xmrig | a6f48f8f554b67aa4e0112b00c48936b33a60a9b63c29a6b47f1c36f0268de76

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 23:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
Size

1.7MB
MD5

8299291116572e81c4a532247dfb92d0
SHA1

336e759cbf2e33c932cb8e6cc293a8f958d1d319
SHA256

a6f48f8f554b67aa4e0112b00c48936b33a60a9b63c29a6b47f1c36f0268de76
SHA512

12a948cae01b0de019f5a280ec543107fda8a0c1968ef54e1efdd5ab1757cf113fbeb19a3e1459edd3e0558af3a34f5352f34e8260acaa7356492b06e99afc8c
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuBk5ck:Lz071uv4BPMkFfdg6NsIRSwV7C

Score

10^/10

xmrig execution miner persistence upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 27 IoCs

miner

resource	yara_rule
behavioral2/memory/2064-326-0x00007FF7C4DD0000-0x00007FF7C51C2000-memory.dmp	xmrig
behavioral2/memory/4984-1078-0x00007FF63DA40000-0x00007FF63DE32000-memory.dmp	xmrig
behavioral2/memory/4528-1510-0x00007FF6EB980000-0x00007FF6EBD72000-memory.dmp	xmrig
behavioral2/memory/1824-1079-0x00007FF69A7F0000-0x00007FF69ABE2000-memory.dmp	xmrig
behavioral2/memory/4016-975-0x00007FF724090000-0x00007FF724482000-memory.dmp	xmrig
behavioral2/memory/1220-781-0x00007FF7BADF0000-0x00007FF7BB1E2000-memory.dmp	xmrig
behavioral2/memory/4296-656-0x00007FF7D1360000-0x00007FF7D1752000-memory.dmp	xmrig
behavioral2/memory/224-533-0x00007FF7B3A20000-0x00007FF7B3E12000-memory.dmp	xmrig
behavioral2/memory/3668-431-0x00007FF6C47F0000-0x00007FF6C4BE2000-memory.dmp	xmrig
behavioral2/memory/928-327-0x00007FF6DA410000-0x00007FF6DA802000-memory.dmp	xmrig
behavioral2/memory/1612-272-0x00007FF6EC690000-0x00007FF6ECA82000-memory.dmp	xmrig
behavioral2/memory/2540-242-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp	xmrig
behavioral2/memory/888-199-0x00007FF656590000-0x00007FF656982000-memory.dmp	xmrig
behavioral2/memory/316-195-0x00007FF6E0FA0000-0x00007FF6E1392000-memory.dmp	xmrig
behavioral2/memory/3316-160-0x00007FF6D7E30000-0x00007FF6D8222000-memory.dmp	xmrig
behavioral2/memory/888-4694-0x00007FF656590000-0x00007FF656982000-memory.dmp	xmrig
behavioral2/memory/3668-4709-0x00007FF6C47F0000-0x00007FF6C4BE2000-memory.dmp	xmrig
behavioral2/memory/316-4699-0x00007FF6E0FA0000-0x00007FF6E1392000-memory.dmp	xmrig
behavioral2/memory/4016-4735-0x00007FF724090000-0x00007FF724482000-memory.dmp	xmrig
behavioral2/memory/4984-4740-0x00007FF63DA40000-0x00007FF63DE32000-memory.dmp	xmrig
behavioral2/memory/928-4749-0x00007FF6DA410000-0x00007FF6DA802000-memory.dmp	xmrig
behavioral2/memory/2064-4766-0x00007FF7C4DD0000-0x00007FF7C51C2000-memory.dmp	xmrig
behavioral2/memory/224-4759-0x00007FF7B3A20000-0x00007FF7B3E12000-memory.dmp	xmrig
behavioral2/memory/1824-4782-0x00007FF69A7F0000-0x00007FF69ABE2000-memory.dmp	xmrig
behavioral2/memory/1220-4788-0x00007FF7BADF0000-0x00007FF7BB1E2000-memory.dmp	xmrig
behavioral2/memory/4296-4763-0x00007FF7D1360000-0x00007FF7D1752000-memory.dmp	xmrig
behavioral2/memory/2540-4754-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3716	powershell.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Software\Microsoft\Active Setup\Installed Components	Process not Found

Executes dropped EXE 64 IoCs

pid	Process
460	rCaxTaM.exe
3436	TahDxYo.exe
804	KwXtQCz.exe
3316	cDzvkUh.exe
316	abaDNeN.exe
888	vhfMflu.exe
2540	vtaAvEk.exe
1612	VbtIQMP.exe
2064	nkGvcZa.exe
928	PXlAWkf.exe
3668	eymvIKs.exe
2640	aGPtERH.exe
224	xDYXMad.exe
4296	qTSqOwR.exe
1220	UyYSkFX.exe
4016	NsnFVVz.exe
4984	WIDBRKd.exe
1824	smDnDuY.exe
4528	NhYTrgd.exe
1472	EfkpqCE.exe
3000	tBWVGaS.exe
4840	ATrIJLo.exe
3284	UqlBEcd.exe
2884	ocnAtkt.exe
3384	uSBRNyt.exe
2312	mlaBpdE.exe
4400	qEDbQsA.exe
4556	kiNkmmz.exe
2828	yvTGtoL.exe
2956	mCxThyf.exe
4664	zDvIUiP.exe
4712	FpgDkkI.exe
2896	GKijVpV.exe
2952	hdJBsBD.exe
3112	QZcooZW.exe
968	vdCCXcF.exe
2404	tuCLvkz.exe
4316	bQDCjjD.exe
2868	IRVTZRt.exe
5072	xKtAPPY.exe
3636	jsPNMpP.exe
2120	fXIsVGx.exe
1460	tJVFZdp.exe
4024	TdvScSQ.exe
1296	zYrJBSm.exe
1132	IjOrzEj.exe
3116	kBPHnmg.exe
2872	saZUtBZ.exe
3956	xCJYLrI.exe
2700	LanoQXI.exe
4784	uaYZnIO.exe
5084	KjBACjR.exe
840	MMyvyYa.exe
212	KmPgYDJ.exe
208	KwLGmwM.exe
4420	NLTMmxz.exe
732	MvLSCMF.exe
2456	UwSMRtu.exe
4044	TifynKQ.exe
4380	vqtfLXg.exe
4452	lhQzIcR.exe
4432	KZVgTMU.exe
2008	bVnTOEF.exe
3744	czvMgRF.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3232-0-0x00007FF656BC0000-0x00007FF656FB2000-memory.dmp	upx
behavioral2/files/0x000b00000002340f-5.dat	upx
behavioral2/files/0x000700000002343e-27.dat	upx
behavioral2/files/0x0007000000023444-75.dat	upx
behavioral2/files/0x0007000000023449-72.dat	upx
behavioral2/files/0x0007000000023448-69.dat	upx
behavioral2/files/0x0007000000023447-68.dat	upx
behavioral2/files/0x0007000000023446-67.dat	upx
behavioral2/files/0x000700000002344e-123.dat	upx
behavioral2/files/0x0007000000023453-126.dat	upx
behavioral2/files/0x0007000000023460-190.dat	upx
behavioral2/memory/2064-326-0x00007FF7C4DD0000-0x00007FF7C51C2000-memory.dmp	upx
behavioral2/memory/4984-1078-0x00007FF63DA40000-0x00007FF63DE32000-memory.dmp	upx
behavioral2/memory/4528-1510-0x00007FF6EB980000-0x00007FF6EBD72000-memory.dmp	upx
behavioral2/memory/1824-1079-0x00007FF69A7F0000-0x00007FF69ABE2000-memory.dmp	upx
behavioral2/memory/4016-975-0x00007FF724090000-0x00007FF724482000-memory.dmp	upx
behavioral2/memory/1220-781-0x00007FF7BADF0000-0x00007FF7BB1E2000-memory.dmp	upx
behavioral2/memory/4296-656-0x00007FF7D1360000-0x00007FF7D1752000-memory.dmp	upx
behavioral2/memory/224-533-0x00007FF7B3A20000-0x00007FF7B3E12000-memory.dmp	upx
behavioral2/memory/3668-431-0x00007FF6C47F0000-0x00007FF6C4BE2000-memory.dmp	upx
behavioral2/memory/928-327-0x00007FF6DA410000-0x00007FF6DA802000-memory.dmp	upx
behavioral2/memory/1612-272-0x00007FF6EC690000-0x00007FF6ECA82000-memory.dmp	upx
behavioral2/memory/2540-242-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp	upx
behavioral2/files/0x0007000000023455-215.dat	upx
behavioral2/files/0x0007000000023452-210.dat	upx
behavioral2/files/0x000700000002344f-201.dat	upx
behavioral2/memory/888-199-0x00007FF656590000-0x00007FF656982000-memory.dmp	upx
behavioral2/memory/316-195-0x00007FF6E0FA0000-0x00007FF6E1392000-memory.dmp	upx
behavioral2/files/0x000700000002345a-189.dat	upx
behavioral2/files/0x0007000000023459-183.dat	upx
behavioral2/files/0x000700000002345f-181.dat	upx
behavioral2/files/0x000700000002345c-175.dat	upx
behavioral2/files/0x0008000000023438-171.dat	upx
behavioral2/memory/3316-160-0x00007FF6D7E30000-0x00007FF6D8222000-memory.dmp	upx
behavioral2/files/0x000700000002344d-159.dat	upx
behavioral2/files/0x000700000002344c-151.dat	upx
behavioral2/files/0x0007000000023458-136.dat	upx
behavioral2/files/0x0007000000023457-169.dat	upx
behavioral2/files/0x0007000000023456-167.dat	upx
behavioral2/files/0x0007000000023454-162.dat	upx
behavioral2/files/0x000700000002344a-133.dat	upx
behavioral2/files/0x0007000000023442-128.dat	upx
behavioral2/files/0x000700000002345b-161.dat	upx
behavioral2/files/0x0007000000023441-145.dat	upx
behavioral2/files/0x0007000000023445-141.dat	upx
behavioral2/files/0x0007000000023440-94.dat	upx
behavioral2/files/0x000700000002343f-115.dat	upx
behavioral2/files/0x000700000002344b-111.dat	upx
behavioral2/files/0x0007000000023443-56.dat	upx
behavioral2/files/0x000700000002343d-53.dat	upx
behavioral2/files/0x000700000002343c-32.dat	upx
behavioral2/files/0x000700000002343b-31.dat	upx
behavioral2/files/0x000800000002343a-20.dat	upx
behavioral2/memory/460-12-0x00007FF79BB30000-0x00007FF79BF22000-memory.dmp	upx
behavioral2/memory/888-4694-0x00007FF656590000-0x00007FF656982000-memory.dmp	upx
behavioral2/memory/3668-4709-0x00007FF6C47F0000-0x00007FF6C4BE2000-memory.dmp	upx
behavioral2/memory/316-4699-0x00007FF6E0FA0000-0x00007FF6E1392000-memory.dmp	upx
behavioral2/memory/4016-4735-0x00007FF724090000-0x00007FF724482000-memory.dmp	upx
behavioral2/memory/4984-4740-0x00007FF63DA40000-0x00007FF63DE32000-memory.dmp	upx
behavioral2/memory/928-4749-0x00007FF6DA410000-0x00007FF6DA802000-memory.dmp	upx
behavioral2/memory/2064-4766-0x00007FF7C4DD0000-0x00007FF7C51C2000-memory.dmp	upx
behavioral2/memory/224-4759-0x00007FF7B3A20000-0x00007FF7B3E12000-memory.dmp	upx
behavioral2/memory/1824-4782-0x00007FF69A7F0000-0x00007FF69ABE2000-memory.dmp	upx
behavioral2/memory/1220-4788-0x00007FF7BADF0000-0x00007FF7BB1E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vGbtKEk.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\nbNVcbg.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\aenDxup.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\bQtEhYs.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\BdgbVNV.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\MQDuOcQ.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\dfmcEGH.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\HSFCWhA.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\WYAXkRu.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\ugMzUpe.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\LbZIJoU.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\xMSfeSs.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\JDihyqs.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\vqSnxtQ.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\sXCacie.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\QJYSsTc.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\zSwdNAw.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\gApEkiE.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\TmHtxjB.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\emCQiKs.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\oloPNHE.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\mCAvdLX.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\ikXaDpo.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\GIRTpgH.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\LEQeULY.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\kJomTrK.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\MQpwaTP.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\mdinAoV.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\xxsnInb.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\PVkFzXD.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\bqQiewY.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\miHlPlE.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\XSDqOdA.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\daVWfeK.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\pAcmTYO.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\LUpgyvy.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\MINnNVK.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\HqHrNnF.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\PBGHgXx.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\dSqHsme.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\XmgLjGw.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\toQqXxU.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\Wfxzvoi.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\OJZCozW.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\ReHyuIC.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\EFIFhCS.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\vVZYmbq.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\ywHkHot.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\RFOSvOG.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\uryaJiu.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\iZzyIkW.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\HTZUxCr.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\eviDxTr.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\qikMlLw.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\zAOpoEX.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\FzQdjZo.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\mwaMFAm.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\jkYxMds.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\WhWBJOj.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\JGeFfLH.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\rrsEUGq.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\BDWIuPT.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\gpMBLsc.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
File created	C:\Windows\System\jmEnzKa.exe	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PromotedIconCache = "{7820NR83-23R3-4229-82P1-R41PO67Q5O9P}"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	Process not Found

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3716	powershell.exe
3716	powershell.exe
3716	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeCreateGlobalPrivilege	12868	dwm.exe
Token: SeChangeNotifyPrivilege	12868	dwm.exe
Token: 33	12868	dwm.exe
Token: SeIncBasePriorityPrivilege	12868	dwm.exe
Token: SeCreateGlobalPrivilege	13536	dwm.exe
Token: SeChangeNotifyPrivilege	13536	dwm.exe
Token: 33	13536	dwm.exe
Token: SeIncBasePriorityPrivilege	13536	dwm.exe
Token: SeShutdownPrivilege	17388	Process not Found
Token: SeCreatePagefilePrivilege	17388	Process not Found
Token: SeShutdownPrivilege	17388	Process not Found
Token: SeCreatePagefilePrivilege	17388	Process not Found

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
13232	sihost.exe
17388	Process not Found
17388	Process not Found

