xmrig | 6053a566f1001c059a31b7ab3c8e846e62d0b01cf808d0bda410891398a07f38

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
Size 1.7MB
Sample240603-nlw53seb59
SHA256 6053a566f1001c059a31b7ab3c8e846e62d0b01cf808d0bda410891398a07f38
MD5 a1d0fc14c24ce5034f4d121039f88f60
SHA1 a297dba0fc4facc1af573623a450c28c7b49b9ae
SHA512 181689a13d6e8d9f71d8fafa20c32b5b0a94b771567ce44768ad964f2d89a6233fd102f7b554affe6d6558844304e0ea7d9cd330a2b537656f4192db6bbfbe15
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qm:Lz071uv4BPMkHC0I6Gz3N1pHP771Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/760-160-0x00007FF7A0A80000-0x00007FF7A0E72000-memory.dmp	xmrig
behavioral2/memory/3900-124-0x00007FF7AFEC0000-0x00007FF7B02B2000-memory.dmp	xmrig
behavioral2/memory/3000-355-0x00007FF741D40000-0x00007FF742132000-memory.dmp	xmrig
behavioral2/memory/2128-421-0x00007FF753230000-0x00007FF753622000-memory.dmp	xmrig
behavioral2/memory/1276-475-0x00007FF7EBEE0000-0x00007FF7EC2D2000-memory.dmp	xmrig
behavioral2/memory/1412-478-0x00007FF6CA530000-0x00007FF6CA922000-memory.dmp	xmrig
behavioral2/memory/3120-480-0x00007FF7EC5F0000-0x00007FF7EC9E2000-memory.dmp	xmrig
behavioral2/memory/2764-483-0x00007FF63F150000-0x00007FF63F542000-memory.dmp	xmrig
behavioral2/memory/4968-485-0x00007FF7F8A50000-0x00007FF7F8E42000-memory.dmp	xmrig
behavioral2/memory/4820-717-0x00007FF65EBC0000-0x00007FF65EFB2000-memory.dmp	xmrig
behavioral2/memory/3076-793-0x00007FF640B00000-0x00007FF640EF2000-memory.dmp	xmrig
behavioral2/memory/2848-679-0x00007FF6D4FF0000-0x00007FF6D53E2000-memory.dmp	xmrig
behavioral2/memory/4652-637-0x00007FF74D460000-0x00007FF74D852000-memory.dmp	xmrig
behavioral2/memory/3948-601-0x00007FF6018E0000-0x00007FF601CD2000-memory.dmp	xmrig
behavioral2/memory/4912-592-0x00007FF7F1710000-0x00007FF7F1B02000-memory.dmp	xmrig
behavioral2/memory/3156-484-0x00007FF76B710000-0x00007FF76BB02000-memory.dmp	xmrig
behavioral2/memory/1620-482-0x00007FF7E8B20000-0x00007FF7E8F12000-memory.dmp	xmrig
behavioral2/memory/1988-481-0x00007FF71DEB0000-0x00007FF71E2A2000-memory.dmp	xmrig
behavioral2/memory/2852-479-0x00007FF64DDC0000-0x00007FF64E1B2000-memory.dmp	xmrig
behavioral2/memory/2736-477-0x00007FF7516B0000-0x00007FF751AA2000-memory.dmp	xmrig
behavioral2/memory/2820-476-0x00007FF664570000-0x00007FF664962000-memory.dmp	xmrig
behavioral2/memory/4484-474-0x00007FF71DE80000-0x00007FF71E272000-memory.dmp	xmrig
behavioral2/memory/1680-272-0x00007FF7C0F70000-0x00007FF7C1362000-memory.dmp	xmrig
behavioral2/memory/1848-210-0x00007FF67A470000-0x00007FF67A862000-memory.dmp	xmrig
behavioral2/memory/3000-4106-0x00007FF741D40000-0x00007FF742132000-memory.dmp	xmrig
behavioral2/memory/2820-4124-0x00007FF664570000-0x00007FF664962000-memory.dmp	xmrig
behavioral2/memory/2128-4136-0x00007FF753230000-0x00007FF753622000-memory.dmp	xmrig
behavioral2/memory/2736-4140-0x00007FF7516B0000-0x00007FF751AA2000-memory.dmp	xmrig
behavioral2/memory/4820-4152-0x00007FF65EBC0000-0x00007FF65EFB2000-memory.dmp	xmrig
behavioral2/memory/1412-4165-0x00007FF6CA530000-0x00007FF6CA922000-memory.dmp	xmrig
behavioral2/memory/3948-4195-0x00007FF6018E0000-0x00007FF601CD2000-memory.dmp	xmrig
behavioral2/memory/2764-4188-0x00007FF63F150000-0x00007FF63F542000-memory.dmp	xmrig
behavioral2/memory/1620-4177-0x00007FF7E8B20000-0x00007FF7E8F12000-memory.dmp	xmrig
behavioral2/memory/3120-4173-0x00007FF7EC5F0000-0x00007FF7EC9E2000-memory.dmp	xmrig
behavioral2/memory/1988-4170-0x00007FF71DEB0000-0x00007FF71E2A2000-memory.dmp	xmrig
behavioral2/memory/4484-4145-0x00007FF71DE80000-0x00007FF71E272000-memory.dmp	xmrig
behavioral2/memory/2852-4156-0x00007FF64DDC0000-0x00007FF64E1B2000-memory.dmp	xmrig
behavioral2/memory/3076-4203-0x00007FF640B00000-0x00007FF640EF2000-memory.dmp	xmrig
behavioral2/memory/2848-4307-0x00007FF6D4FF0000-0x00007FF6D53E2000-memory.dmp	xmrig
behavioral2/memory/4912-4292-0x00007FF7F1710000-0x00007FF7F1B02000-memory.dmp	xmrig
behavioral2/memory/4968-4288-0x00007FF7F8A50000-0x00007FF7F8E42000-memory.dmp	xmrig
behavioral2/memory/4652-4293-0x00007FF74D460000-0x00007FF74D852000-memory.dmp	xmrig
behavioral2/memory/3156-4278-0x00007FF76B710000-0x00007FF76BB02000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5064	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3900	wVKDCuw.exe
760	ObclgZh.exe
1848	bwxWzUt.exe
1680	AYpqtYp.exe
3000	VMNaRAT.exe
2128	DkdQoHJ.exe
4484	FerEafY.exe
1276	COxrDWv.exe
2820	rtFGLtG.exe
2736	ErHDlgr.exe
1412	hUwvYHD.exe
3076	XcLViSn.exe
2852	jtxrxoT.exe
3120	LctOpZo.exe
1988	kyyIfDx.exe
1620	DSqzOsG.exe
2764	xFGjsft.exe
3156	SovYyUa.exe
4968	dXDeAzv.exe
4912	LpBUOJa.exe
3948	BAbpcxz.exe
4652	Muwueiq.exe
2848	IyvSdgf.exe
4820	FyPmrxp.exe
4676	LzGJsqB.exe
3200	FVapZpV.exe
4692	tkoXZyN.exe
1064	FofticC.exe
1532	RredidN.exe
2860	kJPPyjn.exe
948	pLlXOIY.exe
3160	PJPPwVW.exe
4680	ugVIiaI.exe
3812	CMmTKjM.exe
2264	cvFlqxy.exe
2968	AQjIrDy.exe
1424	eMdqHHu.exe
2744	SNCVbDX.exe
1380	thfNihg.exe
2064	KXXlpsO.exe
5020	CVykZtl.exe
4780	cSKSZwg.exe
4992	kRdJwWV.exe
1648	qZCMbCT.exe
3408	IdQnJts.exe
2440	LloQdZi.exe
4488	hEwOUTU.exe
1840	rNlwSyp.exe
1612	LBCVJWC.exe
4232	CNJcTaN.exe
2004	gzUePVL.exe
4616	baGkrhr.exe
1876	jWpIaBi.exe
376	BjoaEzE.exe
532	jlCHqKf.exe
464	cAkFwrP.exe
548	sUlLeZj.exe
4824	cqozRRq.exe
1240	NPmTLAE.exe
116	BLclwPA.exe
224	fiRLDOc.exe
2928	Rwkgmsf.exe
1552	KGFdVpN.exe
1976	vPvMirM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4976-0-0x00007FF78B4C0000-0x00007FF78B8B2000-memory.dmp	upx
behavioral2/files/0x000c000000023370-5.dat	upx
behavioral2/files/0x00070000000233f6-9.dat	upx
behavioral2/files/0x00070000000233f8-27.dat	upx
behavioral2/files/0x00070000000233ff-163.dat	upx
behavioral2/memory/760-160-0x00007FF7A0A80000-0x00007FF7A0E72000-memory.dmp	upx
behavioral2/memory/3900-124-0x00007FF7AFEC0000-0x00007FF7B02B2000-memory.dmp	upx
behavioral2/files/0x000700000002340c-123.dat	upx
behavioral2/files/0x000700000002340b-121.dat	upx
behavioral2/files/0x000700000002340a-120.dat	upx
behavioral2/files/0x0007000000023409-119.dat	upx
behavioral2/files/0x0007000000023408-118.dat	upx
behavioral2/files/0x0007000000023406-115.dat	upx
behavioral2/files/0x00070000000233fa-109.dat	upx
behavioral2/files/0x00070000000233fd-100.dat	upx
behavioral2/files/0x0007000000023403-99.dat	upx
behavioral2/files/0x0007000000023402-96.dat	upx
behavioral2/files/0x0007000000023414-140.dat	upx
behavioral2/files/0x0007000000023401-95.dat	upx
behavioral2/files/0x0007000000023400-88.dat	upx
behavioral2/files/0x00070000000233fc-83.dat	upx
behavioral2/files/0x000700000002340d-126.dat	upx
behavioral2/files/0x00070000000233fb-73.dat	upx
behavioral2/files/0x0007000000023407-117.dat	upx
behavioral2/files/0x0007000000023405-114.dat	upx
behavioral2/files/0x00070000000233f7-56.dat	upx
behavioral2/files/0x00070000000233f9-51.dat	upx
behavioral2/memory/3000-355-0x00007FF741D40000-0x00007FF742132000-memory.dmp	upx
behavioral2/memory/2128-421-0x00007FF753230000-0x00007FF753622000-memory.dmp	upx
behavioral2/memory/1276-475-0x00007FF7EBEE0000-0x00007FF7EC2D2000-memory.dmp	upx
behavioral2/memory/1412-478-0x00007FF6CA530000-0x00007FF6CA922000-memory.dmp	upx
behavioral2/memory/3120-480-0x00007FF7EC5F0000-0x00007FF7EC9E2000-memory.dmp	upx
behavioral2/memory/2764-483-0x00007FF63F150000-0x00007FF63F542000-memory.dmp	upx
behavioral2/memory/4968-485-0x00007FF7F8A50000-0x00007FF7F8E42000-memory.dmp	upx
behavioral2/memory/4820-717-0x00007FF65EBC0000-0x00007FF65EFB2000-memory.dmp	upx
behavioral2/memory/3076-793-0x00007FF640B00000-0x00007FF640EF2000-memory.dmp	upx
behavioral2/memory/2848-679-0x00007FF6D4FF0000-0x00007FF6D53E2000-memory.dmp	upx
behavioral2/memory/4652-637-0x00007FF74D460000-0x00007FF74D852000-memory.dmp	upx
behavioral2/memory/3948-601-0x00007FF6018E0000-0x00007FF601CD2000-memory.dmp	upx
behavioral2/memory/4912-592-0x00007FF7F1710000-0x00007FF7F1B02000-memory.dmp	upx
behavioral2/memory/3156-484-0x00007FF76B710000-0x00007FF76BB02000-memory.dmp	upx
behavioral2/memory/1620-482-0x00007FF7E8B20000-0x00007FF7E8F12000-memory.dmp	upx
behavioral2/memory/1988-481-0x00007FF71DEB0000-0x00007FF71E2A2000-memory.dmp	upx
behavioral2/memory/2852-479-0x00007FF64DDC0000-0x00007FF64E1B2000-memory.dmp	upx
behavioral2/memory/2736-477-0x00007FF7516B0000-0x00007FF751AA2000-memory.dmp	upx
behavioral2/memory/2820-476-0x00007FF664570000-0x00007FF664962000-memory.dmp	upx
behavioral2/memory/4484-474-0x00007FF71DE80000-0x00007FF71E272000-memory.dmp	upx
behavioral2/memory/1680-272-0x00007FF7C0F70000-0x00007FF7C1362000-memory.dmp	upx
behavioral2/memory/1848-210-0x00007FF67A470000-0x00007FF67A862000-memory.dmp	upx
behavioral2/files/0x000700000002341d-190.dat	upx
behavioral2/files/0x000700000002341c-186.dat	upx
behavioral2/files/0x00090000000233f2-185.dat	upx
behavioral2/files/0x000700000002341a-168.dat	upx
behavioral2/files/0x0007000000023419-167.dat	upx
behavioral2/files/0x000700000002341e-198.dat	upx
behavioral2/files/0x00070000000233fe-146.dat	upx
behavioral2/files/0x0007000000023418-145.dat	upx
behavioral2/files/0x0007000000023417-144.dat	upx
behavioral2/files/0x0007000000023404-143.dat	upx
behavioral2/files/0x0007000000023416-142.dat	upx
behavioral2/files/0x0007000000023415-141.dat	upx
behavioral2/files/0x0007000000023413-139.dat	upx
behavioral2/files/0x0007000000023412-137.dat	upx
behavioral2/files/0x0007000000023411-136.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dUDooxm.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\WEiBNCt.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\YqqlIsi.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\KvhQLhR.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\fOAwpLP.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\kLlgpzG.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\hTxEOoq.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\HyUGinh.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\UIThYTi.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\znXflCy.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\LYFOtEJ.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\ocgYLnR.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\owvqhcl.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\ITuvWBK.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\rOtBLlt.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\hXlvAvn.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\GWdeZWV.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\QPkCXGn.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\KcmaQPo.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\nlxgoDP.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\AIvbJob.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\itDiadn.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\uwTMZtv.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\rKwELRo.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\JWylXRz.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\lfAKVGK.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\CaifgGK.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\GtGFCuE.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\DuVrNTN.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\dWHNxzP.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\MzLjPlS.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\EbAPPBH.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\BBhsziB.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\nWrHdSE.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\ccQFDBC.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\dKWjHpt.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\KHDXPnM.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\MXBlmPC.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\CNEfXrj.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\cuUKfvQ.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\sNwSdtJ.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\MhJeSBP.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\mKQiYeF.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\MUlTxDe.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\UNhsnYC.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\KwhtcZI.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\VnFBVcJ.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\VHpiBAq.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\lvzZAHa.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\YRLybmk.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\FKlmKrL.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\HAUGiCb.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\lrOJdKb.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\qQaaEtc.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\kVYfJZT.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\pWwJAmV.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\RJXDtgS.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\NVBRLZe.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\TgePPwQ.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\sqrvsQc.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\lMUjbFC.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\jVHaUqX.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\nkCvWkT.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
File created	C:\Windows\System\WpOVzvv.exe	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5064	powershell.exe
5064	powershell.exe
5064	powershell.exe
5064	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
Token: SeDebugPrivilege	5064	powershell.exe
Token: SeLockMemoryPrivilege	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
Token: SeCreateGlobalPrivilege	13472	dwm.exe
Token: SeChangeNotifyPrivilege	13472	dwm.exe
Token: 33	13472	dwm.exe
Token: SeIncBasePriorityPrivilege	13472	dwm.exe
Token: SeCreateGlobalPrivilege	13984	dwm.exe
Token: SeChangeNotifyPrivilege	13984	dwm.exe
Token: 33	13984	dwm.exe
Token: SeIncBasePriorityPrivilege	13984	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 5064	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	83
PID 4976 wrote to memory of 5064	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	83
PID 4976 wrote to memory of 3900	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	84
PID 4976 wrote to memory of 3900	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	84
PID 4976 wrote to memory of 760	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	85
PID 4976 wrote to memory of 760	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	85
PID 4976 wrote to memory of 1848	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	86
PID 4976 wrote to memory of 1848	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	86
PID 4976 wrote to memory of 1680	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	87
PID 4976 wrote to memory of 1680	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	87
PID 4976 wrote to memory of 3000	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	88
PID 4976 wrote to memory of 3000	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	88
PID 4976 wrote to memory of 2128	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	89
PID 4976 wrote to memory of 2128	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	89
PID 4976 wrote to memory of 4484	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	90
PID 4976 wrote to memory of 4484	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	90
PID 4976 wrote to memory of 1276	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	91
PID 4976 wrote to memory of 1276	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	91
PID 4976 wrote to memory of 2820	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	92
PID 4976 wrote to memory of 2820	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	92
PID 4976 wrote to memory of 2736	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	93
PID 4976 wrote to memory of 2736	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	93
PID 4976 wrote to memory of 1412	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	94
PID 4976 wrote to memory of 1412	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	94
PID 4976 wrote to memory of 3076	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	95
PID 4976 wrote to memory of 3076	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	95
PID 4976 wrote to memory of 2852	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	96
PID 4976 wrote to memory of 2852	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	96
PID 4976 wrote to memory of 3120	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	97
PID 4976 wrote to memory of 3120	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	97
PID 4976 wrote to memory of 1988	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	98
PID 4976 wrote to memory of 1988	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	98
PID 4976 wrote to memory of 1620	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	99
PID 4976 wrote to memory of 1620	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	99
PID 4976 wrote to memory of 2264	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	100
