xmrig | 387cef2dcfc8a0d5083d9cd24a78f9ce204280f8eeb7a26b29d5f3b416f8400d

Analysis

max time kernel
115s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
Size

3.2MB
MD5

bfb98b8d439c638a7e1aa903552bdec0
SHA1

0696f5956717dad9daa742bc3aa95737bd4c5983
SHA256

387cef2dcfc8a0d5083d9cd24a78f9ce204280f8eeb7a26b29d5f3b416f8400d
SHA512

b69d01c5b3555aed6ccdd97d1adae69fe7abe464c31ed6e7313a7579b170e911c5bee71eb390ec0486f38a254a79d2ebf09886a6d6f6908b8330ac406cb0e279
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWA:7bBeSFk8

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/668-0-0x00007FF7E35A0000-0x00007FF7E3996000-memory.dmp	xmrig
behavioral2/files/0x0009000000023403-5.dat	xmrig
behavioral2/files/0x000700000002340b-7.dat	xmrig
behavioral2/memory/932-39-0x00007FF658850000-0x00007FF658C46000-memory.dmp	xmrig
behavioral2/memory/2676-60-0x00007FF799230000-0x00007FF799626000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-67.dat	xmrig
behavioral2/memory/4216-72-0x00007FF72F0F0000-0x00007FF72F4E6000-memory.dmp	xmrig
behavioral2/memory/1456-76-0x00007FF7CD7F0000-0x00007FF7CDBE6000-memory.dmp	xmrig
behavioral2/memory/2960-78-0x00007FF6F5CA0000-0x00007FF6F6096000-memory.dmp	xmrig
behavioral2/files/0x0008000000023413-80.dat	xmrig
behavioral2/memory/4924-79-0x00007FF7D0420000-0x00007FF7D0816000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-71.dat	xmrig
behavioral2/memory/1604-70-0x00007FF769E30000-0x00007FF76A226000-memory.dmp	xmrig
behavioral2/memory/4880-65-0x00007FF719F00000-0x00007FF71A2F6000-memory.dmp	xmrig
behavioral2/memory/3820-64-0x00007FF798AE0000-0x00007FF798ED6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023410-58.dat	xmrig
behavioral2/memory/2412-55-0x00007FF7B7B80000-0x00007FF7B7F76000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-42.dat	xmrig
behavioral2/files/0x000700000002340f-37.dat	xmrig
behavioral2/files/0x000700000002340d-33.dat	xmrig
behavioral2/files/0x000700000002340c-27.dat	xmrig
behavioral2/files/0x0008000000023407-20.dat	xmrig
behavioral2/memory/3588-9-0x00007FF696C00000-0x00007FF696FF6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023412-84.dat	xmrig
behavioral2/memory/1980-93-0x00007FF77F5A0000-0x00007FF77F996000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-104.dat	xmrig
behavioral2/files/0x0007000000023418-110.dat	xmrig
behavioral2/files/0x0007000000023419-116.dat	xmrig
behavioral2/memory/4140-118-0x00007FF76F5D0000-0x00007FF76F9C6000-memory.dmp	xmrig
behavioral2/memory/2316-121-0x00007FF6873D0000-0x00007FF6877C6000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-130.dat	xmrig
behavioral2/files/0x000700000002341d-139.dat	xmrig
behavioral2/files/0x000700000002341f-155.dat	xmrig
behavioral2/files/0x0007000000023421-165.dat	xmrig
behavioral2/files/0x0007000000023425-185.dat	xmrig
behavioral2/memory/1468-341-0x00007FF79D990000-0x00007FF79DD86000-memory.dmp	xmrig
behavioral2/memory/4060-342-0x00007FF6C4EA0000-0x00007FF6C5296000-memory.dmp	xmrig
behavioral2/memory/1612-343-0x00007FF630070000-0x00007FF630466000-memory.dmp	xmrig
behavioral2/memory/3588-340-0x00007FF696C00000-0x00007FF696FF6000-memory.dmp	xmrig
behavioral2/memory/316-355-0x00007FF6C3880000-0x00007FF6C3C76000-memory.dmp	xmrig
behavioral2/memory/668-595-0x00007FF7E35A0000-0x00007FF7E3996000-memory.dmp	xmrig
behavioral2/memory/2164-2009-0x00007FF7DD0D0000-0x00007FF7DD4C6000-memory.dmp	xmrig
behavioral2/memory/4924-2001-0x00007FF7D0420000-0x00007FF7D0816000-memory.dmp	xmrig
behavioral2/memory/3036-353-0x00007FF70E460000-0x00007FF70E856000-memory.dmp	xmrig
behavioral2/memory/3172-350-0x00007FF7055C0000-0x00007FF7059B6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023428-194.dat	xmrig
behavioral2/files/0x0007000000023426-190.dat	xmrig
behavioral2/files/0x0007000000023427-189.dat	xmrig
behavioral2/files/0x0007000000023424-180.dat	xmrig
behavioral2/files/0x0007000000023423-175.dat	xmrig
behavioral2/files/0x0007000000023422-164.dat	xmrig
behavioral2/files/0x0007000000023421-161.dat	xmrig
behavioral2/files/0x0007000000023420-154.dat	xmrig
behavioral2/files/0x000700000002341e-150.dat	xmrig
behavioral2/files/0x000700000002341d-145.dat	xmrig
behavioral2/files/0x000700000002341c-140.dat	xmrig
behavioral2/files/0x000700000002341b-134.dat	xmrig
behavioral2/files/0x000700000002341a-126.dat	xmrig
behavioral2/memory/2184-117-0x00007FF67CE70000-0x00007FF67D266000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-112.dat	xmrig
behavioral2/memory/4276-108-0x00007FF7F4D60000-0x00007FF7F5156000-memory.dmp	xmrig
behavioral2/files/0x0007000000023415-107.dat	xmrig
behavioral2/memory/4280-102-0x00007FF7C4400000-0x00007FF7C47F6000-memory.dmp	xmrig
behavioral2/memory/2164-96-0x00007FF7DD0D0000-0x00007FF7DD4C6000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
9	564	powershell.exe
11	564	powershell.exe
22	564	powershell.exe
23	564	powershell.exe
25	564	powershell.exe
26	564	powershell.exe
27	564	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
564	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3588	rofqAgy.exe
4880	xWTvhwE.exe
932	mxoOhAt.exe
2412	sRCnCly.exe
2676	YgBfThs.exe
3820	whwqUwA.exe
1604	CFAitcG.exe
4216	QSRHJvm.exe
1456	DWfOjar.exe
2960	nftRuGM.exe
4924	BVhUhTR.exe
1980	GCYoHYN.exe
4280	skdASYc.exe
2164	FRlBqMo.exe
4276	ttatgqA.exe
2184	oFADDvq.exe
4140	bPewzNm.exe
2316	XqBeRzW.exe
1468	nWynPmo.exe
4060	pIQfUwq.exe
1612	QbEybBk.exe
3172	vKkUeXO.exe
3036	fqJHSlM.exe
316	eHEbSus.exe
4964	ZNCoGBu.exe
3812	hhdEqGM.exe
1708	GMCFNnt.exe
880	YEMMnSY.exe
4496	UWCRsnw.exe
1808	ewSSzba.exe
3052	EPdIKxO.exe
3308	MPcGLdP.exe
4408	PkyRYRW.exe
1816	jwfhIFN.exe
3896	RUlZDoF.exe
3136	RwkptFL.exe
2664	HCPMzXP.exe
3088	rLUqKJk.exe
3520	kYDeZjG.exe
3632	YfTySUk.exe
4896	ZFfOxhb.exe
4244	zEwVxbv.exe
2652	fQiDBoc.exe
2220	LRwioYF.exe
4332	JYJvjWz.exe
3776	bOddfjB.exe
1392	TRpwcGN.exe
1872	WiMUMye.exe
968	DqtnHEM.exe
3784	uizFBJD.exe
2736	OwNLCEw.exe
4988	xDxWWYU.exe
1460	GeBnzLw.exe
4940	ynsfMmx.exe
5092	ZJGjROt.exe
4220	rqFkAQz.exe
2792	warjxxN.exe
3280	LWfPyeI.exe
2580	akWnPoF.exe
2236	FpgcqyS.exe
1988	ejNVyic.exe
2812	CgImHIU.exe
4044	XCMueSO.exe
3440	EaoTrMl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/668-0-0x00007FF7E35A0000-0x00007FF7E3996000-memory.dmp	upx
behavioral2/files/0x0009000000023403-5.dat	upx
behavioral2/files/0x000700000002340b-7.dat	upx
behavioral2/memory/932-39-0x00007FF658850000-0x00007FF658C46000-memory.dmp	upx
behavioral2/memory/2676-60-0x00007FF799230000-0x00007FF799626000-memory.dmp	upx
behavioral2/files/0x0007000000023411-67.dat	upx
behavioral2/memory/4216-72-0x00007FF72F0F0000-0x00007FF72F4E6000-memory.dmp	upx
behavioral2/memory/1456-76-0x00007FF7CD7F0000-0x00007FF7CDBE6000-memory.dmp	upx
behavioral2/memory/2960-78-0x00007FF6F5CA0000-0x00007FF6F6096000-memory.dmp	upx
behavioral2/files/0x0008000000023413-80.dat	upx
behavioral2/memory/4924-79-0x00007FF7D0420000-0x00007FF7D0816000-memory.dmp	upx
behavioral2/files/0x0007000000023414-71.dat	upx
behavioral2/memory/1604-70-0x00007FF769E30000-0x00007FF76A226000-memory.dmp	upx
behavioral2/memory/4880-65-0x00007FF719F00000-0x00007FF71A2F6000-memory.dmp	upx
behavioral2/memory/3820-64-0x00007FF798AE0000-0x00007FF798ED6000-memory.dmp	upx
behavioral2/files/0x0007000000023410-58.dat	upx
behavioral2/memory/2412-55-0x00007FF7B7B80000-0x00007FF7B7F76000-memory.dmp	upx
behavioral2/files/0x000700000002340e-42.dat	upx
behavioral2/files/0x000700000002340f-37.dat	upx
behavioral2/files/0x000700000002340d-33.dat	upx
behavioral2/files/0x000700000002340c-27.dat	upx
behavioral2/files/0x0008000000023407-20.dat	upx
behavioral2/memory/3588-9-0x00007FF696C00000-0x00007FF696FF6000-memory.dmp	upx
behavioral2/files/0x0008000000023412-84.dat	upx
behavioral2/memory/1980-93-0x00007FF77F5A0000-0x00007FF77F996000-memory.dmp	upx
behavioral2/files/0x0007000000023417-104.dat	upx
behavioral2/files/0x0007000000023418-110.dat	upx
behavioral2/files/0x0007000000023419-116.dat	upx
behavioral2/memory/4140-118-0x00007FF76F5D0000-0x00007FF76F9C6000-memory.dmp	upx
behavioral2/memory/2316-121-0x00007FF6873D0000-0x00007FF6877C6000-memory.dmp	upx
behavioral2/files/0x000700000002341a-130.dat	upx
behavioral2/files/0x000700000002341d-139.dat	upx
behavioral2/files/0x000700000002341f-155.dat	upx
behavioral2/files/0x0007000000023421-165.dat	upx
behavioral2/files/0x0007000000023425-185.dat	upx
behavioral2/memory/1468-341-0x00007FF79D990000-0x00007FF79DD86000-memory.dmp	upx
behavioral2/memory/4060-342-0x00007FF6C4EA0000-0x00007FF6C5296000-memory.dmp	upx
behavioral2/memory/1612-343-0x00007FF630070000-0x00007FF630466000-memory.dmp	upx
behavioral2/memory/3588-340-0x00007FF696C00000-0x00007FF696FF6000-memory.dmp	upx
behavioral2/memory/316-355-0x00007FF6C3880000-0x00007FF6C3C76000-memory.dmp	upx
behavioral2/memory/668-595-0x00007FF7E35A0000-0x00007FF7E3996000-memory.dmp	upx
behavioral2/memory/2164-2009-0x00007FF7DD0D0000-0x00007FF7DD4C6000-memory.dmp	upx
behavioral2/memory/4924-2001-0x00007FF7D0420000-0x00007FF7D0816000-memory.dmp	upx
behavioral2/memory/3036-353-0x00007FF70E460000-0x00007FF70E856000-memory.dmp	upx
behavioral2/memory/3172-350-0x00007FF7055C0000-0x00007FF7059B6000-memory.dmp	upx
behavioral2/files/0x0007000000023428-194.dat	upx
behavioral2/files/0x0007000000023426-190.dat	upx
behavioral2/files/0x0007000000023427-189.dat	upx
behavioral2/files/0x0007000000023424-180.dat	upx
behavioral2/files/0x0007000000023423-175.dat	upx
behavioral2/files/0x0007000000023422-164.dat	upx
behavioral2/files/0x0007000000023421-161.dat	upx
behavioral2/files/0x0007000000023420-154.dat	upx
behavioral2/files/0x000700000002341e-150.dat	upx
behavioral2/files/0x000700000002341d-145.dat	upx
behavioral2/files/0x000700000002341c-140.dat	upx
behavioral2/files/0x000700000002341b-134.dat	upx
behavioral2/files/0x000700000002341a-126.dat	upx
behavioral2/memory/2184-117-0x00007FF67CE70000-0x00007FF67D266000-memory.dmp	upx
behavioral2/files/0x0007000000023416-112.dat	upx
behavioral2/memory/4276-108-0x00007FF7F4D60000-0x00007FF7F5156000-memory.dmp	upx
behavioral2/files/0x0007000000023415-107.dat	upx
behavioral2/memory/4280-102-0x00007FF7C4400000-0x00007FF7C47F6000-memory.dmp	upx
behavioral2/memory/2164-96-0x00007FF7DD0D0000-0x00007FF7DD4C6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GVlqcNx.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\UengMNo.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\qiUyKVD.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\oVzqYXG.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\CSqMoKD.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\qHSrvzw.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\zZORLdA.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\cyglUxR.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\irAAnPh.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\XMtmkDG.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\TdZBmdo.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\zawRjvt.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\dZkWylA.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\XEwVcEO.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\FfpiGxz.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\eZdZivb.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\LDaQyfk.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\gAXrhLz.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\AmOtgeT.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\Vgyfvzb.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\yGQbJEq.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\MthAfXH.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\KJYVrol.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\InVzJuU.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\MpuSmEe.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\scYTtmV.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\QHhbVfW.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\hfgInUv.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\ArPwgMT.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\OopGtlq.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\NdHcKDJ.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\LWaUSHx.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\qMqSvIn.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\BqGXwtR.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\oKDGDVj.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\MKSyOph.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\zWGPGee.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\zkavQDY.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\LQHasqr.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\vMMlFco.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\zuFlfvW.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\WXKqRWj.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\VMZBLls.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\vaHWjlw.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\hpjvTLL.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\pMCmbch.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\PSfKmba.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\hJjWScY.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\HTQdGQA.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\wDbwgTC.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\TTJCFwx.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\BAQqkJC.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\QRBRWbM.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\eVBdKfN.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\hpyZwir.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\NIYiJIf.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\iXjpkll.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\siAghVl.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\ghOSZHU.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\xSgTipV.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\pnuMvFB.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\tJqtDVs.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\sByAqeK.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
File created	C:\Windows\System\gADSJXd.exe	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
564	powershell.exe
564	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
Token: SeDebugPrivilege	564	powershell.exe
Token: SeLockMemoryPrivilege	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 564	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	83
PID 668 wrote to memory of 564	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	83
PID 668 wrote to memory of 3588	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	84
PID 668 wrote to memory of 3588	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	84
PID 668 wrote to memory of 4880	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	85
PID 668 wrote to memory of 4880	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	85
PID 668 wrote to memory of 2412	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	86
PID 668 wrote to memory of 2412	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	86
PID 668 wrote to memory of 932	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	87
PID 668 wrote to memory of 932	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	87
PID 668 wrote to memory of 2676	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	88
PID 668 wrote to memory of 2676	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	88
PID 668 wrote to memory of 3820	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	89
PID 668 wrote to memory of 3820	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	89
PID 668 wrote to memory of 1604	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	90
PID 668 wrote to memory of 1604	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	90
PID 668 wrote to memory of 4216	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	91
PID 668 wrote to memory of 4216	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	91
PID 668 wrote to memory of 1456	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	92
PID 668 wrote to memory of 1456	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	92
PID 668 wrote to memory of 2960	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	93
PID 668 wrote to memory of 2960	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	93
PID 668 wrote to memory of 4924	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	94
PID 668 wrote to memory of 4924	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	94
PID 668 wrote to memory of 1980	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	95
PID 668 wrote to memory of 1980	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	95
