows\System\BxFEvVW.exe
  C:\Windows\System\BxFEvVW.exe
  2⤵
  PID:14204
- C:\Windows\System\fKGZBJL.exe
  C:\Windows\System\fKGZBJL.exe
  2⤵
  PID:14220
- C:\Windows\System\AmPqYlp.exe
  C:\Windows\System\AmPqYlp.exe
  2⤵
  PID:14236
- C:\Windows\System\GMwmTZY.exe
  C:\Windows\System\GMwmTZY.exe
  2⤵
  PID:14252
- C:\Windows\System\DPszWsK.exe
  C:\Windows\System\DPszWsK.exe
  2⤵
  PID:14268
- C:\Windows\System\VXKHPjD.exe
  C:\Windows\System\VXKHPjD.exe
  2⤵
  PID:14284
- C:\Windows\System\YBnBgaT.exe
  C:\Windows\System\YBnBgaT.exe
  2⤵
  PID:14300
- C:\Windows\System\cTQcPiD.exe
  C:\Windows\System\cTQcPiD.exe
  2⤵
  PID:14316
- C:\Windows\System\GyQenYE.exe
  C:\Windows\System\GyQenYE.exe
  2⤵
  PID:14332
- C:\Windows\System\ITIQqTH.exe
  C:\Windows\System\ITIQqTH.exe
  2⤵
  PID:13336
- C:\Windows\System\ceesnax.exe
  C:\Windows\System\ceesnax.exe
  2⤵
  PID:13368
- C:\Windows\System\WeCqdng.exe
  C:\Windows\System\WeCqdng.exe
  2⤵
  PID:13392
- C:\Windows\System\NmLYmEl.exe
  C:\Windows\System\NmLYmEl.exe
  2⤵
  PID:13424
- C:\Windows\System\zVYYWEx.exe
  C:\Windows\System\zVYYWEx.exe
  2⤵
  PID:13456
- C:\Windows\System\oGpfVIF.exe
  C:\Windows\System\oGpfVIF.exe
  2⤵
  PID:13484
- C:\Windows\System\qzuEjZD.exe
  C:\Windows\System\qzuEjZD.exe
  2⤵
  PID:13516
- C:\Windows\System\hXMFMcg.exe
  C:\Windows\System\hXMFMcg.exe
  2⤵
  PID:13540
- C:\Windows\System\OGDMlTy.exe
  C:\Windows\System\OGDMlTy.exe
  2⤵
  PID:13576
- C:\Windows\System\zqeheCk.exe
  C:\Windows\System\zqeheCk.exe
  2⤵
  PID:13600
- C:\Windows\System\tHJKHcF.exe
  C:\Windows\System\tHJKHcF.exe
  2⤵
  PID:13556
- C:\Windows\System\eXQVLkY.exe
  C:\Windows\System\eXQVLkY.exe
  2⤵
  PID:13548
- C:\Windows\System\IbyWDEH.exe
  C:\Windows\System\IbyWDEH.exe
  2⤵
  PID:3400
- C:\Windows\System\OlMLlnx.exe
  C:\Windows\System\OlMLlnx.exe
  2⤵
  PID:13664
- C:\Windows\System\DiCZjRK.exe
  C:\Windows\System\DiCZjRK.exe
  2⤵
  PID:13644
- C:\Windows\System\zHbvCQj.exe
  C:\Windows\System\zHbvCQj.exe
  2⤵
  PID:13712
- C:\Windows\System\iCDAfKx.exe
  C:\Windows\System\iCDAfKx.exe
  2⤵
  PID:13752
- C:\Windows\System\vAftWum.exe
  C:\Windows\System\vAftWum.exe
  2⤵
  PID:13780
- C:\Windows\System\QiEKkvp.exe
  C:\Windows\System\QiEKkvp.exe
  2⤵
  PID:13812
- C:\Windows\System\GgeLuom.exe
  C:\Windows\System\GgeLuom.exe
  2⤵
  PID:13840
- C:\Windows\System\EGgbtOK.exe
  C:\Windows\System\EGgbtOK.exe
  2⤵
  PID:13876
- C:\Windows\System\QNiLtLO.exe
  C:\Windows\System\QNiLtLO.exe
  2⤵
  PID:13836
- C:\Windows\System\UrRqBce.exe
  C:\Windows\System\UrRqBce.exe
  2⤵
  PID:13684
- C:\Windows\System\ECCtFbM.exe
  C:\Windows\System\ECCtFbM.exe
  2⤵
  PID:4500
- C:\Windows\System\ebEMoUP.exe
  C:\Windows\System\ebEMoUP.exe
  2⤵
  PID:2740
- C:\Windows\System\CcHJsdl.exe
  C:\Windows\System\CcHJsdl.exe
  2⤵
  PID:13908
- C:\Windows\System\oiPiQdX.exe
  C:\Windows\System\oiPiQdX.exe
  2⤵
  PID:1500
- C:\Windows\System\KRHHYAm.exe
  C:\Windows\System\KRHHYAm.exe
  2⤵
  PID:13952
- C:\Windows\System\vsDbwHA.exe
  C:\Windows\System\vsDbwHA.exe
  2⤵
  PID:388
- C:\Windows\System\jrfUneT.exe
  C:\Windows\System\jrfUneT.exe
  2⤵
  PID:14000
- C:\Windows\System\cqPHsyl.exe
  C:\Windows\System\cqPHsyl.exe
  2⤵
  PID:14032
- C:\Windows\System\HsoHxHC.exe
  C:\Windows\System\HsoHxHC.exe
  2⤵
  PID:14064
- C:\Windows\System\ZvkOPlf.exe
  C:\Windows\System\ZvkOPlf.exe
  2⤵
  PID:14096
- C:\Windows\System\LkkGdab.exe
  C:\Windows\System\LkkGdab.exe
  2⤵
  PID:14216
- C:\Windows\System\GKLBAaC.exe
  C:\Windows\System\GKLBAaC.exe
  2⤵
  PID:14248
- C:\Windows\System\JEExfHq.exe
  C:\Windows\System\JEExfHq.exe
  2⤵
  PID:14280
- C:\Windows\System\AvwVowz.exe
  C:\Windows\System\AvwVowz.exe
  2⤵
  PID:14312
- C:\Windows\System\wfbpHtH.exe
  C:\Windows\System\wfbpHtH.exe
  2⤵
  PID:3972
- C:\Windows\System\YFUdzDA.exe
  C:\Windows\System\YFUdzDA.exe
  2⤵
  PID:13584
- C:\Windows\System\opmAYdk.exe
  C:\Windows\System\opmAYdk.exe
  2⤵
  PID:3336
- C:\Windows\System\pLiUQPs.exe
  C:\Windows\System\pLiUQPs.exe
  2⤵
  PID:13668
- C:\Windows\System\wsAmkTM.exe
  C:\Windows\System\wsAmkTM.exe
  2⤵
  PID:13652
- C:\Windows\System\BPjwiXV.exe
  C:\Windows\System\BPjwiXV.exe
  2⤵
  PID:13748
- C:\Windows\System\OdHASOx.exe
  C:\Windows\System\OdHASOx.exe
  2⤵
  PID:13820
- C:\Windows\System\mEzhsVZ.exe
  C:\Windows\System\mEzhsVZ.exe
  2⤵
  PID:13864
- C:\Windows\System\HEkcVkq.exe
  C:\Windows\System\HEkcVkq.exe
  2⤵
  PID:13708
- C:\Windows\System\asOhCqM.exe
  C:\Windows\System\asOhCqM.exe
  2⤵
  PID:2272