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
17388	Process not Found
17388	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 3716	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	82
PID 3232 wrote to memory of 3716	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	82
PID 3232 wrote to memory of 460	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	83
PID 3232 wrote to memory of 460	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	83
PID 3232 wrote to memory of 3436	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	84
PID 3232 wrote to memory of 3436	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	84
PID 3232 wrote to memory of 804	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	85
PID 3232 wrote to memory of 804	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	85
PID 3232 wrote to memory of 3316	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	86
PID 3232 wrote to memory of 3316	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	86
PID 3232 wrote to memory of 316	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	87
PID 3232 wrote to memory of 316	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	87
PID 3232 wrote to memory of 888	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	88
PID 3232 wrote to memory of 888	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	88
PID 3232 wrote to memory of 2540	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	89
PID 3232 wrote to memory of 2540	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	89
PID 3232 wrote to memory of 1612	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	90
PID 3232 wrote to memory of 1612	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	90
PID 3232 wrote to memory of 2064	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	91
PID 3232 wrote to memory of 2064	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	91
PID 3232 wrote to memory of 928	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	92
PID 3232 wrote to memory of 928	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	92
PID 3232 wrote to memory of 3668	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	93
PID 3232 wrote to memory of 3668	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	93
PID 3232 wrote to memory of 2640	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	94
PID 3232 wrote to memory of 2640	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	94
PID 3232 wrote to memory of 224	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	95
PID 3232 wrote to memory of 224	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	95
PID 3232 wrote to memory of 4296	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	96
PID 3232 wrote to memory of 4296	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	96
PID 3232 wrote to memory of 1220	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	97
PID 3232 wrote to memory of 1220	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	97
PID 3232 wrote to memory of 4016	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	98
PID 3232 wrote to memory of 4016	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	98
PID 3232 wrote to memory of 4984	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	99
PID 3232 wrote to memory of 4984	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	99
PID 3232 wrote to memory of 1824	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	100
PID 3232 wrote to memory of 1824	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	100
PID 3232 wrote to memory of 4528	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	101
PID 3232 wrote to memory of 4528	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	101
PID 3232 wrote to memory of 1472	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	102
PID 3232 wrote to memory of 1472	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	102
PID 3232 wrote to memory of 2956	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	103
PID 3232 wrote to memory of 2956	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	103
PID 3232 wrote to memory of 3000	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	104
PID 3232 wrote to memory of 3000	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	104
PID 3232 wrote to memory of 4840	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	105
PID 3232 wrote to memory of 4840	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	105
PID 3232 wrote to memory of 3284	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	106
PID 3232 wrote to memory of 3284	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	106
PID 3232 wrote to memory of 2884	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	107
PID 3232 wrote to memory of 2884	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	107
PID 3232 wrote to memory of 3384	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	108
PID 3232 wrote to memory of 3384	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	108
PID 3232 wrote to memory of 2312	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	109
PID 3232 wrote to memory of 2312	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	109
PID 3232 wrote to memory of 4712	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	110
PID 3232 wrote to memory of 4712	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	110
PID 3232 wrote to memory of 4400	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	111
PID 3232 wrote to memory of 4400	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	111
PID 3232 wrote to memory of 4556	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	112
PID 3232 wrote to memory of 4556	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	112
PID 3232 wrote to memory of 2828	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	113
PID 3232 wrote to memory of 2828	3232	8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8299291116572e81c4a532247dfb92d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3716
- C:\Windows\System\rCaxTaM.exe
  C:\Windows\System\rCaxTaM.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\TahDxYo.exe
  C:\Windows\System\TahDxYo.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\KwXtQCz.exe
  C:\Windows\System\KwXtQCz.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\cDzvkUh.exe
  C:\Windows\System\cDzvkUh.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\abaDNeN.exe
  C:\Windows\System\abaDNeN.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\vhfMflu.exe
  C:\Windows\System\vhfMflu.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\vtaAvEk.exe
  C:\Windows\System\vtaAvEk.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\VbtIQMP.exe
  C:\Windows\System\VbtIQMP.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\nkGvcZa.exe
  C:\Windows\System\nkGvcZa.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\PXlAWkf.exe
  C:\Windows\System\PXlAWkf.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\eymvIKs.exe
  C:\Windows\System\eymvIKs.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\aGPtERH.exe
  C:\Windows\System\aGPtERH.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\xDYXMad.exe
  C:\Windows\System\xDYXMad.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\qTSqOwR.exe
  C:\Windows\System\qTSqOwR.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\UyYSkFX.exe
  C:\Windows\System\UyYSkFX.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\NsnFVVz.exe
  C:\Windows\System\NsnFVVz.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\WIDBRKd.exe
  C:\Windows\System\WIDBRKd.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\smDnDuY.exe
  C:\Windows\System\smDnDuY.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\NhYTrgd.exe
  C:\Windows\System\NhYTrgd.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\EfkpqCE.exe
  C:\Windows\System\EfkpqCE.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\mCxThyf.exe
  C:\Windows\System\mCxThyf.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\tBWVGaS.exe
  C:\Windows\System\tBWVGaS.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\ATrIJLo.exe
  C:\Windows\System\ATrIJLo.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\UqlBEcd.exe
  C:\Windows\System\UqlBEcd.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\ocnAtkt.exe
  C:\Windows\System\ocnAtkt.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\uSBRNyt.exe
  C:\Windows\System\uSBRNyt.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\mlaBpdE.exe
  C:\Windows\System\mlaBpdE.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\FpgDkkI.exe
  C:\Windows\System\FpgDkkI.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\qEDbQsA.exe
  C:\Windows\System\qEDbQsA.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\kiNkmmz.exe
  C:\Windows\System\kiNkmmz.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\yvTGtoL.exe
  C:\Windows\System\yvTGtoL.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\vdCCXcF.exe
  C:\Windows\System\vdCCXcF.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\zDvIUiP.exe
  C:\Windows\System\zDvIUiP.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\GKijVpV.exe
  C:\Windows\System\GKijVpV.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\UwSMRtu.exe
  C:\Windows\System\UwSMRtu.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\hdJBsBD.exe
  C:\Windows\System\hdJBsBD.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\jsPNMpP.exe
  C:\Windows\System\jsPNMpP.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\fXIsVGx.exe
  C:\Windows\System\fXIsVGx.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\QZcooZW.exe
  C:\Windows\System\QZcooZW.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\tuCLvkz.exe
  C:\Windows\System\tuCLvkz.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\bQDCjjD.exe
  C:\Windows\System\bQDCjjD.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\IRVTZRt.exe
  C:\Windows\System\IRVTZRt.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\xKtAPPY.exe
  C:\Windows\System\xKtAPPY.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\bVnTOEF.exe
  C:\Windows\System\bVnTOEF.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\tJVFZdp.exe
  C:\Windows\System\tJVFZdp.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\TdvScSQ.exe
  C:\Windows\System\TdvScSQ.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\zYrJBSm.exe
  C:\Windows\System\zYrJBSm.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\IjOrzEj.exe
  C:\Windows\System\IjOrzEj.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\kBPHnmg.exe
  C:\Windows\System\kBPHnmg.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\saZUtBZ.exe
  C:\Windows\System\saZUtBZ.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\xCJYLrI.exe
  C:\Windows\System\xCJYLrI.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\LanoQXI.exe
  C:\Windows\System\LanoQXI.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\uaYZnIO.exe
  C:\Windows\System\uaYZnIO.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\KjBACjR.exe
  C:\Windows\System\KjBACjR.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\MMyvyYa.exe
  C:\Windows\System\MMyvyYa.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\KmPgYDJ.exe
  C:\Windows\System\KmPgYDJ.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\KwLGmwM.exe
  C:\Windows\System\KwLGmwM.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\NLTMmxz.exe
  C:\Windows\System\NLTMmxz.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\MvLSCMF.exe
  C:\Windows\System\MvLSCMF.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\TifynKQ.exe
  C:\Windows\System\TifynKQ.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\vqtfLXg.exe
  C:\Windows\System\vqtfLXg.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\lhQzIcR.exe
  C:\Windows\System\lhQzIcR.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\KZVgTMU.exe
  C:\Windows\System\KZVgTMU.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\czvMgRF.exe
  C:\Windows\System\czvMgRF.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\GpjmFng.exe
  C:\Windows\System\GpjmFng.exe
  2⤵
  PID:3796
- C:\Windows\System\pLPeWYP.exe
  C:\Windows\System\pLPeWYP.exe
  2⤵
  PID:628
- C:\Windows\System\adsKmEx.exe
  C:\Windows\System\adsKmEx.exe
  2⤵
  PID:4576
- C:\Windows\System\plewAPk.exe
  C:\Windows\System\plewAPk.exe
  2⤵
  PID:3624
- C:\Windows\System\zJhVnug.exe
  C:\Windows\System\zJhVnug.exe
  2⤵
  PID:1212
- C:\Windows\System\KXGzMgH.exe
  C:\Windows\System\KXGzMgH.exe
  2⤵
  PID:5048
- C:\Windows\System\buHjnVj.exe
  C:\Windows\System\buHjnVj.exe
  2⤵
  PID:2756
- C:\Windows\System\fJAmMJt.exe
  C:\Windows\System\fJAmMJt.exe
  2⤵
  PID:336
- C:\Windows\System\nkQvgCp.exe
  C:\Windows\System\nkQvgCp.exe
  2⤵
  PID:116
- C:\Windows\System\ukhmxfw.exe
  C:\Windows\System\ukhmxfw.exe
  2⤵
  PID:1080
- C:\Windows\System\owXnFXU.exe
  C:\Windows\System\owXnFXU.exe
  2⤵
  PID:2188
- C:\Windows\System\dBFUinC.exe
  C:\Windows\System\dBFUinC.exe
  2⤵
  PID:4560
- C:\Windows\System\AYRGbjq.exe
  C:\Windows\System\AYRGbjq.exe
  2⤵
  PID:700
- C:\Windows\System\ZtEqjan.exe
  C:\Windows\System\ZtEqjan.exe
  2⤵
  PID:4584
- C:\Windows\System\HSjpPNn.exe
  C:\Windows\System\HSjpPNn.exe
  2⤵
  PID:2552
- C:\Windows\System\EIxsOvT.exe
  C:\Windows\System\EIxsOvT.exe
  2⤵
  PID:4196
- C:\Windows\System\aKzPMoB.exe
  C:\Windows\System\aKzPMoB.exe
  2⤵
  PID:4688
- C:\Windows\System\bBVJaNM.exe
  C:\Windows\System\bBVJaNM.exe
  2⤵
  PID:3692
- C:\Windows\System\XyIaFPF.exe
  C:\Windows\System\XyIaFPF.exe
  2⤵
  PID:3096
- C:\Windows\System\rBKpcnl.exe
  C:\Windows\System\rBKpcnl.exe
  2⤵
  PID:4500
- C:\Windows\System\XXyPPhm.exe
  C:\Windows\System\XXyPPhm.exe
  2⤵
  PID:3432
- C:\Windows\System\oqJEEDW.exe
  C:\Windows\System\oqJEEDW.exe
  2⤵
  PID:2460
- C:\Windows\System\dXkkDKI.exe
  C:\Windows\System\dXkkDKI.exe
  2⤵
  PID:468
- C:\Windows\System\HZwmNxg.exe
  C:\Windows\System\HZwmNxg.exe
  2⤵
  PID:3192
- C:\Windows\System\iVFqKEV.exe
  C:\Windows\System\iVFqKEV.exe
  2⤵
  PID:2464
- C:\Windows\System\raigvOH.exe
  C:\Windows\System\raigvOH.exe
  2⤵
  PID:2108
- C:\Windows\System\HZcSJTq.exe
  C:\Windows\System\HZcSJTq.exe
  2⤵
  PID:1676
- C:\Windows\System\ybCTosh.exe
  C:\Windows\System\ybCTosh.exe
  2⤵
  PID:5136
- C:\Windows\System\BylvxGG.exe
  C:\Windows\System\BylvxGG.exe
  2⤵
  PID:5160
- C:\Windows\System\EwcGqOy.exe
  C:\Windows\System\EwcGqOy.exe
  2⤵
  PID:5184
- C:\Windows\System\FieBVJr.exe
  C:\Windows\System\FieBVJr.exe
  2⤵
  PID:5200
- C:\Windows\System\pJrAcAz.exe
  C:\Windows\System\pJrAcAz.exe
  2⤵
  PID:5224
- C:\Windows\System\RtSxCIt.exe
  C:\Windows\System\RtSxCIt.exe
  2⤵
  PID:5244
- C:\Windows\System\EUWnjCc.exe
  C:\Windows\System\EUWnjCc.exe
  2⤵
  PID:5260
- C:\Windows\System\jbFmMxb.exe
  C:\Windows\System\jbFmMxb.exe
  2⤵
  PID:5300
- C:\Windows\System\gjWuvMc.exe
  C:\Windows\System\gjWuvMc.exe
  2⤵
  PID:5332
- C:\Windows\System\mYhSdAY.exe
  C:\Windows\System\mYhSdAY.exe
  2⤵
  PID:5348
- C:\Windows\System\ZxwajWE.exe
  C:\Windows\System\ZxwajWE.exe
  2⤵
  PID:5376
- C:\Windows\System\BzsUdBi.exe
  C:\Windows\System\BzsUdBi.exe
  2⤵
  PID:5396
- C:\Windows\System\CNPaLyt.exe
  C:\Windows\System\CNPaLyt.exe
  2⤵
  PID:5420
- C:\Windows\System\EqgIFiq.exe
  C:\Windows\System\EqgIFiq.exe
  2⤵
  PID:5444
- C:\Windows\System\pxFBqEf.exe
  C:\Windows\System\pxFBqEf.exe
  2⤵
  PID:5468
- C:\Windows\System\JKTMPAS.exe
  C:\Windows\System\JKTMPAS.exe
  2⤵
  PID:5488
- C:\Windows\System\aJswtVF.exe
  C:\Windows\System\aJswtVF.exe
  2⤵
  PID:5508
- C:\Windows\System\fWleGNh.exe
  C:\Windows\System\fWleGNh.exe
  2⤵
  PID:5532
- C:\Windows\System\HppQwTP.exe
  C:\Windows\System\HppQwTP.exe
  2⤵
  PID:5552
- C:\Windows\System\ZzMLQKt.exe
  C:\Windows\System\ZzMLQKt.exe
  2⤵
  PID:5568
- C:\Windows\System\IKspOOL.exe
  C:\Windows\System\IKspOOL.exe
  2⤵
  PID:5596
- C:\Windows\System\KLBxfpu.exe
  C:\Windows\System\KLBxfpu.exe
  2⤵
  PID:5616
- C:\Windows\System\rNhHVCw.exe
  C:\Windows\System\rNhHVCw.exe
  2⤵
  PID:5636
- C:\Windows\System\XMvEFMc.exe
  C:\Windows\System\XMvEFMc.exe
  2⤵
  PID:5660
- C:\Windows\System\lZdkyRT.exe
  C:\Windows\System\lZdkyRT.exe
  2⤵
  PID:5676
- C:\Windows\System\teZYoae.exe
  C:\Windows\System\teZYoae.exe
  2⤵
  PID:5700
- C:\Windows\System\QUZzgIw.exe
  C:\Windows\System\QUZzgIw.exe
  2⤵
  PID:5720
- C:\Windows\System\aKaNtOX.exe
  C:\Windows\System\aKaNtOX.exe
  2⤵
  PID:5736
- C:\Windows\System\oqcTOeT.exe
  C:\Windows\System\oqcTOeT.exe
  2⤵
  PID:5760
- C:\Windows\System\wmxBJec.exe
  C:\Windows\System\wmxBJec.exe
  2⤵
  PID:5780
- C:\Windows\System\MdRhalO.exe
  C:\Windows\System\MdRhalO.exe
  2⤵
  PID:5796
- C:\Windows\System\qJSeUVg.exe
  C:\Windows\System\qJSeUVg.exe
  2⤵
  PID:5832
- C:\Windows\System\QGlRdxh.exe
  C:\Windows\System\QGlRdxh.exe
  2⤵
  PID:5848
- C:\Windows\System\OwpLhmF.exe
  C:\Windows\System\OwpLhmF.exe
  2⤵
  PID:5876
- C:\Windows\System\mZujGsx.exe
  C:\Windows\System\mZujGsx.exe
  2⤵
  PID:5892
- C:\Windows\System\QDtPHpO.exe
  C:\Windows\System\QDtPHpO.exe
  2⤵
  PID:5916
- C:\Windows\System\tqsZMil.exe
  C:\Windows\System\tqsZMil.exe
  2⤵
  PID:5936
- C:\Windows\System\LLrcDFQ.exe
  C:\Windows\System\LLrcDFQ.exe
  2⤵
  PID:5960
- C:\Windows\System\CNJDpap.exe
  C:\Windows\System\CNJDpap.exe
  2⤵
  PID:5976
- C:\Windows\System\tASlCkp.exe
  C:\Windows\System\tASlCkp.exe
  2⤵
  PID:6000
- C:\Windows\System\nCYhWWb.exe
  C:\Windows\System\nCYhWWb.exe
  2⤵
  PID:6020
- C:\Windows\System\MvoheZe.exe
  C:\Windows\System\MvoheZe.exe
  2⤵
  PID:6040
- C:\Windows\System\XpAepMQ.exe
  C:\Windows\System\XpAepMQ.exe
  2⤵
  PID:6056
- C:\Windows\System\ZBjNzkz.exe
  C:\Windows\System\ZBjNzkz.exe
  2⤵
  PID:6076
- C:\Windows\System\QYoapNP.exe