PID 4976 wrote to memory of 2264	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	100
PID 4976 wrote to memory of 2764	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	101
PID 4976 wrote to memory of 2764	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	101
PID 4976 wrote to memory of 3156	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	102
PID 4976 wrote to memory of 3156	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	102
PID 4976 wrote to memory of 4968	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	103
PID 4976 wrote to memory of 4968	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	103
PID 4976 wrote to memory of 4912	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	104
PID 4976 wrote to memory of 4912	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	104
PID 4976 wrote to memory of 3948	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	105
PID 4976 wrote to memory of 3948	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	105
PID 4976 wrote to memory of 4652	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	106
PID 4976 wrote to memory of 4652	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	106
PID 4976 wrote to memory of 2848	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	107
PID 4976 wrote to memory of 2848	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	107
PID 4976 wrote to memory of 4820	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	108
PID 4976 wrote to memory of 4820	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	108
PID 4976 wrote to memory of 4676	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	109
PID 4976 wrote to memory of 4676	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	109
PID 4976 wrote to memory of 3200	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	110
PID 4976 wrote to memory of 3200	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	110
PID 4976 wrote to memory of 4692	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	111
PID 4976 wrote to memory of 4692	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	111
PID 4976 wrote to memory of 1064	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	112
PID 4976 wrote to memory of 1064	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	112
PID 4976 wrote to memory of 1532	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	113
PID 4976 wrote to memory of 1532	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	113
PID 4976 wrote to memory of 2860	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	114
PID 4976 wrote to memory of 2860	4976	a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a1d0fc14c24ce5034f4d121039f88f60_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Windows\System\wVKDCuw.exe
  C:\Windows\System\wVKDCuw.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\ObclgZh.exe
  C:\Windows\System\ObclgZh.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\bwxWzUt.exe
  C:\Windows\System\bwxWzUt.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\AYpqtYp.exe
  C:\Windows\System\AYpqtYp.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\VMNaRAT.exe
  C:\Windows\System\VMNaRAT.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\DkdQoHJ.exe
  C:\Windows\System\DkdQoHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\FerEafY.exe
  C:\Windows\System\FerEafY.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\COxrDWv.exe
  C:\Windows\System\COxrDWv.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\rtFGLtG.exe
  C:\Windows\System\rtFGLtG.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\ErHDlgr.exe
  C:\Windows\System\ErHDlgr.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\hUwvYHD.exe
  C:\Windows\System\hUwvYHD.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\XcLViSn.exe
  C:\Windows\System\XcLViSn.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\jtxrxoT.exe
  C:\Windows\System\jtxrxoT.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\LctOpZo.exe
  C:\Windows\System\LctOpZo.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\kyyIfDx.exe
  C:\Windows\System\kyyIfDx.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\DSqzOsG.exe
  C:\Windows\System\DSqzOsG.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\cvFlqxy.exe
  C:\Windows\System\cvFlqxy.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\xFGjsft.exe
  C:\Windows\System\xFGjsft.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\SovYyUa.exe
  C:\Windows\System\SovYyUa.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\dXDeAzv.exe
  C:\Windows\System\dXDeAzv.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\LpBUOJa.exe
  C:\Windows\System\LpBUOJa.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\BAbpcxz.exe
  C:\Windows\System\BAbpcxz.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\Muwueiq.exe
  C:\Windows\System\Muwueiq.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\IyvSdgf.exe
  C:\Windows\System\IyvSdgf.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\FyPmrxp.exe
  C:\Windows\System\FyPmrxp.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\LzGJsqB.exe
  C:\Windows\System\LzGJsqB.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\FVapZpV.exe
  C:\Windows\System\FVapZpV.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\tkoXZyN.exe
  C:\Windows\System\tkoXZyN.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\FofticC.exe
  C:\Windows\System\FofticC.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\RredidN.exe
  C:\Windows\System\RredidN.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\kJPPyjn.exe
  C:\Windows\System\kJPPyjn.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\pLlXOIY.exe
  C:\Windows\System\pLlXOIY.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\PJPPwVW.exe
  C:\Windows\System\PJPPwVW.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\ugVIiaI.exe
  C:\Windows\System\ugVIiaI.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\CMmTKjM.exe
  C:\Windows\System\CMmTKjM.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\AQjIrDy.exe
  C:\Windows\System\AQjIrDy.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\eMdqHHu.exe
  C:\Windows\System\eMdqHHu.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\SNCVbDX.exe
  C:\Windows\System\SNCVbDX.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\thfNihg.exe
  C:\Windows\System\thfNihg.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\KXXlpsO.exe
  C:\Windows\System\KXXlpsO.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\CVykZtl.exe
  C:\Windows\System\CVykZtl.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\cSKSZwg.exe
  C:\Windows\System\cSKSZwg.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\kRdJwWV.exe
  C:\Windows\System\kRdJwWV.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\qZCMbCT.exe
  C:\Windows\System\qZCMbCT.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\IdQnJts.exe
  C:\Windows\System\IdQnJts.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\LloQdZi.exe
  C:\Windows\System\LloQdZi.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\hEwOUTU.exe
  C:\Windows\System\hEwOUTU.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\rNlwSyp.exe
  C:\Windows\System\rNlwSyp.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\LBCVJWC.exe
  C:\Windows\System\LBCVJWC.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\CNJcTaN.exe
  C:\Windows\System\CNJcTaN.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\gzUePVL.exe
  C:\Windows\System\gzUePVL.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\baGkrhr.exe
  C:\Windows\System\baGkrhr.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\jWpIaBi.exe
  C:\Windows\System\jWpIaBi.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\BjoaEzE.exe
  C:\Windows\System\BjoaEzE.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\jlCHqKf.exe
  C:\Windows\System\jlCHqKf.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\cAkFwrP.exe
  C:\Windows\System\cAkFwrP.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\sUlLeZj.exe
  C:\Windows\System\sUlLeZj.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\cqozRRq.exe
  C:\Windows\System\cqozRRq.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\NPmTLAE.exe
  C:\Windows\System\NPmTLAE.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\BLclwPA.exe
  C:\Windows\System\BLclwPA.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\fiRLDOc.exe
  C:\Windows\System\fiRLDOc.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\Rwkgmsf.exe
  C:\Windows\System\Rwkgmsf.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\KGFdVpN.exe
  C:\Windows\System\KGFdVpN.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\vPvMirM.exe
  C:\Windows\System\vPvMirM.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\MOFwwZp.exe
  C:\Windows\System\MOFwwZp.exe
  2⤵
  PID:1084
- C:\Windows\System\EbQvqSa.exe
  C:\Windows\System\EbQvqSa.exe
  2⤵
  PID:4740
- C:\Windows\System\wQNizNe.exe
  C:\Windows\System\wQNizNe.exe
  2⤵
  PID:4604
- C:\Windows\System\SaxmTGQ.exe
  C:\Windows\System\SaxmTGQ.exe
  2⤵
  PID:5084
- C:\Windows\System\lDNoLQV.exe
  C:\Windows\System\lDNoLQV.exe
  2⤵
  PID:4908
- C:\Windows\System\vApexwr.exe
  C:\Windows\System\vApexwr.exe
  2⤵
  PID:1740
- C:\Windows\System\mKXesTZ.exe
  C:\Windows\System\mKXesTZ.exe
  2⤵
  PID:3464
- C:\Windows\System\OGeAjzS.exe
  C:\Windows\System\OGeAjzS.exe
  2⤵
  PID:4844
- C:\Windows\System\HRSsKmL.exe
  C:\Windows\System\HRSsKmL.exe
  2⤵
  PID:4980
- C:\Windows\System\vTrBYEn.exe
  C:\Windows\System\vTrBYEn.exe
  2⤵
  PID:2864
- C:\Windows\System\Ubquqmk.exe
  C:\Windows\System\Ubquqmk.exe
  2⤵
  PID:4816
- C:\Windows\System\XYGjluM.exe
  C:\Windows\System\XYGjluM.exe
  2⤵
  PID:2804
- C:\Windows\System\YlhPQNw.exe
  C:\Windows\System\YlhPQNw.exe
  2⤵
  PID:1676
- C:\Windows\System\iyNlVAa.exe
  C:\Windows\System\iyNlVAa.exe
  2⤵
  PID:5036
- C:\Windows\System\SjamTas.exe
  C:\Windows\System\SjamTas.exe
  2⤵
  PID:1580
- C:\Windows\System\CKXlHQe.exe
  C:\Windows\System\CKXlHQe.exe
  2⤵
  PID:4552
- C:\Windows\System\ygCroeR.exe
  C:\Windows\System\ygCroeR.exe
  2⤵
  PID:5072
- C:\Windows\System\XbRWClF.exe
  C:\Windows\System\XbRWClF.exe
  2⤵
  PID:392
- C:\Windows\System\ZUUdsQY.exe
  C:\Windows\System\ZUUdsQY.exe
  2⤵
  PID:3344
- C:\Windows\System\kKPtHRD.exe
  C:\Windows\System\kKPtHRD.exe
  2⤵
  PID:4892
- C:\Windows\System\uprseBG.exe
  C:\Windows\System\uprseBG.exe
  2⤵
  PID:5124
- C:\Windows\System\EedkQIQ.exe
  C:\Windows\System\EedkQIQ.exe
  2⤵
  PID:5144
- C:\Windows\System\kaamYEX.exe
  C:\Windows\System\kaamYEX.exe
  2⤵
  PID:5168
- C:\Windows\System\LzrmiNR.exe
  C:\Windows\System\LzrmiNR.exe
  2⤵
  PID:5188
- C:\Windows\System\ZLDEiVu.exe
  C:\Windows\System\ZLDEiVu.exe
  2⤵
  PID:5208
- C:\Windows\System\yVuEwTh.exe
  C:\Windows\System\yVuEwTh.exe
  2⤵
  PID:5232
- C:\Windows\System\NHYZkqz.exe
  C:\Windows\System\NHYZkqz.exe
  2⤵
  PID:5256
- C:\Windows\System\cZSsCdl.exe
  C:\Windows\System\cZSsCdl.exe
  2⤵
  PID:5276
- C:\Windows\System\hCmdZFi.exe
  C:\Windows\System\hCmdZFi.exe
  2⤵
  PID:5312
- C:\Windows\System\peNOjnq.exe
  C:\Windows\System\peNOjnq.exe
  2⤵
  PID:5348
- C:\Windows\System\qmBnOIF.exe
  C:\Windows\System\qmBnOIF.exe
  2⤵
  PID:5372
- C:\Windows\System\HgHDGIO.exe
  C:\Windows\System\HgHDGIO.exe
  2⤵
  PID:5388
- C:\Windows\System\OyooWJK.exe
  C:\Windows\System\OyooWJK.exe
  2⤵
  PID:5408
- C:\Windows\System\RqVRVyu.exe
  C:\Windows\System\RqVRVyu.exe
  2⤵
  PID:5432
- C:\Windows\System\oGecLbC.exe
  C:\Windows\System\oGecLbC.exe
  2⤵
  PID:5488
- C:\Windows\System\aiZteuE.exe
  C:\Windows\System\aiZteuE.exe
  2⤵
  PID:5516
- C:\Windows\System\hjCgYEa.exe
  C:\Windows\System\hjCgYEa.exe
  2⤵
  PID:5544
- C:\Windows\System\WBAgNet.exe
  C:\Windows\System\WBAgNet.exe
  2⤵
  PID:5572
- C:\Windows\System\rnfKPEe.exe
  C:\Windows\System\rnfKPEe.exe
  2⤵
  PID:5588
- C:\Windows\System\LpYjDfy.exe
  C:\Windows\System\LpYjDfy.exe
  2⤵
  PID:5608
- C:\Windows\System\cNjueqn.exe
  C:\Windows\System\cNjueqn.exe
  2⤵
  PID:5628
- C:\Windows\System\thfQbUZ.exe
  C:\Windows\System\thfQbUZ.exe
  2⤵
  PID:5648
- C:\Windows\System\GwQIyJx.exe
  C:\Windows\System\GwQIyJx.exe
  2⤵
  PID:5672
- C:\Windows\System\wdOZBVW.exe
  C:\Windows\System\wdOZBVW.exe
  2⤵
  PID:5688
- C:\Windows\System\qPUNyYe.exe
  C:\Windows\System\qPUNyYe.exe
  2⤵
  PID:5712
- C:\Windows\System\kywzIkQ.exe
  C:\Windows\System\kywzIkQ.exe
  2⤵
  PID:5728
- C:\Windows\System\kBeZqEf.exe
  C:\Windows\System\kBeZqEf.exe
  2⤵
  PID:5752
- C:\Windows\System\VpHtPPc.exe
  C:\Windows\System\VpHtPPc.exe
  2⤵
  PID:5776
- C:\Windows\System\CqBgXIh.exe
  C:\Windows\System\CqBgXIh.exe
  2⤵
  PID:5792
- C:\Windows\System\cBElvOu.exe
  C:\Windows\System\cBElvOu.exe
  2⤵
  PID:5808
- C:\Windows\System\zhQiure.exe
  C:\Windows\System\zhQiure.exe
  2⤵
  PID:5828
- C:\Windows\System\BaERgsO.exe
  C:\Windows\System\BaERgsO.exe
  2⤵
  PID:5848
- C:\Windows\System\IWDFKFt.exe
  C:\Windows\System\IWDFKFt.exe
  2⤵
  PID:5868
- C:\Windows\System\kuQKBAg.exe
  C:\Windows\System\kuQKBAg.exe
  2⤵
  PID:5892
- C:\Windows\System\VXxLbIZ.exe
  C:\Windows\System\VXxLbIZ.exe
  2⤵
  PID:5908
- C:\Windows\System\UonLzHS.exe
  C:\Windows\System\UonLzHS.exe
  2⤵
  PID:5928
- C:\Windows\System\KvhQLhR.exe
  C:\Windows\System\KvhQLhR.exe
  2⤵
  PID:5952
- C:\Windows\System\WPdCQLs.exe
  C:\Windows\System\WPdCQLs.exe
  2⤵
  PID:5976
- C:\Windows\System\AtwLdEA.exe
  C:\Windows\System\AtwLdEA.exe
  2⤵
  PID:5992
- C:\Windows\System\CDzIvJK.exe
  C:\Windows\System\CDzIvJK.exe
  2⤵
  PID:6016
- C:\Windows\System\sKjZThc.exe
  C:\Windows\System\sKjZThc.exe
  2⤵
  PID:6036
- C:\Windows\System\dovQNJe.exe
  C:\Windows\System\dovQNJe.exe
  2⤵
  PID:6056
- C:\Windows\System\LDFCZIm.exe
  C:\Windows\System\LDFCZIm.exe
  2⤵
  PID:6080
- C:\Windows\System\MMbwhjy.exe
  C:\Windows\System\MMbwhjy.exe
  2⤵
  PID:6104
- C:\Windows\System\DhJKPHh.exe
  C:\Windows\System\DhJKPHh.exe
  2⤵
  PID:4296
- C:\Windows\System\gSvewRk.exe
  C:\Windows\System\gSvewRk.exe
  2⤵
  PID:1952
- C:\Windows\System\vIsKWQU.exe
  C:\Windows\System\vIsKWQU.exe
  2⤵
  PID:1808
- C:\Windows\System\sFGYLvS.exe
  C:\Windows\System\sFGYLvS.exe
  2⤵
  PID:3252
- C:\Windows\System\HGbCoWU.exe
  C:\Windows\System\HGbCoWU.exe
  2⤵
  PID:2692
- C:\Windows\System\eodWXIc.exe
  C:\Windows\System\eodWXIc.exe
  2⤵
  PID:4124
- C:\Windows\System\aWnqjBc.exe
  C:\Windows\System\aWnqjBc.exe
  2⤵
  PID:5184
- C:\Windows\System\UCdUcxd.exe
  C:\Windows\System\UCdUcxd.exe
  2⤵
  PID:5272
- C:\Windows\System\HzTRlbX.exe
  C:\Windows\System\HzTRlbX.exe
  2⤵
  PID:5320
- C:\Windows\System\LBmfmEj.exe
  C:\Windows\System\LBmfmEj.exe
  2⤵
  PID:1560
- C:\Windows\System\lJftsvG.exe
  C:\Windows\System\lJftsvG.exe
  2⤵
  PID:4108
- C:\Windows\System\iWerjlY.exe
  C:\Windows\System\iWerjlY.exe
  2⤵
  PID:2336
- C:\Windows\System\nVUnmqe.exe
  C:\Windows\System\nVUnmqe.exe
  2⤵
  PID:2900
- C:\Windows\System\hBCuXCq.exe
  C:\Windows\System\hBCuXCq.exe
  2⤵
  PID:5704
- C:\Windows\System\RFmulBd.exe
  C:\Windows\System\RFmulBd.exe
  2⤵
  PID:5580
- C:\Windows\System\EqmuoWo.exe
  C:\Windows\System\EqmuoWo.exe
  2⤵
  PID:1028
- C:\Windows\System\VJkPWWE.exe
  C:\Windows\System\VJkPWWE.exe
  2⤵
  PID:1596
- C:\Windows\System\upSBwUa.exe
  C:\Windows\System\upSBwUa.exe
  2⤵
  PID:5180
- C:\Windows\System\ZsnnJlX.exe
  C:\Windows\System\ZsnnJlX.exe
  2⤵
  PID:5216
- C:\Windows\System\iigzcuC.exe
  C:\Windows\System\iigzcuC.exe
  2⤵
  PID:5268
- C:\Windows\System\ONWdmFH.exe
  C:\Windows\System\ONWdmFH.exe
  2⤵
  PID:5340
- C:\Windows\System\fOvOmGA.exe
  C:\Windows\System\fOvOmGA.exe
  2⤵
  PID:5960
- C:\Windows\System\wPyREVq.exe
  C:\Windows\System\wPyREVq.exe
  2⤵
  PID:6168
- C:\Windows\System\wUlzuMU.exe
  C:\Windows\System\wUlzuMU.exe
  2⤵
  PID:6192
- C:\Windows\System\IJjzyFV.exe
  C:\Windows\System\IJjzyFV.exe
  2⤵
  PID:6212
- C:\Windows\System\PWNnnBh.exe
  C:\Windows\System\PWNnnBh.exe
  2⤵
  PID:6236
- C:\Windows\System\KsAJLrV.exe
  C:\Windows\System\KsAJLrV.exe
  2⤵
  PID:6252
- C:\Windows\System\zrxGffx.exe
  C:\Windows\System\zrxGffx.exe
  2⤵
  PID:6276
- C:\Windows\System\sAwpjSL.exe
  C:\Windows\System\sAwpjSL.exe
  2⤵
  PID:6292
- C:\Windows\System\TphaZHO.exe
  C:\Windows\System\TphaZHO.exe
  2⤵
  PID:6320
- C:\Windows\System\zHfZTxl.exe
  C:\Windows\System\zHfZTxl.exe
  2⤵
  PID:6468
- C:\Windows\System\vksciIy.exe
  C:\Windows\System\vksciIy.exe
  2⤵
  PID:6708
- C:\Windows\System\qVCgXFh.exe
  C:\Windows\System\qVCgXFh.exe
  2⤵
  PID:6728
- C:\Windows\System\ybfmFbU.exe
  C:\Windows\System\ybfmFbU.exe
  2⤵
  PID:6748
- C:\Windows\System\UfsOcEF.exe
  C:\Windows\System\UfsOcEF.exe
  2⤵
  PID:6768
- C:\Windows\System\feIMqBC.exe
  C:\Windows\System\feIMqBC.exe
  2⤵
  PID:6928
- C:\Windows\System\aRRiRGL.exe
  C:\Windows\System\aRRiRGL.exe
  2⤵
  PID:6944
- C:\Windows\System\xCywcUB.exe
  C:\Windows\System\xCywcUB.exe
  2⤵
  PID:6960
- C:\Windows\System\FXoVpmf.exe
  C:\Windows\System\FXoVpmf.exe
  2⤵
  PID:6980
- C:\Windows\System\VVLaiQd.exe
  C:\Windows\System\VVLaiQd.exe
  2⤵
  PID:7000
- C:\Windows\System\lBpuxqt.exe
