xmrig | d44676c93256c4fdf2857cdb5100f1f1ccb534293a6fbb1dd1b76bb8bc238a23

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 05:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
Size

1.5MB
MD5

3f01f52ed81b432c603a3beefcf1fee0
SHA1

18188c902e6638cb09fa28fc1faa97071560b996
SHA256

d44676c93256c4fdf2857cdb5100f1f1ccb534293a6fbb1dd1b76bb8bc238a23
SHA512

47ff4a44ee62af36a3bb1fafcb11c853fae63068ce85413e260919a4e62f5cb1f1354ae69aff972e1babc11421690b9bf9d6d91cb5aaf2a01634dc8c0dcb76c1
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbqoBQ0Y9xFj+rg:Lz071uv4BPMkHC0IlnASEx/mY9H+8

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 26 IoCs

miner

resource	yara_rule
behavioral2/memory/1700-72-0x00007FF71FF20000-0x00007FF720312000-memory.dmp	xmrig
behavioral2/memory/740-75-0x00007FF61B060000-0x00007FF61B452000-memory.dmp	xmrig
behavioral2/memory/5056-78-0x00007FF667B20000-0x00007FF667F12000-memory.dmp	xmrig
behavioral2/memory/3992-77-0x00007FF64F5A0000-0x00007FF64F992000-memory.dmp	xmrig
behavioral2/memory/1220-76-0x00007FF777260000-0x00007FF777652000-memory.dmp	xmrig
behavioral2/memory/3336-74-0x00007FF7F7450000-0x00007FF7F7842000-memory.dmp	xmrig
behavioral2/memory/4176-73-0x00007FF687400000-0x00007FF6877F2000-memory.dmp	xmrig
behavioral2/memory/3940-71-0x00007FF71F940000-0x00007FF71FD32000-memory.dmp	xmrig
behavioral2/memory/832-68-0x00007FF6DE0A0000-0x00007FF6DE492000-memory.dmp	xmrig
behavioral2/memory/4528-46-0x00007FF6BDBF0000-0x00007FF6BDFE2000-memory.dmp	xmrig
behavioral2/memory/2616-105-0x00007FF6D94C0000-0x00007FF6D98B2000-memory.dmp	xmrig
behavioral2/memory/4444-139-0x00007FF6B3A00000-0x00007FF6B3DF2000-memory.dmp	xmrig
behavioral2/memory/1224-143-0x00007FF622E90000-0x00007FF623282000-memory.dmp	xmrig
behavioral2/memory/2760-140-0x00007FF64EE00000-0x00007FF64F1F2000-memory.dmp	xmrig
behavioral2/memory/2404-138-0x00007FF7A6B40000-0x00007FF7A6F32000-memory.dmp	xmrig
behavioral2/memory/1776-137-0x00007FF6144B0000-0x00007FF6148A2000-memory.dmp	xmrig
behavioral2/memory/2320-135-0x00007FF6F9E30000-0x00007FF6FA222000-memory.dmp	xmrig
behavioral2/memory/264-119-0x00007FF64F160000-0x00007FF64F552000-memory.dmp	xmrig
behavioral2/memory/3276-109-0x00007FF71BEB0000-0x00007FF71C2A2000-memory.dmp	xmrig
behavioral2/memory/3700-174-0x00007FF7246D0000-0x00007FF724AC2000-memory.dmp	xmrig
behavioral2/memory/5040-161-0x00007FF79D500000-0x00007FF79D8F2000-memory.dmp	xmrig
behavioral2/memory/2468-2802-0x00007FF780C00000-0x00007FF780FF2000-memory.dmp	xmrig
behavioral2/memory/5040-3874-0x00007FF79D500000-0x00007FF79D8F2000-memory.dmp	xmrig
behavioral2/memory/832-4513-0x00007FF6DE0A0000-0x00007FF6DE492000-memory.dmp	xmrig
behavioral2/memory/1776-6412-0x00007FF6144B0000-0x00007FF6148A2000-memory.dmp	xmrig
behavioral2/memory/3136-7407-0x00007FF6339D0000-0x00007FF633DC2000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
8	1596	powershell.exe
10	1596	powershell.exe
15	1596	powershell.exe
16	1596	powershell.exe
19	1596	powershell.exe
21	1596	powershell.exe
26	1596	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1596	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1220	xglZCwR.exe
4528	cbpShpK.exe
832	ghTIrbu.exe
3940	rdUnsyv.exe
3992	gEYgpeu.exe
1700	coeIlRp.exe
4176	PZwDgHh.exe
5056	NkZGmwc.exe
3336	ZySMQMj.exe
740	RUwElIv.exe
2468	GfFfhRc.exe
2616	lfOAZVj.exe
264	LsAdtjd.exe
2320	TMJcNDa.exe
3276	AWueGWo.exe
4608	xyiCPYr.exe
2760	vDdKORV.exe
1776	QdcCIoM.exe
2404	SFlZFUX.exe
4444	OBkyJlk.exe
1224	HbeWMPx.exe
5040	hlnwZrG.exe
3136	PqEsRBs.exe
3700	HoKiOKf.exe
4596	vdeYOtC.exe
3132	OSVuEbb.exe
3268	dyyUFIr.exe
2244	iAfAYWS.exe
3920	iWoJUJH.exe
4308	ExIYacX.exe
436	JaKMiut.exe
1672	YZDVMXz.exe
3248	opOufuP.exe
1132	bIIxmrR.exe
4360	bMPStVk.exe
1976	OPOmltI.exe
4044	jNbOrpj.exe
2056	IRjSwgk.exe
3600	idLNzqP.exe
1624	gGRubwE.exe
1420	WYbTubC.exe
3152	JWQpwzl.exe
2920	QxOcLyw.exe
3776	UUYWxDB.exe
1236	OyzEgbx.exe
2080	qykkSOW.exe
4272	TdgVonF.exe
908	kkwmJcX.exe
3156	GkNzqpm.exe
3252	FBiqhpG.exe
4396	QLUmhvC.exe
4648	hkmCJiX.exe
3772	dBxyokP.exe
4208	pvGjWMX.exe
4316	ILsPNjz.exe
1988	nYMCnQm.exe
5004	cWPKzHA.exe
4584	BIsVUjE.exe
4372	OlmjNLO.exe
1392	JQgliUn.exe
3696	XeGcwAW.exe
5060	OMQepth.exe
1880	gSuTLFo.exe
3708	GAUPUZG.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4716-0-0x00007FF728D30000-0x00007FF729122000-memory.dmp	upx
behavioral2/files/0x000800000002346a-6.dat	upx
behavioral2/files/0x000700000002346b-12.dat	upx
behavioral2/files/0x000700000002346c-14.dat	upx
behavioral2/files/0x000700000002346e-27.dat	upx
behavioral2/files/0x000700000002346f-34.dat	upx
behavioral2/files/0x0007000000023470-47.dat	upx
behavioral2/files/0x0008000000023473-59.dat	upx
behavioral2/files/0x0007000000023474-65.dat	upx
behavioral2/memory/1700-72-0x00007FF71FF20000-0x00007FF720312000-memory.dmp	upx
behavioral2/memory/740-75-0x00007FF61B060000-0x00007FF61B452000-memory.dmp	upx
behavioral2/memory/5056-78-0x00007FF667B20000-0x00007FF667F12000-memory.dmp	upx
behavioral2/files/0x0007000000023475-80.dat	upx
behavioral2/memory/2468-79-0x00007FF780C00000-0x00007FF780FF2000-memory.dmp	upx
behavioral2/memory/3992-77-0x00007FF64F5A0000-0x00007FF64F992000-memory.dmp	upx
behavioral2/memory/1220-76-0x00007FF777260000-0x00007FF777652000-memory.dmp	upx
behavioral2/memory/3336-74-0x00007FF7F7450000-0x00007FF7F7842000-memory.dmp	upx
behavioral2/memory/4176-73-0x00007FF687400000-0x00007FF6877F2000-memory.dmp	upx
behavioral2/memory/3940-71-0x00007FF71F940000-0x00007FF71FD32000-memory.dmp	upx
behavioral2/memory/832-68-0x00007FF6DE0A0000-0x00007FF6DE492000-memory.dmp	upx
behavioral2/files/0x0007000000023471-58.dat	upx
behavioral2/memory/4528-46-0x00007FF6BDBF0000-0x00007FF6BDFE2000-memory.dmp	upx
behavioral2/files/0x000700000002346d-19.dat	upx
behavioral2/files/0x0007000000023476-86.dat	upx
behavioral2/files/0x0008000000023468-94.dat	upx
behavioral2/files/0x0007000000023477-104.dat	upx
behavioral2/memory/2616-105-0x00007FF6D94C0000-0x00007FF6D98B2000-memory.dmp	upx
behavioral2/memory/4608-113-0x00007FF6832E0000-0x00007FF6836D2000-memory.dmp	upx
behavioral2/files/0x0007000000023478-116.dat	upx
behavioral2/files/0x000700000002347a-121.dat	upx
behavioral2/files/0x000700000002347c-129.dat	upx
behavioral2/files/0x000700000002347b-131.dat	upx
behavioral2/files/0x000700000002347d-136.dat	upx
behavioral2/memory/4444-139-0x00007FF6B3A00000-0x00007FF6B3DF2000-memory.dmp	upx
behavioral2/memory/1224-143-0x00007FF622E90000-0x00007FF623282000-memory.dmp	upx
behavioral2/memory/2760-140-0x00007FF64EE00000-0x00007FF64F1F2000-memory.dmp	upx
behavioral2/memory/2404-138-0x00007FF7A6B40000-0x00007FF7A6F32000-memory.dmp	upx
behavioral2/memory/1776-137-0x00007FF6144B0000-0x00007FF6148A2000-memory.dmp	upx
behavioral2/memory/2320-135-0x00007FF6F9E30000-0x00007FF6FA222000-memory.dmp	upx
behavioral2/files/0x0007000000023479-125.dat	upx
behavioral2/memory/264-119-0x00007FF64F160000-0x00007FF64F552000-memory.dmp	upx
behavioral2/memory/3276-109-0x00007FF71BEB0000-0x00007FF71C2A2000-memory.dmp	upx
behavioral2/files/0x0008000000023472-102.dat	upx
behavioral2/files/0x000700000002347e-148.dat	upx
behavioral2/files/0x000300000001e4d2-156.dat	upx
behavioral2/files/0x000300000001e4d4-169.dat	upx
behavioral2/files/0x000200000001e6ff-175.dat	upx
behavioral2/memory/3700-174-0x00007FF7246D0000-0x00007FF724AC2000-memory.dmp	upx
behavioral2/files/0x000200000001e6fe-170.dat	upx
behavioral2/files/0x000300000001e4d3-168.dat	upx
behavioral2/files/0x0007000000023485-219.dat	upx
behavioral2/files/0x0007000000023486-230.dat	upx
behavioral2/files/0x0007000000023488-221.dat	upx
behavioral2/files/0x0007000000023484-211.dat	upx
behavioral2/files/0x000200000001e700-201.dat	upx
behavioral2/memory/3136-163-0x00007FF6339D0000-0x00007FF633DC2000-memory.dmp	upx
behavioral2/files/0x000300000001e4d1-162.dat	upx
behavioral2/memory/5040-161-0x00007FF79D500000-0x00007FF79D8F2000-memory.dmp	upx
behavioral2/memory/2468-2802-0x00007FF780C00000-0x00007FF780FF2000-memory.dmp	upx
behavioral2/memory/5040-3874-0x00007FF79D500000-0x00007FF79D8F2000-memory.dmp	upx
behavioral2/memory/832-4513-0x00007FF6DE0A0000-0x00007FF6DE492000-memory.dmp	upx
behavioral2/memory/1776-6412-0x00007FF6144B0000-0x00007FF6148A2000-memory.dmp	upx
behavioral2/memory/3136-7407-0x00007FF6339D0000-0x00007FF633DC2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xDXgFpz.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\jrnwINa.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\LCyrJhP.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\odzpxWr.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\uMqMRhs.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\nPRgakV.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\ZZJXiMp.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\XnVJFEg.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\XBmRYuz.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\tgZnrmS.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\YhNSsDp.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\RILsWLY.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\tvWREBp.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\DbXGNja.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\otOVmGq.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\CeSAuwZ.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\gFaYAVT.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\aaHUeDh.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\PtDPCLG.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\ymeSZZK.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\tqASGHq.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\sXvKHoo.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\ZnTkzhZ.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\jhtTDay.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\lvVGmDF.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\IBBXaDa.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\IMNfCKK.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\WnboEcr.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\CUWGSoQ.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\YdOnMeD.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\bgdnxpb.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\RimckXt.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\eyDsWrK.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\urpWszD.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\YGNWSsP.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\EtYNmdx.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\cMWssTq.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\LXUvnqb.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\aqFIXnl.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\TJViouW.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\WfCfCAL.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\AREXXNb.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\zqJWBOb.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\ncKsbjp.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\BINPmGe.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\ZYWgMCv.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\ctCrEZf.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\fXItylM.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\ZvdrysO.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\nYkaAwC.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\XnkpAGY.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\EjjfYZw.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\pPvOCNa.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\dQTfbyJ.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\eaDukaO.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\LunzHxU.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\bTRhOdN.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\dTBreTN.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\lrFZmvQ.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\VIwBbnO.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\SBHzYPj.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\QSsDLMK.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\vUgKzGu.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
File created	C:\Windows\System\qmKGcMH.exe	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1596	powershell.exe
1596	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeLockMemoryPrivilege	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
Token: SeCreateGlobalPrivilege	14592	dwm.exe
Token: SeChangeNotifyPrivilege	14592	dwm.exe
Token: 33	14592	dwm.exe
Token: SeIncBasePriorityPrivilege	14592	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1596	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	83
PID 4716 wrote to memory of 1596	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	83
PID 4716 wrote to memory of 1220	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	84
PID 4716 wrote to memory of 1220	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	84
PID 4716 wrote to memory of 4528	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	85
PID 4716 wrote to memory of 4528	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	85
PID 4716 wrote to memory of 832	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	86
PID 4716 wrote to memory of 832	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	86
PID 4716 wrote to memory of 3940	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	87
PID 4716 wrote to memory of 3940	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	87
PID 4716 wrote to memory of 3992	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	88
PID 4716 wrote to memory of 3992	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	88
PID 4716 wrote to memory of 1700	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	89
PID 4716 wrote to memory of 1700	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	89
PID 4716 wrote to memory of 4176	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	90
PID 4716 wrote to memory of 4176	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	90
PID 4716 wrote to memory of 5056	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	91
PID 4716 wrote to memory of 5056	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	91
PID 4716 wrote to memory of 3336	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	92
PID 4716 wrote to memory of 3336	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	92
PID 4716 wrote to memory of 740	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	93
PID 4716 wrote to memory of 740	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	93
PID 4716 wrote to memory of 2468	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	94
PID 4716 wrote to memory of 2468	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	94
PID 4716 wrote to memory of 2616	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	95
PID 4716 wrote to memory of 2616	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	95
PID 4716 wrote to memory of 264	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	96
PID 4716 wrote to memory of 264	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	96
PID 4716 wrote to memory of 2320	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	97
PID 4716 wrote to memory of 2320	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	97
PID 4716 wrote to memory of 3276	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	98
PID 4716 wrote to memory of 3276	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	98
PID 4716 wrote to memory of 4608	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	99
PID 4716 wrote to memory of 4608	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	99
PID 4716 wrote to memory of 2760	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	100
PID 4716 wrote to memory of 2760	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	100
PID 4716 wrote to memory of 1776	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	101
PID 4716 wrote to memory of 1776	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	101
PID 4716 wrote to memory of 4444	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	102
PID 4716 wrote to memory of 4444	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	102
PID 4716 wrote to memory of 2404	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	103
PID 4716 wrote to memory of 2404	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	103
PID 4716 wrote to memory of 1224	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	104
PID 4716 wrote to memory of 1224	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	104
PID 4716 wrote to memory of 5040	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	105
PID 4716 wrote to memory of 5040	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	105
PID 4716 wrote to memory of 3136	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	106
