xmrig | 3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d

Analysis

max time kernel
133s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
Size

1.8MB
MD5

252c22fb59b3a951ce7824d041685160
SHA1

2673f872fc31b35a7d45c001210b01792ac6b8bf
SHA256

3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d
SHA512

5d04716c6e8542b245a1325cc5f67dc7ffde9d6be79bd8dba0b80c7d4c9de4e9b902005f17c6b5ed7d061f73729c9c25dab4fc5bdceebdfa3bbdfb0181ad331c
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkipfzaCtNcQcAupaXHeY5HmsoKTQXvaW9Rcps9kdie:Lz071uv4BPMki8CnfLv3zQXtTE3Z

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/208-48-0x00007FF7DFAA0000-0x00007FF7DFE92000-memory.dmp	xmrig
behavioral2/memory/4528-134-0x00007FF66C770000-0x00007FF66CB62000-memory.dmp	xmrig
behavioral2/memory/3156-139-0x00007FF72ACB0000-0x00007FF72B0A2000-memory.dmp	xmrig
behavioral2/memory/4436-144-0x00007FF7AD6E0000-0x00007FF7ADAD2000-memory.dmp	xmrig
behavioral2/memory/4416-146-0x00007FF6319F0000-0x00007FF631DE2000-memory.dmp	xmrig
behavioral2/memory/2860-145-0x00007FF7EFE80000-0x00007FF7F0272000-memory.dmp	xmrig
behavioral2/memory/1920-143-0x00007FF65DE80000-0x00007FF65E272000-memory.dmp	xmrig
behavioral2/memory/4352-142-0x00007FF628630000-0x00007FF628A22000-memory.dmp	xmrig
behavioral2/memory/1912-141-0x00007FF72F350000-0x00007FF72F742000-memory.dmp	xmrig
behavioral2/memory/3600-140-0x00007FF7F0A70000-0x00007FF7F0E62000-memory.dmp	xmrig
behavioral2/memory/3808-138-0x00007FF76C3D0000-0x00007FF76C7C2000-memory.dmp	xmrig
behavioral2/memory/4168-137-0x00007FF6ED260000-0x00007FF6ED652000-memory.dmp	xmrig
behavioral2/memory/2036-133-0x00007FF75E120000-0x00007FF75E512000-memory.dmp	xmrig
behavioral2/memory/532-132-0x00007FF735B80000-0x00007FF735F72000-memory.dmp	xmrig
behavioral2/memory/1540-126-0x00007FF60A200000-0x00007FF60A5F2000-memory.dmp	xmrig
behavioral2/memory/4556-125-0x00007FF65D5A0000-0x00007FF65D992000-memory.dmp	xmrig
behavioral2/memory/4088-119-0x00007FF600360000-0x00007FF600752000-memory.dmp	xmrig
behavioral2/memory/5112-110-0x00007FF753DC0000-0x00007FF7541B2000-memory.dmp	xmrig
behavioral2/memory/2044-109-0x00007FF6AEF30000-0x00007FF6AF322000-memory.dmp	xmrig
behavioral2/memory/3584-101-0x00007FF620B90000-0x00007FF620F82000-memory.dmp	xmrig
behavioral2/memory/3492-90-0x00007FF7F6400000-0x00007FF7F67F2000-memory.dmp	xmrig
behavioral2/memory/592-31-0x00007FF6A8D60000-0x00007FF6A9152000-memory.dmp	xmrig
behavioral2/memory/4868-5420-0x00007FF79E230000-0x00007FF79E622000-memory.dmp	xmrig
behavioral2/memory/2312-6084-0x00007FF6BCAE0000-0x00007FF6BCED2000-memory.dmp	xmrig
behavioral2/memory/208-6083-0x00007FF7DFAA0000-0x00007FF7DFE92000-memory.dmp	xmrig
behavioral2/memory/592-6073-0x00007FF6A8D60000-0x00007FF6A9152000-memory.dmp	xmrig
behavioral2/memory/4868-6087-0x00007FF79E230000-0x00007FF79E622000-memory.dmp	xmrig
behavioral2/memory/1912-6093-0x00007FF72F350000-0x00007FF72F742000-memory.dmp	xmrig
behavioral2/memory/3600-6090-0x00007FF7F0A70000-0x00007FF7F0E62000-memory.dmp	xmrig
behavioral2/memory/4352-6095-0x00007FF628630000-0x00007FF628A22000-memory.dmp	xmrig
behavioral2/memory/3584-6125-0x00007FF620B90000-0x00007FF620F82000-memory.dmp	xmrig
behavioral2/memory/2044-6123-0x00007FF6AEF30000-0x00007FF6AF322000-memory.dmp	xmrig
behavioral2/memory/2860-6129-0x00007FF7EFE80000-0x00007FF7F0272000-memory.dmp	xmrig
behavioral2/memory/4416-6131-0x00007FF6319F0000-0x00007FF631DE2000-memory.dmp	xmrig
behavioral2/memory/3808-6126-0x00007FF76C3D0000-0x00007FF76C7C2000-memory.dmp	xmrig
behavioral2/memory/3156-6119-0x00007FF72ACB0000-0x00007FF72B0A2000-memory.dmp	xmrig
behavioral2/memory/4168-6115-0x00007FF6ED260000-0x00007FF6ED652000-memory.dmp	xmrig
behavioral2/memory/3492-6113-0x00007FF7F6400000-0x00007FF7F67F2000-memory.dmp	xmrig
behavioral2/memory/1920-6111-0x00007FF65DE80000-0x00007FF65E272000-memory.dmp	xmrig
behavioral2/memory/4556-6105-0x00007FF65D5A0000-0x00007FF65D992000-memory.dmp	xmrig
behavioral2/memory/4436-6103-0x00007FF7AD6E0000-0x00007FF7ADAD2000-memory.dmp	xmrig
behavioral2/memory/4528-6101-0x00007FF66C770000-0x00007FF66CB62000-memory.dmp	xmrig
behavioral2/memory/532-6099-0x00007FF735B80000-0x00007FF735F72000-memory.dmp	xmrig
behavioral2/memory/2036-6121-0x00007FF75E120000-0x00007FF75E512000-memory.dmp	xmrig
behavioral2/memory/1540-6117-0x00007FF60A200000-0x00007FF60A5F2000-memory.dmp	xmrig
behavioral2/memory/5112-6109-0x00007FF753DC0000-0x00007FF7541B2000-memory.dmp	xmrig
behavioral2/memory/4088-6107-0x00007FF600360000-0x00007FF600752000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	1568	powershell.exe
10	1568	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1568	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
592	XvtrUzx.exe
2312	ZCsrJeY.exe
208	yEhbNQT.exe
3600	BOAxHzw.exe
1912	XIGWdeC.exe
4868	bBDZWXQ.exe
4352	LqDxzxt.exe
3492	eSLiLOE.exe
3584	HqOAoPw.exe
1920	UjxBKkF.exe
2044	KNOOqXE.exe
5112	hIZvvDE.exe
4088	HAPmGpP.exe
4556	JClIZTM.exe
1540	qyWtOVv.exe
532	FImpkkQ.exe
2036	nhEfCKF.exe
4528	wtxpXSs.exe
4436	iXelnue.exe
4168	iFpmkqW.exe
3808	WcXpylK.exe
3156	OdnvHIX.exe
2860	syDZZLk.exe
4416	ixsrkzc.exe
4900	euPdUWw.exe
3236	wCLhkVh.exe
4848	GjuhcTQ.exe
4940	nzKFpej.exe
2108	KLvhEvo.exe
1096	pvUJohh.exe
864	YwIVbeo.exe
4760	WTPruEy.exe
1708	VCKwJZO.exe
2716	hgqODkg.exe
1200	gbDgtSV.exe
3328	FjnRggU.exe
3172	EfJLnsc.exe
5104	XilKYdz.exe
4408	OEpqnsm.exe
1420	SmpIxwO.exe
4092	JZUPAmn.exe
1000	xizDkHH.exe
2668	rzfRaXb.exe
4076	lttvqHF.exe
3408	GaZdQbu.exe
4444	CZuuRRm.exe
4592	nyhrZcD.exe
4980	knRCWOX.exe
3592	IFDIewS.exe
3164	vcTCmMe.exe
3988	rvZwGdJ.exe
3200	apoeFjf.exe
3436	gEhYMWP.exe
2708	GSeSxjd.exe
1900	HRHVJWb.exe
1260	EliLuJD.exe
4656	BhVYlxI.exe
1736	gNoBXqq.exe
1344	oIRSAiG.exe
1988	konOhQv.exe
512	OrGbyJR.exe
1312	KZbUGqq.exe
2748	RCqzHnX.exe
3220	vyXMFoQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1100-0-0x00007FF6D9F20000-0x00007FF6DA312000-memory.dmp	upx
behavioral2/files/0x000700000002342d-6.dat	upx
behavioral2/files/0x000700000002342f-24.dat	upx
behavioral2/files/0x0007000000023433-38.dat	upx
behavioral2/memory/208-48-0x00007FF7DFAA0000-0x00007FF7DFE92000-memory.dmp	upx
behavioral2/files/0x0007000000023439-82.dat	upx
behavioral2/files/0x0007000000023436-95.dat	upx
behavioral2/files/0x000700000002343a-106.dat	upx
behavioral2/files/0x0007000000023440-122.dat	upx
behavioral2/memory/4528-134-0x00007FF66C770000-0x00007FF66CB62000-memory.dmp	upx
behavioral2/memory/3156-139-0x00007FF72ACB0000-0x00007FF72B0A2000-memory.dmp	upx
behavioral2/memory/4436-144-0x00007FF7AD6E0000-0x00007FF7ADAD2000-memory.dmp	upx
behavioral2/files/0x0008000000023445-172.dat	upx
behavioral2/files/0x0007000000023449-195.dat	upx
behavioral2/files/0x000700000002344f-201.dat	upx
behavioral2/files/0x000700000002344e-200.dat	upx
behavioral2/files/0x000700000002344d-199.dat	upx
behavioral2/files/0x000700000002344c-198.dat	upx