PID 668 wrote to memory of 4280	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	96
PID 668 wrote to memory of 4280	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	96
PID 668 wrote to memory of 2164	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	97
PID 668 wrote to memory of 2164	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	97
PID 668 wrote to memory of 4276	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	98
PID 668 wrote to memory of 4276	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	98
PID 668 wrote to memory of 2184	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	99
PID 668 wrote to memory of 2184	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	99
PID 668 wrote to memory of 4140	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	100
PID 668 wrote to memory of 4140	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	100
PID 668 wrote to memory of 2316	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	101
PID 668 wrote to memory of 2316	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	101
PID 668 wrote to memory of 1468	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	102
PID 668 wrote to memory of 1468	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	102
PID 668 wrote to memory of 4060	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	103
PID 668 wrote to memory of 4060	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	103
PID 668 wrote to memory of 1612	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	104
PID 668 wrote to memory of 1612	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	104
PID 668 wrote to memory of 3172	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	105
PID 668 wrote to memory of 3172	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	105
PID 668 wrote to memory of 3036	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	106
PID 668 wrote to memory of 3036	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	106
PID 668 wrote to memory of 316	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	107
PID 668 wrote to memory of 316	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	107
PID 668 wrote to memory of 4964	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	108
PID 668 wrote to memory of 4964	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	108
PID 668 wrote to memory of 3812	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	109
PID 668 wrote to memory of 3812	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	109
PID 668 wrote to memory of 1708	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	110
PID 668 wrote to memory of 1708	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	110
PID 668 wrote to memory of 880	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	111
PID 668 wrote to memory of 880	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	111
PID 668 wrote to memory of 4496	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	112
PID 668 wrote to memory of 4496	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	112
PID 668 wrote to memory of 1808	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	113
PID 668 wrote to memory of 1808	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	113
PID 668 wrote to memory of 3052	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	114
PID 668 wrote to memory of 3052	668	bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bfb98b8d439c638a7e1aa903552bdec0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:564
- C:\Windows\System\rofqAgy.exe
  C:\Windows\System\rofqAgy.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\xWTvhwE.exe
  C:\Windows\System\xWTvhwE.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\sRCnCly.exe
  C:\Windows\System\sRCnCly.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\mxoOhAt.exe
  C:\Windows\System\mxoOhAt.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\YgBfThs.exe
  C:\Windows\System\YgBfThs.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\whwqUwA.exe
  C:\Windows\System\whwqUwA.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\CFAitcG.exe
  C:\Windows\System\CFAitcG.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\QSRHJvm.exe
  C:\Windows\System\QSRHJvm.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\DWfOjar.exe
  C:\Windows\System\DWfOjar.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\nftRuGM.exe
  C:\Windows\System\nftRuGM.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\BVhUhTR.exe
  C:\Windows\System\BVhUhTR.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\GCYoHYN.exe
  C:\Windows\System\GCYoHYN.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\skdASYc.exe
  C:\Windows\System\skdASYc.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\FRlBqMo.exe
  C:\Windows\System\FRlBqMo.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\ttatgqA.exe
  C:\Windows\System\ttatgqA.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\oFADDvq.exe
  C:\Windows\System\oFADDvq.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\bPewzNm.exe
  C:\Windows\System\bPewzNm.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\XqBeRzW.exe
  C:\Windows\System\XqBeRzW.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\nWynPmo.exe
  C:\Windows\System\nWynPmo.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\pIQfUwq.exe
  C:\Windows\System\pIQfUwq.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\QbEybBk.exe
  C:\Windows\System\QbEybBk.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\vKkUeXO.exe
  C:\Windows\System\vKkUeXO.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\fqJHSlM.exe
  C:\Windows\System\fqJHSlM.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\eHEbSus.exe
  C:\Windows\System\eHEbSus.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\ZNCoGBu.exe
  C:\Windows\System\ZNCoGBu.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\hhdEqGM.exe
  C:\Windows\System\hhdEqGM.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\GMCFNnt.exe
  C:\Windows\System\GMCFNnt.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\YEMMnSY.exe
  C:\Windows\System\YEMMnSY.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\UWCRsnw.exe
  C:\Windows\System\UWCRsnw.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\ewSSzba.exe
  C:\Windows\System\ewSSzba.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\EPdIKxO.exe
  C:\Windows\System\EPdIKxO.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\MPcGLdP.exe
  C:\Windows\System\MPcGLdP.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\PkyRYRW.exe
  C:\Windows\System\PkyRYRW.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\jwfhIFN.exe
  C:\Windows\System\jwfhIFN.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\RUlZDoF.exe
  C:\Windows\System\RUlZDoF.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\RwkptFL.exe
  C:\Windows\System\RwkptFL.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\HCPMzXP.exe
  C:\Windows\System\HCPMzXP.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\rLUqKJk.exe
  C:\Windows\System\rLUqKJk.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\kYDeZjG.exe
  C:\Windows\System\kYDeZjG.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\YfTySUk.exe
  C:\Windows\System\YfTySUk.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\ZFfOxhb.exe
  C:\Windows\System\ZFfOxhb.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\zEwVxbv.exe
  C:\Windows\System\zEwVxbv.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\fQiDBoc.exe
  C:\Windows\System\fQiDBoc.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\LRwioYF.exe
  C:\Windows\System\LRwioYF.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\JYJvjWz.exe
  C:\Windows\System\JYJvjWz.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\bOddfjB.exe
  C:\Windows\System\bOddfjB.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\TRpwcGN.exe
  C:\Windows\System\TRpwcGN.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\WiMUMye.exe
  C:\Windows\System\WiMUMye.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\DqtnHEM.exe
  C:\Windows\System\DqtnHEM.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\uizFBJD.exe
  C:\Windows\System\uizFBJD.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\OwNLCEw.exe
  C:\Windows\System\OwNLCEw.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\xDxWWYU.exe
  C:\Windows\System\xDxWWYU.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\GeBnzLw.exe
  C:\Windows\System\GeBnzLw.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\ynsfMmx.exe
  C:\Windows\System\ynsfMmx.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\ZJGjROt.exe
  C:\Windows\System\ZJGjROt.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\rqFkAQz.exe
  C:\Windows\System\rqFkAQz.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\warjxxN.exe
  C:\Windows\System\warjxxN.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\LWfPyeI.exe
  C:\Windows\System\LWfPyeI.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\akWnPoF.exe
  C:\Windows\System\akWnPoF.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\FpgcqyS.exe
  C:\Windows\System\FpgcqyS.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ejNVyic.exe
  C:\Windows\System\ejNVyic.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\CgImHIU.exe
  C:\Windows\System\CgImHIU.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\XCMueSO.exe
  C:\Windows\System\XCMueSO.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\EaoTrMl.exe
  C:\Windows\System\EaoTrMl.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\NftkSvU.exe
  C:\Windows\System\NftkSvU.exe
  2⤵
  PID:2276
- C:\Windows\System\cUIeqZX.exe
  C:\Windows\System\cUIeqZX.exe
  2⤵
  PID:2292
- C:\Windows\System\QUTerDS.exe
  C:\Windows\System\QUTerDS.exe
  2⤵
  PID:4400
- C:\Windows\System\RVhgXjv.exe
  C:\Windows\System\RVhgXjv.exe
  2⤵
  PID:2576
- C:\Windows\System\MHeuyPe.exe
  C:\Windows\System\MHeuyPe.exe
  2⤵
  PID:3404
- C:\Windows\System\bUhaaSS.exe
  C:\Windows\System\bUhaaSS.exe
  2⤵
  PID:2148
- C:\Windows\System\DNSumaT.exe
  C:\Windows\System\DNSumaT.exe
  2⤵
  PID:3464
- C:\Windows\System\ELpqMKm.exe
  C:\Windows\System\ELpqMKm.exe
  2⤵
  PID:4188
- C:\Windows\System\VoCfyDy.exe
  C:\Windows\System\VoCfyDy.exe
  2⤵
  PID:2572
- C:\Windows\System\fEJYIAS.exe
  C:\Windows\System\fEJYIAS.exe
  2⤵
  PID:1896
- C:\Windows\System\XTHHMfp.exe
  C:\Windows\System\XTHHMfp.exe
  2⤵
  PID:3320
- C:\Windows\System\UeknyQp.exe
  C:\Windows\System\UeknyQp.exe
  2⤵
  PID:536
- C:\Windows\System\tYSlimQ.exe
  C:\Windows\System\tYSlimQ.exe
  2⤵
  PID:1444
- C:\Windows\System\gLnzMAp.exe
  C:\Windows\System\gLnzMAp.exe
  2⤵
  PID:2532
- C:\Windows\System\ASsBEUH.exe
  C:\Windows\System\ASsBEUH.exe
  2⤵
  PID:5040
- C:\Windows\System\PpbQqVM.exe
  C:\Windows\System\PpbQqVM.exe
  2⤵
  PID:4536
- C:\Windows\System\AmOtgeT.exe
  C:\Windows\System\AmOtgeT.exe
  2⤵
  PID:3448
- C:\Windows\System\hxghRQM.exe
  C:\Windows\System\hxghRQM.exe
  2⤵
  PID:2796
- C:\Windows\System\BJLAebI.exe
  C:\Windows\System\BJLAebI.exe
  2⤵
  PID:4452
- C:\Windows\System\uGxcPeZ.exe
  C:\Windows\System\uGxcPeZ.exe
  2⤵
  PID:3104
- C:\Windows\System\XfyTKif.exe
  C:\Windows\System\XfyTKif.exe
  2⤵
  PID:3900
- C:\Windows\System\pYzRzMD.exe
  C:\Windows\System\pYzRzMD.exe
  2⤵
  PID:3248
- C:\Windows\System\pnuMvFB.exe
  C:\Windows\System\pnuMvFB.exe
  2⤵
  PID:2836
- C:\Windows\System\SFnvBlz.exe
  C:\Windows\System\SFnvBlz.exe
  2⤵
  PID:3860
- C:\Windows\System\HMQQZBs.exe
  C:\Windows\System\HMQQZBs.exe
  2⤵
  PID:436
- C:\Windows\System\OIlgtFC.exe
  C:\Windows\System\OIlgtFC.exe
  2⤵
  PID:1600
- C:\Windows\System\ppwpdct.exe
  C:\Windows\System\ppwpdct.exe
  2⤵
  PID:5140
- C:\Windows\System\lwLyXhb.exe
  C:\Windows\System\lwLyXhb.exe
  2⤵
  PID:5156
- C:\Windows\System\hEyuJiP.exe
  C:\Windows\System\hEyuJiP.exe
  2⤵
  PID:5192
- C:\Windows\System\UdbmJqq.exe
  C:\Windows\System\UdbmJqq.exe
  2⤵
  PID:5236
- C:\Windows\System\TwAFNJk.exe
  C:\Windows\System\TwAFNJk.exe
  2⤵
  PID:5264
- C:\Windows\System\elVqhff.exe
  C:\Windows\System\elVqhff.exe
  2⤵
  PID:5284
- C:\Windows\System\NrmJHRv.exe
  C:\Windows\System\NrmJHRv.exe
  2⤵
  PID:5312
- C:\Windows\System\MwaKmIA.exe
  C:\Windows\System\MwaKmIA.exe
  2⤵
  PID:5344
- C:\Windows\System\uBlTRxZ.exe
  C:\Windows\System\uBlTRxZ.exe
  2⤵
  PID:5376
- C:\Windows\System\UJbTEVd.exe
  C:\Windows\System\UJbTEVd.exe
  2⤵
  PID:5424
- C:\Windows\System\fZxOXVm.exe
  C:\Windows\System\fZxOXVm.exe
  2⤵
  PID:5440
- C:\Windows\System\xrHHYJZ.exe
  C:\Windows\System\xrHHYJZ.exe
  2⤵
  PID:5480
- C:\Windows\System\YDdJQtp.exe
  C:\Windows\System\YDdJQtp.exe
  2⤵
  PID:5516
- C:\Windows\System\MlToDqM.exe
  C:\Windows\System\MlToDqM.exe
  2⤵
  PID:5544
- C:\Windows\System\FKfSGaX.exe
  C:\Windows\System\FKfSGaX.exe
  2⤵
  PID:5580
- C:\Windows\System\CYJXXCb.exe
  C:\Windows\System\CYJXXCb.exe
  2⤵
  PID:5608
- C:\Windows\System\kRplgIC.exe
  C:\Windows\System\kRplgIC.exe
  2⤵
  PID:5652
- C:\Windows\System\SLgkGsu.exe
  C:\Windows\System\SLgkGsu.exe
  2⤵
  PID:5684
- C:\Windows\System\TVBGNSj.exe
  C:\Windows\System\TVBGNSj.exe
  2⤵
  PID:5716
- C:\Windows\System\LOUqbXw.exe
  C:\Windows\System\LOUqbXw.exe
  2⤵
  PID:5756
- C:\Windows\System\mTNtkak.exe
  C:\Windows\System\mTNtkak.exe
  2⤵
  PID:5780
- C:\Windows\System\QOdkvBe.exe
  C:\Windows\System\QOdkvBe.exe
  2⤵
  PID:5808
- C:\Windows\System\IVfJNiF.exe
  C:\Windows\System\IVfJNiF.exe
  2⤵
  PID:5852
- C:\Windows\System\lntqvpl.exe
  C:\Windows\System\lntqvpl.exe
  2⤵
  PID:5876
- C:\Windows\System\BptGCnp.exe
  C:\Windows\System\BptGCnp.exe
  2⤵
  PID:5912
- C:\Windows\System\OpYkmnG.exe
  C:\Windows\System\OpYkmnG.exe
  2⤵
  PID:5952
- C:\Windows\System\TGpAVBG.exe
  C:\Windows\System\TGpAVBG.exe
  2⤵
  PID:5972
- C:\Windows\System\QiCueUZ.exe
  C:\Windows\System\QiCueUZ.exe
  2⤵
  PID:6012
- C:\Windows\System\cAYctqP.exe
  C:\Windows\System\cAYctqP.exe
  2⤵
  PID:6068
- C:\Windows\System\HVDdxqS.exe
  C:\Windows\System\HVDdxqS.exe
  2⤵
  PID:6100
- C:\Windows\System\sTqufJs.exe
  C:\Windows\System\sTqufJs.exe
  2⤵
  PID:6124
- C:\Windows\System\aZoXpnE.exe
  C:\Windows\System\aZoXpnE.exe
  2⤵
  PID:4144
- C:\Windows\System\nThrzdP.exe
  C:\Windows\System\nThrzdP.exe
  2⤵
  PID:5168
- C:\Windows\System\cKkxAxX.exe
  C:\Windows\System\cKkxAxX.exe
  2⤵
  PID:5220
- C:\Windows\System\YDwTIjz.exe
  C:\Windows\System\YDwTIjz.exe
  2⤵
  PID:5296
- C:\Windows\System\esudEbG.exe
  C:\Windows\System\esudEbG.exe
  2⤵
  PID:5404
- C:\Windows\System\dvCBSgH.exe
  C:\Windows\System\dvCBSgH.exe
  2⤵
  PID:3384
- C:\Windows\System\pDviEPT.exe
  C:\Windows\System\pDviEPT.exe
  2⤵
  PID:5540
- C:\Windows\System\nHoBepR.exe
  C:\Windows\System\nHoBepR.exe
  2⤵
  PID:5600
- C:\Windows\System\RgKFWnH.exe
  C:\Windows\System\RgKFWnH.exe
  2⤵
  PID:692
- C:\Windows\System\mfSKrzu.exe
  C:\Windows\System\mfSKrzu.exe
  2⤵
  PID:5396
- C:\Windows\System\tmazCoo.exe
  C:\Windows\System\tmazCoo.exe
  2⤵
  PID:832
- C:\Windows\System\SCFcFGA.exe
  C:\Windows\System\SCFcFGA.exe
  2⤵
  PID:5860
- C:\Windows\System\GEHodge.exe
  C:\Windows\System\GEHodge.exe
  2⤵
  PID:5920
- C:\Windows\System\lydrQbT.exe
  C:\Windows\System\lydrQbT.exe
  2⤵
  PID:6004
- C:\Windows\System\BLkaCze.exe
  C:\Windows\System\BLkaCze.exe
  2⤵
  PID:6108
- C:\Windows\System\jYPPGUf.exe
  C:\Windows\System\jYPPGUf.exe
  2⤵
  PID:5148
- C:\Windows\System\EDUvNME.exe
  C:\Windows\System\EDUvNME.exe
  2⤵
  PID:5828
- C:\Windows\System\jzMNKPp.exe
  C:\Windows\System\jzMNKPp.exe
  2⤵
  PID:5364
- C:\Windows\System\RuYhEgY.exe
  C:\Windows\System\RuYhEgY.exe
  2⤵
  PID:5452
- C:\Windows\System\QoitLyw.exe
  C:\Windows\System\QoitLyw.exe
  2⤵
  PID:5660
- C:\Windows\System\dNWqmbR.exe
  C:\Windows\System\dNWqmbR.exe
  2⤵
  PID:4968
- C:\Windows\System\EhGrBeg.exe
  C:\Windows\System\EhGrBeg.exe
  2⤵
  PID:5872
- C:\Windows\System\kdxpYxa.exe
  C:\Windows\System\kdxpYxa.exe
  2⤵
  PID:6084
- C:\Windows\System\wZPXPJO.exe
  C:\Windows\System\wZPXPJO.exe
  2⤵
  PID:5276
- C:\Windows\System\KoBMqLD.exe
  C:\Windows\System\KoBMqLD.exe
  2⤵
  PID:5536
- C:\Windows\System\hnfZQEy.exe
  C:\Windows\System\hnfZQEy.exe
  2⤵
  PID:5824
- C:\Windows\System\acTvArP.exe
  C:\Windows\System\acTvArP.exe
  2⤵
  PID:1752
- C:\Windows\System\zKfVccv.exe
  C:\Windows\System\zKfVccv.exe
  2⤵
  PID:1788
- C:\Windows\System\DjbpqvW.exe
  C:\Windows\System\DjbpqvW.exe
  2⤵
  PID:5764
- C:\Windows\System\qosgCto.exe
  C:\Windows\System\qosgCto.exe
  2⤵
  PID:6148
- C:\Windows\System\qTIHXyv.exe
  C:\Windows\System\qTIHXyv.exe
  2⤵
  PID:6184
- C:\Windows\System\RUMeaUd.exe
  C:\Windows\System\RUMeaUd.exe
  2⤵
  PID:6228
- C:\Windows\System\PWYsHHg.exe
  C:\Windows\System\PWYsHHg.exe
  2⤵
  PID:6256
- C:\Windows\System\hssZtGl.exe