PID 4716 wrote to memory of 3136	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	106
PID 4716 wrote to memory of 3700	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	107
PID 4716 wrote to memory of 3700	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	107
PID 4716 wrote to memory of 4596	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	108
PID 4716 wrote to memory of 4596	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	108
PID 4716 wrote to memory of 3132	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	109
PID 4716 wrote to memory of 3132	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	109
PID 4716 wrote to memory of 3268	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	110
PID 4716 wrote to memory of 3268	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	110
PID 4716 wrote to memory of 2244	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	111
PID 4716 wrote to memory of 2244	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	111
PID 4716 wrote to memory of 3920	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	112
PID 4716 wrote to memory of 3920	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	112
PID 4716 wrote to memory of 4308	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	114
PID 4716 wrote to memory of 4308	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	114
PID 4716 wrote to memory of 436	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	115
PID 4716 wrote to memory of 436	4716	3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3f01f52ed81b432c603a3beefcf1fee0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\System\xglZCwR.exe
  C:\Windows\System\xglZCwR.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\cbpShpK.exe
  C:\Windows\System\cbpShpK.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\ghTIrbu.exe
  C:\Windows\System\ghTIrbu.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\rdUnsyv.exe
  C:\Windows\System\rdUnsyv.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\gEYgpeu.exe
  C:\Windows\System\gEYgpeu.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\coeIlRp.exe
  C:\Windows\System\coeIlRp.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\PZwDgHh.exe
  C:\Windows\System\PZwDgHh.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\NkZGmwc.exe
  C:\Windows\System\NkZGmwc.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\ZySMQMj.exe
  C:\Windows\System\ZySMQMj.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\RUwElIv.exe
  C:\Windows\System\RUwElIv.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\GfFfhRc.exe
  C:\Windows\System\GfFfhRc.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\lfOAZVj.exe
  C:\Windows\System\lfOAZVj.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\LsAdtjd.exe
  C:\Windows\System\LsAdtjd.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\TMJcNDa.exe
  C:\Windows\System\TMJcNDa.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\AWueGWo.exe
  C:\Windows\System\AWueGWo.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\xyiCPYr.exe
  C:\Windows\System\xyiCPYr.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\vDdKORV.exe
  C:\Windows\System\vDdKORV.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\QdcCIoM.exe
  C:\Windows\System\QdcCIoM.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\OBkyJlk.exe
  C:\Windows\System\OBkyJlk.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\SFlZFUX.exe
  C:\Windows\System\SFlZFUX.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\HbeWMPx.exe
  C:\Windows\System\HbeWMPx.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\hlnwZrG.exe
  C:\Windows\System\hlnwZrG.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\PqEsRBs.exe
  C:\Windows\System\PqEsRBs.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\HoKiOKf.exe
  C:\Windows\System\HoKiOKf.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\vdeYOtC.exe
  C:\Windows\System\vdeYOtC.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\OSVuEbb.exe
  C:\Windows\System\OSVuEbb.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\dyyUFIr.exe
  C:\Windows\System\dyyUFIr.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\iAfAYWS.exe
  C:\Windows\System\iAfAYWS.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\iWoJUJH.exe
  C:\Windows\System\iWoJUJH.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\ExIYacX.exe
  C:\Windows\System\ExIYacX.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\JaKMiut.exe
  C:\Windows\System\JaKMiut.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\YZDVMXz.exe
  C:\Windows\System\YZDVMXz.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\opOufuP.exe
  C:\Windows\System\opOufuP.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\bIIxmrR.exe
  C:\Windows\System\bIIxmrR.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\bMPStVk.exe
  C:\Windows\System\bMPStVk.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\OPOmltI.exe
  C:\Windows\System\OPOmltI.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\jNbOrpj.exe
  C:\Windows\System\jNbOrpj.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\IRjSwgk.exe
  C:\Windows\System\IRjSwgk.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\idLNzqP.exe
  C:\Windows\System\idLNzqP.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\gGRubwE.exe
  C:\Windows\System\gGRubwE.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\WYbTubC.exe
  C:\Windows\System\WYbTubC.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\JWQpwzl.exe
  C:\Windows\System\JWQpwzl.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\QxOcLyw.exe
  C:\Windows\System\QxOcLyw.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\UUYWxDB.exe
  C:\Windows\System\UUYWxDB.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\OyzEgbx.exe
  C:\Windows\System\OyzEgbx.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\qykkSOW.exe
  C:\Windows\System\qykkSOW.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\TdgVonF.exe
  C:\Windows\System\TdgVonF.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\kkwmJcX.exe
  C:\Windows\System\kkwmJcX.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\GkNzqpm.exe
  C:\Windows\System\GkNzqpm.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\FBiqhpG.exe
  C:\Windows\System\FBiqhpG.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\QLUmhvC.exe
  C:\Windows\System\QLUmhvC.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\hkmCJiX.exe
  C:\Windows\System\hkmCJiX.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\dBxyokP.exe
  C:\Windows\System\dBxyokP.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\pvGjWMX.exe
  C:\Windows\System\pvGjWMX.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\ILsPNjz.exe
  C:\Windows\System\ILsPNjz.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\nYMCnQm.exe
  C:\Windows\System\nYMCnQm.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\cWPKzHA.exe
  C:\Windows\System\cWPKzHA.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\BIsVUjE.exe
  C:\Windows\System\BIsVUjE.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\OlmjNLO.exe
  C:\Windows\System\OlmjNLO.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\JQgliUn.exe
  C:\Windows\System\JQgliUn.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\XeGcwAW.exe
  C:\Windows\System\XeGcwAW.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\OMQepth.exe
  C:\Windows\System\OMQepth.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\gSuTLFo.exe
  C:\Windows\System\gSuTLFo.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\GAUPUZG.exe
  C:\Windows\System\GAUPUZG.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\zdNJthc.exe
  C:\Windows\System\zdNJthc.exe
  2⤵
  PID:3188
- C:\Windows\System\sXGZsIS.exe
  C:\Windows\System\sXGZsIS.exe
  2⤵
  PID:4592
- C:\Windows\System\XBtFtek.exe
  C:\Windows\System\XBtFtek.exe
  2⤵
  PID:3228
- C:\Windows\System\pzJrHdv.exe
  C:\Windows\System\pzJrHdv.exe
  2⤵
  PID:4640
- C:\Windows\System\qBanjCu.exe
  C:\Windows\System\qBanjCu.exe
  2⤵
  PID:4904
- C:\Windows\System\MQezgsJ.exe
  C:\Windows\System\MQezgsJ.exe
  2⤵
  PID:4548
- C:\Windows\System\wueAale.exe
  C:\Windows\System\wueAale.exe
  2⤵
  PID:2136
- C:\Windows\System\hjpFjFN.exe
  C:\Windows\System\hjpFjFN.exe
  2⤵
  PID:3048
- C:\Windows\System\duYtrSd.exe
  C:\Windows\System\duYtrSd.exe
  2⤵
  PID:2736
- C:\Windows\System\ctkoOtu.exe
  C:\Windows\System\ctkoOtu.exe
  2⤵
  PID:3804
- C:\Windows\System\aLgpyNi.exe
  C:\Windows\System\aLgpyNi.exe
  2⤵
  PID:208
- C:\Windows\System\iHfFBsb.exe
  C:\Windows\System\iHfFBsb.exe
  2⤵
  PID:3080
- C:\Windows\System\KpYPNDY.exe
  C:\Windows\System\KpYPNDY.exe
  2⤵
  PID:1712
- C:\Windows\System\PPCsamD.exe
  C:\Windows\System\PPCsamD.exe
  2⤵
  PID:1480
- C:\Windows\System\gdhDSSC.exe
  C:\Windows\System\gdhDSSC.exe
  2⤵
  PID:2196
- C:\Windows\System\UPgXZMG.exe
  C:\Windows\System\UPgXZMG.exe
  2⤵
  PID:2036
- C:\Windows\System\PuohIzz.exe
  C:\Windows\System\PuohIzz.exe
  2⤵
  PID:4776
- C:\Windows\System\qTUYSvg.exe
  C:\Windows\System\qTUYSvg.exe
  2⤵
  PID:2044
- C:\Windows\System\pAQcAag.exe
  C:\Windows\System\pAQcAag.exe
  2⤵
  PID:3492
- C:\Windows\System\jPfCwGA.exe
  C:\Windows\System\jPfCwGA.exe
  2⤵
  PID:4340
- C:\Windows\System\OFftDRI.exe
  C:\Windows\System\OFftDRI.exe
  2⤵
  PID:1136
- C:\Windows\System\jkCmOsB.exe
  C:\Windows\System\jkCmOsB.exe
  2⤵
  PID:3856
- C:\Windows\System\GDSpzaJ.exe
  C:\Windows\System\GDSpzaJ.exe
  2⤵
  PID:2688
- C:\Windows\System\lNlThqQ.exe
  C:\Windows\System\lNlThqQ.exe
  2⤵
  PID:1356
- C:\Windows\System\WRtZlVM.exe
  C:\Windows\System\WRtZlVM.exe
  2⤵
  PID:400
- C:\Windows\System\xBBtlJv.exe
  C:\Windows\System\xBBtlJv.exe
  2⤵
  PID:4952
- C:\Windows\System\Btxoede.exe
  C:\Windows\System\Btxoede.exe
  2⤵
  PID:2712
- C:\Windows\System\GMcBjPT.exe
  C:\Windows\System\GMcBjPT.exe
  2⤵
  PID:4720
- C:\Windows\System\ngcRTtK.exe
  C:\Windows\System\ngcRTtK.exe
  2⤵
  PID:3424
- C:\Windows\System\bUVonxg.exe
  C:\Windows\System\bUVonxg.exe
  2⤵
  PID:1836
- C:\Windows\System\bwEAZwe.exe
  C:\Windows\System\bwEAZwe.exe
  2⤵
  PID:5148
- C:\Windows\System\BTXOktk.exe
  C:\Windows\System\BTXOktk.exe
  2⤵
  PID:5184
- C:\Windows\System\YmqyJQP.exe
  C:\Windows\System\YmqyJQP.exe
  2⤵
  PID:5208
- C:\Windows\System\lqfegom.exe
  C:\Windows\System\lqfegom.exe
  2⤵
  PID:5280
- C:\Windows\System\IaKFCeT.exe
  C:\Windows\System\IaKFCeT.exe
  2⤵
  PID:5304
- C:\Windows\System\ppLiCxR.exe
  C:\Windows\System\ppLiCxR.exe
  2⤵
  PID:5380
- C:\Windows\System\GFXUuUH.exe
  C:\Windows\System\GFXUuUH.exe
  2⤵
  PID:5428
- C:\Windows\System\ZKnntNc.exe
  C:\Windows\System\ZKnntNc.exe
  2⤵
  PID:5480
- C:\Windows\System\eULNSfX.exe
  C:\Windows\System\eULNSfX.exe
  2⤵
  PID:5512
- C:\Windows\System\WnCmfyS.exe
  C:\Windows\System\WnCmfyS.exe
  2⤵
  PID:5528
- C:\Windows\System\liYuiHL.exe
  C:\Windows\System\liYuiHL.exe
  2⤵
  PID:5588
- C:\Windows\System\RCbpXQH.exe
  C:\Windows\System\RCbpXQH.exe
  2⤵
  PID:5612
- C:\Windows\System\MZjJium.exe
  C:\Windows\System\MZjJium.exe
  2⤵
  PID:5636
- C:\Windows\System\wDjRWRs.exe
  C:\Windows\System\wDjRWRs.exe
  2⤵
  PID:5692
- C:\Windows\System\bcQjfhm.exe
  C:\Windows\System\bcQjfhm.exe
  2⤵
  PID:5708
- C:\Windows\System\aznvkoS.exe
  C:\Windows\System\aznvkoS.exe
  2⤵
  PID:5760
- C:\Windows\System\lAuebAf.exe
  C:\Windows\System\lAuebAf.exe
  2⤵
  PID:5792
- C:\Windows\System\TchmokR.exe
  C:\Windows\System\TchmokR.exe
  2⤵
  PID:5836
- C:\Windows\System\TUECiYF.exe
  C:\Windows\System\TUECiYF.exe
  2⤵
  PID:5860
- C:\Windows\System\hPXZyLz.exe
  C:\Windows\System\hPXZyLz.exe
  2⤵
  PID:5932
- C:\Windows\System\KgRZqur.exe
  C:\Windows\System\KgRZqur.exe
  2⤵
  PID:5948
- C:\Windows\System\Ymcfqtm.exe
  C:\Windows\System\Ymcfqtm.exe
  2⤵
  PID:5980
- C:\Windows\System\BekKZCK.exe
  C:\Windows\System\BekKZCK.exe
  2⤵
  PID:6000
- C:\Windows\System\TiFmuen.exe
  C:\Windows\System\TiFmuen.exe
  2⤵
  PID:6052
- C:\Windows\System\vGoffyL.exe
  C:\Windows\System\vGoffyL.exe
  2⤵
  PID:6076
- C:\Windows\System\IGhoubw.exe
  C:\Windows\System\IGhoubw.exe
  2⤵
  PID:6100
- C:\Windows\System\fszyuKV.exe
  C:\Windows\System\fszyuKV.exe
  2⤵
  PID:4520
- C:\Windows\System\gGTUqFL.exe
  C:\Windows\System\gGTUqFL.exe
  2⤵
  PID:3192
- C:\Windows\System\qeLbLgZ.exe
  C:\Windows\System\qeLbLgZ.exe
  2⤵
  PID:5160
- C:\Windows\System\YXjUagi.exe
  C:\Windows\System\YXjUagi.exe
  2⤵
  PID:5172
- C:\Windows\System\qxrJiuT.exe
  C:\Windows\System\qxrJiuT.exe
  2⤵
  PID:5228
- C:\Windows\System\kVHUOtt.exe
  C:\Windows\System\kVHUOtt.exe
  2⤵
  PID:5332
- C:\Windows\System\PrDXzod.exe
  C:\Windows\System\PrDXzod.exe
  2⤵
  PID:5292
- C:\Windows\System\TNsNpoM.exe
  C:\Windows\System\TNsNpoM.exe
  2⤵
  PID:5372
- C:\Windows\System\FxZGyQB.exe
  C:\Windows\System\FxZGyQB.exe
  2⤵
  PID:5416
- C:\Windows\System\clNAaLa.exe
  C:\Windows\System\clNAaLa.exe
  2⤵
  PID:5472
- C:\Windows\System\bDZKVpp.exe
  C:\Windows\System\bDZKVpp.exe
  2⤵
  PID:5560
- C:\Windows\System\WwukOyZ.exe
  C:\Windows\System\WwukOyZ.exe
  2⤵
  PID:5668
- C:\Windows\System\NtuBrdl.exe
  C:\Windows\System\NtuBrdl.exe
  2⤵
  PID:5672
- C:\Windows\System\aVhogOC.exe
  C:\Windows\System\aVhogOC.exe
  2⤵
  PID:5684
- C:\Windows\System\orsntxV.exe
  C:\Windows\System\orsntxV.exe
  2⤵
  PID:5728
- C:\Windows\System\icTXXBF.exe
  C:\Windows\System\icTXXBF.exe
  2⤵
  PID:1344
- C:\Windows\System\YSWzYqQ.exe
  C:\Windows\System\YSWzYqQ.exe
  2⤵
  PID:5828
- C:\Windows\System\AYZbeqY.exe
  C:\Windows\System\AYZbeqY.exe
  2⤵
  PID:5908
- C:\Windows\System\jVDWKWY.exe
  C:\Windows\System\jVDWKWY.exe
  2⤵
  PID:5972
- C:\Windows\System\KLcGqRV.exe
  C:\Windows\System\KLcGqRV.exe
  2⤵
  PID:5992
- C:\Windows\System\xTDsQLD.exe
  C:\Windows\System\xTDsQLD.exe
  2⤵
  PID:6036
- C:\Windows\System\Gabpwnq.exe
  C:\Windows\System\Gabpwnq.exe
  2⤵
  PID:6068
- C:\Windows\System\grrFTJB.exe
  C:\Windows\System\grrFTJB.exe
  2⤵
  PID:6096
- C:\Windows\System\srgDecA.exe
  C:\Windows\System\srgDecA.exe
  2⤵
  PID:4612
- C:\Windows\System\CiDpPso.exe
  C:\Windows\System\CiDpPso.exe
  2⤵
  PID:5156
- C:\Windows\System\wnXMabI.exe
  C:\Windows\System\wnXMabI.exe
  2⤵
  PID:5196
- C:\Windows\System\VmdcZfr.exe
  C:\Windows\System\VmdcZfr.exe
  2⤵
  PID:5324
- C:\Windows\System\seFUzjQ.exe
  C:\Windows\System\seFUzjQ.exe
  2⤵
  PID:5488
- C:\Windows\System\axRsBEn.exe
  C:\Windows\System\axRsBEn.exe
  2⤵
  PID:5412
- C:\Windows\System\LsEOMaW.exe
  C:\Windows\System\LsEOMaW.exe
  2⤵
  PID:5556
- C:\Windows\System\pVUkNsc.exe
  C:\Windows\System\pVUkNsc.exe
  2⤵
  PID:5804
- C:\Windows\System\oIPDonr.exe
  C:\Windows\System\oIPDonr.exe
  2⤵
  PID:5880
- C:\Windows\System\rdDHAvg.exe
  C:\Windows\System\rdDHAvg.exe
  2⤵
  PID:6008
- C:\Windows\System\oDrbEPe.exe
  C:\Windows\System\oDrbEPe.exe
  2⤵
  PID:5124
- C:\Windows\System\NhlUmjQ.exe
  C:\Windows\System\NhlUmjQ.exe
  2⤵
  PID:3840
- C:\Windows\System\ksQvPDR.exe
  C:\Windows\System\ksQvPDR.exe
  2⤵
  PID:5492
- C:\Windows\System\FlGslpZ.exe
  C:\Windows\System\FlGslpZ.exe
  2⤵
  PID:5648
- C:\Windows\System\BvuqQVg.exe
  C:\Windows\System\BvuqQVg.exe
  2⤵
  PID:6156
- C:\Windows\System\UddhLQU.exe
  C:\Windows\System\UddhLQU.exe
  2⤵
  PID:6240
- C:\Windows\System\qbRHLkV.exe
  C:\Windows\System\qbRHLkV.exe
  2⤵
  PID:6312
- C:\Windows\System\WLqjYFZ.exe
  C:\Windows\System\WLqjYFZ.exe
  2⤵
  PID:6328
- C:\Windows\System\shuiBRk.exe
  C:\Windows\System\shuiBRk.exe
  2⤵
  PID:6376
- C:\Windows\System\KRnvCcO.exe
  C:\Windows\System\KRnvCcO.exe
  2⤵
  PID:6400
- C:\Windows\System\bafjDMH.exe
  C:\Windows\System\bafjDMH.exe
  2⤵
  PID:6432
- C:\Windows\System\dglOAse.exe
  C:\Windows\System\dglOAse.exe
  2⤵
  PID:6448
- C:\Windows\System\wKOgnPf.exe
  C:\Windows\System\wKOgnPf.exe
  2⤵
  PID:6504
- C:\Windows\System\NoXGtyg.exe
  C:\Windows\System\NoXGtyg.exe
  2⤵
  PID:6528
- C:\Windows\System\lNMSeRQ.exe
  C:\Windows\System\lNMSeRQ.exe
  2⤵
  PID:6548
- C:\Windows\System\MRMzDmp.exe
  C:\Windows\System\MRMzDmp.exe
  2⤵
  PID:6568
- C:\Windows\System\ijDfPxJ.exe
  C:\Windows\System\ijDfPxJ.exe
  2⤵
  PID:6620
- C:\Windows\System\NyxqvDT.exe
  C:\Windows\System\NyxqvDT.exe
  2⤵
  PID:6636
- C:\Windows\System\YBOZvBg.exe
  C:\Windows\System\YBOZvBg.exe
  2⤵
  PID:6668
- C:\Windows\System\NfsSyrL.exe
  C:\Windows\System\NfsSyrL.exe
  2⤵
  PID:6692
- C:\Windows\System\MotqTsQ.exe
  C:\Windows\System\MotqTsQ.exe
  2⤵
  PID:6708
- C:\Windows\System\pvsNWUL.exe
  C:\Windows\System\pvsNWUL.exe
  2⤵
  PID:6732
- C:\Windows\System\gCfivIf.exe
  C:\Windows\System\gCfivIf.exe
  2⤵
  PID:6776
- C:\Windows\System\QImDzWz.exe
  C:\Windows\System\QImDzWz.exe
  2⤵
  PID:6844
- C:\Windows\System\ikaPdct.exe
  C:\Windows\System\ikaPdct.exe
  2⤵
  PID:6864
- C:\Windows\System\ELvnLJM.exe
  C:\Windows\System\ELvnLJM.exe
  2⤵
  PID:6888
- C:\Windows\System\etWZsTe.exe
  C:\Windows\System\etWZsTe.exe
  2⤵
  PID:6908