  C:\Windows\System\QYoapNP.exe
  2⤵
  PID:6096
- C:\Windows\System\ZvMyjoc.exe
  C:\Windows\System\ZvMyjoc.exe
  2⤵
  PID:6124
- C:\Windows\System\dTuHxRm.exe
  C:\Windows\System\dTuHxRm.exe
  2⤵
  PID:6140
- C:\Windows\System\CDpOMTu.exe
  C:\Windows\System\CDpOMTu.exe
  2⤵
  PID:2356
- C:\Windows\System\mmlDzye.exe
  C:\Windows\System\mmlDzye.exe
  2⤵
  PID:5044
- C:\Windows\System\WxHEMMJ.exe
  C:\Windows\System\WxHEMMJ.exe
  2⤵
  PID:3780
- C:\Windows\System\ZfZWZWe.exe
  C:\Windows\System\ZfZWZWe.exe
  2⤵
  PID:4156
- C:\Windows\System\MUNbSlY.exe
  C:\Windows\System\MUNbSlY.exe
  2⤵
  PID:4716
- C:\Windows\System\exPpIhc.exe
  C:\Windows\System\exPpIhc.exe
  2⤵
  PID:4604
- C:\Windows\System\zXHBzkR.exe
  C:\Windows\System\zXHBzkR.exe
  2⤵
  PID:3680
- C:\Windows\System\VYnyeMC.exe
  C:\Windows\System\VYnyeMC.exe
  2⤵
  PID:3188
- C:\Windows\System\BIjvcqQ.exe
  C:\Windows\System\BIjvcqQ.exe
  2⤵
  PID:3700
- C:\Windows\System\AvxFaGu.exe
  C:\Windows\System\AvxFaGu.exe
  2⤵
  PID:2560
- C:\Windows\System\PKspvXH.exe
  C:\Windows\System\PKspvXH.exe
  2⤵
  PID:2320
- C:\Windows\System\meuUCcI.exe
  C:\Windows\System\meuUCcI.exe
  2⤵
  PID:3672
- C:\Windows\System\AfkEAbS.exe
  C:\Windows\System\AfkEAbS.exe
  2⤵
  PID:5452
- C:\Windows\System\dyQaHFy.exe
  C:\Windows\System\dyQaHFy.exe
  2⤵
  PID:5528
- C:\Windows\System\dwOQEsx.exe
  C:\Windows\System\dwOQEsx.exe
  2⤵
  PID:6152
- C:\Windows\System\wTFtJRD.exe
  C:\Windows\System\wTFtJRD.exe
  2⤵
  PID:6172
- C:\Windows\System\CbnRinL.exe
  C:\Windows\System\CbnRinL.exe
  2⤵
  PID:6188
- C:\Windows\System\EEfoneR.exe
  C:\Windows\System\EEfoneR.exe
  2⤵
  PID:6216
- C:\Windows\System\dkbEQne.exe
  C:\Windows\System\dkbEQne.exe
  2⤵
  PID:6236
- C:\Windows\System\OmqYdMy.exe
  C:\Windows\System\OmqYdMy.exe
  2⤵
  PID:6260
- C:\Windows\System\WHcNMig.exe
  C:\Windows\System\WHcNMig.exe
  2⤵
  PID:6280
- C:\Windows\System\PfwPHwZ.exe
  C:\Windows\System\PfwPHwZ.exe
  2⤵
  PID:6300
- C:\Windows\System\FrPrQGf.exe
  C:\Windows\System\FrPrQGf.exe
  2⤵
  PID:6316
- C:\Windows\System\dTTVnyt.exe
  C:\Windows\System\dTTVnyt.exe
  2⤵
  PID:6340
- C:\Windows\System\WStHlPu.exe
  C:\Windows\System\WStHlPu.exe
  2⤵
  PID:6360
- C:\Windows\System\xHaXKAm.exe
  C:\Windows\System\xHaXKAm.exe
  2⤵
  PID:6380
- C:\Windows\System\YxEZHzv.exe
  C:\Windows\System\YxEZHzv.exe
  2⤵
  PID:6404
- C:\Windows\System\tSfdIbj.exe
  C:\Windows\System\tSfdIbj.exe
  2⤵
  PID:6420
- C:\Windows\System\HIDJLiG.exe
  C:\Windows\System\HIDJLiG.exe
  2⤵
  PID:6448
- C:\Windows\System\URJbxkm.exe
  C:\Windows\System\URJbxkm.exe
  2⤵
  PID:6468
- C:\Windows\System\SHnemby.exe
  C:\Windows\System\SHnemby.exe
  2⤵
  PID:6484
- C:\Windows\System\qWfQNOD.exe
  C:\Windows\System\qWfQNOD.exe
  2⤵
  PID:6512
- C:\Windows\System\xDRJIHW.exe
  C:\Windows\System\xDRJIHW.exe
  2⤵
  PID:6532
- C:\Windows\System\wYgJRrd.exe
  C:\Windows\System\wYgJRrd.exe
  2⤵
  PID:6552
- C:\Windows\System\NwNtgTs.exe
  C:\Windows\System\NwNtgTs.exe
  2⤵
  PID:6576
- C:\Windows\System\QENCrxa.exe
  C:\Windows\System\QENCrxa.exe
  2⤵
  PID:6600
- C:\Windows\System\gFPueLY.exe
  C:\Windows\System\gFPueLY.exe
  2⤵
  PID:6616
- C:\Windows\System\AZudHXu.exe
  C:\Windows\System\AZudHXu.exe
  2⤵
  PID:6640
- C:\Windows\System\SMJINhV.exe
  C:\Windows\System\SMJINhV.exe
  2⤵
  PID:6660
- C:\Windows\System\tGyRWeq.exe
  C:\Windows\System\tGyRWeq.exe
  2⤵
  PID:6680
- C:\Windows\System\xXdemUu.exe
  C:\Windows\System\xXdemUu.exe
  2⤵
  PID:6704
- C:\Windows\System\oOuQnAX.exe
  C:\Windows\System\oOuQnAX.exe
  2⤵
  PID:6720
- C:\Windows\System\XzgSnXl.exe
  C:\Windows\System\XzgSnXl.exe
  2⤵
  PID:6740
- C:\Windows\System\QoDDOGY.exe
  C:\Windows\System\QoDDOGY.exe
  2⤵
  PID:6764
- C:\Windows\System\avascxx.exe
  C:\Windows\System\avascxx.exe
  2⤵
  PID:6780
- C:\Windows\System\uDrYxDV.exe
  C:\Windows\System\uDrYxDV.exe
  2⤵
  PID:6812
- C:\Windows\System\QGJhNKQ.exe
  C:\Windows\System\QGJhNKQ.exe
  2⤵
  PID:6828
- C:\Windows\System\PFvtErn.exe
  C:\Windows\System\PFvtErn.exe
  2⤵
  PID:6848
- C:\Windows\System\sdtoVha.exe
  C:\Windows\System\sdtoVha.exe
  2⤵
  PID:6868
- C:\Windows\System\PBxoSxW.exe
  C:\Windows\System\PBxoSxW.exe
  2⤵
  PID:6900
- C:\Windows\System\tvKFZck.exe
  C:\Windows\System\tvKFZck.exe
  2⤵
  PID:6928
- C:\Windows\System\VjAvHIi.exe
  C:\Windows\System\VjAvHIi.exe
  2⤵
  PID:6956
- C:\Windows\System\MFkjygS.exe
  C:\Windows\System\MFkjygS.exe
  2⤵
  PID:6976
- C:\Windows\System\YyOAFZE.exe
  C:\Windows\System\YyOAFZE.exe
  2⤵
  PID:7000
- C:\Windows\System\Vxdtpkq.exe
  C:\Windows\System\Vxdtpkq.exe
  2⤵
  PID:7020
- C:\Windows\System\gdwqJkJ.exe
  C:\Windows\System\gdwqJkJ.exe
  2⤵
  PID:7040
- C:\Windows\System\YgsDUQs.exe
  C:\Windows\System\YgsDUQs.exe
  2⤵
  PID:7060
- C:\Windows\System\fydORCL.exe
  C:\Windows\System\fydORCL.exe
  2⤵
  PID:7084
- C:\Windows\System\UHPDnrW.exe
  C:\Windows\System\UHPDnrW.exe
  2⤵
  PID:7108
- C:\Windows\System\phkVaFG.exe
  C:\Windows\System\phkVaFG.exe
  2⤵
  PID:7128
- C:\Windows\System\kwdTqbo.exe
  C:\Windows\System\kwdTqbo.exe
  2⤵
  PID:7152
- C:\Windows\System\JAstQMa.exe
  C:\Windows\System\JAstQMa.exe
  2⤵
  PID:5672
- C:\Windows\System\cSjSCIc.exe
  C:\Windows\System\cSjSCIc.exe
  2⤵
  PID:4908
- C:\Windows\System\frglLGY.exe
  C:\Windows\System\frglLGY.exe
  2⤵
  PID:5768
- C:\Windows\System\nfwKkeA.exe
  C:\Windows\System\nfwKkeA.exe
  2⤵
  PID:228
- C:\Windows\System\AjASlPy.exe
  C:\Windows\System\AjASlPy.exe
  2⤵
  PID:1172
- C:\Windows\System\YUmozlf.exe
  C:\Windows\System\YUmozlf.exe
  2⤵
  PID:2984
- C:\Windows\System\AbxCCae.exe
  C:\Windows\System\AbxCCae.exe
  2⤵
  PID:5932
- C:\Windows\System\OmieEjd.exe
  C:\Windows\System\OmieEjd.exe
  2⤵
  PID:4036
- C:\Windows\System\vDeEMJJ.exe
  C:\Windows\System\vDeEMJJ.exe
  2⤵
  PID:2568
- C:\Windows\System\aYtEGAH.exe
  C:\Windows\System\aYtEGAH.exe
  2⤵
  PID:5252
- C:\Windows\System\bZGUcBv.exe
  C:\Windows\System\bZGUcBv.exe
  2⤵
  PID:4308
- C:\Windows\System\LfwGxvZ.exe
  C:\Windows\System\LfwGxvZ.exe
  2⤵
  PID:5412
- C:\Windows\System\KIEhDdw.exe
  C:\Windows\System\KIEhDdw.exe
  2⤵
  PID:4492
- C:\Windows\System\gSveADL.exe
  C:\Windows\System\gSveADL.exe
  2⤵
  PID:5500
- C:\Windows\System\kBaEILq.exe
  C:\Windows\System\kBaEILq.exe
  2⤵
  PID:4384
- C:\Windows\System\RRfJVgo.exe
  C:\Windows\System\RRfJVgo.exe
  2⤵
  PID:1880
- C:\Windows\System\rctgYcH.exe
  C:\Windows\System\rctgYcH.exe
  2⤵
  PID:5696
- C:\Windows\System\FOiusaO.exe
  C:\Windows\System\FOiusaO.exe
  2⤵
  PID:5728
- C:\Windows\System\huQoefW.exe
  C:\Windows\System\huQoefW.exe
  2⤵
  PID:6332
- C:\Windows\System\SVXfdHG.exe
  C:\Windows\System\SVXfdHG.exe
  2⤵
  PID:6376
- C:\Windows\System\PRLBStz.exe
  C:\Windows\System\PRLBStz.exe
  2⤵
  PID:5844
- C:\Windows\System\HcifcDQ.exe
  C:\Windows\System\HcifcDQ.exe
  2⤵
  PID:5900
- C:\Windows\System\minqMXX.exe
  C:\Windows\System\minqMXX.exe
  2⤵
  PID:6500
- C:\Windows\System\dAktIha.exe
  C:\Windows\System\dAktIha.exe
  2⤵
  PID:5944
- C:\Windows\System\dJuRDAp.exe
  C:\Windows\System\dJuRDAp.exe
  2⤵
  PID:5968
- C:\Windows\System\WYyoyKj.exe
  C:\Windows\System\WYyoyKj.exe
  2⤵
  PID:6012
- C:\Windows\System\SDwNABM.exe
  C:\Windows\System\SDwNABM.exe
  2⤵
  PID:6608
- C:\Windows\System\VvmKfAd.exe
  C:\Windows\System\VvmKfAd.exe
  2⤵
  PID:5220
- C:\Windows\System\IzkUYFk.exe
  C:\Windows\System\IzkUYFk.exe
  2⤵
  PID:6104
- C:\Windows\System\yIgiOME.exe
  C:\Windows\System\yIgiOME.exe
  2⤵
  PID:5272
- C:\Windows\System\aWkYQML.exe
  C:\Windows\System\aWkYQML.exe
  2⤵
  PID:3196
- C:\Windows\System\fFsBknD.exe
  C:\Windows\System\fFsBknD.exe
  2⤵
  PID:3816
- C:\Windows\System\YOwWhFJ.exe
  C:\Windows\System\YOwWhFJ.exe
  2⤵
  PID:7172
- C:\Windows\System\ujmEHyi.exe
  C:\Windows\System\ujmEHyi.exe
  2⤵
  PID:7204
- C:\Windows\System\uVpCavh.exe
  C:\Windows\System\uVpCavh.exe
  2⤵
  PID:7220
- C:\Windows\System\ImIdQiZ.exe
  C:\Windows\System\ImIdQiZ.exe
  2⤵
  PID:7248
- C:\Windows\System\jjKpfmO.exe
  C:\Windows\System\jjKpfmO.exe
  2⤵
  PID:7268
- C:\Windows\System\TvmKHFV.exe
  C:\Windows\System\TvmKHFV.exe
  2⤵
  PID:7288
- C:\Windows\System\oCFEWAC.exe
  C:\Windows\System\oCFEWAC.exe
  2⤵
  PID:7308
- C:\Windows\System\ZjpFMto.exe
  C:\Windows\System\ZjpFMto.exe
  2⤵
  PID:7328
- C:\Windows\System\MuZHmnQ.exe
  C:\Windows\System\MuZHmnQ.exe
  2⤵
  PID:7356
- C:\Windows\System\DTdKMKF.exe
  C:\Windows\System\DTdKMKF.exe
  2⤵
  PID:7372
- C:\Windows\System\fLzUttC.exe
  C:\Windows\System\fLzUttC.exe
  2⤵
  PID:7392
- C:\Windows\System\TiUavXn.exe
  C:\Windows\System\TiUavXn.exe
  2⤵
  PID:7428
- C:\Windows\System\ZnuskFj.exe
  C:\Windows\System\ZnuskFj.exe
  2⤵
  PID:7448
- C:\Windows\System\tWXhjwu.exe
  C:\Windows\System\tWXhjwu.exe
  2⤵
  PID:7464
- C:\Windows\System\OWAnzxw.exe
  C:\Windows\System\OWAnzxw.exe
  2⤵
  PID:7488
- C:\Windows\System\wfUqXBX.exe
  C:\Windows\System\wfUqXBX.exe
  2⤵
  PID:7520
- C:\Windows\System\AtaOGUk.exe
  C:\Windows\System\AtaOGUk.exe
  2⤵
  PID:7544
- C:\Windows\System\tWQtHGu.exe
  C:\Windows\System\tWQtHGu.exe
  2⤵
  PID:7560
- C:\Windows\System\NOCbTVE.exe
  C:\Windows\System\NOCbTVE.exe
  2⤵
  PID:7576
- C:\Windows\System\lCZxiNW.exe
  C:\Windows\System\lCZxiNW.exe
  2⤵
  PID:7592
- C:\Windows\System\wwoXTWw.exe
  C:\Windows\System\wwoXTWw.exe
  2⤵
  PID:7616
- C:\Windows\System\oknuqay.exe
  C:\Windows\System\oknuqay.exe
  2⤵
  PID:7640
- C:\Windows\System\tBbIcdb.exe
  C:\Windows\System\tBbIcdb.exe
  2⤵
  PID:7664
- C:\Windows\System\RxafxjK.exe
  C:\Windows\System\RxafxjK.exe
  2⤵
  PID:7680
- C:\Windows\System\gPIkEox.exe
  C:\Windows\System\gPIkEox.exe
  2⤵
  PID:7772
- C:\Windows\System\dNCvbQj.exe
  C:\Windows\System\dNCvbQj.exe
  2⤵
  PID:7788
- C:\Windows\System\tizvsBU.exe
  C:\Windows\System\tizvsBU.exe
  2⤵
  PID:7816
- C:\Windows\System\SifrPLd.exe
  C:\Windows\System\SifrPLd.exe
  2⤵
  PID:7832
- C:\Windows\System\weNzbEk.exe
  C:\Windows\System\weNzbEk.exe
  2⤵
  PID:7852
- C:\Windows\System\wgrLdAh.exe
  C:\Windows\System\wgrLdAh.exe
  2⤵
  PID:7872
- C:\Windows\System\FtLAiEM.exe
  C:\Windows\System\FtLAiEM.exe
  2⤵
  PID:7888
- C:\Windows\System\dSJaIrB.exe
  C:\Windows\System\dSJaIrB.exe
  2⤵
  PID:7912
- C:\Windows\System\iqBBkih.exe
  C:\Windows\System\iqBBkih.exe
  2⤵
  PID:7936
- C:\Windows\System\FUIKYIk.exe
  C:\Windows\System\FUIKYIk.exe
  2⤵
  PID:7956
- C:\Windows\System\FsiiXLY.exe
  C:\Windows\System\FsiiXLY.exe
  2⤵
  PID:7976
- C:\Windows\System\kQXRCoQ.exe
  C:\Windows\System\kQXRCoQ.exe
  2⤵
  PID:8000
- C:\Windows\System\ELOoxkb.exe
  C:\Windows\System\ELOoxkb.exe
  2⤵
  PID:8020
- C:\Windows\System\qzKSIcj.exe
  C:\Windows\System\qzKSIcj.exe
  2⤵
  PID:8044
- C:\Windows\System\kPwnuEW.exe
  C:\Windows\System\kPwnuEW.exe
  2⤵
  PID:8060
- C:\Windows\System\lPdpeeL.exe
  C:\Windows\System\lPdpeeL.exe
  2⤵
  PID:8088
- C:\Windows\System\dGZepgU.exe
  C:\Windows\System\dGZepgU.exe
  2⤵
  PID:8104
- C:\Windows\System\SftjcSo.exe
  C:\Windows\System\SftjcSo.exe
  2⤵
  PID:8132
- C:\Windows\System\FjKxAGr.exe
  C:\Windows\System\FjKxAGr.exe
  2⤵
  PID:8156
- C:\Windows\System\UMFTcIO.exe
  C:\Windows\System\UMFTcIO.exe
  2⤵
  PID:8172
- C:\Windows\System\KspFUev.exe
  C:\Windows\System\KspFUev.exe
  2⤵
  PID:5364
- C:\Windows\System\rTiAXjG.exe
  C:\Windows\System\rTiAXjG.exe
  2⤵
  PID:6844
- C:\Windows\System\tPosVWw.exe
  C:\Windows\System\tPosVWw.exe
  2⤵
  PID:5520
- C:\Windows\System\fvgFCfi.exe
  C:\Windows\System\fvgFCfi.exe
  2⤵
  PID:5476
- C:\Windows\System\xqGwtmK.exe
  C:\Windows\System\xqGwtmK.exe
  2⤵
  PID:5756
- C:\Windows\System\YPwYBJo.exe
  C:\Windows\System\YPwYBJo.exe
  2⤵
  PID:5788
- C:\Windows\System\JtPpYpI.exe
  C:\Windows\System\JtPpYpI.exe
  2⤵
  PID:5868
- C:\Windows\System\hsvuxOj.exe
  C:\Windows\System\hsvuxOj.exe
  2⤵
  PID:6476
- C:\Windows\System\JFRiwAN.exe
  C:\Windows\System\JFRiwAN.exe
  2⤵
  PID:7032
- C:\Windows\System\SZiliWi.exe
  C:\Windows\System\SZiliWi.exe
  2⤵
  PID:1960
- C:\Windows\System\fFyQCLp.exe
  C:\Windows\System\fFyQCLp.exe
  2⤵
  PID:5392
- C:\Windows\System\pQzZudI.exe
  C:\Windows\System\pQzZudI.exe
  2⤵
  PID:6232
- C:\Windows\System\CNYhsyE.exe
  C:\Windows\System\CNYhsyE.exe
  2⤵
  PID:6064
- C:\Windows\System\tYMejzP.exe
  C:\Windows\System\tYMejzP.exe
  2⤵
  PID:6480
- C:\Windows\System\PEObbcr.exe
  C:\Windows\System\PEObbcr.exe
  2⤵
  PID:5972
- C:\Windows\System\rlfzbxl.exe
  C:\Windows\System\rlfzbxl.exe
  2⤵
  PID:5312
- C:\Windows\System\kCYSZXz.exe
  C:\Windows\System\kCYSZXz.exe
  2⤵
  PID:6760
- C:\Windows\System\wrZlAlt.exe
  C:\Windows\System\wrZlAlt.exe
  2⤵
  PID:7284
- C:\Windows\System\QNwvwnc.exe
  C:\Windows\System\QNwvwnc.exe
  2⤵
  PID:8196
- C:\Windows\System\ZcAiAaR.exe
  C:\Windows\System\ZcAiAaR.exe
  2⤵
  PID:8216
- C:\Windows\System\dIHEeBT.exe
  C:\Windows\System\dIHEeBT.exe
  2⤵
  PID:8232
- C:\Windows\System\gPuaLJv.exe
  C:\Windows\System\gPuaLJv.exe
  2⤵
  PID:8252
- C:\Windows\System\aZfVNbX.exe
  C:\Windows\System\aZfVNbX.exe
  2⤵
  PID:8276
- C:\Windows\System\raMTMAq.exe
  C:\Windows\System\raMTMAq.exe
  2⤵
  PID:8300
- C:\Windows\System\DsDueCP.exe
  C:\Windows\System\DsDueCP.exe
  2⤵
  PID:8320
- C:\Windows\System\hIMxAKN.exe
  C:\Windows\System\hIMxAKN.exe
  2⤵
  PID:8344
- C:\Windows\System\QHGnspC.exe
  C:\Windows\System\QHGnspC.exe
  2⤵
  PID:8360
- C:\Windows\System\okmAKwg.exe
  C:\Windows\System\okmAKwg.exe
  2⤵
  PID:8396
- C:\Windows\System\LQdUaqA.exe
  C:\Windows\System\LQdUaqA.exe
  2⤵
  PID:8420
- C:\Windows\System\nymZKUZ.exe
  C:\Windows\System\nymZKUZ.exe
  2⤵
  PID:8436
- C:\Windows\System\lylqdLV.exe
  C:\Windows\System\lylqdLV.exe
  2⤵
  PID:8456
- C:\Windows\System\IfLVfGi.exe
  C:\Windows\System\IfLVfGi.exe
  2⤵
  PID:8484
- C:\Windows\System\seIgtuQ.exe
  C:\Windows\System\seIgtuQ.exe
  2⤵
  PID:8500
- C:\Windows\System\zSGfUDq.exe
  C:\Windows\System\zSGfUDq.exe
  2⤵
  PID:8536
- C:\Windows\System\pMkjFZx.exe
  C:\Windows\System\pMkjFZx.exe
  2⤵
  PID:8552
- C:\Windows\System\PGgVOyh.exe
  C:\Windows\System\PGgVOyh.exe
  2⤵
  PID:8576
- C:\Windows\System\NUhftXz.exe
  C:\Windows\System\NUhftXz.exe
  2⤵
  PID:8600
- C:\Windows\System\FZiluQU.exe
  C:\Windows\System\FZiluQU.exe
  2⤵
  PID:8620
- C:\Windows\System\ngaIMuH.exe
  C:\Windows\System\ngaIMuH.exe
  2⤵
  PID:8644
- C:\Windows\System\egGDuHV.exe
  C:\Windows\System\egGDuHV.exe
  2⤵
  PID:8664
- C:\Windows\System\ahNWzIv.exe
  C:\Windows\System\ahNWzIv.exe
  2⤵
  PID:8684
- C:\Windows\System\KxtUIOz.exe
  C:\Windows\System\KxtUIOz.exe
  2⤵
  PID:8700
- C:\Windows\System\YCqUgYE.exe
  C:\Windows\System\YCqUgYE.exe
  2⤵
  PID:8720
- C:\Windows\System\AEyzUIe.exe
  C:\Windows\System\AEyzUIe.exe
  2⤵
  PID:8748
- C:\Windows\System\PmLXAiR.exe
  C:\Windows\System\PmLXAiR.exe
  2⤵
  PID:8772
- C:\Windows\System\vpatsyB.exe
  C:\Windows\System\vpatsyB.exe
  2⤵
  PID:8792
- C:\Windows\System\xvTeEZR.exe
  C:\Windows\System\xvTeEZR.exe
  2⤵
  PID:8808
- C:\Windows\System\MULlQVV.exe
  C:\Windows\System\MULlQVV.exe
  2⤵
  PID:8828
- C:\Windows\System\bQDkwPp.exe
  C:\Windows\System\bQDkwPp.exe
  2⤵
  PID:8844
- C:\Windows\System\nWcNRYf.exe
  C:\Windows\System\nWcNRYf.exe
  2⤵
  PID:8864
- C:\Windows\System\TDsjufv.exe
  C:\Windows\System\TDsjufv.exe
  2⤵
  PID:8880
- C:\Windows\System\cbURHdn.exe
  C:\Windows\System\cbURHdn.exe
  2⤵
  PID:8900
- C:\Windows\System\OIDfuAO.exe
  C:\Windows\System\OIDfuAO.exe
  2⤵
  PID:8924
- C:\Windows\System\scEuDWd.exe
  C:\Windows\System\scEuDWd.exe
  2⤵
  PID:8940
- C:\Windows\System\DOJMMfq.exe
  C:\Windows\System\DOJMMfq.exe
  2⤵
  PID:8968
- C:\Windows\System\xmbuWJH.exe
  C:\Windows\System\xmbuWJH.exe
  2⤵
  PID:8992
- C:\Windows\System\tOycpLF.exe
  C:\Windows\System\tOycpLF.exe
  2⤵
  PID:9008
- C:\Windows\System\fQOGGOH.exe
  C:\Windows\System\fQOGGOH.exe
  2⤵
  PID:9032
- C:\Windows\System\NiZjzXX.exe
  C:\Windows\System\NiZjzXX.exe
  2⤵
  PID:9056
- C:\Windows\System\nAzoERG.exe
  C:\Windows\System\nAzoERG.exe
  2⤵
  PID:9072
- C:\Windows\System\OrlFIXd.exe
  C:\Windows\System\OrlFIXd.exe
  2⤵
  PID:9096
- C:\Windows\System\EFAauoz.exe
  C:\Windows\System\EFAauoz.exe
  2⤵
  PID:9120
- C:\Windows\System\HSiURqh.exe
  C:\Windows\System\HSiURqh.exe
  2⤵
  PID:9144
- C:\Windows\System\RRvrYEo.exe
  C:\Windows\System\RRvrYEo.exe
  2⤵
  PID:9168
- C:\Windows\System\TgFFoYn.exe
  C:\Windows\System\TgFFoYn.exe
  2⤵
  PID:9188
- C:\Windows\System\LBKBTHr.exe
  C:\Windows\System\LBKBTHr.exe
  2⤵
  PID:9212
- C:\Windows\System\vBZEybb.exe
  C:\Windows\System\vBZEybb.exe
  2⤵
  PID:7364
- C:\Windows\System\bIUaqbt.exe
  C:\Windows\System\bIUaqbt.exe
  2⤵
  PID:7400
- C:\Windows\System\yqceBnn.exe
  C:\Windows\System\yqceBnn.exe
  2⤵
  PID:4360
- C:\Windows\System\sAdydBi.exe
  C:\Windows\System\sAdydBi.exe
  2⤵
  PID:7528
- C:\Windows\System\slnMQFs.exe
  C:\Windows\System\slnMQFs.exe
  2⤵
  PID:6940
- C:\Windows\System\fVYnrIo.exe
  C:\Windows\System\fVYnrIo.exe
  2⤵
  PID:6180
- C:\Windows\System\foSzPdg.exe
  C:\Windows\System\foSzPdg.exe
  2⤵
  PID:6208
- C:\Windows\System\cnmZVkF.exe
  C:\Windows\System\cnmZVkF.exe
  2⤵
  PID:7072
- C:\Windows\System\CQjTUAz.exe
  C:\Windows\System\CQjTUAz.exe
  2⤵
  PID:7124
- C:\Windows\System\PHUhxfL.exe
  C:\Windows\System\PHUhxfL.exe
  2⤵
  PID:5992
- C:\Windows\System\jKAPsnJ.exe
  C:\Windows\System\jKAPsnJ.exe
  2⤵
  PID:2276
- C:\Windows\System\ZnVgsZb.exe
  C:\Windows\System\ZnVgsZb.exe
  2⤵
  PID:5168
- C:\Windows\System\HfcnUdI.exe
  C:\Windows\System\HfcnUdI.exe
  2⤵
  PID:7804
- C:\Windows\System\JAVCtxx.exe
  C:\Windows\System\JAVCtxx.exe
  2⤵
  PID:5908
- C:\Windows\System\uIgbrqH.exe
  C:\Windows\System\uIgbrqH.exe
  2⤵
  PID:8036
- C:\Windows\System\hzeaaxg.exe
  C:\Windows\System\hzeaaxg.exe
  2⤵