  C:\Windows\System\hssZtGl.exe
  2⤵
  PID:6288
- C:\Windows\System\aYHSdDy.exe
  C:\Windows\System\aYHSdDy.exe
  2⤵
  PID:6316
- C:\Windows\System\bFdaFpT.exe
  C:\Windows\System\bFdaFpT.exe
  2⤵
  PID:6344
- C:\Windows\System\ZExUEEW.exe
  C:\Windows\System\ZExUEEW.exe
  2⤵
  PID:6380
- C:\Windows\System\BeJddQk.exe
  C:\Windows\System\BeJddQk.exe
  2⤵
  PID:6408
- C:\Windows\System\mJNieOj.exe
  C:\Windows\System\mJNieOj.exe
  2⤵
  PID:6432
- C:\Windows\System\GgXXjxI.exe
  C:\Windows\System\GgXXjxI.exe
  2⤵
  PID:6456
- C:\Windows\System\FyYHptk.exe
  C:\Windows\System\FyYHptk.exe
  2⤵
  PID:6488
- C:\Windows\System\BBkQrfh.exe
  C:\Windows\System\BBkQrfh.exe
  2⤵
  PID:6520
- C:\Windows\System\zKLokkJ.exe
  C:\Windows\System\zKLokkJ.exe
  2⤵
  PID:6540
- C:\Windows\System\rqeoedi.exe
  C:\Windows\System\rqeoedi.exe
  2⤵
  PID:6560
- C:\Windows\System\oHLGUcp.exe
  C:\Windows\System\oHLGUcp.exe
  2⤵
  PID:6600
- C:\Windows\System\KHQhqlW.exe
  C:\Windows\System\KHQhqlW.exe
  2⤵
  PID:6624
- C:\Windows\System\ujchrVs.exe
  C:\Windows\System\ujchrVs.exe
  2⤵
  PID:6652
- C:\Windows\System\gAcRVmJ.exe
  C:\Windows\System\gAcRVmJ.exe
  2⤵
  PID:6668
- C:\Windows\System\SXWOoHr.exe
  C:\Windows\System\SXWOoHr.exe
  2⤵
  PID:6708
- C:\Windows\System\rFbknRt.exe
  C:\Windows\System\rFbknRt.exe
  2⤵
  PID:6748
- C:\Windows\System\FWdpaPC.exe
  C:\Windows\System\FWdpaPC.exe
  2⤵
  PID:6792
- C:\Windows\System\fHFsPAc.exe
  C:\Windows\System\fHFsPAc.exe
  2⤵
  PID:6848
- C:\Windows\System\TTPwZWF.exe
  C:\Windows\System\TTPwZWF.exe
  2⤵
  PID:6876
- C:\Windows\System\VDabehV.exe
  C:\Windows\System\VDabehV.exe
  2⤵
  PID:6904
- C:\Windows\System\kWBKhWW.exe
  C:\Windows\System\kWBKhWW.exe
  2⤵
  PID:6940
- C:\Windows\System\UpeoRzT.exe
  C:\Windows\System\UpeoRzT.exe
  2⤵
  PID:6972
- C:\Windows\System\CrerBOt.exe
  C:\Windows\System\CrerBOt.exe
  2⤵
  PID:7000
- C:\Windows\System\RYoNfzr.exe
  C:\Windows\System\RYoNfzr.exe
  2⤵
  PID:7028
- C:\Windows\System\qQEMvSX.exe
  C:\Windows\System\qQEMvSX.exe
  2⤵
  PID:7064
- C:\Windows\System\jFnijLw.exe
  C:\Windows\System\jFnijLw.exe
  2⤵
  PID:7088
- C:\Windows\System\dZkWylA.exe
  C:\Windows\System\dZkWylA.exe
  2⤵
  PID:7120
- C:\Windows\System\OYCnPpI.exe
  C:\Windows\System\OYCnPpI.exe
  2⤵
  PID:7144
- C:\Windows\System\scrjpJC.exe
  C:\Windows\System\scrjpJC.exe
  2⤵
  PID:5928
- C:\Windows\System\LNSHSnq.exe
  C:\Windows\System\LNSHSnq.exe
  2⤵
  PID:6176
- C:\Windows\System\GzQvnhB.exe
  C:\Windows\System\GzQvnhB.exe
  2⤵
  PID:6248
- C:\Windows\System\KeWPCEq.exe
  C:\Windows\System\KeWPCEq.exe
  2⤵
  PID:6328
- C:\Windows\System\bqsYZLz.exe
  C:\Windows\System\bqsYZLz.exe
  2⤵
  PID:5280
- C:\Windows\System\fmeOSRD.exe
  C:\Windows\System\fmeOSRD.exe
  2⤵
  PID:6424
- C:\Windows\System\tRoueEP.exe
  C:\Windows\System\tRoueEP.exe
  2⤵
  PID:6480
- C:\Windows\System\XmVlbBP.exe
  C:\Windows\System\XmVlbBP.exe
  2⤵
  PID:6556
- C:\Windows\System\ULsLKHV.exe
  C:\Windows\System\ULsLKHV.exe
  2⤵
  PID:6616
- C:\Windows\System\YAHNLeA.exe
  C:\Windows\System\YAHNLeA.exe
  2⤵
  PID:6692
- C:\Windows\System\McsAyiD.exe
  C:\Windows\System\McsAyiD.exe
  2⤵
  PID:6784
- C:\Windows\System\qcvhTbb.exe
  C:\Windows\System\qcvhTbb.exe
  2⤵
  PID:3460
- C:\Windows\System\ABIdTBI.exe
  C:\Windows\System\ABIdTBI.exe
  2⤵
  PID:6932
- C:\Windows\System\mLLzEKq.exe
  C:\Windows\System\mLLzEKq.exe
  2⤵
  PID:6992
- C:\Windows\System\kRFgOMG.exe
  C:\Windows\System\kRFgOMG.exe
  2⤵
  PID:7048
- C:\Windows\System\RlkuIjN.exe
  C:\Windows\System\RlkuIjN.exe
  2⤵
  PID:7128
- C:\Windows\System\IdhKcYj.exe
  C:\Windows\System\IdhKcYj.exe
  2⤵
  PID:5668
- C:\Windows\System\cscIrra.exe
  C:\Windows\System\cscIrra.exe
  2⤵
  PID:6300
- C:\Windows\System\rCKqyxK.exe
  C:\Windows\System\rCKqyxK.exe
  2⤵
  PID:6416
- C:\Windows\System\ZjnolBp.exe
  C:\Windows\System\ZjnolBp.exe
  2⤵
  PID:6508
- C:\Windows\System\uvmgGjZ.exe
  C:\Windows\System\uvmgGjZ.exe
  2⤵
  PID:6696
- C:\Windows\System\FyhCjOK.exe
  C:\Windows\System\FyhCjOK.exe
  2⤵
  PID:6896
- C:\Windows\System\TktAjyA.exe
  C:\Windows\System\TktAjyA.exe
  2⤵
  PID:6964
- C:\Windows\System\aFlrHvd.exe
  C:\Windows\System\aFlrHvd.exe
  2⤵
  PID:7096
- C:\Windows\System\nMmiGWB.exe
  C:\Windows\System\nMmiGWB.exe
  2⤵
  PID:6596
- C:\Windows\System\ohoQfEI.exe
  C:\Windows\System\ohoQfEI.exe
  2⤵
  PID:7164
- C:\Windows\System\EiFPiWW.exe
  C:\Windows\System\EiFPiWW.exe
  2⤵
  PID:7172
- C:\Windows\System\mgZfKPg.exe
  C:\Windows\System\mgZfKPg.exe
  2⤵
  PID:7204
- C:\Windows\System\OoRUmIr.exe
  C:\Windows\System\OoRUmIr.exe
  2⤵
  PID:7248
- C:\Windows\System\dZLKijA.exe
  C:\Windows\System\dZLKijA.exe
  2⤵
  PID:7288
- C:\Windows\System\EkgKOVd.exe
  C:\Windows\System\EkgKOVd.exe
  2⤵
  PID:7308
- C:\Windows\System\WjOeHwC.exe
  C:\Windows\System\WjOeHwC.exe
  2⤵
  PID:7324
- C:\Windows\System\NfwDtYr.exe
  C:\Windows\System\NfwDtYr.exe
  2⤵
  PID:7352
- C:\Windows\System\yxQXwSA.exe
  C:\Windows\System\yxQXwSA.exe
  2⤵
  PID:7384
- C:\Windows\System\vsZYQpr.exe
  C:\Windows\System\vsZYQpr.exe
  2⤵
  PID:7428
- C:\Windows\System\XnTkkCq.exe
  C:\Windows\System\XnTkkCq.exe
  2⤵
  PID:7484
- C:\Windows\System\HqnYspD.exe
  C:\Windows\System\HqnYspD.exe
  2⤵
  PID:7512
- C:\Windows\System\LiyDVqo.exe
  C:\Windows\System\LiyDVqo.exe
  2⤵
  PID:7552
- C:\Windows\System\XsXAdhA.exe
  C:\Windows\System\XsXAdhA.exe
  2⤵
  PID:7580
- C:\Windows\System\vJqafHr.exe
  C:\Windows\System\vJqafHr.exe
  2⤵
  PID:7608
- C:\Windows\System\zZrSTGg.exe
  C:\Windows\System\zZrSTGg.exe
  2⤵
  PID:7668
- C:\Windows\System\zaUbtLu.exe
  C:\Windows\System\zaUbtLu.exe
  2⤵
  PID:7724
- C:\Windows\System\hAJdTup.exe
  C:\Windows\System\hAJdTup.exe
  2⤵
  PID:7784
- C:\Windows\System\ZQRiReS.exe
  C:\Windows\System\ZQRiReS.exe
  2⤵
  PID:7816
- C:\Windows\System\eGPiCOA.exe
  C:\Windows\System\eGPiCOA.exe
  2⤵
  PID:7832
- C:\Windows\System\ycpfwVT.exe
  C:\Windows\System\ycpfwVT.exe
  2⤵
  PID:7880
- C:\Windows\System\yhMXmmY.exe
  C:\Windows\System\yhMXmmY.exe
  2⤵
  PID:7920
- C:\Windows\System\xkPzJRd.exe
  C:\Windows\System\xkPzJRd.exe
  2⤵
  PID:7960
- C:\Windows\System\GbJHvFq.exe
  C:\Windows\System\GbJHvFq.exe
  2⤵
  PID:8020
- C:\Windows\System\PzJyVKq.exe
  C:\Windows\System\PzJyVKq.exe
  2⤵
  PID:8044
- C:\Windows\System\AWFtogs.exe
  C:\Windows\System\AWFtogs.exe
  2⤵
  PID:8096
- C:\Windows\System\khkHFME.exe
  C:\Windows\System\khkHFME.exe
  2⤵
  PID:8156
- C:\Windows\System\TOnncOh.exe
  C:\Windows\System\TOnncOh.exe
  2⤵
  PID:4948
- C:\Windows\System\sPXjxLS.exe
  C:\Windows\System\sPXjxLS.exe
  2⤵
  PID:7304
- C:\Windows\System\WBeRYUl.exe
  C:\Windows\System\WBeRYUl.exe
  2⤵
  PID:7424
- C:\Windows\System\MnHYZzh.exe
  C:\Windows\System\MnHYZzh.exe
  2⤵
  PID:7600
- C:\Windows\System\igvvnjr.exe
  C:\Windows\System\igvvnjr.exe
  2⤵
  PID:7660
- C:\Windows\System\cKdWikl.exe
  C:\Windows\System\cKdWikl.exe
  2⤵
  PID:7808
- C:\Windows\System\VzJIvIc.exe
  C:\Windows\System\VzJIvIc.exe
  2⤵
  PID:7900
- C:\Windows\System\fjSxWMJ.exe
  C:\Windows\System\fjSxWMJ.exe
  2⤵
  PID:7968
- C:\Windows\System\ahBOKIL.exe
  C:\Windows\System\ahBOKIL.exe
  2⤵
  PID:8052
- C:\Windows\System\wuIvUzb.exe
  C:\Windows\System\wuIvUzb.exe
  2⤵
  PID:8088
- C:\Windows\System\OyrVjVF.exe
  C:\Windows\System\OyrVjVF.exe
  2⤵
  PID:8140
- C:\Windows\System\VtcESAL.exe
  C:\Windows\System\VtcESAL.exe
  2⤵
  PID:7256
- C:\Windows\System\XSrJxhq.exe
  C:\Windows\System\XSrJxhq.exe
  2⤵
  PID:7500
- C:\Windows\System\qhCWXFX.exe
  C:\Windows\System\qhCWXFX.exe
  2⤵
  PID:1080
- C:\Windows\System\scvjEjm.exe
  C:\Windows\System\scvjEjm.exe
  2⤵
  PID:7864
- C:\Windows\System\fVDidMN.exe
  C:\Windows\System\fVDidMN.exe
  2⤵
  PID:7956
- C:\Windows\System\RWNZXYt.exe
  C:\Windows\System\RWNZXYt.exe
  2⤵
  PID:8120
- C:\Windows\System\UAOFIoo.exe
  C:\Windows\System\UAOFIoo.exe
  2⤵
  PID:8168
- C:\Windows\System\dbjepBi.exe
  C:\Windows\System\dbjepBi.exe
  2⤵
  PID:7412
- C:\Windows\System\xuoMSVt.exe
  C:\Windows\System\xuoMSVt.exe
  2⤵
  PID:7696
- C:\Windows\System\IXUXbvF.exe
  C:\Windows\System\IXUXbvF.exe
  2⤵
  PID:6452
- C:\Windows\System\dqXOuOO.exe
  C:\Windows\System\dqXOuOO.exe
  2⤵
  PID:7984
- C:\Windows\System\wQswaik.exe
  C:\Windows\System\wQswaik.exe
  2⤵
  PID:7220
- C:\Windows\System\HtAxaRA.exe
  C:\Windows\System\HtAxaRA.exe
  2⤵
  PID:1768
- C:\Windows\System\qtfsWZu.exe
  C:\Windows\System\qtfsWZu.exe
  2⤵
  PID:2504
- C:\Windows\System\nccFLrN.exe
  C:\Windows\System\nccFLrN.exe
  2⤵
  PID:7368
- C:\Windows\System\FfUfpMM.exe
  C:\Windows\System\FfUfpMM.exe
  2⤵
  PID:8036
- C:\Windows\System\lsbIiiO.exe
  C:\Windows\System\lsbIiiO.exe
  2⤵
  PID:7752
- C:\Windows\System\czxGqHx.exe
  C:\Windows\System\czxGqHx.exe
  2⤵
  PID:6900
- C:\Windows\System\haRIzOw.exe
  C:\Windows\System\haRIzOw.exe
  2⤵
  PID:5012
- C:\Windows\System\wPuJari.exe
  C:\Windows\System\wPuJari.exe
  2⤵
  PID:8236
- C:\Windows\System\sKtHyof.exe
  C:\Windows\System\sKtHyof.exe
  2⤵
  PID:8264
- C:\Windows\System\amsSbpF.exe
  C:\Windows\System\amsSbpF.exe
  2⤵
  PID:8316
- C:\Windows\System\XUqHSEU.exe
  C:\Windows\System\XUqHSEU.exe
  2⤵
  PID:8356
- C:\Windows\System\cddMhTJ.exe
  C:\Windows\System\cddMhTJ.exe
  2⤵
  PID:8396
- C:\Windows\System\JmoZcbo.exe
  C:\Windows\System\JmoZcbo.exe
  2⤵
  PID:8436
- C:\Windows\System\UeuLIkE.exe
  C:\Windows\System\UeuLIkE.exe
  2⤵
  PID:8476
- C:\Windows\System\wXibeOB.exe
  C:\Windows\System\wXibeOB.exe
  2⤵
  PID:8504
- C:\Windows\System\TTUTCPX.exe
  C:\Windows\System\TTUTCPX.exe
  2⤵
  PID:8544
- C:\Windows\System\wZKAfby.exe
  C:\Windows\System\wZKAfby.exe
  2⤵
  PID:8588
- C:\Windows\System\BFMPOrS.exe
  C:\Windows\System\BFMPOrS.exe
  2⤵
  PID:8624
- C:\Windows\System\FiNETQN.exe
  C:\Windows\System\FiNETQN.exe
  2⤵
  PID:8676
- C:\Windows\System\EhxOArB.exe
  C:\Windows\System\EhxOArB.exe
  2⤵
  PID:8704
- C:\Windows\System\ujQipaP.exe
  C:\Windows\System\ujQipaP.exe
  2⤵
  PID:8772
- C:\Windows\System\QfDrzio.exe
  C:\Windows\System\QfDrzio.exe
  2⤵
  PID:8792
- C:\Windows\System\DeNRLAG.exe
  C:\Windows\System\DeNRLAG.exe
  2⤵
  PID:8852
- C:\Windows\System\QIBAKES.exe
  C:\Windows\System\QIBAKES.exe
  2⤵
  PID:8872
- C:\Windows\System\nAJYaur.exe
  C:\Windows\System\nAJYaur.exe
  2⤵
  PID:8928
- C:\Windows\System\HthQZKK.exe
  C:\Windows\System\HthQZKK.exe
  2⤵
  PID:8956
- C:\Windows\System\tReMkEt.exe
  C:\Windows\System\tReMkEt.exe
  2⤵
  PID:9016
- C:\Windows\System\nkSDfxJ.exe
  C:\Windows\System\nkSDfxJ.exe
  2⤵
  PID:9036
- C:\Windows\System\UNPujst.exe
  C:\Windows\System\UNPujst.exe
  2⤵
  PID:9088
- C:\Windows\System\ygYqYnm.exe
  C:\Windows\System\ygYqYnm.exe
  2⤵
  PID:9116
- C:\Windows\System\gxuRJFM.exe
  C:\Windows\System\gxuRJFM.exe
  2⤵
  PID:9152
- C:\Windows\System\BAQqkJC.exe
  C:\Windows\System\BAQqkJC.exe
  2⤵
  PID:9180
- C:\Windows\System\gvYXbzE.exe
  C:\Windows\System\gvYXbzE.exe
  2⤵
  PID:8196
- C:\Windows\System\tSQHxox.exe
  C:\Windows\System\tSQHxox.exe
  2⤵
  PID:8228
- C:\Windows\System\asPKTvA.exe
  C:\Windows\System\asPKTvA.exe
  2⤵
  PID:8304
- C:\Windows\System\TDuLuPx.exe
  C:\Windows\System\TDuLuPx.exe
  2⤵
  PID:8344
- C:\Windows\System\rKXoxAI.exe
  C:\Windows\System\rKXoxAI.exe
  2⤵
  PID:2912
- C:\Windows\System\fCIhimk.exe
  C:\Windows\System\fCIhimk.exe
  2⤵
  PID:8444
- C:\Windows\System\OnHYXMd.exe
  C:\Windows\System\OnHYXMd.exe
  2⤵
  PID:8496
- C:\Windows\System\bzuklvG.exe
  C:\Windows\System\bzuklvG.exe
  2⤵
  PID:8560
- C:\Windows\System\yPPiWrj.exe
  C:\Windows\System\yPPiWrj.exe
  2⤵
  PID:8600
- C:\Windows\System\BXhMvvC.exe
  C:\Windows\System\BXhMvvC.exe
  2⤵
  PID:8668
- C:\Windows\System\wSTqrXE.exe
  C:\Windows\System\wSTqrXE.exe
  2⤵
  PID:8728
- C:\Windows\System\kQSIFNj.exe
  C:\Windows\System\kQSIFNj.exe
  2⤵
  PID:8756
- C:\Windows\System\ShRAeFH.exe
  C:\Windows\System\ShRAeFH.exe
  2⤵
  PID:8804
- C:\Windows\System\dmnwtyJ.exe
  C:\Windows\System\dmnwtyJ.exe
  2⤵
  PID:8868
- C:\Windows\System\vkimxHR.exe
  C:\Windows\System\vkimxHR.exe
  2⤵
  PID:8908
- C:\Windows\System\VpjeBTt.exe
  C:\Windows\System\VpjeBTt.exe
  2⤵
  PID:8984
- C:\Windows\System\yFmNqrs.exe
  C:\Windows\System\yFmNqrs.exe
  2⤵
  PID:9024
- C:\Windows\System\NKSjftB.exe
  C:\Windows\System\NKSjftB.exe
  2⤵
  PID:9072
- C:\Windows\System\KHQtSAv.exe
  C:\Windows\System\KHQtSAv.exe
  2⤵
  PID:9112
- C:\Windows\System\bkaCmwt.exe
  C:\Windows\System\bkaCmwt.exe
  2⤵
  PID:9172
- C:\Windows\System\vUnHHxZ.exe
  C:\Windows\System\vUnHHxZ.exe
  2⤵
  PID:8216
- C:\Windows\System\IEgDULj.exe
  C:\Windows\System\IEgDULj.exe
  2⤵
  PID:8336
- C:\Windows\System\RxzzxGa.exe
  C:\Windows\System\RxzzxGa.exe
  2⤵
  PID:8408
- C:\Windows\System\Mcgfxvs.exe
  C:\Windows\System\Mcgfxvs.exe
  2⤵
  PID:8540
- C:\Windows\System\yitGUgw.exe
  C:\Windows\System\yitGUgw.exe
  2⤵
  PID:8620
- C:\Windows\System\LvKhrFK.exe
  C:\Windows\System\LvKhrFK.exe
  2⤵
  PID:8744
- C:\Windows\System\TNlUixR.exe
  C:\Windows\System\TNlUixR.exe
  2⤵
  PID:8816
- C:\Windows\System\vriHOxs.exe
  C:\Windows\System\vriHOxs.exe
  2⤵
  PID:8924
- C:\Windows\System\GnoouEG.exe
  C:\Windows\System\GnoouEG.exe
  2⤵
  PID:9004
- C:\Windows\System\RxSLndh.exe
  C:\Windows\System\RxSLndh.exe
  2⤵
  PID:9148
- C:\Windows\System\xtPNetf.exe
  C:\Windows\System\xtPNetf.exe
  2⤵
  PID:8276
- C:\Windows\System\aKbPJfq.exe
  C:\Windows\System\aKbPJfq.exe
  2⤵
  PID:8512
- C:\Windows\System\yVCpeEG.exe
  C:\Windows\System\yVCpeEG.exe
  2⤵
  PID:4720
- C:\Windows\System\ZBauCbP.exe
  C:\Windows\System\ZBauCbP.exe
  2⤵
  PID:8880
- C:\Windows\System\GnfQdNx.exe
  C:\Windows\System\GnfQdNx.exe
  2⤵
  PID:9212
- C:\Windows\System\DqUHNvt.exe
  C:\Windows\System\DqUHNvt.exe
  2⤵
  PID:5000
- C:\Windows\System\hFHgShW.exe
  C:\Windows\System\hFHgShW.exe
  2⤵
  PID:9100
- C:\Windows\System\rczybLj.exe
  C:\Windows\System\rczybLj.exe
  2⤵
  PID:9220
- C:\Windows\System\WYzqzEF.exe
  C:\Windows\System\WYzqzEF.exe
  2⤵
  PID:9264
- C:\Windows\System\qEtYLGB.exe
  C:\Windows\System\qEtYLGB.exe
  2⤵
  PID:9300
- C:\Windows\System\NUGqstZ.exe
  C:\Windows\System\NUGqstZ.exe
  2⤵
  PID:9328
- C:\Windows\System\uxKeJyP.exe
  C:\Windows\System\uxKeJyP.exe
  2⤵
  PID:9364
- C:\Windows\System\DpGcCaC.exe
  C:\Windows\System\DpGcCaC.exe
  2⤵
  PID:9404
- C:\Windows\System\IrKCosA.exe
  C:\Windows\System\IrKCosA.exe
  2⤵
  PID:9428
- C:\Windows\System\vssddlu.exe
  C:\Windows\System\vssddlu.exe
  2⤵
  PID:9460
- C:\Windows\System\GHYZObV.exe
  C:\Windows\System\GHYZObV.exe
  2⤵
  PID:9492
- C:\Windows\System\nZRklnJ.exe
  C:\Windows\System\nZRklnJ.exe
  2⤵
  PID:9532
- C:\Windows\System\MTGGNgH.exe
  C:\Windows\System\MTGGNgH.exe
  2⤵
  PID:9560
- C:\Windows\System\xVimpUR.exe
  C:\Windows\System\xVimpUR.exe
  2⤵
  PID:9588
- C:\Windows\System\BjPBQuM.exe
  C:\Windows\System\BjPBQuM.exe
  2⤵
  PID:9616
- C:\Windows\System\qnumkxH.exe
  C:\Windows\System\qnumkxH.exe
  2⤵
  PID:9644
- C:\Windows\System\JIbwUMA.exe
  C:\Windows\System\JIbwUMA.exe
  2⤵
  PID:9672
- C:\Windows\System\ioENFze.exe
  C:\Windows\System\ioENFze.exe
  2⤵
  PID:9704
- C:\Windows\System\KtofMGV.exe
  C:\Windows\System\KtofMGV.exe
  2⤵
  PID:9732
- C:\Windows\System\YVKpxNy.exe
  C:\Windows\System\YVKpxNy.exe
  2⤵
  PID:9760
- C:\Windows\System\SkfwzlC.exe
  C:\Windows\System\SkfwzlC.exe
  2⤵
  PID:9788
- C:\Windows\System\sdBwlzB.exe
  C:\Windows\System\sdBwlzB.exe
  2⤵
  PID:9816
- C:\Windows\System\vVWjspY.exe
  C:\Windows\System\vVWjspY.exe
  2⤵
  PID:9844
- C:\Windows\System\MAIlcDm.exe
  C:\Windows\System\MAIlcDm.exe
  2⤵
  PID:9860
- C:\Windows\System\Uyujngg.exe
  C:\Windows\System\Uyujngg.exe
  2⤵
  PID:9880
- C:\Windows\System\BqGXwtR.exe
  C:\Windows\System\BqGXwtR.exe
  2⤵
  PID:9900
- C:\Windows\System\uasOgec.exe
  C:\Windows\System\uasOgec.exe
  2⤵
  PID:9928
- C:\Windows\System\kUByOac.exe
  C:\Windows\System\kUByOac.exe
  2⤵
  PID:9976
- C:\Windows\System\gcGndZo.exe
  C:\Windows\System\gcGndZo.exe
  2⤵
  PID:10012
- C:\Windows\System\HQqhkEf.exe
  C:\Windows\System\HQqhkEf.exe
  2⤵
  PID:10048
- C:\Windows\System\vrWOGsu.exe
  C:\Windows\System\vrWOGsu.exe
  2⤵
  PID:10088
- C:\Windows\System\YLoVtei.exe
  C:\Windows\System\YLoVtei.exe
  2⤵
  PID:10108
- C:\Windows\System\cjwsPYp.exe
  C:\Windows\System\cjwsPYp.exe
  2⤵
  PID:10136
- C:\Windows\System\NNQDbVc.exe
  C:\Windows\System\NNQDbVc.exe
  2⤵
  PID:10164
- C:\Windows\System\aJqrhEa.exe
  C:\Windows\System\aJqrhEa.exe
  2⤵
  PID:10192
- C:\Windows\System\tJqtDVs.exe
  C:\Windows\System\tJqtDVs.exe
  2⤵
  PID:10220
- C:\Windows\System\kPabwDY.exe
  C:\Windows\System\kPabwDY.exe
  2⤵
  PID:9244
- C:\Windows\System\JltBHsn.exe
  C:\Windows\System\JltBHsn.exe
  2⤵
  PID:9292
- C:\Windows\System\fhIfQwe.exe