- C:\Windows\System\gskowdr.exe
  C:\Windows\System\gskowdr.exe
  2⤵
  PID:1540
- C:\Windows\System\WDBnPMn.exe
  C:\Windows\System\WDBnPMn.exe
  2⤵
  PID:13968
- C:\Windows\System\hHKSGJq.exe
  C:\Windows\System\hHKSGJq.exe
  2⤵
  PID:14060
- C:\Windows\System\AJzcSum.exe
  C:\Windows\System\AJzcSum.exe
  2⤵
  PID:14144
- C:\Windows\System\mCqECdr.exe
  C:\Windows\System\mCqECdr.exe
  2⤵
  PID:14212
- C:\Windows\System\VfebNDj.exe
  C:\Windows\System\VfebNDj.exe
  2⤵
  PID:14168
- C:\Windows\System\DPEjHLb.exe
  C:\Windows\System\DPEjHLb.exe
  2⤵
  PID:14196
- C:\Windows\System\CWCEMWz.exe
  C:\Windows\System\CWCEMWz.exe
  2⤵
  PID:13320
- C:\Windows\System\kWKrlMr.exe
  C:\Windows\System\kWKrlMr.exe
  2⤵
  PID:13420
- C:\Windows\System\cCaHyRn.exe
  C:\Windows\System\cCaHyRn.exe
  2⤵
  PID:13472
- C:\Windows\System\WYqWUgc.exe
  C:\Windows\System\WYqWUgc.exe
  2⤵
  PID:13616
- C:\Windows\System\uBarpNQ.exe
  C:\Windows\System\uBarpNQ.exe
  2⤵
  PID:13716
- C:\Windows\System\QhABdRi.exe
  C:\Windows\System\QhABdRi.exe
  2⤵
  PID:13860
- C:\Windows\System\OQbEwan.exe
  C:\Windows\System\OQbEwan.exe
  2⤵
  PID:1516
- C:\Windows\System\mDNyDpE.exe
  C:\Windows\System\mDNyDpE.exe
  2⤵
  PID:2324
- C:\Windows\System\HYiuLWz.exe
  C:\Windows\System\HYiuLWz.exe
  2⤵
  PID:14048
- C:\Windows\System\FZLCzbK.exe
  C:\Windows\System\FZLCzbK.exe
  2⤵
  PID:14128
- C:\Windows\System\EUtCpii.exe
  C:\Windows\System\EUtCpii.exe
  2⤵
  PID:14276
- C:\Windows\System\qggtTzk.exe
  C:\Windows\System\qggtTzk.exe
  2⤵
  PID:13528
- C:\Windows\System\QsUWXHW.exe
  C:\Windows\System\QsUWXHW.exe
  2⤵
  PID:2600
- C:\Windows\System\iYkFMfg.exe
  C:\Windows\System\iYkFMfg.exe
  2⤵
  PID:2240
- C:\Windows\System\iyWpNRC.exe
  C:\Windows\System\iyWpNRC.exe
  2⤵
  PID:13688
- C:\Windows\System\CaNJrLx.exe
  C:\Windows\System\CaNJrLx.exe
  2⤵
  PID:1928
- C:\Windows\System\RidQKSK.exe
  C:\Windows\System\RidQKSK.exe
  2⤵
  PID:14028
- C:\Windows\System\NQshuwn.exe
  C:\Windows\System\NQshuwn.exe
  2⤵
  PID:14200
- C:\Windows\System\NYcxrMR.exe
  C:\Windows\System\NYcxrMR.exe
  2⤵
  PID:976
- C:\Windows\System\MNfDslf.exe
  C:\Windows\System\MNfDslf.exe
  2⤵
  PID:13648
- C:\Windows\System\YBHdClJ.exe
  C:\Windows\System\YBHdClJ.exe
  2⤵
  PID:13964
- C:\Windows\System\kvnaREd.exe
  C:\Windows\System\kvnaREd.exe
  2⤵
  PID:14232
- C:\Windows\System\tFrKQVs.exe
  C:\Windows\System\tFrKQVs.exe
  2⤵
  PID:3892
- C:\Windows\System\CouPFkF.exe
  C:\Windows\System\CouPFkF.exe
  2⤵
  PID:2936
- C:\Windows\System\GMphwOr.exe
  C:\Windows\System\GMphwOr.exe
  2⤵
  PID:14120
- C:\Windows\System\IvfhDZX.exe
  C:\Windows\System\IvfhDZX.exe
  2⤵
  PID:12088
- C:\Windows\System\PrgbOWK.exe
  C:\Windows\System\PrgbOWK.exe
  2⤵
  PID:13612
- C:\Windows\System\oVxnDQk.exe
  C:\Windows\System\oVxnDQk.exe
  2⤵
  PID:13680
- C:\Windows\System\xKQuIZb.exe
  C:\Windows\System\xKQuIZb.exe
  2⤵
  PID:14132
- C:\Windows\System\hcnNEGH.exe
  C:\Windows\System\hcnNEGH.exe
  2⤵
  PID:13404
- C:\Windows\System\bEYHqoj.exe
  C:\Windows\System\bEYHqoj.exe
  2⤵
  PID:4080
- C:\Windows\System\nZBajnB.exe
  C:\Windows\System\nZBajnB.exe
  2⤵
  PID:14116
- C:\Windows\System\hjfqrfO.exe
  C:\Windows\System\hjfqrfO.exe
  2⤵
  PID:4428
- C:\Windows\System\bFUFQKn.exe
  C:\Windows\System\bFUFQKn.exe
  2⤵
  PID:4380
- C:\Windows\System\JzPmlVc.exe
  C:\Windows\System\JzPmlVc.exe
  2⤵
  PID:3576
- C:\Windows\System\ZBVbaQY.exe
  C:\Windows\System\ZBVbaQY.exe
  2⤵
  PID:2772
- C:\Windows\System\vTgtiiM.exe
  C:\Windows\System\vTgtiiM.exe
  2⤵
  PID:3016
- C:\Windows\System\WxPBQYv.exe
  C:\Windows\System\WxPBQYv.exe
  2⤵
  PID:2428
- C:\Windows\System\vSAAZMF.exe
  C:\Windows\System\vSAAZMF.exe
  2⤵
  PID:4932
- C:\Windows\System\UlcgtDw.exe
  C:\Windows\System\UlcgtDw.exe
  2⤵
  PID:968
- C:\Windows\System\VCmeqKM.exe
  C:\Windows\System\VCmeqKM.exe
  2⤵
  PID:13388
- C:\Windows\System\wDyipYP.exe
  C:\Windows\System\wDyipYP.exe
  2⤵
  PID:2348
- C:\Windows\System\pybNnkV.exe
  C:\Windows\System\pybNnkV.exe
  2⤵
  PID:3088
- C:\Windows\System\ZgNPKWT.exe
  C:\Windows\System\ZgNPKWT.exe
  2⤵
  PID:3588
- C:\Windows\System\sjmKIFJ.exe
  C:\Windows\System\sjmKIFJ.exe
  2⤵
  PID:4824
- C:\Windows\System\LCMRsOI.exe
  C:\Windows\System\LCMRsOI.exe
  2⤵
  PID:13936
- C:\Windows\System\hbfdSBL.exe
  C:\Windows\System\hbfdSBL.exe
  2⤵
  PID:464
- C:\Windows\System\CdUAvce.exe
  C:\Windows\System\CdUAvce.exe
  2⤵
  PID:5400
- C:\Windows\System\XtEBfmQ.exe
  C:\Windows\System\XtEBfmQ.exe
  2⤵
  PID:5164