- C:\Windows\System\WlZgUBQ.exe
  C:\Windows\System\WlZgUBQ.exe
  2⤵
  PID:6984
- C:\Windows\System\FCDXZSJ.exe
  C:\Windows\System\FCDXZSJ.exe
  2⤵
  PID:7000
- C:\Windows\System\cSbVBQs.exe
  C:\Windows\System\cSbVBQs.exe
  2⤵
  PID:7024
- C:\Windows\System\RmPePRq.exe
  C:\Windows\System\RmPePRq.exe
  2⤵
  PID:7060
- C:\Windows\System\bKjvqzY.exe
  C:\Windows\System\bKjvqzY.exe
  2⤵
  PID:7112
- C:\Windows\System\gqQeyTm.exe
  C:\Windows\System\gqQeyTm.exe
  2⤵
  PID:7132
- C:\Windows\System\SuCuARv.exe
  C:\Windows\System\SuCuARv.exe
  2⤵
  PID:7152
- C:\Windows\System\CFllqfE.exe
  C:\Windows\System\CFllqfE.exe
  2⤵
  PID:5352
- C:\Windows\System\WuBGnMU.exe
  C:\Windows\System\WuBGnMU.exe
  2⤵
  PID:6148
- C:\Windows\System\BSWYLwj.exe
  C:\Windows\System\BSWYLwj.exe
  2⤵
  PID:644
- C:\Windows\System\WRcdFdp.exe
  C:\Windows\System\WRcdFdp.exe
  2⤵
  PID:6216
- C:\Windows\System\RgZhqLF.exe
  C:\Windows\System\RgZhqLF.exe
  2⤵
  PID:6228
- C:\Windows\System\cakAXJP.exe
  C:\Windows\System\cakAXJP.exe
  2⤵
  PID:6412
- C:\Windows\System\FFWCand.exe
  C:\Windows\System\FFWCand.exe
  2⤵
  PID:6300
- C:\Windows\System\DLvWNBS.exe
  C:\Windows\System\DLvWNBS.exe
  2⤵
  PID:6408
- C:\Windows\System\hunKSNE.exe
  C:\Windows\System\hunKSNE.exe
  2⤵
  PID:6560
- C:\Windows\System\lXvimdN.exe
  C:\Windows\System\lXvimdN.exe
  2⤵
  PID:6724
- C:\Windows\System\TeIiQtx.exe
  C:\Windows\System\TeIiQtx.exe
  2⤵
  PID:6660
- C:\Windows\System\yZWulDN.exe
  C:\Windows\System\yZWulDN.exe
  2⤵
  PID:6680
- C:\Windows\System\boWwdGY.exe
  C:\Windows\System\boWwdGY.exe
  2⤵
  PID:6840
- C:\Windows\System\lywSUIO.exe
  C:\Windows\System\lywSUIO.exe
  2⤵
  PID:6816
- C:\Windows\System\pUgSoLO.exe
  C:\Windows\System\pUgSoLO.exe
  2⤵
  PID:6904
- C:\Windows\System\AexqJGF.exe
  C:\Windows\System\AexqJGF.exe
  2⤵
  PID:6928
- C:\Windows\System\NwkNXlR.exe
  C:\Windows\System\NwkNXlR.exe
  2⤵
  PID:7032
- C:\Windows\System\xknxlbd.exe
  C:\Windows\System\xknxlbd.exe
  2⤵
  PID:7052
- C:\Windows\System\kBLDnuu.exe
  C:\Windows\System\kBLDnuu.exe
  2⤵
  PID:7120
- C:\Windows\System\tWNUIFl.exe
  C:\Windows\System\tWNUIFl.exe
  2⤵
  PID:7124
- C:\Windows\System\dkSmybS.exe
  C:\Windows\System\dkSmybS.exe
  2⤵
  PID:4896
- C:\Windows\System\kGKqWny.exe
  C:\Windows\System\kGKqWny.exe
  2⤵
  PID:5964
- C:\Windows\System\jYrAQKD.exe
  C:\Windows\System\jYrAQKD.exe
  2⤵
  PID:6296
- C:\Windows\System\hOAEVtK.exe
  C:\Windows\System\hOAEVtK.exe
  2⤵
  PID:6564
- C:\Windows\System\uMLPDaF.exe
  C:\Windows\System\uMLPDaF.exe
  2⤵
  PID:6676
- C:\Windows\System\jPYaWyR.exe
  C:\Windows\System\jPYaWyR.exe
  2⤵
  PID:6872
- C:\Windows\System\FgaUCIo.exe
  C:\Windows\System\FgaUCIo.exe
  2⤵
  PID:6796
- C:\Windows\System\GCuAHdg.exe
  C:\Windows\System\GCuAHdg.exe
  2⤵
  PID:7104
- C:\Windows\System\jcKFIrb.exe
  C:\Windows\System\jcKFIrb.exe
  2⤵
  PID:6088
- C:\Windows\System\HBVDsHd.exe
  C:\Windows\System\HBVDsHd.exe
  2⤵
  PID:6632
- C:\Windows\System\kiGYKZl.exe
  C:\Windows\System\kiGYKZl.exe
  2⤵
  PID:6700
- C:\Windows\System\pkfHgoW.exe
  C:\Windows\System\pkfHgoW.exe
  2⤵
  PID:5704
- C:\Windows\System\FxpaEdl.exe
  C:\Windows\System\FxpaEdl.exe
  2⤵
  PID:3980
- C:\Windows\System\zrJepFb.exe
  C:\Windows\System\zrJepFb.exe
  2⤵
  PID:6972
- C:\Windows\System\luacqeh.exe
  C:\Windows\System\luacqeh.exe
  2⤵
  PID:7176
- C:\Windows\System\szqwzeM.exe
  C:\Windows\System\szqwzeM.exe
  2⤵
  PID:7196
- C:\Windows\System\koFDprC.exe
  C:\Windows\System\koFDprC.exe
  2⤵
  PID:7240
- C:\Windows\System\Lsxuvzw.exe
  C:\Windows\System\Lsxuvzw.exe
  2⤵
  PID:7260
- C:\Windows\System\TuIaEzx.exe
  C:\Windows\System\TuIaEzx.exe
  2⤵
  PID:7280
- C:\Windows\System\lmdZNRt.exe
  C:\Windows\System\lmdZNRt.exe
  2⤵
  PID:7300
- C:\Windows\System\ocgiKsM.exe
  C:\Windows\System\ocgiKsM.exe
  2⤵
  PID:7332
- C:\Windows\System\NxpqIwh.exe
  C:\Windows\System\NxpqIwh.exe
  2⤵
  PID:7352
- C:\Windows\System\rjRetQq.exe
  C:\Windows\System\rjRetQq.exe
  2⤵
  PID:7388
- C:\Windows\System\Tbichvz.exe
  C:\Windows\System\Tbichvz.exe
  2⤵
  PID:7476
- C:\Windows\System\NtNwocx.exe
  C:\Windows\System\NtNwocx.exe
  2⤵
  PID:7496
- C:\Windows\System\onLZUHl.exe
  C:\Windows\System\onLZUHl.exe
  2⤵
  PID:7520
- C:\Windows\System\zbZBrGz.exe
  C:\Windows\System\zbZBrGz.exe
  2⤵
  PID:7536
- C:\Windows\System\HliBrTc.exe
  C:\Windows\System\HliBrTc.exe
  2⤵
  PID:7564
- C:\Windows\System\Jfsiooj.exe
  C:\Windows\System\Jfsiooj.exe
  2⤵
  PID:7588
- C:\Windows\System\fRFEiZn.exe
  C:\Windows\System\fRFEiZn.exe
  2⤵
  PID:7604
- C:\Windows\System\FRELemb.exe
  C:\Windows\System\FRELemb.exe
  2⤵
  PID:7624
- C:\Windows\System\AKmgtpA.exe
  C:\Windows\System\AKmgtpA.exe
  2⤵
  PID:7648
- C:\Windows\System\NbbVwrA.exe
  C:\Windows\System\NbbVwrA.exe
  2⤵
  PID:7664
- C:\Windows\System\aMRJtmh.exe
  C:\Windows\System\aMRJtmh.exe
  2⤵
  PID:7688
- C:\Windows\System\IjzkDKe.exe
  C:\Windows\System\IjzkDKe.exe
  2⤵
  PID:7732
- C:\Windows\System\aEKQSRd.exe
  C:\Windows\System\aEKQSRd.exe
  2⤵
  PID:7796
- C:\Windows\System\yIHZSjg.exe
  C:\Windows\System\yIHZSjg.exe
  2⤵
  PID:7856
- C:\Windows\System\vbXOyIi.exe
  C:\Windows\System\vbXOyIi.exe
  2⤵
  PID:7876
- C:\Windows\System\UWxxiko.exe
  C:\Windows\System\UWxxiko.exe
  2⤵
  PID:7892
- C:\Windows\System\hqvTAXg.exe
  C:\Windows\System\hqvTAXg.exe
  2⤵
  PID:7920
- C:\Windows\System\bofOHoT.exe
  C:\Windows\System\bofOHoT.exe
  2⤵
  PID:7944
- C:\Windows\System\jFXtbDI.exe
  C:\Windows\System\jFXtbDI.exe
  2⤵
  PID:7960
- C:\Windows\System\sNOilGJ.exe
  C:\Windows\System\sNOilGJ.exe
  2⤵
  PID:7980
- C:\Windows\System\LcHRcrR.exe
  C:\Windows\System\LcHRcrR.exe
  2⤵
  PID:8008
- C:\Windows\System\uDXOfYK.exe
  C:\Windows\System\uDXOfYK.exe
  2⤵
  PID:8024
- C:\Windows\System\uqCxCmY.exe
  C:\Windows\System\uqCxCmY.exe
  2⤵
  PID:8064
- C:\Windows\System\gfkBugH.exe
  C:\Windows\System\gfkBugH.exe
  2⤵
  PID:8108
- C:\Windows\System\TbhQGkV.exe
  C:\Windows\System\TbhQGkV.exe
  2⤵
  PID:8132
- C:\Windows\System\XpbFoad.exe
  C:\Windows\System\XpbFoad.exe
  2⤵
  PID:8152
- C:\Windows\System\rAEiplY.exe
  C:\Windows\System\rAEiplY.exe
  2⤵
  PID:8172
- C:\Windows\System\bIofoWg.exe
  C:\Windows\System\bIofoWg.exe
  2⤵
  PID:6616
- C:\Windows\System\HGytqcP.exe
  C:\Windows\System\HGytqcP.exe
  2⤵
  PID:7088
- C:\Windows\System\rsrkfPm.exe
  C:\Windows\System\rsrkfPm.exe
  2⤵
  PID:7344
- C:\Windows\System\JnJiXNs.exe
  C:\Windows\System\JnJiXNs.exe
  2⤵
  PID:7348
- C:\Windows\System\vCDlEby.exe
  C:\Windows\System\vCDlEby.exe
  2⤵
  PID:7532
- C:\Windows\System\PvPbNrW.exe
  C:\Windows\System\PvPbNrW.exe
  2⤵
  PID:7572
- C:\Windows\System\tZTMyfb.exe
  C:\Windows\System\tZTMyfb.exe
  2⤵
  PID:7576
- C:\Windows\System\pnRnqUw.exe
  C:\Windows\System\pnRnqUw.exe
  2⤵
  PID:7620
- C:\Windows\System\rDxfQRA.exe
  C:\Windows\System\rDxfQRA.exe
  2⤵
  PID:7660
- C:\Windows\System\KwwRmfa.exe
  C:\Windows\System\KwwRmfa.exe
  2⤵
  PID:7816
- C:\Windows\System\KEMBBKK.exe
  C:\Windows\System\KEMBBKK.exe
  2⤵
  PID:7864
- C:\Windows\System\mzBkxjL.exe
  C:\Windows\System\mzBkxjL.exe
  2⤵
  PID:7888
- C:\Windows\System\osvarHc.exe
  C:\Windows\System\osvarHc.exe
  2⤵
  PID:7928
- C:\Windows\System\eBqJGoX.exe
  C:\Windows\System\eBqJGoX.exe
  2⤵
  PID:7976
- C:\Windows\System\OvRpVEP.exe
  C:\Windows\System\OvRpVEP.exe
  2⤵
  PID:8052
- C:\Windows\System\QSkQiQW.exe
  C:\Windows\System\QSkQiQW.exe
  2⤵
  PID:8100
- C:\Windows\System\fQEnyOh.exe
  C:\Windows\System\fQEnyOh.exe
  2⤵
  PID:8164
- C:\Windows\System\SUVfLug.exe
  C:\Windows\System\SUVfLug.exe
  2⤵
  PID:7232
- C:\Windows\System\kzozwrr.exe
  C:\Windows\System\kzozwrr.exe
  2⤵
  PID:7412
- C:\Windows\System\kkhbFRj.exe
  C:\Windows\System\kkhbFRj.exe
  2⤵
  PID:7656
- C:\Windows\System\yswihnM.exe
  C:\Windows\System\yswihnM.exe
  2⤵
  PID:3436
- C:\Windows\System\RgjFfAP.exe
  C:\Windows\System\RgjFfAP.exe
  2⤵
  PID:1804
- C:\Windows\System\cbezgoG.exe
  C:\Windows\System\cbezgoG.exe
  2⤵
  PID:8016
- C:\Windows\System\GlSIVGU.exe
  C:\Windows\System\GlSIVGU.exe
  2⤵
  PID:8088
- C:\Windows\System\ZDXAeAv.exe
  C:\Windows\System\ZDXAeAv.exe
  2⤵
  PID:7556
- C:\Windows\System\KNzRZiw.exe
  C:\Windows\System\KNzRZiw.exe
  2⤵
  PID:8120
- C:\Windows\System\JxgSNVT.exe
  C:\Windows\System\JxgSNVT.exe
  2⤵
  PID:7212
- C:\Windows\System\drGDEph.exe
  C:\Windows\System\drGDEph.exe
  2⤵
  PID:7292
- C:\Windows\System\ktmsxOv.exe
  C:\Windows\System\ktmsxOv.exe
  2⤵
  PID:2120
- C:\Windows\System\ehOTTjZ.exe
  C:\Windows\System\ehOTTjZ.exe
  2⤵
  PID:6704
- C:\Windows\System\KcHeJKq.exe
  C:\Windows\System\KcHeJKq.exe
  2⤵
  PID:8216
- C:\Windows\System\TVsVHrN.exe
  C:\Windows\System\TVsVHrN.exe
  2⤵
  PID:8232
- C:\Windows\System\XqfQaRR.exe
  C:\Windows\System\XqfQaRR.exe
  2⤵
  PID:8264
- C:\Windows\System\wqZlKij.exe
  C:\Windows\System\wqZlKij.exe
  2⤵
  PID:8288
- C:\Windows\System\HKgxhSG.exe
  C:\Windows\System\HKgxhSG.exe
  2⤵
  PID:8312
- C:\Windows\System\FofePgU.exe
  C:\Windows\System\FofePgU.exe
  2⤵
  PID:8336
- C:\Windows\System\kIkmsqk.exe
  C:\Windows\System\kIkmsqk.exe
  2⤵
  PID:8384
- C:\Windows\System\Dfhjtjr.exe
  C:\Windows\System\Dfhjtjr.exe
  2⤵
  PID:8400
- C:\Windows\System\JsqakyO.exe
  C:\Windows\System\JsqakyO.exe
  2⤵
  PID:8440
- C:\Windows\System\cBTEKiP.exe
  C:\Windows\System\cBTEKiP.exe
  2⤵
  PID:8460
- C:\Windows\System\BJgvJTh.exe
  C:\Windows\System\BJgvJTh.exe
  2⤵
  PID:8484
- C:\Windows\System\JbQIywV.exe
  C:\Windows\System\JbQIywV.exe
  2⤵
  PID:8536
- C:\Windows\System\iaxhbgi.exe
  C:\Windows\System\iaxhbgi.exe
  2⤵
  PID:8560
- C:\Windows\System\qtfZWzv.exe
  C:\Windows\System\qtfZWzv.exe
  2⤵
  PID:8628
- C:\Windows\System\cSlRyis.exe
  C:\Windows\System\cSlRyis.exe
  2⤵
  PID:8684
- C:\Windows\System\OhzlZVv.exe
  C:\Windows\System\OhzlZVv.exe
  2⤵
  PID:8700
- C:\Windows\System\qhdrAAq.exe
  C:\Windows\System\qhdrAAq.exe
  2⤵
  PID:8716
- C:\Windows\System\gIfjbcG.exe
  C:\Windows\System\gIfjbcG.exe
  2⤵
  PID:8732
- C:\Windows\System\qYScMHu.exe
  C:\Windows\System\qYScMHu.exe
  2⤵
  PID:8752
- C:\Windows\System\BPEYwsB.exe
  C:\Windows\System\BPEYwsB.exe
  2⤵
  PID:8808
- C:\Windows\System\dfAqNlz.exe
  C:\Windows\System\dfAqNlz.exe
  2⤵
  PID:8832
- C:\Windows\System\ISvuWbM.exe
  C:\Windows\System\ISvuWbM.exe
  2⤵
  PID:8848
- C:\Windows\System\bGnzLIx.exe
  C:\Windows\System\bGnzLIx.exe
  2⤵
  PID:8900
- C:\Windows\System\oGizfdJ.exe
  C:\Windows\System\oGizfdJ.exe
  2⤵
  PID:8928
- C:\Windows\System\RUMqqbs.exe
  C:\Windows\System\RUMqqbs.exe
  2⤵
  PID:8956
- C:\Windows\System\FfOMMUe.exe
  C:\Windows\System\FfOMMUe.exe
  2⤵
  PID:8976
- C:\Windows\System\BZGGXsz.exe
  C:\Windows\System\BZGGXsz.exe
  2⤵
  PID:9044
- C:\Windows\System\ssBuKBW.exe
  C:\Windows\System\ssBuKBW.exe
  2⤵
  PID:9068
- C:\Windows\System\BuxdJXb.exe
  C:\Windows\System\BuxdJXb.exe
  2⤵
  PID:9100
- C:\Windows\System\fXnEElY.exe
  C:\Windows\System\fXnEElY.exe
  2⤵
  PID:9136
- C:\Windows\System\ywpIdLI.exe
  C:\Windows\System\ywpIdLI.exe
  2⤵
  PID:9152
- C:\Windows\System\OpRUpyg.exe
  C:\Windows\System\OpRUpyg.exe
  2⤵
  PID:9188
- C:\Windows\System\uQcbapN.exe
  C:\Windows\System\uQcbapN.exe
  2⤵
  PID:344
- C:\Windows\System\cxGzvOS.exe
  C:\Windows\System\cxGzvOS.exe
  2⤵
  PID:8224
- C:\Windows\System\xUMfFGW.exe
  C:\Windows\System\xUMfFGW.exe
  2⤵
  PID:8208
- C:\Windows\System\tSLznPX.exe
  C:\Windows\System\tSLznPX.exe
  2⤵
  PID:8280
- C:\Windows\System\zOHxcPo.exe
  C:\Windows\System\zOHxcPo.exe
  2⤵
  PID:8344
- C:\Windows\System\KJaWUJG.exe
  C:\Windows\System\KJaWUJG.exe
  2⤵
  PID:8480
- C:\Windows\System\xsWJdqQ.exe
  C:\Windows\System\xsWJdqQ.exe
  2⤵
  PID:8524
- C:\Windows\System\XJslhFy.exe
  C:\Windows\System\XJslhFy.exe
  2⤵
  PID:8600
- C:\Windows\System\klCzqrW.exe
  C:\Windows\System\klCzqrW.exe
  2⤵
  PID:8604
- C:\Windows\System\srzgsWk.exe
  C:\Windows\System\srzgsWk.exe
  2⤵
  PID:8712
- C:\Windows\System\dYvgMGV.exe
  C:\Windows\System\dYvgMGV.exe
  2⤵
  PID:8592
- C:\Windows\System\ZZRfGDS.exe
  C:\Windows\System\ZZRfGDS.exe
  2⤵
  PID:8676
- C:\Windows\System\tpkyoaQ.exe
  C:\Windows\System\tpkyoaQ.exe
  2⤵
  PID:8648
- C:\Windows\System\LYEbYvJ.exe
  C:\Windows\System\LYEbYvJ.exe
  2⤵
  PID:8748
- C:\Windows\System\DELvLTg.exe
  C:\Windows\System\DELvLTg.exe
  2⤵
  PID:8896
- C:\Windows\System\psImwJv.exe
  C:\Windows\System\psImwJv.exe
  2⤵
  PID:8944
- C:\Windows\System\ARBWmIY.exe
  C:\Windows\System\ARBWmIY.exe
  2⤵
  PID:8972
- C:\Windows\System\KzFHbvH.exe
  C:\Windows\System\KzFHbvH.exe
  2⤵
  PID:9112
- C:\Windows\System\caLIiqk.exe
  C:\Windows\System\caLIiqk.exe
  2⤵
  PID:9196
- C:\Windows\System\wErwEfK.exe
  C:\Windows\System\wErwEfK.exe
  2⤵
  PID:9212
- C:\Windows\System\oytNyqv.exe
  C:\Windows\System\oytNyqv.exe
  2⤵
  PID:8196
- C:\Windows\System\muADXQQ.exe
  C:\Windows\System\muADXQQ.exe
  2⤵
  PID:9240
- C:\Windows\System\aohtUsy.exe
  C:\Windows\System\aohtUsy.exe
  2⤵
  PID:9272
- C:\Windows\System\XmHEOpu.exe
  C:\Windows\System\XmHEOpu.exe
  2⤵
  PID:9288
- C:\Windows\System\gRcxyVV.exe
  C:\Windows\System\gRcxyVV.exe
  2⤵
  PID:9304
- C:\Windows\System\rWflGWN.exe
  C:\Windows\System\rWflGWN.exe
  2⤵
  PID:9364
- C:\Windows\System\mfqUpKJ.exe
  C:\Windows\System\mfqUpKJ.exe
  2⤵
  PID:9380
- C:\Windows\System\sYsaVDt.exe
  C:\Windows\System\sYsaVDt.exe
  2⤵
  PID:9408
- C:\Windows\System\LigHDPi.exe
  C:\Windows\System\LigHDPi.exe
  2⤵
  PID:9444
- C:\Windows\System\FCFstdH.exe
  C:\Windows\System\FCFstdH.exe
  2⤵
  PID:9468
- C:\Windows\System\ZAKZQwT.exe
  C:\Windows\System\ZAKZQwT.exe
  2⤵
  PID:9492
- C:\Windows\System\LcGUYtp.exe
  C:\Windows\System\LcGUYtp.exe
  2⤵
  PID:9512
- C:\Windows\System\WTGAAdO.exe
  C:\Windows\System\WTGAAdO.exe
  2⤵
  PID:9548
- C:\Windows\System\mubiUOg.exe
  C:\Windows\System\mubiUOg.exe
  2⤵
  PID:9564
- C:\Windows\System\Ebrurmq.exe
  C:\Windows\System\Ebrurmq.exe
  2⤵
  PID:9624
- C:\Windows\System\nfPZNUB.exe
  C:\Windows\System\nfPZNUB.exe
  2⤵
  PID:9656
- C:\Windows\System\lcbycTl.exe
  C:\Windows\System\lcbycTl.exe
  2⤵
  PID:9676
- C:\Windows\System\HhKtBMC.exe
  C:\Windows\System\HhKtBMC.exe
  2⤵
  PID:9700
- C:\Windows\System\rBWWkPD.exe
  C:\Windows\System\rBWWkPD.exe
  2⤵
  PID:9728
- C:\Windows\System\evsIKAu.exe
  C:\Windows\System\evsIKAu.exe
  2⤵
  PID:9752
- C:\Windows\System\aEmHPln.exe
  C:\Windows\System\aEmHPln.exe
  2⤵
  PID:9772
- C:\Windows\System\WIpAkzS.exe
  C:\Windows\System\WIpAkzS.exe
  2⤵
  PID:9836
- C:\Windows\System\XBVXRtN.exe
  C:\Windows\System\XBVXRtN.exe
  2⤵
  PID:9864
- C:\Windows\System\sOrWrdR.exe
  C:\Windows\System\sOrWrdR.exe
  2⤵
  PID:9880
- C:\Windows\System\klHkeTk.exe
  C:\Windows\System\klHkeTk.exe
  2⤵
  PID:9896
- C:\Windows\System\hDbdsCy.exe
  C:\Windows\System\hDbdsCy.exe
  2⤵
  PID:9912
- C:\Windows\System\agTkuZj.exe
  C:\Windows\System\agTkuZj.exe
  2⤵
  PID:9932
- C:\Windows\System\joMbiLs.exe
  C:\Windows\System\joMbiLs.exe
  2⤵
  PID:9956
- C:\Windows\System\petkyEy.exe
  C:\Windows\System\petkyEy.exe
  2⤵
  PID:9980
- C:\Windows\System\clEfqgw.exe
  C:\Windows\System\clEfqgw.exe
  2⤵
  PID:10016
- C:\Windows\System\BPOwjdC.exe
  C:\Windows\System\BPOwjdC.exe
  2⤵
  PID:10076
- C:\Windows\System\JsXnIgR.exe
  C:\Windows\System\JsXnIgR.exe
  2⤵
  PID:10096
- C:\Windows\System\eiBExBw.exe
  C:\Windows\System\eiBExBw.exe
  2⤵
  PID:10140
- C:\Windows\System\HQpSCah.exe
  C:\Windows\System\HQpSCah.exe
  2⤵
  PID:10168
- C:\Windows\System\QGMTVyf.exe
  C:\Windows\System\QGMTVyf.exe
  2⤵
  PID:10184
- C:\Windows\System\RyEcIBD.exe
  C:\Windows\System\RyEcIBD.exe
  2⤵
  PID:10208
- C:\Windows\System\xOLAEOs.exe
  C:\Windows\System\xOLAEOs.exe
  2⤵
  PID:10224
- C:\Windows\System\tudspMR.exe
  C:\Windows\System\tudspMR.exe
  2⤵
  PID:8452
- C:\Windows\System\zgYVkGF.exe
  C:\Windows\System\zgYVkGF.exe
  2⤵
  PID:8580
- C:\Windows\System\WSRnnqc.exe
  C:\Windows\System\WSRnnqc.exe
  2⤵
  PID:8872
- C:\Windows\System\vRiRzcs.exe
  C:\Windows\System\vRiRzcs.exe
  2⤵
  PID:2596
- C:\Windows\System\pvPGhjX.exe
  C:\Windows\System\pvPGhjX.exe
  2⤵
  PID:8740
- C:\Windows\System\PhzjsEr.exe
  C:\Windows\System\PhzjsEr.exe
  2⤵
  PID:9000
- C:\Windows\System\MoxZIRw.exe
  C:\Windows\System\MoxZIRw.exe
  2⤵
  PID:9124
- C:\Windows\System\ZdipGop.exe
  C:\Windows\System\ZdipGop.exe
  2⤵
  PID:9228
- C:\Windows\System\EihYKmF.exe
  C:\Windows\System\EihYKmF.exe
  2⤵
  PID:9320
- C:\Windows\System\crhapGo.exe
  C:\Windows\System\crhapGo.exe
  2⤵
  PID:9268
- C:\Windows\System\HhZoKTX.exe
  C:\Windows\System\HhZoKTX.exe
  2⤵
  PID:9356
- C:\Windows\System\zkaqioB.exe
  C:\Windows\System\zkaqioB.exe
  2⤵
  PID:9436
- C:\Windows\System\TVUYaVU.exe
  C:\Windows\System\TVUYaVU.exe
  2⤵
  PID:9480
- C:\Windows\System\OxAWjME.exe
  C:\Windows\System\OxAWjME.exe
  2⤵
  PID:9612
- C:\Windows\System\tXYIbOr.exe
  C:\Windows\System\tXYIbOr.exe
  2⤵
  PID:9668