behavioral2/files/0x000700000002344b-197.dat	upx
behavioral2/files/0x000700000002344a-196.dat	upx
behavioral2/files/0x0007000000023448-194.dat	upx
behavioral2/files/0x0007000000023447-193.dat	upx
behavioral2/files/0x0007000000023446-186.dat	upx
behavioral2/files/0x0007000000023443-165.dat	upx
behavioral2/files/0x000800000002342a-150.dat	upx
behavioral2/memory/4416-146-0x00007FF6319F0000-0x00007FF631DE2000-memory.dmp	upx
behavioral2/memory/2860-145-0x00007FF7EFE80000-0x00007FF7F0272000-memory.dmp	upx
behavioral2/memory/1920-143-0x00007FF65DE80000-0x00007FF65E272000-memory.dmp	upx
behavioral2/memory/4352-142-0x00007FF628630000-0x00007FF628A22000-memory.dmp	upx
behavioral2/memory/1912-141-0x00007FF72F350000-0x00007FF72F742000-memory.dmp	upx
behavioral2/memory/3600-140-0x00007FF7F0A70000-0x00007FF7F0E62000-memory.dmp	upx
behavioral2/memory/3808-138-0x00007FF76C3D0000-0x00007FF76C7C2000-memory.dmp	upx
behavioral2/memory/4168-137-0x00007FF6ED260000-0x00007FF6ED652000-memory.dmp	upx
behavioral2/files/0x0007000000023442-135.dat	upx
behavioral2/memory/2036-133-0x00007FF75E120000-0x00007FF75E512000-memory.dmp	upx
behavioral2/memory/532-132-0x00007FF735B80000-0x00007FF735F72000-memory.dmp	upx
behavioral2/files/0x000700000002343d-129.dat	upx
behavioral2/memory/1540-126-0x00007FF60A200000-0x00007FF60A5F2000-memory.dmp	upx
behavioral2/memory/4556-125-0x00007FF65D5A0000-0x00007FF65D992000-memory.dmp	upx
behavioral2/memory/4088-119-0x00007FF600360000-0x00007FF600752000-memory.dmp	upx
behavioral2/files/0x0007000000023441-114.dat	upx
behavioral2/files/0x000700000002343e-112.dat	upx
behavioral2/memory/5112-110-0x00007FF753DC0000-0x00007FF7541B2000-memory.dmp	upx
behavioral2/memory/2044-109-0x00007FF6AEF30000-0x00007FF6AF322000-memory.dmp	upx
behavioral2/files/0x000700000002343f-120.dat	upx
behavioral2/files/0x000700000002343c-108.dat	upx
behavioral2/files/0x0007000000023438-103.dat	upx
behavioral2/memory/3584-101-0x00007FF620B90000-0x00007FF620F82000-memory.dmp	upx
behavioral2/files/0x0007000000023435-100.dat	upx
behavioral2/files/0x000700000002343b-97.dat	upx
behavioral2/files/0x0007000000023437-104.dat	upx
behavioral2/memory/3492-90-0x00007FF7F6400000-0x00007FF7F67F2000-memory.dmp	upx
behavioral2/files/0x0007000000023432-75.dat	upx
behavioral2/memory/4868-88-0x00007FF79E230000-0x00007FF79E622000-memory.dmp	upx
behavioral2/files/0x0007000000023431-60.dat	upx
behavioral2/files/0x0007000000023434-86.dat	upx
behavioral2/files/0x0007000000023430-52.dat	upx
behavioral2/files/0x000700000002342e-56.dat	upx
behavioral2/memory/2312-36-0x00007FF6BCAE0000-0x00007FF6BCED2000-memory.dmp	upx
behavioral2/memory/592-31-0x00007FF6A8D60000-0x00007FF6A9152000-memory.dmp	upx
behavioral2/files/0x000800000002342c-23.dat	upx
behavioral2/files/0x0008000000023426-9.dat	upx
behavioral2/memory/4868-5420-0x00007FF79E230000-0x00007FF79E622000-memory.dmp	upx
behavioral2/memory/2312-6084-0x00007FF6BCAE0000-0x00007FF6BCED2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TwxAfQu.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\zTROWiF.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\XvHUoBH.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\Hgwsgof.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\fLsFyIe.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\PJSNQel.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\OFPZLjp.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\pKsajSD.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\sYIEOss.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\seBucTd.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\EawzklT.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\EGUffeB.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\SoGXshp.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\CLjALaH.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\mghskDC.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\QJnlWPn.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\GBQPxnH.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\PuDUpuM.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\ZYjvCuY.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\bbtXLyc.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\uzoYkTY.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\QBByvcL.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\TmFTrbj.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\vKXmrtE.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\XVAsRVT.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\gmIRTEh.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\uRHxFMi.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\QWEbrVL.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\KOVAIAV.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\kEgNWzG.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\EecgVWK.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\PwWyEDk.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\WegmqyQ.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\IJgLpdu.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\qMmZsrs.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\VUBCcKd.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\MbpqezL.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\qBrbVag.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\jQacfrl.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\uFZDLGq.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\LNzNRal.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\kSklmFc.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\PPTqHSX.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\qETYAyL.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\WsqeOyF.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\cOWOmlL.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\MpjujeD.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\TOLyRnk.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\gLAjpum.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\LzYpNRX.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\xOYFfBf.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\pbyQMAB.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\uWidGvP.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\zFQPbHk.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\BbIvFma.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\NIXEcHY.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\zKcFxtV.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\AEjGCSu.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\lAmQYIU.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\CmcQfHC.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\LhKKZRG.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\zJkDCLY.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\ukfXjzj.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