  C:\Windows\System\lBpuxqt.exe
  2⤵
  PID:7024
- C:\Windows\System\pSUnVBE.exe
  C:\Windows\System\pSUnVBE.exe
  2⤵
  PID:7044
- C:\Windows\System\BlqrbOd.exe
  C:\Windows\System\BlqrbOd.exe
  2⤵
  PID:7060
- C:\Windows\System\BNmNCYz.exe
  C:\Windows\System\BNmNCYz.exe
  2⤵
  PID:7084
- C:\Windows\System\yEeHWMU.exe
  C:\Windows\System\yEeHWMU.exe
  2⤵
  PID:7104
- C:\Windows\System\xDJjBZm.exe
  C:\Windows\System\xDJjBZm.exe
  2⤵
  PID:7124
- C:\Windows\System\eEtSgdI.exe
  C:\Windows\System\eEtSgdI.exe
  2⤵
  PID:7152
- C:\Windows\System\ecUvwdf.exe
  C:\Windows\System\ecUvwdf.exe
  2⤵
  PID:5984
- C:\Windows\System\cRFhaiv.exe
  C:\Windows\System\cRFhaiv.exe
  2⤵
  PID:6024
- C:\Windows\System\ZrFlSzH.exe
  C:\Windows\System\ZrFlSzH.exe
  2⤵
  PID:6076
- C:\Windows\System\IWjWBXN.exe
  C:\Windows\System\IWjWBXN.exe
  2⤵
  PID:1556
- C:\Windows\System\nzHTlfB.exe
  C:\Windows\System\nzHTlfB.exe
  2⤵
  PID:4472
- C:\Windows\System\bpIaOew.exe
  C:\Windows\System\bpIaOew.exe
  2⤵
  PID:1716
- C:\Windows\System\uawgnbH.exe
  C:\Windows\System\uawgnbH.exe
  2⤵
  PID:2624
- C:\Windows\System\bnJotwa.exe
  C:\Windows\System\bnJotwa.exe
  2⤵
  PID:3708
- C:\Windows\System\SipOFwl.exe
  C:\Windows\System\SipOFwl.exe
  2⤵
  PID:2140
- C:\Windows\System\TUqirkK.exe
  C:\Windows\System\TUqirkK.exe
  2⤵
  PID:1912
- C:\Windows\System\yodmXNr.exe
  C:\Windows\System\yodmXNr.exe
  2⤵
  PID:5596
- C:\Windows\System\EtqLQeM.exe
  C:\Windows\System\EtqLQeM.exe
  2⤵
  PID:5228
- C:\Windows\System\rTyePHC.exe
  C:\Windows\System\rTyePHC.exe
  2⤵
  PID:5384
- C:\Windows\System\nZQfbNZ.exe
  C:\Windows\System\nZQfbNZ.exe
  2⤵
  PID:5416
- C:\Windows\System\iqjfaxr.exe
  C:\Windows\System\iqjfaxr.exe
  2⤵
  PID:5484
- C:\Windows\System\QZmdPfF.exe
  C:\Windows\System\QZmdPfF.exe
  2⤵
  PID:6564
- C:\Windows\System\bEtpVcn.exe
  C:\Windows\System\bEtpVcn.exe
  2⤵
  PID:6724
- C:\Windows\System\CkdaAgn.exe
  C:\Windows\System\CkdaAgn.exe
  2⤵
  PID:6692
- C:\Windows\System\OddtVxG.exe
  C:\Windows\System\OddtVxG.exe
  2⤵
  PID:6664
- C:\Windows\System\bnRqBsX.exe
  C:\Windows\System\bnRqBsX.exe
  2⤵
  PID:6588
- C:\Windows\System\tBTskXH.exe
  C:\Windows\System\tBTskXH.exe
  2⤵
  PID:6008
- C:\Windows\System\vogAEQn.exe
  C:\Windows\System\vogAEQn.exe
  2⤵
  PID:7284
- C:\Windows\System\WatYLAH.exe
  C:\Windows\System\WatYLAH.exe
  2⤵
  PID:7304
- C:\Windows\System\RosTwCa.exe
  C:\Windows\System\RosTwCa.exe
  2⤵
  PID:7324
- C:\Windows\System\voEMoUR.exe
  C:\Windows\System\voEMoUR.exe
  2⤵
  PID:7348
- C:\Windows\System\qqBsXjJ.exe
  C:\Windows\System\qqBsXjJ.exe
  2⤵
  PID:7364
- C:\Windows\System\FeYGQeI.exe
  C:\Windows\System\FeYGQeI.exe
  2⤵
  PID:7380
- C:\Windows\System\vOyUNMh.exe
  C:\Windows\System\vOyUNMh.exe
  2⤵
  PID:7396
- C:\Windows\System\dtCRuju.exe
  C:\Windows\System\dtCRuju.exe
  2⤵
  PID:7412
- C:\Windows\System\MgqnkFs.exe
  C:\Windows\System\MgqnkFs.exe
  2⤵
  PID:7432
- C:\Windows\System\Idjtqbg.exe
  C:\Windows\System\Idjtqbg.exe
  2⤵
  PID:7452
- C:\Windows\System\yQmVsrW.exe
  C:\Windows\System\yQmVsrW.exe
  2⤵
  PID:7476
- C:\Windows\System\HckUgoO.exe
  C:\Windows\System\HckUgoO.exe
  2⤵
  PID:7492
- C:\Windows\System\fIqlvNJ.exe
  C:\Windows\System\fIqlvNJ.exe
  2⤵
  PID:7508
- C:\Windows\System\vdarJIo.exe
  C:\Windows\System\vdarJIo.exe
  2⤵
  PID:7624
- C:\Windows\System\njixSHH.exe
  C:\Windows\System\njixSHH.exe
  2⤵
  PID:7648
- C:\Windows\System\YkRqzqz.exe
  C:\Windows\System\YkRqzqz.exe
  2⤵
  PID:7696
- C:\Windows\System\YvlOGDc.exe
  C:\Windows\System\YvlOGDc.exe
  2⤵
  PID:7716
- C:\Windows\System\lbhVpDS.exe
  C:\Windows\System\lbhVpDS.exe
  2⤵
  PID:7732
- C:\Windows\System\UdmpCNI.exe
  C:\Windows\System\UdmpCNI.exe
  2⤵
  PID:7752
- C:\Windows\System\CFmnanv.exe
  C:\Windows\System\CFmnanv.exe
  2⤵
  PID:7768
- C:\Windows\System\jkQFQAA.exe
  C:\Windows\System\jkQFQAA.exe
  2⤵
  PID:7784
- C:\Windows\System\qKuvqza.exe
  C:\Windows\System\qKuvqza.exe
  2⤵
  PID:7912
- C:\Windows\System\FEDpwqD.exe
  C:\Windows\System\FEDpwqD.exe
  2⤵
  PID:7928
- C:\Windows\System\KLlvbZf.exe
  C:\Windows\System\KLlvbZf.exe
  2⤵
  PID:7944
- C:\Windows\System\HFQuROY.exe
  C:\Windows\System\HFQuROY.exe
  2⤵
  PID:7960
- C:\Windows\System\yJmwNTw.exe
  C:\Windows\System\yJmwNTw.exe
  2⤵
  PID:7976
- C:\Windows\System\HCaBORs.exe
  C:\Windows\System\HCaBORs.exe
  2⤵
  PID:7996
- C:\Windows\System\gnzRdeO.exe
  C:\Windows\System\gnzRdeO.exe
  2⤵
  PID:8012
- C:\Windows\System\cdcFYsH.exe
  C:\Windows\System\cdcFYsH.exe
  2⤵
  PID:8028
- C:\Windows\System\cQImMhn.exe
  C:\Windows\System\cQImMhn.exe
  2⤵
  PID:8056
- C:\Windows\System\RAxURfc.exe
  C:\Windows\System\RAxURfc.exe
  2⤵
  PID:8076
- C:\Windows\System\QTvJkHO.exe
  C:\Windows\System\QTvJkHO.exe
  2⤵
  PID:8092
- C:\Windows\System\dqMUelp.exe
  C:\Windows\System\dqMUelp.exe
  2⤵
  PID:8116
- C:\Windows\System\MERbFcU.exe
  C:\Windows\System\MERbFcU.exe
  2⤵
  PID:8136
- C:\Windows\System\SLZmVTC.exe
  C:\Windows\System\SLZmVTC.exe
  2⤵
  PID:8168
- C:\Windows\System\BVoczeW.exe
  C:\Windows\System\BVoczeW.exe
  2⤵
  PID:8184
- C:\Windows\System\WiTgpKw.exe
  C:\Windows\System\WiTgpKw.exe
  2⤵
  PID:6940
- C:\Windows\System\RLjpHPb.exe
  C:\Windows\System\RLjpHPb.exe
  2⤵
  PID:6976
- C:\Windows\System\bOeuIAa.exe
  C:\Windows\System\bOeuIAa.exe
  2⤵
  PID:7012
- C:\Windows\System\VzrucCq.exe
  C:\Windows\System\VzrucCq.exe
  2⤵
  PID:7036
- C:\Windows\System\TNXFJZK.exe
  C:\Windows\System\TNXFJZK.exe
  2⤵
  PID:7096
- C:\Windows\System\BqHFTya.exe
  C:\Windows\System\BqHFTya.exe
  2⤵
  PID:2208
- C:\Windows\System\zYwaAFz.exe
  C:\Windows\System\zYwaAFz.exe
  2⤵
  PID:7132
- C:\Windows\System\fGPFEcL.exe
  C:\Windows\System\fGPFEcL.exe
  2⤵
  PID:6740
- C:\Windows\System\NESoQXn.exe
  C:\Windows\System\NESoQXn.exe
  2⤵
  PID:6672
- C:\Windows\System\rlYCdGd.exe
  C:\Windows\System\rlYCdGd.exe
  2⤵
  PID:7164
- C:\Windows\System\vCsKbMN.exe
  C:\Windows\System\vCsKbMN.exe
  2⤵
  PID:7276
- C:\Windows\System\JFnIRoF.exe
  C:\Windows\System\JFnIRoF.exe
  2⤵
  PID:7336
- C:\Windows\System\szYvRcY.exe
  C:\Windows\System\szYvRcY.exe
  2⤵
  PID:7532
- C:\Windows\System\YsFNDCd.exe
  C:\Windows\System\YsFNDCd.exe
  2⤵
  PID:7484
- C:\Windows\System\MHNXZsp.exe
  C:\Windows\System\MHNXZsp.exe
  2⤵
  PID:8104
- C:\Windows\System\lUVMjyc.exe
  C:\Windows\System\lUVMjyc.exe
  2⤵
  PID:8132
- C:\Windows\System\AmHvrLK.exe
  C:\Windows\System\AmHvrLK.exe
  2⤵
  PID:7604
- C:\Windows\System\TzMKOUq.exe
  C:\Windows\System\TzMKOUq.exe
  2⤵
  PID:7656
- C:\Windows\System\yoGHtWp.exe
  C:\Windows\System\yoGHtWp.exe
  2⤵
  PID:940
- C:\Windows\System\EdSKKce.exe
  C:\Windows\System\EdSKKce.exe
  2⤵
  PID:1468
- C:\Windows\System\sXvdffr.exe
  C:\Windows\System\sXvdffr.exe
  2⤵
  PID:7684
- C:\Windows\System\ixgMNFC.exe
  C:\Windows\System\ixgMNFC.exe
  2⤵
  PID:2344
- C:\Windows\System\dIzRfow.exe
  C:\Windows\System\dIzRfow.exe
  2⤵
  PID:5032
- C:\Windows\System\vzWykPm.exe
  C:\Windows\System\vzWykPm.exe
  2⤵
  PID:7040
- C:\Windows\System\hdJdPNQ.exe
  C:\Windows\System\hdJdPNQ.exe
  2⤵
  PID:7924
- C:\Windows\System\ZTJbGFB.exe
  C:\Windows\System\ZTJbGFB.exe
  2⤵
  PID:7956
- C:\Windows\System\qxCebBC.exe
  C:\Windows\System\qxCebBC.exe
  2⤵
  PID:7988
- C:\Windows\System\lWZjarD.exe
  C:\Windows\System\lWZjarD.exe
  2⤵
  PID:8044
- C:\Windows\System\IRQaxfD.exe
  C:\Windows\System\IRQaxfD.exe
  2⤵
  PID:8176
- C:\Windows\System\lVKbVmG.exe
  C:\Windows\System\lVKbVmG.exe
  2⤵
  PID:6956
- C:\Windows\System\cjenrrP.exe
  C:\Windows\System\cjenrrP.exe
  2⤵
  PID:7032
- C:\Windows\System\zupxIBG.exe
  C:\Windows\System\zupxIBG.exe
  2⤵
  PID:8212
- C:\Windows\System\VqnxKCq.exe
  C:\Windows\System\VqnxKCq.exe
  2⤵
  PID:8244
- C:\Windows\System\VqgIasV.exe
  C:\Windows\System\VqgIasV.exe
  2⤵
  PID:8260
- C:\Windows\System\LqHzhmE.exe
  C:\Windows\System\LqHzhmE.exe
  2⤵
  PID:8276
- C:\Windows\System\HVXKPZX.exe
  C:\Windows\System\HVXKPZX.exe
  2⤵
  PID:8296
- C:\Windows\System\eGuPqFi.exe
  C:\Windows\System\eGuPqFi.exe
  2⤵
  PID:8312
- C:\Windows\System\KmNrXrO.exe
  C:\Windows\System\KmNrXrO.exe
  2⤵
  PID:8332
- C:\Windows\System\skctdJF.exe
  C:\Windows\System\skctdJF.exe
  2⤵
  PID:8404
- C:\Windows\System\HetCggE.exe
  C:\Windows\System\HetCggE.exe
  2⤵
  PID:8428
- C:\Windows\System\AMxFpTN.exe
  C:\Windows\System\AMxFpTN.exe
  2⤵
  PID:8452
- C:\Windows\System\KVZmyhW.exe
  C:\Windows\System\KVZmyhW.exe
  2⤵
  PID:8472
- C:\Windows\System\fVKbqSU.exe
  C:\Windows\System\fVKbqSU.exe
  2⤵
  PID:8496
- C:\Windows\System\SyDMfxT.exe
  C:\Windows\System\SyDMfxT.exe
  2⤵
  PID:8516
- C:\Windows\System\AZWXJOL.exe
  C:\Windows\System\AZWXJOL.exe
  2⤵
  PID:8536
- C:\Windows\System\zxpPmjv.exe
  C:\Windows\System\zxpPmjv.exe
  2⤵
  PID:8552
- C:\Windows\System\bViDxVI.exe
  C:\Windows\System\bViDxVI.exe
  2⤵
  PID:8568
- C:\Windows\System\yUOYmAn.exe
  C:\Windows\System\yUOYmAn.exe
  2⤵
  PID:8584
- C:\Windows\System\aoyIYiA.exe
  C:\Windows\System\aoyIYiA.exe
  2⤵
  PID:8600
- C:\Windows\System\uFGqAfT.exe
  C:\Windows\System\uFGqAfT.exe
  2⤵
  PID:8616
- C:\Windows\System\KDctCKv.exe
  C:\Windows\System\KDctCKv.exe
  2⤵
  PID:8632
- C:\Windows\System\UDVWIVf.exe
  C:\Windows\System\UDVWIVf.exe
  2⤵
  PID:8648
- C:\Windows\System\RdKOaqe.exe
  C:\Windows\System\RdKOaqe.exe
  2⤵
  PID:8668
- C:\Windows\System\kKfweSB.exe
  C:\Windows\System\kKfweSB.exe
  2⤵
  PID:8688
- C:\Windows\System\MRprrEp.exe
  C:\Windows\System\MRprrEp.exe
  2⤵
  PID:8704
- C:\Windows\System\XKOJsdv.exe
  C:\Windows\System\XKOJsdv.exe
  2⤵
  PID:8724
- C:\Windows\System\fbTJQqL.exe
  C:\Windows\System\fbTJQqL.exe
  2⤵
  PID:8772
- C:\Windows\System\ovEjblS.exe
  C:\Windows\System\ovEjblS.exe
  2⤵
  PID:8800
- C:\Windows\System\AsEKhbj.exe
  C:\Windows\System\AsEKhbj.exe
  2⤵
  PID:8816
- C:\Windows\System\lIjAXDN.exe
  C:\Windows\System\lIjAXDN.exe
  2⤵
  PID:8832
- C:\Windows\System\NHQeSxz.exe
  C:\Windows\System\NHQeSxz.exe
  2⤵
  PID:8848
- C:\Windows\System\nTNgHol.exe
  C:\Windows\System\nTNgHol.exe
  2⤵
  PID:8868
- C:\Windows\System\rFLxuTw.exe
  C:\Windows\System\rFLxuTw.exe
  2⤵
  PID:8892
- C:\Windows\System\OhRnBhr.exe
  C:\Windows\System\OhRnBhr.exe
  2⤵
  PID:9096
- C:\Windows\System\fFyofxz.exe
  C:\Windows\System\fFyofxz.exe
  2⤵
  PID:9124
- C:\Windows\System\IfoUcKH.exe
  C:\Windows\System\IfoUcKH.exe
  2⤵
  PID:9148
- C:\Windows\System\GitClLr.exe
  C:\Windows\System\GitClLr.exe
  2⤵
  PID:9172
- C:\Windows\System\iFUVDjl.exe
  C:\Windows\System\iFUVDjl.exe
  2⤵
  PID:9196
- C:\Windows\System\yleAJIZ.exe
  C:\Windows\System\yleAJIZ.exe
  2⤵
  PID:5540
- C:\Windows\System\tBqKjZs.exe
  C:\Windows\System\tBqKjZs.exe
  2⤵
  PID:7344
- C:\Windows\System\gtPvafN.exe
  C:\Windows\System\gtPvafN.exe
  2⤵
  PID:6996
- C:\Windows\System\PMhnYEQ.exe
  C:\Windows\System\PMhnYEQ.exe
  2⤵
  PID:8232
- C:\Windows\System\PZXVzKK.exe
  C:\Windows\System\PZXVzKK.exe
  2⤵
  PID:5308
- C:\Windows\System\iWGvXlc.exe
  C:\Windows\System\iWGvXlc.exe
  2⤵
  PID:7572
- C:\Windows\System\nGwGaey.exe
  C:\Windows\System\nGwGaey.exe
  2⤵
  PID:3052
- C:\Windows\System\fMHLVRV.exe
  C:\Windows\System\fMHLVRV.exe
  2⤵
  PID:1116
- C:\Windows\System\jpnAErw.exe
  C:\Windows\System\jpnAErw.exe
  2⤵
  PID:6704
- C:\Windows\System\GyLDNYl.exe
  C:\Windows\System\GyLDNYl.exe
  2⤵
  PID:6284
- C:\Windows\System\xpuNTzv.exe
  C:\Windows\System\xpuNTzv.exe
  2⤵
  PID:8624
- C:\Windows\System\ylwTEpM.exe
  C:\Windows\System\ylwTEpM.exe
  2⤵
  PID:8644
- C:\Windows\System\tsRdakk.exe
  C:\Windows\System\tsRdakk.exe
  2⤵
  PID:8720
- C:\Windows\System\iyFlcxK.exe
  C:\Windows\System\iyFlcxK.exe
  2⤵
  PID:8780
- C:\Windows\System\RXhsrWj.exe
  C:\Windows\System\RXhsrWj.exe
  2⤵
  PID:8304
- C:\Windows\System\cIGbmYs.exe
  C:\Windows\System\cIGbmYs.exe
  2⤵
  PID:1252
- C:\Windows\System\OxpsOKV.exe
  C:\Windows\System\OxpsOKV.exe
  2⤵
  PID:8904
- C:\Windows\System\KBGDZbk.exe
  C:\Windows\System\KBGDZbk.exe
  2⤵
  PID:7764
- C:\Windows\System\lZBdsVx.exe
  C:\Windows\System\lZBdsVx.exe
  2⤵
  PID:7724
- C:\Windows\System\ldOjmKR.exe
  C:\Windows\System\ldOjmKR.exe
  2⤵
  PID:3968
- C:\Windows\System\THGyfoM.exe
  C:\Windows\System\THGyfoM.exe
  2⤵
  PID:7872
- C:\Windows\System\KwAqiPh.exe
  C:\Windows\System\KwAqiPh.exe
  2⤵
  PID:7940
- C:\Windows\System\pPMKRLS.exe
  C:\Windows\System\pPMKRLS.exe
  2⤵
  PID:8008
- C:\Windows\System\eZHXvZF.exe
  C:\Windows\System\eZHXvZF.exe
  2⤵
  PID:2436
- C:\Windows\System\vReoBIk.exe
  C:\Windows\System\vReoBIk.exe
  2⤵
  PID:7312
- C:\Windows\System\XtMuoIO.exe
  C:\Windows\System\XtMuoIO.exe
  2⤵
  PID:8796
- C:\Windows\System\Pbkqrvy.exe
  C:\Windows\System\Pbkqrvy.exe
  2⤵
  PID:8308
- C:\Windows\System\eSoGneo.exe
  C:\Windows\System\eSoGneo.exe
  2⤵
  PID:4804
- C:\Windows\System\zjuhTxa.exe
  C:\Windows\System\zjuhTxa.exe
  2⤵
  PID:9220
- C:\Windows\System\eeLznYj.exe
  C:\Windows\System\eeLznYj.exe
  2⤵
  PID:9240
- C:\Windows\System\xikHuqg.exe
  C:\Windows\System\xikHuqg.exe
  2⤵
  PID:9264
- C:\Windows\System\ZLdAthb.exe
  C:\Windows\System\ZLdAthb.exe
  2⤵
  PID:9284
- C:\Windows\System\FQQwPWu.exe
  C:\Windows\System\FQQwPWu.exe
  2⤵
  PID:9300
- C:\Windows\System\fYEeGqJ.exe
  C:\Windows\System\fYEeGqJ.exe
  2⤵
  PID:9320
- C:\Windows\System\ZqesYRm.exe
  C:\Windows\System\ZqesYRm.exe
  2⤵
  PID:9340
- C:\Windows\System\mzAMAVY.exe
  C:\Windows\System\mzAMAVY.exe
  2⤵
  PID:9360
- C:\Windows\System\lhoLxFv.exe
  C:\Windows\System\lhoLxFv.exe
  2⤵
  PID:9384
- C:\Windows\System\unfJizt.exe
  C:\Windows\System\unfJizt.exe
  2⤵
  PID:9412
- C:\Windows\System\ESWtybd.exe
  C:\Windows\System\ESWtybd.exe
  2⤵
  PID:9436
- C:\Windows\System\TKCQhjW.exe
  C:\Windows\System\TKCQhjW.exe
  2⤵
  PID:9552
- C:\Windows\System\dOasMJt.exe
  C:\Windows\System\dOasMJt.exe
  2⤵
  PID:9568
- C:\Windows\System\MoNexjy.exe
  C:\Windows\System\MoNexjy.exe
  2⤵
  PID:9588
- C:\Windows\System\alMopfg.exe
  C:\Windows\System\alMopfg.exe
  2⤵
  PID:9604
- C:\Windows\System\UKUhxtA.exe
  C:\Windows\System\UKUhxtA.exe
  2⤵
  PID:9624
- C:\Windows\System\oOkKdfs.exe
  C:\Windows\System\oOkKdfs.exe
  2⤵
  PID:9640
- C:\Windows\System\InZWSJV.exe
  C:\Windows\System\InZWSJV.exe
  2⤵
  PID:9660
- C:\Windows\System\IpMyHTj.exe
  C:\Windows\System\IpMyHTj.exe
  2⤵
  PID:9680
- C:\Windows\System\CVeHnQn.exe
  C:\Windows\System\CVeHnQn.exe
  2⤵
  PID:9696
- C:\Windows\System\oAsiLnE.exe
  C:\Windows\System\oAsiLnE.exe
  2⤵
  PID:9716
- C:\Windows\System\NpFGaQc.exe
  C:\Windows\System\NpFGaQc.exe
  2⤵
  PID:9740
- C:\Windows\System\QOaDVqR.exe
  C:\Windows\System\QOaDVqR.exe
  2⤵
  PID:9756
- C:\Windows\System\IXKurlw.exe
  C:\Windows\System\IXKurlw.exe
  2⤵
  PID:9772
- C:\Windows\System\NJnrVbu.exe
  C:\Windows\System\NJnrVbu.exe
  2⤵
  PID:9788
- C:\Windows\System\WBKcRxy.exe
  C:\Windows\System\WBKcRxy.exe
  2⤵
  PID:9804
- C:\Windows\System\tCSQZHU.exe
  C:\Windows\System\tCSQZHU.exe
  2⤵
  PID:9828
- C:\Windows\System\dPQqIcK.exe
  C:\Windows\System\dPQqIcK.exe
  2⤵
  PID:9852
- C:\Windows\System\eDYkWyS.exe
  C:\Windows\System\eDYkWyS.exe
  2⤵
  PID:9868
- C:\Windows\System\RoxXEMZ.exe
  C:\Windows\System\RoxXEMZ.exe
  2⤵
  PID:9888
- C:\Windows\System\oDtiBeZ.exe
  C:\Windows\System\oDtiBeZ.exe
  2⤵
  PID:9916
- C:\Windows\System\BzcuyZR.exe
  C:\Windows\System\BzcuyZR.exe
  2⤵
  PID:9936
- C:\Windows\System\jFFzaKA.exe
  C:\Windows\System\jFFzaKA.exe
  2⤵
  PID:9960
- C:\Windows\System\AqRDZHD.exe
  C:\Windows\System\AqRDZHD.exe
  2⤵
  PID:9988
- C:\Windows\System\WtDtVzR.exe
  C:\Windows\System\WtDtVzR.exe
  2⤵
  PID:10004
- C:\Windows\System\ZtuDUvZ.exe
  C:\Windows\System\ZtuDUvZ.exe
  2⤵
  PID:10024
- C:\Windows\System\HYICobV.exe
  C:\Windows\System\HYICobV.exe
  2⤵
  PID:10048
- C:\Windows\System\xGQkBEx.exe
  C:\Windows\System\xGQkBEx.exe
  2⤵
  PID:10068
- C:\Windows\System\VHsHiJO.exe
  C:\Windows\System\VHsHiJO.exe
  2⤵
  PID:10160
- C:\Windows\System\AQJhzxe.exe
  C:\Windows\System\AQJhzxe.exe
  2⤵
  PID:10184
- C:\Windows\System\YCVcDtD.exe
  C:\Windows\System\YCVcDtD.exe
  2⤵
  PID:10212
- C:\Windows\System\rPrkuCn.exe
  C:\Windows\System\rPrkuCn.exe
  2⤵
  PID:10228
- C:\Windows\System\ZMPGfdo.exe
  C:\Windows\System\ZMPGfdo.exe
  2⤵
  PID:8416
- C:\Windows\System\UMMAwdL.exe
  C:\Windows\System\UMMAwdL.exe
  2⤵
  PID:8464
- C:\Windows\System\PJIBDMJ.exe
  C:\Windows\System\PJIBDMJ.exe
  2⤵
  PID:8508
- C:\Windows\System\bydQhdM.exe
  C:\Windows\System\bydQhdM.exe
  2⤵
  PID:8548
- C:\Windows\System\tAQFHVz.exe
  C:\Windows\System\tAQFHVz.exe
  2⤵
  PID:8580
- C:\Windows\System\lBuCBtt.exe
  C:\Windows\System\lBuCBtt.exe
  2⤵
  PID:8628
- C:\Windows\System\RMEyelc.exe
  C:\Windows\System\RMEyelc.exe
  2⤵
  PID:8712
- C:\Windows\System\XEBNifC.exe
  C:\Windows\System\XEBNifC.exe
  2⤵
  PID:8808
- C:\Windows\System\KhGQIzt.exe
  C:\Windows\System\KhGQIzt.exe
  2⤵
  PID:8840
- C:\Windows\System\kMojfro.exe
  C:\Windows\System\kMojfro.exe
  2⤵
  PID:9088
- C:\Windows\System\SeyOVSQ.exe
  C:\Windows\System\SeyOVSQ.exe
  2⤵
  PID:8912
- C:\Windows\System\KeYIbpZ.exe
  C:\Windows\System\KeYIbpZ.exe
  2⤵
  PID:8928