  PID:5996
- C:\Windows\System\FrbPQjq.exe
  C:\Windows\System\FrbPQjq.exe
  2⤵
  PID:6716
- C:\Windows\System\kTvfISj.exe
  C:\Windows\System\kTvfISj.exe
  2⤵
  PID:9228
- C:\Windows\System\lHrfxcT.exe
  C:\Windows\System\lHrfxcT.exe
  2⤵
  PID:9252
- C:\Windows\System\sJyIPxg.exe
  C:\Windows\System\sJyIPxg.exe
  2⤵
  PID:9272
- C:\Windows\System\BRzPlSr.exe
  C:\Windows\System\BRzPlSr.exe
  2⤵
  PID:9292
- C:\Windows\System\mugTnQu.exe
  C:\Windows\System\mugTnQu.exe
  2⤵
  PID:9316
- C:\Windows\System\iVisQTB.exe
  C:\Windows\System\iVisQTB.exe
  2⤵
  PID:9332
- C:\Windows\System\idnCrqA.exe
  C:\Windows\System\idnCrqA.exe
  2⤵
  PID:9356
- C:\Windows\System\bfzBeGQ.exe
  C:\Windows\System\bfzBeGQ.exe
  2⤵
  PID:9380
- C:\Windows\System\UXtfbZh.exe
  C:\Windows\System\UXtfbZh.exe
  2⤵
  PID:9400
- C:\Windows\System\GDxqEQD.exe
  C:\Windows\System\GDxqEQD.exe
  2⤵
  PID:9424
- C:\Windows\System\vYHYMrW.exe
  C:\Windows\System\vYHYMrW.exe
  2⤵
  PID:9444
- C:\Windows\System\aFsqPRj.exe
  C:\Windows\System\aFsqPRj.exe
  2⤵
  PID:9468
- C:\Windows\System\VuzdYHc.exe
  C:\Windows\System\VuzdYHc.exe
  2⤵
  PID:9496
- C:\Windows\System\EZiltle.exe
  C:\Windows\System\EZiltle.exe
  2⤵
  PID:9516
- C:\Windows\System\wWbXUaZ.exe
  C:\Windows\System\wWbXUaZ.exe
  2⤵
  PID:9536
- C:\Windows\System\ydLsVvL.exe
  C:\Windows\System\ydLsVvL.exe
  2⤵
  PID:9560
- C:\Windows\System\shMcIpZ.exe
  C:\Windows\System\shMcIpZ.exe
  2⤵
  PID:9576
- C:\Windows\System\DJdKdig.exe
  C:\Windows\System\DJdKdig.exe
  2⤵
  PID:9600
- C:\Windows\System\xHapHGe.exe
  C:\Windows\System\xHapHGe.exe
  2⤵
  PID:9624
- C:\Windows\System\hTCeXyM.exe
  C:\Windows\System\hTCeXyM.exe
  2⤵
  PID:9648
- C:\Windows\System\SnPnTVP.exe
  C:\Windows\System\SnPnTVP.exe
  2⤵
  PID:9664
- C:\Windows\System\ddyVTMK.exe
  C:\Windows\System\ddyVTMK.exe
  2⤵
  PID:9688
- C:\Windows\System\QsAxMiC.exe
  C:\Windows\System\QsAxMiC.exe
  2⤵
  PID:9708
- C:\Windows\System\HPfBMkz.exe
  C:\Windows\System\HPfBMkz.exe
  2⤵
  PID:9724
- C:\Windows\System\Jrlfmqr.exe
  C:\Windows\System\Jrlfmqr.exe
  2⤵
  PID:9748
- C:\Windows\System\SpSJbvo.exe
  C:\Windows\System\SpSJbvo.exe
  2⤵
  PID:9776
- C:\Windows\System\CcInoEM.exe
  C:\Windows\System\CcInoEM.exe
  2⤵
  PID:9792
- C:\Windows\System\GGUbhIp.exe
  C:\Windows\System\GGUbhIp.exe
  2⤵
  PID:9816
- C:\Windows\System\CTfFqPU.exe
  C:\Windows\System\CTfFqPU.exe
  2⤵
  PID:9836
- C:\Windows\System\wGzOJPL.exe
  C:\Windows\System\wGzOJPL.exe
  2⤵
  PID:9860
- C:\Windows\System\GlqtXzT.exe
  C:\Windows\System\GlqtXzT.exe
  2⤵
  PID:9884
- C:\Windows\System\GRAGyYz.exe
  C:\Windows\System\GRAGyYz.exe
  2⤵
  PID:9908
- C:\Windows\System\kXWwZTa.exe
  C:\Windows\System\kXWwZTa.exe
  2⤵
  PID:9928
- C:\Windows\System\OgRkmge.exe
  C:\Windows\System\OgRkmge.exe
  2⤵
  PID:9948
- C:\Windows\System\cMfPRhH.exe
  C:\Windows\System\cMfPRhH.exe
  2⤵
  PID:9968
- C:\Windows\System\FaldHFo.exe
  C:\Windows\System\FaldHFo.exe
  2⤵
  PID:9996
- C:\Windows\System\yWXdLVo.exe
  C:\Windows\System\yWXdLVo.exe
  2⤵
  PID:10132
- C:\Windows\System\kxJjBbf.exe
  C:\Windows\System\kxJjBbf.exe
  2⤵
  PID:10148
- C:\Windows\System\IGzwlEQ.exe
  C:\Windows\System\IGzwlEQ.exe
  2⤵
  PID:10164
- C:\Windows\System\MQocSbA.exe
  C:\Windows\System\MQocSbA.exe
  2⤵
  PID:10180
- C:\Windows\System\irYHRDO.exe
  C:\Windows\System\irYHRDO.exe
  2⤵
  PID:10200
- C:\Windows\System\ORCLdVa.exe
  C:\Windows\System\ORCLdVa.exe
  2⤵
  PID:10216
- C:\Windows\System\gTmZsom.exe
  C:\Windows\System\gTmZsom.exe
  2⤵
  PID:10232
- C:\Windows\System\UmTEcYu.exe
  C:\Windows\System\UmTEcYu.exe
  2⤵
  PID:6804
- C:\Windows\System\WINgGHC.exe
  C:\Windows\System\WINgGHC.exe
  2⤵
  PID:6788
- C:\Windows\System\GCzSIbH.exe
  C:\Windows\System\GCzSIbH.exe
  2⤵
  PID:7340
- C:\Windows\System\qRbIVVn.exe
  C:\Windows\System\qRbIVVn.exe
  2⤵
  PID:6396
- C:\Windows\System\aNNdrZr.exe
  C:\Windows\System\aNNdrZr.exe
  2⤵
  PID:3768
- C:\Windows\System\IcrziUh.exe
  C:\Windows\System\IcrziUh.exe
  2⤵
  PID:10248
- C:\Windows\System\zzGOKgk.exe
  C:\Windows\System\zzGOKgk.exe
  2⤵
  PID:10264
- C:\Windows\System\BMAslKN.exe
  C:\Windows\System\BMAslKN.exe
  2⤵
  PID:10280
- C:\Windows\System\oTURBBz.exe
  C:\Windows\System\oTURBBz.exe
  2⤵
  PID:10308
- C:\Windows\System\eKGvzBL.exe
  C:\Windows\System\eKGvzBL.exe
  2⤵
  PID:10332
- C:\Windows\System\gCpccTz.exe
  C:\Windows\System\gCpccTz.exe
  2⤵
  PID:10356
- C:\Windows\System\uvvyuFE.exe
  C:\Windows\System\uvvyuFE.exe
  2⤵
  PID:10384
- C:\Windows\System\TWcRCuN.exe
  C:\Windows\System\TWcRCuN.exe
  2⤵
  PID:10404
- C:\Windows\System\SRItfhD.exe
  C:\Windows\System\SRItfhD.exe
  2⤵
  PID:10428
- C:\Windows\System\jAzbhIR.exe
  C:\Windows\System\jAzbhIR.exe
  2⤵
  PID:10456
- C:\Windows\System\PupSEAx.exe
  C:\Windows\System\PupSEAx.exe
  2⤵
  PID:10476
- C:\Windows\System\XiviSKv.exe
  C:\Windows\System\XiviSKv.exe
  2⤵
  PID:10504
- C:\Windows\System\bwvLEDz.exe
  C:\Windows\System\bwvLEDz.exe
  2⤵
  PID:10524
- C:\Windows\System\FdSVcrP.exe
  C:\Windows\System\FdSVcrP.exe
  2⤵
  PID:10552
- C:\Windows\System\WFDVnUh.exe
  C:\Windows\System\WFDVnUh.exe
  2⤵
  PID:10572
- C:\Windows\System\fJICEpc.exe
  C:\Windows\System\fJICEpc.exe
  2⤵
  PID:10596
- C:\Windows\System\lFIgkEy.exe
  C:\Windows\System\lFIgkEy.exe
  2⤵
  PID:10624
- C:\Windows\System\prkdZKy.exe
  C:\Windows\System\prkdZKy.exe
  2⤵
  PID:10640
- C:\Windows\System\peMmDjm.exe
  C:\Windows\System\peMmDjm.exe
  2⤵
  PID:10660
- C:\Windows\System\xDLjncl.exe
  C:\Windows\System\xDLjncl.exe
  2⤵
  PID:10684
- C:\Windows\System\UsdtbcA.exe
  C:\Windows\System\UsdtbcA.exe
  2⤵
  PID:10708
- C:\Windows\System\axcNGpI.exe
  C:\Windows\System\axcNGpI.exe
  2⤵
  PID:10724
- C:\Windows\System\uQOVsVZ.exe
  C:\Windows\System\uQOVsVZ.exe
  2⤵
  PID:10748
- C:\Windows\System\vrSQIBZ.exe
  C:\Windows\System\vrSQIBZ.exe
  2⤵
  PID:10772
- C:\Windows\System\emvaImr.exe
  C:\Windows\System\emvaImr.exe
  2⤵
  PID:10796
- C:\Windows\System\MfKPrlF.exe
  C:\Windows\System\MfKPrlF.exe
  2⤵
  PID:10824
- C:\Windows\System\KBWLhQv.exe
  C:\Windows\System\KBWLhQv.exe
  2⤵
  PID:10840
- C:\Windows\System\TifwfVf.exe
  C:\Windows\System\TifwfVf.exe
  2⤵
  PID:10860
- C:\Windows\System\pxwYysh.exe
  C:\Windows\System\pxwYysh.exe
  2⤵
  PID:10888
- C:\Windows\System\GHlxlcR.exe
  C:\Windows\System\GHlxlcR.exe
  2⤵
  PID:10908
- C:\Windows\System\ZscNUva.exe
  C:\Windows\System\ZscNUva.exe
  2⤵
  PID:10928
- C:\Windows\System\EloYqZJ.exe
  C:\Windows\System\EloYqZJ.exe
  2⤵
  PID:10952
- C:\Windows\System\iOhDRst.exe
  C:\Windows\System\iOhDRst.exe
  2⤵
  PID:10976
- C:\Windows\System\PuGALgv.exe
  C:\Windows\System\PuGALgv.exe
  2⤵
  PID:10996
- C:\Windows\System\INYyBSl.exe
  C:\Windows\System\INYyBSl.exe
  2⤵
  PID:11016
- C:\Windows\System\KzfibtI.exe
  C:\Windows\System\KzfibtI.exe
  2⤵
  PID:11040
- C:\Windows\System\KLpyRCv.exe
  C:\Windows\System\KLpyRCv.exe
  2⤵
  PID:11064
- C:\Windows\System\nFUITEZ.exe
  C:\Windows\System\nFUITEZ.exe
  2⤵
  PID:11092
- C:\Windows\System\OwXUalA.exe
  C:\Windows\System\OwXUalA.exe
  2⤵
  PID:11108
- C:\Windows\System\FCeZTVu.exe
  C:\Windows\System\FCeZTVu.exe
  2⤵
  PID:11144
- C:\Windows\System\LFqHYVd.exe
  C:\Windows\System\LFqHYVd.exe
  2⤵
  PID:11160
- C:\Windows\System\cNmwCTB.exe
  C:\Windows\System\cNmwCTB.exe
  2⤵
  PID:11180
- C:\Windows\System\rqlhUkA.exe
  C:\Windows\System\rqlhUkA.exe
  2⤵
  PID:11196
- C:\Windows\System\ZGtnUaE.exe
  C:\Windows\System\ZGtnUaE.exe
  2⤵
  PID:11212
- C:\Windows\System\PATPKPZ.exe
  C:\Windows\System\PATPKPZ.exe
  2⤵
  PID:11228
- C:\Windows\System\SXjXqse.exe
  C:\Windows\System\SXjXqse.exe
  2⤵
  PID:11252
- C:\Windows\System\llcPyWG.exe
  C:\Windows\System\llcPyWG.exe
  2⤵
  PID:11272
- C:\Windows\System\LezulWv.exe
  C:\Windows\System\LezulWv.exe
  2⤵
  PID:11296
- C:\Windows\System\hzzfyPN.exe
  C:\Windows\System\hzzfyPN.exe
  2⤵
  PID:11320
- C:\Windows\System\hREnDsw.exe
  C:\Windows\System\hREnDsw.exe
  2⤵
  PID:11348
- C:\Windows\System\SbAPypV.exe
  C:\Windows\System\SbAPypV.exe
  2⤵
  PID:11376
- C:\Windows\System\SepsQjD.exe
  C:\Windows\System\SepsQjD.exe
  2⤵
  PID:11396
- C:\Windows\System\qywKOJc.exe
  C:\Windows\System\qywKOJc.exe
  2⤵
  PID:11412
- C:\Windows\System\VOOKxPq.exe
  C:\Windows\System\VOOKxPq.exe
  2⤵
  PID:11436
- C:\Windows\System\UxkxfBl.exe
  C:\Windows\System\UxkxfBl.exe
  2⤵
  PID:11452
- C:\Windows\System\BZvMGcX.exe
  C:\Windows\System\BZvMGcX.exe
  2⤵
  PID:11468
- C:\Windows\System\HRrmGdm.exe
  C:\Windows\System\HRrmGdm.exe
  2⤵
  PID:11488
- C:\Windows\System\zHXnLqZ.exe
  C:\Windows\System\zHXnLqZ.exe
  2⤵
  PID:11516
- C:\Windows\System\VPzIhFa.exe
  C:\Windows\System\VPzIhFa.exe
  2⤵
  PID:11536
- C:\Windows\System\UwcfsuG.exe
  C:\Windows\System\UwcfsuG.exe
  2⤵
  PID:11560
- C:\Windows\System\GEUcJRS.exe
  C:\Windows\System\GEUcJRS.exe
  2⤵
  PID:11576
- C:\Windows\System\ngwPYYE.exe
  C:\Windows\System\ngwPYYE.exe
  2⤵
  PID:11600
- C:\Windows\System\htQJZeS.exe
  C:\Windows\System\htQJZeS.exe
  2⤵
  PID:11624
- C:\Windows\System\MNTVbEc.exe
  C:\Windows\System\MNTVbEc.exe
  2⤵
  PID:11648
- C:\Windows\System\obwMKCh.exe
  C:\Windows\System\obwMKCh.exe
  2⤵
  PID:11668
- C:\Windows\System\LtlcZLL.exe
  C:\Windows\System\LtlcZLL.exe
  2⤵
  PID:11704
- C:\Windows\System\BrKCMVk.exe
  C:\Windows\System\BrKCMVk.exe
  2⤵
  PID:11740
- C:\Windows\System\nitBwLB.exe
  C:\Windows\System\nitBwLB.exe
  2⤵
  PID:11756
- C:\Windows\System\wlAJNyc.exe
  C:\Windows\System\wlAJNyc.exe
  2⤵
  PID:11800
- C:\Windows\System\mHbRyOI.exe
  C:\Windows\System\mHbRyOI.exe
  2⤵
  PID:11824
- C:\Windows\System\jHJGJSd.exe
  C:\Windows\System\jHJGJSd.exe
  2⤵
  PID:11848
- C:\Windows\System\FffMEOY.exe
  C:\Windows\System\FffMEOY.exe
  2⤵
  PID:11872
- C:\Windows\System\juzRBEz.exe
  C:\Windows\System\juzRBEz.exe
  2⤵
  PID:11900
- C:\Windows\System\ofcOzvz.exe
  C:\Windows\System\ofcOzvz.exe
  2⤵
  PID:11916
- C:\Windows\System\PXPQMUi.exe
  C:\Windows\System\PXPQMUi.exe
  2⤵
  PID:11940
- C:\Windows\System\jLTiaOp.exe
  C:\Windows\System\jLTiaOp.exe
  2⤵
  PID:11960
- C:\Windows\System\IhXqNRD.exe
  C:\Windows\System\IhXqNRD.exe
  2⤵
  PID:11980
- C:\Windows\System\GGSCNEE.exe
  C:\Windows\System\GGSCNEE.exe
  2⤵
  PID:12004
- C:\Windows\System\DkSzVeN.exe
  C:\Windows\System\DkSzVeN.exe
  2⤵
  PID:12028
- C:\Windows\System\PdYBTXe.exe
  C:\Windows\System\PdYBTXe.exe
  2⤵
  PID:12048
- C:\Windows\System\QJstPeh.exe
  C:\Windows\System\QJstPeh.exe
  2⤵
  PID:12072
- C:\Windows\System\wNJhPnQ.exe
  C:\Windows\System\wNJhPnQ.exe
  2⤵
  PID:12092
- C:\Windows\System\rnJVWFZ.exe
  C:\Windows\System\rnJVWFZ.exe
  2⤵
  PID:12112
- C:\Windows\System\POLtGqu.exe
  C:\Windows\System\POLtGqu.exe
  2⤵
  PID:12132
- C:\Windows\System\ejqdtfC.exe
  C:\Windows\System\ejqdtfC.exe
  2⤵
  PID:12160
- C:\Windows\System\DUxirhH.exe
  C:\Windows\System\DUxirhH.exe
  2⤵
  PID:12188
- C:\Windows\System\HfdHObF.exe
  C:\Windows\System\HfdHObF.exe
  2⤵
  PID:12208
- C:\Windows\System\sqbStFc.exe
  C:\Windows\System\sqbStFc.exe
  2⤵
  PID:12228
- C:\Windows\System\FwHZldZ.exe
  C:\Windows\System\FwHZldZ.exe
  2⤵
  PID:12248
- C:\Windows\System\SpMKIOF.exe
  C:\Windows\System\SpMKIOF.exe
  2⤵
  PID:12272
- C:\Windows\System\eaQmeNl.exe
  C:\Windows\System\eaQmeNl.exe
  2⤵
  PID:6672
- C:\Windows\System\IYjsExa.exe
  C:\Windows\System\IYjsExa.exe
  2⤵
  PID:5268
- C:\Windows\System\NZNljDk.exe
  C:\Windows\System\NZNljDk.exe
  2⤵
  PID:7184
- C:\Windows\System\FEDepVc.exe
  C:\Windows\System\FEDepVc.exe
  2⤵
  PID:9284
- C:\Windows\System\NzRxjES.exe
  C:\Windows\System\NzRxjES.exe
  2⤵
  PID:9352
- C:\Windows\System\wRrZyJL.exe
  C:\Windows\System\wRrZyJL.exe
  2⤵
  PID:9388
- C:\Windows\System\yHeizxd.exe
  C:\Windows\System\yHeizxd.exe
  2⤵
  PID:9532
- C:\Windows\System\rxTXydu.exe
  C:\Windows\System\rxTXydu.exe
  2⤵
  PID:9584
- C:\Windows\System\IRyayvJ.exe
  C:\Windows\System\IRyayvJ.exe
  2⤵
  PID:9620
- C:\Windows\System\GQJREDL.exe
  C:\Windows\System\GQJREDL.exe
  2⤵
  PID:9656
- C:\Windows\System\WUkvNWa.exe
  C:\Windows\System\WUkvNWa.exe
  2⤵
  PID:7256
- C:\Windows\System\SomUKaG.exe
  C:\Windows\System\SomUKaG.exe
  2⤵
  PID:9756
- C:\Windows\System\bQXdGDo.exe
  C:\Windows\System\bQXdGDo.exe
  2⤵
  PID:9824
- C:\Windows\System\AgdGDCx.exe
  C:\Windows\System\AgdGDCx.exe
  2⤵
  PID:8244
- C:\Windows\System\nOezdho.exe
  C:\Windows\System\nOezdho.exe
  2⤵
  PID:7444
- C:\Windows\System\abLpsSV.exe
  C:\Windows\System\abLpsSV.exe
  2⤵
  PID:9940
- C:\Windows\System\qXIvoho.exe
  C:\Windows\System\qXIvoho.exe
  2⤵
  PID:8340
- C:\Windows\System\lQrkNMy.exe
  C:\Windows\System\lQrkNMy.exe
  2⤵
  PID:7504
- C:\Windows\System\gmJnUft.exe
  C:\Windows\System\gmJnUft.exe
  2⤵
  PID:7588
- C:\Windows\System\WmtpLGR.exe
  C:\Windows\System\WmtpLGR.exe
  2⤵
  PID:7660
- C:\Windows\System\cOmEvsb.exe
  C:\Windows\System\cOmEvsb.exe
  2⤵
  PID:12300
- C:\Windows\System\maANgQk.exe
  C:\Windows\System\maANgQk.exe
  2⤵
  PID:12320
- C:\Windows\System\tdiSvgw.exe
  C:\Windows\System\tdiSvgw.exe
  2⤵
  PID:12340
- C:\Windows\System\ljfcCXx.exe
  C:\Windows\System\ljfcCXx.exe
  2⤵
  PID:12364
- C:\Windows\System\NZEfXmA.exe
  C:\Windows\System\NZEfXmA.exe
  2⤵
  PID:12388
- C:\Windows\System\GcxZyoi.exe
  C:\Windows\System\GcxZyoi.exe
  2⤵
  PID:12416
- C:\Windows\System\ZcyWjIG.exe
  C:\Windows\System\ZcyWjIG.exe
  2⤵
  PID:12436
- C:\Windows\System\vmqlwFO.exe
  C:\Windows\System\vmqlwFO.exe
  2⤵
  PID:12456
- C:\Windows\System\dFCjBUQ.exe
  C:\Windows\System\dFCjBUQ.exe
  2⤵
  PID:12476
- C:\Windows\System\IZjVlSh.exe
  C:\Windows\System\IZjVlSh.exe
  2⤵
  PID:12496
- C:\Windows\System\JHISKkq.exe
  C:\Windows\System\JHISKkq.exe
  2⤵
  PID:12520
- C:\Windows\System\jPZhzGu.exe
  C:\Windows\System\jPZhzGu.exe
  2⤵
  PID:12544
- C:\Windows\System\szyHevu.exe
  C:\Windows\System\szyHevu.exe
  2⤵
  PID:12568
- C:\Windows\System\FuWFGUA.exe
  C:\Windows\System\FuWFGUA.exe
  2⤵
  PID:12588
- C:\Windows\System\aNTSmCU.exe
  C:\Windows\System\aNTSmCU.exe
  2⤵
  PID:12604
- C:\Windows\System\NgAPkNd.exe
  C:\Windows\System\NgAPkNd.exe
  2⤵
  PID:12632
- C:\Windows\System\bjyIyin.exe
  C:\Windows\System\bjyIyin.exe
  2⤵
  PID:12684
- C:\Windows\System\Xsgumcl.exe
  C:\Windows\System\Xsgumcl.exe
  2⤵
  PID:12720
- C:\Windows\System\MREZlpq.exe
  C:\Windows\System\MREZlpq.exe
  2⤵
  PID:12752
- C:\Windows\System\rFhEdWo.exe
  C:\Windows\System\rFhEdWo.exe
  2⤵
  PID:12792
- C:\Windows\System\RAblPgY.exe
  C:\Windows\System\RAblPgY.exe
  2⤵
  PID:12828
- C:\Windows\System\lWnPoNN.exe
  C:\Windows\System\lWnPoNN.exe
  2⤵
  PID:12852
- C:\Windows\System\xJrREpQ.exe
  C:\Windows\System\xJrREpQ.exe
  2⤵
  PID:12876
- C:\Windows\System\CPAXXbo.exe
  C:\Windows\System\CPAXXbo.exe
  2⤵
  PID:12912
- C:\Windows\System\skPcNJl.exe
  C:\Windows\System\skPcNJl.exe
  2⤵
  PID:12948
- C:\Windows\System\VXADFqc.exe
  C:\Windows\System\VXADFqc.exe
  2⤵
  PID:8268
- C:\Windows\System\WHYaiRU.exe
  C:\Windows\System\WHYaiRU.exe
  2⤵
  PID:8292
- C:\Windows\System\DHxeYSJ.exe
  C:\Windows\System\DHxeYSJ.exe
  2⤵
  PID:8336
- C:\Windows\System\EkIasZt.exe
  C:\Windows\System\EkIasZt.exe
  2⤵
  PID:8448
- C:\Windows\System\CFXNApu.exe
  C:\Windows\System\CFXNApu.exe
  2⤵
  PID:8496
- C:\Windows\System\kvePbnr.exe
  C:\Windows\System\kvePbnr.exe
  2⤵
  PID:8544
- C:\Windows\System\VtigpnV.exe
  C:\Windows\System\VtigpnV.exe
  2⤵
  PID:8596
- C:\Windows\System\vERnJTc.exe
  C:\Windows\System\vERnJTc.exe
  2⤵
  PID:8640
- C:\Windows\System\YpHhJKJ.exe
  C:\Windows\System\YpHhJKJ.exe
  2⤵
  PID:8692
- C:\Windows\System\wFOeilO.exe
  C:\Windows\System\wFOeilO.exe
  2⤵
  PID:8784
- C:\Windows\System\XrnTDoo.exe
  C:\Windows\System\XrnTDoo.exe
  2⤵
  PID:8820
- C:\Windows\System\zfsTBtA.exe
  C:\Windows\System\zfsTBtA.exe
  2⤵
  PID:9024
- C:\Windows\System\GiIpbSO.exe
  C:\Windows\System\GiIpbSO.exe
  2⤵
  PID:9068
- C:\Windows\System\bTYbQSG.exe
  C:\Windows\System\bTYbQSG.exe
  2⤵
  PID:9116
- C:\Windows\System\uSBMcZP.exe
  C:\Windows\System\uSBMcZP.exe
  2⤵
  PID:9156
- C:\Windows\System\KAOiNpP.exe
  C:\Windows\System\KAOiNpP.exe
  2⤵
  PID:9196
- C:\Windows\System\gjvRypj.exe
  C:\Windows\System\gjvRypj.exe
  2⤵
  PID:6824
- C:\Windows\System\CWOMpVQ.exe
  C:\Windows\System\CWOMpVQ.exe
  2⤵
  PID:5148
- C:\Windows\System\kTSvDVA.exe
  C:\Windows\System\kTSvDVA.exe
  2⤵
  PID:7676
- C:\Windows\System\QlMyzso.exe
  C:\Windows\System\QlMyzso.exe
  2⤵
  PID:7056
- C:\Windows\System\MPHmzvj.exe
  C:\Windows\System\MPHmzvj.exe
  2⤵
  PID:7100
- C:\Windows\System\RPvrsmq.exe
  C:\Windows\System\RPvrsmq.exe
  2⤵
  PID:8028
- C:\Windows\System\mMsPczr.exe
  C:\Windows\System\mMsPczr.exe
  2⤵
  PID:13032
- C:\Windows\System\pjvffMs.exe
  C:\Windows\System\pjvffMs.exe
  2⤵
  PID:13132
- C:\Windows\System\izyBVKj.exe
  C:\Windows\System\izyBVKj.exe
  2⤵
  PID:10716
- C:\Windows\System\bXZxAvT.exe
  C:\Windows\System\bXZxAvT.exe
  2⤵
  PID:13276
- C:\Windows\System\rlxIQxv.exe
  C:\Windows\System\rlxIQxv.exe
  2⤵
  PID:11024
- C:\Windows\System\OpSHjVy.exe
  C:\Windows\System\OpSHjVy.exe
  2⤵
  PID:11076
- C:\Windows\System\PWbCUdV.exe
  C:\Windows\System\PWbCUdV.exe
  2⤵
  PID:11132
- C:\Windows\System\BbfGvZv.exe
  C:\Windows\System\BbfGvZv.exe
  2⤵
  PID:11156
- C:\Windows\System\CambRpr.exe
  C:\Windows\System\CambRpr.exe
  2⤵
  PID:11192
- C:\Windows\System\IynIXgH.exe
  C:\Windows\System\IynIXgH.exe
  2⤵
  PID:11224
- C:\Windows\System\kitPpme.exe
  C:\Windows\System\kitPpme.exe
  2⤵
  PID:7828
- C:\Windows\System\ltVoSKD.exe
  C:\Windows\System\ltVoSKD.exe
  2⤵
  PID:11408
- C:\Windows\System\YmtVfcX.exe
  C:\Windows\System\YmtVfcX.exe
  2⤵
  PID:13316
- C:\Windows\System\WPGZgmt.exe
  C:\Windows\System\WPGZgmt.exe