File created	C:\Windows\System\pbRlHDb.exe	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe
1568	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
Token: SeDebugPrivilege	1568	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1568	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	86
PID 1100 wrote to memory of 1568	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	86
PID 1100 wrote to memory of 592	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	87
PID 1100 wrote to memory of 592	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	87
PID 1100 wrote to memory of 2312	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	88
PID 1100 wrote to memory of 2312	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	88
PID 1100 wrote to memory of 208	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	89
PID 1100 wrote to memory of 208	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	89
PID 1100 wrote to memory of 3600	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	90
PID 1100 wrote to memory of 3600	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	90
PID 1100 wrote to memory of 1912	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	91
PID 1100 wrote to memory of 1912	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	91
PID 1100 wrote to memory of 4868	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	92
PID 1100 wrote to memory of 4868	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	92
PID 1100 wrote to memory of 3584	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	93
PID 1100 wrote to memory of 3584	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	93
PID 1100 wrote to memory of 4352	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	94
PID 1100 wrote to memory of 4352	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	94
PID 1100 wrote to memory of 3492	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	95
PID 1100 wrote to memory of 3492	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	95
PID 1100 wrote to memory of 2044	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	96
PID 1100 wrote to memory of 2044	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	96
PID 1100 wrote to memory of 5112	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	97
PID 1100 wrote to memory of 5112	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	97
PID 1100 wrote to memory of 1920	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	98
PID 1100 wrote to memory of 1920	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	98
PID 1100 wrote to memory of 1540	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	99
PID 1100 wrote to memory of 1540	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	99
PID 1100 wrote to memory of 4088	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	100
PID 1100 wrote to memory of 4088	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	100
PID 1100 wrote to memory of 4556	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	101
PID 1100 wrote to memory of 4556	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	101
PID 1100 wrote to memory of 532	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	102
PID 1100 wrote to memory of 532	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	102
PID 1100 wrote to memory of 2036	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	103
PID 1100 wrote to memory of 2036	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	103
PID 1100 wrote to memory of 4528	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	104
PID 1100 wrote to memory of 4528	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	104
PID 1100 wrote to memory of 2860	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	105
PID 1100 wrote to memory of 2860	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	105
PID 1100 wrote to memory of 4436	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	106
PID 1100 wrote to memory of 4436	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	106
PID 1100 wrote to memory of 4168	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	107
PID 1100 wrote to memory of 4168	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	107
PID 1100 wrote to memory of 3808	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	108
PID 1100 wrote to memory of 3808	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	108
PID 1100 wrote to memory of 3156	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	109
PID 1100 wrote to memory of 3156	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	109
PID 1100 wrote to memory of 4416	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	110
PID 1100 wrote to memory of 4416	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	110
PID 1100 wrote to memory of 4900	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	111
PID 1100 wrote to memory of 4900	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	111
PID 1100 wrote to memory of 3236	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	112
PID 1100 wrote to memory of 3236	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	112
PID 1100 wrote to memory of 4848	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	113
PID 1100 wrote to memory of 4848	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	113
PID 1100 wrote to memory of 4940	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	114
PID 1100 wrote to memory of 4940	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	114
PID 1100 wrote to memory of 2108	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	115
PID 1100 wrote to memory of 2108	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	115
PID 1100 wrote to memory of 1096	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	116
PID 1100 wrote to memory of 1096	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	116
PID 1100 wrote to memory of 864	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	117
PID 1100 wrote to memory of 864	1100	3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3696aa021fea35d2f070c141da24c4b1b2bbe6f679a4eb26133d13745fe9ad0d_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1568" "2968" "2900" "2972" "0" "0" "2976" "0" "0" "0" "0" "0"
    3⤵
    PID:6440
- C:\Windows\System\XvtrUzx.exe
  C:\Windows\System\XvtrUzx.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\ZCsrJeY.exe
  C:\Windows\System\ZCsrJeY.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\yEhbNQT.exe
  C:\Windows\System\yEhbNQT.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\BOAxHzw.exe
  C:\Windows\System\BOAxHzw.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\XIGWdeC.exe
  C:\Windows\System\XIGWdeC.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\bBDZWXQ.exe
  C:\Windows\System\bBDZWXQ.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\HqOAoPw.exe