- C:\Windows\System\JEzxEJd.exe
  C:\Windows\System\JEzxEJd.exe
  2⤵
  PID:4456
- C:\Windows\System\aUBkBqA.exe
  C:\Windows\System\aUBkBqA.exe
  2⤵
  PID:5136
- C:\Windows\System\XBrFNEv.exe
  C:\Windows\System\XBrFNEv.exe
  2⤵
  PID:5172
- C:\Windows\System\aVZiwKF.exe
  C:\Windows\System\aVZiwKF.exe
  2⤵
  PID:1452
- C:\Windows\System\DHuAREA.exe
  C:\Windows\System\DHuAREA.exe
  2⤵
  PID:14352
- C:\Windows\System\PIwhVpo.exe
  C:\Windows\System\PIwhVpo.exe
  2⤵
  PID:14400
- C:\Windows\System\HgNLVaC.exe
  C:\Windows\System\HgNLVaC.exe
  2⤵
  PID:14424
- C:\Windows\System\XdMDKMT.exe
  C:\Windows\System\XdMDKMT.exe
  2⤵
  PID:14440
- C:\Windows\System\XYbBBAM.exe
  C:\Windows\System\XYbBBAM.exe
  2⤵
  PID:14464
- C:\Windows\System\fvnPTrn.exe
  C:\Windows\System\fvnPTrn.exe
  2⤵
  PID:14504
- C:\Windows\System\qyVocVd.exe
  C:\Windows\System\qyVocVd.exe
  2⤵
  PID:14520
- C:\Windows\System\SjDpgsu.exe
  C:\Windows\System\SjDpgsu.exe
  2⤵
  PID:14536
- C:\Windows\System\aihPnHT.exe
  C:\Windows\System\aihPnHT.exe
  2⤵
  PID:14572
- C:\Windows\System\hAPIdav.exe
  C:\Windows\System\hAPIdav.exe
  2⤵
  PID:14592
- C:\Windows\System\nlBrSjo.exe
  C:\Windows\System\nlBrSjo.exe
  2⤵
  PID:14616
- C:\Windows\System\mAtbTzI.exe
  C:\Windows\System\mAtbTzI.exe
  2⤵
  PID:14640
- C:\Windows\System\LLMvqqc.exe
  C:\Windows\System\LLMvqqc.exe
  2⤵
  PID:14664
- C:\Windows\System\WDxfVEw.exe
  C:\Windows\System\WDxfVEw.exe
  2⤵
  PID:14688
- C:\Windows\System\CEiuMfJ.exe
  C:\Windows\System\CEiuMfJ.exe
  2⤵
  PID:14708
- C:\Windows\System\EWyNKYh.exe
  C:\Windows\System\EWyNKYh.exe
  2⤵
  PID:14728
- C:\Windows\System\AKoGJLR.exe
  C:\Windows\System\AKoGJLR.exe
  2⤵
  PID:14752
- C:\Windows\System\KnppzdN.exe
  C:\Windows\System\KnppzdN.exe
  2⤵
  PID:14772
- C:\Windows\System\GFgdanB.exe
  C:\Windows\System\GFgdanB.exe
  2⤵
  PID:14792
- C:\Windows\System\hYEzjXJ.exe
  C:\Windows\System\hYEzjXJ.exe
  2⤵
  PID:14816
- C:\Windows\System\IcpDHVD.exe
  C:\Windows\System\IcpDHVD.exe
  2⤵
  PID:14840
- C:\Windows\System\MtVmqHO.exe
  C:\Windows\System\MtVmqHO.exe
  2⤵
  PID:14860
- C:\Windows\System\AcVmMal.exe
  C:\Windows\System\AcVmMal.exe
  2⤵
  PID:14880
- C:\Windows\System\qnwJNBM.exe
  C:\Windows\System\qnwJNBM.exe
  2⤵
  PID:14900
- C:\Windows\System\SlCrjbR.exe
  C:\Windows\System\SlCrjbR.exe
  2⤵
  PID:14920
- C:\Windows\System\wuoDGjF.exe
  C:\Windows\System\wuoDGjF.exe
  2⤵
  PID:14940
- C:\Windows\System\ZqDtIuP.exe
  C:\Windows\System\ZqDtIuP.exe
  2⤵
  PID:14964
- C:\Windows\System\IswUefD.exe
  C:\Windows\System\IswUefD.exe
  2⤵
  PID:14988
- C:\Windows\System\Ouzszrz.exe
  C:\Windows\System\Ouzszrz.exe
  2⤵
  PID:15016
- C:\Windows\System\pBqArlR.exe
  C:\Windows\System\pBqArlR.exe
  2⤵
  PID:15036
- C:\Windows\System\ElFQvmB.exe
  C:\Windows\System\ElFQvmB.exe
  2⤵
  PID:15056
- C:\Windows\System\wcsOoap.exe
  C:\Windows\System\wcsOoap.exe
  2⤵
  PID:15076
- C:\Windows\System\BWiKNHp.exe
  C:\Windows\System\BWiKNHp.exe
  2⤵
  PID:15096
- C:\Windows\System\lDwyRaE.exe
  C:\Windows\System\lDwyRaE.exe
  2⤵
  PID:15116
- C:\Windows\System\kIyswoJ.exe
  C:\Windows\System\kIyswoJ.exe
  2⤵
  PID:15136
- C:\Windows\System\cAlIzkN.exe
  C:\Windows\System\cAlIzkN.exe
  2⤵
  PID:15160
- C:\Windows\System\FcNUwpA.exe
  C:\Windows\System\FcNUwpA.exe
  2⤵
  PID:15180
- C:\Windows\System\IVTYTsI.exe
  C:\Windows\System\IVTYTsI.exe
  2⤵
  PID:15204
- C:\Windows\System\RuYFeKJ.exe
  C:\Windows\System\RuYFeKJ.exe
  2⤵
  PID:15224
- C:\Windows\System\vTlMrKx.exe
  C:\Windows\System\vTlMrKx.exe
  2⤵
  PID:15244
- C:\Windows\System\jsdWMwL.exe
  C:\Windows\System\jsdWMwL.exe
  2⤵
  PID:15264
- C:\Windows\System\iwcuBzD.exe
  C:\Windows\System\iwcuBzD.exe
  2⤵
  PID:15292
- C:\Windows\System\vJffUio.exe
  C:\Windows\System\vJffUio.exe
  2⤵
  PID:15316
- C:\Windows\System\VDaFzWl.exe
  C:\Windows\System\VDaFzWl.exe
  2⤵
  PID:15336
- C:\Windows\System\gxMiPvD.exe
  C:\Windows\System\gxMiPvD.exe
  2⤵
  PID:15356
- C:\Windows\System\hEYtoxl.exe
  C:\Windows\System\hEYtoxl.exe
  2⤵
  PID:14092
- C:\Windows\System\LgusWog.exe
  C:\Windows\System\LgusWog.exe
  2⤵
  PID:3096
- C:\Windows\System\btPiuql.exe
  C:\Windows\System\btPiuql.exe
  2⤵
  PID:14348
- C:\Windows\System\CETiIoP.exe
  C:\Windows\System\CETiIoP.exe
  2⤵
  PID:13384
- C:\Windows\System\SfiJcyM.exe
  C:\Windows\System\SfiJcyM.exe
  2⤵
  PID:14108
- C:\Windows\System\CkOeMyq.exe
  C:\Windows\System\CkOeMyq.exe
  2⤵
  PID:14376
- C:\Windows\System\ZByBFYi.exe
  C:\Windows\System\ZByBFYi.exe
  2⤵