  2⤵
  PID:13332
- C:\Windows\System\gWqQfkW.exe
  C:\Windows\System\gWqQfkW.exe
  2⤵
  PID:13348
- C:\Windows\System\NMHGndM.exe
  C:\Windows\System\NMHGndM.exe
  2⤵
  PID:13364
- C:\Windows\System\zBhvzdl.exe
  C:\Windows\System\zBhvzdl.exe
  2⤵
  PID:13380
- C:\Windows\System\CIOnGok.exe
  C:\Windows\System\CIOnGok.exe
  2⤵
  PID:13396
- C:\Windows\System\SNoVjsa.exe
  C:\Windows\System\SNoVjsa.exe
  2⤵
  PID:13412
- C:\Windows\System\irQNEGd.exe
  C:\Windows\System\irQNEGd.exe
  2⤵
  PID:13428
- C:\Windows\System\LiETelo.exe
  C:\Windows\System\LiETelo.exe
  2⤵
  PID:13444
- C:\Windows\System\uLvAMJA.exe
  C:\Windows\System\uLvAMJA.exe
  2⤵
  PID:13460
- C:\Windows\System\yCXhWwz.exe
  C:\Windows\System\yCXhWwz.exe
  2⤵
  PID:13476
- C:\Windows\System\hKUjppr.exe
  C:\Windows\System\hKUjppr.exe
  2⤵
  PID:13492
- C:\Windows\System\BcOUDwb.exe
  C:\Windows\System\BcOUDwb.exe
  2⤵
  PID:13540
- C:\Windows\System\NtYldeL.exe
  C:\Windows\System\NtYldeL.exe
  2⤵
  PID:13556
- C:\Windows\System\eSPyIUn.exe
  C:\Windows\System\eSPyIUn.exe
  2⤵
  PID:13592
- C:\Windows\System\jfrlQoe.exe
  C:\Windows\System\jfrlQoe.exe
  2⤵
  PID:13608
- C:\Windows\System\jltGziC.exe
  C:\Windows\System\jltGziC.exe
  2⤵
  PID:13116
- C:\Windows\System\dekvWgK.exe
  C:\Windows\System\dekvWgK.exe
  2⤵
  PID:9136
- C:\Windows\System\HQehqar.exe
  C:\Windows\System\HQehqar.exe
  2⤵
  PID:10540
- C:\Windows\System\sTqykeR.exe
  C:\Windows\System\sTqykeR.exe
  2⤵
  PID:8984
- C:\Windows\System\GRBgaVA.exe
  C:\Windows\System\GRBgaVA.exe
  2⤵
  PID:13420
- C:\Windows\System\RnOQYwd.exe
  C:\Windows\System\RnOQYwd.exe
  2⤵
  PID:5340
- C:\Windows\System\xQMgrQb.exe
  C:\Windows\System\xQMgrQb.exe
  2⤵
  PID:10340
- C:\Windows\System\EWJEqRT.exe
  C:\Windows\System\EWJEqRT.exe
  2⤵
  PID:13812
- C:\Windows\System\xncAQvm.exe
  C:\Windows\System\xncAQvm.exe
  2⤵
  PID:13828
- C:\Windows\System\qDhkRnZ.exe
  C:\Windows\System\qDhkRnZ.exe
  2⤵
  PID:13856
- C:\Windows\System\kpDqDyS.exe
  C:\Windows\System\kpDqDyS.exe
  2⤵
  PID:10968
- C:\Windows\System\zSdcCLa.exe
  C:\Windows\System\zSdcCLa.exe
  2⤵
  PID:5652
- C:\Windows\System\XRIlZzz.exe
  C:\Windows\System\XRIlZzz.exe
  2⤵
  PID:5216
- C:\Windows\System\gahmxVm.exe
  C:\Windows\System\gahmxVm.exe
  2⤵
  PID:9416
- C:\Windows\System\BcjsZsE.exe
  C:\Windows\System\BcjsZsE.exe
  2⤵
  PID:11996
- C:\Windows\System\jPDPLIW.exe
  C:\Windows\System\jPDPLIW.exe
  2⤵
  PID:12256
- C:\Windows\System\EcPjOyE.exe
  C:\Windows\System\EcPjOyE.exe
  2⤵
  PID:8296
- C:\Windows\System\BqQfdax.exe
  C:\Windows\System\BqQfdax.exe
  2⤵
  PID:8492
- C:\Windows\System\VHSwvPX.exe
  C:\Windows\System\VHSwvPX.exe
  2⤵
  PID:8584
- C:\Windows\System\OSLdzAO.exe
  C:\Windows\System\OSLdzAO.exe
  2⤵
  PID:8676
- C:\Windows\System\CmcItND.exe
  C:\Windows\System\CmcItND.exe
  2⤵
  PID:8732
- C:\Windows\System\TMwpCuv.exe
  C:\Windows\System\TMwpCuv.exe
  2⤵
  PID:3704
- C:\Windows\System\kKIZTmx.exe
  C:\Windows\System\kKIZTmx.exe
  2⤵
  PID:9044
- C:\Windows\System\rCFjnTT.exe
  C:\Windows\System\rCFjnTT.exe
  2⤵
  PID:9152
- C:\Windows\System\kPMYxrF.exe
  C:\Windows\System\kPMYxrF.exe
  2⤵
  PID:6820
- C:\Windows\System\wkmfzbY.exe
  C:\Windows\System\wkmfzbY.exe
  2⤵
  PID:7536
- C:\Windows\System\DmAQAKR.exe
  C:\Windows\System\DmAQAKR.exe
  2⤵
  PID:12540
- C:\Windows\System\GAkecga.exe
  C:\Windows\System\GAkecga.exe
  2⤵
  PID:8056
- C:\Windows\System\GoMEjeh.exe
  C:\Windows\System\GoMEjeh.exe
  2⤵
  PID:14020
- C:\Windows\System\JjqrWnQ.exe
  C:\Windows\System\JjqrWnQ.exe
  2⤵
  PID:4356
- C:\Windows\System\POYEmqb.exe
  C:\Windows\System\POYEmqb.exe
  2⤵
  PID:11072
- C:\Windows\System\jxGTZiz.exe
  C:\Windows\System\jxGTZiz.exe
  2⤵
  PID:13324
- C:\Windows\System\BFQjYEE.exe
  C:\Windows\System\BFQjYEE.exe
  2⤵
  PID:13360
- C:\Windows\System\aorwxNo.exe
  C:\Windows\System\aorwxNo.exe
  2⤵
  PID:13408
- C:\Windows\System\pMKtBOI.exe
  C:\Windows\System\pMKtBOI.exe
  2⤵
  PID:13600
- C:\Windows\System\SsPYjeG.exe
  C:\Windows\System\SsPYjeG.exe
  2⤵
  PID:13640
- C:\Windows\System\DDcZVkT.exe
  C:\Windows\System\DDcZVkT.exe
  2⤵
  PID:13688
- C:\Windows\System\RayvEaJ.exe
  C:\Windows\System\RayvEaJ.exe
  2⤵
  PID:14260
- C:\Windows\System\XNzTDRV.exe
  C:\Windows\System\XNzTDRV.exe
  2⤵
  PID:14296
- C:\Windows\System\rxOWYoZ.exe
  C:\Windows\System\rxOWYoZ.exe
  2⤵
  PID:14208
- C:\Windows\System\OQNkiyf.exe
  C:\Windows\System\OQNkiyf.exe
  2⤵
  PID:12732
- C:\Windows\System\AuATtvE.exe
  C:\Windows\System\AuATtvE.exe
  2⤵
  PID:12600
- C:\Windows\System\YKANFcj.exe
  C:\Windows\System\YKANFcj.exe
  2⤵
  PID:12336
- C:\Windows\System\xhDbquG.exe
  C:\Windows\System\xhDbquG.exe
  2⤵
  PID:12100
- C:\Windows\System\jxDysEz.exe
  C:\Windows\System\jxDysEz.exe
  2⤵
  PID:4176
- C:\Windows\System\jmeImBZ.exe
  C:\Windows\System\jmeImBZ.exe
  2⤵
  PID:13016
- C:\Windows\System\lrOQeDp.exe
  C:\Windows\System\lrOQeDp.exe
  2⤵
  PID:9000
- C:\Windows\System\CMqysWS.exe
  C:\Windows\System\CMqysWS.exe
  2⤵
  PID:13008
- C:\Windows\System\iifXnvV.exe
  C:\Windows\System\iifXnvV.exe
  2⤵
  PID:13048
- C:\Windows\System\AKjxTLn.exe
  C:\Windows\System\AKjxTLn.exe
  2⤵
  PID:10444
- C:\Windows\System\RXNQYBL.exe
  C:\Windows\System\RXNQYBL.exe
  2⤵
  PID:8616
- C:\Windows\System\MuCLzMJ.exe
  C:\Windows\System\MuCLzMJ.exe
  2⤵
  PID:8728
- C:\Windows\System\aEvqRHq.exe
  C:\Windows\System\aEvqRHq.exe
  2⤵
  PID:4272
- C:\Windows\System\SsVhCOf.exe
  C:\Windows\System\SsVhCOf.exe
  2⤵
  PID:13804
- C:\Windows\System\oItdHQW.exe
  C:\Windows\System\oItdHQW.exe
  2⤵
  PID:10920
- C:\Windows\System\diuSLDl.exe
  C:\Windows\System\diuSLDl.exe
  2⤵
  PID:7008
- C:\Windows\System\MxlFhUX.exe
  C:\Windows\System\MxlFhUX.exe
  2⤵
  PID:12196
- C:\Windows\System\aKsvccs.exe
  C:\Windows\System\aKsvccs.exe
  2⤵
  PID:14028
- C:\Windows\System\aVPQXnb.exe
  C:\Windows\System\aVPQXnb.exe
  2⤵
  PID:9204
- C:\Windows\System\QRfDooj.exe
  C:\Windows\System\QRfDooj.exe
  2⤵
  PID:13680
- C:\Windows\System\pgfLQzm.exe
  C:\Windows\System\pgfLQzm.exe
  2⤵
  PID:11140
- C:\Windows\System\MHJeNzU.exe
  C:\Windows\System\MHJeNzU.exe
  2⤵
  PID:5792
- C:\Windows\System\LrKdFdp.exe
  C:\Windows\System\LrKdFdp.exe
  2⤵
  PID:9868
- C:\Windows\System\cqvaGbH.exe
  C:\Windows\System\cqvaGbH.exe
  2⤵
  PID:4504
- C:\Windows\System\ddIsnLJ.exe
  C:\Windows\System\ddIsnLJ.exe
  2⤵
  PID:12468
- C:\Windows\System\rlzgsbk.exe
  C:\Windows\System\rlzgsbk.exe
  2⤵
  PID:10740
- C:\Windows\System\bUxciyI.exe
  C:\Windows\System\bUxciyI.exe
  2⤵
  PID:8228
- C:\Windows\System\DhAZIkp.exe
  C:\Windows\System\DhAZIkp.exe
  2⤵
  PID:12800
- C:\Windows\System\SFaKMDr.exe
  C:\Windows\System\SFaKMDr.exe
  2⤵
  PID:13052
- C:\Windows\System\LtSObsE.exe
  C:\Windows\System\LtSObsE.exe
  2⤵
  PID:12896
- C:\Windows\System\uRCqApV.exe
  C:\Windows\System\uRCqApV.exe
  2⤵
  PID:12956
- C:\Windows\System\sjmFvuB.exe
  C:\Windows\System\sjmFvuB.exe
  2⤵
  PID:13020
- C:\Windows\System\FiGnwtS.exe
  C:\Windows\System\FiGnwtS.exe
  2⤵
  PID:13836
- C:\Windows\System\hYorzJe.exe
  C:\Windows\System\hYorzJe.exe
  2⤵
  PID:8836
- C:\Windows\System\WIcAKaI.exe
  C:\Windows\System\WIcAKaI.exe
  2⤵
  PID:11152
- C:\Windows\System\IdiEgNC.exe
  C:\Windows\System\IdiEgNC.exe
  2⤵
  PID:13520
- C:\Windows\System\zoSjQKi.exe
  C:\Windows\System\zoSjQKi.exe
  2⤵
  PID:10400
- C:\Windows\System\TqzfjPn.exe
  C:\Windows\System\TqzfjPn.exe
  2⤵
  PID:4900
- C:\Windows\System\uzidxvP.exe
  C:\Windows\System\uzidxvP.exe
  2⤵
  PID:12084
- C:\Windows\System\BAMfEJq.exe
  C:\Windows\System\BAMfEJq.exe
  2⤵
  PID:3548
- C:\Windows\System\enyZjGo.exe
  C:\Windows\System\enyZjGo.exe
  2⤵
  PID:4292
- C:\Windows\System\ddzVVDO.exe
  C:\Windows\System\ddzVVDO.exe
  2⤵
  PID:3856
- C:\Windows\System\PcHRgVT.exe
  C:\Windows\System\PcHRgVT.exe
  2⤵
  PID:12640
- C:\Windows\System\UnsFqXx.exe
  C:\Windows\System\UnsFqXx.exe
  2⤵
  PID:7696
- C:\Windows\System\CITmlsW.exe
  C:\Windows\System\CITmlsW.exe
  2⤵
  PID:2908
- C:\Windows\System\PIBkttO.exe
  C:\Windows\System\PIBkttO.exe
  2⤵
  PID:14060
- C:\Windows\System\OLXSlLO.exe
  C:\Windows\System\OLXSlLO.exe
  2⤵
  PID:10048
- C:\Windows\System\EOeiUPp.exe
  C:\Windows\System\EOeiUPp.exe
  2⤵
  PID:9960
- C:\Windows\System\UPvuWFj.exe
  C:\Windows\System\UPvuWFj.exe
  2⤵
  PID:12992
- C:\Windows\System\WPVQyMA.exe
  C:\Windows\System\WPVQyMA.exe
  2⤵
  PID:996
- C:\Windows\System\fEJqpZU.exe
  C:\Windows\System\fEJqpZU.exe
  2⤵
  PID:11700
- C:\Windows\System\BVuivnq.exe
  C:\Windows\System\BVuivnq.exe
  2⤵
  PID:1500
- C:\Windows\System\zxXalpE.exe
  C:\Windows\System\zxXalpE.exe
  2⤵
  PID:6308
- C:\Windows\System\iMqFutJ.exe
  C:\Windows\System\iMqFutJ.exe
  2⤵
  PID:11312
- C:\Windows\System\AwuAbVa.exe
  C:\Windows\System\AwuAbVa.exe
  2⤵
  PID:12152
- C:\Windows\System\uOBYcIA.exe
  C:\Windows\System\uOBYcIA.exe
  2⤵
  PID:1652
- C:\Windows\System\QTAqarz.exe
  C:\Windows\System\QTAqarz.exe
  2⤵
  PID:10484
- C:\Windows\System\qxsiCVs.exe
  C:\Windows\System\qxsiCVs.exe
  2⤵
  PID:4288
- C:\Windows\System\YBRDEga.exe
  C:\Windows\System\YBRDEga.exe
  2⤵
  PID:3644
- C:\Windows\System\yFkClge.exe
  C:\Windows\System\yFkClge.exe
  2⤵
  PID:1228
- C:\Windows\System\TKpcuTu.exe
  C:\Windows\System\TKpcuTu.exe
  2⤵
  PID:11328
- C:\Windows\System\nRiQgkW.exe
  C:\Windows\System\nRiQgkW.exe
  2⤵
  PID:3932
- C:\Windows\System\FMJwYZa.exe
  C:\Windows\System\FMJwYZa.exe
  2⤵
  PID:3988
- C:\Windows\System\dyeoMKJ.exe
  C:\Windows\System\dyeoMKJ.exe
  2⤵
  PID:1156
- C:\Windows\System\eGaqkvb.exe
  C:\Windows\System\eGaqkvb.exe
  2⤵
  PID:7304
- C:\Windows\System\gNGKCpT.exe
  C:\Windows\System\gNGKCpT.exe
  2⤵
  PID:3276
- C:\Windows\System\DdUWuEY.exe
  C:\Windows\System\DdUWuEY.exe
  2⤵
  PID:3356
- C:\Windows\System\mspWhcs.exe
  C:\Windows\System\mspWhcs.exe
  2⤵
  PID:13404
- C:\Windows\System\ZNggbEU.exe
  C:\Windows\System\ZNggbEU.exe
  2⤵
  PID:864
- C:\Windows\System\zWUaaSc.exe
  C:\Windows\System\zWUaaSc.exe
  2⤵
  PID:13800
- C:\Windows\System\FJQjTCK.exe
  C:\Windows\System\FJQjTCK.exe
  2⤵
  PID:2116
- C:\Windows\System\iqFoSxL.exe
  C:\Windows\System\iqFoSxL.exe
  2⤵
  PID:4088
- C:\Windows\System\PdgIptr.exe
  C:\Windows\System\PdgIptr.exe
  2⤵
  PID:1848
- C:\Windows\System\pAguBwq.exe
  C:\Windows\System\pAguBwq.exe
  2⤵
  PID:688
- C:\Windows\System\VnYqfBx.exe
  C:\Windows\System\VnYqfBx.exe
  2⤵
  PID:4268
- C:\Windows\System\nskoghM.exe
  C:\Windows\System\nskoghM.exe
  2⤵
  PID:1592
- C:\Windows\System\DFMVllN.exe
  C:\Windows\System\DFMVllN.exe
  2⤵
  PID:13844
- C:\Windows\System\XRODiAa.exe
  C:\Windows\System\XRODiAa.exe
  2⤵
  PID:4436
- C:\Windows\System\daszhff.exe
  C:\Windows\System\daszhff.exe
  2⤵
  PID:4084
- C:\Windows\System\BgIvELc.exe
  C:\Windows\System\BgIvELc.exe
  2⤵
  PID:14184
- C:\Windows\System\qqpLRel.exe
  C:\Windows\System\qqpLRel.exe
  2⤵
  PID:4312
- C:\Windows\System\aZbsCPh.exe
  C:\Windows\System\aZbsCPh.exe
  2⤵
  PID:12348
- C:\Windows\System\BIhdCOu.exe
  C:\Windows\System\BIhdCOu.exe
  2⤵
  PID:12700
- C:\Windows\System\zrkYhms.exe
  C:\Windows\System\zrkYhms.exe
  2⤵
  PID:9636
- C:\Windows\System\HikoZWV.exe
  C:\Windows\System\HikoZWV.exe
  2⤵
  PID:12888
- C:\Windows\System\wPeQSDA.exe
  C:\Windows\System\wPeQSDA.exe
  2⤵
  PID:3344
- C:\Windows\System\fXgXsbF.exe
  C:\Windows\System\fXgXsbF.exe
  2⤵
  PID:3832
- C:\Windows\System\gaxOWnu.exe
  C:\Windows\System\gaxOWnu.exe
  2⤵
  PID:4120
- C:\Windows\System\pwauhkc.exe
  C:\Windows\System\pwauhkc.exe
  2⤵
  PID:380
- C:\Windows\System\Llknacr.exe
  C:\Windows\System\Llknacr.exe
  2⤵
  PID:2688
- C:\Windows\System\coQmttL.exe
  C:\Windows\System\coQmttL.exe
  2⤵
  PID:3360
- C:\Windows\System\MIYovSF.exe
  C:\Windows\System\MIYovSF.exe
  2⤵
  PID:3496
- C:\Windows\System\gcbeEBO.exe
  C:\Windows\System\gcbeEBO.exe
  2⤵
  PID:3928
- C:\Windows\System\csUEfgo.exe
  C:\Windows\System\csUEfgo.exe
  2⤵
  PID:4548
- C:\Windows\System\INTslqI.exe
  C:\Windows\System\INTslqI.exe
  2⤵
  PID:4416
- C:\Windows\System\gMVdpSj.exe
  C:\Windows\System\gMVdpSj.exe
  2⤵
  PID:3512
- C:\Windows\System\eqNPrct.exe
  C:\Windows\System\eqNPrct.exe
  2⤵
  PID:14204
- C:\Windows\System\bKdnAfg.exe
  C:\Windows\System\bKdnAfg.exe
  2⤵
  PID:1400
- C:\Windows\System\CcMHtnA.exe
  C:\Windows\System\CcMHtnA.exe
  2⤵
  PID:10116
- C:\Windows\System\IFfoiML.exe
  C:\Windows\System\IFfoiML.exe
  2⤵
  PID:12704
- C:\Windows\System\vHVzqgw.exe
  C:\Windows\System\vHVzqgw.exe
  2⤵
  PID:7232
- C:\Windows\System\QvEPudn.exe
  C:\Windows\System\QvEPudn.exe
  2⤵
  PID:4124
- C:\Windows\System\rvcfeza.exe
  C:\Windows\System\rvcfeza.exe
  2⤵
  PID:5096
- C:\Windows\System\AycebsO.exe
  C:\Windows\System\AycebsO.exe
  2⤵
  PID:1200
- C:\Windows\System\kfzfxHk.exe
  C:\Windows\System\kfzfxHk.exe
  2⤵
  PID:1204
- C:\Windows\System\OmblBow.exe
  C:\Windows\System\OmblBow.exe
  2⤵
  PID:872
- C:\Windows\System\LWDEWOw.exe
  C:\Windows\System\LWDEWOw.exe
  2⤵
  PID:1244
- C:\Windows\System\NhGbuZR.exe
  C:\Windows\System\NhGbuZR.exe
  2⤵
  PID:4928
- C:\Windows\System\eTdbzee.exe
  C:\Windows\System\eTdbzee.exe
  2⤵
  PID:1396
- C:\Windows\System\ZiePTtx.exe
  C:\Windows\System\ZiePTtx.exe
  2⤵
  PID:8416
- C:\Windows\System\qhiXkIA.exe
  C:\Windows\System\qhiXkIA.exe
  2⤵
  PID:5504
- C:\Windows\System\KaawWFh.exe
  C:\Windows\System\KaawWFh.exe
  2⤵
  PID:3412
- C:\Windows\System\pofNsJX.exe
  C:\Windows\System\pofNsJX.exe
  2⤵
  PID:3980
- C:\Windows\System\BobcoPE.exe
  C:\Windows\System\BobcoPE.exe
  2⤵
  PID:10096
- C:\Windows\System\nImrylh.exe
  C:\Windows\System\nImrylh.exe
  2⤵
  PID:12996
- C:\Windows\System\beuRWfN.exe
  C:\Windows\System\beuRWfN.exe
  2⤵
  PID:2172
- C:\Windows\System\NeCnijs.exe
  C:\Windows\System\NeCnijs.exe
  2⤵
  PID:3272
- C:\Windows\System\lkBhdFP.exe
  C:\Windows\System\lkBhdFP.exe
  2⤵
  PID:4580
- C:\Windows\System\IyxAjeY.exe
  C:\Windows\System\IyxAjeY.exe
  2⤵
  PID:6016
- C:\Windows\System\qClKiLC.exe
  C:\Windows\System\qClKiLC.exe
  2⤵
  PID:1468
- C:\Windows\System\qZHOapi.exe
  C:\Windows\System\qZHOapi.exe
  2⤵
  PID:5408
- C:\Windows\System\KcAixUp.exe
  C:\Windows\System\KcAixUp.exe
  2⤵
  PID:5656
- C:\Windows\System\vHWcBpI.exe
  C:\Windows\System\vHWcBpI.exe
  2⤵
  PID:5580
- C:\Windows\System\DsVTQWy.exe
  C:\Windows\System\DsVTQWy.exe
  2⤵
  PID:1428
- C:\Windows\System\qfkmCRL.exe
  C:\Windows\System\qfkmCRL.exe
  2⤵
  PID:5100
- C:\Windows\System\NBaBKjN.exe
  C:\Windows\System\NBaBKjN.exe
  2⤵
  PID:13840
- C:\Windows\System\ABuBesf.exe
  C:\Windows\System\ABuBesf.exe
  2⤵
  PID:3504
- C:\Windows\System\CJYlPBf.exe
  C:\Windows\System\CJYlPBf.exe
  2⤵
  PID:8480
- C:\Windows\System\QBirfqr.exe
  C:\Windows\System\QBirfqr.exe
  2⤵
  PID:5860
- C:\Windows\System\WApiDdS.exe
  C:\Windows\System\WApiDdS.exe
  2⤵
  PID:3440
- C:\Windows\System\YTIwawI.exe
  C:\Windows\System\YTIwawI.exe
  2⤵
  PID:6568
- C:\Windows\System\lCDXwoC.exe
  C:\Windows\System\lCDXwoC.exe
  2⤵
  PID:2836
- C:\Windows\System\tvzWrAb.exe
  C:\Windows\System\tvzWrAb.exe
  2⤵
  PID:13392
- C:\Windows\System\DvItkvQ.exe
  C:\Windows\System\DvItkvQ.exe
  2⤵
  PID:4816
- C:\Windows\System\bmkHlEK.exe
  C:\Windows\System\bmkHlEK.exe
  2⤵
  PID:1028
- C:\Windows\System\dbtPnJb.exe
  C:\Windows\System\dbtPnJb.exe
  2⤵
  PID:876
- C:\Windows\System\AFfKMlL.exe
  C:\Windows\System\AFfKMlL.exe
  2⤵
  PID:648
- C:\Windows\System\ZjtoTbQ.exe
  C:\Windows\System\ZjtoTbQ.exe
  2⤵
  PID:6924
- C:\Windows\System\jhxkXMv.exe
  C:\Windows\System\jhxkXMv.exe
  2⤵
  PID:7148
- C:\Windows\System\OnVNlGt.exe
  C:\Windows\System\OnVNlGt.exe
  2⤵
  PID:3972
- C:\Windows\System\dafRsnS.exe
  C:\Windows\System\dafRsnS.exe
  2⤵
  PID:7096
- C:\Windows\System\GINWJGc.exe
  C:\Windows\System\GINWJGc.exe
  2⤵
  PID:1988
- C:\Windows\System\qKrOmdd.exe
  C:\Windows\System\qKrOmdd.exe
  2⤵
  PID:3864
- C:\Windows\System\DAmlJaS.exe
  C:\Windows\System\DAmlJaS.exe
  2⤵
  PID:2140
- C:\Windows\System\njkwqza.exe
  C:\Windows\System\njkwqza.exe
  2⤵
  PID:6596
- C:\Windows\System\FMmgqvd.exe
  C:\Windows\System\FMmgqvd.exe
  2⤵
  PID:7424
- C:\Windows\System\dUJvWHW.exe
  C:\Windows\System\dUJvWHW.exe
  2⤵
  PID:7480
- C:\Windows\System\BvTyYAG.exe
  C:\Windows\System\BvTyYAG.exe
  2⤵
  PID:6752
- C:\Windows\System\FqLVywE.exe
  C:\Windows\System\FqLVywE.exe
  2⤵
  PID:5460
- C:\Windows\System\OzbUPUb.exe
  C:\Windows\System\OzbUPUb.exe
  2⤵
  PID:1100
- C:\Windows\System\cabsIIa.exe
  C:\Windows\System\cabsIIa.exe
  2⤵
  PID:12488
- C:\Windows\System\eCWfmIk.exe
  C:\Windows\System\eCWfmIk.exe
  2⤵
  PID:5716
- C:\Windows\System\eYObvsb.exe
  C:\Windows\System\eYObvsb.exe
  2⤵
  PID:8100
- C:\Windows\System\VCIBRcN.exe
  C:\Windows\System\VCIBRcN.exe
  2⤵
  PID:5928
- C:\Windows\System\GvpxZhr.exe
  C:\Windows\System\GvpxZhr.exe
  2⤵
  PID:6296
- C:\Windows\System\ZNXaCPP.exe
  C:\Windows\System\ZNXaCPP.exe
  2⤵
  PID:5388
- C:\Windows\System\KtHyXre.exe
  C:\Windows\System\KtHyXre.exe
  2⤵
  PID:12844
- C:\Windows\System\MXMbabv.exe
  C:\Windows\System\MXMbabv.exe
  2⤵
  PID:7120
- C:\Windows\System\YfmXnHg.exe
  C:\Windows\System\YfmXnHg.exe
  2⤵
  PID:4236
- C:\Windows\System\YAkyQQI.exe
  C:\Windows\System\YAkyQQI.exe
  2⤵
  PID:7904
- C:\Windows\System\EmXocam.exe
  C:\Windows\System\EmXocam.exe
  2⤵
  PID:8128
- C:\Windows\System\UYCBHyW.exe
  C:\Windows\System\UYCBHyW.exe
  2⤵
  PID:5124
- C:\Windows\System\fiHcRTS.exe
  C:\Windows\System\fiHcRTS.exe
  2⤵
  PID:760
- C:\Windows\System\GIEnMKD.exe
  C:\Windows\System\GIEnMKD.exe
  2⤵
  PID:2864
- C:\Windows\System\VFIEtyE.exe
  C:\Windows\System\VFIEtyE.exe
  2⤵
  PID:5360
- C:\Windows\System\icuKVhY.exe
  C:\Windows\System\icuKVhY.exe
  2⤵
  PID:6256