  C:\Windows\System\HqOAoPw.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\LqDxzxt.exe
  C:\Windows\System\LqDxzxt.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\eSLiLOE.exe
  C:\Windows\System\eSLiLOE.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\KNOOqXE.exe
  C:\Windows\System\KNOOqXE.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\hIZvvDE.exe
  C:\Windows\System\hIZvvDE.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\UjxBKkF.exe
  C:\Windows\System\UjxBKkF.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\qyWtOVv.exe
  C:\Windows\System\qyWtOVv.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\HAPmGpP.exe
  C:\Windows\System\HAPmGpP.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\JClIZTM.exe
  C:\Windows\System\JClIZTM.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\FImpkkQ.exe
  C:\Windows\System\FImpkkQ.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\nhEfCKF.exe
  C:\Windows\System\nhEfCKF.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\wtxpXSs.exe
  C:\Windows\System\wtxpXSs.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\syDZZLk.exe
  C:\Windows\System\syDZZLk.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\iXelnue.exe
  C:\Windows\System\iXelnue.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\iFpmkqW.exe
  C:\Windows\System\iFpmkqW.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\WcXpylK.exe
  C:\Windows\System\WcXpylK.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\OdnvHIX.exe
  C:\Windows\System\OdnvHIX.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\ixsrkzc.exe
  C:\Windows\System\ixsrkzc.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\euPdUWw.exe
  C:\Windows\System\euPdUWw.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\wCLhkVh.exe
  C:\Windows\System\wCLhkVh.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\GjuhcTQ.exe
  C:\Windows\System\GjuhcTQ.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\nzKFpej.exe
  C:\Windows\System\nzKFpej.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\KLvhEvo.exe
  C:\Windows\System\KLvhEvo.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\pvUJohh.exe
  C:\Windows\System\pvUJohh.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\YwIVbeo.exe
  C:\Windows\System\YwIVbeo.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\WTPruEy.exe
  C:\Windows\System\WTPruEy.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\VCKwJZO.exe
  C:\Windows\System\VCKwJZO.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\hgqODkg.exe
  C:\Windows\System\hgqODkg.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\gbDgtSV.exe
  C:\Windows\System\gbDgtSV.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\FjnRggU.exe
  C:\Windows\System\FjnRggU.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\EfJLnsc.exe
  C:\Windows\System\EfJLnsc.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\XilKYdz.exe
  C:\Windows\System\XilKYdz.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\OEpqnsm.exe
  C:\Windows\System\OEpqnsm.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\SmpIxwO.exe
  C:\Windows\System\SmpIxwO.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\JZUPAmn.exe
  C:\Windows\System\JZUPAmn.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\xizDkHH.exe
  C:\Windows\System\xizDkHH.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\rzfRaXb.exe
  C:\Windows\System\rzfRaXb.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\lttvqHF.exe
  C:\Windows\System\lttvqHF.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\GaZdQbu.exe
  C:\Windows\System\GaZdQbu.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\CZuuRRm.exe
  C:\Windows\System\CZuuRRm.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\nyhrZcD.exe
  C:\Windows\System\nyhrZcD.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\knRCWOX.exe
  C:\Windows\System\knRCWOX.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\IFDIewS.exe
  C:\Windows\System\IFDIewS.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\vcTCmMe.exe
  C:\Windows\System\vcTCmMe.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\rvZwGdJ.exe
  C:\Windows\System\rvZwGdJ.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\apoeFjf.exe
  C:\Windows\System\apoeFjf.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\gEhYMWP.exe
  C:\Windows\System\gEhYMWP.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\GSeSxjd.exe
  C:\Windows\System\GSeSxjd.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\HRHVJWb.exe
  C:\Windows\System\HRHVJWb.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\EliLuJD.exe
  C:\Windows\System\EliLuJD.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\BhVYlxI.exe
  C:\Windows\System\BhVYlxI.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\gNoBXqq.exe
  C:\Windows\System\gNoBXqq.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\oIRSAiG.exe
  C:\Windows\System\oIRSAiG.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\konOhQv.exe
  C:\Windows\System\konOhQv.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\OrGbyJR.exe
  C:\Windows\System\OrGbyJR.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\KZbUGqq.exe
  C:\Windows\System\KZbUGqq.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\RCqzHnX.exe
  C:\Windows\System\RCqzHnX.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\vyXMFoQ.exe
  C:\Windows\System\vyXMFoQ.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\nYvnzkg.exe
  C:\Windows\System\nYvnzkg.exe
  2⤵
  PID:3416
- C:\Windows\System\ZcFlHGI.exe
  C:\Windows\System\ZcFlHGI.exe
  2⤵
  PID:996
- C:\Windows\System\DoioTAc.exe
  C:\Windows\System\DoioTAc.exe
  2⤵
  PID:3980
- C:\Windows\System\tqmbWJI.exe
  C:\Windows\System\tqmbWJI.exe
  2⤵
  PID:3968
- C:\Windows\System\EaYryYl.exe
  C:\Windows\System\EaYryYl.exe
  2⤵
  PID:1408
- C:\Windows\System\XSjkslL.exe
  C:\Windows\System\XSjkslL.exe
  2⤵
  PID:4240
- C:\Windows\System\AUXzKCc.exe
  C:\Windows\System\AUXzKCc.exe
  2⤵
  PID:3360
- C:\Windows\System\gEOlOEu.exe
  C:\Windows\System\gEOlOEu.exe
  2⤵
  PID:1264
- C:\Windows\System\dNVlyoI.exe
  C:\Windows\System\dNVlyoI.exe
  2⤵
  PID:4924
- C:\Windows\System\yNFMMAg.exe
  C:\Windows\System\yNFMMAg.exe
  2⤵
  PID:2848
- C:\Windows\System\AdJRyXy.exe
  C:\Windows\System\AdJRyXy.exe
  2⤵
  PID:2532
- C:\Windows\System\ZADhPag.exe
  C:\Windows\System\ZADhPag.exe
  2⤵
  PID:724
- C:\Windows\System\zTloLWW.exe
  C:\Windows\System\zTloLWW.exe
  2⤵
  PID:4860
- C:\Windows\System\ayiHrDu.exe
  C:\Windows\System\ayiHrDu.exe
  2⤵
  PID:2008
- C:\Windows\System\vvvgBkn.exe
  C:\Windows\System\vvvgBkn.exe
  2⤵
  PID:1288
- C:\Windows\System\VthTbYM.exe
  C:\Windows\System\VthTbYM.exe
  2⤵
  PID:4968
- C:\Windows\System\oKDRKeR.exe
  C:\Windows\System\oKDRKeR.exe
  2⤵
  PID:2352