  C:\Windows\System\fhIfQwe.exe
  2⤵
  PID:9344
- C:\Windows\System\UleBUVz.exe
  C:\Windows\System\UleBUVz.exe
  2⤵
  PID:9396
- C:\Windows\System\TgnlTVc.exe
  C:\Windows\System\TgnlTVc.exe
  2⤵
  PID:9452
- C:\Windows\System\gHjFBRk.exe
  C:\Windows\System\gHjFBRk.exe
  2⤵
  PID:9512
- C:\Windows\System\yyjhuZn.exe
  C:\Windows\System\yyjhuZn.exe
  2⤵
  PID:9552
- C:\Windows\System\avLcOqw.exe
  C:\Windows\System\avLcOqw.exe
  2⤵
  PID:9612
- C:\Windows\System\XzkzOTm.exe
  C:\Windows\System\XzkzOTm.exe
  2⤵
  PID:9684
- C:\Windows\System\TTJNAjz.exe
  C:\Windows\System\TTJNAjz.exe
  2⤵
  PID:9752
- C:\Windows\System\wtEJxNK.exe
  C:\Windows\System\wtEJxNK.exe
  2⤵
  PID:9812
- C:\Windows\System\CTeXuOz.exe
  C:\Windows\System\CTeXuOz.exe
  2⤵
  PID:9856
- C:\Windows\System\bXPximo.exe
  C:\Windows\System\bXPximo.exe
  2⤵
  PID:9892
- C:\Windows\System\YDnYWKd.exe
  C:\Windows\System\YDnYWKd.exe
  2⤵
  PID:10004
- C:\Windows\System\SkNRnpl.exe
  C:\Windows\System\SkNRnpl.exe
  2⤵
  PID:4444
- C:\Windows\System\zTVbZfT.exe
  C:\Windows\System\zTVbZfT.exe
  2⤵
  PID:10044
- C:\Windows\System\WvArOMy.exe
  C:\Windows\System\WvArOMy.exe
  2⤵
  PID:6988
- C:\Windows\System\KSzzGHR.exe
  C:\Windows\System\KSzzGHR.exe
  2⤵
  PID:10132
- C:\Windows\System\Fywygwh.exe
  C:\Windows\System\Fywygwh.exe
  2⤵
  PID:10204
- C:\Windows\System\ThnjTST.exe
  C:\Windows\System\ThnjTST.exe
  2⤵
  PID:9284
- C:\Windows\System\yXGblwZ.exe
  C:\Windows\System\yXGblwZ.exe
  2⤵
  PID:9416
- C:\Windows\System\bhdjcjm.exe
  C:\Windows\System\bhdjcjm.exe
  2⤵
  PID:9524
- C:\Windows\System\BKHknEZ.exe
  C:\Windows\System\BKHknEZ.exe
  2⤵
  PID:9664
- C:\Windows\System\Nigzkve.exe
  C:\Windows\System\Nigzkve.exe
  2⤵
  PID:9808
- C:\Windows\System\JzYLous.exe
  C:\Windows\System\JzYLous.exe
  2⤵
  PID:9956
- C:\Windows\System\nEkgJAt.exe
  C:\Windows\System\nEkgJAt.exe
  2⤵
  PID:5564
- C:\Windows\System\GHSmAFO.exe
  C:\Windows\System\GHSmAFO.exe
  2⤵
  PID:10188
- C:\Windows\System\zmRLaZB.exe
  C:\Windows\System\zmRLaZB.exe
  2⤵
  PID:9260
- C:\Windows\System\ETwODts.exe
  C:\Windows\System\ETwODts.exe
  2⤵
  PID:9580
- C:\Windows\System\lPcyXeo.exe
  C:\Windows\System\lPcyXeo.exe
  2⤵
  PID:9780
- C:\Windows\System\qosykrm.exe
  C:\Windows\System\qosykrm.exe
  2⤵
  PID:2528
- C:\Windows\System\WQyCapt.exe
  C:\Windows\System\WQyCapt.exe
  2⤵
  PID:3264
- C:\Windows\System\WIGnWHy.exe
  C:\Windows\System\WIGnWHy.exe
  2⤵
  PID:5804
- C:\Windows\System\TpJtdKn.exe
  C:\Windows\System\TpJtdKn.exe
  2⤵
  PID:9804
- C:\Windows\System\FSpYhKx.exe
  C:\Windows\System\FSpYhKx.exe
  2⤵
  PID:10256
- C:\Windows\System\wBAJhSd.exe
  C:\Windows\System\wBAJhSd.exe
  2⤵
  PID:10284
- C:\Windows\System\gFLmGwn.exe
  C:\Windows\System\gFLmGwn.exe
  2⤵
  PID:10312
- C:\Windows\System\tvxXRQu.exe
  C:\Windows\System\tvxXRQu.exe
  2⤵
  PID:10340
- C:\Windows\System\qLcWngZ.exe
  C:\Windows\System\qLcWngZ.exe
  2⤵
  PID:10368
- C:\Windows\System\etYXjDL.exe
  C:\Windows\System\etYXjDL.exe
  2⤵
  PID:10396
- C:\Windows\System\HCqeYTJ.exe
  C:\Windows\System\HCqeYTJ.exe
  2⤵
  PID:10424
- C:\Windows\System\LrIMpuV.exe
  C:\Windows\System\LrIMpuV.exe
  2⤵
  PID:10452
- C:\Windows\System\zSrsTgI.exe
  C:\Windows\System\zSrsTgI.exe
  2⤵
  PID:10480
- C:\Windows\System\VaZIFcS.exe
  C:\Windows\System\VaZIFcS.exe
  2⤵
  PID:10508
- C:\Windows\System\dHtYloq.exe
  C:\Windows\System\dHtYloq.exe
  2⤵
  PID:10536
- C:\Windows\System\iiUZaTE.exe
  C:\Windows\System\iiUZaTE.exe
  2⤵
  PID:10564
- C:\Windows\System\ZnsvFAz.exe
  C:\Windows\System\ZnsvFAz.exe
  2⤵
  PID:10592
- C:\Windows\System\waoAPJh.exe
  C:\Windows\System\waoAPJh.exe
  2⤵
  PID:10620
- C:\Windows\System\qHQcXGH.exe
  C:\Windows\System\qHQcXGH.exe
  2⤵
  PID:10648
- C:\Windows\System\rlYlHuw.exe
  C:\Windows\System\rlYlHuw.exe
  2⤵
  PID:10676
- C:\Windows\System\eCBTsId.exe
  C:\Windows\System\eCBTsId.exe
  2⤵
  PID:10704
- C:\Windows\System\dGCuOzt.exe
  C:\Windows\System\dGCuOzt.exe
  2⤵
  PID:10732
- C:\Windows\System\cNSWlDa.exe
  C:\Windows\System\cNSWlDa.exe
  2⤵
  PID:10760
- C:\Windows\System\utpDTBc.exe
  C:\Windows\System\utpDTBc.exe
  2⤵
  PID:10788
- C:\Windows\System\AbubwBP.exe
  C:\Windows\System\AbubwBP.exe
  2⤵
  PID:10816
- C:\Windows\System\YKkAVCb.exe
  C:\Windows\System\YKkAVCb.exe
  2⤵
  PID:10844
- C:\Windows\System\QjrdKSe.exe
  C:\Windows\System\QjrdKSe.exe
  2⤵
  PID:10872
- C:\Windows\System\hRnvcCK.exe
  C:\Windows\System\hRnvcCK.exe
  2⤵
  PID:10900
- C:\Windows\System\IuUzlAZ.exe
  C:\Windows\System\IuUzlAZ.exe
  2⤵
  PID:10928
- C:\Windows\System\HljwumN.exe
  C:\Windows\System\HljwumN.exe
  2⤵
  PID:10956
- C:\Windows\System\tsWwlEY.exe
  C:\Windows\System\tsWwlEY.exe
  2⤵
  PID:10984
- C:\Windows\System\COZAzaw.exe
  C:\Windows\System\COZAzaw.exe
  2⤵
  PID:11012
- C:\Windows\System\fTiyQch.exe
  C:\Windows\System\fTiyQch.exe
  2⤵
  PID:11040
- C:\Windows\System\HjtMsGw.exe
  C:\Windows\System\HjtMsGw.exe
  2⤵
  PID:11068
- C:\Windows\System\vvZfMvH.exe
  C:\Windows\System\vvZfMvH.exe
  2⤵
  PID:11096
- C:\Windows\System\CJNQcCk.exe
  C:\Windows\System\CJNQcCk.exe
  2⤵
  PID:11124
- C:\Windows\System\tcTYDPc.exe
  C:\Windows\System\tcTYDPc.exe
  2⤵
  PID:11152
- C:\Windows\System\jysVATq.exe
  C:\Windows\System\jysVATq.exe
  2⤵
  PID:11180
- C:\Windows\System\lSVwfsE.exe
  C:\Windows\System\lSVwfsE.exe
  2⤵
  PID:11208
- C:\Windows\System\tLeIxln.exe
  C:\Windows\System\tLeIxln.exe
  2⤵
  PID:11248
- C:\Windows\System\tCxbDOe.exe
  C:\Windows\System\tCxbDOe.exe
  2⤵
  PID:10252
- C:\Windows\System\FnEIwfJ.exe
  C:\Windows\System\FnEIwfJ.exe
  2⤵
  PID:10332
- C:\Windows\System\jEbZHkD.exe
  C:\Windows\System\jEbZHkD.exe
  2⤵
  PID:10388
- C:\Windows\System\ynLhzrX.exe
  C:\Windows\System\ynLhzrX.exe
  2⤵
  PID:10436
- C:\Windows\System\vwKZKdq.exe
  C:\Windows\System\vwKZKdq.exe
  2⤵
  PID:10524
- C:\Windows\System\QvTdXKU.exe
  C:\Windows\System\QvTdXKU.exe
  2⤵
  PID:10584
- C:\Windows\System\KQvWYol.exe
  C:\Windows\System\KQvWYol.exe
  2⤵
  PID:10632
- C:\Windows\System\qAHPaKA.exe
  C:\Windows\System\qAHPaKA.exe
  2⤵
  PID:10720
- C:\Windows\System\WAEchFr.exe
  C:\Windows\System\WAEchFr.exe
  2⤵
  PID:10780
- C:\Windows\System\duHwXmo.exe
  C:\Windows\System\duHwXmo.exe
  2⤵
  PID:10840
- C:\Windows\System\pyGXnPl.exe
  C:\Windows\System\pyGXnPl.exe
  2⤵
  PID:10892
- C:\Windows\System\rGXHXym.exe
  C:\Windows\System\rGXHXym.exe
  2⤵
  PID:11000
- C:\Windows\System\yFbxbCv.exe
  C:\Windows\System\yFbxbCv.exe
  2⤵
  PID:11088
- C:\Windows\System\kNATzpS.exe
  C:\Windows\System\kNATzpS.exe
  2⤵
  PID:11220
- C:\Windows\System\sNzcqSU.exe
  C:\Windows\System\sNzcqSU.exe
  2⤵
  PID:10356
- C:\Windows\System\TsuYEUY.exe
  C:\Windows\System\TsuYEUY.exe
  2⤵
  PID:10772
- C:\Windows\System\mHTkHwC.exe
  C:\Windows\System\mHTkHwC.exe
  2⤵
  PID:10968
- C:\Windows\System\ZIyOANA.exe
  C:\Windows\System\ZIyOANA.exe
  2⤵
  PID:11064
- C:\Windows\System\egcuPhr.exe
  C:\Windows\System\egcuPhr.exe
  2⤵
  PID:10328
- C:\Windows\System\VaUEPdA.exe
  C:\Windows\System\VaUEPdA.exe
  2⤵
  PID:10940
- C:\Windows\System\savMgXo.exe
  C:\Windows\System\savMgXo.exe
  2⤵
  PID:11296
- C:\Windows\System\poSeoNu.exe
  C:\Windows\System\poSeoNu.exe
  2⤵
  PID:11324
- C:\Windows\System\dwpqKDO.exe
  C:\Windows\System\dwpqKDO.exe
  2⤵
  PID:11352
- C:\Windows\System\smyNtft.exe
  C:\Windows\System\smyNtft.exe
  2⤵
  PID:11380
- C:\Windows\System\EQkahxt.exe
  C:\Windows\System\EQkahxt.exe
  2⤵
  PID:11408
- C:\Windows\System\WpCweZT.exe
  C:\Windows\System\WpCweZT.exe
  2⤵
  PID:11436
- C:\Windows\System\nkKWuAf.exe
  C:\Windows\System\nkKWuAf.exe
  2⤵
  PID:11464
- C:\Windows\System\bRmlqcm.exe
  C:\Windows\System\bRmlqcm.exe
  2⤵
  PID:11492
- C:\Windows\System\pUNweJw.exe
  C:\Windows\System\pUNweJw.exe
  2⤵
  PID:11520
- C:\Windows\System\jIBrbfN.exe
  C:\Windows\System\jIBrbfN.exe
  2⤵
  PID:11548
- C:\Windows\System\ARBgpuk.exe
  C:\Windows\System\ARBgpuk.exe
  2⤵
  PID:11576
- C:\Windows\System\WsGEeRx.exe
  C:\Windows\System\WsGEeRx.exe
  2⤵
  PID:11604
- C:\Windows\System\vTswvFj.exe
  C:\Windows\System\vTswvFj.exe
  2⤵
  PID:11632
- C:\Windows\System\wCvEWCb.exe
  C:\Windows\System\wCvEWCb.exe
  2⤵
  PID:11660
- C:\Windows\System\DIURyze.exe
  C:\Windows\System\DIURyze.exe
  2⤵
  PID:11688
- C:\Windows\System\GhROCWS.exe
  C:\Windows\System\GhROCWS.exe
  2⤵
  PID:11716
- C:\Windows\System\qPsCEtf.exe
  C:\Windows\System\qPsCEtf.exe
  2⤵
  PID:11744
- C:\Windows\System\KpjCRYN.exe
  C:\Windows\System\KpjCRYN.exe
  2⤵
  PID:11772
- C:\Windows\System\ssAvwXH.exe
  C:\Windows\System\ssAvwXH.exe
  2⤵
  PID:11800
- C:\Windows\System\JxlLpGs.exe
  C:\Windows\System\JxlLpGs.exe
  2⤵
  PID:11828
- C:\Windows\System\OgWnRia.exe
  C:\Windows\System\OgWnRia.exe
  2⤵
  PID:11856
- C:\Windows\System\nLvIYTH.exe
  C:\Windows\System\nLvIYTH.exe
  2⤵
  PID:11884
- C:\Windows\System\UVMwkxA.exe
  C:\Windows\System\UVMwkxA.exe
  2⤵
  PID:11912
- C:\Windows\System\zIFtIiX.exe
  C:\Windows\System\zIFtIiX.exe
  2⤵
  PID:11940
- C:\Windows\System\JMICiiw.exe
  C:\Windows\System\JMICiiw.exe
  2⤵
  PID:11968
- C:\Windows\System\UTdAxkE.exe
  C:\Windows\System\UTdAxkE.exe
  2⤵
  PID:11996
- C:\Windows\System\YSjuAgT.exe
  C:\Windows\System\YSjuAgT.exe
  2⤵
  PID:12024
- C:\Windows\System\KJYVrol.exe
  C:\Windows\System\KJYVrol.exe
  2⤵
  PID:12052
- C:\Windows\System\IfLPUKX.exe
  C:\Windows\System\IfLPUKX.exe
  2⤵
  PID:12080
- C:\Windows\System\jYoVlRg.exe
  C:\Windows\System\jYoVlRg.exe
  2⤵
  PID:12108
- C:\Windows\System\GVizDYh.exe
  C:\Windows\System\GVizDYh.exe
  2⤵
  PID:12136
- C:\Windows\System\rEbFxyB.exe
  C:\Windows\System\rEbFxyB.exe
  2⤵
  PID:12164
- C:\Windows\System\ixrKJuC.exe
  C:\Windows\System\ixrKJuC.exe
  2⤵
  PID:12192
- C:\Windows\System\IDRXjng.exe
  C:\Windows\System\IDRXjng.exe
  2⤵
  PID:12220
- C:\Windows\System\CethxeJ.exe
  C:\Windows\System\CethxeJ.exe
  2⤵
  PID:12248
- C:\Windows\System\ffTPVvi.exe
  C:\Windows\System\ffTPVvi.exe
  2⤵
  PID:12276
- C:\Windows\System\pTZwykl.exe
  C:\Windows\System\pTZwykl.exe
  2⤵
  PID:11308
- C:\Windows\System\AHZmXes.exe
  C:\Windows\System\AHZmXes.exe
  2⤵
  PID:11348
- C:\Windows\System\neiGzRi.exe
  C:\Windows\System\neiGzRi.exe
  2⤵
  PID:11420
- C:\Windows\System\RFkTBlW.exe
  C:\Windows\System\RFkTBlW.exe
  2⤵
  PID:11488
- C:\Windows\System\GlzLfCV.exe
  C:\Windows\System\GlzLfCV.exe
  2⤵
  PID:11560
- C:\Windows\System\GDosNuu.exe
  C:\Windows\System\GDosNuu.exe
  2⤵
  PID:11624
- C:\Windows\System\XwXuZfi.exe
  C:\Windows\System\XwXuZfi.exe
  2⤵
  PID:11684
- C:\Windows\System\ToiyDkG.exe
  C:\Windows\System\ToiyDkG.exe
  2⤵
  PID:11764
- C:\Windows\System\ttVhUMu.exe
  C:\Windows\System\ttVhUMu.exe
  2⤵
  PID:11824
- C:\Windows\System\PtWOwsV.exe
  C:\Windows\System\PtWOwsV.exe
  2⤵
  PID:11896
- C:\Windows\System\ITBvTna.exe
  C:\Windows\System\ITBvTna.exe
  2⤵
  PID:11964
- C:\Windows\System\aiLdtJw.exe
  C:\Windows\System\aiLdtJw.exe
  2⤵
  PID:12044
- C:\Windows\System\pxJEfTU.exe
  C:\Windows\System\pxJEfTU.exe
  2⤵
  PID:12096
- C:\Windows\System\PxqbPmF.exe
  C:\Windows\System\PxqbPmF.exe
  2⤵
  PID:12156
- C:\Windows\System\ShxtUUt.exe
  C:\Windows\System\ShxtUUt.exe
  2⤵
  PID:12212
- C:\Windows\System\zCsFIFO.exe
  C:\Windows\System\zCsFIFO.exe
  2⤵
  PID:12272
- C:\Windows\System\kiuaAmC.exe
  C:\Windows\System\kiuaAmC.exe
  2⤵
  PID:11376
- C:\Windows\System\vaKgCtL.exe
  C:\Windows\System\vaKgCtL.exe
  2⤵
  PID:11540
- C:\Windows\System\RTfMPuE.exe
  C:\Windows\System\RTfMPuE.exe
  2⤵
  PID:11680
- C:\Windows\System\bcajlmz.exe
  C:\Windows\System\bcajlmz.exe
  2⤵
  PID:11852
- C:\Windows\System\TmiTYsg.exe
  C:\Windows\System\TmiTYsg.exe
  2⤵
  PID:12008
- C:\Windows\System\IDviboR.exe
  C:\Windows\System\IDviboR.exe
  2⤵
  PID:4576
- C:\Windows\System\dUgwwDS.exe
  C:\Windows\System\dUgwwDS.exe
  2⤵
  PID:12240
- C:\Windows\System\nQYDNZR.exe
  C:\Windows\System\nQYDNZR.exe
  2⤵
  PID:11480
- C:\Windows\System\gnRxiFk.exe
  C:\Windows\System\gnRxiFk.exe
  2⤵
  PID:11740
- C:\Windows\System\siAghVl.exe
  C:\Windows\System\siAghVl.exe
  2⤵
  PID:4412
- C:\Windows\System\FnDSRKC.exe
  C:\Windows\System\FnDSRKC.exe
  2⤵
  PID:11344
- C:\Windows\System\NjXNlnc.exe
  C:\Windows\System\NjXNlnc.exe
  2⤵
  PID:12208
- C:\Windows\System\NewItHZ.exe
  C:\Windows\System\NewItHZ.exe
  2⤵
  PID:12076
- C:\Windows\System\heJBZPI.exe
  C:\Windows\System\heJBZPI.exe
  2⤵
  PID:12316
- C:\Windows\System\tjzNvHa.exe
  C:\Windows\System\tjzNvHa.exe
  2⤵
  PID:12344
- C:\Windows\System\DCUkdeY.exe
  C:\Windows\System\DCUkdeY.exe
  2⤵
  PID:12372
- C:\Windows\System\viujxdl.exe
  C:\Windows\System\viujxdl.exe
  2⤵
  PID:12400
- C:\Windows\System\JsOMgcT.exe
  C:\Windows\System\JsOMgcT.exe
  2⤵
  PID:12428
- C:\Windows\System\mKZCprV.exe
  C:\Windows\System\mKZCprV.exe
  2⤵
  PID:12456
- C:\Windows\System\pJLASwW.exe
  C:\Windows\System\pJLASwW.exe
  2⤵
  PID:12484
- C:\Windows\System\fbKipfv.exe
  C:\Windows\System\fbKipfv.exe
  2⤵
  PID:12512
- C:\Windows\System\oedUVBh.exe
  C:\Windows\System\oedUVBh.exe
  2⤵
  PID:12540
- C:\Windows\System\wefwhwX.exe
  C:\Windows\System\wefwhwX.exe
  2⤵
  PID:12568
- C:\Windows\System\HRMKNhm.exe
  C:\Windows\System\HRMKNhm.exe
  2⤵
  PID:12596
- C:\Windows\System\mduZAjF.exe
  C:\Windows\System\mduZAjF.exe
  2⤵
  PID:12624
- C:\Windows\System\ToILjFS.exe
  C:\Windows\System\ToILjFS.exe
  2⤵
  PID:12652
- C:\Windows\System\ZaFRAQB.exe
  C:\Windows\System\ZaFRAQB.exe
  2⤵
  PID:12680
- C:\Windows\System\rSQMymT.exe
  C:\Windows\System\rSQMymT.exe
  2⤵
  PID:12708
- C:\Windows\System\AIFNXRA.exe
  C:\Windows\System\AIFNXRA.exe
  2⤵
  PID:12736
- C:\Windows\System\QLoEZZR.exe
  C:\Windows\System\QLoEZZR.exe
  2⤵
  PID:12764
- C:\Windows\System\HGkXQlW.exe
  C:\Windows\System\HGkXQlW.exe
  2⤵
  PID:12792
- C:\Windows\System\jOCsOtn.exe
  C:\Windows\System\jOCsOtn.exe
  2⤵
  PID:12820
- C:\Windows\System\ZhvUZFx.exe
  C:\Windows\System\ZhvUZFx.exe
  2⤵
  PID:12848
- C:\Windows\System\rBqXWRf.exe
  C:\Windows\System\rBqXWRf.exe
  2⤵
  PID:12876
- C:\Windows\System\cyyRkVK.exe
  C:\Windows\System\cyyRkVK.exe
  2⤵
  PID:12904
- C:\Windows\System\NqJhRXr.exe
  C:\Windows\System\NqJhRXr.exe
  2⤵
  PID:12932
- C:\Windows\System\wXfuxMu.exe
  C:\Windows\System\wXfuxMu.exe
  2⤵
  PID:12960
- C:\Windows\System\cDsdzOP.exe
  C:\Windows\System\cDsdzOP.exe
  2⤵
  PID:12988
- C:\Windows\System\nnBdtZK.exe
  C:\Windows\System\nnBdtZK.exe
  2⤵
  PID:13016
- C:\Windows\System\uhExReC.exe
  C:\Windows\System\uhExReC.exe
  2⤵
  PID:13044
- C:\Windows\System\iqTcbMb.exe
  C:\Windows\System\iqTcbMb.exe
  2⤵
  PID:13072
- C:\Windows\System\SDNQLzY.exe
  C:\Windows\System\SDNQLzY.exe
  2⤵
  PID:13100
- C:\Windows\System\hmkovHx.exe
  C:\Windows\System\hmkovHx.exe
  2⤵
  PID:13128
- C:\Windows\System\QHhbVfW.exe
  C:\Windows\System\QHhbVfW.exe
  2⤵
  PID:13156
- C:\Windows\System\fKGTfUa.exe
  C:\Windows\System\fKGTfUa.exe
  2⤵
  PID:13184
- C:\Windows\System\fQFqIxY.exe
  C:\Windows\System\fQFqIxY.exe
  2⤵
  PID:13212
- C:\Windows\System\GKZhPYF.exe
  C:\Windows\System\GKZhPYF.exe
  2⤵
  PID:13240
- C:\Windows\System\YGVAcGv.exe
  C:\Windows\System\YGVAcGv.exe
  2⤵
  PID:13272
- C:\Windows\System\hTvHciC.exe
  C:\Windows\System\hTvHciC.exe
  2⤵
  PID:13304
- C:\Windows\System\JUppMtq.exe
  C:\Windows\System\JUppMtq.exe
  2⤵
  PID:12328
- C:\Windows\System\ZYGGixG.exe
  C:\Windows\System\ZYGGixG.exe
  2⤵
  PID:12384
- C:\Windows\System\CUevdlI.exe
  C:\Windows\System\CUevdlI.exe
  2⤵
  PID:12424
- C:\Windows\System\eKksJcd.exe
  C:\Windows\System\eKksJcd.exe
  2⤵
  PID:12504
- C:\Windows\System\wHDAFrX.exe
  C:\Windows\System\wHDAFrX.exe
  2⤵
  PID:12620
- C:\Windows\System\ccJVAMn.exe
  C:\Windows\System\ccJVAMn.exe
  2⤵
  PID:12692
- C:\Windows\System\viySLte.exe
  C:\Windows\System\viySLte.exe
  2⤵
  PID:12756
- C:\Windows\System\fzJecLO.exe
  C:\Windows\System\fzJecLO.exe
  2⤵
  PID:12816
- C:\Windows\System\FctmSQc.exe
  C:\Windows\System\FctmSQc.exe
  2⤵
  PID:12900
- C:\Windows\System\DCSMjih.exe
  C:\Windows\System\DCSMjih.exe
  2⤵
  PID:12928
- C:\Windows\System\cReJPMy.exe
  C:\Windows\System\cReJPMy.exe
  2⤵
  PID:13000
- C:\Windows\System\nnoZvpY.exe
  C:\Windows\System\nnoZvpY.exe
  2⤵
  PID:13064
- C:\Windows\System\gTFNfjT.exe
  C:\Windows\System\gTFNfjT.exe
  2⤵
  PID:13124
- C:\Windows\System\dYbLxQr.exe
  C:\Windows\System\dYbLxQr.exe
  2⤵
  PID:13196
- C:\Windows\System\jBulrHn.exe
  C:\Windows\System\jBulrHn.exe
  2⤵
  PID:13268
- C:\Windows\System\XgGZaUm.exe
  C:\Windows\System\XgGZaUm.exe
  2⤵
  PID:12356
- C:\Windows\System\cKKSvmZ.exe
  C:\Windows\System\cKKSvmZ.exe
  2⤵
  PID:12532
- C:\Windows\System\IEjkWOV.exe
  C:\Windows\System\IEjkWOV.exe
  2⤵
  PID:12676