- C:\Windows\System\TPOmwwx.exe
  C:\Windows\System\TPOmwwx.exe
  2⤵
  PID:9720
- C:\Windows\System\xorPfOm.exe
  C:\Windows\System\xorPfOm.exe
  2⤵
  PID:9672
- C:\Windows\System\ogfkSgm.exe
  C:\Windows\System\ogfkSgm.exe
  2⤵
  PID:9724
- C:\Windows\System\MUTwBUe.exe
  C:\Windows\System\MUTwBUe.exe
  2⤵
  PID:9788
- C:\Windows\System\HerYjTd.exe
  C:\Windows\System\HerYjTd.exe
  2⤵
  PID:9848
- C:\Windows\System\BntcpXe.exe
  C:\Windows\System\BntcpXe.exe
  2⤵
  PID:9988
- C:\Windows\System\AHOcPAR.exe
  C:\Windows\System\AHOcPAR.exe
  2⤵
  PID:9928
- C:\Windows\System\TUsMrsM.exe
  C:\Windows\System\TUsMrsM.exe
  2⤵
  PID:10092
- C:\Windows\System\zxwziIZ.exe
  C:\Windows\System\zxwziIZ.exe
  2⤵
  PID:10148
- C:\Windows\System\cfDYssu.exe
  C:\Windows\System\cfDYssu.exe
  2⤵
  PID:10160
- C:\Windows\System\dvQtMRS.exe
  C:\Windows\System\dvQtMRS.exe
  2⤵
  PID:9056
- C:\Windows\System\munZgxk.exe
  C:\Windows\System\munZgxk.exe
  2⤵
  PID:8572
- C:\Windows\System\fVpzkLl.exe
  C:\Windows\System\fVpzkLl.exe
  2⤵
  PID:9220
- C:\Windows\System\ZPoLDMp.exe
  C:\Windows\System\ZPoLDMp.exe
  2⤵
  PID:9232
- C:\Windows\System\BsGOonF.exe
  C:\Windows\System\BsGOonF.exe
  2⤵
  PID:4008
- C:\Windows\System\MYsnrUA.exe
  C:\Windows\System\MYsnrUA.exe
  2⤵
  PID:9460
- C:\Windows\System\qcYNDOf.exe
  C:\Windows\System\qcYNDOf.exe
  2⤵
  PID:9708
- C:\Windows\System\zbbMghL.exe
  C:\Windows\System\zbbMghL.exe
  2⤵
  PID:9888
- C:\Windows\System\MVGbLhz.exe
  C:\Windows\System\MVGbLhz.exe
  2⤵
  PID:10124
- C:\Windows\System\riGmzdG.exe
  C:\Windows\System\riGmzdG.exe
  2⤵
  PID:10220
- C:\Windows\System\sLvGRbv.exe
  C:\Windows\System\sLvGRbv.exe
  2⤵
  PID:8792
- C:\Windows\System\JPVHNWE.exe
  C:\Windows\System\JPVHNWE.exe
  2⤵
  PID:9256
- C:\Windows\System\JXJDYMh.exe
  C:\Windows\System\JXJDYMh.exe
  2⤵
  PID:9348
- C:\Windows\System\OmKpVCt.exe
  C:\Windows\System\OmKpVCt.exe
  2⤵
  PID:9640
- C:\Windows\System\RfLKplW.exe
  C:\Windows\System\RfLKplW.exe
  2⤵
  PID:548
- C:\Windows\System\vMhYtrE.exe
  C:\Windows\System\vMhYtrE.exe
  2⤵
  PID:10128
- C:\Windows\System\NDxTmQu.exe
  C:\Windows\System\NDxTmQu.exe
  2⤵
  PID:8952
- C:\Windows\System\rTCokpr.exe
  C:\Windows\System\rTCokpr.exe
  2⤵
  PID:9580
- C:\Windows\System\tWbEFij.exe
  C:\Windows\System\tWbEFij.exe
  2⤵
  PID:8568
- C:\Windows\System\swHLhoY.exe
  C:\Windows\System\swHLhoY.exe
  2⤵
  PID:10260
- C:\Windows\System\ROQcAuD.exe
  C:\Windows\System\ROQcAuD.exe
  2⤵
  PID:10276
- C:\Windows\System\nremswV.exe
  C:\Windows\System\nremswV.exe
  2⤵
  PID:10300
- C:\Windows\System\ATTjtlP.exe
  C:\Windows\System\ATTjtlP.exe
  2⤵
  PID:10328
- C:\Windows\System\KnwpwGH.exe
  C:\Windows\System\KnwpwGH.exe
  2⤵
  PID:10348
- C:\Windows\System\qAceJui.exe
  C:\Windows\System\qAceJui.exe
  2⤵
  PID:10396
- C:\Windows\System\QUFCrGR.exe
  C:\Windows\System\QUFCrGR.exe
  2⤵
  PID:10432
- C:\Windows\System\iYcJBoL.exe
  C:\Windows\System\iYcJBoL.exe
  2⤵
  PID:10452
- C:\Windows\System\xwZgdUF.exe
  C:\Windows\System\xwZgdUF.exe
  2⤵
  PID:10472
- C:\Windows\System\zNUQLtT.exe
  C:\Windows\System\zNUQLtT.exe
  2⤵
  PID:10496
- C:\Windows\System\qrEqsHW.exe
  C:\Windows\System\qrEqsHW.exe
  2⤵
  PID:10524
- C:\Windows\System\QtScnsb.exe
  C:\Windows\System\QtScnsb.exe
  2⤵
  PID:10540
- C:\Windows\System\HVhEdzU.exe
  C:\Windows\System\HVhEdzU.exe
  2⤵
  PID:10604
- C:\Windows\System\IRLOBna.exe
  C:\Windows\System\IRLOBna.exe
  2⤵
  PID:10660
- C:\Windows\System\JvAyPLc.exe
  C:\Windows\System\JvAyPLc.exe
  2⤵
  PID:10676
- C:\Windows\System\GRFDeoT.exe
  C:\Windows\System\GRFDeoT.exe
  2⤵
  PID:10696
- C:\Windows\System\GIAFvBa.exe
  C:\Windows\System\GIAFvBa.exe
  2⤵
  PID:10752
- C:\Windows\System\kiVoDXr.exe
  C:\Windows\System\kiVoDXr.exe
  2⤵
  PID:10796
- C:\Windows\System\ZmaOknb.exe
  C:\Windows\System\ZmaOknb.exe
  2⤵
  PID:10816
- C:\Windows\System\cWHSMNV.exe
  C:\Windows\System\cWHSMNV.exe
  2⤵
  PID:10844
- C:\Windows\System\tIbhDeX.exe
  C:\Windows\System\tIbhDeX.exe
  2⤵
  PID:10860
- C:\Windows\System\ptjnqhq.exe
  C:\Windows\System\ptjnqhq.exe
  2⤵
  PID:10904
- C:\Windows\System\VPXmGEA.exe
  C:\Windows\System\VPXmGEA.exe
  2⤵
  PID:10928
- C:\Windows\System\XQfmNco.exe
  C:\Windows\System\XQfmNco.exe
  2⤵
  PID:10968
- C:\Windows\System\nxIPdZS.exe
  C:\Windows\System\nxIPdZS.exe
  2⤵
  PID:10988
- C:\Windows\System\vPgXETw.exe
  C:\Windows\System\vPgXETw.exe
  2⤵
  PID:11008
- C:\Windows\System\VWQoPTR.exe
  C:\Windows\System\VWQoPTR.exe
  2⤵
  PID:11036
- C:\Windows\System\BgJytAU.exe
  C:\Windows\System\BgJytAU.exe
  2⤵
  PID:11076
- C:\Windows\System\yUvaSQS.exe
  C:\Windows\System\yUvaSQS.exe
  2⤵
  PID:11108
- C:\Windows\System\AwoQQCq.exe
  C:\Windows\System\AwoQQCq.exe
  2⤵
  PID:11124
- C:\Windows\System\dalYHzq.exe
  C:\Windows\System\dalYHzq.exe
  2⤵
  PID:11148
- C:\Windows\System\kWdsEUX.exe
  C:\Windows\System\kWdsEUX.exe
  2⤵
  PID:11172
- C:\Windows\System\Bzjuclm.exe
  C:\Windows\System\Bzjuclm.exe
  2⤵
  PID:11192
- C:\Windows\System\VOWguYB.exe
  C:\Windows\System\VOWguYB.exe
  2⤵
  PID:11232
- C:\Windows\System\WVdQlxB.exe
  C:\Windows\System\WVdQlxB.exe
  2⤵
  PID:10268
- C:\Windows\System\jKAnNyP.exe
  C:\Windows\System\jKAnNyP.exe
  2⤵
  PID:8432
- C:\Windows\System\JkrKqUu.exe
  C:\Windows\System\JkrKqUu.exe
  2⤵
  PID:10308
- C:\Windows\System\vNZDaVO.exe
  C:\Windows\System\vNZDaVO.exe
  2⤵
  PID:10336
- C:\Windows\System\cULBatW.exe
  C:\Windows\System\cULBatW.exe
  2⤵
  PID:10552
- C:\Windows\System\oDxvfbH.exe
  C:\Windows\System\oDxvfbH.exe
  2⤵
  PID:10536
- C:\Windows\System\jpTltcv.exe
  C:\Windows\System\jpTltcv.exe
  2⤵
  PID:10592
- C:\Windows\System\svlztbw.exe
  C:\Windows\System\svlztbw.exe
  2⤵
  PID:10632
- C:\Windows\System\vPNgTVs.exe
  C:\Windows\System\vPNgTVs.exe
  2⤵
  PID:10668
- C:\Windows\System\OHwbwEl.exe
  C:\Windows\System\OHwbwEl.exe
  2⤵
  PID:10744
- C:\Windows\System\wjcNxTy.exe
  C:\Windows\System\wjcNxTy.exe
  2⤵
  PID:10828
- C:\Windows\System\SJbKFNL.exe
  C:\Windows\System\SJbKFNL.exe
  2⤵
  PID:10896
- C:\Windows\System\sPFlqfR.exe
  C:\Windows\System\sPFlqfR.exe
  2⤵
  PID:10980
- C:\Windows\System\gQNjPDV.exe
  C:\Windows\System\gQNjPDV.exe
  2⤵
  PID:11084
- C:\Windows\System\siKFyvG.exe
  C:\Windows\System\siKFyvG.exe
  2⤵
  PID:11104
- C:\Windows\System\CMLLBhS.exe
  C:\Windows\System\CMLLBhS.exe
  2⤵
  PID:11180
- C:\Windows\System\UCsfgJz.exe
  C:\Windows\System\UCsfgJz.exe
  2⤵
  PID:11252
- C:\Windows\System\sVtsTnV.exe
  C:\Windows\System\sVtsTnV.exe
  2⤵
  PID:9540
- C:\Windows\System\GXgsXKD.exe
  C:\Windows\System\GXgsXKD.exe
  2⤵
  PID:10296
- C:\Windows\System\PFcsLoA.exe
  C:\Windows\System\PFcsLoA.exe
  2⤵
  PID:10576
- C:\Windows\System\SdrZQje.exe
  C:\Windows\System\SdrZQje.exe
  2⤵
  PID:9952
- C:\Windows\System\XMJhcaN.exe
  C:\Windows\System\XMJhcaN.exe
  2⤵
  PID:10836
- C:\Windows\System\FGjaQmd.exe
  C:\Windows\System\FGjaQmd.exe
  2⤵
  PID:11032
- C:\Windows\System\AHIydOo.exe
  C:\Windows\System\AHIydOo.exe
  2⤵
  PID:11156
- C:\Windows\System\UQZMPMk.exe
  C:\Windows\System\UQZMPMk.exe
  2⤵
  PID:3540
- C:\Windows\System\qBJyxEl.exe
  C:\Windows\System\qBJyxEl.exe
  2⤵
  PID:10340
- C:\Windows\System\iFHvvGe.exe
  C:\Windows\System\iFHvvGe.exe
  2⤵
  PID:10856
- C:\Windows\System\rJNXYCB.exe
  C:\Windows\System\rJNXYCB.exe
  2⤵
  PID:11064
- C:\Windows\System\EVbRlbM.exe
  C:\Windows\System\EVbRlbM.exe
  2⤵
  PID:11244
- C:\Windows\System\IgWDBjh.exe
  C:\Windows\System\IgWDBjh.exe
  2⤵
  PID:11268
- C:\Windows\System\LKVpLcq.exe
  C:\Windows\System\LKVpLcq.exe
  2⤵
  PID:11292
- C:\Windows\System\iEhLRrW.exe
  C:\Windows\System\iEhLRrW.exe
  2⤵
  PID:11352
- C:\Windows\System\rDAgGpz.exe
  C:\Windows\System\rDAgGpz.exe
  2⤵
  PID:11384
- C:\Windows\System\OgmCNsX.exe
  C:\Windows\System\OgmCNsX.exe
  2⤵
  PID:11400
- C:\Windows\System\lhqrPYx.exe
  C:\Windows\System\lhqrPYx.exe
  2⤵
  PID:11420
- C:\Windows\System\iMgJTEa.exe
  C:\Windows\System\iMgJTEa.exe
  2⤵
  PID:11440
- C:\Windows\System\UkbCCnY.exe
  C:\Windows\System\UkbCCnY.exe
  2⤵
  PID:11480
- C:\Windows\System\OnYbxyE.exe
  C:\Windows\System\OnYbxyE.exe
  2⤵
  PID:11532
- C:\Windows\System\WGMLwHM.exe
  C:\Windows\System\WGMLwHM.exe
  2⤵
  PID:11552
- C:\Windows\System\mrtZJgB.exe
  C:\Windows\System\mrtZJgB.exe
  2⤵
  PID:11576
- C:\Windows\System\XXtKGie.exe
  C:\Windows\System\XXtKGie.exe
  2⤵
  PID:11612
- C:\Windows\System\vSFzHpn.exe
  C:\Windows\System\vSFzHpn.exe
  2⤵
  PID:11628
- C:\Windows\System\wmezVDx.exe
  C:\Windows\System\wmezVDx.exe
  2⤵
  PID:11656
- C:\Windows\System\YcvgVpa.exe
  C:\Windows\System\YcvgVpa.exe
  2⤵
  PID:11692
- C:\Windows\System\GgCcNPL.exe
  C:\Windows\System\GgCcNPL.exe
  2⤵
  PID:11716
- C:\Windows\System\RolbHgH.exe
  C:\Windows\System\RolbHgH.exe
  2⤵
  PID:11740
- C:\Windows\System\ppNToJK.exe
  C:\Windows\System\ppNToJK.exe
  2⤵
  PID:11764
- C:\Windows\System\iSNmqFN.exe
  C:\Windows\System\iSNmqFN.exe
  2⤵
  PID:11788
- C:\Windows\System\YuMdGwx.exe
  C:\Windows\System\YuMdGwx.exe
  2⤵
  PID:11808
- C:\Windows\System\xlqbjIA.exe
  C:\Windows\System\xlqbjIA.exe
  2⤵
  PID:11832
- C:\Windows\System\DHBASSN.exe
  C:\Windows\System\DHBASSN.exe
  2⤵
  PID:11852
- C:\Windows\System\QcLdEIw.exe
  C:\Windows\System\QcLdEIw.exe
  2⤵
  PID:11876
- C:\Windows\System\YhiFoaB.exe
  C:\Windows\System\YhiFoaB.exe
  2⤵
  PID:11896
- C:\Windows\System\CfHoNVt.exe
  C:\Windows\System\CfHoNVt.exe
  2⤵
  PID:11956
- C:\Windows\System\KJbnacV.exe
  C:\Windows\System\KJbnacV.exe
  2⤵
  PID:11972
- C:\Windows\System\dgwxdEu.exe
  C:\Windows\System\dgwxdEu.exe
  2⤵
  PID:11992
- C:\Windows\System\cJPrsiV.exe
  C:\Windows\System\cJPrsiV.exe
  2⤵
  PID:12012
- C:\Windows\System\qeCeqrf.exe
  C:\Windows\System\qeCeqrf.exe
  2⤵
  PID:12072
- C:\Windows\System\DNRRSkl.exe
  C:\Windows\System\DNRRSkl.exe
  2⤵
  PID:12096
- C:\Windows\System\IXJGNyn.exe
  C:\Windows\System\IXJGNyn.exe
  2⤵
  PID:12140
- C:\Windows\System\ExnkDOB.exe
  C:\Windows\System\ExnkDOB.exe
  2⤵
  PID:12172
- C:\Windows\System\xsozwiW.exe
  C:\Windows\System\xsozwiW.exe
  2⤵
  PID:12192
- C:\Windows\System\sAVLcSb.exe
  C:\Windows\System\sAVLcSb.exe
  2⤵
  PID:12212
- C:\Windows\System\HXPwpmx.exe
  C:\Windows\System\HXPwpmx.exe
  2⤵
  PID:12260
- C:\Windows\System\FjIKzVG.exe
  C:\Windows\System\FjIKzVG.exe
  2⤵
  PID:12280
- C:\Windows\System\gIIIETk.exe
  C:\Windows\System\gIIIETk.exe
  2⤵
  PID:10468
- C:\Windows\System\UBvjKhb.exe
  C:\Windows\System\UBvjKhb.exe
  2⤵
  PID:11324
- C:\Windows\System\PQghefO.exe
  C:\Windows\System\PQghefO.exe
  2⤵
  PID:11372
- C:\Windows\System\YXxoyqh.exe
  C:\Windows\System\YXxoyqh.exe
  2⤵
  PID:11408
- C:\Windows\System\MggUQdS.exe
  C:\Windows\System\MggUQdS.exe
  2⤵
  PID:11468
- C:\Windows\System\OQQJINc.exe
  C:\Windows\System\OQQJINc.exe
  2⤵
  PID:11648
- C:\Windows\System\DuTXXZh.exe
  C:\Windows\System\DuTXXZh.exe
  2⤵
  PID:11684
- C:\Windows\System\yHgpIAU.exe
  C:\Windows\System\yHgpIAU.exe
  2⤵
  PID:11800
- C:\Windows\System\mnlBdBt.exe
  C:\Windows\System\mnlBdBt.exe
  2⤵
  PID:11784
- C:\Windows\System\WswMgZU.exe
  C:\Windows\System\WswMgZU.exe
  2⤵
  PID:11892
- C:\Windows\System\tGPhZBB.exe
  C:\Windows\System\tGPhZBB.exe
  2⤵
  PID:11936
- C:\Windows\System\ktApjlG.exe
  C:\Windows\System\ktApjlG.exe
  2⤵
  PID:11984
- C:\Windows\System\NwgEKEy.exe
  C:\Windows\System\NwgEKEy.exe
  2⤵
  PID:12108
- C:\Windows\System\YnyTUSu.exe
  C:\Windows\System\YnyTUSu.exe
  2⤵
  PID:12188
- C:\Windows\System\tJLueJV.exe
  C:\Windows\System\tJLueJV.exe
  2⤵
  PID:11364
- C:\Windows\System\ShcxGEn.exe
  C:\Windows\System\ShcxGEn.exe
  2⤵
  PID:11476
- C:\Windows\System\TFwfRFz.exe
  C:\Windows\System\TFwfRFz.exe
  2⤵
  PID:11592
- C:\Windows\System\jwjBqRp.exe
  C:\Windows\System\jwjBqRp.exe
  2⤵
  PID:11680
- C:\Windows\System\Kvspmud.exe
  C:\Windows\System\Kvspmud.exe
  2⤵
  PID:11756
- C:\Windows\System\ROlfslj.exe
  C:\Windows\System\ROlfslj.exe
  2⤵
  PID:11828
- C:\Windows\System\GdMqIiF.exe
  C:\Windows\System\GdMqIiF.exe
  2⤵
  PID:11868
- C:\Windows\System\OTPbJDG.exe
  C:\Windows\System\OTPbJDG.exe
  2⤵
  PID:12060
- C:\Windows\System\lzqmqiN.exe
  C:\Windows\System\lzqmqiN.exe
  2⤵
  PID:12228
- C:\Windows\System\pHsQhxk.exe
  C:\Windows\System\pHsQhxk.exe
  2⤵
  PID:12300
- C:\Windows\System\fupmwIg.exe
  C:\Windows\System\fupmwIg.exe
  2⤵
  PID:12316
- C:\Windows\System\FHATKDG.exe
  C:\Windows\System\FHATKDG.exe
  2⤵
  PID:12332
- C:\Windows\System\KpjuUMo.exe
  C:\Windows\System\KpjuUMo.exe
  2⤵
  PID:12352
- C:\Windows\System\GlhaEhB.exe
  C:\Windows\System\GlhaEhB.exe
  2⤵
  PID:12372
- C:\Windows\System\mqIHHKu.exe
  C:\Windows\System\mqIHHKu.exe
  2⤵
  PID:12388
- C:\Windows\System\SZRhVxj.exe
  C:\Windows\System\SZRhVxj.exe
  2⤵
  PID:12408
- C:\Windows\System\NRTvGCy.exe
  C:\Windows\System\NRTvGCy.exe
  2⤵
  PID:12428
- C:\Windows\System\SwWcxNG.exe
  C:\Windows\System\SwWcxNG.exe
  2⤵
  PID:12444
- C:\Windows\System\tPaoLDX.exe
  C:\Windows\System\tPaoLDX.exe
  2⤵
  PID:12460
- C:\Windows\System\TYovQrp.exe
  C:\Windows\System\TYovQrp.exe
  2⤵
  PID:12484
- C:\Windows\System\CvSunqO.exe
  C:\Windows\System\CvSunqO.exe
  2⤵
  PID:12504
- C:\Windows\System\VikObcf.exe
  C:\Windows\System\VikObcf.exe
  2⤵
  PID:12520
- C:\Windows\System\ZaseKLa.exe
  C:\Windows\System\ZaseKLa.exe
  2⤵
  PID:12560
- C:\Windows\System\jLtoKZn.exe
  C:\Windows\System\jLtoKZn.exe
  2⤵
  PID:12764
- C:\Windows\System\QVBAfQk.exe
  C:\Windows\System\QVBAfQk.exe
  2⤵
  PID:12784
- C:\Windows\System\wOkThen.exe
  C:\Windows\System\wOkThen.exe
  2⤵
  PID:12800
- C:\Windows\System\TNxVpRf.exe
  C:\Windows\System\TNxVpRf.exe
  2⤵
  PID:12840
- C:\Windows\System\MuTqOVk.exe
  C:\Windows\System\MuTqOVk.exe
  2⤵
  PID:12856
- C:\Windows\System\ReHJRLJ.exe
  C:\Windows\System\ReHJRLJ.exe
  2⤵
  PID:12888
- C:\Windows\System\MEOIFDG.exe
  C:\Windows\System\MEOIFDG.exe
  2⤵
  PID:12936
- C:\Windows\System\LbkgUXx.exe
  C:\Windows\System\LbkgUXx.exe
  2⤵
  PID:12952
- C:\Windows\System\dBTwjcO.exe
  C:\Windows\System\dBTwjcO.exe
  2⤵
  PID:12976
- C:\Windows\System\QnjLLxV.exe
  C:\Windows\System\QnjLLxV.exe
  2⤵
  PID:13188
- C:\Windows\System\PkYLEgK.exe
  C:\Windows\System\PkYLEgK.exe
  2⤵
  PID:13216
- C:\Windows\System\OfKWzKF.exe
  C:\Windows\System\OfKWzKF.exe
  2⤵
  PID:13240
- C:\Windows\System\qDapQlX.exe
  C:\Windows\System\qDapQlX.exe
  2⤵
  PID:11920
- C:\Windows\System\WSPuxNt.exe
  C:\Windows\System\WSPuxNt.exe
  2⤵
  PID:12044
- C:\Windows\System\sxuntfv.exe
  C:\Windows\System\sxuntfv.exe
  2⤵
  PID:12312
- C:\Windows\System\iIRvSXb.exe
  C:\Windows\System\iIRvSXb.exe
  2⤵
  PID:12344
- C:\Windows\System\FkRtRxk.exe
  C:\Windows\System\FkRtRxk.exe
  2⤵
  PID:12384
- C:\Windows\System\ahcYhYd.exe
  C:\Windows\System\ahcYhYd.exe
  2⤵
  PID:12972
- C:\Windows\System\krdCMIT.exe
  C:\Windows\System\krdCMIT.exe
  2⤵
  PID:4332
- C:\Windows\System\NhPbBkF.exe
  C:\Windows\System\NhPbBkF.exe
  2⤵
  PID:13228
- C:\Windows\System\SEtXOBa.exe
  C:\Windows\System\SEtXOBa.exe
  2⤵
  PID:11328
- C:\Windows\System\QcJQipr.exe
  C:\Windows\System\QcJQipr.exe
  2⤵
  PID:12136
- C:\Windows\System\FFrKyCS.exe
  C:\Windows\System\FFrKyCS.exe
  2⤵
  PID:4884
- C:\Windows\System\RLzrAZi.exe
  C:\Windows\System\RLzrAZi.exe
  2⤵
  PID:12420
- C:\Windows\System\RyemmtJ.exe
  C:\Windows\System\RyemmtJ.exe
  2⤵
  PID:11988
- C:\Windows\System\dWkMQEq.exe
  C:\Windows\System\dWkMQEq.exe
  2⤵
  PID:12596
- C:\Windows\System\GaBAjKJ.exe
  C:\Windows\System\GaBAjKJ.exe
  2⤵
  PID:12128
- C:\Windows\System\RIxAVUn.exe
  C:\Windows\System\RIxAVUn.exe
  2⤵
  PID:13256
- C:\Windows\System\SxpHDhP.exe
  C:\Windows\System\SxpHDhP.exe
  2⤵
  PID:1020
- C:\Windows\System\oTntOmK.exe
  C:\Windows\System\oTntOmK.exe
  2⤵
  PID:4304
- C:\Windows\System\xheCWOc.exe
  C:\Windows\System\xheCWOc.exe
  2⤵
  PID:13084
- C:\Windows\System\PzZoJTB.exe
  C:\Windows\System\PzZoJTB.exe
  2⤵
  PID:3368
- C:\Windows\System\GuJoWWC.exe
  C:\Windows\System\GuJoWWC.exe
  2⤵
  PID:13100
- C:\Windows\System\gQRLoeG.exe
  C:\Windows\System\gQRLoeG.exe
  2⤵
  PID:7724
- C:\Windows\System\oGteHrQ.exe
  C:\Windows\System\oGteHrQ.exe
  2⤵
  PID:13252
- C:\Windows\System\vkKLvck.exe
  C:\Windows\System\vkKLvck.exe
  2⤵
  PID:13300
- C:\Windows\System\TihrdxJ.exe
  C:\Windows\System\TihrdxJ.exe
  2⤵
  PID:12240
- C:\Windows\System\bRNVoAH.exe
  C:\Windows\System\bRNVoAH.exe
  2⤵
  PID:5912
- C:\Windows\System\lpjtDbu.exe
  C:\Windows\System\lpjtDbu.exe
  2⤵
  PID:13268
- C:\Windows\System\yLqQuIb.exe
  C:\Windows\System\yLqQuIb.exe
  2⤵
  PID:12624
- C:\Windows\System\Fixqmqq.exe
  C:\Windows\System\Fixqmqq.exe
  2⤵
  PID:12832
- C:\Windows\System\eKyEHgm.exe
  C:\Windows\System\eKyEHgm.exe
  2⤵
  PID:2560
- C:\Windows\System\zhharhB.exe
  C:\Windows\System\zhharhB.exe
  2⤵
  PID:12380
- C:\Windows\System\xqoRxzJ.exe
  C:\Windows\System\xqoRxzJ.exe
  2⤵
  PID:2440