  PID:13796
- C:\Windows\System\yOjeJHh.exe
  C:\Windows\System\yOjeJHh.exe
  2⤵
  PID:5440
- C:\Windows\System\teYRWZy.exe
  C:\Windows\System\teYRWZy.exe
  2⤵
  PID:13856
- C:\Windows\System\KKfLYid.exe
  C:\Windows\System\KKfLYid.exe
  2⤵
  PID:5576
- C:\Windows\System\LsfNbiS.exe
  C:\Windows\System\LsfNbiS.exe
  2⤵
  PID:5628
- C:\Windows\System\ZKvoeOQ.exe
  C:\Windows\System\ZKvoeOQ.exe
  2⤵
  PID:5884
- C:\Windows\System\RSjYpPx.exe
  C:\Windows\System\RSjYpPx.exe
  2⤵
  PID:14556
- C:\Windows\System\uwHEGtC.exe
  C:\Windows\System\uwHEGtC.exe
  2⤵
  PID:14456
- C:\Windows\System\JoHpoZz.exe
  C:\Windows\System\JoHpoZz.exe
  2⤵
  PID:5652
- C:\Windows\System\GUHwabT.exe
  C:\Windows\System\GUHwabT.exe
  2⤵
  PID:14544
- C:\Windows\System\BDLldwI.exe
  C:\Windows\System\BDLldwI.exe
  2⤵
  PID:6084
- C:\Windows\System\pxjhKAs.exe
  C:\Windows\System\pxjhKAs.exe
  2⤵
  PID:3608
- C:\Windows\System\VgFtKgh.exe
  C:\Windows\System\VgFtKgh.exe
  2⤵
  PID:14624
- C:\Windows\System\gzBkVut.exe
  C:\Windows\System\gzBkVut.exe
  2⤵
  PID:632
- C:\Windows\System\fyJInRV.exe
  C:\Windows\System\fyJInRV.exe
  2⤵
  PID:14724
- C:\Windows\System\XAQTnTS.exe
  C:\Windows\System\XAQTnTS.exe
  2⤵
  PID:14736
- C:\Windows\System\ugxEkKR.exe
  C:\Windows\System\ugxEkKR.exe
  2⤵
  PID:5504
- C:\Windows\System\jlcztRQ.exe
  C:\Windows\System\jlcztRQ.exe
  2⤵
  PID:14768
- C:\Windows\System\hnrZGta.exe
  C:\Windows\System\hnrZGta.exe
  2⤵
  PID:14784
- C:\Windows\System\GkfuTeT.exe
  C:\Windows\System\GkfuTeT.exe
  2⤵
  PID:5160
- C:\Windows\System\cLWTNUu.exe
  C:\Windows\System\cLWTNUu.exe
  2⤵
  PID:5704
- C:\Windows\System\KtRuyqF.exe
  C:\Windows\System\KtRuyqF.exe
  2⤵
  PID:14856
- C:\Windows\System\lMBdadS.exe
  C:\Windows\System\lMBdadS.exe
  2⤵
  PID:5364
- C:\Windows\System\cADYJZm.exe
  C:\Windows\System\cADYJZm.exe
  2⤵
  PID:14896
- C:\Windows\System\lkbOLds.exe
  C:\Windows\System\lkbOLds.exe
  2⤵
  PID:14936
- C:\Windows\System\dBSWXfm.exe
  C:\Windows\System\dBSWXfm.exe
  2⤵
  PID:14956
- C:\Windows\System\dghlppV.exe
  C:\Windows\System\dghlppV.exe
  2⤵
  PID:6032
- C:\Windows\System\SnZhSbt.exe
  C:\Windows\System\SnZhSbt.exe
  2⤵
  PID:14984
- C:\Windows\System\HMkBPhW.exe
  C:\Windows\System\HMkBPhW.exe
  2⤵
  PID:15008
- C:\Windows\System\XSAXCtZ.exe
  C:\Windows\System\XSAXCtZ.exe
  2⤵
  PID:15044
- C:\Windows\System\YybZatB.exe
  C:\Windows\System\YybZatB.exe
  2⤵
  PID:5432
- C:\Windows\System\GdaWfsP.exe
  C:\Windows\System\GdaWfsP.exe
  2⤵
  PID:15084
- C:\Windows\System\LSJstwB.exe
  C:\Windows\System\LSJstwB.exe
  2⤵
  PID:15104
- C:\Windows\System\IQsmSqI.exe
  C:\Windows\System\IQsmSqI.exe
  2⤵
  PID:6332
- C:\Windows\System\dUPTnAh.exe
  C:\Windows\System\dUPTnAh.exe
  2⤵
  PID:6148
- C:\Windows\System\gEXLmUk.exe
  C:\Windows\System\gEXLmUk.exe
  2⤵
  PID:15152
- C:\Windows\System\qeaZFme.exe
  C:\Windows\System\qeaZFme.exe
  2⤵
  PID:15172
- C:\Windows\System\NkPUgTM.exe
  C:\Windows\System\NkPUgTM.exe
  2⤵
  PID:15196
- C:\Windows\System\iMlAHZO.exe
  C:\Windows\System\iMlAHZO.exe
  2⤵
  PID:12324
- C:\Windows\System\JPHycqE.exe
  C:\Windows\System\JPHycqE.exe
  2⤵
  PID:15220
- C:\Windows\System\aIUkUlK.exe
  C:\Windows\System\aIUkUlK.exe
  2⤵
  PID:6572
- C:\Windows\System\BwHrroG.exe
  C:\Windows\System\BwHrroG.exe
  2⤵
  PID:6624
- C:\Windows\System\CMLEzkV.exe
  C:\Windows\System\CMLEzkV.exe
  2⤵
  PID:6416
- C:\Windows\System\EFCyDXG.exe
  C:\Windows\System\EFCyDXG.exe
  2⤵
  PID:6648
- C:\Windows\System\dXLMNwJ.exe
  C:\Windows\System\dXLMNwJ.exe
  2⤵
  PID:15308
- C:\Windows\System\RndSREL.exe
  C:\Windows\System\RndSREL.exe
  2⤵
  PID:15344
- C:\Windows\System\NmhdIYy.exe
  C:\Windows\System\NmhdIYy.exe
  2⤵
  PID:6760
- C:\Windows\System\nUpfmjS.exe
  C:\Windows\System\nUpfmjS.exe
  2⤵
  PID:5252
- C:\Windows\System\NjlbXbC.exe
  C:\Windows\System\NjlbXbC.exe
  2⤵
  PID:6924
- C:\Windows\System\slFOYfw.exe
  C:\Windows\System\slFOYfw.exe
  2⤵
  PID:6752
- C:\Windows\System\vcJfPFZ.exe
  C:\Windows\System\vcJfPFZ.exe
  2⤵
  PID:14148
- C:\Windows\System\AsLmNxH.exe
  C:\Windows\System\AsLmNxH.exe
  2⤵
  PID:6100
- C:\Windows\System\ulVPhVT.exe
  C:\Windows\System\ulVPhVT.exe
  2⤵
  PID:6872
- C:\Windows\System\kGCTxYI.exe
  C:\Windows\System\kGCTxYI.exe
  2⤵
  PID:14380
- C:\Windows\System\PrIBofp.exe
  C:\Windows\System\PrIBofp.exe
  2⤵
  PID:7060
- C:\Windows\System\ZTyCkLM.exe
  C:\Windows\System\ZTyCkLM.exe
  2⤵
  PID:2684
- C:\Windows\System\DVcvIyh.exe
  C:\Windows\System\DVcvIyh.exe
  2⤵
  PID:7088