- C:\Windows\System\gSfQOnO.exe
  C:\Windows\System\gSfQOnO.exe
  2⤵
  PID:12844
- C:\Windows\System\KNmWOnW.exe
  C:\Windows\System\KNmWOnW.exe
  2⤵
  PID:12664
- C:\Windows\System\wNFtYRn.exe
  C:\Windows\System\wNFtYRn.exe
  2⤵
  PID:13028
- C:\Windows\System\BtEuRUf.exe
  C:\Windows\System\BtEuRUf.exe
  2⤵
  PID:12924
- C:\Windows\System\GrBjmNh.exe
  C:\Windows\System\GrBjmNh.exe
  2⤵
  PID:12984
- C:\Windows\System\DzaZlPf.exe
  C:\Windows\System\DzaZlPf.exe
  2⤵
  PID:3232
- C:\Windows\System\IEcPWlc.exe
  C:\Windows\System\IEcPWlc.exe
  2⤵
  PID:4872
- C:\Windows\System\ScNYrJQ.exe
  C:\Windows\System\ScNYrJQ.exe
  2⤵
  PID:12980
- C:\Windows\System\fOBvyBf.exe
  C:\Windows\System\fOBvyBf.exe
  2⤵
  PID:3620
- C:\Windows\System\pYoIddX.exe
  C:\Windows\System\pYoIddX.exe
  2⤵
  PID:13120
- C:\Windows\System\lHAyfUd.exe
  C:\Windows\System\lHAyfUd.exe
  2⤵
  PID:13112
- C:\Windows\System\vkTkoUK.exe
  C:\Windows\System\vkTkoUK.exe
  2⤵
  PID:1968
- C:\Windows\System\VnauaQg.exe
  C:\Windows\System\VnauaQg.exe
  2⤵
  PID:3808
- C:\Windows\System\hvZonJu.exe
  C:\Windows\System\hvZonJu.exe
  2⤵
  PID:32
- C:\Windows\System\WuHBDCu.exe
  C:\Windows\System\WuHBDCu.exe
  2⤵
  PID:13380
- C:\Windows\System\VYIxTqx.exe
  C:\Windows\System\VYIxTqx.exe
  2⤵
  PID:13508
- C:\Windows\System\AbfMSnK.exe
  C:\Windows\System\AbfMSnK.exe
  2⤵
  PID:13588
- C:\Windows\System\llmLZvI.exe
  C:\Windows\System\llmLZvI.exe
  2⤵
  PID:13604
- C:\Windows\System\NOnWfFU.exe
  C:\Windows\System\NOnWfFU.exe
  2⤵
  PID:13688
- C:\Windows\System\aWNhaeE.exe
  C:\Windows\System\aWNhaeE.exe
  2⤵
  PID:13728
- C:\Windows\System\AGRDrGQ.exe
  C:\Windows\System\AGRDrGQ.exe
  2⤵
  PID:13948
- C:\Windows\System\bOXAveu.exe
  C:\Windows\System\bOXAveu.exe
  2⤵
  PID:2296
- C:\Windows\System\VGmueTv.exe
  C:\Windows\System\VGmueTv.exe
  2⤵
  PID:13976
- C:\Windows\System\CumFXaS.exe
  C:\Windows\System\CumFXaS.exe
  2⤵
  PID:6136
- C:\Windows\System\aCzGHys.exe
  C:\Windows\System\aCzGHys.exe
  2⤵
  PID:14196
- C:\Windows\System\brNJKdS.exe
  C:\Windows\System\brNJKdS.exe
  2⤵
  PID:3816
- C:\Windows\System\oVBPLyU.exe
  C:\Windows\System\oVBPLyU.exe
  2⤵
  PID:5776
- C:\Windows\System\ARyMhXo.exe
  C:\Windows\System\ARyMhXo.exe
  2⤵
  PID:1860
- C:\Windows\System\nOYXlxa.exe
  C:\Windows\System\nOYXlxa.exe
  2⤵
  PID:13852
- C:\Windows\System\QxBiIfU.exe
  C:\Windows\System\QxBiIfU.exe
  2⤵
  PID:13896
- C:\Windows\System\xrdbGMC.exe
  C:\Windows\System\xrdbGMC.exe
  2⤵
  PID:13940
- C:\Windows\System\Rqfxgjj.exe
  C:\Windows\System\Rqfxgjj.exe
  2⤵
  PID:7060
- C:\Windows\System\AuunGQt.exe
  C:\Windows\System\AuunGQt.exe
  2⤵
  PID:6812
- C:\Windows\System\jVcpOIr.exe
  C:\Windows\System\jVcpOIr.exe
  2⤵
  PID:7212
- C:\Windows\System\idtHGbg.exe
  C:\Windows\System\idtHGbg.exe
  2⤵
  PID:7436
- C:\Windows\System\RpXcfkF.exe
  C:\Windows\System\RpXcfkF.exe
  2⤵
  PID:7560
- C:\Windows\System\HHpMtip.exe
  C:\Windows\System\HHpMtip.exe
  2⤵
  PID:7744
- C:\Windows\System\IQTlOfy.exe
  C:\Windows\System\IQTlOfy.exe
  2⤵
  PID:2268
- C:\Windows\System\diUczme.exe
  C:\Windows\System\diUczme.exe
  2⤵
  PID:5320
- C:\Windows\System\DxHyokM.exe
  C:\Windows\System\DxHyokM.exe
  2⤵
  PID:7928
- C:\Windows\System\DiWxXqx.exe
  C:\Windows\System\DiWxXqx.exe
  2⤵
  PID:7980
- C:\Windows\System\efFfSDy.exe
  C:\Windows\System\efFfSDy.exe
  2⤵
  PID:2436
- C:\Windows\System\cqZuQox.exe
  C:\Windows\System\cqZuQox.exe
  2⤵
  PID:8000
- C:\Windows\System\LbAblNn.exe
  C:\Windows\System\LbAblNn.exe
  2⤵
  PID:14028
- C:\Windows\System\DXwBoRH.exe
  C:\Windows\System\DXwBoRH.exe
  2⤵
  PID:5936
- C:\Windows\System\jWHDIpu.exe
  C:\Windows\System\jWHDIpu.exe
  2⤵
  PID:14044
- C:\Windows\System\NaZXNYM.exe
  C:\Windows\System\NaZXNYM.exe
  2⤵
  PID:14048
- C:\Windows\System\XLnDbKL.exe
  C:\Windows\System\XLnDbKL.exe
  2⤵
  PID:14076
- C:\Windows\System\EMuEWMo.exe
  C:\Windows\System\EMuEWMo.exe
  2⤵
  PID:8172
- C:\Windows\System\ppMchTS.exe
  C:\Windows\System\ppMchTS.exe
  2⤵
  PID:14124
- C:\Windows\System\fjyRTnv.exe
  C:\Windows\System\fjyRTnv.exe
  2⤵
  PID:14144
- C:\Windows\System\zPTXsxu.exe
  C:\Windows\System\zPTXsxu.exe
  2⤵
  PID:5456
- C:\Windows\System\fkWDQeu.exe
  C:\Windows\System\fkWDQeu.exe
  2⤵
  PID:14180
- C:\Windows\System\XFDAeHI.exe
  C:\Windows\System\XFDAeHI.exe
  2⤵
  PID:14160
- C:\Windows\System\CyBlNXQ.exe
  C:\Windows\System\CyBlNXQ.exe
  2⤵
  PID:3508
- C:\Windows\System\cmrXxVE.exe
  C:\Windows\System\cmrXxVE.exe
  2⤵
  PID:7476
- C:\Windows\System\lkEerPh.exe
  C:\Windows\System\lkEerPh.exe
  2⤵
  PID:14216
- C:\Windows\System\AFDnuuC.exe
  C:\Windows\System\AFDnuuC.exe
  2⤵
  PID:5556
- C:\Windows\System\hiITcne.exe
  C:\Windows\System\hiITcne.exe
  2⤵
  PID:14244
- C:\Windows\System\LAkwdgA.exe
  C:\Windows\System\LAkwdgA.exe
  2⤵
  PID:4620
- C:\Windows\System\zjMgSzu.exe
  C:\Windows\System\zjMgSzu.exe
  2⤵
  PID:14276
- C:\Windows\System\JtxEsue.exe
  C:\Windows\System\JtxEsue.exe
  2⤵
  PID:7896
- C:\Windows\System\SHTVWYV.exe
  C:\Windows\System\SHTVWYV.exe
  2⤵
  PID:7976
- C:\Windows\System\BIYSUPE.exe
  C:\Windows\System\BIYSUPE.exe
  2⤵
  PID:14312
- C:\Windows\System\cDplHBw.exe
  C:\Windows\System\cDplHBw.exe
  2⤵
  PID:5924
- C:\Windows\System\lhUkazH.exe
  C:\Windows\System\lhUkazH.exe
  2⤵
  PID:8176
- C:\Windows\System\caYJLbi.exe
  C:\Windows\System\caYJLbi.exe
  2⤵
  PID:5724
- C:\Windows\System\vfdnIiv.exe
  C:\Windows\System\vfdnIiv.exe
  2⤵
  PID:7344
- C:\Windows\System\tGKUeDE.exe
  C:\Windows\System\tGKUeDE.exe
  2⤵
  PID:13388
- C:\Windows\System\xXBKChm.exe
  C:\Windows\System\xXBKChm.exe
  2⤵
  PID:13452
- C:\Windows\System\saBsEgy.exe
  C:\Windows\System\saBsEgy.exe
  2⤵
  PID:7848
- C:\Windows\System\TOpnKxn.exe
  C:\Windows\System\TOpnKxn.exe
  2⤵
  PID:5796
- C:\Windows\System\zztMowb.exe
  C:\Windows\System\zztMowb.exe
  2⤵
  PID:13464
- C:\Windows\System\IczwCbY.exe
  C:\Windows\System\IczwCbY.exe
  2⤵
  PID:5820
- C:\Windows\System\NOEzJxs.exe
  C:\Windows\System\NOEzJxs.exe
  2⤵
  PID:10416
- C:\Windows\System\hsfMeYZ.exe
  C:\Windows\System\hsfMeYZ.exe
  2⤵
  PID:6200
- C:\Windows\System\cEfUVLe.exe
  C:\Windows\System\cEfUVLe.exe
  2⤵
  PID:6216
- C:\Windows\System\fYWKzPx.exe
  C:\Windows\System\fYWKzPx.exe
  2⤵
  PID:7372
- C:\Windows\System\lJYSicM.exe
  C:\Windows\System\lJYSicM.exe
  2⤵
  PID:3664
- C:\Windows\System\YUqoSCq.exe
  C:\Windows\System\YUqoSCq.exe
  2⤵
  PID:8112
- C:\Windows\System\bDPhvpq.exe
  C:\Windows\System\bDPhvpq.exe
  2⤵
  PID:7716
- C:\Windows\System\XeZvzNO.exe
  C:\Windows\System\XeZvzNO.exe
  2⤵
  PID:3648
- C:\Windows\System\PmQiuox.exe
  C:\Windows\System\PmQiuox.exe
  2⤵
  PID:13584
- C:\Windows\System\uyvITZS.exe
  C:\Windows\System\uyvITZS.exe
  2⤵
  PID:13600
- C:\Windows\System\hjyVVcY.exe
  C:\Windows\System\hjyVVcY.exe
  2⤵
  PID:5988
- C:\Windows\System\tlRgoHl.exe
  C:\Windows\System\tlRgoHl.exe
  2⤵
  PID:13632
- C:\Windows\System\PImiqoJ.exe
  C:\Windows\System\PImiqoJ.exe
  2⤵
  PID:8404
- C:\Windows\System\PpPoyVg.exe
  C:\Windows\System\PpPoyVg.exe
  2⤵
  PID:13672
- C:\Windows\System\YJZdscY.exe
  C:\Windows\System\YJZdscY.exe
  2⤵
  PID:8516
- C:\Windows\System\SJrJydM.exe
  C:\Windows\System\SJrJydM.exe
  2⤵
  PID:6024
- C:\Windows\System\rrRKMfP.exe
  C:\Windows\System\rrRKMfP.exe
  2⤵
  PID:5072
- C:\Windows\System\rWFDwjY.exe
  C:\Windows\System\rWFDwjY.exe
  2⤵
  PID:6824
- C:\Windows\System\bTdPWYT.exe
  C:\Windows\System\bTdPWYT.exe
  2⤵
  PID:6800
- C:\Windows\System\IXCVoAW.exe
  C:\Windows\System\IXCVoAW.exe
  2⤵
  PID:6832
- C:\Windows\System\ulaDxuI.exe
  C:\Windows\System\ulaDxuI.exe
  2⤵
  PID:6096
- C:\Windows\System\WzHCiiX.exe
  C:\Windows\System\WzHCiiX.exe
  2⤵
  PID:6772
- C:\Windows\System\ObXizTL.exe
  C:\Windows\System\ObXizTL.exe
  2⤵
  PID:2900
- C:\Windows\System\oFefBPI.exe
  C:\Windows\System\oFefBPI.exe
  2⤵
  PID:6500
- C:\Windows\System\Qzjrdjb.exe
  C:\Windows\System\Qzjrdjb.exe
  2⤵
  PID:9044
- C:\Windows\System\MCxrUlN.exe
  C:\Windows\System\MCxrUlN.exe
  2⤵
  PID:6512
- C:\Windows\System\ppGwOPJ.exe
  C:\Windows\System\ppGwOPJ.exe
  2⤵
  PID:1148
- C:\Windows\System\rIPktfH.exe
  C:\Windows\System\rIPktfH.exe
  2⤵
  PID:13740
- C:\Windows\System\DjwLGhI.exe
  C:\Windows\System\DjwLGhI.exe
  2⤵
  PID:8248
- C:\Windows\System\kNwEtuY.exe
  C:\Windows\System\kNwEtuY.exe
  2⤵
  PID:8372
- C:\Windows\System\zdmjNxu.exe
  C:\Windows\System\zdmjNxu.exe
  2⤵
  PID:8392
- C:\Windows\System\erTcCZL.exe
  C:\Windows\System\erTcCZL.exe
  2⤵
  PID:6572
- C:\Windows\System\phBFbwP.exe
  C:\Windows\System\phBFbwP.exe
  2⤵
  PID:2716
- C:\Windows\System\bETbUtO.exe
  C:\Windows\System\bETbUtO.exe
  2⤵
  PID:8644
- C:\Windows\System\ZEhOgVR.exe
  C:\Windows\System\ZEhOgVR.exe
  2⤵
  PID:8824
- C:\Windows\System\fjhAxHO.exe
  C:\Windows\System\fjhAxHO.exe
  2⤵
  PID:13816
- C:\Windows\System\qFdKHqI.exe
  C:\Windows\System\qFdKHqI.exe
  2⤵
  PID:5204
- C:\Windows\System\NapDOai.exe
  C:\Windows\System\NapDOai.exe
  2⤵
  PID:13824
- C:\Windows\System\xsTRQED.exe
  C:\Windows\System\xsTRQED.exe
  2⤵
  PID:5228
- C:\Windows\System\PMdvBnl.exe
  C:\Windows\System\PMdvBnl.exe
  2⤵
  PID:13856
- C:\Windows\System\ckNrPzs.exe
  C:\Windows\System\ckNrPzs.exe
  2⤵
  PID:13868
- C:\Windows\System\CNUzIUh.exe
  C:\Windows\System\CNUzIUh.exe
  2⤵
  PID:6764
- C:\Windows\System\oEtWozc.exe
  C:\Windows\System\oEtWozc.exe
  2⤵
  PID:8212
- C:\Windows\System\jbGPERv.exe
  C:\Windows\System\jbGPERv.exe
  2⤵
  PID:8280
- C:\Windows\System\riihpml.exe
  C:\Windows\System\riihpml.exe
  2⤵
  PID:8520
- C:\Windows\System\MREwUbp.exe
  C:\Windows\System\MREwUbp.exe
  2⤵
  PID:13916
- C:\Windows\System\wZSNksE.exe
  C:\Windows\System\wZSNksE.exe
  2⤵
  PID:2520
- C:\Windows\System\aoNxYJl.exe
  C:\Windows\System\aoNxYJl.exe
  2⤵
  PID:8980
- C:\Windows\System\gZTnPlv.exe
  C:\Windows\System\gZTnPlv.exe
  2⤵
  PID:13928
- C:\Windows\System\OvuXEcY.exe
  C:\Windows\System\OvuXEcY.exe
  2⤵
  PID:1052
- C:\Windows\System\EJTVftD.exe
  C:\Windows\System\EJTVftD.exe
  2⤵
  PID:8648
- C:\Windows\System\FnTKHXY.exe
  C:\Windows\System\FnTKHXY.exe
  2⤵
  PID:4680
- C:\Windows\System\JqJaXnE.exe
  C:\Windows\System\JqJaXnE.exe
  2⤵
  PID:3928
- C:\Windows\System\DyYWOaf.exe
  C:\Windows\System\DyYWOaf.exe
  2⤵
  PID:8460
- C:\Windows\System\UdBWorU.exe
  C:\Windows\System\UdBWorU.exe
  2⤵
  PID:6220
- C:\Windows\System\ZrTPqPS.exe
  C:\Windows\System\ZrTPqPS.exe
  2⤵
  PID:8488
- C:\Windows\System\JnYourw.exe
  C:\Windows\System\JnYourw.exe
  2⤵
  PID:6388
- C:\Windows\System\vxjoiAw.exe
  C:\Windows\System\vxjoiAw.exe
  2⤵
  PID:6592
- C:\Windows\System\FPwSzCG.exe
  C:\Windows\System\FPwSzCG.exe
  2⤵
  PID:6720
- C:\Windows\System\WAmpkHn.exe
  C:\Windows\System\WAmpkHn.exe
  2⤵
  PID:6916
- C:\Windows\System\QhMDjzW.exe
  C:\Windows\System\QhMDjzW.exe
  2⤵
  PID:7072
- C:\Windows\System\ESPRXAb.exe
  C:\Windows\System\ESPRXAb.exe
  2⤵
  PID:9412
- C:\Windows\System\jYTVWnK.exe
  C:\Windows\System\jYTVWnK.exe
  2⤵
  PID:6740
- C:\Windows\System\lkCvJva.exe
  C:\Windows\System\lkCvJva.exe
  2⤵
  PID:4100
- C:\Windows\System\GDvJHLG.exe
  C:\Windows\System\GDvJHLG.exe
  2⤵
  PID:7160
- C:\Windows\System\RAlvQcD.exe
  C:\Windows\System\RAlvQcD.exe
  2⤵
  PID:7236
- C:\Windows\System\CsaALAs.exe
  C:\Windows\System\CsaALAs.exe
  2⤵
  PID:7408
- C:\Windows\System\RSksDGZ.exe
  C:\Windows\System\RSksDGZ.exe
  2⤵
  PID:9544
- C:\Windows\System\gbKLBjJ.exe
  C:\Windows\System\gbKLBjJ.exe
  2⤵
  PID:9600
- C:\Windows\System\rGQvRUv.exe
  C:\Windows\System\rGQvRUv.exe
  2⤵
  PID:1884
- C:\Windows\System\ZjmqMui.exe
  C:\Windows\System\ZjmqMui.exe
  2⤵
  PID:2720
- C:\Windows\System\OHBuDNq.exe
  C:\Windows\System\OHBuDNq.exe
  2⤵
  PID:9740
- C:\Windows\System\FXibCXS.exe
  C:\Windows\System\FXibCXS.exe
  2⤵
  PID:7868
- C:\Windows\System\VpwundZ.exe
  C:\Windows\System\VpwundZ.exe
  2⤵
  PID:1128
- C:\Windows\System\VgeJTlT.exe
  C:\Windows\System\VgeJTlT.exe
  2⤵
  PID:13932
- C:\Windows\System\TJNZSHf.exe
  C:\Windows\System\TJNZSHf.exe
  2⤵
  PID:9948
- C:\Windows\System\HIOYpxT.exe
  C:\Windows\System\HIOYpxT.exe
  2⤵
  PID:1380
- C:\Windows\System\YfHKLfS.exe
  C:\Windows\System\YfHKLfS.exe
  2⤵
  PID:10056
- C:\Windows\System\nCOsPoe.exe
  C:\Windows\System\nCOsPoe.exe
  2⤵
  PID:6952
- C:\Windows\System\XrErvkz.exe
  C:\Windows\System\XrErvkz.exe
  2⤵
  PID:10144
- C:\Windows\System\usrgaGT.exe
  C:\Windows\System\usrgaGT.exe
  2⤵
  PID:10208
- C:\Windows\System\cGDnOSf.exe
  C:\Windows\System\cGDnOSf.exe
  2⤵
  PID:5112
- C:\Windows\System\hkGJqtS.exe
  C:\Windows\System\hkGJqtS.exe
  2⤵
  PID:4524
- C:\Windows\System\wkjxqtj.exe
  C:\Windows\System\wkjxqtj.exe
  2⤵
  PID:9440
- C:\Windows\System\IvwuXOD.exe
  C:\Windows\System\IvwuXOD.exe
  2⤵
  PID:5412
- C:\Windows\System\WQkMDqB.exe
  C:\Windows\System\WQkMDqB.exe
  2⤵
  PID:9636
- C:\Windows\System\VpmguTD.exe
  C:\Windows\System\VpmguTD.exe
  2⤵
  PID:9700
- C:\Windows\System\zfutWmN.exe
  C:\Windows\System\zfutWmN.exe
  2⤵
  PID:9912
- C:\Windows\System\bVCbAjr.exe
  C:\Windows\System\bVCbAjr.exe
  2⤵
  PID:9964
- C:\Windows\System\TCKejbe.exe
  C:\Windows\System\TCKejbe.exe
  2⤵
  PID:5500
- C:\Windows\System\tdbZnHC.exe
  C:\Windows\System\tdbZnHC.exe
  2⤵
  PID:10100
- C:\Windows\System\zJKWQIG.exe
  C:\Windows\System\zJKWQIG.exe
  2⤵
  PID:10236
- C:\Windows\System\fSRWkJh.exe
  C:\Windows\System\fSRWkJh.exe
  2⤵
  PID:9468
- C:\Windows\System\MfPdkzY.exe
  C:\Windows\System\MfPdkzY.exe
  2⤵
  PID:9548
- C:\Windows\System\RJyoUUy.exe
  C:\Windows\System\RJyoUUy.exe
  2⤵
  PID:1096
- C:\Windows\System\onxTeaG.exe
  C:\Windows\System\onxTeaG.exe
  2⤵
  PID:14172
- C:\Windows\System\bgJQyKD.exe
  C:\Windows\System\bgJQyKD.exe
  2⤵
  PID:9384
- C:\Windows\System\gLxJRbI.exe
  C:\Windows\System\gLxJRbI.exe
  2⤵
  PID:4356
- C:\Windows\System\efCxfXL.exe
  C:\Windows\System\efCxfXL.exe
  2⤵
  PID:9504
- C:\Windows\System\EBPPzlX.exe
  C:\Windows\System\EBPPzlX.exe
  2⤵
  PID:9748
- C:\Windows\System\haxIVpz.exe
  C:\Windows\System\haxIVpz.exe
  2⤵
  PID:10324
- C:\Windows\System\WfXMPvD.exe
  C:\Windows\System\WfXMPvD.exe
  2⤵
  PID:10352
- C:\Windows\System\NAwsMHM.exe
  C:\Windows\System\NAwsMHM.exe
  2⤵
  PID:4944
- C:\Windows\System\GEMKDwB.exe
  C:\Windows\System\GEMKDwB.exe
  2⤵
  PID:10468
- C:\Windows\System\SBHZkje.exe
  C:\Windows\System\SBHZkje.exe
  2⤵
  PID:5740
- C:\Windows\System\zQfdbSy.exe
  C:\Windows\System\zQfdbSy.exe
  2⤵
  PID:4152
- C:\Windows\System\wYYSijy.exe
  C:\Windows\System\wYYSijy.exe
  2⤵
  PID:2976
- C:\Windows\System\LxwsmnN.exe
  C:\Windows\System\LxwsmnN.exe
  2⤵
  PID:10656
- C:\Windows\System\GQGccGf.exe
  C:\Windows\System\GQGccGf.exe
  2⤵
  PID:4364
- C:\Windows\System\prEUuip.exe
  C:\Windows\System\prEUuip.exe
  2⤵
  PID:4552
- C:\Windows\System\rqjmAYg.exe
  C:\Windows\System\rqjmAYg.exe
  2⤵
  PID:4068
- C:\Windows\System\GlShpfR.exe
  C:\Windows\System\GlShpfR.exe
  2⤵
  PID:10800
- C:\Windows\System\VsfNtfC.exe
  C:\Windows\System\VsfNtfC.exe
  2⤵
  PID:5704
- C:\Windows\System\RHfhHTP.exe
  C:\Windows\System\RHfhHTP.exe
  2⤵
  PID:10880
- C:\Windows\System\XfCXlvU.exe
  C:\Windows\System\XfCXlvU.exe
  2⤵
  PID:10936
- C:\Windows\System\mglYqlv.exe
  C:\Windows\System\mglYqlv.exe
  2⤵
  PID:2788
- C:\Windows\System\bFdhjMy.exe
  C:\Windows\System\bFdhjMy.exe
  2⤵
  PID:11056
- C:\Windows\System\dhMQLtp.exe
  C:\Windows\System\dhMQLtp.exe
  2⤵
  PID:13368
- C:\Windows\System\FoHQSuz.exe
  C:\Windows\System\FoHQSuz.exe
  2⤵
  PID:5792
- C:\Windows\System\CyNRckq.exe
  C:\Windows\System\CyNRckq.exe
  2⤵
  PID:11224
- C:\Windows\System\ooYTzMa.exe
  C:\Windows\System\ooYTzMa.exe
  2⤵
  PID:7620
- C:\Windows\System\MNxSqgH.exe
  C:\Windows\System\MNxSqgH.exe
  2⤵
  PID:13408
- C:\Windows\System\JlshQqd.exe
  C:\Windows\System\JlshQqd.exe
  2⤵
  PID:10472
- C:\Windows\System\ITffObp.exe
  C:\Windows\System\ITffObp.exe
  2⤵
  PID:10560
- C:\Windows\System\nKsUBff.exe
  C:\Windows\System\nKsUBff.exe
  2⤵
  PID:6160
- C:\Windows\System\IzXnXmc.exe
  C:\Windows\System\IzXnXmc.exe
  2⤵
  PID:3616
- C:\Windows\System\FcgdbPf.exe
  C:\Windows\System\FcgdbPf.exe
  2⤵
  PID:11036
- C:\Windows\System\yUrYhUp.exe
  C:\Windows\System\yUrYhUp.exe
  2⤵
  PID:10864
- C:\Windows\System\ikRdBru.exe
  C:\Windows\System\ikRdBru.exe
  2⤵
  PID:11280
- C:\Windows\System\BqvCCyJ.exe
  C:\Windows\System\BqvCCyJ.exe
  2⤵
  PID:11368
- C:\Windows\System\FbluUog.exe
  C:\Windows\System\FbluUog.exe
  2⤵
  PID:11444
- C:\Windows\System\Loiipkk.exe
  C:\Windows\System\Loiipkk.exe
  2⤵
  PID:11564
- C:\Windows\System\sSnsWgz.exe
  C:\Windows\System\sSnsWgz.exe
  2⤵
  PID:11640
- C:\Windows\System\lxYMQzM.exe
  C:\Windows\System\lxYMQzM.exe
  2⤵
  PID:11760