- C:\Windows\System\IjeDkoc.exe
  C:\Windows\System\IjeDkoc.exe
  2⤵
  PID:12456
- C:\Windows\System\kUJtJcJ.exe
  C:\Windows\System\kUJtJcJ.exe
  2⤵
  PID:7468
- C:\Windows\System\BncHfJB.exe
  C:\Windows\System\BncHfJB.exe
  2⤵
  PID:7640
- C:\Windows\System\FHFTFFU.exe
  C:\Windows\System\FHFTFFU.exe
  2⤵
  PID:6480
- C:\Windows\System\IugdTXB.exe
  C:\Windows\System\IugdTXB.exe
  2⤵
  PID:12608
- C:\Windows\System\rWcwUkU.exe
  C:\Windows\System\rWcwUkU.exe
  2⤵
  PID:12308
- C:\Windows\System\zCQaZiA.exe
  C:\Windows\System\zCQaZiA.exe
  2⤵
  PID:7828
- C:\Windows\System\hdazJcs.exe
  C:\Windows\System\hdazJcs.exe
  2⤵
  PID:8160
- C:\Windows\System\gtskOzo.exe
  C:\Windows\System\gtskOzo.exe
  2⤵
  PID:5960
- C:\Windows\System\xlhNudq.exe
  C:\Windows\System\xlhNudq.exe
  2⤵
  PID:3740
- C:\Windows\System\ProDVim.exe
  C:\Windows\System\ProDVim.exe
  2⤵
  PID:12852
- C:\Windows\System\PllKpja.exe
  C:\Windows\System\PllKpja.exe
  2⤵
  PID:6304
- C:\Windows\System\VrikCxo.exe
  C:\Windows\System\VrikCxo.exe
  2⤵
  PID:736
- C:\Windows\System\QWEODuU.exe
  C:\Windows\System\QWEODuU.exe
  2⤵
  PID:10120
- C:\Windows\System\QkONcpl.exe
  C:\Windows\System\QkONcpl.exe
  2⤵
  PID:8284
- C:\Windows\System\aLGoMKQ.exe
  C:\Windows\System\aLGoMKQ.exe
  2⤵
  PID:7220
- C:\Windows\System\EMDgNny.exe
  C:\Windows\System\EMDgNny.exe
  2⤵
  PID:8636
- C:\Windows\System\qvrQksy.exe
  C:\Windows\System\qvrQksy.exe
  2⤵
  PID:5576
- C:\Windows\System\hSTVAQe.exe
  C:\Windows\System\hSTVAQe.exe
  2⤵
  PID:7296
- C:\Windows\System\PaKAwnb.exe
  C:\Windows\System\PaKAwnb.exe
  2⤵
  PID:6612
- C:\Windows\System\KPkCzMo.exe
  C:\Windows\System\KPkCzMo.exe
  2⤵
  PID:6420
- C:\Windows\System\TVvreiw.exe
  C:\Windows\System\TVvreiw.exe
  2⤵
  PID:8276
- C:\Windows\System\cGoNHVe.exe
  C:\Windows\System\cGoNHVe.exe
  2⤵
  PID:4116
- C:\Windows\System\duEqVJG.exe
  C:\Windows\System\duEqVJG.exe
  2⤵
  PID:9088
- C:\Windows\System\KhRwRIV.exe
  C:\Windows\System\KhRwRIV.exe
  2⤵
  PID:3768
- C:\Windows\System\KrHFsga.exe
  C:\Windows\System\KrHFsga.exe
  2⤵
  PID:5928
- C:\Windows\System\SyBPwyw.exe
  C:\Windows\System\SyBPwyw.exe
  2⤵
  PID:6608
- C:\Windows\System\qMBdFwG.exe
  C:\Windows\System\qMBdFwG.exe
  2⤵
  PID:1380
- C:\Windows\System\AcasnRa.exe
  C:\Windows\System\AcasnRa.exe
  2⤵
  PID:12496
- C:\Windows\System\ocLzKSD.exe
  C:\Windows\System\ocLzKSD.exe
  2⤵
  PID:9388
- C:\Windows\System\SibqaSC.exe
  C:\Windows\System\SibqaSC.exe
  2⤵
  PID:12400
- C:\Windows\System\fOnQpQm.exe
  C:\Windows\System\fOnQpQm.exe
  2⤵
  PID:8184
- C:\Windows\System\MntrDrz.exe
  C:\Windows\System\MntrDrz.exe
  2⤵
  PID:5420
- C:\Windows\System\HIOtEzI.exe
  C:\Windows\System\HIOtEzI.exe
  2⤵
  PID:3172
- C:\Windows\System\KGVRghD.exe
  C:\Windows\System\KGVRghD.exe
  2⤵
  PID:9116
- C:\Windows\System\hNkFtNQ.exe
  C:\Windows\System\hNkFtNQ.exe
  2⤵
  PID:8728
- C:\Windows\System\cGFkIkj.exe
  C:\Windows\System\cGFkIkj.exe
  2⤵
  PID:7528
- C:\Windows\System\YKuxweV.exe
  C:\Windows\System\YKuxweV.exe
  2⤵
  PID:7504
- C:\Windows\System\zAqTarr.exe
  C:\Windows\System\zAqTarr.exe
  2⤵
  PID:10376
- C:\Windows\System\pqofnUN.exe
  C:\Windows\System\pqofnUN.exe
  2⤵
  PID:9692
- C:\Windows\System\AeyUVkm.exe
  C:\Windows\System\AeyUVkm.exe
  2⤵
  PID:4436
- C:\Windows\System\hwrZPwv.exe
  C:\Windows\System\hwrZPwv.exe
  2⤵
  PID:116
- C:\Windows\System\vlZSwro.exe
  C:\Windows\System\vlZSwro.exe
  2⤵
  PID:3240
- C:\Windows\System\tiBluSf.exe
  C:\Windows\System\tiBluSf.exe
  2⤵
  PID:6960
- C:\Windows\System\haZqSUj.exe
  C:\Windows\System\haZqSUj.exe
  2⤵
  PID:13148
- C:\Windows\System\oNVTOot.exe
  C:\Windows\System\oNVTOot.exe
  2⤵
  PID:10044
- C:\Windows\System\FveuSpr.exe
  C:\Windows\System\FveuSpr.exe
  2⤵
  PID:6964
- C:\Windows\System\SULRPvK.exe
  C:\Windows\System\SULRPvK.exe
  2⤵
  PID:6476
- C:\Windows\System\RmNeGMu.exe
  C:\Windows\System\RmNeGMu.exe
  2⤵
  PID:11276
- C:\Windows\System\JBnQuQJ.exe
  C:\Windows\System\JBnQuQJ.exe
  2⤵
  PID:11312
- C:\Windows\System\snOxthX.exe
  C:\Windows\System\snOxthX.exe
  2⤵
  PID:2084
- C:\Windows\System\fhzGRkZ.exe
  C:\Windows\System\fhzGRkZ.exe
  2⤵
  PID:10232
- C:\Windows\System\EJyfPFq.exe
  C:\Windows\System\EJyfPFq.exe
  2⤵
  PID:3620
- C:\Windows\System\dbIjuYV.exe
  C:\Windows\System\dbIjuYV.exe
  2⤵
  PID:6600
- C:\Windows\System\fcGLorn.exe
  C:\Windows\System\fcGLorn.exe
  2⤵
  PID:7472
- C:\Windows\System\BerAaaD.exe
  C:\Windows\System\BerAaaD.exe
  2⤵
  PID:12156
- C:\Windows\System\oMXPkoA.exe
  C:\Windows\System\oMXPkoA.exe
  2⤵
  PID:7760
- C:\Windows\System\QoDarWF.exe
  C:\Windows\System\QoDarWF.exe
  2⤵
  PID:5876
- C:\Windows\System\OAkhyIY.exe
  C:\Windows\System\OAkhyIY.exe
  2⤵
  PID:8800
- C:\Windows\System\wejaPjR.exe
  C:\Windows\System\wejaPjR.exe
  2⤵
  PID:10252
- C:\Windows\System\VqsaywX.exe
  C:\Windows\System\VqsaywX.exe
  2⤵
  PID:12920
- C:\Windows\System\yZzXmKv.exe
  C:\Windows\System\yZzXmKv.exe
  2⤵
  PID:7644
- C:\Windows\System\zCKVHwY.exe
  C:\Windows\System\zCKVHwY.exe
  2⤵
  PID:3076
- C:\Windows\System\klRJOKr.exe
  C:\Windows\System\klRJOKr.exe
  2⤵
  PID:6996
- C:\Windows\System\tkQPMFb.exe
  C:\Windows\System\tkQPMFb.exe
  2⤵
  PID:3756
- C:\Windows\System\WLnKAWK.exe
  C:\Windows\System\WLnKAWK.exe
  2⤵
  PID:4872
- C:\Windows\System\RLzjFVN.exe
  C:\Windows\System\RLzjFVN.exe
  2⤵
  PID:11220
- C:\Windows\System\bKuDFMs.exe
  C:\Windows\System\bKuDFMs.exe
  2⤵
  PID:8144
- C:\Windows\System\phFPjqc.exe
  C:\Windows\System\phFPjqc.exe
  2⤵
  PID:3548
- C:\Windows\System\mICYYnM.exe
  C:\Windows\System\mICYYnM.exe
  2⤵
  PID:11568
- C:\Windows\System\YSRITHg.exe
  C:\Windows\System\YSRITHg.exe
  2⤵
  PID:13052
- C:\Windows\System\IauFjVq.exe
  C:\Windows\System\IauFjVq.exe
  2⤵
  PID:7376
- C:\Windows\System\xoqXUzW.exe
  C:\Windows\System\xoqXUzW.exe
  2⤵
  PID:1504
- C:\Windows\System\IrlSXru.exe
  C:\Windows\System\IrlSXru.exe
  2⤵
  PID:12068
- C:\Windows\System\wDMHmpu.exe
  C:\Windows\System\wDMHmpu.exe
  2⤵
  PID:5192
- C:\Windows\System\bUhSJld.exe
  C:\Windows\System\bUhSJld.exe
  2⤵
  PID:11396
- C:\Windows\System\lTiLQds.exe
  C:\Windows\System\lTiLQds.exe
  2⤵
  PID:5200
- C:\Windows\System\HnRFDTV.exe
  C:\Windows\System\HnRFDTV.exe
  2⤵
  PID:7512
- C:\Windows\System\nejSTBY.exe
  C:\Windows\System\nejSTBY.exe
  2⤵
  PID:2792
- C:\Windows\System\XpmKNCE.exe
  C:\Windows\System\XpmKNCE.exe
  2⤵
  PID:10196
- C:\Windows\System\YXgAxLX.exe
  C:\Windows\System\YXgAxLX.exe
  2⤵
  PID:13304
- C:\Windows\System\UQOvebE.exe
  C:\Windows\System\UQOvebE.exe
  2⤵
  PID:544
- C:\Windows\System\ezRdksc.exe
  C:\Windows\System\ezRdksc.exe
  2⤵
  PID:640
- C:\Windows\System\eiKTITs.exe
  C:\Windows\System\eiKTITs.exe
  2⤵
  PID:5924
- C:\Windows\System\yEbaFZg.exe
  C:\Windows\System\yEbaFZg.exe
  2⤵
  PID:4288
- C:\Windows\System\BoYqIPu.exe
  C:\Windows\System\BoYqIPu.exe
  2⤵
  PID:10740
- C:\Windows\System\KJtKtGY.exe
  C:\Windows\System\KJtKtGY.exe
  2⤵
  PID:9176
- C:\Windows\System\XJNvJLe.exe
  C:\Windows\System\XJNvJLe.exe
  2⤵
  PID:4432
- C:\Windows\System\hvUojNh.exe
  C:\Windows\System\hvUojNh.exe
  2⤵
  PID:2644
- C:\Windows\System\eyZdmtg.exe
  C:\Windows\System\eyZdmtg.exe
  2⤵
  PID:4512
- C:\Windows\System\nahWndO.exe
  C:\Windows\System\nahWndO.exe
  2⤵
  PID:10792
- C:\Windows\System\PapZQUt.exe
  C:\Windows\System\PapZQUt.exe
  2⤵
  PID:10936
- C:\Windows\System\eQphvJw.exe
  C:\Windows\System\eQphvJw.exe
  2⤵
  PID:1628
- C:\Windows\System\TOwTmeb.exe
  C:\Windows\System\TOwTmeb.exe
  2⤵
  PID:7328
- C:\Windows\System\gYKiJvm.exe
  C:\Windows\System\gYKiJvm.exe
  2⤵
  PID:12032
- C:\Windows\System\BAJNByf.exe
  C:\Windows\System\BAJNByf.exe
  2⤵
  PID:3536
- C:\Windows\System\lHwGWMQ.exe
  C:\Windows\System\lHwGWMQ.exe
  2⤵
  PID:5232
- C:\Windows\System\lTXLfOG.exe
  C:\Windows\System\lTXLfOG.exe
  2⤵
  PID:3304
- C:\Windows\System\mgEhQKE.exe
  C:\Windows\System\mgEhQKE.exe
  2⤵
  PID:12200
- C:\Windows\System\FOVLwqB.exe
  C:\Windows\System\FOVLwqB.exe
  2⤵
  PID:5300
- C:\Windows\System\sOrLLmt.exe
  C:\Windows\System\sOrLLmt.exe
  2⤵
  PID:7752
- C:\Windows\System\hrSqDFd.exe
  C:\Windows\System\hrSqDFd.exe
  2⤵
  PID:5448
- C:\Windows\System\cvoLcoh.exe
  C:\Windows\System\cvoLcoh.exe
  2⤵
  PID:5600
- C:\Windows\System\RXOcCRU.exe
  C:\Windows\System\RXOcCRU.exe
  2⤵
  PID:2284
- C:\Windows\System\FdlpYKB.exe
  C:\Windows\System\FdlpYKB.exe
  2⤵
  PID:2368
- C:\Windows\System\xsMRnLv.exe
  C:\Windows\System\xsMRnLv.exe
  2⤵
  PID:4684
- C:\Windows\System\wRkqAlP.exe
  C:\Windows\System\wRkqAlP.exe
  2⤵
  PID:11452
- C:\Windows\System\CgtxWLr.exe
  C:\Windows\System\CgtxWLr.exe
  2⤵
  PID:6188
- C:\Windows\System\kyRRUAb.exe
  C:\Windows\System\kyRRUAb.exe
  2⤵
  PID:1448
- C:\Windows\System\gXdKojQ.exe
  C:\Windows\System\gXdKojQ.exe
  2⤵
  PID:3712
- C:\Windows\System\tlelwPi.exe
  C:\Windows\System\tlelwPi.exe
  2⤵
  PID:6248
- C:\Windows\System\dKLPfSZ.exe
  C:\Windows\System\dKLPfSZ.exe
  2⤵
  PID:4864
- C:\Windows\System\VrtFGZz.exe
  C:\Windows\System\VrtFGZz.exe
  2⤵
  PID:8532
- C:\Windows\System\nzADHbP.exe
  C:\Windows\System\nzADHbP.exe
  2⤵
  PID:6308
- C:\Windows\System\QTbQpGA.exe
  C:\Windows\System\QTbQpGA.exe
  2⤵
  PID:6388
- C:\Windows\System\rkiBMRH.exe
  C:\Windows\System\rkiBMRH.exe
  2⤵
  PID:12084
- C:\Windows\System\nEvHVZX.exe
  C:\Windows\System\nEvHVZX.exe
  2⤵
  PID:9504
- C:\Windows\System\XzjSsfb.exe
  C:\Windows\System\XzjSsfb.exe
  2⤵
  PID:6464
- C:\Windows\System\OOPHMrU.exe
  C:\Windows\System\OOPHMrU.exe
  2⤵
  PID:6544
- C:\Windows\System\SWqDiyE.exe
  C:\Windows\System\SWqDiyE.exe
  2⤵
  PID:12088
- C:\Windows\System\wyxxBoa.exe
  C:\Windows\System\wyxxBoa.exe
  2⤵
  PID:6784
- C:\Windows\System\ZZWrqky.exe
  C:\Windows\System\ZZWrqky.exe
  2⤵
  PID:12168
- C:\Windows\System\pHfPJNp.exe
  C:\Windows\System\pHfPJNp.exe
  2⤵
  PID:7396
- C:\Windows\System\NSidLXB.exe
  C:\Windows\System\NSidLXB.exe
  2⤵
  PID:5388
- C:\Windows\System\fRezbvz.exe
  C:\Windows\System\fRezbvz.exe
  2⤵
  PID:9184
- C:\Windows\System\yTnlQRS.exe
  C:\Windows\System\yTnlQRS.exe
  2⤵
  PID:10448
- C:\Windows\System\aNDRVKW.exe
  C:\Windows\System\aNDRVKW.exe
  2⤵
  PID:10688
- C:\Windows\System\UgwTDfe.exe
  C:\Windows\System\UgwTDfe.exe
  2⤵
  PID:5656
- C:\Windows\System\QqtmDVN.exe
  C:\Windows\System\QqtmDVN.exe
  2⤵
  PID:5652
- C:\Windows\System\TcjxKdr.exe
  C:\Windows\System\TcjxKdr.exe
  2⤵
  PID:13060
- C:\Windows\System\rLVxmgw.exe
  C:\Windows\System\rLVxmgw.exe
  2⤵
  PID:2152
- C:\Windows\System\DKNdyJz.exe
  C:\Windows\System\DKNdyJz.exe
  2⤵
  PID:7636
- C:\Windows\System\EbOeEMs.exe
  C:\Windows\System\EbOeEMs.exe
  2⤵
  PID:216
- C:\Windows\System\BoMHHdh.exe
  C:\Windows\System\BoMHHdh.exe
  2⤵
  PID:8104
- C:\Windows\System\QpobEIY.exe
  C:\Windows\System\QpobEIY.exe
  2⤵
  PID:7256
- C:\Windows\System\svPlKKH.exe
  C:\Windows\System\svPlKKH.exe
  2⤵
  PID:7720
- C:\Windows\System\giIpAJU.exe
  C:\Windows\System\giIpAJU.exe
  2⤵
  PID:3532
- C:\Windows\System\BmsgKZg.exe
  C:\Windows\System\BmsgKZg.exe
  2⤵
  PID:6200
- C:\Windows\System\WRroRog.exe
  C:\Windows\System\WRroRog.exe
  2⤵
  PID:8044
- C:\Windows\System\IVBOFou.exe
  C:\Windows\System\IVBOFou.exe
  2⤵
  PID:4448
- C:\Windows\System\wqiwSGe.exe
  C:\Windows\System\wqiwSGe.exe
  2⤵
  PID:5944
- C:\Windows\System\nRiOJgR.exe
  C:\Windows\System\nRiOJgR.exe
  2⤵
  PID:7368
- C:\Windows\System\OBVLlHk.exe
  C:\Windows\System\OBVLlHk.exe
  2⤵
  PID:8060
- C:\Windows\System\zzujlwQ.exe
  C:\Windows\System\zzujlwQ.exe
  2⤵
  PID:7188
- C:\Windows\System\bZDUYba.exe
  C:\Windows\System\bZDUYba.exe
  2⤵
  PID:5604
- C:\Windows\System\ECFuvhS.exe
  C:\Windows\System\ECFuvhS.exe
  2⤵
  PID:6740
- C:\Windows\System\rkCZEXU.exe
  C:\Windows\System\rkCZEXU.exe
  2⤵
  PID:5400
- C:\Windows\System\CReLKpB.exe
  C:\Windows\System\CReLKpB.exe
  2⤵
  PID:5872
- C:\Windows\System\SmnizGT.exe
  C:\Windows\System\SmnizGT.exe
  2⤵
  PID:5884
- C:\Windows\System\fzaUTWo.exe
  C:\Windows\System\fzaUTWo.exe
  2⤵
  PID:3576
- C:\Windows\System\BBExNZw.exe
  C:\Windows\System\BBExNZw.exe
  2⤵
  PID:6512
- C:\Windows\System\DfEvFJO.exe
  C:\Windows\System\DfEvFJO.exe
  2⤵
  PID:6456
- C:\Windows\System\pssUVMO.exe
  C:\Windows\System\pssUVMO.exe
  2⤵
  PID:7400
- C:\Windows\System\BXgTnQV.exe
  C:\Windows\System\BXgTnQV.exe
  2⤵
  PID:6340
- C:\Windows\System\uAbAQHf.exe
  C:\Windows\System\uAbAQHf.exe
  2⤵
  PID:6500
- C:\Windows\System\meEZKQt.exe
  C:\Windows\System\meEZKQt.exe
  2⤵
  PID:12036
- C:\Windows\System\XpUQzKz.exe
  C:\Windows\System\XpUQzKz.exe
  2⤵
  PID:3896
- C:\Windows\System\xRwKHLr.exe
  C:\Windows\System\xRwKHLr.exe
  2⤵
  PID:8436
- C:\Windows\System\tPXnVuB.exe
  C:\Windows\System\tPXnVuB.exe
  2⤵
  PID:11456
- C:\Windows\System\qCTGXvS.exe
  C:\Windows\System\qCTGXvS.exe
  2⤵
  PID:6900
- C:\Windows\System\GMKBfRC.exe
  C:\Windows\System\GMKBfRC.exe
  2⤵
  PID:7432
- C:\Windows\System\puAQNoG.exe
  C:\Windows\System\puAQNoG.exe
  2⤵
  PID:6128
- C:\Windows\System\jtCRFfe.exe
  C:\Windows\System\jtCRFfe.exe
  2⤵
  PID:8252
- C:\Windows\System\gghPxvD.exe
  C:\Windows\System\gghPxvD.exe
  2⤵
  PID:8320
- C:\Windows\System\oDfxNMl.exe
  C:\Windows\System\oDfxNMl.exe
  2⤵
  PID:8476
- C:\Windows\System\AKjtgji.exe
  C:\Windows\System\AKjtgji.exe
  2⤵
  PID:11676
- C:\Windows\System\jZJwNvo.exe
  C:\Windows\System\jZJwNvo.exe
  2⤵
  PID:6192
- C:\Windows\System\HSptUXj.exe
  C:\Windows\System\HSptUXj.exe
  2⤵
  PID:11604
- C:\Windows\System\bVtuwgx.exe
  C:\Windows\System\bVtuwgx.exe
  2⤵
  PID:1068
- C:\Windows\System\fLUIROZ.exe
  C:\Windows\System\fLUIROZ.exe
  2⤵
  PID:808
- C:\Windows\System\CqiXdzF.exe
  C:\Windows\System\CqiXdzF.exe
  2⤵
  PID:8780
- C:\Windows\System\kggGtzx.exe
  C:\Windows\System\kggGtzx.exe
  2⤵
  PID:8864
- C:\Windows\System\lvhUyXY.exe
  C:\Windows\System\lvhUyXY.exe
  2⤵
  PID:12568
- C:\Windows\System\iazdyBL.exe
  C:\Windows\System\iazdyBL.exe
  2⤵
  PID:8772
- C:\Windows\System\hBESoGe.exe
  C:\Windows\System\hBESoGe.exe
  2⤵
  PID:9024
- C:\Windows\System\xIirdYh.exe
  C:\Windows\System\xIirdYh.exe
  2⤵
  PID:7040
- C:\Windows\System\dhjxvZP.exe
  C:\Windows\System\dhjxvZP.exe
  2⤵
  PID:6852
- C:\Windows\System\qfxJRoo.exe
  C:\Windows\System\qfxJRoo.exe
  2⤵
  PID:7728
- C:\Windows\System\DqAKsbO.exe
  C:\Windows\System\DqAKsbO.exe
  2⤵
  PID:9572
- C:\Windows\System\PkEQiWL.exe
  C:\Windows\System\PkEQiWL.exe
  2⤵
  PID:9636
- C:\Windows\System\oJmWgue.exe
  C:\Windows\System\oJmWgue.exe
  2⤵
  PID:9588
- C:\Windows\System\dtgIIyU.exe
  C:\Windows\System\dtgIIyU.exe
  2⤵
  PID:4056
- C:\Windows\System\wvYNNpc.exe
  C:\Windows\System\wvYNNpc.exe
  2⤵
  PID:3764
- C:\Windows\System\oAtoNXS.exe
  C:\Windows\System\oAtoNXS.exe
  2⤵
  PID:9488
- C:\Windows\System\bxSXXKx.exe
  C:\Windows\System\bxSXXKx.exe
  2⤵
  PID:9420
- C:\Windows\System\NvARqAT.exe
  C:\Windows\System\NvARqAT.exe
  2⤵
  PID:9532
- C:\Windows\System\QRIxjju.exe
  C:\Windows\System\QRIxjju.exe
  2⤵
  PID:6120
- C:\Windows\System\VuVZAQC.exe
  C:\Windows\System\VuVZAQC.exe
  2⤵
  PID:9976
- C:\Windows\System\aDWMjmU.exe
  C:\Windows\System\aDWMjmU.exe
  2⤵
  PID:10052
- C:\Windows\System\yTAxgcQ.exe
  C:\Windows\System\yTAxgcQ.exe
  2⤵
  PID:9780
- C:\Windows\System\gMUeTDS.exe
  C:\Windows\System\gMUeTDS.exe
  2⤵
  PID:6260
- C:\Windows\System\lyGAKkt.exe
  C:\Windows\System\lyGAKkt.exe
  2⤵
  PID:6172
- C:\Windows\System\ufPtWvI.exe
  C:\Windows\System\ufPtWvI.exe
  2⤵
  PID:7508
- C:\Windows\System\LtlllfK.exe
  C:\Windows\System\LtlllfK.exe
  2⤵
  PID:8356
- C:\Windows\System\mBUnqUE.exe
  C:\Windows\System\mBUnqUE.exe
  2⤵
  PID:5852
- C:\Windows\System\qeqYYAY.exe
  C:\Windows\System\qeqYYAY.exe
  2⤵
  PID:4192
- C:\Windows\System\oOpIPqA.exe
  C:\Windows\System\oOpIPqA.exe
  2⤵
  PID:8408
- C:\Windows\System\YjHipjB.exe
  C:\Windows\System\YjHipjB.exe
  2⤵
  PID:7424
- C:\Windows\System\ORTTKOx.exe
  C:\Windows\System\ORTTKOx.exe
  2⤵
  PID:8876
- C:\Windows\System\oHOAbWY.exe
  C:\Windows\System\oHOAbWY.exe
  2⤵
  PID:6536
- C:\Windows\System\mpGYdGM.exe
  C:\Windows\System\mpGYdGM.exe
  2⤵
  PID:8412
- C:\Windows\System\cAvXXlD.exe
  C:\Windows\System\cAvXXlD.exe
  2⤵
  PID:8784
- C:\Windows\System\ApkPHfy.exe
  C:\Windows\System\ApkPHfy.exe
  2⤵
  PID:9208
- C:\Windows\System\Mipouyt.exe
  C:\Windows\System\Mipouyt.exe
  2⤵
  PID:9012
- C:\Windows\System\rUjATDU.exe
  C:\Windows\System\rUjATDU.exe
  2⤵
  PID:748
- C:\Windows\System\DpJznQN.exe
  C:\Windows\System\DpJznQN.exe
  2⤵
  PID:316
- C:\Windows\System\jZaengt.exe
  C:\Windows\System\jZaengt.exe
  2⤵
  PID:6292
- C:\Windows\System\nQzzxCg.exe
  C:\Windows\System\nQzzxCg.exe
  2⤵
  PID:9904
- C:\Windows\System\hMpEzha.exe
  C:\Windows\System\hMpEzha.exe
  2⤵
  PID:9948
- C:\Windows\System\PDIvNlN.exe
  C:\Windows\System\PDIvNlN.exe
  2⤵
  PID:8884
- C:\Windows\System\YUhRKOn.exe
  C:\Windows\System\YUhRKOn.exe
  2⤵