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 1500 -i 1500 -h 420 -j 428 -s 520 -d 0
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:12936

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 1500 -i 1500 -h 460 -j 452 -s 508 -d 12636
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:13644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_mhtu2dzc.euv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mhtu2dzc.euv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BJcirgv.exe

Path C:\Windows\System\BJcirgv.exe
Size 2.9MB
SHA256 65d82c9a0baa9df0072780277122d875ab5d5b61dbfa1c8ea64d71231da13efc
MD5 fb4d9b80c9dd31a06ecc6821f08ead64
SHA1 5c6f9dacfad8f6c55bfa6d87226a917efe5cb403
SHA512 1add5dc15e68d68c8af3ca890080d6c2b727a7dd2edafce35b2b9b225c2e7a4333a528b8b84a737b9d9c1b1947215598f353f869980e0d9884df5f269f49a04c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Yz:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

CWTYLYt.exe

Path C:\Windows\System\CWTYLYt.exe
Size 2.9MB
SHA256 a9007b56bd5d20b84aaad19ec900275a930285095d2aa076c5ad29182adc0521
MD5 ce10c7e47f65a97fa4067d90f90bb45d
SHA1 9c0f4ec1713b123619c9b166fbd74a2ed2eb63bd
SHA512 6e6a628145cf46dd98cdc6a7fa1e549690568e1af1cb3c69a34a017244c85b0b37056c9a11f87d2af90327b3346fc8aefc7145e6d21af57bd31c5978e01dcb6b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Yv:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

DLVEdod.exe

Path C:\Windows\System\DLVEdod.exe
Size 2.9MB
SHA256 33b00f249c1a7fc3079b87f67038b314b89ee1901548883c1d4ac9ef97297d83
MD5 2aa1bc34ecf74a268d865ad1914423c9
SHA1 3d9ad19bb9154304db27fe091a3ebe84d7b5e7fa
SHA512 9c570f4cbf4c2b1a4603793c40b581ef404f8e3378d71dd3b3cfd51636cd1bd8907c500aa744369f46f1434d26c7b440e477bad535e419600e482de74c525723
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YL:NABx
MD5 SHA1 SHA512 SSDEEP

Submit Download

GIRuoPF.exe

Path C:\Windows\System\GIRuoPF.exe
Size 2.9MB
SHA256 d79eff987202ddfdda44641441f2f0af66578aa8c5abd79f14c95b216f4e98af
MD5 c65888c6f644ca14be57aa7d1a883e03
SHA1 6348d126de669adf2c36e2de0a6161e801cc9d3e
SHA512 b710692ed66de37305d5902f11e188f2a16f37a75e446126adeee16c2189017e04a036ee52f0dd4d25394e811c3bc5777d7ba53895ca5f1f4c5345820bd44488
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YZ:NABb
MD5 SHA1 SHA512 SSDEEP

Submit Download

GIYoOJF.exe

Path C:\Windows\System\GIYoOJF.exe
Size 2.9MB
SHA256 7f96e7af64da7e615aa086e8ec07c9e188071d09a2874240b4429e9c86e53752
MD5 f6b5e08ef64272efa35a8bab80744468
SHA1 c6093a3001e5227a9849dcdc1512a608972b86d2
SHA512 5b570eca29a91e2bff906cbc28234b98d125c1cbbb237bcca72fe7c179430495f9da76682f0eb9ebb9148bb2e52bb62492324e4901459b1c0730829fb24d7c61
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Yj:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

HGSrsLL.exe

Path C:\Windows\System\HGSrsLL.exe
Size 2.9MB
SHA256 d93da5b0440dc7ab4c596f9ef2e47c515d3491a502b13cde043aeaeeb1133653
MD5 e002dcad64383720011f5eebf10ce1d9
SHA1 bfec6c11218df134c45835229a01ba3f660e305f
SHA512 0ea5a4f4259195d4a4f60f796599ecaf5224727eec10389b9f9bb68357981603672e750a6e4517ad44820563d75506c733962eeb6c0b307bc804749ab1ffef82
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Yf:NAB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

HqwqWmF.exe

Path C:\Windows\System\HqwqWmF.exe
Size 2.9MB
SHA256 3b7cbce251c136b38db730bc492a22f27736c295e30104c80bac2ff65a496794
MD5 adb2d2cf00819118ae0b67fe206ab2db
SHA1 56a3aa4cdf8876ecb83fa957e4d40c208d962790
SHA512 5760d1a3c323f6974babe1d0e031ccea708f6f256b448c6e3e455239621c53e7062de49b517fe67660801bbe41f845f6f1094c255568cbec193994f57ff6915c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YDJ:NABv
MD5 SHA1 SHA512 SSDEEP

Submit Download

IxTKGwB.exe

Path C:\Windows\System\IxTKGwB.exe
Size 2.9MB
SHA256 0a44f83423ab6976bc440b7e9f4dca76c2afb46508c8e9dbe92f4b36df130e82
MD5 62ced431b0b0c330a28f44e94fb835c2
SHA1 2bd0ffb9f6d6b5adb49bd35147105f3fdc55a0c6
SHA512 2b62ad146ea79742b18b17578bd6cb85fa3fe56e4d8c7b9d11b368ea169f6d0c0afb225bf8bfce8412d8b37a3b412584d02c1b462b39cf685ce874ec058284b2
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Yoq:NABj
MD5 SHA1 SHA512 SSDEEP

Submit Download

JWxJuCQ.exe

Path C:\Windows\System\JWxJuCQ.exe
Size 2.9MB
SHA256 00d70efba700da64c9bba4d661ecd3ad10cc4de1f0ce424341a433052145d1bd
MD5 ddb68f924ead9a417a797f9dc38002e3
SHA1 15f2f7058fdf518465b57aeec5d31a91543f8331
SHA512 8169881ea08080257505c9c0e656bfeb10f5bf026ecf178a1260a55063263d4716c0db4291aa268241427eed57be4596150051bdd990645c23f55edf15959b7b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YI:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

KfJjWNd.exe

Path C:\Windows\System\KfJjWNd.exe
Size 2.9MB
SHA256 2d9089cce7a3941b7b9ed75ea078d4bfddcd687143cdda699da12fdcd6938a3c
MD5 8dfb0332e510d071548c330f78ae7386
SHA1 b4752d75cb994f8a834f968dac2f22ab017bdf4f
SHA512 5416cf68d659137e5981ec7a8a6c268150c62a5841a2351852026e6686cb766cabb83e236f92ca083d87a0a03a880490c38e76e1d8a1011cc3c8ccde4817ba20
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YoET:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

KsoeIJX.exe

Path C:\Windows\System\KsoeIJX.exe
Size 2.9MB
SHA256 f16f6b0fd9fdb315e7350fbcd11b6361406245ddb3e364fb75fa65b73887581e
MD5 9654724d28642d4c8cfad1c105157660
SHA1 32fc4cbc0c6438f806b39515a23a36a24fc93cc8
SHA512 c736be5f2ecb30acf009deb1f52509234d29899f619b396819c5ffee223160c952cd235dbea066c88cf4f926647a5921fe44e9950d43a5c170e7fe2182e3ca3f
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YS:NABs
MD5 SHA1 SHA512 SSDEEP