- C:\Windows\System\cqbCzgM.exe
  C:\Windows\System\cqbCzgM.exe
  2⤵
  PID:9280
- C:\Windows\System\taYgFzc.exe
  C:\Windows\System\taYgFzc.exe
  2⤵
  PID:9376
- C:\Windows\System\hJMpxDW.exe
  C:\Windows\System\hJMpxDW.exe
  2⤵
  PID:9424
- C:\Windows\System\swpNXul.exe
  C:\Windows\System\swpNXul.exe
  2⤵
  PID:8988
- C:\Windows\System\DTiSLnL.exe
  C:\Windows\System\DTiSLnL.exe
  2⤵
  PID:9032
- C:\Windows\System\qQCxJTd.exe
  C:\Windows\System\qQCxJTd.exe
  2⤵
  PID:9068
- C:\Windows\System\voGSIGx.exe
  C:\Windows\System\voGSIGx.exe
  2⤵
  PID:9712
- C:\Windows\System\FufyZgy.exe
  C:\Windows\System\FufyZgy.exe
  2⤵
  PID:9768
- C:\Windows\System\BdnWBqZ.exe
  C:\Windows\System\BdnWBqZ.exe
  2⤵
  PID:9836
- C:\Windows\System\NeaiGoa.exe
  C:\Windows\System\NeaiGoa.exe
  2⤵
  PID:1592
- C:\Windows\System\NFaGlKU.exe
  C:\Windows\System\NFaGlKU.exe
  2⤵
  PID:9356
- C:\Windows\System\ZFlywZu.exe
  C:\Windows\System\ZFlywZu.exe
  2⤵
  PID:10032
- C:\Windows\System\AcjGGvE.exe
  C:\Windows\System\AcjGGvE.exe
  2⤵
  PID:10076
- C:\Windows\System\LdLJRlh.exe
  C:\Windows\System\LdLJRlh.exe
  2⤵
  PID:10244
- C:\Windows\System\zguIcQS.exe
  C:\Windows\System\zguIcQS.exe
  2⤵
  PID:10272
- C:\Windows\System\xcvMOYE.exe
  C:\Windows\System\xcvMOYE.exe
  2⤵
  PID:10288
- C:\Windows\System\NwstIQW.exe
  C:\Windows\System\NwstIQW.exe
  2⤵
  PID:10304
- C:\Windows\System\WnGiPvP.exe
  C:\Windows\System\WnGiPvP.exe
  2⤵
  PID:10324
- C:\Windows\System\yvggWBU.exe
  C:\Windows\System\yvggWBU.exe
  2⤵
  PID:10348
- C:\Windows\System\cxbYevo.exe
  C:\Windows\System\cxbYevo.exe
  2⤵
  PID:10368
- C:\Windows\System\LigAqIL.exe
  C:\Windows\System\LigAqIL.exe
  2⤵
  PID:10392
- C:\Windows\System\cvZmAtT.exe
  C:\Windows\System\cvZmAtT.exe
  2⤵
  PID:10416
- C:\Windows\System\YqYiSut.exe
  C:\Windows\System\YqYiSut.exe
  2⤵
  PID:10436
- C:\Windows\System\tMdEhZo.exe
  C:\Windows\System\tMdEhZo.exe
  2⤵
  PID:10460
- C:\Windows\System\YKivEVJ.exe
  C:\Windows\System\YKivEVJ.exe
  2⤵
  PID:10484
- C:\Windows\System\HkFagEF.exe
  C:\Windows\System\HkFagEF.exe
  2⤵
  PID:10508
- C:\Windows\System\CcPGILS.exe
  C:\Windows\System\CcPGILS.exe
  2⤵
  PID:10532
- C:\Windows\System\jRaawvY.exe
  C:\Windows\System\jRaawvY.exe
  2⤵
  PID:10548
- C:\Windows\System\fWfSokX.exe
  C:\Windows\System\fWfSokX.exe
  2⤵
  PID:10572
- C:\Windows\System\QjnOXPF.exe
  C:\Windows\System\QjnOXPF.exe
  2⤵
  PID:10588
- C:\Windows\System\BCsTYxw.exe
  C:\Windows\System\BCsTYxw.exe
  2⤵
  PID:10616
- C:\Windows\System\DtjKOFO.exe
  C:\Windows\System\DtjKOFO.exe
  2⤵
  PID:10636
- C:\Windows\System\zkKVkTY.exe
  C:\Windows\System\zkKVkTY.exe
  2⤵
  PID:10660
- C:\Windows\System\igGoNCy.exe
  C:\Windows\System\igGoNCy.exe
  2⤵
  PID:10700
- C:\Windows\System\TIbrAEP.exe
  C:\Windows\System\TIbrAEP.exe
  2⤵
  PID:10716
- C:\Windows\System\BTTOTjT.exe
  C:\Windows\System\BTTOTjT.exe
  2⤵
  PID:10740
- C:\Windows\System\HErrwlg.exe
  C:\Windows\System\HErrwlg.exe
  2⤵
  PID:10764
- C:\Windows\System\tfpdrDS.exe
  C:\Windows\System\tfpdrDS.exe
  2⤵
  PID:10784
- C:\Windows\System\pyCulkN.exe
  C:\Windows\System\pyCulkN.exe
  2⤵
  PID:10804
- C:\Windows\System\zFyJNuI.exe
  C:\Windows\System\zFyJNuI.exe
  2⤵
  PID:10820
- C:\Windows\System\MvodWlV.exe
  C:\Windows\System\MvodWlV.exe
  2⤵
  PID:10840
- C:\Windows\System\OApATSb.exe
  C:\Windows\System\OApATSb.exe
  2⤵
  PID:10860
- C:\Windows\System\bONvwbf.exe
  C:\Windows\System\bONvwbf.exe
  2⤵
  PID:10880
- C:\Windows\System\KBHKScA.exe
  C:\Windows\System\KBHKScA.exe
  2⤵
  PID:10904
- C:\Windows\System\AnLBpYo.exe
  C:\Windows\System\AnLBpYo.exe
  2⤵
  PID:10924
- C:\Windows\System\VSxirPl.exe
  C:\Windows\System\VSxirPl.exe
  2⤵
  PID:9328
- C:\Windows\System\dWtxaUt.exe
  C:\Windows\System\dWtxaUt.exe
  2⤵
  PID:9524
- C:\Windows\System\AkEBkKJ.exe
  C:\Windows\System\AkEBkKJ.exe
  2⤵
  PID:756
- C:\Windows\System\uewFPKu.exe
  C:\Windows\System\uewFPKu.exe
  2⤵
  PID:10376
- C:\Windows\System\znoDGck.exe
  C:\Windows\System\znoDGck.exe
  2⤵
  PID:10528
- C:\Windows\System\YtTWZAA.exe
  C:\Windows\System\YtTWZAA.exe
  2⤵
  PID:9540
- C:\Windows\System\OObGIEW.exe
  C:\Windows\System\OObGIEW.exe
  2⤵
  PID:9564
- C:\Windows\System\hqcORRS.exe
  C:\Windows\System\hqcORRS.exe
  2⤵
  PID:9620
- C:\Windows\System\ZSlXYMz.exe
  C:\Windows\System\ZSlXYMz.exe
  2⤵
  PID:9672
- C:\Windows\System\sNTSVdr.exe
  C:\Windows\System\sNTSVdr.exe
  2⤵
  PID:10724
- C:\Windows\System\EbMOStx.exe
  C:\Windows\System\EbMOStx.exe
  2⤵
  PID:10816
- C:\Windows\System\FUCuoyy.exe
  C:\Windows\System\FUCuoyy.exe
  2⤵
  PID:9864
- C:\Windows\System\RoCpGOX.exe
  C:\Windows\System\RoCpGOX.exe
  2⤵
  PID:4156
- C:\Windows\System\pajZbZg.exe
  C:\Windows\System\pajZbZg.exe
  2⤵
  PID:9996
- C:\Windows\System\dNcJoFP.exe
  C:\Windows\System\dNcJoFP.exe
  2⤵
  PID:1132
- C:\Windows\System\wGKdEuE.exe
  C:\Windows\System\wGKdEuE.exe
  2⤵
  PID:10360
- C:\Windows\System\DuBCCdv.exe
  C:\Windows\System\DuBCCdv.exe
  2⤵
  PID:10544
- C:\Windows\System\IBxtIzX.exe
  C:\Windows\System\IBxtIzX.exe
  2⤵
  PID:10168
- C:\Windows\System\FMfQLtd.exe
  C:\Windows\System\FMfQLtd.exe
  2⤵
  PID:10748
- C:\Windows\System\AIiBQDe.exe
  C:\Windows\System\AIiBQDe.exe
  2⤵
  PID:11228
- C:\Windows\System\OWJJfYh.exe
  C:\Windows\System\OWJJfYh.exe
  2⤵
  PID:6992
- C:\Windows\System\WZDaVlf.exe
  C:\Windows\System\WZDaVlf.exe
  2⤵
  PID:9004
- C:\Windows\System\MXBlmPC.exe
  C:\Windows\System\MXBlmPC.exe
  2⤵
  PID:9232
- C:\Windows\System\aCeSNDY.exe
  C:\Windows\System\aCeSNDY.exe
  2⤵
  PID:10016
- C:\Windows\System\tpaWIfo.exe
  C:\Windows\System\tpaWIfo.exe
  2⤵
  PID:10252
- C:\Windows\System\NfuhMJr.exe
  C:\Windows\System\NfuhMJr.exe
  2⤵
  PID:868
- C:\Windows\System\LYawckc.exe
  C:\Windows\System\LYawckc.exe
  2⤵
  PID:4168
- C:\Windows\System\XnaMtHl.exe
  C:\Windows\System\XnaMtHl.exe
  2⤵
  PID:10408
- C:\Windows\System\XlbbFEg.exe
  C:\Windows\System\XlbbFEg.exe
  2⤵
  PID:10504
- C:\Windows\System\DpqVFTF.exe
  C:\Windows\System\DpqVFTF.exe
  2⤵
  PID:10596
- C:\Windows\System\WyFxgLx.exe
  C:\Windows\System\WyFxgLx.exe
  2⤵
  PID:10644
- C:\Windows\System\NqsCtYB.exe
  C:\Windows\System\NqsCtYB.exe
  2⤵
  PID:9208
- C:\Windows\System\YROHOwq.exe
  C:\Windows\System\YROHOwq.exe
  2⤵
  PID:10712
- C:\Windows\System\eQeVcTr.exe
  C:\Windows\System\eQeVcTr.exe
  2⤵
  PID:11192
- C:\Windows\System\mQnUkWl.exe
  C:\Windows\System\mQnUkWl.exe
  2⤵
  PID:11252
- C:\Windows\System\ykcvODR.exe
  C:\Windows\System\ykcvODR.exe
  2⤵
  PID:10876
- C:\Windows\System\DqKUqWg.exe
  C:\Windows\System\DqKUqWg.exe
  2⤵
  PID:10960
- C:\Windows\System\vzpmBtb.exe
  C:\Windows\System\vzpmBtb.exe
  2⤵
  PID:9396
- C:\Windows\System\IKqsaHV.exe
  C:\Windows\System\IKqsaHV.exe
  2⤵
  PID:11280
- C:\Windows\System\vlhKdDd.exe
  C:\Windows\System\vlhKdDd.exe
  2⤵
  PID:11296
- C:\Windows\System\VZNyBtn.exe
  C:\Windows\System\VZNyBtn.exe
  2⤵
  PID:11332
- C:\Windows\System\QVtHwdJ.exe
  C:\Windows\System\QVtHwdJ.exe
  2⤵
  PID:11348
- C:\Windows\System\WKKEDnJ.exe
  C:\Windows\System\WKKEDnJ.exe
  2⤵
  PID:11364
- C:\Windows\System\edMkoya.exe
  C:\Windows\System\edMkoya.exe
  2⤵
  PID:11380
- C:\Windows\System\khFXvcL.exe
  C:\Windows\System\khFXvcL.exe
  2⤵
  PID:11396
- C:\Windows\System\EQPgImy.exe
  C:\Windows\System\EQPgImy.exe
  2⤵
  PID:11412
- C:\Windows\System\oZCeOOk.exe
  C:\Windows\System\oZCeOOk.exe
  2⤵
  PID:11432
- C:\Windows\System\NDMblkc.exe
  C:\Windows\System\NDMblkc.exe
  2⤵
  PID:11452
- C:\Windows\System\VfprNoZ.exe
  C:\Windows\System\VfprNoZ.exe
  2⤵
  PID:11476
- C:\Windows\System\LHKEklT.exe
  C:\Windows\System\LHKEklT.exe
  2⤵
  PID:11492
- C:\Windows\System\wyClplL.exe
  C:\Windows\System\wyClplL.exe
  2⤵
  PID:11512
- C:\Windows\System\CnoZOQq.exe
  C:\Windows\System\CnoZOQq.exe
  2⤵
  PID:11536
- C:\Windows\System\KkkxKRt.exe
  C:\Windows\System\KkkxKRt.exe
  2⤵
  PID:11552
- C:\Windows\System\sFstQTU.exe
  C:\Windows\System\sFstQTU.exe
  2⤵
  PID:11576
- C:\Windows\System\ukOnVWg.exe
  C:\Windows\System\ukOnVWg.exe
  2⤵
  PID:11596
- C:\Windows\System\rZOFUsG.exe
  C:\Windows\System\rZOFUsG.exe
  2⤵
  PID:11616
- C:\Windows\System\AFXDstl.exe
  C:\Windows\System\AFXDstl.exe
  2⤵
  PID:11636
- C:\Windows\System\igSZosR.exe
  C:\Windows\System\igSZosR.exe
  2⤵
  PID:11656
- C:\Windows\System\tsTQZrl.exe
  C:\Windows\System\tsTQZrl.exe
  2⤵
  PID:11676
- C:\Windows\System\YckusaP.exe
  C:\Windows\System\YckusaP.exe
  2⤵
  PID:11700
- C:\Windows\System\YIFXbEu.exe
  C:\Windows\System\YIFXbEu.exe
  2⤵
  PID:11736
- C:\Windows\System\KvmCene.exe
  C:\Windows\System\KvmCene.exe
  2⤵
  PID:11756
- C:\Windows\System\ZeNpqfF.exe
  C:\Windows\System\ZeNpqfF.exe
  2⤵
  PID:11776
- C:\Windows\System\AEGlwjn.exe
  C:\Windows\System\AEGlwjn.exe
  2⤵
  PID:11808
- C:\Windows\System\EggAnBr.exe
  C:\Windows\System\EggAnBr.exe
  2⤵
  PID:11824
- C:\Windows\System\NHYwdei.exe
  C:\Windows\System\NHYwdei.exe
  2⤵
  PID:11844
- C:\Windows\System\jDkcJPM.exe
  C:\Windows\System\jDkcJPM.exe
  2⤵
  PID:11864
- C:\Windows\System\GzWpaSc.exe
  C:\Windows\System\GzWpaSc.exe
  2⤵
  PID:11884
- C:\Windows\System\TmiRNPX.exe
  C:\Windows\System\TmiRNPX.exe
  2⤵
  PID:11904
- C:\Windows\System\VBOtdhe.exe
  C:\Windows\System\VBOtdhe.exe
  2⤵
  PID:11924
- C:\Windows\System\SRhXFTr.exe
  C:\Windows\System\SRhXFTr.exe
  2⤵
  PID:11940
- C:\Windows\System\KLozKOg.exe
  C:\Windows\System\KLozKOg.exe
  2⤵
  PID:11960
- C:\Windows\System\BwfcCiT.exe
  C:\Windows\System\BwfcCiT.exe
  2⤵
  PID:11984
- C:\Windows\System\QMKMnIh.exe
  C:\Windows\System\QMKMnIh.exe
  2⤵
  PID:12004
- C:\Windows\System\AhMXVUB.exe
  C:\Windows\System\AhMXVUB.exe
  2⤵
  PID:12024
- C:\Windows\System\lJBiHbA.exe
  C:\Windows\System\lJBiHbA.exe
  2⤵
  PID:12048
- C:\Windows\System\SCtUiRZ.exe
  C:\Windows\System\SCtUiRZ.exe
  2⤵
  PID:12072
- C:\Windows\System\kUnGuLZ.exe
  C:\Windows\System\kUnGuLZ.exe
  2⤵
  PID:12088
- C:\Windows\System\opJlVNd.exe
  C:\Windows\System\opJlVNd.exe
  2⤵
  PID:12112
- C:\Windows\System\dmRaZWk.exe
  C:\Windows\System\dmRaZWk.exe
  2⤵
  PID:12132
- C:\Windows\System\eAISLWp.exe
  C:\Windows\System\eAISLWp.exe
  2⤵
  PID:12160
- C:\Windows\System\XYTYOFT.exe
  C:\Windows\System\XYTYOFT.exe
  2⤵
  PID:12180
- C:\Windows\System\TYahkxH.exe
  C:\Windows\System\TYahkxH.exe
  2⤵
  PID:12200
- C:\Windows\System\bkiGGpn.exe
  C:\Windows\System\bkiGGpn.exe
  2⤵
  PID:12216
- C:\Windows\System\YBEXkDC.exe
  C:\Windows\System\YBEXkDC.exe
  2⤵
  PID:12236
- C:\Windows\System\vbCJuWe.exe
  C:\Windows\System\vbCJuWe.exe
  2⤵
  PID:12252
- C:\Windows\System\KNYQqgU.exe
  C:\Windows\System\KNYQqgU.exe
  2⤵
  PID:12268
- C:\Windows\System\atdjeVy.exe
  C:\Windows\System\atdjeVy.exe
  2⤵
  PID:5024
- C:\Windows\System\xvyJNjy.exe
  C:\Windows\System\xvyJNjy.exe
  2⤵
  PID:4340
- C:\Windows\System\BwIbOZd.exe
  C:\Windows\System\BwIbOZd.exe
  2⤵
  PID:2748
- C:\Windows\System\oLFsEDA.exe
  C:\Windows\System\oLFsEDA.exe
  2⤵
  PID:9484
- C:\Windows\System\tGCwiNt.exe
  C:\Windows\System\tGCwiNt.exe
  2⤵
  PID:9560
- C:\Windows\System\qjDIrtP.exe
  C:\Windows\System\qjDIrtP.exe
  2⤵
  PID:11112
- C:\Windows\System\AxrPLWt.exe
  C:\Windows\System\AxrPLWt.exe
  2⤵
  PID:11148
- C:\Windows\System\oTMEESh.exe
  C:\Windows\System\oTMEESh.exe
  2⤵
  PID:8564
- C:\Windows\System\gOZxAvz.exe
  C:\Windows\System\gOZxAvz.exe
  2⤵
  PID:8828
- C:\Windows\System\RZmAJah.exe
  C:\Windows\System\RZmAJah.exe
  2⤵
  PID:8324
- C:\Windows\System\qaMmgkg.exe
  C:\Windows\System\qaMmgkg.exe
  2⤵
  PID:2824
- C:\Windows\System\SiEmkOR.exe
  C:\Windows\System\SiEmkOR.exe
  2⤵
  PID:10792
- C:\Windows\System\xlHYqJK.exe
  C:\Windows\System\xlHYqJK.exe
  2⤵
  PID:3544
- C:\Windows\System\aclqkex.exe
  C:\Windows\System\aclqkex.exe
  2⤵
  PID:2960
- C:\Windows\System\LvKrlwJ.exe
  C:\Windows\System\LvKrlwJ.exe
  2⤵
  PID:5104
- C:\Windows\System\FeHbdJh.exe
  C:\Windows\System\FeHbdJh.exe
  2⤵
  PID:11392
- C:\Windows\System\tHANwjs.exe
  C:\Windows\System\tHANwjs.exe
  2⤵
  PID:3616
- C:\Windows\System\tQZdDxu.exe
  C:\Windows\System\tQZdDxu.exe
  2⤵
  PID:9652
- C:\Windows\System\uABRSMd.exe
  C:\Windows\System\uABRSMd.exe
  2⤵
  PID:11572
- C:\Windows\System\yoAGHUM.exe
  C:\Windows\System\yoAGHUM.exe
  2⤵
  PID:11604
- C:\Windows\System\bVDnlxp.exe
  C:\Windows\System\bVDnlxp.exe
  2⤵
  PID:8784
- C:\Windows\System\zcXUlhN.exe
  C:\Windows\System\zcXUlhN.exe
  2⤵
  PID:11644
- C:\Windows\System\BxbAuMJ.exe
  C:\Windows\System\BxbAuMJ.exe
  2⤵
  PID:1644
- C:\Windows\System\itQaPng.exe
  C:\Windows\System\itQaPng.exe
  2⤵
  PID:11688
- C:\Windows\System\kGYMBsm.exe
  C:\Windows\System\kGYMBsm.exe
  2⤵
  PID:8612
- C:\Windows\System\qQAuEto.exe
  C:\Windows\System\qQAuEto.exe
  2⤵
  PID:11852
- C:\Windows\System\boYZsuA.exe
  C:\Windows\System\boYZsuA.exe
  2⤵
  PID:9352
- C:\Windows\System\wniVtpr.exe
  C:\Windows\System\wniVtpr.exe
  2⤵
  PID:12300
- C:\Windows\System\xnqoRfK.exe
  C:\Windows\System\xnqoRfK.exe
  2⤵
  PID:12316
- C:\Windows\System\YfhuEEA.exe
  C:\Windows\System\YfhuEEA.exe
  2⤵
  PID:12336
- C:\Windows\System\RfBViqC.exe
  C:\Windows\System\RfBViqC.exe
  2⤵
  PID:12352
- C:\Windows\System\VzIcGmC.exe
  C:\Windows\System\VzIcGmC.exe
  2⤵
  PID:12376
- C:\Windows\System\AaYAmkc.exe
  C:\Windows\System\AaYAmkc.exe
  2⤵
  PID:12392
- C:\Windows\System\fPKzWaO.exe
  C:\Windows\System\fPKzWaO.exe
  2⤵
  PID:12420
- C:\Windows\System\BFefHIO.exe
  C:\Windows\System\BFefHIO.exe
  2⤵
  PID:12440
- C:\Windows\System\SotxGIp.exe
  C:\Windows\System\SotxGIp.exe
  2⤵
  PID:12456
- C:\Windows\System\LagGYXr.exe
  C:\Windows\System\LagGYXr.exe
  2⤵
  PID:12476
- C:\Windows\System\sAgzofx.exe
  C:\Windows\System\sAgzofx.exe
  2⤵
  PID:12492
- C:\Windows\System\JrPObfG.exe
  C:\Windows\System\JrPObfG.exe
  2⤵
  PID:12512
- C:\Windows\System\eyhQyqw.exe
  C:\Windows\System\eyhQyqw.exe
  2⤵
  PID:12536
- C:\Windows\System\hYsALiv.exe
  C:\Windows\System\hYsALiv.exe
  2⤵
  PID:12552
- C:\Windows\System\PYYoNDQ.exe
  C:\Windows\System\PYYoNDQ.exe
  2⤵
  PID:12576
- C:\Windows\System\iTGLSto.exe
  C:\Windows\System\iTGLSto.exe
  2⤵
  PID:12600
- C:\Windows\System\xIFBnXR.exe
  C:\Windows\System\xIFBnXR.exe
  2⤵
  PID:12620
- C:\Windows\System\tMEvqOZ.exe
  C:\Windows\System\tMEvqOZ.exe
  2⤵
  PID:12636
- C:\Windows\System\RgXYvYi.exe
  C:\Windows\System\RgXYvYi.exe
  2⤵
  PID:12656
- C:\Windows\System\cmubyVM.exe
  C:\Windows\System\cmubyVM.exe
  2⤵
  PID:12676
- C:\Windows\System\cKhIeHA.exe
  C:\Windows\System\cKhIeHA.exe
  2⤵
  PID:12692
- C:\Windows\System\dnfTbhs.exe
  C:\Windows\System\dnfTbhs.exe
  2⤵
  PID:12708
- C:\Windows\System\lUKUdrA.exe
  C:\Windows\System\lUKUdrA.exe
  2⤵
  PID:12728
- C:\Windows\System\kJDelcI.exe
  C:\Windows\System\kJDelcI.exe
  2⤵
  PID:12748
- C:\Windows\System\koYmxOI.exe
  C:\Windows\System\koYmxOI.exe
  2⤵
  PID:12764
- C:\Windows\System\ZwggTis.exe
  C:\Windows\System\ZwggTis.exe
  2⤵
  PID:12780
- C:\Windows\System\izCDmwE.exe
  C:\Windows\System\izCDmwE.exe
  2⤵
  PID:12796
- C:\Windows\System\vvTGftG.exe
  C:\Windows\System\vvTGftG.exe
  2⤵
  PID:12812
- C:\Windows\System\SwJJOen.exe
  C:\Windows\System\SwJJOen.exe
  2⤵
  PID:12836
- C:\Windows\System\qdiCNyM.exe
  C:\Windows\System\qdiCNyM.exe
  2⤵
  PID:12856
- C:\Windows\System\imVpTYm.exe
  C:\Windows\System\imVpTYm.exe
  2⤵
  PID:9668
- C:\Windows\System\eZJEcgw.exe
  C:\Windows\System\eZJEcgw.exe
  2⤵
  PID:11708
- C:\Windows\System\epMbrOz.exe
  C:\Windows\System\epMbrOz.exe
  2⤵
  PID:11900
- C:\Windows\System\TAJSJIs.exe
  C:\Windows\System\TAJSJIs.exe
  2⤵
  PID:12368
- C:\Windows\System\NWcjWHw.exe
  C:\Windows\System\NWcjWHw.exe
  2⤵
  PID:11176
- C:\Windows\System\CqVvzEE.exe
  C:\Windows\System\CqVvzEE.exe
  2⤵
  PID:12528
- C:\Windows\System\mhziugz.exe
  C:\Windows\System\mhziugz.exe
  2⤵
  PID:12652
- C:\Windows\System\uuOGAkH.exe
  C:\Windows\System\uuOGAkH.exe
  2⤵
  PID:11744
- C:\Windows\System\TUoRztR.exe
  C:\Windows\System\TUoRztR.exe
  2⤵
  PID:11796
- C:\Windows\System\HkmPyYv.exe
  C:\Windows\System\HkmPyYv.exe
  2⤵
  PID:11880
- C:\Windows\System\PdVuOCF.exe
  C:\Windows\System\PdVuOCF.exe
  2⤵
  PID:12128
- C:\Windows\System\FLmnqzW.exe
  C:\Windows\System\FLmnqzW.exe
  2⤵
  PID:12212
- C:\Windows\System\gFfeIFu.exe
  C:\Windows\System\gFfeIFu.exe
  2⤵
  PID:12976
- C:\Windows\System\SVlqsqp.exe
  C:\Windows\System\SVlqsqp.exe
  2⤵
  PID:12508
- C:\Windows\System\wBiHIFS.exe
  C:\Windows\System\wBiHIFS.exe
  2⤵
  PID:12564
- C:\Windows\System\oHRuFbj.exe
  C:\Windows\System\oHRuFbj.exe
  2⤵
  PID:12616
- C:\Windows\System\mZKryZt.exe
  C:\Windows\System\mZKryZt.exe
  2⤵
  PID:12700
- C:\Windows\System\FclyiJj.exe
  C:\Windows\System\FclyiJj.exe
  2⤵
  PID:13056
- C:\Windows\System\ExLLbSS.exe
  C:\Windows\System\ExLLbSS.exe
  2⤵
  PID:13016
- C:\Windows\System\GXcqOhq.exe
  C:\Windows\System\GXcqOhq.exe
  2⤵
  PID:12984
- C:\Windows\System\EcRYhtv.exe
  C:\Windows\System\EcRYhtv.exe
  2⤵
  PID:12932
- C:\Windows\System\KjygVcW.exe
  C:\Windows\System\KjygVcW.exe
  2⤵
  PID:12868
- C:\Windows\System\bIbCgQG.exe