- C:\Windows\System\OMzwbDw.exe
  C:\Windows\System\OMzwbDw.exe
  2⤵
  PID:416
- C:\Windows\System\aCkHfnB.exe
  C:\Windows\System\aCkHfnB.exe
  2⤵
  PID:1300
- C:\Windows\System\TowVFAC.exe
  C:\Windows\System\TowVFAC.exe
  2⤵
  PID:4408
- C:\Windows\System\ZjxYzzO.exe
  C:\Windows\System\ZjxYzzO.exe
  2⤵
  PID:8212
- C:\Windows\System\RgMiYdH.exe
  C:\Windows\System\RgMiYdH.exe
  2⤵
  PID:7700
- C:\Windows\System\iRRWbBc.exe
  C:\Windows\System\iRRWbBc.exe
  2⤵
  PID:2228
- C:\Windows\System\PMQkEsg.exe
  C:\Windows\System\PMQkEsg.exe
  2⤵
  PID:11172
- C:\Windows\System\BgSSbHb.exe
  C:\Windows\System\BgSSbHb.exe
  2⤵
  PID:6120
- C:\Windows\System\xtwbAXs.exe
  C:\Windows\System\xtwbAXs.exe
  2⤵
  PID:12064
- C:\Windows\System\BBzlYci.exe
  C:\Windows\System\BBzlYci.exe
  2⤵
  PID:7708
- C:\Windows\System\YGyyrNC.exe
  C:\Windows\System\YGyyrNC.exe
  2⤵
  PID:5812
- C:\Windows\System\NFchzZs.exe
  C:\Windows\System\NFchzZs.exe
  2⤵
  PID:2232
- C:\Windows\System\FcpIYLO.exe
  C:\Windows\System\FcpIYLO.exe
  2⤵
  PID:1756
- C:\Windows\System\yVVmktU.exe
  C:\Windows\System\yVVmktU.exe
  2⤵
  PID:8468
- C:\Windows\System\hhMONCX.exe
  C:\Windows\System\hhMONCX.exe
  2⤵
  PID:7812
- C:\Windows\System\YAyhsIx.exe
  C:\Windows\System\YAyhsIx.exe
  2⤵
  PID:944
- C:\Windows\System\wfGIDnD.exe
  C:\Windows\System\wfGIDnD.exe
  2⤵
  PID:5212
- C:\Windows\System\XxViXhz.exe
  C:\Windows\System\XxViXhz.exe
  2⤵
  PID:8908
- C:\Windows\System\MjVnXcr.exe
  C:\Windows\System\MjVnXcr.exe
  2⤵
  PID:8040
- C:\Windows\System\CkEkQsS.exe
  C:\Windows\System\CkEkQsS.exe
  2⤵
  PID:3664
- C:\Windows\System\hZvkfcO.exe
  C:\Windows\System\hZvkfcO.exe
  2⤵
  PID:7964
- C:\Windows\System\PxsSySJ.exe
  C:\Windows\System\PxsSySJ.exe
  2⤵
  PID:8008
- C:\Windows\System\lWJMJmP.exe
  C:\Windows\System\lWJMJmP.exe
  2⤵
  PID:6564
- C:\Windows\System\uTRKFbE.exe
  C:\Windows\System\uTRKFbE.exe
  2⤵
  PID:8148
- C:\Windows\System\XIySkOG.exe
  C:\Windows\System\XIySkOG.exe
  2⤵
  PID:5884
- C:\Windows\System\bfJCRFL.exe
  C:\Windows\System\bfJCRFL.exe
  2⤵
  PID:4996
- C:\Windows\System\fGhyJFK.exe
  C:\Windows\System\fGhyJFK.exe
  2⤵
  PID:1952
- C:\Windows\System\JxuRntJ.exe
  C:\Windows\System\JxuRntJ.exe
  2⤵
  PID:440
- C:\Windows\System\jiTiRcR.exe
  C:\Windows\System\jiTiRcR.exe
  2⤵
  PID:452
- C:\Windows\System\xYbxsfz.exe
  C:\Windows\System\xYbxsfz.exe
  2⤵
  PID:8464
- C:\Windows\System\iFhoqsS.exe
  C:\Windows\System\iFhoqsS.exe
  2⤵
  PID:3888
- C:\Windows\System\rnbkBSO.exe
  C:\Windows\System\rnbkBSO.exe
  2⤵
  PID:8284
- C:\Windows\System\aTadUqC.exe
  C:\Windows\System\aTadUqC.exe
  2⤵
  PID:444
- C:\Windows\System\fXDVejk.exe
  C:\Windows\System\fXDVejk.exe
  2⤵
  PID:6456
- C:\Windows\System\VkgnIeV.exe
  C:\Windows\System\VkgnIeV.exe
  2⤵
  PID:8512
- C:\Windows\System\wePWeBv.exe
  C:\Windows\System\wePWeBv.exe
  2⤵
  PID:5284
- C:\Windows\System\QmvcElG.exe
  C:\Windows\System\QmvcElG.exe
  2⤵
  PID:6988
- C:\Windows\System\isudbXH.exe
  C:\Windows\System\isudbXH.exe
  2⤵
  PID:8152
- C:\Windows\System\cwETjnf.exe
  C:\Windows\System\cwETjnf.exe
  2⤵
  PID:7712
- C:\Windows\System\VyPjpnS.exe
  C:\Windows\System\VyPjpnS.exe
  2⤵
  PID:7136
- C:\Windows\System\pKoOiQy.exe
  C:\Windows\System\pKoOiQy.exe
  2⤵
  PID:3984
- C:\Windows\System\qFGUVoP.exe
  C:\Windows\System\qFGUVoP.exe
  2⤵
  PID:4904
- C:\Windows\System\kVfMeds.exe
  C:\Windows\System\kVfMeds.exe
  2⤵
  PID:4404
- C:\Windows\System\cprfIhC.exe
  C:\Windows\System\cprfIhC.exe
  2⤵
  PID:4828
- C:\Windows\System\FpOSaXx.exe
  C:\Windows\System\FpOSaXx.exe
  2⤵
  PID:10040
- C:\Windows\System\TZopAoY.exe
  C:\Windows\System\TZopAoY.exe
  2⤵
  PID:10032
- C:\Windows\System\elSFMOq.exe
  C:\Windows\System\elSFMOq.exe
  2⤵
  PID:7920
- C:\Windows\System\ceKneuS.exe
  C:\Windows\System\ceKneuS.exe
  2⤵
  PID:9084
- C:\Windows\System\CBiJusm.exe
  C:\Windows\System\CBiJusm.exe
  2⤵
  PID:7800
- C:\Windows\System\CLEyrKx.exe
  C:\Windows\System\CLEyrKx.exe
  2⤵
  PID:9944
- C:\Windows\System\fJpPFtp.exe
  C:\Windows\System\fJpPFtp.exe
  2⤵
  PID:8588
- C:\Windows\System\rGarAbb.exe
  C:\Windows\System\rGarAbb.exe
  2⤵
  PID:3524
- C:\Windows\System\gRqnkoV.exe
  C:\Windows\System\gRqnkoV.exe
  2⤵
  PID:4164
- C:\Windows\System\TqFfNcD.exe
  C:\Windows\System\TqFfNcD.exe
  2⤵
  PID:5464
- C:\Windows\System\gGJplru.exe
  C:\Windows\System\gGJplru.exe
  2⤵
  PID:6352
- C:\Windows\System\ONYnJbg.exe
  C:\Windows\System\ONYnJbg.exe
  2⤵
  PID:9344
- C:\Windows\System\TkNAIfX.exe
  C:\Windows\System\TkNAIfX.exe
  2⤵
  PID:8188
- C:\Windows\System\EndDgVt.exe
  C:\Windows\System\EndDgVt.exe
  2⤵
  PID:8072
- C:\Windows\System\RhqvcSo.exe
  C:\Windows\System\RhqvcSo.exe
  2⤵
  PID:9696
- C:\Windows\System\lPdOqVF.exe
  C:\Windows\System\lPdOqVF.exe
  2⤵
  PID:9736
- C:\Windows\System\VfjijSv.exe
  C:\Windows\System\VfjijSv.exe
  2⤵
  PID:9408
- C:\Windows\System\enhvuqX.exe
  C:\Windows\System\enhvuqX.exe
  2⤵
  PID:8708
- C:\Windows\System\AtUSJlH.exe
  C:\Windows\System\AtUSJlH.exe
  2⤵
  PID:9612
- C:\Windows\System\hMzyDdf.exe
  C:\Windows\System\hMzyDdf.exe
  2⤵
  PID:10068
- C:\Windows\System\hrLojCZ.exe
  C:\Windows\System\hrLojCZ.exe
  2⤵
  PID:9108
- C:\Windows\System\oJgJDto.exe
  C:\Windows\System\oJgJDto.exe
  2⤵
  PID:13584
- C:\Windows\System\kEMVfMq.exe
  C:\Windows\System\kEMVfMq.exe
  2⤵
  PID:8120
- C:\Windows\System\SrhxqIF.exe
  C:\Windows\System\SrhxqIF.exe
  2⤵
  PID:12108
- C:\Windows\System\IhpOGUQ.exe
  C:\Windows\System\IhpOGUQ.exe
  2⤵
  PID:6920
- C:\Windows\System\YWrJqsj.exe
  C:\Windows\System\YWrJqsj.exe
  2⤵
  PID:14348
- C:\Windows\System\JWbrkNa.exe
  C:\Windows\System\JWbrkNa.exe
  2⤵
  PID:14380
- C:\Windows\System\zWshkhK.exe
  C:\Windows\System\zWshkhK.exe
  2⤵
  PID:14404
- C:\Windows\System\ELyECWP.exe
  C:\Windows\System\ELyECWP.exe
  2⤵
  PID:14636
- C:\Windows\System\cqjfCwy.exe
  C:\Windows\System\cqjfCwy.exe
  2⤵
  PID:14752
- C:\Windows\System\QGwSSkP.exe
  C:\Windows\System\QGwSSkP.exe
  2⤵
  PID:14928
- C:\Windows\System\cMsluMr.exe
  C:\Windows\System\cMsluMr.exe
  2⤵
  PID:15040
- C:\Windows\System\pzNuIII.exe
  C:\Windows\System\pzNuIII.exe
  2⤵
  PID:15072
- C:\Windows\System\qemWrxI.exe
  C:\Windows\System\qemWrxI.exe
  2⤵
  PID:15108
- C:\Windows\System\PJxZLfd.exe
  C:\Windows\System\PJxZLfd.exe
  2⤵
  PID:15144
- C:\Windows\System\JRulEbw.exe
  C:\Windows\System\JRulEbw.exe
  2⤵
  PID:15176
- C:\Windows\System\rOduEUi.exe
  C:\Windows\System\rOduEUi.exe
  2⤵
  PID:15208
- C:\Windows\System\AjgbsQc.exe
  C:\Windows\System\AjgbsQc.exe
  2⤵
  PID:15240
- C:\Windows\System\wyPjTeA.exe
  C:\Windows\System\wyPjTeA.exe
  2⤵
  PID:15264
- C:\Windows\System\bpiEyCO.exe
  C:\Windows\System\bpiEyCO.exe
  2⤵
  PID:15300
- C:\Windows\System\dwARVJn.exe
  C:\Windows\System\dwARVJn.exe
  2⤵
  PID:15336
- C:\Windows\System\YABpzmM.exe
  C:\Windows\System\YABpzmM.exe
  2⤵
  PID:7276
- C:\Windows\System\sCfqkpP.exe
  C:\Windows\System\sCfqkpP.exe
  2⤵
  PID:14340
- C:\Windows\System\sVlEwvX.exe
  C:\Windows\System\sVlEwvX.exe
  2⤵
  PID:14364
- C:\Windows\System\Yunmxva.exe
  C:\Windows\System\Yunmxva.exe
  2⤵
  PID:14388
- C:\Windows\System\SxTfLcc.exe
  C:\Windows\System\SxTfLcc.exe
  2⤵
  PID:14432
- C:\Windows\System\NMuCOqy.exe
  C:\Windows\System\NMuCOqy.exe
  2⤵
  PID:14548
- C:\Windows\System\mGUwVTN.exe
  C:\Windows\System\mGUwVTN.exe
  2⤵
  PID:13260
- C:\Windows\System\oVrrfFz.exe
  C:\Windows\System\oVrrfFz.exe
  2⤵
  PID:14760
- C:\Windows\System\HcxLeWU.exe
  C:\Windows\System\HcxLeWU.exe
  2⤵
  PID:14600
- C:\Windows\System\TiJUmHx.exe
  C:\Windows\System\TiJUmHx.exe
  2⤵
  PID:7728
- C:\Windows\System\YtIpenB.exe
  C:\Windows\System\YtIpenB.exe
  2⤵
  PID:14848
- C:\Windows\System\QqzGtZt.exe
  C:\Windows\System\QqzGtZt.exe
  2⤵
  PID:14664
- C:\Windows\System\tJTxlOr.exe
  C:\Windows\System\tJTxlOr.exe
  2⤵
  PID:14868
- C:\Windows\System\zIYQEqB.exe
  C:\Windows\System\zIYQEqB.exe
  2⤵
  PID:5692
- C:\Windows\System\vYZuoZm.exe
  C:\Windows\System\vYZuoZm.exe
  2⤵
  PID:13244
- C:\Windows\System\NscEUPW.exe
  C:\Windows\System\NscEUPW.exe
  2⤵
  PID:4100
- C:\Windows\System\LYmCFJA.exe
  C:\Windows\System\LYmCFJA.exe
  2⤵
  PID:10812
- C:\Windows\System\CkhpSsw.exe
  C:\Windows\System\CkhpSsw.exe
  2⤵
  PID:14964
- C:\Windows\System\JhwgtZP.exe
  C:\Windows\System\JhwgtZP.exe
  2⤵
  PID:14880
- C:\Windows\System\JpnFvOw.exe
  C:\Windows\System\JpnFvOw.exe
  2⤵
  PID:14692
- C:\Windows\System\GIhtqIu.exe
  C:\Windows\System\GIhtqIu.exe
  2⤵
  PID:14696
- C:\Windows\System\lgwMotl.exe
  C:\Windows\System\lgwMotl.exe
  2⤵
  PID:14944
- C:\Windows\System\DyjUBCz.exe
  C:\Windows\System\DyjUBCz.exe
  2⤵
  PID:15080
- C:\Windows\System\lrJkLkR.exe
  C:\Windows\System\lrJkLkR.exe
  2⤵
  PID:14972
- C:\Windows\System\ggdeQKo.exe
  C:\Windows\System\ggdeQKo.exe
  2⤵
  PID:15260
- C:\Windows\System\mSGqDzn.exe
  C:\Windows\System\mSGqDzn.exe
  2⤵
  PID:15344
- C:\Windows\System\CyHgVAZ.exe
  C:\Windows\System\CyHgVAZ.exe
  2⤵
  PID:13300
- C:\Windows\System\yesvotk.exe
  C:\Windows\System\yesvotk.exe
  2⤵
  PID:15160
- C:\Windows\System\pLnBcHj.exe
  C:\Windows\System\pLnBcHj.exe
  2⤵
  PID:15356
- C:\Windows\System\EsqtVUr.exe
  C:\Windows\System\EsqtVUr.exe
  2⤵
  PID:15052
- C:\Windows\System\hnuQatC.exe
  C:\Windows\System\hnuQatC.exe
  2⤵
  PID:8920
- C:\Windows\System\UkndLRc.exe
  C:\Windows\System\UkndLRc.exe
  2⤵
  PID:15152
- C:\Windows\System\SiRVyvB.exe
  C:\Windows\System\SiRVyvB.exe
  2⤵
  PID:12120
- C:\Windows\System\XmbUOgi.exe
  C:\Windows\System\XmbUOgi.exe
  2⤵
  PID:15308
- C:\Windows\System\zOUmfyb.exe
  C:\Windows\System\zOUmfyb.exe
  2⤵
  PID:9904
- C:\Windows\System\xXSORWO.exe
  C:\Windows\System\xXSORWO.exe
  2⤵
  PID:14376
- C:\Windows\System\YeRVepK.exe
  C:\Windows\System\YeRVepK.exe
  2⤵
  PID:10004
- C:\Windows\System\vRGLCtl.exe
  C:\Windows\System\vRGLCtl.exe
  2⤵
  PID:8076
- C:\Windows\System\LArGBuH.exe
  C:\Windows\System\LArGBuH.exe
  2⤵
  PID:6728
- C:\Windows\System\XpmUwkR.exe
  C:\Windows\System\XpmUwkR.exe
  2⤵
  PID:12556
- C:\Windows\System\BTjxtEK.exe
  C:\Windows\System\BTjxtEK.exe
  2⤵
  PID:5576
- C:\Windows\System\HMgrJaX.exe
  C:\Windows\System\HMgrJaX.exe
  2⤵
  PID:8840
- C:\Windows\System\YApnGfZ.exe
  C:\Windows\System\YApnGfZ.exe
  2⤵
  PID:9412
- C:\Windows\System\GImUqzm.exe
  C:\Windows\System\GImUqzm.exe
  2⤵
  PID:7436
- C:\Windows\System\CnrDQQe.exe
  C:\Windows\System\CnrDQQe.exe
  2⤵
  PID:9992
- C:\Windows\System\AGEMOuR.exe
  C:\Windows\System\AGEMOuR.exe
  2⤵
  PID:11724
- C:\Windows\System\JRmLzEW.exe
  C:\Windows\System\JRmLzEW.exe
  2⤵
  PID:10188
- C:\Windows\System\oBXtyOv.exe
  C:\Windows\System\oBXtyOv.exe
  2⤵
  PID:9224
- C:\Windows\System\GClllYs.exe
  C:\Windows\System\GClllYs.exe
  2⤵
  PID:14736
- C:\Windows\System\kCiIMnW.exe
  C:\Windows\System\kCiIMnW.exe
  2⤵
  PID:9236
- C:\Windows\System\dOLaQPJ.exe
  C:\Windows\System\dOLaQPJ.exe
  2⤵
  PID:11244
- C:\Windows\System\glstsmh.exe
  C:\Windows\System\glstsmh.exe
  2⤵
  PID:14632
- C:\Windows\System\yIzZeAu.exe
  C:\Windows\System\yIzZeAu.exe
  2⤵
  PID:12484
- C:\Windows\System\OxAmWbY.exe
  C:\Windows\System\OxAmWbY.exe
  2⤵
  PID:14500
- C:\Windows\System\GUxfZnA.exe
  C:\Windows\System\GUxfZnA.exe
  2⤵
  PID:6908
- C:\Windows\System\YPYgXxT.exe
  C:\Windows\System\YPYgXxT.exe
  2⤵
  PID:7016
- C:\Windows\System\ebZtcTa.exe
  C:\Windows\System\ebZtcTa.exe
  2⤵
  PID:13176
- C:\Windows\System\LahbabO.exe
  C:\Windows\System\LahbabO.exe
  2⤵
  PID:10348
- C:\Windows\System\kJteDnY.exe
  C:\Windows\System\kJteDnY.exe
  2⤵
  PID:14712
- C:\Windows\System\rLHVXkX.exe
  C:\Windows\System\rLHVXkX.exe
  2⤵
  PID:14900
- C:\Windows\System\zrUssqR.exe
  C:\Windows\System\zrUssqR.exe
  2⤵
  PID:12964
- C:\Windows\System\MICUWhg.exe
  C:\Windows\System\MICUWhg.exe
  2⤵
  PID:15252
- C:\Windows\System\nqxnRgd.exe
  C:\Windows\System\nqxnRgd.exe
  2⤵
  PID:12696
- C:\Windows\System\ufJrzcF.exe
  C:\Windows\System\ufJrzcF.exe
  2⤵
  PID:6948
- C:\Windows\System\kVddwGf.exe
  C:\Windows\System\kVddwGf.exe
  2⤵
  PID:12712
- C:\Windows\System\IEeYCFc.exe
  C:\Windows\System\IEeYCFc.exe
  2⤵
  PID:13100
- C:\Windows\System\vorKIeV.exe
  C:\Windows\System\vorKIeV.exe
  2⤵
  PID:7280
- C:\Windows\System\YJcoDjZ.exe
  C:\Windows\System\YJcoDjZ.exe
  2⤵
  PID:13140
- C:\Windows\System\SbokoAR.exe
  C:\Windows\System\SbokoAR.exe
  2⤵
  PID:12788
- C:\Windows\System\bXCWreK.exe
  C:\Windows\System\bXCWreK.exe
  2⤵
  PID:14956
- C:\Windows\System\pyGSUIP.exe
  C:\Windows\System\pyGSUIP.exe
  2⤵
  PID:14976
- C:\Windows\System\tgryqeD.exe
  C:\Windows\System\tgryqeD.exe
  2⤵
  PID:8872
- C:\Windows\System\CcDWmdB.exe
  C:\Windows\System\CcDWmdB.exe
  2⤵
  PID:10192
- C:\Windows\System\BgzWaQv.exe
  C:\Windows\System\BgzWaQv.exe
  2⤵
  PID:15120
- C:\Windows\System\HDjXJJG.exe
  C:\Windows\System\HDjXJJG.exe
  2⤵
  PID:14844
- C:\Windows\System\RfoQntt.exe
  C:\Windows\System\RfoQntt.exe
  2⤵
  PID:12216
- C:\Windows\System\Hnyzeoz.exe
  C:\Windows\System\Hnyzeoz.exe
  2⤵
  PID:13752
- C:\Windows\System\YJCbCtt.exe
  C:\Windows\System\YJCbCtt.exe
  2⤵
  PID:7924
- C:\Windows\System\GZJkqWL.exe
  C:\Windows\System\GZJkqWL.exe
  2⤵
  PID:10788
- C:\Windows\System\wAyeEQi.exe
  C:\Windows\System\wAyeEQi.exe
  2⤵
  PID:11896
- C:\Windows\System\tUjIEzB.exe
  C:\Windows\System\tUjIEzB.exe
  2⤵
  PID:14424
- C:\Windows\System\QIgTErM.exe
  C:\Windows\System\QIgTErM.exe
  2⤵
  PID:12148
- C:\Windows\System\UcbYDtu.exe
  C:\Windows\System\UcbYDtu.exe
  2⤵
  PID:6632
- C:\Windows\System\DJjZEue.exe
  C:\Windows\System\DJjZEue.exe
  2⤵
  PID:5608
- C:\Windows\System\XvdFOmw.exe
  C:\Windows\System\XvdFOmw.exe
  2⤵
  PID:10924
- C:\Windows\System\epzbrwd.exe
  C:\Windows\System\epzbrwd.exe
  2⤵
  PID:12176
- C:\Windows\System\XFAmrCO.exe
  C:\Windows\System\XFAmrCO.exe
  2⤵
  PID:3940
- C:\Windows\System\IcBzGUS.exe
  C:\Windows\System\IcBzGUS.exe
  2⤵
  PID:9372
- C:\Windows\System\CLOdrFm.exe
  C:\Windows\System\CLOdrFm.exe
  2⤵
  PID:11752
- C:\Windows\System\DHttswN.exe
  C:\Windows\System\DHttswN.exe
  2⤵
  PID:4732
- C:\Windows\System\ULzDJFt.exe
  C:\Windows\System\ULzDJFt.exe
  2⤵
  PID:14748
- C:\Windows\System\cuMiRlW.exe
  C:\Windows\System\cuMiRlW.exe
  2⤵
  PID:11928
- C:\Windows\System\YzarxtC.exe
  C:\Windows\System\YzarxtC.exe
  2⤵
  PID:14804
- C:\Windows\System\ZwWFyWI.exe
  C:\Windows\System\ZwWFyWI.exe
  2⤵
  PID:10856
- C:\Windows\System\vKARuBH.exe
  C:\Windows\System\vKARuBH.exe
  2⤵
  PID:2136
- C:\Windows\System\YipeWkl.exe
  C:\Windows\System\YipeWkl.exe
  2⤵
  PID:13096
- C:\Windows\System\pZWwAKo.exe
  C:\Windows\System\pZWwAKo.exe
  2⤵
  PID:12408
- C:\Windows\System\JDgDCYz.exe
  C:\Windows\System\JDgDCYz.exe
  2⤵
  PID:12932
- C:\Windows\System\fHgVlhA.exe
  C:\Windows\System\fHgVlhA.exe
  2⤵
  PID:7968
- C:\Windows\System\GlctNSb.exe
  C:\Windows\System\GlctNSb.exe
  2⤵
  PID:6560
- C:\Windows\System\ocRSDvY.exe
  C:\Windows\System\ocRSDvY.exe
  2⤵
  PID:14904
- C:\Windows\System\WbMvYEj.exe
  C:\Windows\System\WbMvYEj.exe
  2⤵
  PID:3200
- C:\Windows\System\ZYYvfQl.exe
  C:\Windows\System\ZYYvfQl.exe
  2⤵
  PID:7472
- C:\Windows\System\OHslVBU.exe
  C:\Windows\System\OHslVBU.exe
  2⤵
  PID:11924
- C:\Windows\System\iXhKURT.exe
  C:\Windows\System\iXhKURT.exe
  2⤵
  PID:14876
- C:\Windows\System\hDHqiOy.exe
  C:\Windows\System\hDHqiOy.exe
  2⤵
  PID:9040
- C:\Windows\System\ibwwuXL.exe
  C:\Windows\System\ibwwuXL.exe
  2⤵
  PID:7624
- C:\Windows\System\OFGVoIT.exe
  C:\Windows\System\OFGVoIT.exe
  2⤵
  PID:14000
- C:\Windows\System\VBInovG.exe
  C:\Windows\System\VBInovG.exe
  2⤵
  PID:8368
- C:\Windows\System\HKFOwCM.exe
  C:\Windows\System\HKFOwCM.exe
  2⤵
  PID:8432
- C:\Windows\System\IpjWXkC.exe
  C:\Windows\System\IpjWXkC.exe
  2⤵
  PID:7636
- C:\Windows\System\TyCWjlk.exe
  C:\Windows\System\TyCWjlk.exe
  2⤵
  PID:13156
- C:\Windows\System\JIUgZuf.exe
  C:\Windows\System\JIUgZuf.exe
  2⤵
  PID:10636
- C:\Windows\System\bqXHBml.exe
  C:\Windows\System\bqXHBml.exe
  2⤵
  PID:8660
- C:\Windows\System\tRdHIYL.exe
  C:\Windows\System\tRdHIYL.exe
  2⤵
  PID:10496
- C:\Windows\System\ifaxLGs.exe
  C:\Windows\System\ifaxLGs.exe
  2⤵
  PID:9480
- C:\Windows\System\HsrtGYq.exe
  C:\Windows\System\HsrtGYq.exe
  2⤵
  PID:8476
- C:\Windows\System\fdUKOQf.exe
  C:\Windows\System\fdUKOQf.exe
  2⤵
  PID:12748
- C:\Windows\System\MAkEjlz.exe
  C:\Windows\System\MAkEjlz.exe
  2⤵
  PID:5604
- C:\Windows\System\tLdpFeE.exe
  C:\Windows\System\tLdpFeE.exe
  2⤵
  PID:5732
- C:\Windows\System\UOizuMI.exe
  C:\Windows\System\UOizuMI.exe
  2⤵
  PID:15248
- C:\Windows\System\MVMqQnU.exe
  C:\Windows\System\MVMqQnU.exe
  2⤵
  PID:5356
- C:\Windows\System\mMhcsTx.exe
  C:\Windows\System\mMhcsTx.exe
  2⤵
  PID:11880
- C:\Windows\System\wnSqsAA.exe
  C:\Windows\System\wnSqsAA.exe
  2⤵
  PID:10916
- C:\Windows\System\QzFskYz.exe
  C:\Windows\System\QzFskYz.exe
  2⤵
  PID:13668
- C:\Windows\System\LAafflF.exe
  C:\Windows\System\LAafflF.exe
  2⤵
  PID:14268
- C:\Windows\System\aIzebvo.exe
  C:\Windows\System\aIzebvo.exe
  2⤵
  PID:14216
- C:\Windows\System\iObmbCz.exe
  C:\Windows\System\iObmbCz.exe
  2⤵
  PID:14152
- C:\Windows\System\dbrtAEU.exe
  C:\Windows\System\dbrtAEU.exe
  2⤵
  PID:12644
- C:\Windows\System\zcRhilD.exe
  C:\Windows\System\zcRhilD.exe
  2⤵
  PID:11060
- C:\Windows\System\dtUvNeF.exe
  C:\Windows\System\dtUvNeF.exe
  2⤵
  PID:13952
- C:\Windows\System\GVwgkOs.exe
  C:\Windows\System\GVwgkOs.exe
  2⤵
  PID:11080
- C:\Windows\System\ibkRaoA.exe
  C:\Windows\System\ibkRaoA.exe
  2⤵
  PID:7672
- C:\Windows\System\WQdXvAH.exe
  C:\Windows\System\WQdXvAH.exe
  2⤵
  PID:15216
- C:\Windows\System\eKpBCYl.exe
  C:\Windows\System\eKpBCYl.exe
  2⤵
  PID:12000