Submit Download

LdHPeAZ.exe

Path C:\Windows\System\LdHPeAZ.exe
Size 2.9MB
SHA256 0eef913e50dd99efaf0b4bb32c8f8e09f3813f331270dca1f5a193b7c3c48d99
MD5 9da3fd43937bb28470a0af7c28f1556b
SHA1 484000522107958e6fef61dd592be57cf24a2e3e
SHA512 e4eff805eed818c50cc8467bb892c6f9bd8d991ae1d35c9821b6decd0a6593b3699e96650532e576339c1f038ffa4e56ec8b1afcbcdb4d5f08a12f436c2f95c7
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YJ:NABb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ObJJxEH.exe

Path C:\Windows\System\ObJJxEH.exe
Size 2.9MB
SHA256 4fea7a86475adb9a7788e2d1de178d0bd1f4bc22a5473a1313c66382f9c1bb38
MD5 81777136ffdfd62aed1482b7c8fbfc89
SHA1 b35a272cc3a4d6576c597e8074e46878d34ef2da
SHA512 629f936517ddb67e14c358467fe204b38a5de69e6d374205eae67fb2b1aee3591df30afa7b872018edae5d0c8910c1e49f70f9a1553738e7aec508ee362e954a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Y3:NABV
MD5 SHA1 SHA512 SSDEEP

Submit Download

PxAawDA.exe

Path C:\Windows\System\PxAawDA.exe
Size 2.9MB
SHA256 ce20e0229d950a74b03871e7d8b9c6b7bc8e8255113e07f79b1c754801a676e4
MD5 82e0c0883a8c159b8216ed18bc229710
SHA1 70db67d30b1a8a350c5a8791a9009a1a2eb04b23
SHA512 e61f433ca772cc7e88e6866f355528d861b047136a2e916dedb064b5100168f63d3f3b1a74e90658dd168b420da4ba49d0cff902d040f7f08132030b953e0b1e
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Y8:NABy
MD5 SHA1 SHA512 SSDEEP

Submit Download

QoGSmwS.exe

Path C:\Windows\System\QoGSmwS.exe
Size 2.9MB
SHA256 3d90573dabf927dca2f1bd11c27e2996661f31cc2f478eb5d92ade1a23481f34
MD5 0b1de581147a4bb94890df35cba52b46
SHA1 31b82b9ab2a1f709b110ecb9fb14cc591cbfc666
SHA512 cb3c830d55a8f6ef30f48d812724fc9571c1fb53af2ac6c8dcc5302525b1349861651093020fbff4febadd76457a533feabf57c18e46613d4f9395ac98fe46b7
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Y9:NABX
MD5 SHA1 SHA512 SSDEEP

Submit Download

SpFwjLh.exe

Path C:\Windows\System\SpFwjLh.exe
Size 2.9MB
SHA256 9e00e75d2c0f028379ba8ef32ec3de4472b19b069af5e40ed2bf8ccd524d2371
MD5 b151b993e70d82b7d43efb09ee838fb5
SHA1 3bc112976d79f45d533b9993c5018fb455d3cacc
SHA512 b9f72c59c86367f8150abcbbdad1473bab69f9853e86dcaeed1de888031c6c6144737dd82d2d11cc80d8dc586dc766a67ba19e157671c87d64fa30e16ec4e56f
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Y/:NABV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TbgmnxQ.exe

Path C:\Windows\System\TbgmnxQ.exe
Size 2.9MB
SHA256 6a180403022fe2238fe6af9c79bf3b06a5c2193b2032cd880b15ec0ab0cd2a40
MD5 0d033cd6bf1118fbf5bbe10859c5d628
SHA1 4c2f4ed1421ea1b4912c66700c9c0101432a76cf
SHA512 73ccb975f8405527aef1a79e54adf0290f6b1cca177a6accdf150abc8564c08e02264b5bc3586be6ae1feee8aada188c72cdbf65305dca33b27edf24a0181bc2
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Yk:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

UqNoRZH.exe

Path C:\Windows\System\UqNoRZH.exe
Size 2.9MB
SHA256 85184c9f9fd59ab092ce06e21562a6dc7525d5ce56660d50b5b1b320528aff72
MD5 32b8cc5fff4b02da9c0c93c67bd209ae
SHA1 51e81195e32341eb36905444109a58da355f7fad
SHA512 efcf0c3cf861b3ce9792c95c8d85c3cdd43d97ba0d62ecd596920222353012aca8b3523e7062e7c1f10f51c49221472823fe2d9f668ec04a990be831f55546ba
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YMe:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

VOEzGBR.exe

Path C:\Windows\System\VOEzGBR.exe
Size 2.9MB
SHA256 374a10f33cbdae3f26a97057fc30211a983d5b8551f4ceffdec0f7d6f7a0bd4a
MD5 8fd2ad153fe50bb69411f757f67a4d1e
SHA1 c549f39ddfc0be304d178e6b01563340c54f6a2c
SHA512 330aa5678540a5638c25b127700f06ad5e2b193df19bca095572ea00021524c202d2d3807659da4edfc3d08320a8383893ff037786e632d45b81cb106136c024
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Yiv:NAB4
MD5 SHA1 SHA512 SSDEEP

Submit Download

XVbLZyP.exe

Path C:\Windows\System\XVbLZyP.exe
Size 2.9MB
SHA256 303110e15edf5eef6f375651d59e5d7a29fd847a8a09c7e476ccd56635fc33e0
MD5 48ea011cabdced1d825d2410c81d8915
SHA1 7ab0991cdae2391db30e51162f64e3910af2af8c
SHA512 7de0d500dd717062126798254c8d5bc05a50b37a9620d35ac395d45452839af6666e3606209fe9e27dc3f7295f4ff3a0f6b526f5c348d312a1b52e556255df8d
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Yk:NABG
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZmdVaaV.exe

Path C:\Windows\System\ZmdVaaV.exe
Size 2.9MB
SHA256 52516e3e3150cb6bc091b78ce2ddbb988ec392ea9aa45746d5d1ba2fb5fe481d
MD5 0673ebb0fdf2e4043b6b8bdc61768a93
SHA1 a7f991526d2cb7b96bb62b0b7464f3b342c1875f
SHA512 58024bb035b84757e944269be16de4923b90db490038d63d230e7e58d70a7ae88c5a72b76b40e62a75d3bce78435054e51d74f8a04a385179a90416e6a653258
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Yt:NABf
MD5 SHA1 SHA512 SSDEEP

Submit Download

cWzaLCZ.exe

Path C:\Windows\System\cWzaLCZ.exe
Size 8B
SHA256 755fd52af881e52d8581734deed65b261324bea5979dbb6c3cb63a484774b291
MD5 bb619ca80177568a9850ff8d7dc139bc
SHA1 39598cf7a1b2d3ae37699a3d204bcb3b9a800338
SHA512 77a78bba51b6f52cc6161f41e26d3b06c03e53c642da1fce66ee01b29a74a58b514da40bb12a8dbaffc02d45dc730672ed991bf1ba6f8df90e20af812fc0abd2
MD5 SHA1 SHA512

Submit Download

etHsdVY.exe

Path C:\Windows\System\etHsdVY.exe
Size 2.9MB
SHA256 f5c9861a347b284cb62c6c5a68ae87bb84ea234833d24b9f9939bf4933b9c0f9
MD5 e422900d418a798c08466d31eff492c5
SHA1 17def6c68988e0cd023474be189aa070dd720522
SHA512 a71fd6873f1ea2365a21aac645163a343b8c71c8f702bacb94d0f59e3e199da4a5a5fe53c91de4e852f579998f894a6df17aafe95c9695b0f4bdcb3c372a9c11
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Yc:NABq
MD5 SHA1 SHA512 SSDEEP