- C:\Windows\System\fBqJbQx.exe
  C:\Windows\System\fBqJbQx.exe
  2⤵
  PID:11836
- C:\Windows\System\WYCVEgN.exe
  C:\Windows\System\WYCVEgN.exe
  2⤵
  PID:11892
- C:\Windows\System\Lnxzwre.exe
  C:\Windows\System\Lnxzwre.exe
  2⤵
  PID:5848
- C:\Windows\System\DAUfsFg.exe
  C:\Windows\System\DAUfsFg.exe
  2⤵
  PID:11256
- C:\Windows\System\kcNndtq.exe
  C:\Windows\System\kcNndtq.exe
  2⤵
  PID:12040
- C:\Windows\System\pgTmLHU.exe
  C:\Windows\System\pgTmLHU.exe
  2⤵
  PID:7364
- C:\Windows\System\gulAcCe.exe
  C:\Windows\System\gulAcCe.exe
  2⤵
  PID:6236
- C:\Windows\System\RJQkSnM.exe
  C:\Windows\System\RJQkSnM.exe
  2⤵
  PID:12152
- C:\Windows\System\OPMYvBQ.exe
  C:\Windows\System\OPMYvBQ.exe
  2⤵
  PID:12200
- C:\Windows\System\HrxsQGc.exe
  C:\Windows\System\HrxsQGc.exe
  2⤵
  PID:12256
- C:\Windows\System\ulJXDSx.exe
  C:\Windows\System\ulJXDSx.exe
  2⤵
  PID:2660
- C:\Windows\System\iosmpVe.exe
  C:\Windows\System\iosmpVe.exe
  2⤵
  PID:6272
- C:\Windows\System\dfLvrlu.exe
  C:\Windows\System\dfLvrlu.exe
  2⤵
  PID:3484
- C:\Windows\System\BxJRCnM.exe
  C:\Windows\System\BxJRCnM.exe
  2⤵
  PID:2252
- C:\Windows\System\YmmwOsr.exe
  C:\Windows\System\YmmwOsr.exe
  2⤵
  PID:3500
- C:\Windows\System\LBnzfgP.exe
  C:\Windows\System\LBnzfgP.exe
  2⤵
  PID:11712
- C:\Windows\System\UveegNm.exe
  C:\Windows\System\UveegNm.exe
  2⤵
  PID:11932
- C:\Windows\System\BHwSGpP.exe
  C:\Windows\System\BHwSGpP.exe
  2⤵
  PID:6352
- C:\Windows\System\OuroyYv.exe
  C:\Windows\System\OuroyYv.exe
  2⤵
  PID:12188
- C:\Windows\System\pTqMVFE.exe
  C:\Windows\System\pTqMVFE.exe
  2⤵
  PID:11204
- C:\Windows\System\MnCtMGl.exe
  C:\Windows\System\MnCtMGl.exe
  2⤵
  PID:11736
- C:\Windows\System\HWKAErg.exe
  C:\Windows\System\HWKAErg.exe
  2⤵
  PID:8364
- C:\Windows\System\ZCVEiFi.exe
  C:\Windows\System\ZCVEiFi.exe
  2⤵
  PID:6836
- C:\Windows\System\cgnVBun.exe
  C:\Windows\System\cgnVBun.exe
  2⤵
  PID:11656
- C:\Windows\System\fBYKasN.exe
  C:\Windows\System\fBYKasN.exe
  2⤵
  PID:12296
- C:\Windows\System\MpuSmEe.exe
  C:\Windows\System\MpuSmEe.exe
  2⤵
  PID:12388
- C:\Windows\System\QaCgDZf.exe
  C:\Windows\System\QaCgDZf.exe
  2⤵
  PID:12436
- C:\Windows\System\XovuSJS.exe
  C:\Windows\System\XovuSJS.exe
  2⤵
  PID:13680
- C:\Windows\System\KvObKli.exe
  C:\Windows\System\KvObKli.exe
  2⤵
  PID:12584
- C:\Windows\System\VWSYaAw.exe
  C:\Windows\System\VWSYaAw.exe
  2⤵
  PID:12640
- C:\Windows\System\ylYcMgc.exe
  C:\Windows\System\ylYcMgc.exe
  2⤵
  PID:3212
- C:\Windows\System\yvapJRA.exe
  C:\Windows\System\yvapJRA.exe
  2⤵
  PID:12752
- C:\Windows\System\zziTOvz.exe
  C:\Windows\System\zziTOvz.exe
  2⤵
  PID:8848
- C:\Windows\System\khLbaFB.exe
  C:\Windows\System\khLbaFB.exe
  2⤵
  PID:8904
- C:\Windows\System\oRbJnMo.exe
  C:\Windows\System\oRbJnMo.exe
  2⤵
  PID:12948
- C:\Windows\System\SZglaog.exe
  C:\Windows\System\SZglaog.exe
  2⤵
  PID:13004
- C:\Windows\System\Vqnukju.exe
  C:\Windows\System\Vqnukju.exe
  2⤵
  PID:13052
- C:\Windows\System\PWoSZPC.exe
  C:\Windows\System\PWoSZPC.exe
  2⤵
  PID:13716
- C:\Windows\System\OJJKPXe.exe
  C:\Windows\System\OJJKPXe.exe
  2⤵
  PID:9164
- C:\Windows\System\KBCJbyf.exe
  C:\Windows\System\KBCJbyf.exe
  2⤵
  PID:9196
- C:\Windows\System\GzGlFCX.exe
  C:\Windows\System\GzGlFCX.exe
  2⤵
  PID:8256
- C:\Windows\System\dcFzCtK.exe
  C:\Windows\System\dcFzCtK.exe
  2⤵
  PID:12564
- C:\Windows\System\ripcgjk.exe
  C:\Windows\System\ripcgjk.exe
  2⤵
  PID:4936
- C:\Windows\System\GgUBpxM.exe
  C:\Windows\System\GgUBpxM.exe
  2⤵
  PID:12860
- C:\Windows\System\gCgEABn.exe
  C:\Windows\System\gCgEABn.exe
  2⤵
  PID:12972
- C:\Windows\System\SMzemkF.exe
  C:\Windows\System\SMzemkF.exe
  2⤵
  PID:13092
- C:\Windows\System\UKoyIQk.exe
  C:\Windows\System\UKoyIQk.exe
  2⤵
  PID:13232
- C:\Windows\System\wbpfyOv.exe
  C:\Windows\System\wbpfyOv.exe
  2⤵
  PID:12412
- C:\Windows\System\ykBaPrp.exe
  C:\Windows\System\ykBaPrp.exe
  2⤵
  PID:8840
- C:\Windows\System\VrJxvdL.exe
  C:\Windows\System\VrJxvdL.exe
  2⤵
  PID:13828
- C:\Windows\System\beVqufc.exe
  C:\Windows\System\beVqufc.exe
  2⤵
  PID:8992
- C:\Windows\System\avfnXUQ.exe
  C:\Windows\System\avfnXUQ.exe
  2⤵
  PID:9140
- C:\Windows\System\PWQmxJk.exe
  C:\Windows\System\PWQmxJk.exe
  2⤵
  PID:6648
- C:\Windows\System\rONaqZr.exe
  C:\Windows\System\rONaqZr.exe
  2⤵
  PID:13908
- C:\Windows\System\shMvLyu.exe
  C:\Windows\System\shMvLyu.exe
  2⤵
  PID:2760
- C:\Windows\System\scYTtmV.exe
  C:\Windows\System\scYTtmV.exe
  2⤵
  PID:9060
- C:\Windows\System\TzOZqMA.exe
  C:\Windows\System\TzOZqMA.exe
  2⤵
  PID:708
- C:\Windows\System\ltcAFNZ.exe
  C:\Windows\System\ltcAFNZ.exe
  2⤵
  PID:7140
- C:\Windows\System\JIptKpV.exe
  C:\Windows\System\JIptKpV.exe
  2⤵
  PID:9240
- C:\Windows\System\DNkgfzU.exe
  C:\Windows\System\DNkgfzU.exe
  2⤵
  PID:9308
- C:\Windows\System\pIqkVsh.exe
  C:\Windows\System\pIqkVsh.exe
  2⤵
  PID:7152
- C:\Windows\System\cVSAVxa.exe
  C:\Windows\System\cVSAVxa.exe
  2⤵
  PID:9472
- C:\Windows\System\eKMULsm.exe
  C:\Windows\System\eKMULsm.exe
  2⤵
  PID:6208
- C:\Windows\System\AXdaRUM.exe
  C:\Windows\System\AXdaRUM.exe
  2⤵
  PID:1092
- C:\Windows\System\HurJkXE.exe
  C:\Windows\System\HurJkXE.exe
  2⤵
  PID:7684
- C:\Windows\System\MjqRhzY.exe
  C:\Windows\System\MjqRhzY.exe
  2⤵
  PID:9744
- C:\Windows\System\VnGNcdl.exe
  C:\Windows\System\VnGNcdl.exe
  2⤵
  PID:4288
- C:\Windows\System\LefngIZ.exe
  C:\Windows\System\LefngIZ.exe
  2⤵
  PID:9992
- C:\Windows\System\IRmQcpH.exe
  C:\Windows\System\IRmQcpH.exe
  2⤵
  PID:2464
- C:\Windows\System\QPFYhyh.exe
  C:\Windows\System\QPFYhyh.exe
  2⤵
  PID:14024
- C:\Windows\System\gdcTIeN.exe
  C:\Windows\System\gdcTIeN.exe
  2⤵
  PID:9360
- C:\Windows\System\CnaQkMw.exe
  C:\Windows\System\CnaQkMw.exe
  2⤵
  PID:9520
- C:\Windows\System\WnMBefN.exe
  C:\Windows\System\WnMBefN.exe
  2⤵
  PID:9772
- C:\Windows\System\kIEshAJ.exe
  C:\Windows\System\kIEshAJ.exe
  2⤵
  PID:3836
- C:\Windows\System\BZVSNxP.exe
  C:\Windows\System\BZVSNxP.exe
  2⤵
  PID:768
- C:\Windows\System\uILUPHX.exe
  C:\Windows\System\uILUPHX.exe
  2⤵
  PID:9716
- C:\Windows\System\PPKywMw.exe
  C:\Windows\System\PPKywMw.exe
  2⤵
  PID:4476
- C:\Windows\System\JVodsHY.exe
  C:\Windows\System\JVodsHY.exe
  2⤵
  PID:14208
- C:\Windows\System\JMyhdPR.exe
  C:\Windows\System\JMyhdPR.exe
  2⤵
  PID:7572
- C:\Windows\System\ThOGJDw.exe
  C:\Windows\System\ThOGJDw.exe
  2⤵
  PID:552
- C:\Windows\System\fIbBjdn.exe
  C:\Windows\System\fIbBjdn.exe
  2⤵
  PID:7680
- C:\Windows\System\RhGmLMf.exe
  C:\Windows\System\RhGmLMf.exe
  2⤵
  PID:10636
- C:\Windows\System\BbRRqwd.exe
  C:\Windows\System\BbRRqwd.exe
  2⤵
  PID:5680
- C:\Windows\System\MqFoAuX.exe
  C:\Windows\System\MqFoAuX.exe
  2⤵
  PID:5748
- C:\Windows\System\GuhDpVJ.exe
  C:\Windows\System\GuhDpVJ.exe
  2⤵
  PID:4568
- C:\Windows\System\rjazXoh.exe
  C:\Windows\System\rjazXoh.exe
  2⤵
  PID:1576
- C:\Windows\System\Rsplxol.exe
  C:\Windows\System\Rsplxol.exe
  2⤵
  PID:14316
- C:\Windows\System\EttrIax.exe
  C:\Windows\System\EttrIax.exe
  2⤵
  PID:11028
- C:\Windows\System\pMGNfKQ.exe
  C:\Windows\System\pMGNfKQ.exe
  2⤵
  PID:11132
- C:\Windows\System\SZKbekf.exe
  C:\Windows\System\SZKbekf.exe
  2⤵
  PID:7856
- C:\Windows\System\xxAkqtt.exe
  C:\Windows\System\xxAkqtt.exe
  2⤵
  PID:13440
- C:\Windows\System\UOgRAaC.exe
  C:\Windows\System\UOgRAaC.exe
  2⤵
  PID:10644
- C:\Windows\System\jVRERHF.exe
  C:\Windows\System\jVRERHF.exe
  2⤵
  PID:11008
- C:\Windows\System\fPmcHuQ.exe
  C:\Windows\System\fPmcHuQ.exe
  2⤵
  PID:11032
- C:\Windows\System\ROLzKaR.exe
  C:\Windows\System\ROLzKaR.exe
  2⤵
  PID:11528
- C:\Windows\System\nXZgRxM.exe
  C:\Windows\System\nXZgRxM.exe
  2⤵
  PID:11188
- C:\Windows\System\YqGvSJa.exe
  C:\Windows\System\YqGvSJa.exe
  2⤵
  PID:3824
- C:\Windows\System\rsxbBej.exe
  C:\Windows\System\rsxbBej.exe
  2⤵
  PID:11976
- C:\Windows\System\upIgYXA.exe
  C:\Windows\System\upIgYXA.exe
  2⤵
  PID:12088
- C:\Windows\System\LDBcACY.exe
  C:\Windows\System\LDBcACY.exe
  2⤵
  PID:12232
- C:\Windows\System\VCwMPbc.exe
  C:\Windows\System\VCwMPbc.exe
  2⤵
  PID:3408
- C:\Windows\System\DTakmod.exe
  C:\Windows\System\DTakmod.exe
  2⤵
  PID:7908
- C:\Windows\System\NDzyTDv.exe
  C:\Windows\System\NDzyTDv.exe
  2⤵
  PID:11796
- C:\Windows\System\oTITxAd.exe
  C:\Windows\System\oTITxAd.exe
  2⤵
  PID:12128
- C:\Windows\System\SrKkxhh.exe
  C:\Windows\System\SrKkxhh.exe
  2⤵
  PID:11600
- C:\Windows\System\dcEXErV.exe
  C:\Windows\System\dcEXErV.exe
  2⤵
  PID:11516
- C:\Windows\System\gAXAmYd.exe
  C:\Windows\System\gAXAmYd.exe
  2⤵
  PID:12324
- C:\Windows\System\qOXMvTZ.exe
  C:\Windows\System\qOXMvTZ.exe
  2⤵
  PID:12464
- C:\Windows\System\frtzTuv.exe
  C:\Windows\System\frtzTuv.exe
  2⤵
  PID:8716
- C:\Windows\System\SwnRJlr.exe
  C:\Windows\System\SwnRJlr.exe
  2⤵
  PID:8800
- C:\Windows\System\LoqKwkQ.exe
  C:\Windows\System\LoqKwkQ.exe
  2⤵
  PID:12916
- C:\Windows\System\GRDPrEP.exe
  C:\Windows\System\GRDPrEP.exe
  2⤵
  PID:6484
- C:\Windows\System\XTNilVD.exe
  C:\Windows\System\XTNilVD.exe
  2⤵
  PID:5132
- C:\Windows\System\OmpEeqR.exe
  C:\Windows\System\OmpEeqR.exe
  2⤵
  PID:12452
- C:\Windows\System\amvizTc.exe
  C:\Windows\System\amvizTc.exe
  2⤵
  PID:12780
- C:\Windows\System\DTHfMvF.exe
  C:\Windows\System\DTHfMvF.exe
  2⤵
  PID:13012
- C:\Windows\System\DgqhTbM.exe
  C:\Windows\System\DgqhTbM.exe
  2⤵
  PID:12308
- C:\Windows\System\xxhtwpX.exe
  C:\Windows\System\xxhtwpX.exe
  2⤵
  PID:3828
- C:\Windows\System\siXhelh.exe
  C:\Windows\System\siXhelh.exe
  2⤵
  PID:1720
- C:\Windows\System\xFWCFbg.exe
  C:\Windows\System\xFWCFbg.exe
  2⤵
  PID:6588
- C:\Windows\System\iapmUDU.exe
  C:\Windows\System\iapmUDU.exe
  2⤵
  PID:8752
- C:\Windows\System\ifXndWj.exe
  C:\Windows\System\ifXndWj.exe
  2⤵
  PID:5640
- C:\Windows\System\BMJqsdr.exe
  C:\Windows\System\BMJqsdr.exe
  2⤵
  PID:6368
- C:\Windows\System\XuhlFUF.exe
  C:\Windows\System\XuhlFUF.exe
  2⤵
  PID:9340
- C:\Windows\System\kmvnGHb.exe
  C:\Windows\System\kmvnGHb.exe
  2⤵
  PID:6240
- C:\Windows\System\CmHDkjv.exe
  C:\Windows\System\CmHDkjv.exe
  2⤵
  PID:9660
- C:\Windows\System\XXorrVG.exe
  C:\Windows\System\XXorrVG.exe
  2⤵
  PID:9960
- C:\Windows\System\CEDBpPz.exe
  C:\Windows\System\CEDBpPz.exe
  2⤵
  PID:10172
- C:\Windows\System\KXxpQge.exe
  C:\Windows\System\KXxpQge.exe
  2⤵
  PID:8008
- C:\Windows\System\xbmtKNE.exe
  C:\Windows\System\xbmtKNE.exe
  2⤵
  PID:4984
- C:\Windows\System\bHbjfFf.exe
  C:\Windows\System\bHbjfFf.exe
  2⤵
  PID:4776
- C:\Windows\System\ptStxIL.exe
  C:\Windows\System\ptStxIL.exe
  2⤵
  PID:10184
- C:\Windows\System\nDzfixp.exe
  C:\Windows\System\nDzfixp.exe
  2⤵
  PID:12300
- C:\Windows\System\CmdOpaw.exe
  C:\Windows\System\CmdOpaw.exe
  2⤵
  PID:13176
- C:\Windows\System\aquxzGu.exe
  C:\Windows\System\aquxzGu.exe
  2⤵
  PID:14284
- C:\Windows\System\TpNsrSb.exe
  C:\Windows\System\TpNsrSb.exe
  2⤵
  PID:6048
- C:\Windows\System\BbYGOwM.exe
  C:\Windows\System\BbYGOwM.exe
  2⤵
  PID:14296
- C:\Windows\System\sTaWWWo.exe
  C:\Windows\System\sTaWWWo.exe
  2⤵
  PID:13656
- C:\Windows\System\xleGSJc.exe
  C:\Windows\System\xleGSJc.exe
  2⤵
  PID:11084
- C:\Windows\System\JKfsSFZ.exe
  C:\Windows\System\JKfsSFZ.exe
  2⤵
  PID:8040
- C:\Windows\System\bZNdJga.exe
  C:\Windows\System\bZNdJga.exe
  2⤵
  PID:7524
- C:\Windows\System\WJoaIZj.exe
  C:\Windows\System\WJoaIZj.exe
  2⤵
  PID:11532
- C:\Windows\System\JDuErVj.exe
  C:\Windows\System\JDuErVj.exe
  2⤵
  PID:5864
- C:\Windows\System\YYzSdUc.exe
  C:\Windows\System\YYzSdUc.exe
  2⤵
  PID:12176
- C:\Windows\System\fomkxeM.exe
  C:\Windows\System\fomkxeM.exe
  2⤵
  PID:4780
- C:\Windows\System\HFsksun.exe
  C:\Windows\System\HFsksun.exe
  2⤵
  PID:13628
- C:\Windows\System\hInsEQL.exe
  C:\Windows\System\hInsEQL.exe
  2⤵
  PID:11988
- C:\Windows\System\CmHfnHT.exe
  C:\Windows\System\CmHfnHT.exe
  2⤵
  PID:11332
- C:\Windows\System\lbHYCwC.exe
  C:\Windows\System\lbHYCwC.exe
  2⤵
  PID:12884
- C:\Windows\System\wQoHgHd.exe
  C:\Windows\System\wQoHgHd.exe
  2⤵
  PID:5176
- C:\Windows\System\ILLgLjO.exe
  C:\Windows\System\ILLgLjO.exe
  2⤵
  PID:8528
- C:\Windows\System\NZLJlIu.exe
  C:\Windows\System\NZLJlIu.exe
  2⤵
  PID:8896
- C:\Windows\System\wDWspiB.exe
  C:\Windows\System\wDWspiB.exe
  2⤵
  PID:13888
- C:\Windows\System\WbRHqBJ.exe
  C:\Windows\System\WbRHqBJ.exe
  2⤵
  PID:8720
- C:\Windows\System\PWbpTca.exe
  C:\Windows\System\PWbpTca.exe
  2⤵
  PID:4636
- C:\Windows\System\TGDrljs.exe
  C:\Windows\System\TGDrljs.exe
  2⤵
  PID:1636
- C:\Windows\System\HgEXgoS.exe
  C:\Windows\System\HgEXgoS.exe
  2⤵
  PID:14068
- C:\Windows\System\EcPujZy.exe
  C:\Windows\System\EcPujZy.exe
  2⤵
  PID:2544
- C:\Windows\System\vMMlFco.exe
  C:\Windows\System\vMMlFco.exe
  2⤵
  PID:4104
- C:\Windows\System\DzyPQzC.exe
  C:\Windows\System\DzyPQzC.exe
  2⤵
  PID:8084
- C:\Windows\System\NdqwJYH.exe
  C:\Windows\System\NdqwJYH.exe
  2⤵
  PID:5576
- C:\Windows\System\tpmOcKu.exe
  C:\Windows\System\tpmOcKu.exe
  2⤵
  PID:6044
- C:\Windows\System\xJKBcvU.exe
  C:\Windows\System\xJKBcvU.exe
  2⤵
  PID:884
- C:\Windows\System\avxuDTE.exe
  C:\Windows\System\avxuDTE.exe
  2⤵
  PID:9876
- C:\Windows\System\eLxJJXW.exe
  C:\Windows\System\eLxJJXW.exe
  2⤵
  PID:11816
- C:\Windows\System\cncKmbo.exe
  C:\Windows\System\cncKmbo.exe
  2⤵
  PID:2808
- C:\Windows\System\OTAFavM.exe
  C:\Windows\System\OTAFavM.exe
  2⤵
  PID:10812
- C:\Windows\System\NsAdeji.exe
  C:\Windows\System\NsAdeji.exe
  2⤵
  PID:9096
- C:\Windows\System\ZTjTvyy.exe
  C:\Windows\System\ZTjTvyy.exe
  2⤵
  PID:12364
- C:\Windows\System\ISGHFNk.exe
  C:\Windows\System\ISGHFNk.exe
  2⤵
  PID:8884
- C:\Windows\System\eCKEajG.exe
  C:\Windows\System\eCKEajG.exe
  2⤵
  PID:10152
- C:\Windows\System\ELKyOVX.exe
  C:\Windows\System\ELKyOVX.exe
  2⤵
  PID:1620
- C:\Windows\System\YOBpiEV.exe
  C:\Windows\System\YOBpiEV.exe
  2⤵
  PID:14224
- C:\Windows\System\jHvBSrf.exe
  C:\Windows\System\jHvBSrf.exe
  2⤵
  PID:13032
- C:\Windows\System\ccjQdkh.exe
  C:\Windows\System\ccjQdkh.exe
  2⤵
  PID:13468
- C:\Windows\System\paKnSof.exe
  C:\Windows\System\paKnSof.exe
  2⤵
  PID:12660
- C:\Windows\System\ZJCZSab.exe
  C:\Windows\System\ZJCZSab.exe
  2⤵
  PID:4512
- C:\Windows\System\VaLxBSQ.exe
  C:\Windows\System\VaLxBSQ.exe
  2⤵
  PID:7544
- C:\Windows\System\hvyqRAz.exe
  C:\Windows\System\hvyqRAz.exe
  2⤵
  PID:4176
- C:\Windows\System\tQflVGU.exe
  C:\Windows\System\tQflVGU.exe
  2⤵
  PID:4456
- C:\Windows\System\mIDsAWu.exe
  C:\Windows\System\mIDsAWu.exe
  2⤵
  PID:12592
- C:\Windows\System\DnlRoyb.exe
  C:\Windows\System\DnlRoyb.exe
  2⤵
  PID:12020
- C:\Windows\System\BgxehQO.exe
  C:\Windows\System\BgxehQO.exe
  2⤵
  PID:14360
- C:\Windows\System\phpXzOb.exe
  C:\Windows\System\phpXzOb.exe
  2⤵
  PID:14388
- C:\Windows\System\MthAfXH.exe
  C:\Windows\System\MthAfXH.exe
  2⤵
  PID:14416
- C:\Windows\System\dfWcWax.exe
  C:\Windows\System\dfWcWax.exe
  2⤵
  PID:14444
- C:\Windows\System\QgLHEKU.exe
  C:\Windows\System\QgLHEKU.exe
  2⤵
  PID:14476
- C:\Windows\System\txsQqNr.exe
  C:\Windows\System\txsQqNr.exe
  2⤵
  PID:14504
- C:\Windows\System\FuDOXmD.exe
  C:\Windows\System\FuDOXmD.exe
  2⤵
  PID:14532
- C:\Windows\System\XSZfwTI.exe
  C:\Windows\System\XSZfwTI.exe
  2⤵
  PID:14560
- C:\Windows\System\NuLQsET.exe
  C:\Windows\System\NuLQsET.exe
  2⤵
  PID:14588
- C:\Windows\System\NyOYjYB.exe
  C:\Windows\System\NyOYjYB.exe
  2⤵
  PID:14616
- C:\Windows\System\BDYTBek.exe
  C:\Windows\System\BDYTBek.exe
  2⤵
  PID:14644
- C:\Windows\System\TYIzzLC.exe
  C:\Windows\System\TYIzzLC.exe
  2⤵
  PID:14672
- C:\Windows\System\meiCfaA.exe
  C:\Windows\System\meiCfaA.exe
  2⤵
  PID:14700
- C:\Windows\System\WZHWWOW.exe
  C:\Windows\System\WZHWWOW.exe
  2⤵
  PID:14728
- C:\Windows\System\wjUZMoU.exe
  C:\Windows\System\wjUZMoU.exe
  2⤵
  PID:14756
- C:\Windows\System\AEuJAYi.exe
  C:\Windows\System\AEuJAYi.exe
  2⤵
  PID:14784
- C:\Windows\System\XOsRMlH.exe
  C:\Windows\System\XOsRMlH.exe
  2⤵
  PID:15204
- C:\Windows\System\LAjGztg.exe
  C:\Windows\System\LAjGztg.exe
  2⤵
  PID:14432
- C:\Windows\System\NLkTbLf.exe
  C:\Windows\System\NLkTbLf.exe
  2⤵
  PID:15172
- C:\Windows\System\qWseznK.exe
  C:\Windows\System\qWseznK.exe
  2⤵
  PID:14860
- C:\Windows\System\wSVZKQJ.exe
  C:\Windows\System\wSVZKQJ.exe
  2⤵
  PID:13972
- C:\Windows\System\LNOELhy.exe
  C:\Windows\System\LNOELhy.exe
  2⤵
  PID:14904
- C:\Windows\System\hPpUBCg.exe
  C:\Windows\System\hPpUBCg.exe
  2⤵
  PID:14932
- C:\Windows\System\epwvtlu.exe
  C:\Windows\System\epwvtlu.exe
  2⤵
  PID:14952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mwmt2gpf.3oe.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BVhUhTR.exe