  C:\Windows\System\bIbCgQG.exe
  2⤵
  PID:13224
- C:\Windows\System\qHQBlfD.exe
  C:\Windows\System\qHQBlfD.exe
  2⤵
  PID:13152
- C:\Windows\System\HIlDKhM.exe
  C:\Windows\System\HIlDKhM.exe
  2⤵
  PID:13188
- C:\Windows\System\UhyrFXv.exe
  C:\Windows\System\UhyrFXv.exe
  2⤵
  PID:11244
- C:\Windows\System\nPFDSQE.exe
  C:\Windows\System\nPFDSQE.exe
  2⤵
  PID:13292
- C:\Windows\System\aMZMsVc.exe
  C:\Windows\System\aMZMsVc.exe
  2⤵
  PID:13276
- C:\Windows\System\AhDiCzx.exe
  C:\Windows\System\AhDiCzx.exe
  2⤵
  PID:13252
- C:\Windows\System\eDeDhWf.exe
  C:\Windows\System\eDeDhWf.exe
  2⤵
  PID:12000
- C:\Windows\System\fLxgQtW.exe
  C:\Windows\System\fLxgQtW.exe
  2⤵
  PID:11972
- C:\Windows\System\EAwsdZx.exe
  C:\Windows\System\EAwsdZx.exe
  2⤵
  PID:2880
- C:\Windows\System\gUJtYqx.exe
  C:\Windows\System\gUJtYqx.exe
  2⤵
  PID:11500
- C:\Windows\System\upCeQOI.exe
  C:\Windows\System\upCeQOI.exe
  2⤵
  PID:11820
- C:\Windows\System\rqcmGfX.exe
  C:\Windows\System\rqcmGfX.exe
  2⤵
  PID:11360
- C:\Windows\System\hnzezHo.exe
  C:\Windows\System\hnzezHo.exe
  2⤵
  PID:10480
- C:\Windows\System\pSRTfKZ.exe
  C:\Windows\System\pSRTfKZ.exe
  2⤵
  PID:11816
- C:\Windows\System\gDSjSxn.exe
  C:\Windows\System\gDSjSxn.exe
  2⤵
  PID:12108
- C:\Windows\System\VZGctHc.exe
  C:\Windows\System\VZGctHc.exe
  2⤵
  PID:12248
- C:\Windows\System\MJEmwKy.exe
  C:\Windows\System\MJEmwKy.exe
  2⤵
  PID:856
- C:\Windows\System\sjoQRQi.exe
  C:\Windows\System\sjoQRQi.exe
  2⤵
  PID:11608
- C:\Windows\System\LmxBzLc.exe
  C:\Windows\System\LmxBzLc.exe
  2⤵
  PID:9180
- C:\Windows\System\AbulCwP.exe
  C:\Windows\System\AbulCwP.exe
  2⤵
  PID:5244
- C:\Windows\System\VDYdyDq.exe
  C:\Windows\System\VDYdyDq.exe
  2⤵
  PID:3180
- C:\Windows\System\jFjsYGX.exe
  C:\Windows\System\jFjsYGX.exe
  2⤵
  PID:12308
- C:\Windows\System\ymGxIQx.exe
  C:\Windows\System\ymGxIQx.exe
  2⤵
  PID:5052
- C:\Windows\System\kYZzquX.exe
  C:\Windows\System\kYZzquX.exe
  2⤵
  PID:11272
- C:\Windows\System\jedUBjK.exe
  C:\Windows\System\jedUBjK.exe
  2⤵
  PID:1964
- C:\Windows\System\ZffFWTK.exe
  C:\Windows\System\ZffFWTK.exe
  2⤵
  PID:9444
- C:\Windows\System\FDOfOtp.exe
  C:\Windows\System\FDOfOtp.exe
  2⤵
  PID:12084
- C:\Windows\System\KCBGGZP.exe
  C:\Windows\System\KCBGGZP.exe
  2⤵
  PID:12228
- C:\Windows\System\fGaYRYx.exe
  C:\Windows\System\fGaYRYx.exe
  2⤵
  PID:12364
- C:\Windows\System\JlkFVqi.exe
  C:\Windows\System\JlkFVqi.exe
  2⤵
  PID:7420
- C:\Windows\System\LqpCdfg.exe
  C:\Windows\System\LqpCdfg.exe
  2⤵
  PID:10676
- C:\Windows\System\kCDGcuB.exe
  C:\Windows\System\kCDGcuB.exe
  2⤵
  PID:13220
- C:\Windows\System\CPtenCe.exe
  C:\Windows\System\CPtenCe.exe
  2⤵
  PID:11956
- C:\Windows\System\aXerNBQ.exe
  C:\Windows\System\aXerNBQ.exe
  2⤵
  PID:6504
- C:\Windows\System\nsusglo.exe
  C:\Windows\System\nsusglo.exe
  2⤵
  PID:6528
- C:\Windows\System\zMsAfrU.exe
  C:\Windows\System\zMsAfrU.exe
  2⤵
  PID:12592
- C:\Windows\System\rZMonmv.exe
  C:\Windows\System\rZMonmv.exe
  2⤵
  PID:12196
- C:\Windows\System\KhWiUtr.exe
  C:\Windows\System\KhWiUtr.exe
  2⤵
  PID:12888
- C:\Windows\System\jorvlCk.exe
  C:\Windows\System\jorvlCk.exe
  2⤵
  PID:5152
- C:\Windows\System\rOItalf.exe
  C:\Windows\System\rOItalf.exe
  2⤵
  PID:12684
- C:\Windows\System\MRoVCFU.exe
  C:\Windows\System\MRoVCFU.exe
  2⤵
  PID:13192
- C:\Windows\System\XcfaCRu.exe
  C:\Windows\System\XcfaCRu.exe
  2⤵
  PID:12232
- C:\Windows\System\NMbhXam.exe
  C:\Windows\System\NMbhXam.exe
  2⤵
  PID:11200
- C:\Windows\System\QqexkyF.exe
  C:\Windows\System\QqexkyF.exe
  2⤵
  PID:11952
- C:\Windows\System\jsrUjmm.exe
  C:\Windows\System\jsrUjmm.exe
  2⤵
  PID:12388
- C:\Windows\System\gyKWEch.exe
  C:\Windows\System\gyKWEch.exe
  2⤵
  PID:13092
- C:\Windows\System\VUXOFXO.exe
  C:\Windows\System\VUXOFXO.exe
  2⤵
  PID:13324
- C:\Windows\System\oNHkOZc.exe
  C:\Windows\System\oNHkOZc.exe
  2⤵
  PID:13404
- C:\Windows\System\eJQSjYY.exe
  C:\Windows\System\eJQSjYY.exe
  2⤵
  PID:13560
- C:\Windows\System\idyajJu.exe
  C:\Windows\System\idyajJu.exe
  2⤵
  PID:13768
- C:\Windows\System\fkEOuZS.exe
  C:\Windows\System\fkEOuZS.exe
  2⤵
  PID:13788
- C:\Windows\System\ZLTPnYt.exe
  C:\Windows\System\ZLTPnYt.exe
  2⤵
  PID:13808
- C:\Windows\System\FdGgWSu.exe
  C:\Windows\System\FdGgWSu.exe
  2⤵
  PID:13848
- C:\Windows\System\JvciCfD.exe
  C:\Windows\System\JvciCfD.exe
  2⤵
  PID:13868
- C:\Windows\System\EBkrQfB.exe
  C:\Windows\System\EBkrQfB.exe
  2⤵
  PID:13904
- C:\Windows\System\WEWlNfH.exe
  C:\Windows\System\WEWlNfH.exe
  2⤵
  PID:14012
- C:\Windows\System\efxsQGN.exe
  C:\Windows\System\efxsQGN.exe
  2⤵
  PID:14072
- C:\Windows\System\gQbRQHx.exe
  C:\Windows\System\gQbRQHx.exe
  2⤵
  PID:14120
- C:\Windows\System\BdThhKY.exe
  C:\Windows\System\BdThhKY.exe
  2⤵
  PID:14144
- C:\Windows\System\NyQlrri.exe
  C:\Windows\System\NyQlrri.exe
  2⤵
  PID:14172
- C:\Windows\System\UxaLyGH.exe
  C:\Windows\System\UxaLyGH.exe
  2⤵
  PID:14188
- C:\Windows\System\nNUIciN.exe
  C:\Windows\System\nNUIciN.exe
  2⤵
  PID:14228
- C:\Windows\System\wTkeCTw.exe
  C:\Windows\System\wTkeCTw.exe
  2⤵
  PID:14248
- C:\Windows\System\rYJGcbZ.exe
  C:\Windows\System\rYJGcbZ.exe
  2⤵
  PID:14264
- C:\Windows\System\imgGNdD.exe
  C:\Windows\System\imgGNdD.exe
  2⤵
  PID:14280
- C:\Windows\System\exludkY.exe
  C:\Windows\System\exludkY.exe
  2⤵
  PID:4072
- C:\Windows\System\EoOynrF.exe
  C:\Windows\System\EoOynrF.exe
  2⤵
  PID:13492
- C:\Windows\System\BAWsSSx.exe
  C:\Windows\System\BAWsSSx.exe
  2⤵
  PID:13600
- C:\Windows\System\wkYCoQb.exe
  C:\Windows\System\wkYCoQb.exe
  2⤵
  PID:13088
- C:\Windows\System\OsbpcYQ.exe
  C:\Windows\System\OsbpcYQ.exe
  2⤵
  PID:13580
- C:\Windows\System\YUVuuBh.exe
  C:\Windows\System\YUVuuBh.exe
  2⤵
  PID:13612
- C:\Windows\System\LraFGrV.exe
  C:\Windows\System\LraFGrV.exe
  2⤵
  PID:13624
- C:\Windows\System\idorXUN.exe
  C:\Windows\System\idorXUN.exe
  2⤵
  PID:13976
- C:\Windows\System\TNvmsbi.exe
  C:\Windows\System\TNvmsbi.exe
  2⤵
  PID:14132
- C:\Windows\System\VaDIoJn.exe
  C:\Windows\System\VaDIoJn.exe
  2⤵
  PID:7740
- C:\Windows\System\kVeZTWG.exe
  C:\Windows\System\kVeZTWG.exe
  2⤵
  PID:14036
- C:\Windows\System\NcsZWrV.exe
  C:\Windows\System\NcsZWrV.exe
  2⤵
  PID:13984
- C:\Windows\System\tFXOBnD.exe
  C:\Windows\System\tFXOBnD.exe
  2⤵
  PID:14292
- C:\Windows\System\apskOXO.exe
  C:\Windows\System\apskOXO.exe
  2⤵
  PID:12124
- C:\Windows\System\ZMdDpaQ.exe
  C:\Windows\System\ZMdDpaQ.exe
  2⤵
  PID:13044
- C:\Windows\System\xTFsSeQ.exe
  C:\Windows\System\xTFsSeQ.exe
  2⤵
  PID:13360
- C:\Windows\System\pTVJJLU.exe
  C:\Windows\System\pTVJJLU.exe
  2⤵
  PID:13008
- C:\Windows\System\sMtYfHW.exe
  C:\Windows\System\sMtYfHW.exe
  2⤵
  PID:9024
- C:\Windows\System\rGTMPtm.exe
  C:\Windows\System\rGTMPtm.exe
  2⤵
  PID:13536
- C:\Windows\System\XBFJjKr.exe
  C:\Windows\System\XBFJjKr.exe
  2⤵
  PID:13520
- C:\Windows\System\kkPSuaL.exe
  C:\Windows\System\kkPSuaL.exe
  2⤵
  PID:13064
- C:\Windows\System\UqIdHAq.exe
  C:\Windows\System\UqIdHAq.exe
  2⤵
  PID:11160
- C:\Windows\System\CLEWrRt.exe
  C:\Windows\System\CLEWrRt.exe
  2⤵
  PID:13400
- C:\Windows\System\RxYbwyE.exe
  C:\Windows\System\RxYbwyE.exe
  2⤵
  PID:60
- C:\Windows\System\PGyfPks.exe
  C:\Windows\System\PGyfPks.exe
  2⤵
  PID:1188
- C:\Windows\System\hdDiOXa.exe
  C:\Windows\System\hdDiOXa.exe
  2⤵
  PID:1368
- C:\Windows\System\pvMrZbJ.exe
  C:\Windows\System\pvMrZbJ.exe
  2⤵
  PID:12208
- C:\Windows\System\zSOSEnu.exe
  C:\Windows\System\zSOSEnu.exe
  2⤵
  PID:13484
- C:\Windows\System\XpSZlNf.exe
  C:\Windows\System\XpSZlNf.exe
  2⤵
  PID:13720
- C:\Windows\System\htqFXad.exe
  C:\Windows\System\htqFXad.exe
  2⤵
  PID:11792
- C:\Windows\System\SWlWsyo.exe
  C:\Windows\System\SWlWsyo.exe
  2⤵
  PID:536
- C:\Windows\System\fusJITy.exe
  C:\Windows\System\fusJITy.exe
  2⤵
  PID:13784
- C:\Windows\System\NyojogV.exe
  C:\Windows\System\NyojogV.exe
  2⤵
  PID:13744
- C:\Windows\System\YkiWqlW.exe
  C:\Windows\System\YkiWqlW.exe
  2⤵
  PID:13828
- C:\Windows\System\fyFJZqc.exe
  C:\Windows\System\fyFJZqc.exe
  2⤵
  PID:14024
- C:\Windows\System\gqsAhGf.exe
  C:\Windows\System\gqsAhGf.exe
  2⤵
  PID:3944
- C:\Windows\System\dMfNrzI.exe
  C:\Windows\System\dMfNrzI.exe
  2⤵
  PID:13080
- C:\Windows\System\IHPnaSX.exe
  C:\Windows\System\IHPnaSX.exe
  2⤵
  PID:12172
- C:\Windows\System\XxnsfDt.exe
  C:\Windows\System\XxnsfDt.exe
  2⤵
  PID:2244
- C:\Windows\System\PvTnXwc.exe
  C:\Windows\System\PvTnXwc.exe
  2⤵
  PID:808
- C:\Windows\System\ySyYgwM.exe
  C:\Windows\System\ySyYgwM.exe
  2⤵
  PID:4464
- C:\Windows\System\JzHwGiE.exe
  C:\Windows\System\JzHwGiE.exe
  2⤵
  PID:13544
- C:\Windows\System\tDGdHDB.exe
  C:\Windows\System\tDGdHDB.exe
  2⤵
  PID:13748
- C:\Windows\System\waRcICS.exe
  C:\Windows\System\waRcICS.exe
  2⤵
  PID:5824
- C:\Windows\System\aBpeYUM.exe
  C:\Windows\System\aBpeYUM.exe
  2⤵
  PID:1184
- C:\Windows\System\ZxwVQtg.exe
  C:\Windows\System\ZxwVQtg.exe
  2⤵
  PID:2988
- C:\Windows\System\qqwJaxP.exe
  C:\Windows\System\qqwJaxP.exe
  2⤵
  PID:13460
- C:\Windows\System\CXAVTAq.exe
  C:\Windows\System\CXAVTAq.exe
  2⤵
  PID:4956
- C:\Windows\System\jTBuSOo.exe
  C:\Windows\System\jTBuSOo.exe
  2⤵
  PID:13740
- C:\Windows\System\KPzABlW.exe
  C:\Windows\System\KPzABlW.exe
  2⤵
  PID:2036
- C:\Windows\System\lrHoLRe.exe
  C:\Windows\System\lrHoLRe.exe
  2⤵
  PID:4784
- C:\Windows\System\Wpgfljf.exe
  C:\Windows\System\Wpgfljf.exe
  2⤵
  PID:4260
- C:\Windows\System\GJmRzaO.exe
  C:\Windows\System\GJmRzaO.exe
  2⤵
  PID:13916
- C:\Windows\System\phmMNkf.exe
  C:\Windows\System\phmMNkf.exe
  2⤵
  PID:4060
- C:\Windows\System\neLbSOR.exe
  C:\Windows\System\neLbSOR.exe
  2⤵
  PID:14044
- C:\Windows\System\NotanOU.exe
  C:\Windows\System\NotanOU.exe
  2⤵
  PID:732
- C:\Windows\System\jDUlDrS.exe
  C:\Windows\System\jDUlDrS.exe
  2⤵
  PID:5220
- C:\Windows\System\knsMVeV.exe
  C:\Windows\System\knsMVeV.exe
  2⤵
  PID:3116
- C:\Windows\System\KCWeuDp.exe
  C:\Windows\System\KCWeuDp.exe
  2⤵
  PID:13972
- C:\Windows\System\Wwujwqm.exe
  C:\Windows\System\Wwujwqm.exe
  2⤵
  PID:14088
- C:\Windows\System\BRcSBRD.exe
  C:\Windows\System\BRcSBRD.exe
  2⤵
  PID:5176
- C:\Windows\System\NWFiino.exe
  C:\Windows\System\NWFiino.exe
  2⤵
  PID:2276
- C:\Windows\System\YBMNQfu.exe
  C:\Windows\System\YBMNQfu.exe
  2⤵
  PID:13572
- C:\Windows\System\IjOBZqB.exe
  C:\Windows\System\IjOBZqB.exe
  2⤵
  PID:5476
- C:\Windows\System\cIhuyqX.exe
  C:\Windows\System\cIhuyqX.exe
  2⤵
  PID:14180
- C:\Windows\System\jvOLhqL.exe
  C:\Windows\System\jvOLhqL.exe
  2⤵
  PID:7668
- C:\Windows\System\nevEXCg.exe
  C:\Windows\System\nevEXCg.exe
  2⤵
  PID:5556
- C:\Windows\System\kaViEII.exe
  C:\Windows\System\kaViEII.exe
  2⤵
  PID:14332
- C:\Windows\System\ADZTYVN.exe
  C:\Windows\System\ADZTYVN.exe
  2⤵
  PID:12612
- C:\Windows\System\mEfNVTx.exe
  C:\Windows\System\mEfNVTx.exe
  2⤵
  PID:5876
- C:\Windows\System\WSyrfti.exe
  C:\Windows\System\WSyrfti.exe
  2⤵
  PID:6004
- C:\Windows\System\mVyTSag.exe
  C:\Windows\System\mVyTSag.exe
  2⤵
  PID:6188
- C:\Windows\System\OulTMJq.exe
  C:\Windows\System\OulTMJq.exe
  2⤵
  PID:1756
- C:\Windows\System\oUoXEbJ.exe
  C:\Windows\System\oUoXEbJ.exe
  2⤵
  PID:6368
- C:\Windows\System\wekrLDN.exe
  C:\Windows\System\wekrLDN.exe
  2⤵
  PID:640
- C:\Windows\System\JvYwNhP.exe
  C:\Windows\System\JvYwNhP.exe
  2⤵
  PID:408
- C:\Windows\System\JXoDAfi.exe
  C:\Windows\System\JXoDAfi.exe
  2⤵
  PID:5460
- C:\Windows\System\DgpPazA.exe
  C:\Windows\System\DgpPazA.exe
  2⤵
  PID:14164
- C:\Windows\System\NoHYmHa.exe
  C:\Windows\System\NoHYmHa.exe
  2⤵
  PID:4148
- C:\Windows\System\vQRDjjo.exe
  C:\Windows\System\vQRDjjo.exe
  2⤵
  PID:2032
- C:\Windows\System\gsHKkoe.exe
  C:\Windows\System\gsHKkoe.exe
  2⤵
  PID:2340
- C:\Windows\System\VedeGGk.exe
  C:\Windows\System\VedeGGk.exe
  2⤵
  PID:6044
- C:\Windows\System\OQDRIpE.exe
  C:\Windows\System\OQDRIpE.exe
  2⤵
  PID:1220
- C:\Windows\System\DYThTPG.exe
  C:\Windows\System\DYThTPG.exe
  2⤵
  PID:6360
- C:\Windows\System\aUOCimk.exe
  C:\Windows\System\aUOCimk.exe
  2⤵
  PID:13556
- C:\Windows\System\xeaBeJi.exe
  C:\Windows\System\xeaBeJi.exe
  2⤵
  PID:6384
- C:\Windows\System\zgKHIMy.exe
  C:\Windows\System\zgKHIMy.exe
  2⤵
  PID:6344
- C:\Windows\System\QgCCpGN.exe
  C:\Windows\System\QgCCpGN.exe
  2⤵
  PID:5204
- C:\Windows\System\HvuOeJc.exe
  C:\Windows\System\HvuOeJc.exe
  2⤵
  PID:6304
- C:\Windows\System\UDNOEqb.exe
  C:\Windows\System\UDNOEqb.exe
  2⤵
  PID:6416
- C:\Windows\System\eIJzssT.exe
  C:\Windows\System\eIJzssT.exe
  2⤵
  PID:6228
- C:\Windows\System\CCOueva.exe
  C:\Windows\System\CCOueva.exe
  2⤵
  PID:13876
- C:\Windows\System\knHLCaF.exe
  C:\Windows\System\knHLCaF.exe
  2⤵
  PID:1508
- C:\Windows\System\IldeNCI.exe
  C:\Windows\System\IldeNCI.exe
  2⤵
  PID:1452
- C:\Windows\System\FWTEPta.exe
  C:\Windows\System\FWTEPta.exe
  2⤵
  PID:12956
- C:\Windows\System\UDYloMV.exe
  C:\Windows\System\UDYloMV.exe
  2⤵
  PID:14196
- C:\Windows\System\UUDXSXM.exe
  C:\Windows\System\UUDXSXM.exe
  2⤵
  PID:5500
- C:\Windows\System\Mbotxbh.exe
  C:\Windows\System\Mbotxbh.exe
  2⤵
  PID:4220
- C:\Windows\System\FvOxeaY.exe
  C:\Windows\System\FvOxeaY.exe
  2⤵
  PID:6800
- C:\Windows\System\drBIGgu.exe
  C:\Windows\System\drBIGgu.exe
  2⤵
  PID:6392
- C:\Windows\System\XfQwpvG.exe
  C:\Windows\System\XfQwpvG.exe
  2⤵
  PID:4832
- C:\Windows\System\JLLmyql.exe
  C:\Windows\System\JLLmyql.exe
  2⤵
  PID:6592
- C:\Windows\System\bGSCHbR.exe
  C:\Windows\System\bGSCHbR.exe
  2⤵
  PID:1196
- C:\Windows\System\NsVoxtf.exe
  C:\Windows\System\NsVoxtf.exe
  2⤵
  PID:6644
- C:\Windows\System\pdOqkxl.exe
  C:\Windows\System\pdOqkxl.exe
  2⤵
  PID:6152
- C:\Windows\System\IntKqWm.exe
  C:\Windows\System\IntKqWm.exe
  2⤵
  PID:5060
- C:\Windows\System\dzYAWqL.exe
  C:\Windows\System\dzYAWqL.exe
  2⤵
  PID:13352
- C:\Windows\System\jzPHoNp.exe
  C:\Windows\System\jzPHoNp.exe
  2⤵
  PID:4996
- C:\Windows\System\vaPLbIO.exe
  C:\Windows\System\vaPLbIO.exe
  2⤵
  PID:6880
- C:\Windows\System\BrEGrUi.exe
  C:\Windows\System\BrEGrUi.exe
  2⤵
  PID:6868
- C:\Windows\System\vhaqyzq.exe
  C:\Windows\System\vhaqyzq.exe
  2⤵
  PID:6832
- C:\Windows\System\gjCDlhh.exe
  C:\Windows\System\gjCDlhh.exe
  2⤵
  PID:13384
- C:\Windows\System\aQdxHXp.exe
  C:\Windows\System\aQdxHXp.exe
  2⤵
  PID:6464
- C:\Windows\System\piKuQgK.exe
  C:\Windows\System\piKuQgK.exe
  2⤵
  PID:6448
- C:\Windows\System\TiYlbYI.exe
  C:\Windows\System\TiYlbYI.exe
  2⤵
  PID:6496
- C:\Windows\System\JAGZsdT.exe
  C:\Windows\System\JAGZsdT.exe
  2⤵
  PID:13940
- C:\Windows\System\zOiDmIo.exe
  C:\Windows\System\zOiDmIo.exe
  2⤵
  PID:5368
- C:\Windows\System\KnlRCEt.exe
  C:\Windows\System\KnlRCEt.exe
  2⤵
  PID:5724
- C:\Windows\System\rKwELRo.exe
  C:\Windows\System\rKwELRo.exe
  2⤵
  PID:5684
- C:\Windows\System\PIFaWtt.exe
  C:\Windows\System\PIFaWtt.exe
  2⤵
  PID:7112
- C:\Windows\System\EwZRLJR.exe
  C:\Windows\System\EwZRLJR.exe
  2⤵
  PID:5788
- C:\Windows\System\tEsZNPH.exe
  C:\Windows\System\tEsZNPH.exe
  2⤵
  PID:4720
- C:\Windows\System\WgCyqQc.exe
  C:\Windows\System\WgCyqQc.exe
  2⤵
  PID:6892
- C:\Windows\System\voyjRtr.exe
  C:\Windows\System\voyjRtr.exe
  2⤵
  PID:6312
- C:\Windows\System\SdSpohU.exe
  C:\Windows\System\SdSpohU.exe
  2⤵
  PID:6884
- C:\Windows\System\gHriJCT.exe
  C:\Windows\System\gHriJCT.exe
  2⤵
  PID:5668
- C:\Windows\System\iMOtCXV.exe
  C:\Windows\System\iMOtCXV.exe
  2⤵
  PID:4620
- C:\Windows\System\WrqTIKp.exe
  C:\Windows\System\WrqTIKp.exe
  2⤵
  PID:6348
- C:\Windows\System\JdfUPCD.exe
  C:\Windows\System\JdfUPCD.exe
  2⤵
  PID:7072
- C:\Windows\System\lcSDfTa.exe
  C:\Windows\System\lcSDfTa.exe
  2⤵
  PID:320
- C:\Windows\System\micExZC.exe
  C:\Windows\System\micExZC.exe
  2⤵
  PID:6596
- C:\Windows\System\KMrDFdU.exe
  C:\Windows\System\KMrDFdU.exe
  2⤵
  PID:5360
- C:\Windows\System\JOwYwbg.exe
  C:\Windows\System\JOwYwbg.exe
  2⤵
  PID:6148
- C:\Windows\System\bqBjSTe.exe
  C:\Windows\System\bqBjSTe.exe
  2⤵
  PID:5800
- C:\Windows\System\WegMYiC.exe
  C:\Windows\System\WegMYiC.exe
  2⤵
  PID:5584
- C:\Windows\System\cIQLcFM.exe
  C:\Windows\System\cIQLcFM.exe
  2⤵
  PID:4624
- C:\Windows\System\PnNvTBG.exe
  C:\Windows\System\PnNvTBG.exe
  2⤵
  PID:5744
- C:\Windows\System\CdXHNYE.exe
  C:\Windows\System\CdXHNYE.exe
  2⤵
  PID:2724
- C:\Windows\System\rzOIvFi.exe
  C:\Windows\System\rzOIvFi.exe
  2⤵
  PID:13824
- C:\Windows\System\pxKlHjE.exe
  C:\Windows\System\pxKlHjE.exe
  2⤵
  PID:6620
- C:\Windows\System\BbvuPWa.exe
  C:\Windows\System\BbvuPWa.exe
  2⤵
  PID:5288
- C:\Windows\System\gxBvHWa.exe
  C:\Windows\System\gxBvHWa.exe
  2⤵
  PID:6572
- C:\Windows\System\BYtMiws.exe
  C:\Windows\System\BYtMiws.exe
  2⤵
  PID:11388
- C:\Windows\System\SkNlUxb.exe
  C:\Windows\System\SkNlUxb.exe
  2⤵
  PID:14504
- C:\Windows\System\bwiBInd.exe
  C:\Windows\System\bwiBInd.exe
  2⤵
  PID:14532
- C:\Windows\System\eCpTOFB.exe
  C:\Windows\System\eCpTOFB.exe
  2⤵
  PID:14556
- C:\Windows\System\DJwaRjx.exe
  C:\Windows\System\DJwaRjx.exe
  2⤵