Submit Download

gjTeOuT.exe

Path C:\Windows\System\gjTeOuT.exe
Size 2.9MB
SHA256 551ffe248b14dbfb90bb04a22c06ed114f00b2ae9557a748e3bc364dc9648ca6
MD5 26082daaddc2d3c2a7c5ea82f39be3f3
SHA1 5d59f16cd3d1848407be7139bfa9b1641a2dd5b4
SHA512 13c76b84889b56690016a7d7de255bbcdca939e0d524fba2a09b47dd1708da8d16bcd981f125174c2865871b2b58994a5c17dd1a9260a9548cb5b3bbec80aa3a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YN:NABj
MD5 SHA1 SHA512 SSDEEP

Submit Download

hBYmSWb.exe

Path C:\Windows\System\hBYmSWb.exe
Size 2.9MB
SHA256 ccb6c4d4fa3efa08d2ed28041066c51e37417f4271d07bf5e46b4c18e0708cd2
MD5 636e72d831383ca5058384ec01d3b58c
SHA1 5607aa5926894dc52f35f0bf1f06781e3f980904
SHA512 f13538f961b72006612836a0fe559be4782d3011ca588c754c6dfbad4c27ab7706583f00a9495970eb4814ac85028c46a862610f5d4b2d4976b66bf9d08e275b
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Yv:NABB
MD5 SHA1 SHA512 SSDEEP

Submit Download

iATggLR.exe

Path C:\Windows\System\iATggLR.exe
Size 2.9MB
SHA256 71f44c633c5023eb3300e96368450e315abda5498f6ce8dd84bb3794483a63e5
MD5 72af30352f4f8e92862741792175e7b4
SHA1 fb3421a616f3a747b130b0a73aa4396bd7e60cd9
SHA512 4584477b47ab1ba1c0104f843bab4d5e74b72334d3bf5731357761861d25c35cfddc1e8f876bbae28aab5de2a2611b42805fd70e198887100d025bd0dced050a
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YL:NABh
MD5 SHA1 SHA512 SSDEEP

Submit Download

kpvqNPP.exe

Path C:\Windows\System\kpvqNPP.exe
Size 2.9MB
SHA256 ad12ca6815f36c51313b117ea1dc47746cce999b04cc82b868dbd609e916aa94
MD5 bda1e4c07465eff070f33c4470b2d4b9
SHA1 2db79b37fe33b92b734efec6be77e34303b28afd
SHA512 315a237e24505dac26b192b789969cf3d948251a31b07258cd56e89958a4f0949545b07c45d8fd6628d12e64d1a1d06980d1438141c03e89dce2c45729815780
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YH:NABx
MD5 SHA1 SHA512 SSDEEP

Submit Download

lAixylv.exe

Path C:\Windows\System\lAixylv.exe
Size 2.9MB
SHA256 76ff354e8ac1c345f4aa8defa0d64569c99cdb04db78f39acc7326e1dcbbaff2
MD5 f71eb0e65262a0cdae3d4d85bcc7150d
SHA1 78d42d80a85f01504a2c8582b0fea4e7e04d6114
SHA512 2759843eddeef8d1978d10d652a714d879d259fe0cac7ee9bcd563b50470d3b235066ca2e3a3cc6f0fbcb4ccef8be2909b03a1d59201d382f5c2c642af5566b4
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YT:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

nFWMJmJ.exe

Path C:\Windows\System\nFWMJmJ.exe
Size 2.9MB
SHA256 e6c585a969786a13001df5bc45ee0610199e3a067605e9d4c18f569188c0577d
MD5 16526a65dd61f0254301ddb651b6eadb
SHA1 55fb261c54ee429312c658c48f7a87a4aec10fe8
SHA512 f68b3fba14a7b97f3ff24e61438fc5dd9c202342ecedfde4b84d269e4a881fa29c75e7860fb04772c2c3d8fee4c8ac89c468912e4cace57355019b45e326745c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Y/:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

nSajIKd.exe

Path C:\Windows\System\nSajIKd.exe
Size 2.9MB
SHA256 46ac18ad76fac6d163a6b89b22f099dc5ca413479c58ff96686e4c7793709ec9
MD5 1d262160370535f963e8bedfecad919b
SHA1 cbec2c139287dc20f95fe4796c7963b6179134ae
SHA512 89abfcd899a527b47f1a3007c0d7c2a07ab356e1bedf6e7ff17d63e4b4ad05fd3ac13bd37e9478753b3ccb2a7c874bf4c9a9dca0aee88db9bae52db7da5797bd
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YX:NABB
MD5 SHA1 SHA512 SSDEEP

Submit Download

qkMRKyM.exe

Path C:\Windows\System\qkMRKyM.exe
Size 2.9MB
SHA256 2c35e82aaf661fedad29948ebbcbc9c8fbcc93cebd57f402350bbfac1ed7776c
MD5 09b2d31aaf7ae16180e30d775f302612
SHA1 802b0798fa8b3a7f582ece08fef0d8f2ebbea65a
SHA512 407cbbe3a31e0f5492cf760a26403fbf04de60d2c3ab249793e921372e0a49ee50b47360ff9fdb68953f987d6a0bd317b1b21ee3e183d866c19d359ec765a26f
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YO:NAB0
MD5 SHA1 SHA512 SSDEEP

Submit Download

raCDYZA.exe

Path C:\Windows\System\raCDYZA.exe
Size 2.9MB
SHA256 0653ce1ac2aeda9872e97398ea7f64acc392de9ab08a1df38ea96b5eb729b08d
MD5 be0031b60885ba5c2c48988c0f4c501c
SHA1 fb386b60d17d4f2776883ecbec95974f1b108c13
SHA512 7dfabf920aad401cade88415a66a6a5411c8a172c2e915fb68fba33df24d13dbf28173dbeedfb6e4603865dd633ef021db9805fadc4549505d6428197348c5b7
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YB:NAB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

sVaiUUm.exe

Path C:\Windows\System\sVaiUUm.exe
Size 2.9MB
SHA256 4e71fca7d11bc4fd5e6119a0c4e07c6b8732b32472c99f149e8e10a81ca7ed49
MD5 b3dbf491bb0054d90fad3689a79fdad8
SHA1 bfaf246ca5e7c791f76d5d35bce3f9bb2d276982
SHA512 c3827b91972fcf34e3daa26cda4095dbc9cd473ace28db875630f12d2bc2303cd3c7b9a876e12f36baeb3c8d39589b4b8d48ea956be74f787ae5a16b8e4e385c
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6YU:NABa
MD5 SHA1 SHA512 SSDEEP

Submit Download

uOxEzaL.exe

Path C:\Windows\System\uOxEzaL.exe
Size 2.9MB
SHA256 7d1e1ff2d34e9823828ac7beb1933eb9591b1db49ddb77a60e727d27b0435dd1
MD5 5d806d58004bccb2eaa5a62deaab4d85
SHA1 8f692f793757394ba22e9699566d8b245edc67df
SHA512 e727ca83abefb932557dedc189d445e7c71d2182e4eae2fdbcc2e899b90c967c14b9cab01c75769fcbfb531994d608c3978a2de01c9b4b665269aa5df178c105
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Y3:NAB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

unqpSSK.exe

Path C:\Windows\System\unqpSSK.exe
Size 2.9MB
SHA256 618390f40d187ccd452e1fdce5805043cbede6d66e2fd462098b0766a75073ec
MD5 0bc4e32cefa738e10b3c200689955d4c
SHA1 55d95c29c65361e6a4689113ff948a43fd1d4e2c
SHA512 27ab44adec9addb52010e265682054fb16348737104ace900a750b0e282b42e597e8b256cbcc707bf136ec8a79bf75d1e4a7064c7c6b88382c47e70078ea2324
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Yg:NABi
MD5 SHA1 SHA512 SSDEEP