  PID:4052
- C:\Windows\System\mbacRhI.exe
  C:\Windows\System\mbacRhI.exe
  2⤵
  PID:10484
- C:\Windows\System\PKUEEzK.exe
  C:\Windows\System\PKUEEzK.exe
  2⤵
  PID:13280
- C:\Windows\System\GYeKVxR.exe
  C:\Windows\System\GYeKVxR.exe
  2⤵
  PID:10772
- C:\Windows\System\SdnFWmD.exe
  C:\Windows\System\SdnFWmD.exe
  2⤵
  PID:5132
- C:\Windows\System\HihSfoM.exe
  C:\Windows\System\HihSfoM.exe
  2⤵
  PID:5644
- C:\Windows\System\jQUlrSz.exe
  C:\Windows\System\jQUlrSz.exe
  2⤵
  PID:9440
- C:\Windows\System\ihCVaNY.exe
  C:\Windows\System\ihCVaNY.exe
  2⤵
  PID:7740
- C:\Windows\System\CFzJLJn.exe
  C:\Windows\System\CFzJLJn.exe
  2⤵
  PID:8304
- C:\Windows\System\DuKGhTv.exe
  C:\Windows\System\DuKGhTv.exe
  2⤵
  PID:8188
- C:\Windows\System\hIAKjTt.exe
  C:\Windows\System\hIAKjTt.exe
  2⤵
  PID:12900
- C:\Windows\System\niehvrr.exe
  C:\Windows\System\niehvrr.exe
  2⤵
  PID:7276
- C:\Windows\System\gePMCkh.exe
  C:\Windows\System\gePMCkh.exe
  2⤵
  PID:9536
- C:\Windows\System\HjPPwlh.exe
  C:\Windows\System\HjPPwlh.exe
  2⤵
  PID:10284
- C:\Windows\System\hWbVAMC.exe
  C:\Windows\System\hWbVAMC.exe
  2⤵
  PID:7552
- C:\Windows\System\QFwXUQA.exe
  C:\Windows\System\QFwXUQA.exe
  2⤵
  PID:5144
- C:\Windows\System\cEaQEhT.exe
  C:\Windows\System\cEaQEhT.exe
  2⤵
  PID:6952
- C:\Windows\System\rSdZnhC.exe
  C:\Windows\System\rSdZnhC.exe
  2⤵
  PID:10684
- C:\Windows\System\kZRbuiJ.exe
  C:\Windows\System\kZRbuiJ.exe
  2⤵
  PID:9592
- C:\Windows\System\ovJfwJy.exe
  C:\Windows\System\ovJfwJy.exe
  2⤵
  PID:11256
- C:\Windows\System\xKNXDBg.exe
  C:\Windows\System\xKNXDBg.exe
  2⤵
  PID:10444
- C:\Windows\System\lHlGNWW.exe
  C:\Windows\System\lHlGNWW.exe
  2⤵
  PID:10920
- C:\Windows\System\wawrGAA.exe
  C:\Windows\System\wawrGAA.exe
  2⤵
  PID:6856
- C:\Windows\System\sFKQHKZ.exe
  C:\Windows\System\sFKQHKZ.exe
  2⤵
  PID:5392
- C:\Windows\System\llqmkmO.exe
  C:\Windows\System\llqmkmO.exe
  2⤵
  PID:5784
- C:\Windows\System\NFAYVFM.exe
  C:\Windows\System\NFAYVFM.exe
  2⤵
  PID:840
- C:\Windows\System\axTKumU.exe
  C:\Windows\System\axTKumU.exe
  2⤵
  PID:11448
- C:\Windows\System\QXzLTAE.exe
  C:\Windows\System\QXzLTAE.exe
  2⤵
  PID:10600
- C:\Windows\System\HttBZro.exe
  C:\Windows\System\HttBZro.exe
  2⤵
  PID:11888
- C:\Windows\System\BfWqJiY.exe
  C:\Windows\System\BfWqJiY.exe
  2⤵
  PID:11940
- C:\Windows\System\IYZuNkI.exe
  C:\Windows\System\IYZuNkI.exe
  2⤵
  PID:8360
- C:\Windows\System\MOKwDnK.exe
  C:\Windows\System\MOKwDnK.exe
  2⤵
  PID:8616
- C:\Windows\System\jfYAKFv.exe
  C:\Windows\System\jfYAKFv.exe
  2⤵
  PID:12080
- C:\Windows\System\iESvttV.exe
  C:\Windows\System\iESvttV.exe
  2⤵
  PID:7096
- C:\Windows\System\tcKdrjp.exe
  C:\Windows\System\tcKdrjp.exe
  2⤵
  PID:7988
- C:\Windows\System\MNHpMJB.exe
  C:\Windows\System\MNHpMJB.exe
  2⤵
  PID:8508
- C:\Windows\System\tVIEKZJ.exe
  C:\Windows\System\tVIEKZJ.exe
  2⤵
  PID:8924
- C:\Windows\System\fIfcarq.exe
  C:\Windows\System\fIfcarq.exe
  2⤵
  PID:9020
- C:\Windows\System\dDMvxOW.exe
  C:\Windows\System\dDMvxOW.exe
  2⤵
  PID:12244
- C:\Windows\System\HAdoLjX.exe
  C:\Windows\System\HAdoLjX.exe
  2⤵
  PID:10460
- C:\Windows\System\kwapkUu.exe
  C:\Windows\System\kwapkUu.exe
  2⤵
  PID:5596
- C:\Windows\System\IKTniQB.exe
  C:\Windows\System\IKTniQB.exe
  2⤵
  PID:12232
- C:\Windows\System\WfXHixE.exe
  C:\Windows\System\WfXHixE.exe
  2⤵
  PID:9996
- C:\Windows\System\KWbxnqa.exe
  C:\Windows\System\KWbxnqa.exe
  2⤵
  PID:12028
- C:\Windows\System\YLxlOJX.exe
  C:\Windows\System\YLxlOJX.exe
  2⤵
  PID:12492
- C:\Windows\System\XOAkNBg.exe
  C:\Windows\System\XOAkNBg.exe
  2⤵
  PID:9428
- C:\Windows\System\PwESirh.exe
  C:\Windows\System\PwESirh.exe
  2⤵
  PID:10564
- C:\Windows\System\ZOkqkeG.exe
  C:\Windows\System\ZOkqkeG.exe
  2⤵
  PID:9032
- C:\Windows\System\eldMlPz.exe
  C:\Windows\System\eldMlPz.exe
  2⤵
  PID:9036
- C:\Windows\System\HrgAmxG.exe
  C:\Windows\System\HrgAmxG.exe
  2⤵
  PID:6336
- C:\Windows\System\NoWldow.exe
  C:\Windows\System\NoWldow.exe
  2⤵
  PID:12724
- C:\Windows\System\crMYSlV.exe
  C:\Windows\System\crMYSlV.exe
  2⤵
  PID:12680
- C:\Windows\System\rNVYUDB.exe
  C:\Windows\System\rNVYUDB.exe
  2⤵
  PID:12716
- C:\Windows\System\BVvvvjt.exe
  C:\Windows\System\BVvvvjt.exe
  2⤵
  PID:10960
- C:\Windows\System\isXMytN.exe
  C:\Windows\System\isXMytN.exe
  2⤵
  PID:12896
- C:\Windows\System\evqoDfk.exe
  C:\Windows\System\evqoDfk.exe
  2⤵
  PID:3864
- C:\Windows\System\TfvLTlL.exe
  C:\Windows\System\TfvLTlL.exe
  2⤵
  PID:8912
- C:\Windows\System\rzoXchl.exe
  C:\Windows\System\rzoXchl.exe
  2⤵
  PID:12580
- C:\Windows\System\DbiQGZO.exe
  C:\Windows\System\DbiQGZO.exe
  2⤵
  PID:12720
- C:\Windows\System\YbBuTJp.exe
  C:\Windows\System\YbBuTJp.exe
  2⤵
  PID:10024
- C:\Windows\System\vZsxmiA.exe
  C:\Windows\System\vZsxmiA.exe
  2⤵
  PID:12904
- C:\Windows\System\kyPSHED.exe
  C:\Windows\System\kyPSHED.exe
  2⤵
  PID:13020
- C:\Windows\System\JODmLAc.exe
  C:\Windows\System\JODmLAc.exe
  2⤵
  PID:5500
- C:\Windows\System\UUSMHPu.exe
  C:\Windows\System\UUSMHPu.exe
  2⤵
  PID:5628
- C:\Windows\System\OiVXgKu.exe
  C:\Windows\System\OiVXgKu.exe
  2⤵
  PID:10360
- C:\Windows\System\ctdqkbt.exe
  C:\Windows\System\ctdqkbt.exe
  2⤵
  PID:13272
- C:\Windows\System\hYbmoAc.exe
  C:\Windows\System\hYbmoAc.exe
  2⤵
  PID:11436
- C:\Windows\System\lvTXNVK.exe
  C:\Windows\System\lvTXNVK.exe
  2⤵
  PID:10868
- C:\Windows\System\WBRCMta.exe
  C:\Windows\System\WBRCMta.exe
  2⤵
  PID:9352
- C:\Windows\System\onfYXiD.exe
  C:\Windows\System\onfYXiD.exe
  2⤵
  PID:7436
- C:\Windows\System\YtbgKBH.exe
  C:\Windows\System\YtbgKBH.exe
  2⤵
  PID:10388
- C:\Windows\System\NCntZoc.exe
  C:\Windows\System\NCntZoc.exe
  2⤵
  PID:2976
- C:\Windows\System\eoUhRSD.exe
  C:\Windows\System\eoUhRSD.exe
  2⤵
  PID:7804
- C:\Windows\System\wGgMBsD.exe
  C:\Windows\System\wGgMBsD.exe
  2⤵
  PID:13152
- C:\Windows\System\LhSbZlf.exe
  C:\Windows\System\LhSbZlf.exe
  2⤵
  PID:12652
- C:\Windows\System\emiayor.exe
  C:\Windows\System\emiayor.exe
  2⤵
  PID:11980
- C:\Windows\System\RpwXzYf.exe
  C:\Windows\System\RpwXzYf.exe
  2⤵
  PID:10000
- C:\Windows\System\ZihiQKb.exe
  C:\Windows\System\ZihiQKb.exe
  2⤵
  PID:11816
- C:\Windows\System\LLgiypI.exe
  C:\Windows\System\LLgiypI.exe
  2⤵
  PID:12908
- C:\Windows\System\etYbjjj.exe
  C:\Windows\System\etYbjjj.exe
  2⤵
  PID:5256
- C:\Windows\System\rREPKjz.exe
  C:\Windows\System\rREPKjz.exe
  2⤵
  PID:3916
- C:\Windows\System\rkwsapb.exe
  C:\Windows\System\rkwsapb.exe
  2⤵
  PID:9172
- C:\Windows\System\BesAFIp.exe
  C:\Windows\System\BesAFIp.exe
  2⤵
  PID:4320
- C:\Windows\System\kzdhyPO.exe
  C:\Windows\System\kzdhyPO.exe
  2⤵
  PID:4924
- C:\Windows\System\lIxaigb.exe
  C:\Windows\System\lIxaigb.exe
  2⤵
  PID:12740
- C:\Windows\System\gmeWctx.exe
  C:\Windows\System\gmeWctx.exe
  2⤵
  PID:6268
- C:\Windows\System\QPzlHNc.exe
  C:\Windows\System\QPzlHNc.exe
  2⤵
  PID:9860
- C:\Windows\System\vQdxvtj.exe
  C:\Windows\System\vQdxvtj.exe
  2⤵
  PID:11932
- C:\Windows\System\gHYJVlX.exe
  C:\Windows\System\gHYJVlX.exe
  2⤵
  PID:12924
- C:\Windows\System\FXrUNOl.exe
  C:\Windows\System\FXrUNOl.exe
  2⤵
  PID:11136
- C:\Windows\System\hinCpWs.exe
  C:\Windows\System\hinCpWs.exe
  2⤵
  PID:6716
- C:\Windows\System\DmIgWvq.exe
  C:\Windows\System\DmIgWvq.exe
  2⤵
  PID:11588
- C:\Windows\System\ZdqJzPI.exe
  C:\Windows\System\ZdqJzPI.exe
  2⤵
  PID:9816
- C:\Windows\System\eVAFRFU.exe
  C:\Windows\System\eVAFRFU.exe
  2⤵
  PID:6484
- C:\Windows\System\GCrNnRT.exe
  C:\Windows\System\GCrNnRT.exe
  2⤵
  PID:13432
- C:\Windows\System\JhKgFAV.exe
  C:\Windows\System\JhKgFAV.exe
  2⤵
  PID:13448
- C:\Windows\System\jKZYneT.exe
  C:\Windows\System\jKZYneT.exe
  2⤵
  PID:13464
- C:\Windows\System\LZrQdiI.exe
  C:\Windows\System\LZrQdiI.exe
  2⤵
  PID:13480
- C:\Windows\System\fqgybAg.exe
  C:\Windows\System\fqgybAg.exe
  2⤵
  PID:13496
- C:\Windows\System\XzHahIq.exe
  C:\Windows\System\XzHahIq.exe
  2⤵
  PID:13512
- C:\Windows\System\AHQskPH.exe
  C:\Windows\System\AHQskPH.exe
  2⤵
  PID:13560
- C:\Windows\System\SzaICYH.exe
  C:\Windows\System\SzaICYH.exe
  2⤵
  PID:13580
- C:\Windows\System\RSpYsBA.exe
  C:\Windows\System\RSpYsBA.exe
  2⤵
  PID:13616
- C:\Windows\System\YmLkITE.exe
  C:\Windows\System\YmLkITE.exe
  2⤵
  PID:13652
- C:\Windows\System\sCWYHOW.exe
  C:\Windows\System\sCWYHOW.exe
  2⤵
  PID:13692
- C:\Windows\System\muVqoCp.exe
  C:\Windows\System\muVqoCp.exe
  2⤵
  PID:13732
- C:\Windows\System\rWqCsBf.exe
  C:\Windows\System\rWqCsBf.exe
  2⤵
  PID:13772
- C:\Windows\System\UTDApFn.exe
  C:\Windows\System\UTDApFn.exe
  2⤵
  PID:13820
- C:\Windows\System\jutwOuK.exe
  C:\Windows\System\jutwOuK.exe
  2⤵
  PID:13856
- C:\Windows\System\dkdHiHK.exe
  C:\Windows\System\dkdHiHK.exe
  2⤵
  PID:13888
- C:\Windows\System\qesTiOL.exe
  C:\Windows\System\qesTiOL.exe
  2⤵
  PID:13920
- C:\Windows\System\iwyQLXY.exe
  C:\Windows\System\iwyQLXY.exe
  2⤵
  PID:13952
- C:\Windows\System\OczYmjd.exe
  C:\Windows\System\OczYmjd.exe
  2⤵
  PID:13976
- C:\Windows\System\XXRNVZa.exe
  C:\Windows\System\XXRNVZa.exe
  2⤵
  PID:13996
- C:\Windows\System\eskKaan.exe
  C:\Windows\System\eskKaan.exe
  2⤵
  PID:14024
- C:\Windows\System\IevRCnc.exe
  C:\Windows\System\IevRCnc.exe
  2⤵
  PID:14060
- C:\Windows\System\nNneLeS.exe
  C:\Windows\System\nNneLeS.exe
  2⤵
  PID:14076
- C:\Windows\System\DReMNHJ.exe
  C:\Windows\System\DReMNHJ.exe
  2⤵
  PID:14108
- C:\Windows\System\lnMpFSI.exe
  C:\Windows\System\lnMpFSI.exe
  2⤵
  PID:14148
- C:\Windows\System\XdQyxny.exe
  C:\Windows\System\XdQyxny.exe
  2⤵
  PID:14168
- C:\Windows\System\DwQVigv.exe
  C:\Windows\System\DwQVigv.exe
  2⤵
  PID:14200
- C:\Windows\System\ogvvqPT.exe
  C:\Windows\System\ogvvqPT.exe
  2⤵
  PID:14224
- C:\Windows\System\DBGuMCc.exe
  C:\Windows\System\DBGuMCc.exe
  2⤵
  PID:14240
- C:\Windows\System\hTPVZSI.exe
  C:\Windows\System\hTPVZSI.exe
  2⤵
  PID:14256
- C:\Windows\System\Blxmqmo.exe
  C:\Windows\System\Blxmqmo.exe
  2⤵
  PID:14276
- C:\Windows\System\NffTvbi.exe
  C:\Windows\System\NffTvbi.exe
  2⤵
  PID:14300
- C:\Windows\System\oFwVwSc.exe
  C:\Windows\System\oFwVwSc.exe
  2⤵
  PID:13292
- C:\Windows\System\byATufs.exe
  C:\Windows\System\byATufs.exe
  2⤵
  PID:11496
- C:\Windows\System\pqrZMOw.exe
  C:\Windows\System\pqrZMOw.exe
  2⤵
  PID:13504
- C:\Windows\System\RYkqQjr.exe
  C:\Windows\System\RYkqQjr.exe
  2⤵
  PID:13548
- C:\Windows\System\EgAwqlf.exe
  C:\Windows\System\EgAwqlf.exe
  2⤵
  PID:13348
- C:\Windows\System\UIamwwC.exe
  C:\Windows\System\UIamwwC.exe
  2⤵
  PID:13472
- C:\Windows\System\cUSJGHk.exe
  C:\Windows\System\cUSJGHk.exe
  2⤵
  PID:13632
- C:\Windows\System\GPzNHNV.exe
  C:\Windows\System\GPzNHNV.exe
  2⤵
  PID:13624
- C:\Windows\System\UGhDJek.exe
  C:\Windows\System\UGhDJek.exe
  2⤵
  PID:13752
- C:\Windows\System\bQoKJKe.exe
  C:\Windows\System\bQoKJKe.exe
  2⤵
  PID:13832
- C:\Windows\System\HIPYKcP.exe
  C:\Windows\System\HIPYKcP.exe
  2⤵
  PID:13872
- C:\Windows\System\iGmMujw.exe
  C:\Windows\System\iGmMujw.exe
  2⤵
  PID:13960
- C:\Windows\System\uNWbiaw.exe
  C:\Windows\System\uNWbiaw.exe
  2⤵
  PID:14036
- C:\Windows\System\mQzebGq.exe
  C:\Windows\System\mQzebGq.exe
  2⤵
  PID:14128
- C:\Windows\System\xQQrJqz.exe
  C:\Windows\System\xQQrJqz.exe
  2⤵
  PID:14184
- C:\Windows\System\bfUlGoV.exe
  C:\Windows\System\bfUlGoV.exe
  2⤵
  PID:14208
- C:\Windows\System\cFoVRlP.exe
  C:\Windows\System\cFoVRlP.exe
  2⤵
  PID:14324
- C:\Windows\System\SMkXnnE.exe
  C:\Windows\System\SMkXnnE.exe
  2⤵
  PID:13420
- C:\Windows\System\BlrkeMQ.exe
  C:\Windows\System\BlrkeMQ.exe
  2⤵
  PID:13384
- C:\Windows\System\fbLfFwu.exe
  C:\Windows\System\fbLfFwu.exe
  2⤵
  PID:13412
- C:\Windows\System\zhmQnaI.exe
  C:\Windows\System\zhmQnaI.exe
  2⤵
  PID:13336
- C:\Windows\System\NlexeSh.exe
  C:\Windows\System\NlexeSh.exe
  2⤵
  PID:13524
- C:\Windows\System\ZutDBey.exe
  C:\Windows\System\ZutDBey.exe
  2⤵
  PID:13628
- C:\Windows\System\wvhBKLr.exe
  C:\Windows\System\wvhBKLr.exe
  2⤵
  PID:13864
- C:\Windows\System\GgqFOlS.exe
  C:\Windows\System\GgqFOlS.exe
  2⤵
  PID:12540
- C:\Windows\System\hjHbWiC.exe
  C:\Windows\System\hjHbWiC.exe
  2⤵
  PID:14164
- C:\Windows\System\cWLXpwI.exe
  C:\Windows\System\cWLXpwI.exe
  2⤵
  PID:13492
- C:\Windows\System\LElcNcw.exe
  C:\Windows\System\LElcNcw.exe
  2⤵
  PID:13576
- C:\Windows\System\IJoqmZr.exe
  C:\Windows\System\IJoqmZr.exe
  2⤵
  PID:14180
- C:\Windows\System\bPCYEuH.exe
  C:\Windows\System\bPCYEuH.exe
  2⤵
  PID:13660
- C:\Windows\System\IGPzRwd.exe
  C:\Windows\System\IGPzRwd.exe
  2⤵
  PID:13416
- C:\Windows\System\oMgeTna.exe
  C:\Windows\System\oMgeTna.exe
  2⤵
  PID:14360
- C:\Windows\System\WVAsSsA.exe
  C:\Windows\System\WVAsSsA.exe
  2⤵
  PID:14392
- C:\Windows\System\MdOBIPG.exe
  C:\Windows\System\MdOBIPG.exe
  2⤵
  PID:14420
- C:\Windows\System\MucXOQE.exe
  C:\Windows\System\MucXOQE.exe
  2⤵
  PID:14440
- C:\Windows\System\ndEOSlt.exe
  C:\Windows\System\ndEOSlt.exe
  2⤵
  PID:14480
- C:\Windows\System\ylcHnhK.exe
  C:\Windows\System\ylcHnhK.exe
  2⤵
  PID:14508
- C:\Windows\System\UDgNiIe.exe
  C:\Windows\System\UDgNiIe.exe
  2⤵
  PID:14536
- C:\Windows\System\WtEpCcD.exe
  C:\Windows\System\WtEpCcD.exe
  2⤵
  PID:14568
- C:\Windows\System\ysKydhL.exe
  C:\Windows\System\ysKydhL.exe
  2⤵
  PID:14584
- C:\Windows\System\UhVycFo.exe
  C:\Windows\System\UhVycFo.exe
  2⤵
  PID:14600
- C:\Windows\System\gUkaWKD.exe
  C:\Windows\System\gUkaWKD.exe
  2⤵
  PID:14616
- C:\Windows\System\GekLtAV.exe
  C:\Windows\System\GekLtAV.exe
  2⤵
  PID:14636
- C:\Windows\System\aifOHSo.exe
  C:\Windows\System\aifOHSo.exe
  2⤵
  PID:14672
- C:\Windows\System\IeyQQUe.exe
  C:\Windows\System\IeyQQUe.exe
  2⤵
  PID:14712
- C:\Windows\System\mJGyyBI.exe
  C:\Windows\System\mJGyyBI.exe
  2⤵
  PID:14740
- C:\Windows\System\QJsgSdf.exe
  C:\Windows\System\QJsgSdf.exe
  2⤵
  PID:14772
- C:\Windows\System\YojNtkA.exe
  C:\Windows\System\YojNtkA.exe
  2⤵
  PID:14816
- C:\Windows\System\cssCXKP.exe
  C:\Windows\System\cssCXKP.exe
  2⤵
  PID:14840
- C:\Windows\System\OqIYYLE.exe
  C:\Windows\System\OqIYYLE.exe
  2⤵
  PID:14872
- C:\Windows\System\XMwnCrn.exe
  C:\Windows\System\XMwnCrn.exe
  2⤵
  PID:14892
- C:\Windows\System\eoKPdTj.exe
  C:\Windows\System\eoKPdTj.exe
  2⤵
  PID:14920
- C:\Windows\System\ANMBJUO.exe
  C:\Windows\System\ANMBJUO.exe
  2⤵
  PID:14956
- C:\Windows\System\aTzhgKY.exe
  C:\Windows\System\aTzhgKY.exe
  2⤵
  PID:14980
- C:\Windows\System\WRYRrDQ.exe
  C:\Windows\System\WRYRrDQ.exe
  2⤵
  PID:15024
- C:\Windows\System\ljyQncV.exe
  C:\Windows\System\ljyQncV.exe
  2⤵
  PID:15052
- C:\Windows\System\GywrjdM.exe
  C:\Windows\System\GywrjdM.exe
  2⤵
  PID:15076
- C:\Windows\System\aAKsrtL.exe
  C:\Windows\System\aAKsrtL.exe
  2⤵
  PID:15104
- C:\Windows\System\jmmCjXY.exe
  C:\Windows\System\jmmCjXY.exe
  2⤵
  PID:15140
- C:\Windows\System\EOpQRGz.exe
  C:\Windows\System\EOpQRGz.exe
  2⤵
  PID:15160
- C:\Windows\System\tFkUhLJ.exe
  C:\Windows\System\tFkUhLJ.exe
  2⤵
  PID:15176
- C:\Windows\System\jCajuYb.exe
  C:\Windows\System\jCajuYb.exe
  2⤵
  PID:15192
- C:\Windows\System\umBAGpi.exe
  C:\Windows\System\umBAGpi.exe
  2⤵
  PID:15224
- C:\Windows\System\HpWZPKd.exe
  C:\Windows\System\HpWZPKd.exe
  2⤵
  PID:15268
- C:\Windows\System\xUCZpeO.exe
  C:\Windows\System\xUCZpeO.exe
  2⤵
  PID:15328
- C:\Windows\System\yjWKlFw.exe
  C:\Windows\System\yjWKlFw.exe
  2⤵
  PID:15344
- C:\Windows\System\MYzSKtm.exe
  C:\Windows\System\MYzSKtm.exe
  2⤵
  PID:14384
- C:\Windows\System\oWXqhlP.exe
  C:\Windows\System\oWXqhlP.exe
  2⤵
  PID:14372
- C:\Windows\System\XXWgrig.exe
  C:\Windows\System\XXWgrig.exe
  2⤵
  PID:14452
- C:\Windows\System\JUuFOHS.exe
  C:\Windows\System\JUuFOHS.exe
  2⤵
  PID:14464
- C:\Windows\System\BxgUsuL.exe
  C:\Windows\System\BxgUsuL.exe
  2⤵
  PID:14544
- C:\Windows\System\uZKGTZR.exe
  C:\Windows\System\uZKGTZR.exe
  2⤵
  PID:14968
- C:\Windows\System\uorjZUL.exe
  C:\Windows\System\uorjZUL.exe
  2⤵
  PID:15308
- C:\Windows\System\kXSkZlb.exe
  C:\Windows\System\kXSkZlb.exe
  2⤵
  PID:15336
- C:\Windows\System\PHOFRlq.exe
  C:\Windows\System\PHOFRlq.exe
  2⤵
  PID:14412
- C:\Windows\System\ANlNkaN.exe
  C:\Windows\System\ANlNkaN.exe
  2⤵
  PID:8796
- C:\Windows\System\qOLgppl.exe
  C:\Windows\System\qOLgppl.exe
  2⤵
  PID:14400
- C:\Windows\System\IfrCvdy.exe
  C:\Windows\System\IfrCvdy.exe
  2⤵
  PID:15036
- C:\Windows\System\BUKweat.exe
  C:\Windows\System\BUKweat.exe
  2⤵
  PID:14936
- C:\Windows\System\DlzbUNT.exe
  C:\Windows\System\DlzbUNT.exe
  2⤵
  PID:812
- C:\Windows\System\uvlUsrv.exe
  C:\Windows\System\uvlUsrv.exe
  2⤵
  PID:11528
- C:\Windows\System\SyvVzpL.exe
  C:\Windows\System\SyvVzpL.exe
  2⤵
  PID:14732
- C:\Windows\System\ssDKwiZ.exe
  C:\Windows\System\ssDKwiZ.exe
  2⤵
  PID:12868
- C:\Windows\System\UTEfcZe.exe
  C:\Windows\System\UTEfcZe.exe
  2⤵
  PID:368