Filesize
3.2MB

MD5
46d9d24a188030199f5742d4f3844cd1

SHA1
db28c5bae51bc9603e887fe7696c9b394cad5d84

SHA256
545717030d950b716332a0dc7b951ac268ecf0a671d590d46be2b96582d9fd40

SHA512
d1d4cedd90e266ff29251e84c19399de73c47a28cb26c642d7557df7eca15f51015c98bf25f9a71ddb458e9bb1fb83b7fae0003275a4d840bfcf7005b6451fa7

Download Submit
C:\Windows\System\CFAitcG.exe

Filesize
3.2MB

MD5
68ed7d95b2cf2ad1bd38dbd4a1b294a5

SHA1
ff2908092fd44373cd2176f5824e4ce069751939

SHA256
b7afcbcb8db454fafc7242e00d378a2e484316820a9ec81f970bffb9e8b8674b

SHA512
d77c3acf2b8543438204ffe9e898d3ab9f9680091c2d1151ca01225751767b30d23310049ecacb780023f308dfc80ebcf84833b10936a7d8a5eb8a00d514eeaa

Download Submit
C:\Windows\System\CGleXzI.exe

Filesize
8B

MD5
0a09bd2e5542320a20ec8eafd2246c28

SHA1
7106c9c7587e96586e92363c5ef70ad925a395b7

SHA256
a2d90ea83d8a1ec8d2d933492892f6a19aa1f0a0628b1cc62b162e5271ee863b

SHA512
994b306b70fd71b0a462a50b9fc03457eac19be8a156ca56f4b5a47c058947eb0f9ce4c706b5ff16df4ad9b5c6da35585e95b3f5ce9ff8ead75dc92e4757e9c1

Download Submit
C:\Windows\System\DWfOjar.exe

Filesize
3.2MB

MD5
ac535b9cfc47b86dad8c6be0c4e5ba49

SHA1
cfec2bef4dfddb214c61167feb15d1e428105f32

SHA256
67dd4e999549accf700113678f91c3b6d743960e893a2caebcda45fd923ccd0e

SHA512
732396beded6d02183615eff07243d1add056c8a70ff088353cc8814c21d99dcf295f4b355ab928b1ad7903e56958db04759f0cba0ee31dbd308778e6edacc55

Download Submit
C:\Windows\System\EPdIKxO.exe

Filesize
3.2MB

MD5
c2839894e8a4a34d68a65ead5517436c

SHA1
02d89f1e7ed3431da781e07a821759f506ec72db

SHA256
b6bdc4402d5de77dbf58f64eaaa322d1f312a9178262d636c255fa337539edfe

SHA512
f76a33fbefdde1ad4e7216804fa4cd02fad736f6d0693cf540be307fe739da0e463f9289b797b0ede88adf0eed4de70c2aaac49d1bcebe392d6e7c3af72848b9

Download Submit
C:\Windows\System\FRlBqMo.exe

Filesize
3.2MB

MD5
bf094279c24b66693541a3ac8ee0eea1

SHA1
8332241f726dab790b5ed30d3180a2e0a34f55f3

SHA256
9c5dde00bbad7a1e9563fcded8bd1ccf09f0871b46371626fdb82b4636cfde26

SHA512
64024ed733ee8d248e717f90748cb8314b17c8a5713f182c6dc7302dae9484b185e3d770f13d60a62ed9abf7f2db321e4a11802dd592d5b1aad0b93ca18afe9e

Download Submit
C:\Windows\System\GCYoHYN.exe

Filesize
3.2MB

MD5
9d4a80e2f17201415a518b7063d81c3a

SHA1
69408978e24e2d0ffa92cc574e12de6d7f739ec6

SHA256
a2d708f902c448c1b6481a807d50ed4d0b3bcc70e2f2a215d9181d83d3653fcb

SHA512
75b7b43862ef4595dcff8984efdab4aa35ebc63e8a729c7715c86ed5fb1c8f5e5b7868df25027c597934bd86d98c7d2c73add839e90542901d00dbbfe794d552

Download Submit
C:\Windows\System\GMCFNnt.exe

Filesize
3.2MB

MD5
084d288930a3fcebafed3ff4a0f62323

SHA1
6ba8eb708981a4896cd3b39e6b7b424080b4ace1

SHA256
c64c3b298dd3314cb1c3f7a1604ad375db97c6ea378f781dd19aae02557d0844

SHA512
f60ebdc185e18fe93f9ed781e40544f3a8f22c0893f23700d9dddcb48bd8726ef97d8a3c5e5d017a26e46c74eda9cd10e5ee564ec380bf23ac1df5e661c9199e

Download Submit
C:\Windows\System\MPcGLdP.exe

Filesize
2.7MB

MD5
32d966551464fe86cbc8a4d9fe03e3d3

SHA1
6a078fd84eaebf6195f2e20888515f92d2cdd3b4

SHA256
0ebc2c7a651de35fcb24cfe3e8fc84ce98c22ed3585b95b8f1afa0acc28bccd1

SHA512
35aa7ebadc79013f8f47780e1a4329b39c5b631f756aa9f80ad41b3f4ca12db7f5a82b8168915f163068bc11c272748ecee478ad5e4563b9fc7f7ffa2dede74e