- C:\Windows\System\meEEEAK.exe
  C:\Windows\System\meEEEAK.exe
  2⤵
  PID:1112
- C:\Windows\System\tPjpbiJ.exe
  C:\Windows\System\tPjpbiJ.exe
  2⤵
  PID:3244
- C:\Windows\System\JsPvyod.exe
  C:\Windows\System\JsPvyod.exe
  2⤵
  PID:2104
- C:\Windows\System\MMmOKgm.exe
  C:\Windows\System\MMmOKgm.exe
  2⤵
  PID:4960
- C:\Windows\System\URIeuRG.exe
  C:\Windows\System\URIeuRG.exe
  2⤵
  PID:4456
- C:\Windows\System\lwXxYeQ.exe
  C:\Windows\System\lwXxYeQ.exe
  2⤵
  PID:4328
- C:\Windows\System\QeMXxbm.exe
  C:\Windows\System\QeMXxbm.exe
  2⤵
  PID:1304
- C:\Windows\System\PGKzRMy.exe
  C:\Windows\System\PGKzRMy.exe
  2⤵
  PID:4276
- C:\Windows\System\HNMkWDD.exe
  C:\Windows\System\HNMkWDD.exe
  2⤵
  PID:4264
- C:\Windows\System\cvEouxt.exe
  C:\Windows\System\cvEouxt.exe
  2⤵
  PID:5148
- C:\Windows\System\ytKtckY.exe
  C:\Windows\System\ytKtckY.exe
  2⤵
  PID:5180
- C:\Windows\System\xLHFfoB.exe
  C:\Windows\System\xLHFfoB.exe
  2⤵
  PID:5200
- C:\Windows\System\mWAggLe.exe
  C:\Windows\System\mWAggLe.exe
  2⤵
  PID:5224
- C:\Windows\System\jpsiFZB.exe
  C:\Windows\System\jpsiFZB.exe
  2⤵
  PID:5240
- C:\Windows\System\fxanCoe.exe
  C:\Windows\System\fxanCoe.exe
  2⤵
  PID:5260
- C:\Windows\System\BlQmhdm.exe
  C:\Windows\System\BlQmhdm.exe
  2⤵
  PID:5288
- C:\Windows\System\PBMoQUh.exe
  C:\Windows\System\PBMoQUh.exe
  2⤵
  PID:5304
- C:\Windows\System\fGJFNmr.exe
  C:\Windows\System\fGJFNmr.exe
  2⤵
  PID:5324
- C:\Windows\System\xccBBAE.exe
  C:\Windows\System\xccBBAE.exe
  2⤵
  PID:5352
- C:\Windows\System\pxRFdIn.exe
  C:\Windows\System\pxRFdIn.exe
  2⤵
  PID:5372
- C:\Windows\System\IpVnkSi.exe
  C:\Windows\System\IpVnkSi.exe
  2⤵
  PID:5388
- C:\Windows\System\qJoURfc.exe
  C:\Windows\System\qJoURfc.exe
  2⤵
  PID:5408
- C:\Windows\System\gaUTOCQ.exe
  C:\Windows\System\gaUTOCQ.exe
  2⤵
  PID:5424
- C:\Windows\System\DQLROJe.exe
  C:\Windows\System\DQLROJe.exe
  2⤵
  PID:5444
- C:\Windows\System\VqkejFW.exe
  C:\Windows\System\VqkejFW.exe
  2⤵
  PID:5460
- C:\Windows\System\xYtjKNE.exe
  C:\Windows\System\xYtjKNE.exe
  2⤵
  PID:5484
- C:\Windows\System\AJQoPJK.exe
  C:\Windows\System\AJQoPJK.exe
  2⤵
  PID:5516
- C:\Windows\System\tFoDgkT.exe
  C:\Windows\System\tFoDgkT.exe
  2⤵
  PID:5544
- C:\Windows\System\UPyKekn.exe
  C:\Windows\System\UPyKekn.exe
  2⤵
  PID:5564
- C:\Windows\System\etPwnMi.exe
  C:\Windows\System\etPwnMi.exe
  2⤵
  PID:5580
- C:\Windows\System\gsfERkv.exe
  C:\Windows\System\gsfERkv.exe
  2⤵
  PID:5612
- C:\Windows\System\SfpwoSn.exe
  C:\Windows\System\SfpwoSn.exe
  2⤵
  PID:5628
- C:\Windows\System\HHOMCVt.exe
  C:\Windows\System\HHOMCVt.exe
  2⤵
  PID:5652
- C:\Windows\System\WaWffkz.exe
  C:\Windows\System\WaWffkz.exe
  2⤵
  PID:5672
- C:\Windows\System\eQYWaIy.exe
  C:\Windows\System\eQYWaIy.exe
  2⤵
  PID:5696
- C:\Windows\System\qDtlPyD.exe
  C:\Windows\System\qDtlPyD.exe
  2⤵
  PID:5716
- C:\Windows\System\VFXBCHJ.exe
  C:\Windows\System\VFXBCHJ.exe
  2⤵
  PID:5732
- C:\Windows\System\FTQDhor.exe
  C:\Windows\System\FTQDhor.exe
  2⤵
  PID:5756
- C:\Windows\System\dwKqicC.exe
  C:\Windows\System\dwKqicC.exe
  2⤵
  PID:5772
- C:\Windows\System\RkWSRDU.exe
  C:\Windows\System\RkWSRDU.exe
  2⤵
  PID:5796
- C:\Windows\System\qkAChin.exe
  C:\Windows\System\qkAChin.exe
  2⤵
  PID:5812
- C:\Windows\System\doVCbit.exe
  C:\Windows\System\doVCbit.exe
  2⤵
  PID:5840
- C:\Windows\System\yFpCsuq.exe
  C:\Windows\System\yFpCsuq.exe
  2⤵
  PID:5860
- C:\Windows\System\TFmtIKI.exe
  C:\Windows\System\TFmtIKI.exe
  2⤵
  PID:5884
- C:\Windows\System\aAMkFUG.exe
  C:\Windows\System\aAMkFUG.exe
  2⤵
  PID:5900
- C:\Windows\System\CoZzLxT.exe
  C:\Windows\System\CoZzLxT.exe
  2⤵
  PID:5924
- C:\Windows\System\rkBdeqM.exe
  C:\Windows\System\rkBdeqM.exe
  2⤵
  PID:5944
- C:\Windows\System\MFtbtfb.exe
  C:\Windows\System\MFtbtfb.exe
  2⤵
  PID:5960
- C:\Windows\System\VIIyzOb.exe
  C:\Windows\System\VIIyzOb.exe
  2⤵
  PID:5984
- C:\Windows\System\QGEUZkj.exe
  C:\Windows\System\QGEUZkj.exe
  2⤵
  PID:6004
- C:\Windows\System\WpWxVkJ.exe
  C:\Windows\System\WpWxVkJ.exe
  2⤵
  PID:6028
- C:\Windows\System\VBSRwez.exe
  C:\Windows\System\VBSRwez.exe
  2⤵
  PID:6048
- C:\Windows\System\SjSLtVe.exe
  C:\Windows\System\SjSLtVe.exe
  2⤵
  PID:6068
- C:\Windows\System\PxIOYRU.exe
  C:\Windows\System\PxIOYRU.exe
  2⤵
  PID:6088
- C:\Windows\System\kMZTCaR.exe
  C:\Windows\System\kMZTCaR.exe
  2⤵
  PID:6108
- C:\Windows\System\mvawXPp.exe
  C:\Windows\System\mvawXPp.exe
  2⤵
  PID:6132
- C:\Windows\System\ethNkjO.exe
  C:\Windows\System\ethNkjO.exe
  2⤵
  PID:4300
- C:\Windows\System\qjZUOue.exe
  C:\Windows\System\qjZUOue.exe
  2⤵
  PID:4580
- C:\Windows\System\DMESvFH.exe
  C:\Windows\System\DMESvFH.exe
  2⤵
  PID:3948
- C:\Windows\System\HpQSCOc.exe
  C:\Windows\System\HpQSCOc.exe
  2⤵
  PID:4708
- C:\Windows\System\nTrvTmK.exe
  C:\Windows\System\nTrvTmK.exe
  2⤵
  PID:5132
- C:\Windows\System\XoZgQPz.exe
  C:\Windows\System\XoZgQPz.exe
  2⤵
  PID:2400
- C:\Windows\System\EHdWbgn.exe
  C:\Windows\System\EHdWbgn.exe
  2⤵
  PID:5396
- C:\Windows\System\HGVHKGa.exe
  C:\Windows\System\HGVHKGa.exe
  2⤵
  PID:5416
- C:\Windows\System\UYHNaAu.exe
  C:\Windows\System\UYHNaAu.exe
  2⤵
  PID:5480
- C:\Windows\System\ylLfmcw.exe
  C:\Windows\System\ylLfmcw.exe
  2⤵
  PID:5248
- C:\Windows\System\WdCJVfV.exe
  C:\Windows\System\WdCJVfV.exe
  2⤵
  PID:5188
- C:\Windows\System\ihMYSNJ.exe
  C:\Windows\System\ihMYSNJ.exe
  2⤵
  PID:5368
- C:\Windows\System\ESfbVfi.exe
  C:\Windows\System\ESfbVfi.exe
  2⤵
  PID:5576
- C:\Windows\System\ehdXhIn.exe
  C:\Windows\System\ehdXhIn.exe
  2⤵
  PID:5436
- C:\Windows\System\WrIZkyH.exe
  C:\Windows\System\WrIZkyH.exe
  2⤵
  PID:3044
- C:\Windows\System\vQxZWmB.exe
  C:\Windows\System\vQxZWmB.exe
  2⤵
  PID:4872
- C:\Windows\System\eYifdtw.exe
  C:\Windows\System\eYifdtw.exe
  2⤵
  PID:5276
- C:\Windows\System\FUXZCfE.exe
  C:\Windows\System\FUXZCfE.exe
  2⤵
  PID:5684
- C:\Windows\System\HlEsTHi.exe
  C:\Windows\System\HlEsTHi.exe
  2⤵
  PID:5768
- C:\Windows\System\rvYfFZB.exe
  C:\Windows\System\rvYfFZB.exe
  2⤵
  PID:5792
- C:\Windows\System\NMnDjFc.exe
  C:\Windows\System\NMnDjFc.exe
  2⤵
  PID:5556
- C:\Windows\System\VSuMWqC.exe
  C:\Windows\System\VSuMWqC.exe
  2⤵
  PID:5620
- C:\Windows\System\rgHmDjG.exe
  C:\Windows\System\rgHmDjG.exe
  2⤵
  PID:5968
- C:\Windows\System\wfdZxWR.exe
  C:\Windows\System\wfdZxWR.exe
  2⤵
  PID:6036
- C:\Windows\System\RMrrTbl.exe
  C:\Windows\System\RMrrTbl.exe
  2⤵
  PID:3848
- C:\Windows\System\eTboHRH.exe
  C:\Windows\System\eTboHRH.exe
  2⤵
  PID:5868
- C:\Windows\System\fVwieCt.exe
  C:\Windows\System\fVwieCt.exe
  2⤵
  PID:5908
- C:\Windows\System\pxlpMLs.exe
  C:\Windows\System\pxlpMLs.exe
  2⤵
  PID:6168
- C:\Windows\System\HgrorEW.exe
  C:\Windows\System\HgrorEW.exe
  2⤵
  PID:6196
- C:\Windows\System\bKCLDfL.exe