  PID:14572
- C:\Windows\System\UXsLoBF.exe
  C:\Windows\System\UXsLoBF.exe
  2⤵
  PID:14592
- C:\Windows\System\zAlWmzQ.exe
  C:\Windows\System\zAlWmzQ.exe
  2⤵
  PID:14620
- C:\Windows\System\xkXZoeJ.exe
  C:\Windows\System\xkXZoeJ.exe
  2⤵
  PID:14648
- C:\Windows\System\pFqnCZH.exe
  C:\Windows\System\pFqnCZH.exe
  2⤵
  PID:14680
- C:\Windows\System\WGkpbhw.exe
  C:\Windows\System\WGkpbhw.exe
  2⤵
  PID:14716
- C:\Windows\System\ZJkBudj.exe
  C:\Windows\System\ZJkBudj.exe
  2⤵
  PID:14736
- C:\Windows\System\XDNykzn.exe
  C:\Windows\System\XDNykzn.exe
  2⤵
  PID:14856
- C:\Windows\System\qkGFttX.exe
  C:\Windows\System\qkGFttX.exe
  2⤵
  PID:14884
- C:\Windows\System\LgRYzDM.exe
  C:\Windows\System\LgRYzDM.exe
  2⤵
  PID:14904
- C:\Windows\System\wFVGhEc.exe
  C:\Windows\System\wFVGhEc.exe
  2⤵
  PID:14924
- C:\Windows\System\uzofdbN.exe
  C:\Windows\System\uzofdbN.exe
  2⤵
  PID:14956
- C:\Windows\System\COqpeDB.exe
  C:\Windows\System\COqpeDB.exe
  2⤵
  PID:14980
- C:\Windows\System\UFmZpzY.exe
  C:\Windows\System\UFmZpzY.exe
  2⤵
  PID:15004
- C:\Windows\System\ACBGpax.exe
  C:\Windows\System\ACBGpax.exe
  2⤵
  PID:15036
- C:\Windows\System\CIlulwC.exe
  C:\Windows\System\CIlulwC.exe
  2⤵
  PID:15064
- C:\Windows\System\bZGGfKB.exe
  C:\Windows\System\bZGGfKB.exe
  2⤵
  PID:15128
- C:\Windows\System\jXuHNct.exe
  C:\Windows\System\jXuHNct.exe
  2⤵
  PID:15144
- C:\Windows\System\ikgzgmz.exe
  C:\Windows\System\ikgzgmz.exe
  2⤵
  PID:15160
- C:\Windows\System\aLFTAmT.exe
  C:\Windows\System\aLFTAmT.exe
  2⤵
  PID:15176
- C:\Windows\System\WzSbwUR.exe
  C:\Windows\System\WzSbwUR.exe
  2⤵
  PID:15204
- C:\Windows\System\FMIlEjY.exe
  C:\Windows\System\FMIlEjY.exe
  2⤵
  PID:15220
- C:\Windows\System\KtQuaZP.exe
  C:\Windows\System\KtQuaZP.exe
  2⤵
  PID:15240
- C:\Windows\System\ZsiJjjN.exe
  C:\Windows\System\ZsiJjjN.exe
  2⤵
  PID:15256
- C:\Windows\System\qbWtGCc.exe
  C:\Windows\System\qbWtGCc.exe
  2⤵
  PID:15280
- C:\Windows\System\dPTmiMn.exe
  C:\Windows\System\dPTmiMn.exe
  2⤵
  PID:15324
- C:\Windows\System\mJdDnXL.exe
  C:\Windows\System\mJdDnXL.exe
  2⤵
  PID:15340
- C:\Windows\System\roUPtHX.exe
  C:\Windows\System\roUPtHX.exe
  2⤵
  PID:6480
- C:\Windows\System\nbngWOZ.exe
  C:\Windows\System\nbngWOZ.exe
  2⤵
  PID:6700
- C:\Windows\System\yTDjnPO.exe
  C:\Windows\System\yTDjnPO.exe
  2⤵
  PID:6604
- C:\Windows\System\IyedlmQ.exe
  C:\Windows\System\IyedlmQ.exe
  2⤵
  PID:6248
- C:\Windows\System\uajCHgi.exe
  C:\Windows\System\uajCHgi.exe
  2⤵
  PID:6776
- C:\Windows\System\TNiQhuw.exe
  C:\Windows\System\TNiQhuw.exe
  2⤵
  PID:7076
- C:\Windows\System\ZMFpjwv.exe
  C:\Windows\System\ZMFpjwv.exe
  2⤵
  PID:6576
- C:\Windows\System\UuKRxfi.exe
  C:\Windows\System\UuKRxfi.exe
  2⤵
  PID:14464
- C:\Windows\System\ZUYXMbU.exe
  C:\Windows\System\ZUYXMbU.exe
  2⤵
  PID:6860
- C:\Windows\System\CQRdyfd.exe
  C:\Windows\System\CQRdyfd.exe
  2⤵
  PID:14732
- C:\Windows\System\lhQUPWY.exe
  C:\Windows\System\lhQUPWY.exe
  2⤵
  PID:6180
- C:\Windows\System\JLyMRhq.exe
  C:\Windows\System\JLyMRhq.exe
  2⤵
  PID:1744
- C:\Windows\System\UuivcQo.exe
  C:\Windows\System\UuivcQo.exe
  2⤵
  PID:14368
- C:\Windows\System\hLUCeCT.exe
  C:\Windows\System\hLUCeCT.exe
  2⤵
  PID:14812
- C:\Windows\System\vCcRjkc.exe
  C:\Windows\System\vCcRjkc.exe
  2⤵
  PID:14828
- C:\Windows\System\OXHjdgF.exe
  C:\Windows\System\OXHjdgF.exe
  2⤵
  PID:4544
- C:\Windows\System\qxRidPu.exe
  C:\Windows\System\qxRidPu.exe
  2⤵
  PID:14640
- C:\Windows\System\zsfpYWj.exe
  C:\Windows\System\zsfpYWj.exe
  2⤵
  PID:7540
- C:\Windows\System\GSQHyOg.exe
  C:\Windows\System\GSQHyOg.exe
  2⤵
  PID:14748
- C:\Windows\System\feyedsC.exe
  C:\Windows\System\feyedsC.exe
  2⤵
  PID:6328
- C:\Windows\System\CCnrjzL.exe
  C:\Windows\System\CCnrjzL.exe
  2⤵
  PID:14416
- C:\Windows\System\zMkArrL.exe
  C:\Windows\System\zMkArrL.exe
  2⤵
  PID:14444
- C:\Windows\System\qsnqrTN.exe
  C:\Windows\System\qsnqrTN.exe
  2⤵
  PID:14408
- C:\Windows\System\OfBCfta.exe
  C:\Windows\System\OfBCfta.exe
  2⤵
  PID:14568
- C:\Windows\System\LYVzmCq.exe
  C:\Windows\System\LYVzmCq.exe
  2⤵
  PID:2476
- C:\Windows\System\YFXJPyP.exe
  C:\Windows\System\YFXJPyP.exe
  2⤵
  PID:15088
- C:\Windows\System\CrNvudU.exe
  C:\Windows\System\CrNvudU.exe
  2⤵
  PID:7840
- C:\Windows\System\gmBCJeg.exe
  C:\Windows\System\gmBCJeg.exe
  2⤵
  PID:7664
- C:\Windows\System\ltEsRgn.exe
  C:\Windows\System\ltEsRgn.exe
  2⤵
  PID:7556
- C:\Windows\System\rNADMbE.exe
  C:\Windows\System\rNADMbE.exe
  2⤵
  PID:7828
- C:\Windows\System\wojRoUW.exe
  C:\Windows\System\wojRoUW.exe
  2⤵
  PID:15200
- C:\Windows\System\dexBPce.exe
  C:\Windows\System\dexBPce.exe
  2⤵
  PID:14896
- C:\Windows\System\ozBlzSF.exe
  C:\Windows\System\ozBlzSF.exe
  2⤵
  PID:10668
- C:\Windows\System\VJIhImE.exe
  C:\Windows\System\VJIhImE.exe
  2⤵
  PID:15044
- C:\Windows\System\JFnUzsY.exe
  C:\Windows\System\JFnUzsY.exe
  2⤵
  PID:15136
- C:\Windows\System\gyDUONA.exe
  C:\Windows\System\gyDUONA.exe
  2⤵
  PID:15172
- C:\Windows\System\qyQVUuM.exe
  C:\Windows\System\qyQVUuM.exe
  2⤵
  PID:15296
- C:\Windows\System\MzqeYzH.exe
  C:\Windows\System\MzqeYzH.exe
  2⤵
  PID:15092
- C:\Windows\System\XyelIJi.exe
  C:\Windows\System\XyelIJi.exe
  2⤵
  PID:6336
- C:\Windows\System\OomDUUz.exe
  C:\Windows\System\OomDUUz.exe
  2⤵
  PID:7856
- C:\Windows\System\tfVDHHT.exe
  C:\Windows\System\tfVDHHT.exe
  2⤵
  PID:5224
- C:\Windows\System\dItssoL.exe
  C:\Windows\System\dItssoL.exe
  2⤵
  PID:5424
- C:\Windows\System\CVpxzCZ.exe
  C:\Windows\System\CVpxzCZ.exe
  2⤵
  PID:15192
- C:\Windows\System\nllEvMF.exe
  C:\Windows\System\nllEvMF.exe
  2⤵
  PID:15356
- C:\Windows\System\yHVuuTX.exe
  C:\Windows\System\yHVuuTX.exe
  2⤵
  PID:6556
- C:\Windows\System\MWxsfem.exe
  C:\Windows\System\MWxsfem.exe
  2⤵
  PID:6900
- C:\Windows\System\fpPvHxy.exe
  C:\Windows\System\fpPvHxy.exe
  2⤵
  PID:15268
- C:\Windows\System\IhyzqKr.exe
  C:\Windows\System\IhyzqKr.exe
  2⤵
  PID:6116
- C:\Windows\System\NJaPown.exe
  C:\Windows\System\NJaPown.exe
  2⤵
  PID:14488
- C:\Windows\System\OpnqgKV.exe
  C:\Windows\System\OpnqgKV.exe
  2⤵
  PID:1736
- C:\Windows\System\zWHAnXV.exe
  C:\Windows\System\zWHAnXV.exe
  2⤵
  PID:5336
- C:\Windows\System\VDPKepf.exe
  C:\Windows\System\VDPKepf.exe
  2⤵
  PID:12716
- C:\Windows\System\eGyLOfr.exe
  C:\Windows\System\eGyLOfr.exe
  2⤵
  PID:7316
- C:\Windows\System\hevZvPu.exe
  C:\Windows\System\hevZvPu.exe
  2⤵
  PID:5472
- C:\Windows\System\KHDXPnM.exe
  C:\Windows\System\KHDXPnM.exe
  2⤵
  PID:7592
- C:\Windows\System\LgYFsmj.exe
  C:\Windows\System\LgYFsmj.exe
  2⤵
  PID:14852
- C:\Windows\System\tNEUtFM.exe
  C:\Windows\System\tNEUtFM.exe
  2⤵
  PID:7544
- C:\Windows\System\DhRhjob.exe
  C:\Windows\System\DhRhjob.exe
  2⤵
  PID:13108
- C:\Windows\System\PNUpYMR.exe
  C:\Windows\System\PNUpYMR.exe
  2⤵
  PID:14440
- C:\Windows\System\vYSdOIh.exe
  C:\Windows\System\vYSdOIh.exe
  2⤵
  PID:728
- C:\Windows\System\YjDMLqi.exe
  C:\Windows\System\YjDMLqi.exe
  2⤵
  PID:14944
- C:\Windows\System\bLZvUaZ.exe
  C:\Windows\System\bLZvUaZ.exe
  2⤵
  PID:8996
- C:\Windows\System\vClEOZf.exe
  C:\Windows\System\vClEOZf.exe
  2⤵
  PID:852
- C:\Windows\System\NWkoTfE.exe
  C:\Windows\System\NWkoTfE.exe
  2⤵
  PID:8388
- C:\Windows\System\qGRrHxf.exe
  C:\Windows\System\qGRrHxf.exe
  2⤵
  PID:7568
- C:\Windows\System\yanWhFu.exe
  C:\Windows\System\yanWhFu.exe
  2⤵
  PID:15100
- C:\Windows\System\LpEOaSD.exe
  C:\Windows\System\LpEOaSD.exe
  2⤵
  PID:7848
- C:\Windows\System\vHQAKFN.exe
  C:\Windows\System\vHQAKFN.exe
  2⤵
  PID:7992
- C:\Windows\System\CJWRbrY.exe
  C:\Windows\System\CJWRbrY.exe
  2⤵
  PID:6380
- C:\Windows\System\mekfWBm.exe
  C:\Windows\System\mekfWBm.exe
  2⤵
  PID:880
- C:\Windows\System\MDrRXEL.exe
  C:\Windows\System\MDrRXEL.exe
  2⤵
  PID:8968
- C:\Windows\System\KmQerBv.exe
  C:\Windows\System\KmQerBv.exe
  2⤵
  PID:9120
- C:\Windows\System\MdQbPcv.exe
  C:\Windows\System\MdQbPcv.exe
  2⤵
  PID:5068
- C:\Windows\System\kxMgdYm.exe
  C:\Windows\System\kxMgdYm.exe
  2⤵
  PID:8488
- C:\Windows\System\aYGZrfP.exe
  C:\Windows\System\aYGZrfP.exe
  2⤵
  PID:7708
- C:\Windows\System\mnsqMkm.exe
  C:\Windows\System\mnsqMkm.exe
  2⤵
  PID:7760
- C:\Windows\System\DrAhLPd.exe
  C:\Windows\System\DrAhLPd.exe
  2⤵
  PID:15084
- C:\Windows\System\neRfyIx.exe
  C:\Windows\System\neRfyIx.exe
  2⤵
  PID:14808
- C:\Windows\System\XtRKNef.exe
  C:\Windows\System\XtRKNef.exe
  2⤵
  PID:7504
- C:\Windows\System\uyCrQru.exe
  C:\Windows\System\uyCrQru.exe
  2⤵
  PID:14516
- C:\Windows\System\IBGGFoV.exe
  C:\Windows\System\IBGGFoV.exe
  2⤵
  PID:7676
- C:\Windows\System\tsQKVps.exe
  C:\Windows\System\tsQKVps.exe
  2⤵
  PID:7320
- C:\Windows\System\ucYnrLT.exe
  C:\Windows\System\ucYnrLT.exe
  2⤵
  PID:8020
- C:\Windows\System\XERXxEb.exe
  C:\Windows\System\XERXxEb.exe
  2⤵
  PID:7880
- C:\Windows\System\nDscKkw.exe
  C:\Windows\System\nDscKkw.exe
  2⤵
  PID:9452
- C:\Windows\System\sTdjQTd.exe
  C:\Windows\System\sTdjQTd.exe
  2⤵
  PID:5656
- C:\Windows\System\DAvkZBH.exe
  C:\Windows\System\DAvkZBH.exe
  2⤵
  PID:7428
- C:\Windows\System\XzNYnko.exe
  C:\Windows\System\XzNYnko.exe
  2⤵
  PID:9204
- C:\Windows\System\FPiRJnO.exe
  C:\Windows\System\FPiRJnO.exe
  2⤵
  PID:9160
- C:\Windows\System\NhRmxXN.exe
  C:\Windows\System\NhRmxXN.exe
  2⤵
  PID:7236
- C:\Windows\System\AiwKdOw.exe
  C:\Windows\System\AiwKdOw.exe
  2⤵
  PID:12332
- C:\Windows\System\DMZBoLA.exe
  C:\Windows\System\DMZBoLA.exe
  2⤵
  PID:8504
- C:\Windows\System\GjuHAMd.exe
  C:\Windows\System\GjuHAMd.exe
  2⤵
  PID:9000
- C:\Windows\System\okOWUVN.exe
  C:\Windows\System\okOWUVN.exe
  2⤵
  PID:9428
- C:\Windows\System\PFYupzz.exe
  C:\Windows\System\PFYupzz.exe
  2⤵
  PID:14836
- C:\Windows\System\ZpAkAMG.exe
  C:\Windows\System\ZpAkAMG.exe
  2⤵
  PID:15096
- C:\Windows\System\FgjDvRP.exe
  C:\Windows\System\FgjDvRP.exe
  2⤵
  PID:8932
- C:\Windows\System\VujsKHt.exe
  C:\Windows\System\VujsKHt.exe
  2⤵
  PID:8956
- C:\Windows\System\DuFyPpS.exe
  C:\Windows\System\DuFyPpS.exe
  2⤵
  PID:7424
- C:\Windows\System\VHEcAvm.exe
  C:\Windows\System\VHEcAvm.exe
  2⤵
  PID:10092
- C:\Windows\System\FUixvHD.exe
  C:\Windows\System\FUixvHD.exe
  2⤵
  PID:7640
- C:\Windows\System\xjbIDwU.exe
  C:\Windows\System\xjbIDwU.exe
  2⤵
  PID:8352
- C:\Windows\System\DpBeyku.exe
  C:\Windows\System\DpBeyku.exe
  2⤵
  PID:8400
- C:\Windows\System\lDIxwmL.exe
  C:\Windows\System\lDIxwmL.exe
  2⤵
  PID:9504
- C:\Windows\System\oxBXswM.exe
  C:\Windows\System\oxBXswM.exe
  2⤵
  PID:9192
- C:\Windows\System\wKyEopk.exe
  C:\Windows\System\wKyEopk.exe
  2⤵
  PID:8424
- C:\Windows\System\nDpeiBX.exe
  C:\Windows\System\nDpeiBX.exe
  2⤵
  PID:10856
- C:\Windows\System\CGIqgdP.exe
  C:\Windows\System\CGIqgdP.exe
  2⤵
  PID:10208
- C:\Windows\System\bVxDryv.exe
  C:\Windows\System\bVxDryv.exe
  2⤵
  PID:9704
- C:\Windows\System\PLhYgVR.exe
  C:\Windows\System\PLhYgVR.exe
  2⤵
  PID:15312
- C:\Windows\System\Rcrhlec.exe
  C:\Windows\System\Rcrhlec.exe
  2⤵
  PID:9520
- C:\Windows\System\HRsIWfm.exe
  C:\Windows\System\HRsIWfm.exe
  2⤵
  PID:10752
- C:\Windows\System\NybyFUe.exe
  C:\Windows\System\NybyFUe.exe
  2⤵
  PID:10692
- C:\Windows\System\wqMTgpI.exe
  C:\Windows\System\wqMTgpI.exe
  2⤵
  PID:9476
- C:\Windows\System\pdxrXkA.exe
  C:\Windows\System\pdxrXkA.exe
  2⤵
  PID:13712
- C:\Windows\System\wYajWgN.exe
  C:\Windows\System\wYajWgN.exe
  2⤵
  PID:14040
- C:\Windows\System\XdEZZGX.exe
  C:\Windows\System\XdEZZGX.exe
  2⤵
  PID:11040
- C:\Windows\System\rcHoPlf.exe
  C:\Windows\System\rcHoPlf.exe
  2⤵
  PID:10524
- C:\Windows\System\TWXUBHY.exe
  C:\Windows\System\TWXUBHY.exe
  2⤵
  PID:9144
- C:\Windows\System\QSAgSmE.exe
  C:\Windows\System\QSAgSmE.exe
  2⤵
  PID:14080
- C:\Windows\System\aZrmbQE.exe
  C:\Windows\System\aZrmbQE.exe
  2⤵
  PID:9420
- C:\Windows\System\JItjQTK.exe
  C:\Windows\System\JItjQTK.exe
  2⤵
  PID:10448
- C:\Windows\System\soXrOfI.exe
  C:\Windows\System\soXrOfI.exe
  2⤵
  PID:11076
- C:\Windows\System\nFUYqzy.exe
  C:\Windows\System\nFUYqzy.exe
  2⤵
  PID:9956
- C:\Windows\System\pnlkOkf.exe
  C:\Windows\System\pnlkOkf.exe
  2⤵
  PID:14524
- C:\Windows\System\cPCRnCE.exe
  C:\Windows\System\cPCRnCE.exe
  2⤵
  PID:11092
- C:\Windows\System\LjUmxWS.exe
  C:\Windows\System\LjUmxWS.exe
  2⤵
  PID:14108
- C:\Windows\System\vupWgzw.exe
  C:\Windows\System\vupWgzw.exe
  2⤵
  PID:10672
- C:\Windows\System\OLcOBvC.exe
  C:\Windows\System\OLcOBvC.exe
  2⤵
  PID:14220
- C:\Windows\System\SgqaVen.exe
  C:\Windows\System\SgqaVen.exe
  2⤵
  PID:10900
- C:\Windows\System\kciXmlH.exe
  C:\Windows\System\kciXmlH.exe
  2⤵
  PID:8392
- C:\Windows\System\sVpJIHK.exe
  C:\Windows\System\sVpJIHK.exe
  2⤵
  PID:10140
- C:\Windows\System\hRLvbNq.exe
  C:\Windows\System\hRLvbNq.exe
  2⤵
  PID:8864
- C:\Windows\System\MITWoqv.exe
  C:\Windows\System\MITWoqv.exe
  2⤵
  PID:10956
- C:\Windows\System\zLkphGB.exe
  C:\Windows\System\zLkphGB.exe
  2⤵
  PID:10912
- C:\Windows\System\bnhOTgm.exe
  C:\Windows\System\bnhOTgm.exe
  2⤵
  PID:10932
- C:\Windows\System\wsjHAXf.exe
  C:\Windows\System\wsjHAXf.exe
  2⤵
  PID:14312
- C:\Windows\System\CTzlXGC.exe
  C:\Windows\System\CTzlXGC.exe
  2⤵
  PID:8480
- C:\Windows\System\zSHKwTc.exe
  C:\Windows\System\zSHKwTc.exe
  2⤵
  PID:8268
- C:\Windows\System\ZSOSOLn.exe
  C:\Windows\System\ZSOSOLn.exe
  2⤵
  PID:10952
- C:\Windows\System\mTVfrPG.exe
  C:\Windows\System\mTVfrPG.exe
  2⤵
  PID:7712
- C:\Windows\System\foZouWr.exe
  C:\Windows\System\foZouWr.exe
  2⤵
  PID:11104
- C:\Windows\System\BTcDfJv.exe
  C:\Windows\System\BTcDfJv.exe
  2⤵
  PID:11124
- C:\Windows\System\CfeQWUJ.exe
  C:\Windows\System\CfeQWUJ.exe
  2⤵
  PID:11164
- C:\Windows\System\RYNpGlv.exe
  C:\Windows\System\RYNpGlv.exe
  2⤵
  PID:11180
- C:\Windows\System\nYZjHWV.exe
  C:\Windows\System\nYZjHWV.exe
  2⤵
  PID:14656
- C:\Windows\System\sfVYipr.exe
  C:\Windows\System\sfVYipr.exe
  2⤵
  PID:10868
- C:\Windows\System\uxvTDHJ.exe
  C:\Windows\System\uxvTDHJ.exe
  2⤵
  PID:10964
- C:\Windows\System\eLPZRwk.exe
  C:\Windows\System\eLPZRwk.exe
  2⤵
  PID:8448
- C:\Windows\System\TiaLJWv.exe
  C:\Windows\System\TiaLJWv.exe
  2⤵
  PID:11248
- C:\Windows\System\ZXTiOox.exe
  C:\Windows\System\ZXTiOox.exe
  2⤵
  PID:11204
- C:\Windows\System\XPZVZYt.exe
  C:\Windows\System\XPZVZYt.exe
  2⤵
  PID:10988
- C:\Windows\System\aZWmhdp.exe
  C:\Windows\System\aZWmhdp.exe
  2⤵
  PID:9132
- C:\Windows\System\lkQxadM.exe
  C:\Windows\System\lkQxadM.exe
  2⤵
  PID:11028
- C:\Windows\System\BnSADBq.exe
  C:\Windows\System\BnSADBq.exe
  2⤵
  PID:9056
- C:\Windows\System\aLisSpo.exe
  C:\Windows\System\aLisSpo.exe
  2⤵
  PID:10980
- C:\Windows\System\vOLGjTi.exe
  C:\Windows\System\vOLGjTi.exe
  2⤵
  PID:9296
- C:\Windows\System\USxQwHk.exe
  C:\Windows\System\USxQwHk.exe
  2⤵
  PID:10112
- C:\Windows\System\vKzLtrM.exe
  C:\Windows\System\vKzLtrM.exe
  2⤵
  PID:7688
- C:\Windows\System\rCiDkhI.exe
  C:\Windows\System\rCiDkhI.exe
  2⤵
  PID:11032
- C:\Windows\System\xRJDIJy.exe
  C:\Windows\System\xRJDIJy.exe
  2⤵
  PID:12312
- C:\Windows\System\hhQUQuN.exe
  C:\Windows\System\hhQUQuN.exe
  2⤵
  PID:8700
- C:\Windows\System\hKSJjwi.exe
  C:\Windows\System\hKSJjwi.exe
  2⤵
  PID:9252
- C:\Windows\System\phvBCOE.exe
  C:\Windows\System\phvBCOE.exe
  2⤵
  PID:11220
- C:\Windows\System\AWrzemh.exe
  C:\Windows\System\AWrzemh.exe
  2⤵
  PID:8532
- C:\Windows\System\nsUrXKB.exe
  C:\Windows\System\nsUrXKB.exe
  2⤵
  PID:13692
- C:\Windows\System\pgkjoqb.exe
  C:\Windows\System\pgkjoqb.exe
  2⤵
  PID:10296
- C:\Windows\System\FxYjKFa.exe
  C:\Windows\System\FxYjKFa.exe
  2⤵
  PID:424
- C:\Windows\System\XTSNJcB.exe
  C:\Windows\System\XTSNJcB.exe
  2⤵
  PID:9928
- C:\Windows\System\CeXsYlo.exe
  C:\Windows\System\CeXsYlo.exe
  2⤵
  PID:11240
- C:\Windows\System\JmOkdMU.exe
  C:\Windows\System\JmOkdMU.exe
  2⤵
  PID:9880
- C:\Windows\System\nlxgoDP.exe
  C:\Windows\System\nlxgoDP.exe
  2⤵
  PID:8208
- C:\Windows\System\AGvoubO.exe
  C:\Windows\System\AGvoubO.exe
  2⤵
  PID:11564
- C:\Windows\System\ESRaOCE.exe
  C:\Windows\System\ESRaOCE.exe
  2⤵
  PID:11208
- C:\Windows\System\PViAbNB.exe
  C:\Windows\System\PViAbNB.exe
  2⤵
  PID:11316
- C:\Windows\System\ihIsHNd.exe
  C:\Windows\System\ihIsHNd.exe
  2⤵
  PID:11444
- C:\Windows\System\vUEEenS.exe
  C:\Windows\System\vUEEenS.exe
  2⤵
  PID:11508
- C:\Windows\System\HjEFdLB.exe
  C:\Windows\System\HjEFdLB.exe
  2⤵
  PID:10920
- C:\Windows\System\cUrajJA.exe
  C:\Windows\System\cUrajJA.exe
  2⤵
  PID:13860
- C:\Windows\System\aEqVEBI.exe
  C:\Windows\System\aEqVEBI.exe
  2⤵
  PID:400
- C:\Windows\System\oKTFGUs.exe
  C:\Windows\System\oKTFGUs.exe
  2⤵
  PID:9212
- C:\Windows\System\HRmQfmk.exe
  C:\Windows\System\HRmQfmk.exe
  2⤵
  PID:11788
- C:\Windows\System\gqZvzLM.exe
  C:\Windows\System\gqZvzLM.exe
  2⤵
  PID:11836
- C:\Windows\System\yzmpyDu.exe
  C:\Windows\System\yzmpyDu.exe
  2⤵
  PID:10400
- C:\Windows\System\ChxuFKz.exe
  C:\Windows\System\ChxuFKz.exe
  2⤵
  PID:11860
- C:\Windows\System\BziPXDp.exe
  C:\Windows\System\BziPXDp.exe
  2⤵
  PID:908