Download Submit
C:\Windows\System\PkyRYRW.exe

Filesize
2.6MB

MD5
ac30d994baa26dae4108a752205533bc

SHA1
011257256155ae5efb356972e1ce19f03230d68d

SHA256
af3eceba68801ec9d3ca5b396aac2e140f818eba2ce67c0dc135d3daed3d99de

SHA512
5b5e7d3984c1bdfde4f33fefcbdf71887566233c92ac883c7294f1789d961e1d258da3b826551f13505f8a3d26957efbf37a182aef30a2d0d7b4847bfb30c59e

Download Submit
C:\Windows\System\QSRHJvm.exe

Filesize
3.2MB

MD5
67991e668407c218c0cee7036431a576

SHA1
a38c6dc8490d27675190125ff60d4f48bf1768d3

SHA256
ef19e7c34e49ae228cc77cadba89b2f1f7be688534f51c72ddd881ee6efe51fb

SHA512
9220096e06f377ede5ccd5c810a626deef5e24d24bdef9ccf3f1608c3257dcd4100f19af5e48eb7a98d410ea2d5182af1beaf1fe465e9f28e0a151677a1eccdf

Download Submit
C:\Windows\System\QbEybBk.exe

Filesize
3.2MB

MD5
3833127e6ac32a22fcb2c62b54ae09fc

SHA1
3ff35121c265562ea6f12d59b10ecc6a66c1abfc

SHA256
6563078f2942a5a9add6f44cc068533876ec07569d281daf8d59b756e4893641

SHA512
457761b9186ce58f73f75892387bf9cd162dc7fd398a67ce00c49fb6d63db10024d9705e52f5ca45218572167155a4dcb895db4fac76df09bc990be32f18ea1e

Download Submit
C:\Windows\System\UWCRsnw.exe

Filesize
3.2MB

MD5
7f83b852b75469d9f509d5ccb0acc0b4

SHA1
37af262d56e7a3b7f9ef4393d62f1949efc12df4

SHA256
cc3de2ed3368ba5e758c140f76c2e26699b51ac41e0353133c72c4fa63c2e13a

SHA512
a391147d29d9eebc8cc1061508ef74b5042f9924874304caa438a76ac8623a99c56bf4966740c290b068011b9afd8d8fcbbfa7099560f96599e91f2c35609578

Download Submit
C:\Windows\System\XqBeRzW.exe

Filesize
3.2MB

MD5
bd90ea7e48b0a8d69af02c2e4309f888

SHA1
4632fae1a80415714ddc042222aa2e3063f6181d

SHA256
f9f40cf5942801208b7f4c8b96a14543634ee9785da7aec10f6e167c0b449b70

SHA512
47cca8cea6489a81b60bea0afd7649fe133da3151cc8f997c53304a2577cf97f622aba35fcd76b1663cca1436422228f01cb76adac6f21cad474375f1af7f14e

Download Submit
C:\Windows\System\YEMMnSY.exe

Filesize
3.2MB

MD5
91554bb16faf058437e0da03f45cbc59

SHA1
7588eda2344132eaea34e09a08fba43570bfd2b8

SHA256
5857eb0f9e596b84977fdc8443b6933edcfc9f0bc0f6620b0e197baa236f6f38

SHA512
d53456dda577943a0d25eff80b9790be59a74d43fd17fe1b9c18aac8c0f309dee1ebed10a04ee1e937e4863631b1af493c6c142b79cfa238f68482fbe6cb3978

Download Submit
C:\Windows\System\YgBfThs.exe

Filesize
3.2MB

MD5
448ead7696e28032f1cf9d0886590577

SHA1
2c0dc01b17fe73baddaa2a62b8eb61b2db37de7d

SHA256
5a46204dc20b34f06f90400d820d9f59a8f9d78822b840af27d37f6088987d28

SHA512
6a23dbab8b247f06693c15fe0f3ea9fd217ba4563901bd07315b6d5b436e718ef3e74f07b859f3ea47a739a72a477f89ec59757499efd7ef5b1ebdc051cfe532

Download Submit
C:\Windows\System\ZNCoGBu.exe

Filesize
3.2MB

MD5
fd98b080a04043e5d6b8ecdf5bee4261

SHA1
a7d7a680921dfa9813c20c4e77df1fc9f890aa4e

SHA256
d9b559728b6fa04b1ac6333b97b15b674f21fd8d1c6b6c906b0b3255a44d4f5f

SHA512
70f0b47ea089fe8e139eae82f312c9af17af4d3b7aa33493547f3f61c1ecb5cfffc5845af17afed5fe7d0193119d8512e4fa01bc7dc8853c65c148388aeaa79c

Download Submit
C:\Windows\System\bPewzNm.exe

Filesize
3.2MB

MD5
a89647f4e6f882b9cdc37d3093ca5df4

SHA1
071e6a2fdcab223bb5d0b116222949750655b2e3

SHA256
0bba71f89187355e1016802fb4c5509a06211d99becf7ea360b04f54a16fadad

SHA512
43c7c2311156bbdf0a1d440125d074edf36c1c9747501ca35704066584a25be767ea9ca7e3ba2a6a1954e13575d578576c5553ee04f489cddde28eafed4ba4f9

Download Submit
C:\Windows\System\eHEbSus.exe

Filesize
3.2MB

MD5
05f9032cdc230c77a14868ab9fb84faf

SHA1
32cd78b6e6debe3c462e3d1131d58316c99f5b6c

SHA256
bbd7169b87fe6a0f26ea70f03d446ec058a7f281e86e1aefb0ebb33984243a7f

SHA512
fd5c1017d2d6b4a2b0d6f3ef8b912fdf8cbdff2dc63af2fef5d60a52c8587e23874ef8b4d4c4108a5c8e2a7b4b022adc5c3e6bdd278c1f9e1044ec8a864ca043

Download Submit
C:\Windows\System\ewSSzba.exe

Filesize
3.2MB

MD5
c642eeba784dc4facbf4f07b4526d054

SHA1
5cf585da13caad54faf7ddd36ab2215607ce2742

SHA256
4f4e48aeaf4ceee68c79c2596cdb8fad21b8bb94a1466a5d96b66c50d0edc2b3

SHA512
274dbe77a7e31a355ace2111d7eddd8c10b4132696d83dde65b5b4c97df95ef2c5e9a30060123a611f7dd21add4dd67caa1f3d398b4359ea08eef3d1983f5453

Download Submit
C:\Windows\System\fqJHSlM.exe

Filesize
3.2MB

MD5
e9d50292316e9ee93c17d0234f992e80

SHA1
e6619339502a9a064da0be00284d8d2f47599594

SHA256
722714cfbdb40f543c6aa68fd9b96283295c79aafc97f0f76cf87cefffcf2534

SHA512
02ec528eac57bef65ea22594e349bb3d31ada3834bda1aed07aced035cfc5c34108a12429fe4618580313b9bd0f818370b0146e6012f4c40da84453b4410ee07

Download Submit
C:\Windows\System\hhdEqGM.exe

Filesize
3.2MB

MD5
a1882d589b7bc323002c0bd04d059e63

SHA1
8c1659117513d78644db36985a78f9bf59b8b8ce

SHA256
3d91bd172d6acd7451f38bbfba9abf88366ed59a782c443e323812d748f1a3cf

SHA512
9d8e53959d8c9a02dcbcfa435d3f719312ea38cc671d5151193bdfc26d1c8544af89c66a179f62056511670166a52db6f278b04c86178f550f6af61bde6fd1b1

Download Submit
C:\Windows\System\hhdEqGM.exe

Filesize
2.4MB

MD5
d3178b5bc49a5f2ddbbdd75281431988

SHA1
5846fc6a5391144e8d978bd8bf3c7ca78bc3eddb

SHA256
b8e6b7c9510e7cb01f731e9518611d569597c1278b16a6cae5fd48a980c7072b

SHA512
9bb5e3716fbb7d24842404a216a03acfbb92f46d909c64f4e609e4b759524e8611c7551b58bd871bc6559d75f8443796123e4cd1973c36edb58c60a644c3708c

Download Submit
C:\Windows\System\mxoOhAt.exe

Filesize
3.2MB

MD5
d4dfde44042dcb613b80fbf39a614ec1

SHA1
d0b86e001e804e370bfa7cd21a09a3b30a162e3a

SHA256
5446a362cfc1234f3d582baa7b8b986ed831ae82b8099d096951a05d267905cd

SHA512
f2907a2f5182f399005ad4c39c3d9d10ee38c6aba9436a9b0acf55147f2d7ffcc550e025c57983e5d985a4f129f5351d31257d92d56e5018c514cd855d6b1789

Download Submit
C:\Windows\System\nWynPmo.exe

Filesize
3.2MB

MD5
11aa1315e2be19da2dc61ef8724061c1

SHA1
c6f5f02b3a046e4cb242592fd9837623da03959e

SHA256
b8c481234439dcf53d3d18125fba883063b622e669fa7e331ed21b168fb83750

SHA512
ea7e292f5b19f734413aaca4cfb1aadbfc7e3453defb5bebf6905b4db0ffb1fc97bf2e5bca2512ec7c5f5368c1ed759546d9000156af5612a2c88d1a1c539ccd

Download Submit
C:\Windows\System\nWynPmo.exe

Filesize
1.6MB

MD5
89b68588ab977e2c19d965c0d2852c4b

SHA1
52530f05e7b916801682b503d58bc88b6d0a0103

SHA256
f14fe14f18cf136e23d236c5d5eece2c7db263964d40fa0f670fd6ea44f793b9

SHA512
aa0c145f7e0b0efcba9824321588b84cdb67ec0254fdc1308bde0704a3c1f312cf3405f7e126ab9fb2253dc2654515cf3b1ddb6ecd584a6a244e97440c262f6d

Download Submit
C:\Windows\System\nftRuGM.exe

Filesize
3.2MB

MD5
83b61a92adb20993e34d1afe6fb080cc

SHA1
c8a853cf7667bc4cc90d3ab3d4eec21f018ef76c

SHA256
2f2c4f06623784c1bd906779a3a9372fd42e5f8958649999feb3f7bf04b4a4df

SHA512
12169e868a253810e20aeb08bcae0f358e6638c264cf7c1b54be76a130b608fac4d94c25eed0d4af35568c2abc6c44afb99d73cbcc7ed7cfa2a792e25c81fcdc

Download Submit
C:\Windows\System\oFADDvq.exe

Filesize
3.2MB

MD5
1caa7c7793d78578ceb9039e52af58c1

SHA1
2b98b5a05bf0926b4e0aced01da0bd14d36455fa

SHA256
244a91be92b0bb75e4c8a74eca3daba4112ffe56b6909f327efc7b2e32ff0a7e

SHA512
0dd53825adcfbb3717c5abcde3e55d497c1c68dd44a1036fffc23eae26a9fc0fb2a96d961f216e845ae5d988286483d7f808bfe3b7368bde7cf590240588c565

Download Submit
C:\Windows\System\pIQfUwq.exe

Filesize
3.2MB

MD5
19bf0a68f86d7707b1da3dee99691f33

SHA1
134fc3db47e06a8f07d3075b07c292af7742e78f

SHA256
c0ede6eae2c98a97b95ff0c5bf3efc6ad94f5ce4a2dbcfcd322629a595a54699

SHA512
e8399666c6955091829ba767bea6e8ab0e77d05e091159190854734bc7576b7839e143214c911e53a099d5630379632f23500d755fe98b21b5e8c6e330c32a99

Download Submit
C:\Windows\System\rofqAgy.exe

Filesize
3.2MB

MD5
fa152c0207b0876dc21ab9160fdeb8d3

SHA1
dde4dca1b7ff0fecc791b084cc4c41ca934cad57

SHA256
69bab1ca78b858b5de5301254b7a84975545f0e0b55a51c44c5b8c68d29081a2

SHA512
fe939e9c33341ab02a7b0e9f71e5641ab5287f96b142fab51b0ffec13af30e1e112509c469111fcaa6544c96fe85876187f16c56eccd75d5fc3fec18a4d4921c

Download Submit
C:\Windows\System\sRCnCly.exe

Filesize
3.2MB

MD5
df79d54e7edd6693bb29f859e5f8dc45

SHA1
9fcc1b6d60ba3a2f8aab1893877d1986353f4f92

SHA256
5b61a7723bbbe402d1fe983ff27c1bb4d217d4feaef3916bea906000ddc86e80

SHA512
2689b94f508e0c3f8149e0e213a70a9e0e428118e2d0bb3def9dcc46363128dec78c6908ff0392d586111b4d43f4cb712b2642c30f343fc190a2ba5c0b4ca066

Download Submit
C:\Windows\System\skdASYc.exe

Filesize
3.2MB

MD5
776c5abe73c255b034aa653032e553c8

SHA1
aa00a5269698685dc202da6d82731b2b54e037f9

SHA256
4fad173c0bf4038d047fd0f6cec96ce671ee4d7c48e02b87026609b32f8491fa

SHA512
fb9677f9e1fba08a0793b39f0c1496f9cae51878c176b096631289b7e2feb5042ab11b38bf8df2bbf8935ea5f8790ebae415c66d774988254153e44d0a4c54c6

Download Submit
C:\Windows\System\ttatgqA.exe

Filesize
3.2MB

MD5
2d5227ea4a75305f0916ec0599c69422

SHA1
f0c35b12ebf4fd09795f9920b227b83b62bd429f

SHA256
7a893f94f1e77d2ec6758444017ee253bb74e95cccdee8fb1684dcd5105199d0

SHA512
f392b65f753ea822dd9d47d7c4a0f1edac84da8ab23a0d4e13ec40293100b81f6b32fcbc80eec79aa88683c26c4d2d6265eee893b88fc5a5f5b96e1859dda7e3

Download Submit
C:\Windows\System\vKkUeXO.exe

Filesize
2.5MB

MD5
42a94859f8da1762abae272c7ffb8dda

SHA1
9769fb0cf064b1c75383b6b478d966951a5b4d6f

SHA256
f298d72985a6318ca2022d702e2a24c684886417b09affaefe2a613bc3da0665

SHA512
978ac14918817b139419cbd3a46b3e89e265d774a9a0181299f463f1b7e8658ccef59b8a08e58324aff0f7847eafe6d0f8de1f8fee70ff205e7d447775fe9c58

Download Submit
C:\Windows\System\vKkUeXO.exe

Filesize
3.2MB

MD5
6d7612505af9cd0e7985341e154e6c81

SHA1
44a73039a93e03f7e8f316c152b780b573ec909a

SHA256
6f8d6c50dfec61ab500b426401f03830784734290cea6c74328086a4b68a43df

SHA512
5982edb9449cfc7191308e0472f48944f32c6f3023cbd916db65fd43d4a9e497d25df7ffa3ca3cc61566a225b81a5dde2ae901e8a84a2e3476e492176586b4fc

Download Submit
C:\Windows\System\whwqUwA.exe

Filesize
3.2MB

MD5
94faeaac4fcea47b6391467a8bed0157

SHA1
b534dcdeb8d2f07f57771d3a1f64467adc1a6942

SHA256
8245a8e0b55b9f0d3b031a92f154a48533b6e00ce51a74f775378bd49fdc8890

SHA512
d8c299e425a2ac4283e5c18d107d75310cce33f990dd00f6a6dd73e1292dec71fabf87b4bf1745e1c47053f6d7a92855ef0f4a1d2807b850f262946808e3f113

Download Submit
C:\Windows\System\xWTvhwE.exe

Filesize
3.2MB

MD5
c3141a78903befaed0352fddddfc495f

SHA1
50467cb45613ce74fbc22fba5a008974d22d8079

SHA256
c7ac5789f2cb1b88210f89b7cf3a5633c042f5583237d8318421582ec5f14891

SHA512
e1b253fafb9dcda375d3d81e21a99c9a53caa43ab6e57c23c57c41539762a1ec9d990c6b9a538ca204439f89f8dbdbea4defdaa789f42af68d93003afe2d1f81

Download Submit
memory/316-6202-0x00007FF6C3880000-0x00007FF6C3C76000-memory.dmp

Filesize
4.0MB

Download
memory/316-355-0x00007FF6C3880000-0x00007FF6C3C76000-memory.dmp

Filesize
4.0MB

Download
memory/564-969-0x00007FFC549E3000-0x00007FFC549E5000-memory.dmp

Filesize
8KB

Download
memory/564-975-0x00007FFC549E0000-0x00007FFC554A1000-memory.dmp

Filesize
10.8MB

Download
memory/564-54-0x000001B362620000-0x000001B362642000-memory.dmp

Filesize
136KB

Download
memory/564-10-0x00007FFC549E3000-0x00007FFC549E5000-memory.dmp

Filesize
8KB

Download
memory/564-270-0x000001B363570000-0x000001B363D16000-memory.dmp

Filesize
7.6MB

Download
memory/564-31-0x00007FFC549E0000-0x00007FFC554A1000-memory.dmp

Filesize
10.8MB

Download
memory/564-69-0x00007FFC549E0000-0x00007FFC554A1000-memory.dmp

Filesize
10.8MB

Download
memory/564-602-0x00007FFC549E0000-0x00007FFC554A1000-memory.dmp

Filesize
10.8MB

Download
memory/668-0-0x00007FF7E35A0000-0x00007FF7E3996000-memory.dmp

Filesize
4.0MB

Download
memory/668-1-0x000001BFD5500000-0x000001BFD5510000-memory.dmp

Filesize
64KB

Download
memory/668-595-0x00007FF7E35A0000-0x00007FF7E3996000-memory.dmp

Filesize
4.0MB

Download
memory/932-39-0x00007FF658850000-0x00007FF658C46000-memory.dmp

Filesize
4.0MB

Download
memory/1456-76-0x00007FF7CD7F0000-0x00007FF7CDBE6000-memory.dmp

Filesize
4.0MB

Download
memory/1468-341-0x00007FF79D990000-0x00007FF79DD86000-memory.dmp

Filesize
4.0MB

Download
memory/1604-70-0x00007FF769E30000-0x00007FF76A226000-memory.dmp

Filesize
4.0MB

Download
memory/1612-343-0x00007FF630070000-0x00007FF630466000-memory.dmp

Filesize
4.0MB

Download
memory/1980-93-0x00007FF77F5A0000-0x00007FF77F996000-memory.dmp

Filesize
4.0MB

Download
memory/2164-6105-0x00007FF7DD0D0000-0x00007FF7DD4C6000-memory.dmp

Filesize
4.0MB

Download
memory/2164-96-0x00007FF7DD0D0000-0x00007FF7DD4C6000-memory.dmp

Filesize
4.0MB

Download
memory/2164-2009-0x00007FF7DD0D0000-0x00007FF7DD4C6000-memory.dmp

Filesize
4.0MB

Download
memory/2184-117-0x00007FF67CE70000-0x00007FF67D266000-memory.dmp

Filesize
4.0MB

Download
memory/2316-121-0x00007FF6873D0000-0x00007FF6877C6000-memory.dmp

Filesize
4.0MB

Download
memory/2316-3451-0x00007FF6873D0000-0x00007FF6877C6000-memory.dmp

Filesize
4.0MB

Download
memory/2412-55-0x00007FF7B7B80000-0x00007FF7B7F76000-memory.dmp

Filesize
4.0MB

Download
memory/2676-60-0x00007FF799230000-0x00007FF799626000-memory.dmp

Filesize
4.0MB

Download
memory/2676-5726-0x00007FF799230000-0x00007FF799626000-memory.dmp

Filesize
4.0MB

Download
memory/2960-78-0x00007FF6F5CA0000-0x00007FF6F6096000-memory.dmp

Filesize
4.0MB

Download
memory/3036-353-0x00007FF70E460000-0x00007FF70E856000-memory.dmp

Filesize
4.0MB

Download
memory/3172-350-0x00007FF7055C0000-0x00007FF7059B6000-memory.dmp

Filesize
4.0MB

Download
memory/3588-340-0x00007FF696C00000-0x00007FF696FF6000-memory.dmp

Filesize
4.0MB

Download
memory/3588-9-0x00007FF696C00000-0x00007FF696FF6000-memory.dmp

Filesize
4.0MB

Download
memory/3820-64-0x00007FF798AE0000-0x00007FF798ED6000-memory.dmp

Filesize
4.0MB

Download
memory/4060-342-0x00007FF6C4EA0000-0x00007FF6C5296000-memory.dmp

Filesize
4.0MB

Download
memory/4140-6114-0x00007FF76F5D0000-0x00007FF76F9C6000-memory.dmp

Filesize
4.0MB

Download
memory/4140-118-0x00007FF76F5D0000-0x00007FF76F9C6000-memory.dmp

Filesize
4.0MB

Download
memory/4216-72-0x00007FF72F0F0000-0x00007FF72F4E6000-memory.dmp

Filesize
4.0MB

Download
memory/4276-108-0x00007FF7F4D60000-0x00007FF7F5156000-memory.dmp

Filesize
4.0MB

Download
memory/4280-102-0x00007FF7C4400000-0x00007FF7C47F6000-memory.dmp

Filesize
4.0MB

Download
memory/4880-65-0x00007FF719F00000-0x00007FF71A2F6000-memory.dmp

Filesize
4.0MB

Download
memory/4880-5671-0x00007FF719F00000-0x00007FF71A2F6000-memory.dmp

Filesize
4.0MB

Download
memory/4924-2001-0x00007FF7D0420000-0x00007FF7D0816000-memory.dmp

Filesize
4.0MB

Download
memory/4924-79-0x00007FF7D0420000-0x00007FF7D0816000-memory.dmp

Filesize
4.0MB

Download