  C:\Windows\System\bKCLDfL.exe
  2⤵
  PID:6220
- C:\Windows\System\KIEUKIR.exe
  C:\Windows\System\KIEUKIR.exe
  2⤵
  PID:6248
- C:\Windows\System\adlEjEJ.exe
  C:\Windows\System\adlEjEJ.exe
  2⤵
  PID:6268
- C:\Windows\System\gbmsYHn.exe
  C:\Windows\System\gbmsYHn.exe
  2⤵
  PID:6292
- C:\Windows\System\rbwbLKc.exe
  C:\Windows\System\rbwbLKc.exe
  2⤵
  PID:6316
- C:\Windows\System\qhLkLJY.exe
  C:\Windows\System\qhLkLJY.exe
  2⤵
  PID:6336
- C:\Windows\System\TeVsdPu.exe
  C:\Windows\System\TeVsdPu.exe
  2⤵
  PID:6364
- C:\Windows\System\PEYPpPN.exe
  C:\Windows\System\PEYPpPN.exe
  2⤵
  PID:6384
- C:\Windows\System\njMKIRq.exe
  C:\Windows\System\njMKIRq.exe
  2⤵
  PID:6408
- C:\Windows\System\jfdImhM.exe
  C:\Windows\System\jfdImhM.exe
  2⤵
  PID:6424
- C:\Windows\System\WlrVCtU.exe
  C:\Windows\System\WlrVCtU.exe
  2⤵
  PID:6460
- C:\Windows\System\LUqUjxy.exe
  C:\Windows\System\LUqUjxy.exe
  2⤵
  PID:6480
- C:\Windows\System\FzLNhWH.exe
  C:\Windows\System\FzLNhWH.exe
  2⤵
  PID:6504
- C:\Windows\System\YfCLiWO.exe
  C:\Windows\System\YfCLiWO.exe
  2⤵
  PID:6528
- C:\Windows\System\jUBsLNh.exe
  C:\Windows\System\jUBsLNh.exe
  2⤵
  PID:6548
- C:\Windows\System\dveQzHq.exe
  C:\Windows\System\dveQzHq.exe
  2⤵
  PID:6568
- C:\Windows\System\NorhSvU.exe
  C:\Windows\System\NorhSvU.exe
  2⤵
  PID:6588
- C:\Windows\System\UYXwXrl.exe
  C:\Windows\System\UYXwXrl.exe
  2⤵
  PID:6612
- C:\Windows\System\nOWcKei.exe
  C:\Windows\System\nOWcKei.exe
  2⤵
  PID:6636
- C:\Windows\System\JZARyyn.exe
  C:\Windows\System\JZARyyn.exe
  2⤵
  PID:6660
- C:\Windows\System\yCCUbsQ.exe
  C:\Windows\System\yCCUbsQ.exe
  2⤵
  PID:6676
- C:\Windows\System\JqpBfBS.exe
  C:\Windows\System\JqpBfBS.exe
  2⤵
  PID:6700
- C:\Windows\System\rRrikTd.exe
  C:\Windows\System\rRrikTd.exe
  2⤵
  PID:6716
- C:\Windows\System\kmkTcTG.exe
  C:\Windows\System\kmkTcTG.exe
  2⤵
  PID:6740
- C:\Windows\System\gqHTKsA.exe
  C:\Windows\System\gqHTKsA.exe
  2⤵
  PID:6764
- C:\Windows\System\jUUZAvD.exe
  C:\Windows\System\jUUZAvD.exe
  2⤵
  PID:6780
- C:\Windows\System\fEpnjur.exe
  C:\Windows\System\fEpnjur.exe
  2⤵
  PID:6804
- C:\Windows\System\BpXYUhk.exe
  C:\Windows\System\BpXYUhk.exe
  2⤵
  PID:6828
- C:\Windows\System\lJGqenB.exe
  C:\Windows\System\lJGqenB.exe
  2⤵
  PID:6856
- C:\Windows\System\tnFjMAm.exe
  C:\Windows\System\tnFjMAm.exe
  2⤵
  PID:6876
- C:\Windows\System\hloOIeI.exe
  C:\Windows\System\hloOIeI.exe
  2⤵
  PID:6900
- C:\Windows\System\NHYWOda.exe
  C:\Windows\System\NHYWOda.exe
  2⤵
  PID:6916
- C:\Windows\System\bYDJtyp.exe
  C:\Windows\System\bYDJtyp.exe
  2⤵
  PID:6944
- C:\Windows\System\UwJiArv.exe
  C:\Windows\System\UwJiArv.exe
  2⤵
  PID:6960
- C:\Windows\System\EctfdQy.exe
  C:\Windows\System\EctfdQy.exe
  2⤵
  PID:6984
- C:\Windows\System\ZbdrKeC.exe
  C:\Windows\System\ZbdrKeC.exe
  2⤵
  PID:7004
- C:\Windows\System\kiOpott.exe
  C:\Windows\System\kiOpott.exe
  2⤵
  PID:7020
- C:\Windows\System\XvQveWX.exe
  C:\Windows\System\XvQveWX.exe
  2⤵
  PID:7044
- C:\Windows\System\gVNVutV.exe
  C:\Windows\System\gVNVutV.exe
  2⤵
  PID:7060
- C:\Windows\System\RUaAiHK.exe
  C:\Windows\System\RUaAiHK.exe
  2⤵
  PID:7088
- C:\Windows\System\NjZjTqk.exe
  C:\Windows\System\NjZjTqk.exe
  2⤵
  PID:7104
- C:\Windows\System\rNOLQzs.exe
  C:\Windows\System\rNOLQzs.exe
  2⤵
  PID:7124
- C:\Windows\System\TdapxYP.exe
  C:\Windows\System\TdapxYP.exe
  2⤵
  PID:7148
- C:\Windows\System\NfndeMZ.exe
  C:\Windows\System\NfndeMZ.exe
  2⤵
  PID:2552
- C:\Windows\System\bEJorCd.exe
  C:\Windows\System\bEJorCd.exe
  2⤵
  PID:5128
- C:\Windows\System\BBMXnsZ.exe
  C:\Windows\System\BBMXnsZ.exe
  2⤵
  PID:5384
- C:\Windows\System\LCPFXeu.exe
  C:\Windows\System\LCPFXeu.exe
  2⤵
  PID:5940
- C:\Windows\System\RqNAwuL.exe
  C:\Windows\System\RqNAwuL.exe
  2⤵
  PID:5364
- C:\Windows\System\ZymBtoy.exe
  C:\Windows\System\ZymBtoy.exe
  2⤵
  PID:3392
- C:\Windows\System\EuiuggL.exe
  C:\Windows\System\EuiuggL.exe
  2⤵
  PID:5752
- C:\Windows\System\IaVPqaB.exe
  C:\Windows\System\IaVPqaB.exe
  2⤵
  PID:5808
- C:\Windows\System\oVxvWVT.exe
  C:\Windows\System\oVxvWVT.exe
  2⤵
  PID:5680
- C:\Windows\System\afCkbHp.exe
  C:\Windows\System\afCkbHp.exe
  2⤵
  PID:6120
- C:\Windows\System\ZKCMNuE.exe
  C:\Windows\System\ZKCMNuE.exe
  2⤵
  PID:6152
- C:\Windows\System\ahNzzJH.exe
  C:\Windows\System\ahNzzJH.exe
  2⤵
  PID:6180
- C:\Windows\System\qJknxJO.exe
  C:\Windows\System\qJknxJO.exe
  2⤵
  PID:6236
- C:\Windows\System\IdrazID.exe
  C:\Windows\System\IdrazID.exe
  2⤵
  PID:5524
- C:\Windows\System\vgMXuGL.exe
  C:\Windows\System\vgMXuGL.exe
  2⤵
  PID:5976
- C:\Windows\System\XYNLJIm.exe
  C:\Windows\System\XYNLJIm.exe
  2⤵
  PID:5896
- C:\Windows\System\yLedXWn.exe
  C:\Windows\System\yLedXWn.exe
  2⤵
  PID:6076
- C:\Windows\System\kotdGUr.exe
  C:\Windows\System\kotdGUr.exe
  2⤵
  PID:6456
- C:\Windows\System\ncWqesq.exe
  C:\Windows\System\ncWqesq.exe
  2⤵
  PID:6516
- C:\Windows\System\BtOGFFs.exe
  C:\Windows\System\BtOGFFs.exe
  2⤵
  PID:6596
- C:\Windows\System\chcVqje.exe
  C:\Windows\System\chcVqje.exe
  2⤵
  PID:6208
- C:\Windows\System\ypjzgMT.exe
  C:\Windows\System\ypjzgMT.exe
  2⤵
  PID:6800
- C:\Windows\System\kocfXZE.exe
  C:\Windows\System\kocfXZE.exe
  2⤵
  PID:6848
- C:\Windows\System\suGgEJw.exe
  C:\Windows\System\suGgEJw.exe
  2⤵
  PID:7176
- C:\Windows\System\HldIanP.exe
  C:\Windows\System\HldIanP.exe
  2⤵
  PID:7200
- C:\Windows\System\pajOSKy.exe
  C:\Windows\System\pajOSKy.exe
  2⤵
  PID:7224
- C:\Windows\System\BYQtiPu.exe
  C:\Windows\System\BYQtiPu.exe
  2⤵
  PID:7240
- C:\Windows\System\hQRytyU.exe
  C:\Windows\System\hQRytyU.exe
  2⤵
  PID:7264
- C:\Windows\System\cQZDJIc.exe
  C:\Windows\System\cQZDJIc.exe
  2⤵
  PID:7284
- C:\Windows\System\ZMsYByH.exe
  C:\Windows\System\ZMsYByH.exe
  2⤵
  PID:7308
- C:\Windows\System\heEadRh.exe
  C:\Windows\System\heEadRh.exe
  2⤵
  PID:7324
- C:\Windows\System\PinZEGF.exe
  C:\Windows\System\PinZEGF.exe
  2⤵
  PID:7348
- C:\Windows\System\WqvKJcq.exe
  C:\Windows\System\WqvKJcq.exe
  2⤵
  PID:7372
- C:\Windows\System\roZsxIC.exe
  C:\Windows\System\roZsxIC.exe
  2⤵
  PID:7388
- C:\Windows\System\HArHLNT.exe
  C:\Windows\System\HArHLNT.exe
  2⤵
  PID:7412
- C:\Windows\System\weWaZHV.exe
  C:\Windows\System\weWaZHV.exe
  2⤵
  PID:7436
- C:\Windows\System\zFfTIsv.exe
  C:\Windows\System\zFfTIsv.exe
  2⤵
  PID:7456
- C:\Windows\System\aEdfmfm.exe
  C:\Windows\System\aEdfmfm.exe
  2⤵
  PID:7476
- C:\Windows\System\IugTTwO.exe
  C:\Windows\System\IugTTwO.exe
  2⤵
  PID:7500
- C:\Windows\System\TcAqGqj.exe
  C:\Windows\System\TcAqGqj.exe
  2⤵
  PID:7520
- C:\Windows\System\fGQfHgy.exe
  C:\Windows\System\fGQfHgy.exe
  2⤵
  PID:7544
- C:\Windows\System\TxLUuSx.exe
  C:\Windows\System\TxLUuSx.exe
  2⤵
  PID:7564
- C:\Windows\System\DRnxein.exe
  C:\Windows\System\DRnxein.exe