Submit Download

unryjNn.exe

Path C:\Windows\System\unryjNn.exe
Size 2.9MB
SHA256 3eb1650e1d4eb0128fce7cb15baf4db64735caed2c30ebe1d757c7b39ec5904f
MD5 bd2bcb33803f4dc72048e7c4f68249b7
SHA1 b0654f27c713398b2c43a578ec5cd3fcaf0afa31
SHA512 9c6b4f885bb7bc172f6a74f3c2f1af4943c9121f1f0f7b1e0fdc9254bc05b76d12fee3bbd243db980a2e0b59fff5377c6312fc9102ef7ddef2542a15531c4959
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Yp:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

yHpTaXI.exe

Path C:\Windows\System\yHpTaXI.exe
Size 2.9MB
SHA256 fe44dd8228124ec610df021268790c4d7bc5e42b084304f6a54eefecaf5fa02e
MD5 df12862173cd7a55e400ff38e6b5f778
SHA1 2b0982b93bef7698fe2efb3bbcad627e2716e4fc
SHA512 31eb6022b04c90b184bce45d7b558a174fa0dde3d1cdd332d169d162555bbbf8161306222f3828590d8c9bd75c3d7e7536bf2e45ed90480e67e1a3f925044d92
SSDEEP 49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5+Q6Ya:NABI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1224-127-0x00007FF7D3E80000-0x00007FF7D4272000-memory.dmp

Download

memory/1224-2838-0x00007FF7D3E80000-0x00007FF7D4272000-memory.dmp

Download

memory/1316-145-0x00007FF6B3EA0000-0x00007FF6B4292000-memory.dmp

Download

memory/1804-147-0x00007FF79C5C0000-0x00007FF79C9B2000-memory.dmp

Download

memory/1804-2830-0x00007FF79C5C0000-0x00007FF79C9B2000-memory.dmp

Download

memory/1876-2875-0x00007FF718DE0000-0x00007FF7191D2000-memory.dmp

Download

memory/1876-152-0x00007FF718DE0000-0x00007FF7191D2000-memory.dmp

Download

memory/2020-2881-0x00007FF697280000-0x00007FF697672000-memory.dmp

Download

memory/2020-151-0x00007FF697280000-0x00007FF697672000-memory.dmp

Download

memory/2084-2869-0x00007FF62ADC0000-0x00007FF62B1B2000-memory.dmp

Download

memory/2084-144-0x00007FF62ADC0000-0x00007FF62B1B2000-memory.dmp

Download

memory/2252-143-0x00007FF7246B0000-0x00007FF724AA2000-memory.dmp

Download

memory/2252-2873-0x00007FF7246B0000-0x00007FF724AA2000-memory.dmp

Download

memory/2320-153-0x00007FF6CA510000-0x00007FF6CA902000-memory.dmp

Download

memory/2320-2866-0x00007FF6CA510000-0x00007FF6CA902000-memory.dmp

Download

memory/2384-135-0x00007FF7A60F0000-0x00007FF7A64E2000-memory.dmp

Download

memory/2384-2860-0x00007FF7A60F0000-0x00007FF7A64E2000-memory.dmp

Download

memory/2436-60-0x0000021C77140000-0x0000021C77162000-memory.dmp

Download

memory/2436-234-0x0000021C77E20000-0x0000021C785C6000-memory.dmp

Download

memory/2436-3181-0x00007FFCFA0A0000-0x00007FFCFAB61000-memory.dmp

Download

memory/2436-45-0x00007FFCFA0A0000-0x00007FFCFAB61000-memory.dmp

Download

memory/2436-31-0x00007FFCFA0A0000-0x00007FFCFAB61000-memory.dmp

Download

memory/2436-12-0x00007FFCFA0A3000-0x00007FFCFA0A5000-memory.dmp

Download

memory/2504-146-0x00007FF7DA6D0000-0x00007FF7DAAC2000-memory.dmp

Download

memory/2504-2818-0x00007FF7DA6D0000-0x00007FF7DAAC2000-memory.dmp

Download

memory/2580-2826-0x00007FF622830000-0x00007FF622C22000-memory.dmp

Download

memory/2580-97-0x00007FF622830000-0x00007FF622C22000-memory.dmp

Download

memory/2596-2850-0x00007FF641010000-0x00007FF641402000-memory.dmp

Download

memory/2596-150-0x00007FF641010000-0x00007FF641402000-memory.dmp

Download

memory/2764-58-0x00007FF71F2B0000-0x00007FF71F6A2000-memory.dmp

Download

memory/2856-133-0x00007FF651D80000-0x00007FF652172000-memory.dmp

Download

memory/2856-2837-0x00007FF651D80000-0x00007FF652172000-memory.dmp

Download

memory/3312-148-0x00007FF7E08B0000-0x00007FF7E0CA2000-memory.dmp

Download

memory/3312-2847-0x00007FF7E08B0000-0x00007FF7E0CA2000-memory.dmp

Download

memory/4236-81-0x00007FF725530000-0x00007FF725922000-memory.dmp

Download

memory/4236-2814-0x00007FF725530000-0x00007FF725922000-memory.dmp

Download

memory/4252-134-0x00007FF75AFC0000-0x00007FF75B3B2000-memory.dmp

Download

memory/4252-2857-0x00007FF75AFC0000-0x00007FF75B3B2000-memory.dmp

Download

memory/4396-204-0x00007FF7469B0000-0x00007FF746DA2000-memory.dmp

Download

memory/4396-2871-0x00007FF7469B0000-0x00007FF746DA2000-memory.dmp

Download

memory/4624-70-0x00007FF63F4C0000-0x00007FF63F8B2000-memory.dmp

Download

memory/4624-2809-0x00007FF63F4C0000-0x00007FF63F8B2000-memory.dmp

Download

memory/4760-2833-0x00007FF782A40000-0x00007FF782E32000-memory.dmp

Download

memory/4760-104-0x00007FF782A40000-0x00007FF782E32000-memory.dmp

Download

memory/4924-2854-0x00007FF72DD00000-0x00007FF72E0F2000-memory.dmp

Download

memory/4924-149-0x00007FF72DD00000-0x00007FF72E0F2000-memory.dmp

Download

memory/4964-11-0x00007FF6D10B0000-0x00007FF6D14A2000-memory.dmp

Download

memory/4972-2862-0x00007FF796B60000-0x00007FF796F52000-memory.dmp

Download

memory/4972-142-0x00007FF796B60000-0x00007FF796F52000-memory.dmp

Download

memory/5000-2984-0x00007FF63BC40000-0x00007FF63C032000-memory.dmp

Download

memory/5000-0-0x00007FF63BC40000-0x00007FF63C032000-memory.dmp

Download

memory/5000-1-0x0000026196A20000-0x0000026196A30000-memory.dmp

Download

memory/5032-2840-0x00007FF643170000-0x00007FF643562000-memory.dmp

Download

memory/5032-118-0x00007FF643170000-0x00007FF643562000-memory.dmp

Download