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 448 -p 12208 -ip 12208
1⤵
PID:12732

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:12868

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13536

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:13232

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:3580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pt1enjjz.1qi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ATrIJLo.exe

Filesize
1.7MB

MD5
e84bc49fa02b7cdba3d09d1f08b94de5

SHA1
ba9787d1cb03aa3c99faf567cdb431a43c742044

SHA256
e1f9a0c72e48205291afe62436d55964dd13411c6679a343704b78cd1f0a8cdd

SHA512
c37de1ee9037140f797fb9690e52751ee7e4143f28d264d012d00a4aa4b481adcf8a18fd003aa4a337f5bb51eda51b8965502364acdb2a754363907a855cfc3a

Download Submit
C:\Windows\System\EfkpqCE.exe

Filesize
1.7MB

MD5
6ab1d8647e168cefbf12cb2b1e8404f7

SHA1
bb2defda78663f1cd4c18a80c150b6179b885ceb

SHA256
06e4828ff4be444248cee963439d8b177a8d430a93aefcdbe4d2480312a7f2a9

SHA512
00e22fa3ddd783d888cfa90e167b626ccd999cb1b49d9b55c9d2f7615ec1cc1b2b5f6f2014be6dfc6371e4ab73b213ddebced3268c6343b7a37cdf7ef5db8cd3

Download Submit
C:\Windows\System\FpgDkkI.exe

Filesize
1.7MB

MD5
e12b1b7a3d80b480fb92deb64c04dcd0

SHA1
f0433f7227a3cec689a9c45139edfe5125da0458

SHA256
5c3b05da624cd73335b7777b2da73cfca79bdbdd08dea204501279f2b14bea53

SHA512
d1415ecb172864dee87393596849f88e6f00ea0abf4234a4264fd879fe41edf773c646c69215f8872667e93559675cb385a5618e80059786d209e7b870c04bc7

Download Submit
C:\Windows\System\GKijVpV.exe

Filesize
1.7MB

MD5
792d16e1ab31d8375770c58179b1a06d

SHA1
70af0dffb6519f65d2b8ecbce3a532aa3ad4d75b

SHA256
14ac61ba276bd803bad6d9f289458357b36aa4b8e6f8147b9f7296f6837c1b63

SHA512
2f356e1f700d7e38ce5e1aadffaa247db2d36c52037d51efba84ce34bf9de1ac89dbd1ebd0ebd92efea951a42e17cf90cc987b02c25e15ab33a927bf481ee590

Download Submit
C:\Windows\System\KwXtQCz.exe

Filesize
1.7MB

MD5
18691275c3d655a75652c3b15f8d8ae6

SHA1
128c6f3dbc5f8023adf99d038112696c6eb384f9

SHA256
01422c8e199e9fe291a4f1a9f93c7c0042c7a9a7026ea3127be05730f6006e68

SHA512
86c16a2538b67905865b3d81937550ecc4b5beafa0b5ffca0ab1252330146c77f4ca76d609bd172beade932f08fb1c5a5e4a960305c564861af9bbdb96ee5986

Download Submit
C:\Windows\System\NhYTrgd.exe

Filesize
1.7MB

MD5
8015a77a88018b5a840c77c2d60e0793

SHA1
bc12a55ee4c4cec76c2615d58304229d0e95d70c

SHA256
dd86f1d163d167b75a8fab7d57605d34adae0e19d1222ad530a954e3122ca138

SHA512
ba997eaec49ce0c4262f10ca9fb1196398dc2dab43c41f434e74b685e727389965305b107984b0d615b5770096baccc9808a134a22480b553e377076915e7640

Download Submit
C:\Windows\System\NsnFVVz.exe

Filesize
1.7MB

MD5
faffcff5a8e65a201f76bd216e514ad9

SHA1
a4c699b3461ba1cf5dd6d62e9023a40004a7677a

SHA256
d84ae6e8fd4c28c6fd5582e81d65f9868e53869b684f9162833341dadaef9fb7

SHA512
40c0e863580aba62b782d52c8c042a4ac562668c61eb2fb57af36ad57e454d8bd6c761481e136e66236701b04514a55dd70973eeb6829c40be53a24061ddc443

Download Submit
C:\Windows\System\PXlAWkf.exe

Filesize
1.7MB

MD5
ccbe810d18edf063d6aaad83cd737a29

SHA1
b33a6039be26ee2460243fdbed30d149aa32f532

SHA256
3c4c0497bb03be27b7e5e8204ddd1ccd41e715fb82c4af2bba5b888a68683d17

SHA512
e177587df9d3db9ba6293c095a87d683b064efa35000425e8e2fd39dce9a56604239c40998b232543c07baffccfa816f25df09819d1974339a59e16620aada27