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 560 -p 12812 -ip 12812
1⤵
PID:12232

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13472

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:13984

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:14308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_cuh5lsfh.ynu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cuh5lsfh.ynu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AQjIrDy.exe

Path C:\Windows\System\AQjIrDy.exe
Size 1.7MB
SHA256 b0e79accd03721b06cd971ad85213919352c67a3f932b61ecfb359f7adc0b08c
MD5 548c56616dfdeffb97e5ff383aed4dc0
SHA1 264bf0db18020d8c2d47c615b65a4a9637882e6f
SHA512 ac2dee7bb41b0503613ff40abc83c6549c05e54a654532c66cd4bd56f7216175b4e9dcfce7e856bdabbda5e1cffb3c5d35c2c4cf5b599f06067931948bffdeb3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qr:Lz071uv4BPMkHC0I6Gz3N1pHP771x
MD5 SHA1 SHA512 SSDEEP

Submit Download

AYpqtYp.exe

Path C:\Windows\System\AYpqtYp.exe
Size 1.7MB
SHA256 6b11da1a92b9539354ebae9ce58a3643087578c72a18a6e8394e7591b577b923
MD5 885c69cb1c6f130e3021134ccd6718ad
SHA1 ad4693e42cd70413c9eb820032c124ed0145e661
SHA512 c836c91874ac51443a3731a5e530c69115e5b230d326df963b70f8cb788d79d247e01e273b0ff5d57fb8f3f59f92b94881bd7984488f5daf0cc52171a8c75530
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qV:Lz071uv4BPMkHC0I6Gz3N1pHP771n
MD5 SHA1 SHA512 SSDEEP

Submit Download

BAbpcxz.exe

Path C:\Windows\System\BAbpcxz.exe
Size 1.7MB
SHA256 5c742362746926a29103b9766177d7045454d76627272d3ffda33c38a37bd0b9
MD5 f7ced9ce10dd9e3eb4ab9e2047ef6fd0
SHA1 7d3099cbde5f4bacf461467a1218b446ccd22ad2
SHA512 f16a4f7e9f79b1c68a338bcf7a6abd8ecafa7c6ea20c2deb107df6499f018ace3c13a0a5b4f11792304a527c5411793498b87cc03dc09cf1c1383e25248d6eea
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2q8:Lz071uv4BPMkHC0I6Gz3N1pHP771AF
MD5 SHA1 SHA512 SSDEEP

Submit Download

CMmTKjM.exe

Path C:\Windows\System\CMmTKjM.exe
Size 1.7MB
SHA256 39c2a166384c3f10e4a3f2167946c5185994e9017044156a94c2656a3f6a9f8b
MD5 da024b7039a430b81b2ec007374728ca
SHA1 1177bbaf851bb9b7f953c6c26ab2cf5d61784338
SHA512 4f40f66ff7e2f9a4e8f6573fb4dbc3013e210001a245b7b9da873c849d234996ddb64860146eb6beb20770cc945f0d9d16821e0098a49c7fbb32190e48460277
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qc:Lz071uv4BPMkHC0I6Gz3N1pHP771K
MD5 SHA1 SHA512 SSDEEP

Submit Download

COxrDWv.exe

Path C:\Windows\System\COxrDWv.exe
Size 1.7MB
SHA256 7ada4295ba17ba916161adbc2ad70b6c671d8342db5ee5dae46579e789ad6cf7
MD5 e17702467e8808cddfbb7c89ff61bd96
SHA1 b73a27f5e87c37d3ee796a2f37810c23a1242459
SHA512 bba21266d625b61821263baf43d5bd9e593e2fe6506cc4e20dffe1a211266085c32d3ff6dceb4599ba7c68af09a593235ccaee78e7ffbfc996c08df20a527fd7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qO:Lz071uv4BPMkHC0I6Gz3N1pHP7714
MD5 SHA1 SHA512 SSDEEP

Submit Download

CVykZtl.exe

Path C:\Windows\System\CVykZtl.exe
Size 1.7MB
SHA256 1ecdb877d8b3022b0a2b3561e6a976e76696ac75ee236e04e9526bf7d6436c67
MD5 905ac14ea51a91aa8f2d0fc476f75fdc
SHA1 0b1a10d11ee03dad77c13f5a61a80295ad65bdbe
SHA512 7852f39aa901f7a8258f2987992674f9060385f01bd1bc8403044a2269df306686a5139b12c6a6a6c6bc645637af15082b62593e1a70de7b34cd46a6cf0bdb26
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qV:Lz071uv4BPMkHC0I6Gz3N1pHP771L
MD5 SHA1 SHA512 SSDEEP

Submit Download

DSqzOsG.exe

Path C:\Windows\System\DSqzOsG.exe
Size 1.7MB
SHA256 8c28da3184c52abdaaa31dd91ced3e2f346a9b0d3312b3a1073860ea7c840a80
MD5 5d125d50d0c2a49ce5b1925e485aae67
SHA1 e90ff0b01149a2620776fe217b9b108abc7fdb41
SHA512 4463d5b9a5e1c52e7d7d4149e5d8e86a8882fb97979767bdcf4a9903636aa2f9967b248c52facaa433b1ff7a9311a6f9a4a70c3cdccbbb87ec1aa154fe5fed0a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qt:Lz071uv4BPMkHC0I6Gz3N1pHP771f
MD5 SHA1 SHA512 SSDEEP

Submit Download

DkdQoHJ.exe

Path C:\Windows\System\DkdQoHJ.exe
Size 1.7MB
SHA256 cbb7f54751628e7c9b4ceaece103208b1165f1deb120cf27ae8028fb370e1ccd
MD5 d83d556f2823406aab3d867d16942c04
SHA1 15308b6a54db3ed7501e2e54754d07e31c85685b
SHA512 2c0f7b06ad67b670d010a403cd8058e8d8a1fb16cfb7905d6d8448501590a029b8e1d15c1181584a85122476cc885d107c609a378ba3c659c82ae80c9ef3a652
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2q1:Lz071uv4BPMkHC0I6Gz3N1pHP771L
MD5 SHA1 SHA512 SSDEEP

Submit Download

ErHDlgr.exe

Path C:\Windows\System\ErHDlgr.exe
Size 1.7MB
SHA256 5cfd2b2c6b92241578e44e576d6a342af1fd9991d68b5da91117c9262a59d6ed
MD5 4f75a4849d3bd94d0999486977276673
SHA1 48d57dd249b203e82b8b09ea736f5544c7b7758d
SHA512 e21c8dce366744a953730a2c923e491de49dd94525c791d20423fa2e0c33ea63850290b146a31be854d071669c032d9a70072ce7a77ad8cf83be4e0c6306767c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qi:Lz071uv4BPMkHC0I6Gz3N1pHP771U
MD5 SHA1 SHA512 SSDEEP

Submit Download

FVapZpV.exe

Path C:\Windows\System\FVapZpV.exe
Size 1.7MB
SHA256 d48f8d2fccc90cc652253db6d95afa42d4d5d3bddc5e02912479ed6fbf30fc4a
MD5 2892384b14d4a1235c96acb9b1e728db
SHA1 0ae4220faa5beeba586c1340e56694ca6f0efd0b
SHA512 d36169a09070bc00ba7670aec485bb437b2c6b8f7eb39c5d254bff7453da1c1b0bef289e5802c8663350bab5f6385fb4f8910824c8e117603b49f397e9af692e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qW:Lz071uv4BPMkHC0I6Gz3N1pHP771c
MD5 SHA1 SHA512 SSDEEP

Submit Download

FerEafY.exe

Path C:\Windows\System\FerEafY.exe
Size 1.7MB
SHA256 78457d6daf43cb986a7ed17ca15836a2493d20573ae97d7c653d71e05c3a5429
MD5 587a55d1561e55e19356d50c422b3b02
SHA1 c5b40c703e2027e575ad9ccab54af83a9aaaeaeb
SHA512 a523182a90e51de4ba421b16b180a20ca0cc783516e5cf8c3dc9f65208bd7581a80e6a2303c433b80d2058f014b71f31ae798a9ad233bea027458fdd6df1cc29
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qz:Lz071uv4BPMkHC0I6Gz3N1pHP771Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

FofticC.exe

Path C:\Windows\System\FofticC.exe
Size 1.7MB
SHA256 3225c7933fe554a5ab2d712207b42fd07daca1c6b7288bd8cb673f95379f4a3a
MD5 83176213dc6fe9727d9d7079963a385b
SHA1 eeabaeaf910fa1329cf6c6b8be9cec1ac61a6e9d
SHA512 88f1884d6b47692d20b8d49c623dac36602b753148d0f2402829077fa55f6b091eb3b6788f3c754c752f7a152236a8752fbbf70418ad78abacec33fde8435c4c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qg:Lz071uv4BPMkHC0I6Gz3N1pHP771G
MD5 SHA1 SHA512 SSDEEP

Submit Download

FyPmrxp.exe

Path C:\Windows\System\FyPmrxp.exe
Size 1.7MB
SHA256 ee2add2fa37c55cbffc2bf255c49036b510087392fa2fcda86ff8279c7606bb1
MD5 130336998ad0bf5667f9e25fa940137a
SHA1 93ebe75de8d9dcc76f161bb9c166b9e266585c3b
SHA512 138dc5be053f787cab80482200d14f72cf47d92d9e3f1ba0bd253a9ffce11dcf5ebe128910d3a12aa1166d15a3d2f1fb88d96464f4160fea533d64dceff7e483
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qT:Lz071uv4BPMkHC0I6Gz3N1pHP771yK
MD5 SHA1 SHA512 SSDEEP

Submit Download

IyvSdgf.exe

Path C:\Windows\System\IyvSdgf.exe
Size 1.7MB
SHA256 3ec832d27095f35398f413b513e0f8333feb2f0e701e46b7d1ae4ea8d56a4a71
MD5 eeae4ea24b1d86d7a966e628c6ec4e90
SHA1 825f9abd52ba04a0b1e999c6b1d865e0af6ec694
SHA512 90d6389c92dbfc3b31f06886b043c1ec2d4607d29dd88037f0dfe4423230251b7f481142a3f17ffa1d349599331e2883eb7fc883d2f24df07957e0e1dc1ea74e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2q0:Lz071uv4BPMkHC0I6Gz3N1pHP771O
MD5 SHA1 SHA512 SSDEEP

Submit Download

KXXlpsO.exe

Path C:\Windows\System\KXXlpsO.exe
Size 1.7MB
SHA256 982892179a7cfb06f7a05b4d75b7f5c5b06273a44880d36ed5ab1196b28f8e58
MD5 b33fd50c898329b0ba793025efa1eabf
SHA1 b5b7cbad9147492f83765df67669cd48e4bcb1d9
SHA512 07dac3034c47a6bda4a42783ba599a83f0496eb5a773c99fef50ab1210b9528264ab58b346d17422a49d195eb80fa2d1117258564dc1ae041c47b1f287e199be
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qc:Lz071uv4BPMkHC0I6Gz3N1pHP771w3
MD5 SHA1 SHA512 SSDEEP

Submit Download

LctOpZo.exe

Path C:\Windows\System\LctOpZo.exe
Size 1.7MB
SHA256 96d9efcc823d864533f85c14f3b7ca2b4d176e06ce64ea8452d9f48e483219e0
MD5 6aae6c5b5e481c63a192ef2bb92b0dfe
SHA1 7401e1f3d79ce0efa65bce660b8b2e91468491e8
SHA512 a55118288ce229c73b86f0a2d38a83e3ddedf71dc56ecfe7b46b60e80eb3e9c149b9d427cc5ebc4aa729a06f51c2a8bf829e278a1c21bc5ed0311d864c43103f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qk:Lz071uv4BPMkHC0I6Gz3N1pHP771W
MD5 SHA1 SHA512 SSDEEP

Submit Download

LpBUOJa.exe

Path C:\Windows\System\LpBUOJa.exe
Size 1.7MB
SHA256 d6ff23ff60f953e7c61f444a9b07991c0096b2a7484317e686fda7bac810bef6
MD5 03c534f357a4a33ef30fb35187e4cdf7
SHA1 cda9360873034760fde71a71e28e8d47fedb25e0
SHA512 a859f7e6936ac14914b21824c93c453332b1471b5cb2e61301de96a28cc3ea0ccb59edc2106b26ceb57ebb413e077220cfbb19eb4f26deb5b026d12b56728f77
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qU:Lz071uv4BPMkHC0I6Gz3N1pHP771y
MD5 SHA1 SHA512 SSDEEP

Submit Download

LzGJsqB.exe

Path C:\Windows\System\LzGJsqB.exe
Size 1.7MB
SHA256 e40ef0996151045da39bbfc938307574bd932506d735da847c6478e8c80a8bd7
MD5 0351e41a382a9ed39aa4195d5e1f851c
SHA1 4b10ef7b35c29653e645201759979cf7f6e8105f
SHA512 1ade0677c73807d516ee6451ff7cb3ef4ba842a14eaeb122fc628b3e33e19d238b097fd0954867f5ebf204670e38baf3df49d5b4c924655cc96f428b5cb01bd3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qa:Lz071uv4BPMkHC0I6Gz3N1pHP771A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Muwueiq.exe

Path C:\Windows\System\Muwueiq.exe
Size 1.7MB
SHA256 b5fe65af956ee62082a1c23282bfa34c5154f210a6197a5ca398a31be7a34aad
MD5 ef14c0e3bef0757240d02bdc09bf4050
SHA1 87b6eaef129526027298d7f8485455937fb65282
SHA512 a21c6e2bf1cd3f49849f37dd1d48a9a8ccf69952eeaa611f1e030e0c7190fc7afb1bdabad115d7831ec7dad5bb4d7571e635be9990f39e83fb22741ddae68937
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qq:Lz071uv4BPMkHC0I6Gz3N1pHP7718
MD5 SHA1 SHA512 SSDEEP

Submit Download

ObclgZh.exe

Path C:\Windows\System\ObclgZh.exe
Size 1.7MB
SHA256 2e2340d2ecabe6385e3b91b32e245084a6ebba61d1a9293fe6133494983b288e
MD5 dc8b4426160354c51f5d405a67d7192c
SHA1 7e4221aa9cbedac3ca4c3aaf4d55b6447eb760ae
SHA512 471760f1781c52727a5d7a04ee3192b47612dcbb13b83af6ad8e509741dbe234b219d5534167a8dd217382d33a922d79d9e7bb80bb2c61f14574b960732f95f1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2q+:Lz071uv4BPMkHC0I6Gz3N1pHP771Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