  2⤵
  PID:7584
- C:\Windows\System\fBJheew.exe
  C:\Windows\System\fBJheew.exe
  2⤵
  PID:7608
- C:\Windows\System\gbDLajC.exe
  C:\Windows\System\gbDLajC.exe
  2⤵
  PID:7636
- C:\Windows\System\canqdEi.exe
  C:\Windows\System\canqdEi.exe
  2⤵
  PID:7656
- C:\Windows\System\HlvLgns.exe
  C:\Windows\System\HlvLgns.exe
  2⤵
  PID:7680
- C:\Windows\System\UXEsorQ.exe
  C:\Windows\System\UXEsorQ.exe
  2⤵
  PID:7700
- C:\Windows\System\YTGBITc.exe
  C:\Windows\System\YTGBITc.exe
  2⤵
  PID:7720
- C:\Windows\System\lNBaQFV.exe
  C:\Windows\System\lNBaQFV.exe
  2⤵
  PID:7748
- C:\Windows\System\ewTayGT.exe
  C:\Windows\System\ewTayGT.exe
  2⤵
  PID:7768
- C:\Windows\System\hSHRWOL.exe
  C:\Windows\System\hSHRWOL.exe
  2⤵
  PID:7788
- C:\Windows\System\XSYlrXi.exe
  C:\Windows\System\XSYlrXi.exe
  2⤵
  PID:7808
- C:\Windows\System\FbtkCbH.exe
  C:\Windows\System\FbtkCbH.exe
  2⤵
  PID:8028
- C:\Windows\System\nyBUQws.exe
  C:\Windows\System\nyBUQws.exe
  2⤵
  PID:8088
- C:\Windows\System\koLaaVg.exe
  C:\Windows\System\koLaaVg.exe
  2⤵
  PID:8104
- C:\Windows\System\YOGsJkq.exe
  C:\Windows\System\YOGsJkq.exe
  2⤵
  PID:8128
- C:\Windows\System\BnUtkmL.exe
  C:\Windows\System\BnUtkmL.exe
  2⤵
  PID:8152
- C:\Windows\System\RyijWMw.exe
  C:\Windows\System\RyijWMw.exe
  2⤵
  PID:8172
- C:\Windows\System\kxCqkfk.exe
  C:\Windows\System\kxCqkfk.exe
  2⤵
  PID:6356
- C:\Windows\System\BoZlqgj.exe
  C:\Windows\System\BoZlqgj.exe
  2⤵
  PID:6432
- C:\Windows\System\YuYPKOd.exe
  C:\Windows\System\YuYPKOd.exe
  2⤵
  PID:6488
- C:\Windows\System\OZTazZo.exe
  C:\Windows\System\OZTazZo.exe
  2⤵
  PID:7080
- C:\Windows\System\xjBExTB.exe
  C:\Windows\System\xjBExTB.exe
  2⤵
  PID:2776
- C:\Windows\System\GXsyMKG.exe
  C:\Windows\System\GXsyMKG.exe
  2⤵
  PID:5348
- C:\Windows\System\rgPuCDW.exe
  C:\Windows\System\rgPuCDW.exe
  2⤵
  PID:6576
- C:\Windows\System\FUEGFdq.exe
  C:\Windows\System\FUEGFdq.exe
  2⤵
  PID:6672
- C:\Windows\System\sIqHeZq.exe
  C:\Windows\System\sIqHeZq.exe
  2⤵
  PID:6788
- C:\Windows\System\gNCprKh.exe
  C:\Windows\System\gNCprKh.exe
  2⤵
  PID:6328
- C:\Windows\System\ZVBHlNG.exe
  C:\Windows\System\ZVBHlNG.exe
  2⤵
  PID:6840
- C:\Windows\System\FinECtp.exe
  C:\Windows\System\FinECtp.exe
  2⤵
  PID:7280
- C:\Windows\System\mHtlmDx.exe
  C:\Windows\System\mHtlmDx.exe
  2⤵
  PID:6468
- C:\Windows\System\CQUdldl.exe
  C:\Windows\System\CQUdldl.exe
  2⤵
  PID:7516
- C:\Windows\System\iSyhaGO.exe
  C:\Windows\System\iSyhaGO.exe
  2⤵
  PID:3868
- C:\Windows\System\ZlBgYza.exe
  C:\Windows\System\ZlBgYza.exe
  2⤵
  PID:5196
- C:\Windows\System\sYHNcxA.exe
  C:\Windows\System\sYHNcxA.exe
  2⤵
  PID:7688
- C:\Windows\System\EGUffeB.exe
  C:\Windows\System\EGUffeB.exe
  2⤵
  PID:6628
- C:\Windows\System\BvHwMGF.exe
  C:\Windows\System\BvHwMGF.exe
  2⤵
  PID:6668
- C:\Windows\System\KixWSIU.exe
  C:\Windows\System\KixWSIU.exe
  2⤵
  PID:6736
- C:\Windows\System\tcHFoHj.exe
  C:\Windows\System\tcHFoHj.exe
  2⤵
  PID:7796
- C:\Windows\System\TUGJtDd.exe
  C:\Windows\System\TUGJtDd.exe
  2⤵
  PID:7712
- C:\Windows\System\CPgUzRZ.exe
  C:\Windows\System\CPgUzRZ.exe
  2⤵
  PID:7192
- C:\Windows\System\xHPvSog.exe
  C:\Windows\System\xHPvSog.exe
  2⤵
  PID:7340
- C:\Windows\System\xzszfOW.exe
  C:\Windows\System\xzszfOW.exe
  2⤵
  PID:7512
- C:\Windows\System\SenacIb.exe
  C:\Windows\System\SenacIb.exe
  2⤵
  PID:7196
- C:\Windows\System\LHmiNqz.exe
  C:\Windows\System\LHmiNqz.exe
  2⤵
  PID:6912
- C:\Windows\System\ZoZklBy.exe
  C:\Windows\System\ZoZklBy.exe
  2⤵
  PID:7396
- C:\Windows\System\vSVjxrl.exe
  C:\Windows\System\vSVjxrl.exe
  2⤵
  PID:7140
- C:\Windows\System\WJQlmXW.exe
  C:\Windows\System\WJQlmXW.exe
  2⤵
  PID:7164
- C:\Windows\System\erDzWVH.exe
  C:\Windows\System\erDzWVH.exe
  2⤵
  PID:7972
- C:\Windows\System\pmbKltN.exe
  C:\Windows\System\pmbKltN.exe
  2⤵
  PID:8208
- C:\Windows\System\XXTuZsB.exe
  C:\Windows\System\XXTuZsB.exe
  2⤵
  PID:8228
- C:\Windows\System\XntccXH.exe
  C:\Windows\System\XntccXH.exe
  2⤵
  PID:8252
- C:\Windows\System\BYGGCSc.exe
  C:\Windows\System\BYGGCSc.exe
  2⤵
  PID:8272
- C:\Windows\System\MjwvtVk.exe
  C:\Windows\System\MjwvtVk.exe
  2⤵
  PID:8292
- C:\Windows\System\yiClNTj.exe
  C:\Windows\System\yiClNTj.exe
  2⤵
  PID:8316
- C:\Windows\System\dYQTuWR.exe
  C:\Windows\System\dYQTuWR.exe
  2⤵
  PID:8332
- C:\Windows\System\NnTKiwM.exe
  C:\Windows\System\NnTKiwM.exe
  2⤵
  PID:8360
- C:\Windows\System\YZXEiNM.exe
  C:\Windows\System\YZXEiNM.exe
  2⤵
  PID:8380
- C:\Windows\System\NZEpZgR.exe
  C:\Windows\System\NZEpZgR.exe
  2⤵
  PID:8404
- C:\Windows\System\XdLmwXB.exe
  C:\Windows\System\XdLmwXB.exe
  2⤵
  PID:8424
- C:\Windows\System\ZzOxGFI.exe
  C:\Windows\System\ZzOxGFI.exe
  2⤵
  PID:8444
- C:\Windows\System\jgylglZ.exe
  C:\Windows\System\jgylglZ.exe
  2⤵
  PID:8468
- C:\Windows\System\woBsKUG.exe
  C:\Windows\System\woBsKUG.exe
  2⤵
  PID:8500
- C:\Windows\System\olKOLVr.exe
  C:\Windows\System\olKOLVr.exe
  2⤵
  PID:8520
- C:\Windows\System\vBpqBzI.exe
  C:\Windows\System\vBpqBzI.exe
  2⤵
  PID:8544
- C:\Windows\System\yQYFArc.exe
  C:\Windows\System\yQYFArc.exe
  2⤵
  PID:8568
- C:\Windows\System\nyUGpNj.exe
  C:\Windows\System\nyUGpNj.exe
  2⤵
  PID:8584
- C:\Windows\System\djsjotg.exe
  C:\Windows\System\djsjotg.exe
  2⤵
  PID:8612
- C:\Windows\System\qWOmDOB.exe
  C:\Windows\System\qWOmDOB.exe
  2⤵
  PID:8636
- C:\Windows\System\yzrXNjn.exe
  C:\Windows\System\yzrXNjn.exe
  2⤵
  PID:8656
- C:\Windows\System\CRtMNIl.exe
  C:\Windows\System\CRtMNIl.exe
  2⤵
  PID:8692
- C:\Windows\System\LWaYgsu.exe
  C:\Windows\System\LWaYgsu.exe
  2⤵
  PID:8712
- C:\Windows\System\lCctIuF.exe
  C:\Windows\System\lCctIuF.exe
  2⤵
  PID:8744
- C:\Windows\System\gNjELYa.exe
  C:\Windows\System\gNjELYa.exe
  2⤵
  PID:8772
- C:\Windows\System\MoLKRJN.exe
  C:\Windows\System\MoLKRJN.exe
  2⤵
  PID:8792
- C:\Windows\System\qMXMfCs.exe
  C:\Windows\System\qMXMfCs.exe
  2⤵
  PID:8824
- C:\Windows\System\MlZEHWV.exe
  C:\Windows\System\MlZEHWV.exe
  2⤵
  PID:8848
- C:\Windows\System\KtXIWDP.exe
  C:\Windows\System\KtXIWDP.exe
  2⤵
  PID:8868
- C:\Windows\System\uDThmEL.exe
  C:\Windows\System\uDThmEL.exe
  2⤵
  PID:8888
- C:\Windows\System\iGbXSWE.exe
  C:\Windows\System\iGbXSWE.exe
  2⤵
  PID:8904
- C:\Windows\System\esqvRXT.exe
  C:\Windows\System\esqvRXT.exe
  2⤵
  PID:8932
- C:\Windows\System\YPLYlWl.exe
  C:\Windows\System\YPLYlWl.exe
  2⤵
  PID:8952
- C:\Windows\System\HPXOsha.exe
  C:\Windows\System\HPXOsha.exe
  2⤵
  PID:8984
- C:\Windows\System\yHytlnI.exe
  C:\Windows\System\yHytlnI.exe
  2⤵
  PID:9000
- C:\Windows\System\VTKfYQS.exe
  C:\Windows\System\VTKfYQS.exe
  2⤵
  PID:9024
- C:\Windows\System\krVMEyW.exe
  C:\Windows\System\krVMEyW.exe
  2⤵
  PID:9048
- C:\Windows\System\tZrOzHP.exe
  C:\Windows\System\tZrOzHP.exe
  2⤵
  PID:9068