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14592

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ieqkeine.owc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AWueGWo.exe

Filesize
1.5MB

MD5
80a3c31d390891ff38a35a5ae4e3edd9

SHA1
e1315bddd86adfdcaca091de3b683fa53b06548a

SHA256
b71f3ecc4a70b7889b9c655b619aba4981b39c5458587c0499ef357c959d6cb3

SHA512
a9b4f1122ea7ee9f895100d409960591ad5acf45a60a65733b056d415d90b8a8a2d3ab31a5515d289aebda8ffdc83ab0778d4394a07cc804e25934f292f72e4f

Download Submit
C:\Windows\System\ExIYacX.exe

Filesize
1.5MB

MD5
004c4744b9a2223f3dec18ab95c16239

SHA1
026d6fdf39845735a938cfab5d45a45803ef0afa

SHA256
22057684f5984fba9409e69f3b3776769de06949c115261664db318bdb28fa88

SHA512
b36cfa7c29562ff6624b9b7fda2dd6a29c58e94d6fd989a38985b34ce5ce2a4238a5bbcac6fb2c02ef4207b1cb842d2be427ef9507448d854ca244f96dd0ad8a

Download Submit
C:\Windows\System\GfFfhRc.exe

Filesize
1.5MB

MD5
f7b3b32b0a3f254aa5bb88f7627daa07

SHA1
95ca1e4b23c2673dee8c13452f383944c9e258a5

SHA256
2645cea5cc063029afcede9ebc0a0c4a954b685f2dbb9ca5906d88d644c414c5

SHA512
bccd3109d8c2cbcd19539d5f56d5ea7d7257f577c3adfe9fc25086f393638c5aec1e4340912abd2d0295f3b7838a408f5783c8cca9ac508ad10c215fe05ac82e

Download Submit
C:\Windows\System\HbeWMPx.exe

Filesize
1.5MB

MD5
08fb12ff99975aef43a7373c15de66a5

SHA1
ae9ca225c80a0b05bd92840024869efc46a01f2c

SHA256
162e45a0ca178eb1c7f845fc1c0a4de26c52b9e0016985e5f1c2bbf09c54ef9b

SHA512
2d5cb29045fe9d94f3f47bd8aeb4b1d0f9262f48559969ac6e5c89ee64c56238487d51fc132bb83d39ebc7880bc2f4c2fee1887f315af6445ec92e9a56bf0135