Download Submit
C:\Windows\System\QZcooZW.exe

Filesize
1.7MB

MD5
6d216f788d77f527a7973abc653c13a2

SHA1
28a3860ce13ea72ae4ab913c3d4897509aa1e635

SHA256
989e6c5d7cdb1272441aff06ec272f2c19b9c7b789f60b98eb4a66639b9121af

SHA512
0e55128c20d3d73581a9350e3ffcafaf01e77603f2a043a7404bee3084ecc082d35f95ab5639cbce693e795898471159ab65df599f9acb74896fe15fac1b5473

Download Submit
C:\Windows\System\TahDxYo.exe

Filesize
1.7MB

MD5
f83876ec964385b03f413e05d9c7aec0

SHA1
ea212da05152c15ac177bb43a2fb3f93759335a9

SHA256
d7a4d18e04bb581f2c7798dfb3ef59a211fc509c1086cb6ee732848505ac8818

SHA512
823f50b5cef8c90d791122193ca512e4df72d8776a5163ca1d4d4fcbfc31b2db9f7af3b28566e783ac9b3f8235ca840b9b70a23dc57102f2a34aaf8aeb7c8406

Download Submit
C:\Windows\System\UqlBEcd.exe

Filesize
1.7MB

MD5
d2aa83f64ddb9dfda2a96f62b811fed6

SHA1
dc80e86500828348e294b59f52b0c2c0e7c0612b

SHA256
69f348c7b7e5674404029b78d4609ee3e2c8a900f3a4ce60a7f9201814670359

SHA512
8d7f078124f43a892c62ebe25f9a36bc879c55c72b1b2258e727da989b0aba3c97746667edcc39a49689afa286982a8b9920376c501a93b3c424b670ce17eb0c

Download Submit
C:\Windows\System\UyYSkFX.exe

Filesize
1.7MB

MD5
5c58dd6f35fde657e017845644ce1b6f

SHA1
018d6c0a37b571b23170d8d0101afb5f8c5c9f53

SHA256
9499407e80480b1e9aab0413e416f674a474aafca9c406b8be1dc8c535710e6f

SHA512
8595d1d8910090691537821930968fb4760412d1bae7c2d9b1c5c38627cfebe09c70f84cb62fe73655182113f16bddc0d1dd75aafcb58480a4ed1ce8c08bf960

Download Submit
C:\Windows\System\VbtIQMP.exe

Filesize
1.7MB

MD5
aaa3abf141ec6278b406940369540155

SHA1
4e4c3a86201f9c72608d4fadec0975e1f55843b5

SHA256
9558ad2eeb6e98f4c05875f5985e5f938eacd63abdb5708671ddeedf626f8879

SHA512
0292ccd1d75163f306e402d128087cba1437252c2fd8c062a109f9c9c65b7f24b2c09fe2a23e94d25b1fee0f473ad9933bafe4e5170a19ca488585910c9e9b66

Download Submit
C:\Windows\System\WIDBRKd.exe

Filesize
1.7MB

MD5
4871c18267ac420ad69b03894db80319

SHA1
c5eae6bbb5a72769de0b0516446e479cb215b117

SHA256
8019f4e56a6f4378d496487ca79f78e76d120f3a25f624445f949eac70ff1764

SHA512
1553cd243c943ccf6029630d15571b57d840a589e555578080e4ff7207b4866c5ab1236b532cd009de48ac925a483866b7a22b6d73404e1d8ad995cf473dae01

Download Submit
C:\Windows\System\aCdQzeJ.exe

Filesize
8B

MD5
68703642e5faeaf00b4b9f791a04a7f5

SHA1
2e8f5d51bda54b6b227caed2cb4535020c7a482c

SHA256
76bc446e18daed4e6417440c778e757728762c893f014de08ffa5f0fe98668bd

SHA512
0c1919485a30576b5fdf963204dc04b356f524c23dfb4ffaecdbb8a8ea4a0993cf3ac05bee011edf07b5b637ac7455499983eac22f5cdd87cd869e7a046115a5

Download Submit
C:\Windows\System\aGPtERH.exe

Filesize
1.7MB

MD5
4e9f5b97d1524dc6699656e78ad3769c

SHA1
1845fd6ef35ccca1b56fff465ca909c2b15804df

SHA256
99de5fddb19b773dde3c89f2ff1a0659552473ad87a09053c3b4c26cebe9de5d

SHA512
d38f986971f715a0acaf3b9dd7daf0e6f56f6c1b2845b4f304ae1b3861ef818780194d579120523510d4ab223a4d48be8e96883a4f8e1fb0cdb97328d0bd86b7

Download Submit
C:\Windows\System\abaDNeN.exe

Filesize
1.7MB

MD5
ebed58760974f5016ac221984ff7d2c7

SHA1
b9f0d5888dff83d5517c4812a43b7fe7b866eb82

SHA256
3512c2fd1dc942ffd7f7e303d42f07e83c6cd72c9a5bd758fc4ce2eacf84f7e8

SHA512
a2211d82c2bd6320f548f524d2ca78a45c05a6bb29950e3df3beb7cfba580d271b3ce558bd6138863103e7b5dcb8b62090b2170f279722140890de01d339eaad

Download Submit
C:\Windows\System\cDzvkUh.exe

Filesize
1.7MB

MD5
a3d51622e77d5d1f53b25a3479099e27

SHA1
6d83d05f4c807484c4fb8b2abe97c36ba0762805

SHA256
ce38a6f1d150f8dd5e55ccf7012ae97fc362aa6ad635965a815fbf786c4c4f90

SHA512
0aeca49f449f6a07c02a60313cc86febe384efd1e1ff6e777247f9a2d4e1920db86649e9eec2df1c212a4703d6602e4d10bb3dbf5847cc294f0fd42cde367007

Download Submit
C:\Windows\System\eymvIKs.exe

Filesize
1.7MB

MD5
49d093ad83d798ecd04029e34df71b36

SHA1
02c9f31ece32c54996e63e2eefa279cbba732194

SHA256
42ce55dc4954755cc8825e5e789db2b8696704bb3a521884f1e41dafd2fc8c1f

SHA512
a8b91bc958e709f37bab02eba1db299c55c64929574ebbb2120e03fd49aea0209211bef4de3bd32a88df374678c71e0402aaf817ea712ce7f993c8466c7ee463

Download Submit
C:\Windows\System\hdJBsBD.exe

Filesize
1.7MB

MD5
50ecafc9b28c71d1b1ecf806f3af0637

SHA1
4eac4d4c79679f52f0da290f1a558612fadb24cd

SHA256
e21249b1eb5f04f1de2c9a8268f1b3c893ef21ae31a193bae2f8debbb2aabf31

SHA512
a0286e8cd0817ec14abda851426d151c15c1870c31111c12ec48ae70d906b40f2960f5abcac78ef0b82505500b2f9a068f2c77a4687117a75af53be9b22eb4be

Download Submit
C:\Windows\System\kiNkmmz.exe

Filesize
1.7MB

MD5
62590a826434a4457d39ff051f42ab21

SHA1
3e1cd22554c9187f679694a6eaf517db381e0493

SHA256
b3d82d8193ed53ff7c7c53af7a5c39926be511773d259665b825b85c6536040a

SHA512
9352e8e302a25e1753b71566cee9cdd5efc82d27ddffc0751531d4868ee0e686ab40896949b3e7b22039c342857d03e04adadeeb551c5313d96e979429e99d45

Download Submit
C:\Windows\System\mCxThyf.exe

Filesize
1.7MB

MD5
4083a282013c1fd75c936253f904daf2

SHA1
d70fbeb6f789a7148fc3ad7e048e92aa9af11ee2

SHA256
12588c92d9f1ee512c4e6c9223657325643c49721a1ce5270f402ac7da3e2ec7

SHA512
b4cbb38d96db73df94ea184c04f85e22b02b6fb6af35dabeba3176e77b0087ce93e1c43027bbe7f1202a27c85b3a72e76ca9c60418daf7bbfd21f2c61ddd887f

Download Submit
C:\Windows\System\mlaBpdE.exe

Filesize
1.7MB

MD5
c6bec6f5fa6ca6fc85f20e00b3f49c98

SHA1
b38590ee019c313d8370090fa19d588914484e4c

SHA256
5183cf6013fde34a4214a4053e50c01b5e835236a9323f81d884c5749dc3d101

SHA512
1418ee7bb99911395786f5adbed9120936699dba0d09ff9912125e88d43e86999849bed8565d4608bd305cd04fa7cce887b6b2c2f0ebf32c3cb9dd907384995a

Download Submit
C:\Windows\System\ncmCIRY.exe

Filesize
18B

MD5
1e115887da89dd331527c9a56198c05a

SHA1
775fd7400acf7d0ce532fe6e77c75a22fe9e230c

SHA256
1f3da7dc011cb34515f387ca2a526d38913785ce0fa141ec7fb7693fbec54d85

SHA512
ff900fcd4057e1f7839c6d429bf4ccbe12ce14bbb4a5dbaaf6535bdaf022b8b29e789eed53a21534de8dcc350cf129f984fa6cec2a0d3d4df59644bd36d66dd9

Download Submit
C:\Windows\System\nkGvcZa.exe

Filesize
1.7MB

MD5
551f7e80594093a013c8bee1a4853051

SHA1
1d03abd7dd90cfa2f739a420e80851b435184ee6

SHA256
aa18f07bf196efa812a1e8dbe69208beb6bb2c2021fe9e871a6a4ea616661ce0

SHA512
3135f6d31b5addde638851df541f73bbbdc3c4bfb557d204e09ecd17488ece5be55fba53d6b76c955b8c6ec6f8821079b9ff79cb40871e57ac4d6c4ad60495dc

Download Submit
C:\Windows\System\ocnAtkt.exe

Filesize
1.7MB

MD5
b068c874ec99559c4c44b6fac3e54d80

SHA1
820648581521c46d1c720f7d23739528438c9d6f

SHA256
9514943c7f90798760ef7c207f273ba66188498145e769bda7a748398351338b

SHA512
e6065bf1040d1d625f54bb37fda088c8933cf2d9117ded5060f38c41fd5c708f200cc6d99c31c29a6fb02b23526c5ef01c2753814a7cf8629f06d71b9d2c8bd4

Download Submit
C:\Windows\System\qEDbQsA.exe

Filesize
1.7MB

MD5
7e3337a58b11f3807b7e14004948ec44

SHA1
ecd21f523ae2782f1c96d18603440ed11b63725a

SHA256
99d7ff0095d7475b3d9de85af3fe941cf421b889f280fa9f387ae9af6d00752f

SHA512
b28b87d69eeca0ce3d837cdd3eea81c2745adc1f2523e01089117448a93c56692fc60b94fea6f1fcf6596eec01cb30932c1e706bf8c082a25192268c9d4fa8de

Download Submit
C:\Windows\System\qTSqOwR.exe

Filesize
1.7MB

MD5
e5feb04ec5ea9f66c69f00b8b0554e01

SHA1
aa76bd29641e91d68426f8850ad0704079c547af

SHA256
5c3acdc7635003d6e3154cc986601ae27dfe524420a55101f269c24d6310f733

SHA512
3da888ee5b51fd9611ed87ee0d4fdf46b7d1011560be5db977b2625736a0ae499d7811ec7ba80a5882a9de677e60af3b24fc996b8ed8c7e232fe15ff43d0c39f

Download Submit
C:\Windows\System\rCaxTaM.exe

Filesize
1.7MB

MD5
952836fc6d91a0d792d4aa6ee15bb2c1

SHA1
bac991c234459b8c5905a75fe7a7c7ec26f2d991

SHA256
445fbb2e8153a2d68740d5b3191ca3105fc363a88b3f814bd72c511b8a230aa8

SHA512
b1a96f0f2e8440cf926beca1308a496a9bfece0fc90c0283a156b34020b4602c2a604625c59b8c1cb8490a0c7d4e566a4b99870f1f2b2ab9bf88b5bfc00570f1

Download Submit
C:\Windows\System\smDnDuY.exe

Filesize
1.7MB

MD5
fa5957c409951300de8e080185e2a713

SHA1
5a7efee055032d2d08c17ab311a06d12b096d6df

SHA256
ec4bbc9d73c4b88eb2f5a2fe6d397aaf2f9c5245330ef3ac87aa2278f0c989c3

SHA512
afb5c05648280baf1dc54841afbdeef6e4f8f858a97fda31a39ba95b573997e894cff82651f304538da9dc16153d63d62ac086a0348fb1566f8cf832034efea5

Download Submit
C:\Windows\System\tBWVGaS.exe

Filesize
1.7MB

MD5
bbf86a2984f6aa1adbc41452f0581513

SHA1
626e42e53c3384c57daa1f055bf59dab1a38f3c3

SHA256
9c5b1bd75efadf677bc8189303fae32030eabf4171ec69a0b38a4f469ab59e4d

SHA512
b80e50f127d430693c0a275898bb4d0357f42f6034bd2e9988f201d83f74e0a52edcd6947c972686bc00789331a218d40a38f64d5b81d4d63e3ce1504cbe5e51

Download Submit
C:\Windows\System\tuCLvkz.exe

Filesize
1.7MB

MD5
9b80a68d4951d4950af5140534322d69

SHA1
feeff56af415750b50c93a3750ac5bde082deb7a

SHA256
3003df97d226b2f07a1655a7b1ce0dc2708cd3626ceba8281d00dcfcca016330

SHA512
687e44a545996732e7bd9619f211e09950113c359c96a65fe2a0a67a59dc9fa102dcc1c48516f343e070dd489c60cd91cbb25db55c5d97279fa255e038b856cf

Download Submit
C:\Windows\System\uSBRNyt.exe

Filesize
1.7MB

MD5
d74108dd972cd065ca7a95b013b01d80

SHA1
a7d825174d427fc58dc7e1ad5b89b1775f7d641a

SHA256
adb24d03391060d0b9ecd076f84974f082ed0e94e062ebfc565c775e1bf4f4e0

SHA512
c518b053086cbce0aee64175862758741e6ccd6f10c6b07acb8fb3b56791928788383c487f09a67d76aadebbc1215b1ef88bef4d9e7d3fd4ee3a8066248806b8

Download Submit
C:\Windows\System\vdCCXcF.exe

Filesize
1.7MB

MD5
7a0fc6e9935a68a73920b37093afe67b

SHA1
f8fbf8080404614eb09cc2930b40eb10346d2cd2

SHA256
98d37a9d065e2de5416e6ba9b5713b868baaf5a75c5c96a57c986208f04aefff

SHA512
c2df4dc5f919fb5e8965b8fab450cee5cf705649dc1e30f561a73a5a791d19994e00da7b279c6125fcd6b92f9c696fd7c0da652431b32125fc953c1504d06d12

Download Submit
C:\Windows\System\vhfMflu.exe

Filesize
1.7MB

MD5
4d8417ec35e7d6002e976c5fe3120adb

SHA1
79a95c84cd83f994574f39aa8273657341ba3d5d

SHA256
417d2529c1f7f5b1416eb59efd2dee8673489e43b9d776c7e666e6bccd67d319

SHA512
f45c2eba6109670dcb585c29bbb35deb9cf95af7884ef779824b6bbe40371bdcdfbcaa860eb0bd90aa825b0e7c3e3439bd34ad809fdd8de084d00b47425376be

Download Submit
C:\Windows\System\vtaAvEk.exe

Filesize
1.7MB

MD5
2ab0dafff0fa8bf08a0f5a566f0cf2c2

SHA1
6195a5cae844c969a44e77874f613ef0a05f1b0d

SHA256
9a437065f010b2bc0dfa28db84c13118f11204902f38eb44a43661a6717b36e7

SHA512
7f2a6b76aaa58b70f765cc1a7fc4d69281a593fa36b5a2cb0d57380a8ce87506032e3857ac54a4030ca65e344b3a368757b9462389a68af00db312aa95ff85cc

Download Submit
C:\Windows\System\xDYXMad.exe

Filesize
1.7MB

MD5
f243f77740c34e92855f3b3f3df3052e

SHA1
7bf472a3d7c39d5a686e01871b8fbdfb449ada8b

SHA256
c444efaaec1bdabeff7031ce02c9b9b47903d6e623e7bd60472539cc9ca135b7

SHA512
38ab6898a92a47461881484bfed9d0b5cd32303b2260205230673505bcc459371ffd1aa9c30e5e33ba80225d24f0454eb841e4c2bc06041f87ebacd39298b4e0

Download Submit
C:\Windows\System\yvTGtoL.exe

Filesize
1.7MB

MD5
c0b705a3e128918783785e841844f56d

SHA1
bbc0172ef118a566eb6929760b1c1523ca89a377

SHA256
5600594f1098e95c398f7bd94e20ee1a7c8786c9c8ec49215998756c58db7032

SHA512
9e83b7343b901db3fea534c3195592ba0dee0af3aceaa3aae3cf62eca63a54afd0c00f08aa031c54281749aba4d09603ede2b5c3b273b1c2640c04b5dab2c4a4

Download Submit
C:\Windows\System\zDvIUiP.exe

Filesize
1.7MB

MD5
4f134665bf52882f08d151e16ca44e9f

SHA1
86ff5ca37245e0b2e67939c11114e5217b46eaf6

SHA256
ee0aa651fd832cfd069f520f3b1f55d9c84a2031e436f6581bdf6aab029b3df3

SHA512
5a43593cec808413c353713b7ab984850bd5146b432a0b8b3f2223126190a27082c9d3fa363fe64e9b32e8f854eadbe6f7c2fc403c8b3a32ce5a22da906b6469

Download Submit
memory/224-4759-0x00007FF7B3A20000-0x00007FF7B3E12000-memory.dmp

Filesize
3.9MB

Download
memory/224-533-0x00007FF7B3A20000-0x00007FF7B3E12000-memory.dmp

Filesize
3.9MB

Download
memory/316-4699-0x00007FF6E0FA0000-0x00007FF6E1392000-memory.dmp

Filesize
3.9MB

Download
memory/316-195-0x00007FF6E0FA0000-0x00007FF6E1392000-memory.dmp

Filesize
3.9MB

Download
memory/460-12-0x00007FF79BB30000-0x00007FF79BF22000-memory.dmp

Filesize
3.9MB

Download
memory/888-199-0x00007FF656590000-0x00007FF656982000-memory.dmp

Filesize
3.9MB

Download
memory/888-4694-0x00007FF656590000-0x00007FF656982000-memory.dmp

Filesize
3.9MB

Download
memory/928-327-0x00007FF6DA410000-0x00007FF6DA802000-memory.dmp

Filesize
3.9MB

Download
memory/928-4749-0x00007FF6DA410000-0x00007FF6DA802000-memory.dmp

Filesize
3.9MB

Download
memory/1220-4788-0x00007FF7BADF0000-0x00007FF7BB1E2000-memory.dmp

Filesize
3.9MB

Download
memory/1220-781-0x00007FF7BADF0000-0x00007FF7BB1E2000-memory.dmp

Filesize
3.9MB

Download
memory/1612-272-0x00007FF6EC690000-0x00007FF6ECA82000-memory.dmp

Filesize
3.9MB

Download
memory/1824-1079-0x00007FF69A7F0000-0x00007FF69ABE2000-memory.dmp

Filesize
3.9MB

Download
memory/1824-4782-0x00007FF69A7F0000-0x00007FF69ABE2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-326-0x00007FF7C4DD0000-0x00007FF7C51C2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-4766-0x00007FF7C4DD0000-0x00007FF7C51C2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-4754-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-242-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp

Filesize
3.9MB

Download
memory/3232-1-0x000001CB2DC60000-0x000001CB2DC70000-memory.dmp

Filesize
64KB

Download
memory/3232-0-0x00007FF656BC0000-0x00007FF656FB2000-memory.dmp

Filesize
3.9MB

Download
memory/3316-160-0x00007FF6D7E30000-0x00007FF6D8222000-memory.dmp

Filesize
3.9MB

Download
memory/3668-4709-0x00007FF6C47F0000-0x00007FF6C4BE2000-memory.dmp

Filesize
3.9MB

Download
memory/3668-431-0x00007FF6C47F0000-0x00007FF6C4BE2000-memory.dmp

Filesize
3.9MB

Download
memory/3716-13-0x00007FFD832C3000-0x00007FFD832C5000-memory.dmp

Filesize
8KB

Download
memory/3716-127-0x00007FFD832C0000-0x00007FFD83D81000-memory.dmp

Filesize
10.8MB

Download
memory/3716-118-0x000001A0ACA30000-0x000001A0ACA52000-memory.dmp

Filesize
136KB

Download
memory/3716-62-0x00007FFD832C0000-0x00007FFD83D81000-memory.dmp

Filesize
10.8MB

Download
memory/4016-4735-0x00007FF724090000-0x00007FF724482000-memory.dmp

Filesize
3.9MB

Download
memory/4016-975-0x00007FF724090000-0x00007FF724482000-memory.dmp

Filesize
3.9MB

Download
memory/4296-4763-0x00007FF7D1360000-0x00007FF7D1752000-memory.dmp

Filesize
3.9MB

Download
memory/4296-656-0x00007FF7D1360000-0x00007FF7D1752000-memory.dmp

Filesize
3.9MB

Download
memory/4528-1510-0x00007FF6EB980000-0x00007FF6EBD72000-memory.dmp

Filesize
3.9MB

Download
memory/4984-4740-0x00007FF63DA40000-0x00007FF63DE32000-memory.dmp

Filesize
3.9MB

Download
memory/4984-1078-0x00007FF63DA40000-0x00007FF63DE32000-memory.dmp

Filesize
3.9MB

Download