PJPPwVW.exe

Path C:\Windows\System\PJPPwVW.exe
Size 1.7MB
SHA256 fcf2da26b9c01b343b8077a705bc6b86a50b65a9352e487e2672b55180040971
MD5 a1cebcac5357dc8d5d29408d0bbbba59
SHA1 bc07074489af36059371abd209c957ce58f59ee9
SHA512 cef313c7ffa49a71cbe59616bdb19cab26003229dc261f1963a35defd5c1bb183b63902bee0e271bc16093f2f33ee5f64b242ee1e7ccbb76ad56a3d95569ff67
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qx:Lz071uv4BPMkHC0I6Gz3N1pHP771X
MD5 SHA1 SHA512 SSDEEP

Submit Download

RredidN.exe

Path C:\Windows\System\RredidN.exe
Size 1.7MB
SHA256 d2a3e5ae8477ed780bc429f60db03f8aa6ce9337a0733b6d974220e5983f17e2
MD5 93b06a5908317939b0d6a08bdff248bb
SHA1 b36c49a07fc391137d0da95eaab5ff3aca80b1e9
SHA512 0d399a01349367b9efb4ee8db0a16da908970c5b66a34ee36e945bc39fd9bbd4bd673fcb4d8d21c3a0432a9bdd7e4713d53a15e6c8c956333c142893891e133d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qu:Lz071uv4BPMkHC0I6Gz3N1pHP7714
MD5 SHA1 SHA512 SSDEEP

Submit Download

SNCVbDX.exe

Path C:\Windows\System\SNCVbDX.exe
Size 1.7MB
SHA256 e370cf21dca206563856cd0b4f682de7d30e5c00e66fc53aa725cc9a0f64aaa4
MD5 c3bf433837c1cea1e80ec101d7ac8c70
SHA1 57adca5d4c66a9893ae76e179c6927fb64cc536a
SHA512 3c33682c676e2348f293d436df7b119d59f37b7c12e17454d4844e59a1a40de2e177dee1a0a8cd919f9493ad6b53f6c466cdf289415e2ea68840e65eb6d2840d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qQ:Lz071uv4BPMkHC0I6Gz3N1pHP7712
MD5 SHA1 SHA512 SSDEEP

Submit Download

SovYyUa.exe

Path C:\Windows\System\SovYyUa.exe
Size 1.7MB
SHA256 3e8e6fb0ff6b199c9b1a4bce77cad193f9150918736713154a8083a8e4811741
MD5 20c2a13af377ba5cef8296b5acccf376
SHA1 4cbca1d4df0eec82cc90412c908f145e7cfdee14
SHA512 605badc9b444647dd3880aa81d7ef5b965122d533afcdc62cb89b47b7f861f97402ef735077296571c4be0c7073449b5790365a3762f529783a4300a8f69b2f0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2q2:Lz071uv4BPMkHC0I6Gz3N1pHP7714
MD5 SHA1 SHA512 SSDEEP

Submit Download

VMNaRAT.exe

Path C:\Windows\System\VMNaRAT.exe
Size 1.7MB
SHA256 7f633ee4af88fb41797e462240adb90dbc9908e2f695b747525e92d02c54ef5f
MD5 2fb75929651278d31f28bd35e8f43ebd
SHA1 de70ae8e57325c4d8ebed7b1ba7ec1bd3a9976eb
SHA512 47b8ed17849c89359bc536cc4ce0a8e0ca49e505343708498a8f864c3686e2ad60dc741c2de9264d5eb82a9d9053c06978600db3b5da5df6eb4f72c604413caf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qW:Lz071uv4BPMkHC0I6Gz3N1pHP771w
MD5 SHA1 SHA512 SSDEEP

Submit Download

XcLViSn.exe

Path C:\Windows\System\XcLViSn.exe
Size 1.7MB
SHA256 a01e87a26b7a862396c825808108526cb95fc46fe67112007a1723b94cdaa54a
MD5 012f6dcd8fa25c3ccc2673496d4f3c0d
SHA1 a8dfff6f1acae4e11800c5bab78d71606ac90196
SHA512 13c65f9e1314cce3a60e10f441ac4cacc19b078a14152d9c95f598137031d9f6dfe03a1a9f2ef72249c18940ec145eeb7e92be21218fcb2716b9c79f92d2b90a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2q8:Lz071uv4BPMkHC0I6Gz3N1pHP771u
MD5 SHA1 SHA512 SSDEEP

Submit Download

bwxWzUt.exe

Path C:\Windows\System\bwxWzUt.exe
Size 1.7MB
SHA256 82d0c39ffb6f6d0e95794609480d43d46f914a73b5904e33c3fab0358cf3618d
MD5 9eadf6fcb864782a67ead6cebcbe2266
SHA1 987c9ccf6fe8c40f39c65ec716685932a2155234
SHA512 efb4a6e0b8669b936caa9a3e0fdeafc4175dfd8d5c81ae457cf6ed878e5b7ee6bc9063ac66050624250a4907665cb20df66eb60a8730f74ebbc4a5343ed6d812
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qS:Lz071uv4BPMkHC0I6Gz3N1pHP771k
MD5 SHA1 SHA512 SSDEEP

Submit Download

cSKSZwg.exe

Path C:\Windows\System\cSKSZwg.exe
Size 1.7MB
SHA256 9d87ccf07cc4fd3a6bb84d6a0e678a9bd038a0a71dd9c88da718b049a9aebdad
MD5 48e3f5256e921f1956eaa71e6499888f
SHA1 a6dd43ec774f34d720289c549c0f61d444c2845a
SHA512 53baf07201847b42ef9224cd5e40322acafc0af46f1974f7204dfbd4abdac672578da9fddbf46d5687bc406620a3bd200aabb9206fb3af048ca4d41bf59e1757
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2q8:Lz071uv4BPMkHC0I6Gz3N1pHP771W
MD5 SHA1 SHA512 SSDEEP

Submit Download

cvFlqxy.exe

Path C:\Windows\System\cvFlqxy.exe
Size 1.7MB
SHA256 744fe25ba0cad044b7173d033fd936bf36c8ea4abb0f427a0603d3afb384327b
MD5 574a4759f9b9724668ecfc8daaac3b51
SHA1 8bcea56d00e2a0e79fa6f992465bfa95914d9fd8
SHA512 bd6cfa9e99deccc8b46eb9b8778828fcd3863f9752c2562c978001d7029fb18161a836720868cd9c45661791915ee9191c537302e8725240b60f2aa9285e5fe3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qE:Lz071uv4BPMkHC0I6Gz3N1pHP771K
MD5 SHA1 SHA512 SSDEEP

Submit Download

dXDeAzv.exe

Path C:\Windows\System\dXDeAzv.exe
Size 1.7MB
SHA256 27ff9b5800d47785bad7dbd1b0dcb51e2d9ea6e8a1982e2474d1ae2688aa39b2
MD5 ccb0b583eb27b0d85af49720369b0f03
SHA1 9b6a152b10c17a3ea2c4464f855175dfdf7d99e3
SHA512 80e968c74b7110872f77a1335832b96819d525a4ad79cf3913870c73726cabf0df56a11c9c27b5dac9ce6d0a2f65fed13608f80c8aa29512b9d316a51e48545b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qq:Lz071uv4BPMkHC0I6Gz3N1pHP771nA
MD5 SHA1 SHA512 SSDEEP

Submit Download

eMdqHHu.exe

Path C:\Windows\System\eMdqHHu.exe
Size 1.7MB
SHA256 d8019f1215b901b5d13315cabf2ca2e63fb768398ddf63aeee6f181670827c3b
MD5 a2a4482061a26b6a57a232be3bde53c8
SHA1 c5752d374a8d833da3dd43407a989cf6123057b6
SHA512 f77ded1e59da4a4a299a76251551fd29f30aa5f8054914a202478205853cc5760700fc728bc878b4c80fb496505138c6c6c7770fc46a2b340adeb95eb809c470
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qY:Lz071uv4BPMkHC0I6Gz3N1pHP771K
MD5 SHA1 SHA512 SSDEEP

Submit Download

hUwvYHD.exe

Path C:\Windows\System\hUwvYHD.exe
Size 1.7MB
SHA256 3b764b7dda82f4141563aae0f5cd9216047ddb6d5f91bd6fb8df3234eb876d32
MD5 817f9c390c1e68b7b9078531d6336711
SHA1 993ce47787396be43e896433dcf217248dce6f0f
SHA512 27d8d853ce037dad0ba5c99aad7f59b863dbbf1d761c1909d01c61ab4a4068ebf9b4ff53ea3784989ede4b04dd7b772f1178ea699cd9dcb3869ff5de341c2ae9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qm:Lz071uv4BPMkHC0I6Gz3N1pHP771k
MD5 SHA1 SHA512 SSDEEP

Submit Download

jtxrxoT.exe

Path C:\Windows\System\jtxrxoT.exe
Size 1.7MB
SHA256 1586e9e0ebb1e775b7b563385b8a762351c064f5b34b9787c22c61b7f6b0c200
MD5 140eaf7c8b8fb151044b8ee6e1bc18f8
SHA1 b62b447c9630952a6a5b373ea64777c2584b6da3
SHA512 b72f3f2fd73e95da5f665fb76b36f946ff5954be78038ede6adabadd8aa3f438783930d12b9ac80d3d3c64b5f12e45e341483e42e583815c63e377200a0cb400
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qY:Lz071uv4BPMkHC0I6Gz3N1pHP7716
MD5 SHA1 SHA512 SSDEEP

Submit Download

kJPPyjn.exe

Path C:\Windows\System\kJPPyjn.exe
Size 1.7MB
SHA256 677d9ff0947df8241cae344277bfdda7b9ab0f1654945bdaf8b9bfb54b102d1d
MD5 185f6d187c5e00520aaa97c92916d044
SHA1 ded4e73fe05fa342ec348610582d2de9599c7521
SHA512 6a888f66fd1b1004df7ac305b79e3bd6ba77e1be4aa1f3e21e9efec790e0fbc2fe5aa120a17144c908bed93712e59242ad4bdb7e8e16aeb2f02bbcd708ad86ca
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qg:Lz071uv4BPMkHC0I6Gz3N1pHP771i
MD5 SHA1 SHA512 SSDEEP

Submit Download

kRdJwWV.exe

Path C:\Windows\System\kRdJwWV.exe
Size 1.7MB
SHA256 616f5bde9edc31f31cb4d855442fb3f0ac2c4271ae63cc43100a021f58e2b325
MD5 1767c534e4264246865e93ced77eb6ca
SHA1 4cf5fd163e7cf92025756e30e5b9597ac2063583
SHA512 447294fe1649c067a704a2aab5b3e027ef7c98c2db19778134560c86348010763c77a9aaed87a25f9faf3ff019b2d4b3c550f432b649c44d204ec4b1b460554c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qC:Lz071uv4BPMkHC0I6Gz3N1pHP771A
MD5 SHA1 SHA512 SSDEEP

Submit Download

kyyIfDx.exe

Path C:\Windows\System\kyyIfDx.exe
Size 1.7MB
SHA256 319e772e82148443f3ff008c77dc21b675408e48503e5517050f76b3a356ce4b
MD5 48635b17503531fe7e892400514d4849
SHA1 7ba6e15c59139d0871b52514d9681d1d7509d510
SHA512 333ba875e4ef14bcf82c879f450697f1b02d8100bd2b96b1d7514eaa42fb6f4b5d3303a8efda838e52ceba9d7207ee098580641134a681c0042ddda11158c7d0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qy:Lz071uv4BPMkHC0I6Gz3N1pHP771U
MD5 SHA1 SHA512 SSDEEP

Submit Download

nJjBexO.exe

Path C:\Windows\System\nJjBexO.exe
Size 18B
SHA256 43b95d43ff3c4c8a23dfabc8c7755e8c1158cc3fa7c378e542068cf3b68504de
MD5 0fafd0c6948102547e1533dc39738d8e
SHA1 34197619aec04515131528da328b27ef50b4ff82
SHA512 1bbc4c3e0698a57f9d1a7f764f034b85da7e58104dba3503749122f09427487087ffb68eae8ad13e8fec3b7a6d78cc9326b69a3378dcf69e135c901dd8ac8cb3
MD5 SHA1 SHA512

Submit Download

pLlXOIY.exe

Path C:\Windows\System\pLlXOIY.exe
Size 1.7MB
SHA256 4d70a63d6e0b9fd312e121003353fca27b1855613bb2ff4e82463e6704c2734e
MD5 1a3da3b0bdb93e2f8843d407946b656b
SHA1 0d46eb8c6995e0ce4a9a87449ce861ef0547acca
SHA512 3a58678e33014e43e8c3df056d99af7f90e77f08f997a28dfafb9b0fe5e8ede9152778a4f613923c2a8c605373dc232c8547e0de3b44feeebd9722b67c67423b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qX:Lz071uv4BPMkHC0I6Gz3N1pHP771x
MD5 SHA1 SHA512 SSDEEP

Submit Download

qZCMbCT.exe

Path C:\Windows\System\qZCMbCT.exe
Size 1.7MB
SHA256 9cd21ee441247e12b1db1899894ed4b9ebf99e715ac5e80be3143a79378571db
MD5 53d6c06e3710e0c4137db5278acc92ec
SHA1 db3e63de693de27d4d848914216cb837c3c20bca
SHA512 0210d41eaec11c28da12539808dffc4da93e1ac667ec782a6b9d98ed23757b03ae6e2f9f69bae55ab66f136c2c375b32dbbf346ed6efedfee20b866cc8861096
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qL:Lz071uv4BPMkHC0I6Gz3N1pHP771hn
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtFGLtG.exe

Path C:\Windows\System\rtFGLtG.exe
Size 1.7MB
SHA256 0e3652eeb4a457768156ed2ebb9f00547de89349b60a0b0e005c3ebd15f1cf7d
MD5 05176cef5efe26e5296f2e6a062d78a6
SHA1 e9d3f5d616e87ed9650a085e2a8ec29aa203a306
SHA512 1ea8fe7a2e1e07b6256595eddf4981c85def1c03cc83ac549f43f9d291ea2cab6b1f7356409c0c1284c157140a5a4e404b50482c4b8324b8e04976901c4d9ce0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qj:Lz071uv4BPMkHC0I6Gz3N1pHP771l
MD5 SHA1 SHA512 SSDEEP

Submit Download

thfNihg.exe

Path C:\Windows\System\thfNihg.exe
Size 1.7MB
SHA256 86275b81637f02d0dd5ff43e0bd937e968f6e2329b360d7bee50179c4ef92bdb
MD5 75dedbb1b25906c47c618171bc40e803
SHA1 33b2fb1d539826ea058aa4ab6e73002a1e3b8c78
SHA512 b204554844f5efb2118b39a2ea531378ae041043a9bcf2e292e29bbf2754afc758543db16d3418a8b257e235430b294b7e0fbea7dcb85eec9f9b94fdf02e3cd7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qo:Lz071uv4BPMkHC0I6Gz3N1pHP771+
MD5 SHA1 SHA512 SSDEEP

Submit Download

tkoXZyN.exe

Path C:\Windows\System\tkoXZyN.exe
Size 1.7MB
SHA256 ea712b321434bb79f2035a6a1721a68b48ed8acc993db5b83e4dd37eae9b4ce5
MD5 9aa22781ccb62c1bcdcd5964f5c92865
SHA1 03ebed9cd8c1fb58519802b92c66421bcf5330fa
SHA512 2db3969f245370c990af98d8e7df9d6ee68ae58678d30b111efb07531dae4868e310c37435279ad63ec2e8a2042f113d2e981debcdab6a6585745f5cd8263e5e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qL:Lz071uv4BPMkHC0I6Gz3N1pHP771N
MD5 SHA1 SHA512 SSDEEP

Submit Download

ugVIiaI.exe

Path C:\Windows\System\ugVIiaI.exe
Size 1.7MB
SHA256 7f44b111fbfff9f998d4638d70c880b94af7288d8dea22c3a17867eeee67c945
MD5 3783a69143330195992bc5c014b018af
SHA1 d1ea9524f538c7225a2bf97470fe301589b4603d
SHA512 ff8aa9c5931bda7ec62540cf01084c5543c925335e043ab61925202a12b0f832d92b8802fd848ff62431f2e504200a0d63088acd87407ca8861f43ac22bf0e73
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qW:Lz071uv4BPMkHC0I6Gz3N1pHP771Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

wVKDCuw.exe

Path C:\Windows\System\wVKDCuw.exe
Size 1.7MB
SHA256 6ca7ce79516ceadb816d8ef32ae11d8fc26af36acf8ba4bf52749cd532445b27
MD5 3401badcd469f50d00405483e5c0f072
SHA1 0c7c7bcde14094a488d582ee5c2b10b942694ba8
SHA512 4ff7e432fcd1fc6397585dfa4903fef8f4c88fc29f115dbbcaed2e6269923d1df9cf1384923513df7f83f066fdaf5fe67d1afddbbf45e67c8175326ea5ef37c0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2q9:Lz071uv4BPMkHC0I6Gz3N1pHP771j
MD5 SHA1 SHA512 SSDEEP

Submit Download

xFGjsft.exe

Path C:\Windows\System\xFGjsft.exe
Size 1.7MB
SHA256 2149b6d6b77d4f79ee0837234e223d3233f7615656e53c05b76c388ba28fcfde
MD5 3813afb2362a46f1d43ac7c9015aaa5a
SHA1 c2637643bac63b97b85ca8bc3651a2d226b4ccc8
SHA512 d2cbd47079ef433dcec399e1e60b11dad38b3b6b3f185fdec4a6c83f2a1753f4a5f23f5837f2b1def9d66976848f86c0f7fe4f4bfef8f057c96ae44bf9ffeb0e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5Gqlfz+y7p9DH2qU:Lz071uv4BPMkHC0I6Gz3N1pHP771W
MD5 SHA1 SHA512 SSDEEP

Submit Download

yhZoFOO.exe

Path C:\Windows\System\yhZoFOO.exe
Size 8B
SHA256 5e241d47c5c1bba728b1d456a45dbbbc3cb228d84126e71ecd96ca4d2f21321d
MD5 98078e6e3179cf16096b56055d65598a
SHA1 839bba9cf7f249374903727f77bb74aa057bfe10
SHA512 37603709821b73dff96cab19e79390a8575f1f7caab4fda9dc215ff6a704ee2d38a1d8b0677b8c0cb56a47fade60f20502f12be7f4cabcce2355b4e9fb212f78
MD5 SHA1 SHA512

Submit Download

memory/760-160-0x00007FF7A0A80000-0x00007FF7A0E72000-memory.dmp

Download

memory/1276-475-0x00007FF7EBEE0000-0x00007FF7EC2D2000-memory.dmp

Download

memory/1412-4165-0x00007FF6CA530000-0x00007FF6CA922000-memory.dmp

Download

memory/1412-478-0x00007FF6CA530000-0x00007FF6CA922000-memory.dmp

Download

memory/1620-4177-0x00007FF7E8B20000-0x00007FF7E8F12000-memory.dmp

Download

memory/1620-482-0x00007FF7E8B20000-0x00007FF7E8F12000-memory.dmp

Download

memory/1680-272-0x00007FF7C0F70000-0x00007FF7C1362000-memory.dmp

Download

memory/1848-210-0x00007FF67A470000-0x00007FF67A862000-memory.dmp

Download

memory/1988-4170-0x00007FF71DEB0000-0x00007FF71E2A2000-memory.dmp

Download

memory/1988-481-0x00007FF71DEB0000-0x00007FF71E2A2000-memory.dmp

Download

memory/2128-4136-0x00007FF753230000-0x00007FF753622000-memory.dmp

Download

memory/2128-421-0x00007FF753230000-0x00007FF753622000-memory.dmp

Download

memory/2736-4140-0x00007FF7516B0000-0x00007FF751AA2000-memory.dmp

Download

memory/2736-477-0x00007FF7516B0000-0x00007FF751AA2000-memory.dmp

Download

memory/2764-4188-0x00007FF63F150000-0x00007FF63F542000-memory.dmp

Download

memory/2764-483-0x00007FF63F150000-0x00007FF63F542000-memory.dmp

Download

memory/2820-476-0x00007FF664570000-0x00007FF664962000-memory.dmp

Download

memory/2820-4124-0x00007FF664570000-0x00007FF664962000-memory.dmp

Download

memory/2848-679-0x00007FF6D4FF0000-0x00007FF6D53E2000-memory.dmp

Download

memory/2848-4307-0x00007FF6D4FF0000-0x00007FF6D53E2000-memory.dmp

Download

memory/2852-479-0x00007FF64DDC0000-0x00007FF64E1B2000-memory.dmp

Download

memory/2852-4156-0x00007FF64DDC0000-0x00007FF64E1B2000-memory.dmp

Download

memory/3000-355-0x00007FF741D40000-0x00007FF742132000-memory.dmp

Download

memory/3000-4106-0x00007FF741D40000-0x00007FF742132000-memory.dmp

Download

memory/3076-4203-0x00007FF640B00000-0x00007FF640EF2000-memory.dmp

Download

memory/3076-793-0x00007FF640B00000-0x00007FF640EF2000-memory.dmp

Download

memory/3120-480-0x00007FF7EC5F0000-0x00007FF7EC9E2000-memory.dmp

Download

memory/3120-4173-0x00007FF7EC5F0000-0x00007FF7EC9E2000-memory.dmp

Download

memory/3156-484-0x00007FF76B710000-0x00007FF76BB02000-memory.dmp

Download

memory/3156-4278-0x00007FF76B710000-0x00007FF76BB02000-memory.dmp

Download

memory/3900-124-0x00007FF7AFEC0000-0x00007FF7B02B2000-memory.dmp

Download

memory/3948-4195-0x00007FF6018E0000-0x00007FF601CD2000-memory.dmp

Download

memory/3948-601-0x00007FF6018E0000-0x00007FF601CD2000-memory.dmp

Download

memory/4484-4145-0x00007FF71DE80000-0x00007FF71E272000-memory.dmp

Download

memory/4484-474-0x00007FF71DE80000-0x00007FF71E272000-memory.dmp

Download

memory/4652-637-0x00007FF74D460000-0x00007FF74D852000-memory.dmp

Download

memory/4652-4293-0x00007FF74D460000-0x00007FF74D852000-memory.dmp

Download

memory/4820-4152-0x00007FF65EBC0000-0x00007FF65EFB2000-memory.dmp

Download

memory/4820-717-0x00007FF65EBC0000-0x00007FF65EFB2000-memory.dmp

Download

memory/4912-4292-0x00007FF7F1710000-0x00007FF7F1B02000-memory.dmp

Download

memory/4912-592-0x00007FF7F1710000-0x00007FF7F1B02000-memory.dmp

Download

memory/4968-485-0x00007FF7F8A50000-0x00007FF7F8E42000-memory.dmp

Download

memory/4968-4288-0x00007FF7F8A50000-0x00007FF7F8E42000-memory.dmp

Download

memory/4976-0-0x00007FF78B4C0000-0x00007FF78B8B2000-memory.dmp

Download

memory/4976-1-0x00000223EEDA0000-0x00000223EEDB0000-memory.dmp

Download

memory/5064-6-0x00007FFC9B8F3000-0x00007FFC9B8F5000-memory.dmp

Download

memory/5064-774-0x00007FFC9B8F0000-0x00007FFC9C3B1000-memory.dmp

Download

memory/5064-300-0x000001152B240000-0x000001152B262000-memory.dmp

Download

memory/5064-64-0x00007FFC9B8F0000-0x00007FFC9C3B1000-memory.dmp

Download