Download Submit
C:\Windows\System\HoKiOKf.exe

Filesize
1.5MB

MD5
4c3c992f112453c259203b91d8956f28

SHA1
5885418cb88e52d62a4e1581479bb3ca592a0dc1

SHA256
6d1479844349ed5e845c5d2cefdf4c960a4154641b1c21312771d795a90a70dd

SHA512
4f5bcdf9aa6a718be558e5252755a66bce3c2415b899c5bb5fa19f8cb0989b8c5e934e0ae847f55394f74ff94d395cd0c7e63ce03fce07b4231d8e3cd997160b

Download Submit
C:\Windows\System\JaKMiut.exe

Filesize
1.5MB

MD5
95514c093b1cb37cb63789304d14dd45

SHA1
207eaf0eeca2b57b03e0211ff5a21d91eef0d91f

SHA256
3042e40d64902e040816298931c97e964a581cf1656c7f3f3883f9e3495e93e3

SHA512
57f63368943091e14eccd4e90b64f80b73172f8b82406b54296fbd701d18ef2ef9d8a0cc2cccaf02e77b9a5decee9fca17c41f36f8effc7bceb565258b2a11da

Download Submit
C:\Windows\System\LooTaPh.exe

Filesize
18B

MD5
d4c53945d0b50cca8ee3c39950f75a96

SHA1
b80a0451cdd1f089663f9ee7b74d1e73ad057fdf

SHA256
c14bc0d583a2e28b394647d06f8fa7c0ff4cba50b7739e8641ff8669f7856a43

SHA512
298bc37c5e19145fc001cebfa843e38909335e86d2dcf1fd6f1a57c9dd72abb4d7c4e4ca9f9b743b79fd750b428a6154b00b7c45d2e633fde4a9fab32fec45b0

Download Submit
C:\Windows\System\LsAdtjd.exe

Filesize
1.5MB

MD5
611d8b15ee7bd91eb64f0a4ab1e7ca4f

SHA1
17bf9eece131c7966207c75011b3b34062d4a41e

SHA256
92c62ce3eac9a6de279069e7b274040d034fb10c2efe290b49882a907284ca70

SHA512
167325a4c1874c69ee542cadeb608591fae248a80d6bbce0ad9d1e9ba7ca0537d58d100afb419b7d3f425eff3fc0bd0711b4b6da9ba54e834a46fec004a4b44c

Download Submit
C:\Windows\System\NkZGmwc.exe

Filesize
1.5MB

MD5
5564e3bc4cd738427530c98c8903fff8

SHA1
8410099e530b2034438bb0a64d6b8f1a19e5b14c

SHA256
e86dac379db1802ea750e8c3d986f00a20ed378fd24264435a9044ffc1c0bbe4

SHA512
cbc90f2f259b1ed508554e86ec7a7992316ffafa182882754390faf40054134627bd103704c3abe6b227c365b180fc2539755e8d0afaddd183befac4f2180ee7

Download Submit
C:\Windows\System\OBkyJlk.exe

Filesize
1.5MB

MD5
5a0e924f11a3937daaca30fa412725c5

SHA1
091abdf45394000732e3fe23f82e45d486d2a3da

SHA256
cf47ca2ce7ea72b821e54379bf3b9da307eba2a2e099b23e769bf9c21e26b34a

SHA512
363b92b6f5c96aef1899fa0c68239539ad234e5fcf57e98c38a0289835b544c5aef7642b80b9864582b83f50e5c61c7a116d19042685291354eab927ba7e7cf6

Download Submit
C:\Windows\System\OSVuEbb.exe

Filesize
1.5MB

MD5
93249910a76ee18cd00b57b1cde7dceb

SHA1
e67197920c04c3e392be8c928eff4b481fe989f8

SHA256
c09e416c6301ae0bdbff29457aa5983f7dc608878d9ac8ef34ec613152bbef0b

SHA512
5c7cabb8be4630d996abd0be2463634084fbcbf355406638464ef73a9e8ab2c2fbbd645c25f798733cafe42ea8cefdbef7f0fb99bdb434ea08024aaf618a09e2

Download Submit
C:\Windows\System\PZwDgHh.exe

Filesize
1.5MB

MD5
83654fb3bd86e220d5087e1a7c39af10

SHA1
0471fc5d50ac7e08578009f2f76778d6ad5438db

SHA256
d910bdf3d96730fa9194f5fba7c1843381944de7fdba5a5aefbe0b137ecae5f9

SHA512
d413e9c3bcd68af4659692aad8c3dd669d1b2079971acf735fe38010d94bef869a92e07358bc7396ab775f842a4a82e80fa69685092fa619f7ebd958019f891d

Download Submit
C:\Windows\System\PqEsRBs.exe

Filesize
1.5MB

MD5
642405c5ebc40e595c0f9aaae92b5e18

SHA1
3801c0041a4058f449c975ab085e61f96fb890dc

SHA256
5f47dfc45e3453d909ba953fec7196e62815d8b2ce4e3e16baca67dfce176096

SHA512
88f303088df281ef09be4e95a10de5f1651d07b920a3b90591eb941c4da1ddba08b709f956aa24c240be4f4fbfcd16b990f29f1111cc77bd89b5c956781d99cd

Download Submit
C:\Windows\System\QdcCIoM.exe

Filesize
1.5MB

MD5
813124d37205c667196af9477b2e7d2e

SHA1
3f2458bb2e79334cc6d31f5ba23c876606652743

SHA256
5c5a1dbdfc20372552c26f5fd50876e1c3e66ca336889f33a27c5345064be8e6

SHA512
308a167bc3add256fc7a30cd11cea7d278159a972769f07deac2e9d7bc514e2fecd2169550f0a90a2c74f0c2e4765c5de5a6b69888e314185157078876787913

Download Submit
C:\Windows\System\RUwElIv.exe

Filesize
1.5MB

MD5
1036c8020fa0ec4b58b7b51da7f802fb

SHA1
8f4bbf6f92c35bd78eef732e638324376c778863

SHA256
56b370dc0b047366cd84d6d21be00a02bf322119c03c653585da23592d618e5c

SHA512
ff66dea7ce07cd9fdcc1bca8e122bac1e7f3f23c67bf32a1e0d0f556fc13836f71aebff399123eaeec9b89db2f384772bd8f4053fe26f06e987940c9a8e39b13

Download Submit
C:\Windows\System\SFlZFUX.exe

Filesize
1.5MB

MD5
e653838400a4c2543e7fa55d74f9a089

SHA1
f8bdeb95c9f4a8453d5ccdccc435db56c6128d90

SHA256
30d32e55bd8dc98a32acd07f66c57669d5445a6e826e7f63d26d8718ba6c1411

SHA512
6465bb96584331bb3f9d69c4670fd37aa9487fe193c18a861cdf414bef0c37868ca68025acaa420212facc14c4339f5e0b516441baecaecb36f42d178e2fd15e

Download Submit
C:\Windows\System\TMJcNDa.exe

Filesize
1.5MB

MD5
6ff6a6eb702cef80f43a1a7a2baa73db

SHA1
eedf2d196e05e1194b423d2ebd0a0731653467a0

SHA256
93498d41e9fbda0c1773cb5fa0910ce29d0eea452afd6aebb28dd3d38ef5d348

SHA512
411edde9236ac474b9c710ce956d6a8d0b36da7bd2a272f7f271add7cbfc6d9fd2f5aa8a2555506f6ad4fe84051aa13ca3a8d89e8a88656cd2d6a05853a60054

Download Submit
C:\Windows\System\YZDVMXz.exe

Filesize
1.5MB

MD5
df6c922ce99d0583ff8fd16fbfbb88c3

SHA1
5a3e394e4d0c5175e2e2d9a1b28b3b4292bae866

SHA256
7f16931bde58967140d91e9de65ddb93f3e1e906eaaa8ce9d8c97d85f69c7f32

SHA512
e78ae7c0bc4d5209eb80042d229058f57fafc4fbf45dc47a7f7ba2eb086b62ea8410c9e2fc729fc82211262b1b0c72d4fcad0f2dd282b52eec400d33b19e92d6

Download Submit
C:\Windows\System\ZySMQMj.exe

Filesize
1.5MB

MD5
38d47b3754e227d25cda43989b4d113e

SHA1
3f8e7da24d5c5335431e5a6ba98749b53740c234

SHA256
53100d2cb01e7c8e809d327ae508d77976786e8ce270f80fb77da5f8e4436ca2

SHA512
d76b5cd8182767a66f98e123f2c97c57ac02fea31730cdd8999e6b4f7f38560dcf8d5ae6db43f64da3d29eed50235610e26bd3bceb7f9d3446661079c166269e

Download Submit
C:\Windows\System\cbpShpK.exe

Filesize
1.5MB

MD5
fc6fd912f8e5f833fe92aa0d5e341420

SHA1
4c88646f60a447e1b36341435cd8931e296ed1f8

SHA256
b08da539cdf8df4d8253cc984766076a2b2cb52607343abb88393d860cf1131f

SHA512
c6244d976cb45e126f92d65505f75ea89ea31ed6843e0d9262cf7b22e04213dac6d8926b68d6e9b7da9c9060381ec35a0c11c9466c8b0ad7d352cc2bd360f037

Download Submit
C:\Windows\System\coeIlRp.exe

Filesize
1.5MB

MD5
34064487c62e0c6303d1ba12e1dc434d

SHA1
5c60317f26a4786d5534faac394bfad1fd23dfb5

SHA256
165943c21a36fa077a46c7a6903db63fc3c0298ac49af4e20925f154bdc910ca

SHA512
e14837b357ac7fc18f3a17272b629bc572b065a396b881298a2667e8b3f1eada4f9b5a501914e7d6a5b6993ffa6ffc1117a5fdec14d994e004c3269eb6d4407b

Download Submit
C:\Windows\System\dyyUFIr.exe

Filesize
1.5MB

MD5
3352bc72632824fab90f0f3d6e294fd9

SHA1
d81b34d99cf3becee15400a14d5b0245405923da

SHA256
9dc365609be9b3a00f22f17590a0d876376b2fdae6cd92dcc2229618e9916878

SHA512
d58ab8a997beda6a8d453d2312be6bb3e62311f712abab860be5522896beccf5f81596b6d449d174dc5c7b5a3c528e922182d04c1a9b223369fa85697d3f36b8

Download Submit
C:\Windows\System\gEYgpeu.exe

Filesize
1.5MB

MD5
9ab34686a2b3ee44ca66377e49a680f2

SHA1
5d6afb8bd66040021e88d34284a55843a2c07339

SHA256
631b9b18d19a0b4b75f89249143d5cd509a5adcd165d646cc6f3bc7dd0e21f6c

SHA512
aa9db5cd1978cf28547ecc6130d173be19c4ef6d567aa45572aaaf6ae9a88a815e07a40a8951612f7cf237bd97e23151df5cc9efb644942585e2ea42f1147dff

Download Submit
C:\Windows\System\ghTIrbu.exe

Filesize
1.5MB

MD5
6d3f6093e84c82ad6c46f8d36b5c3f08

SHA1
e86f9a95876ea8198747d20d0a333214c2fdc6a9

SHA256
9d89603adce1d221d5a3acf11d5866534d9aab07aad697b551298113e462ca7a

SHA512
23e4259894d295e8d251f00de3f5dcf0147f51f0a96328361aa8f832e5117f94b25c61549132cbd39f01d81a7f009ef757da0763a3a3d111ac17487aa779712b

Download Submit
C:\Windows\System\hlnwZrG.exe

Filesize
1.5MB

MD5
203cb33891b8a79dac46914d66220c88

SHA1
74cad4a7ecb610f8505827a8d0903b3dcf08ba44

SHA256
914ad8e51cea02c06040c50b413c720502428b921e7362318e29aa4f59ef26f9

SHA512
ada596b2af748263b27b77c3da46683ff822d4a710f7667947d8c731ab76bbd2041dd9b11d7d35aa9bcde80b1d82a0957d3bc3c824ded1166a859f01bccf240d

Download Submit
C:\Windows\System\iAfAYWS.exe

Filesize
1.5MB

MD5
f6774f16333e60635a78d81f7c765043

SHA1
480b1c545bc5d9072be146d201c05a920001ef81

SHA256
34fa6aee634440cbd6aff62280b8445f551f5677f649029bc9099d213dd2f688

SHA512
8ac9b3b4abd429af60e2824326507709f1115e7af693cebcb7354cbc947522a593c3618497d664d857ade590429a63520f877001b0c44722973c811239a067ee

Download Submit
C:\Windows\System\iWoJUJH.exe

Filesize
1.5MB

MD5
a2ef10ffd9f738c38414682176ecd53c

SHA1
a5342330622db6e3974b76df4629524d98a1293f

SHA256
3dbda3d482ed97bf72628e3eb9c3bfb579dfd48f19befc34f0d993877222eae0

SHA512
7b1ba88b23bb314f2da85350339e07c4cc98c5d47b1cc0b37bdb8bfc1b18721bfbafd10fab8ebf8fdab3b58784971504f86afe03e2db114fccbf3bce1af11736

Download Submit
C:\Windows\System\lfOAZVj.exe

Filesize
1.5MB

MD5
57981489668ceaba04df90acf69c3198

SHA1
8422244f8a76b4f8baddb8511d24f895a0df49b4

SHA256
48a41fcfc7d9a9ea50ce5073621a2dcf16d694d54ccba414318c05a02e63dd7c

SHA512
018114ee1a848cf07e69a3539b5ba2b7018827e2c04bdb0ceddb5ef85380b9ff879e6749d5848a00e779fa0bfbc907090565b081f9675e0ff239eff7a3002d00

Download Submit
C:\Windows\System\opOufuP.exe

Filesize
1.5MB

MD5
70da9a51e3a1ed4ad1013034e75fbab9

SHA1
75d52b10ec55b58de36cb137384aa32b3757210e

SHA256
366c075ed2a025e3502d3b9db957818ffcafdb2d1e9b3f391a8d5f87187f536a

SHA512
6e1b363726f25f4506661c5b5f566ccdd270e2925c55753fad7356b8c8082aeb3af18215015b267c1d600f46d4facd8ce7a6981fc83887ecf828eb9b1fffc8c8

Download Submit
C:\Windows\System\rdUnsyv.exe

Filesize
1.5MB

MD5
18cbff378d881a73a3b8856b9d216e0d

SHA1
06320124328d35bb9fb958859831eb2681a523c5

SHA256
794728ef084591da762eb2099b73d1250663ea9ad9ceeaf28b6bcdfe21e5fed0

SHA512
cd4565087dcbfd47f5b177a36441176a7181565e45bc9e3843cb029d8409dbf911e7fef0dbc0f3a672f55b40e43f14ed40a06d2802c3ade55af8a335eaa6f356

Download Submit
C:\Windows\System\vDdKORV.exe

Filesize
1.5MB

MD5
2ab10f74189c2f9ea5db502cc72193a3

SHA1
54d6d5e7269b428312752d3d5133d99b311f23ba

SHA256
8ae5aeeee35f1817c77c38a0b0a77cb936304534a0b3ff0396ffa971849b0aeb

SHA512
21b6d8f3f24c0c11b2375e4eb2186698ff7ea0f6d31bf2d23fe7e39ce5cf10e537335a2c46bf5f01cddba402372ea4eed512a2a615cf0616930d71d22f69b05d

Download Submit
C:\Windows\System\vdeYOtC.exe

Filesize
1.5MB

MD5
954ad96822f4965f8f27d9251a18ef05

SHA1
f525b241f476b6629fa10431cf7cf755b51700a9

SHA256
73006141f69a415e82ef1694c437f0f26de485e43a37c741759b51355a609eff

SHA512
8d9991d853761496be320a3961b96cf823d031cbd7ff146f0c11f006d8ee9544b41e134a837cf464a842e0c285cf03b5b7769e85a2f2af98a2f2da320de226c4

Download Submit
C:\Windows\System\xglZCwR.exe

Filesize
1.5MB

MD5
860f7c76d2421f79cb093741e2b5e2ef

SHA1
e547796bb606ff80f1975f11e57a8cae6334ade8

SHA256
f287a541d021a631c0a8bd6a6580ca8ba1421d87edc6cfe468124387d3a8b2d5

SHA512
b6f90e0132bbe8181a977427b3f8d0e72fb46da3f968afad0606dd5cf94f480f04ca854225a6adcd8dd7f26243b730ecfc5e1eafc3ee9ae5a77ddf6337c9d094

Download Submit
C:\Windows\System\xyiCPYr.exe

Filesize
1.5MB

MD5
f720e796405d3ceef375a69d56938daf

SHA1
72cf1fbd47e33878f07e122faeefb25dafe6f649

SHA256
96d51b9f008d65ce73c76ddcefe3f3c5fd96fcfd555d8739288a5499cdde6d94

SHA512
6aca585abb9b2e6017582df09a84edb6b0c8f2d168b71973bc73491cb0e6d26def74579476bbda19f2083cd11307801c10372a2aed478ebb8a636ccc95bcb687

Download Submit
memory/264-119-0x00007FF64F160000-0x00007FF64F552000-memory.dmp

Filesize
3.9MB

Download
memory/740-75-0x00007FF61B060000-0x00007FF61B452000-memory.dmp

Filesize
3.9MB

Download
memory/832-68-0x00007FF6DE0A0000-0x00007FF6DE492000-memory.dmp

Filesize
3.9MB

Download
memory/832-4513-0x00007FF6DE0A0000-0x00007FF6DE492000-memory.dmp

Filesize
3.9MB

Download
memory/1220-76-0x00007FF777260000-0x00007FF777652000-memory.dmp

Filesize
3.9MB

Download
memory/1224-143-0x00007FF622E90000-0x00007FF623282000-memory.dmp

Filesize
3.9MB

Download
memory/1596-2011-0x00007FF8E8B00000-0x00007FF8E95C1000-memory.dmp

Filesize
10.8MB

Download
memory/1596-48-0x000001CAB1F00000-0x000001CAB1F22000-memory.dmp

Filesize
136KB

Download
memory/1596-26-0x00007FF8E8B00000-0x00007FF8E95C1000-memory.dmp

Filesize
10.8MB

Download
memory/1596-82-0x000001CAB2AA0000-0x000001CAB3246000-memory.dmp

Filesize
7.6MB

Download
memory/1596-5-0x00007FF8E8B03000-0x00007FF8E8B05000-memory.dmp

Filesize
8KB

Download
memory/1596-2542-0x00007FF8E8B03000-0x00007FF8E8B05000-memory.dmp

Filesize
8KB

Download
memory/1596-45-0x00007FF8E8B00000-0x00007FF8E95C1000-memory.dmp

Filesize
10.8MB

Download
memory/1700-72-0x00007FF71FF20000-0x00007FF720312000-memory.dmp

Filesize
3.9MB

Download
memory/1776-6412-0x00007FF6144B0000-0x00007FF6148A2000-memory.dmp

Filesize
3.9MB

Download
memory/1776-137-0x00007FF6144B0000-0x00007FF6148A2000-memory.dmp

Filesize
3.9MB

Download
memory/2320-135-0x00007FF6F9E30000-0x00007FF6FA222000-memory.dmp

Filesize
3.9MB

Download
memory/2404-138-0x00007FF7A6B40000-0x00007FF7A6F32000-memory.dmp

Filesize
3.9MB

Download
memory/2468-2802-0x00007FF780C00000-0x00007FF780FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-79-0x00007FF780C00000-0x00007FF780FF2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-105-0x00007FF6D94C0000-0x00007FF6D98B2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-140-0x00007FF64EE00000-0x00007FF64F1F2000-memory.dmp

Filesize
3.9MB

Download
memory/3136-163-0x00007FF6339D0000-0x00007FF633DC2000-memory.dmp

Filesize
3.9MB

Download
memory/3136-7407-0x00007FF6339D0000-0x00007FF633DC2000-memory.dmp

Filesize
3.9MB

Download
memory/3276-109-0x00007FF71BEB0000-0x00007FF71C2A2000-memory.dmp

Filesize
3.9MB

Download
memory/3336-74-0x00007FF7F7450000-0x00007FF7F7842000-memory.dmp

Filesize
3.9MB

Download
memory/3700-174-0x00007FF7246D0000-0x00007FF724AC2000-memory.dmp

Filesize
3.9MB

Download
memory/3940-71-0x00007FF71F940000-0x00007FF71FD32000-memory.dmp

Filesize
3.9MB

Download
memory/3992-77-0x00007FF64F5A0000-0x00007FF64F992000-memory.dmp

Filesize
3.9MB

Download
memory/4176-73-0x00007FF687400000-0x00007FF6877F2000-memory.dmp

Filesize
3.9MB

Download
memory/4444-139-0x00007FF6B3A00000-0x00007FF6B3DF2000-memory.dmp

Filesize
3.9MB

Download
memory/4528-46-0x00007FF6BDBF0000-0x00007FF6BDFE2000-memory.dmp

Filesize
3.9MB

Download
memory/4608-113-0x00007FF6832E0000-0x00007FF6836D2000-memory.dmp

Filesize
3.9MB

Download
memory/4716-0-0x00007FF728D30000-0x00007FF729122000-memory.dmp

Filesize
3.9MB

Download
memory/4716-1-0x00000238792A0000-0x00000238792B0000-memory.dmp

Filesize
64KB

Download
memory/5040-161-0x00007FF79D500000-0x00007FF79D8F2000-memory.dmp

Filesize
3.9MB

Download
memory/5040-3874-0x00007FF79D500000-0x00007FF79D8F2000-memory.dmp

Filesize
3.9MB

Download
memory/5056-78-0x00007FF667B20000-0x00007FF667F12000-memory.dmp

Filesize
3.9MB

Download