- C:\Windows\System\LdtRXkS.exe
  C:\Windows\System\LdtRXkS.exe
  2⤵
  PID:9084
- C:\Windows\System\yZBXuTx.exe
  C:\Windows\System\yZBXuTx.exe
  2⤵
  PID:9104
- C:\Windows\System\mafwnMc.exe
  C:\Windows\System\mafwnMc.exe
  2⤵
  PID:7120
- C:\Windows\System\YYewHIl.exe
  C:\Windows\System\YYewHIl.exe
  2⤵
  PID:6924
- C:\Windows\System\wrqKJHj.exe
  C:\Windows\System\wrqKJHj.exe
  2⤵
  PID:7432
- C:\Windows\System\DAnKMDz.exe
  C:\Windows\System\DAnKMDz.exe
  2⤵
  PID:7496
- C:\Windows\System\izylWJW.exe
  C:\Windows\System\izylWJW.exe
  2⤵
  PID:7556
- C:\Windows\System\CLHrdpa.exe
  C:\Windows\System\CLHrdpa.exe
  2⤵
  PID:7468
- C:\Windows\System\XnPpVkO.exe
  C:\Windows\System\XnPpVkO.exe
  2⤵
  PID:7956
- C:\Windows\System\GfyADZR.exe
  C:\Windows\System\GfyADZR.exe
  2⤵
  PID:8244
- C:\Windows\System\HnQsBxm.exe
  C:\Windows\System\HnQsBxm.exe
  2⤵
  PID:8396
- C:\Windows\System\NMOhqDI.exe
  C:\Windows\System\NMOhqDI.exe
  2⤵
  PID:8464
- C:\Windows\System\EiWfJoN.exe
  C:\Windows\System\EiWfJoN.exe
  2⤵
  PID:8552
- C:\Windows\System\vIJSgiE.exe
  C:\Windows\System\vIJSgiE.exe
  2⤵
  PID:7552
- C:\Windows\System\dgjvZov.exe
  C:\Windows\System\dgjvZov.exe
  2⤵
  PID:6540
- C:\Windows\System\IEzgHHM.exe
  C:\Windows\System\IEzgHHM.exe
  2⤵
  PID:8884
- C:\Windows\System\wJHbNUA.exe
  C:\Windows\System\wJHbNUA.exe
  2⤵
  PID:8916
- C:\Windows\System\YSUZCCF.exe
  C:\Windows\System\YSUZCCF.exe
  2⤵
  PID:7880
- C:\Windows\System\wRbDyhz.exe
  C:\Windows\System\wRbDyhz.exe
  2⤵
  PID:6772
- C:\Windows\System\MmGBzbU.exe
  C:\Windows\System\MmGBzbU.exe
  2⤵
  PID:8996
- C:\Windows\System\mWlPiJU.exe
  C:\Windows\System\mWlPiJU.exe
  2⤵
  PID:9076
- C:\Windows\System\hBjBBib.exe
  C:\Windows\System\hBjBBib.exe
  2⤵
  PID:9232
- C:\Windows\System\OFiLNrT.exe
  C:\Windows\System\OFiLNrT.exe
  2⤵
  PID:9260
- C:\Windows\System\vFuSuPS.exe
  C:\Windows\System\vFuSuPS.exe
  2⤵
  PID:9280
- C:\Windows\System\sdghAhr.exe
  C:\Windows\System\sdghAhr.exe
  2⤵
  PID:9300
- C:\Windows\System\LZkiMkP.exe
  C:\Windows\System\LZkiMkP.exe
  2⤵
  PID:9324
- C:\Windows\System\PDFzEwg.exe
  C:\Windows\System\PDFzEwg.exe
  2⤵
  PID:9344
- C:\Windows\System\dTMNwdo.exe
  C:\Windows\System\dTMNwdo.exe
  2⤵
  PID:9360
- C:\Windows\System\PCjpnuD.exe
  C:\Windows\System\PCjpnuD.exe
  2⤵
  PID:9384
- C:\Windows\System\XHPEuua.exe
  C:\Windows\System\XHPEuua.exe
  2⤵
  PID:9400
- C:\Windows\System\GRkySoC.exe
  C:\Windows\System\GRkySoC.exe
  2⤵
  PID:9436
- C:\Windows\System\OZLmtWe.exe
  C:\Windows\System\OZLmtWe.exe
  2⤵
  PID:9460
- C:\Windows\System\YAZRswG.exe
  C:\Windows\System\YAZRswG.exe
  2⤵
  PID:9476
- C:\Windows\System\vziKJnw.exe
  C:\Windows\System\vziKJnw.exe
  2⤵
  PID:9500
- C:\Windows\System\TNFMWCS.exe
  C:\Windows\System\TNFMWCS.exe
  2⤵
  PID:9516
- C:\Windows\System\VJKnvEq.exe
  C:\Windows\System\VJKnvEq.exe
  2⤵
  PID:9540
- C:\Windows\System\IlmZEKY.exe
  C:\Windows\System\IlmZEKY.exe
  2⤵
  PID:9560
- C:\Windows\System\GZZwRDD.exe
  C:\Windows\System\GZZwRDD.exe
  2⤵
  PID:9588
- C:\Windows\System\VwRQSxU.exe
  C:\Windows\System\VwRQSxU.exe
  2⤵
  PID:9612
- C:\Windows\System\PAIHJOJ.exe
  C:\Windows\System\PAIHJOJ.exe
  2⤵
  PID:9628
- C:\Windows\System\KNsTgKL.exe
  C:\Windows\System\KNsTgKL.exe
  2⤵
  PID:9668
- C:\Windows\System\jnYXbPT.exe
  C:\Windows\System\jnYXbPT.exe
  2⤵
  PID:9696
- C:\Windows\System\KukVRmJ.exe
  C:\Windows\System\KukVRmJ.exe
  2⤵
  PID:9724
- C:\Windows\System\idPtqHU.exe
  C:\Windows\System\idPtqHU.exe
  2⤵
  PID:9740
- C:\Windows\System\viEfWfe.exe
  C:\Windows\System\viEfWfe.exe
  2⤵
  PID:9756
- C:\Windows\System\VtjndoU.exe
  C:\Windows\System\VtjndoU.exe
  2⤵
  PID:9772
- C:\Windows\System\FWHVERq.exe
  C:\Windows\System\FWHVERq.exe
  2⤵
  PID:9792
- C:\Windows\System\mlJBVHf.exe
  C:\Windows\System\mlJBVHf.exe
  2⤵
  PID:9808
- C:\Windows\System\pifRPsP.exe
  C:\Windows\System\pifRPsP.exe
  2⤵
  PID:9836
- C:\Windows\System\AgYVpiG.exe
  C:\Windows\System\AgYVpiG.exe
  2⤵
  PID:9860
- C:\Windows\System\YoOLBnN.exe
  C:\Windows\System\YoOLBnN.exe
  2⤵
  PID:9884
- C:\Windows\System\DoAWGDu.exe
  C:\Windows\System\DoAWGDu.exe
  2⤵
  PID:9908
- C:\Windows\System\PCUzvaN.exe
  C:\Windows\System\PCUzvaN.exe
  2⤵
  PID:9924
- C:\Windows\System\tjwnHKs.exe
  C:\Windows\System\tjwnHKs.exe
  2⤵
  PID:9948
- C:\Windows\System\kNszNqV.exe
  C:\Windows\System\kNszNqV.exe
  2⤵
  PID:9968
- C:\Windows\System\hKypPYO.exe
  C:\Windows\System\hKypPYO.exe
  2⤵
  PID:9988
- C:\Windows\System\lnKEsiM.exe
  C:\Windows\System\lnKEsiM.exe
  2⤵
  PID:10016
- C:\Windows\System\PzNHEnW.exe
  C:\Windows\System\PzNHEnW.exe
  2⤵
  PID:10032
- C:\Windows\System\hkaZXaj.exe
  C:\Windows\System\hkaZXaj.exe
  2⤵
  PID:10064
- C:\Windows\System\vBaAtKP.exe
  C:\Windows\System\vBaAtKP.exe
  2⤵
  PID:10088
- C:\Windows\System\ilNWrDO.exe
  C:\Windows\System\ilNWrDO.exe
  2⤵
  PID:10112
- C:\Windows\System\oQCAKbo.exe
  C:\Windows\System\oQCAKbo.exe
  2⤵
  PID:10136
- C:\Windows\System\KRgQHur.exe
  C:\Windows\System\KRgQHur.exe
  2⤵
  PID:10152
- C:\Windows\System\iqMJaMv.exe
  C:\Windows\System\iqMJaMv.exe
  2⤵
  PID:10172
- C:\Windows\System\rPfHctB.exe
  C:\Windows\System\rPfHctB.exe
  2⤵
  PID:10196
- C:\Windows\System\GAcqYiO.exe
  C:\Windows\System\GAcqYiO.exe
  2⤵
  PID:10216
- C:\Windows\System\ekwPsQO.exe
  C:\Windows\System\ekwPsQO.exe
  2⤵
  PID:10236
- C:\Windows\System\oAfXxtW.exe
  C:\Windows\System\oAfXxtW.exe
  2⤵
  PID:6024
- C:\Windows\System\yAYDSRS.exe
  C:\Windows\System\yAYDSRS.exe
  2⤵
  PID:7232
- C:\Windows\System\yCsUbiU.exe
  C:\Windows\System\yCsUbiU.exe
  2⤵
  PID:7356
- C:\Windows\System\uZEnAYe.exe
  C:\Windows\System\uZEnAYe.exe
  2⤵
  PID:7540
- C:\Windows\System\kvwKBoH.exe
  C:\Windows\System\kvwKBoH.exe
  2⤵
  PID:8200
- C:\Windows\System\AfkQfel.exe
  C:\Windows\System\AfkQfel.exe
  2⤵
  PID:8288
- C:\Windows\System\RpbqBSC.exe
  C:\Windows\System\RpbqBSC.exe
  2⤵
  PID:7672
- C:\Windows\System\ThhkrRy.exe
  C:\Windows\System\ThhkrRy.exe
  2⤵
  PID:7448
- C:\Windows\System\elSjiQy.exe
  C:\Windows\System\elSjiQy.exe
  2⤵
  PID:8632
- C:\Windows\System\ackzbjR.exe
  C:\Windows\System\ackzbjR.exe
  2⤵
  PID:8800
- C:\Windows\System\vtOAIPs.exe
  C:\Windows\System\vtOAIPs.exe
  2⤵
  PID:8700
- C:\Windows\System\AUiOdgA.exe
  C:\Windows\System\AUiOdgA.exe
  2⤵
  PID:8144
- C:\Windows\System\JaiXZxG.exe
  C:\Windows\System\JaiXZxG.exe
  2⤵
  PID:8864
- C:\Windows\System\gowXmsf.exe
  C:\Windows\System\gowXmsf.exe
  2⤵
  PID:6620
- C:\Windows\System\ljMcCCI.exe
  C:\Windows\System\ljMcCCI.exe
  2⤵
  PID:1160
- C:\Windows\System\VqdMBfC.exe
  C:\Windows\System\VqdMBfC.exe
  2⤵
  PID:9016
- C:\Windows\System\HulpRqz.exe
  C:\Windows\System\HulpRqz.exe
  2⤵
  PID:9080
- C:\Windows\System\UpKEgLy.exe
  C:\Windows\System\UpKEgLy.exe
  2⤵
  PID:6624
- C:\Windows\System\JKwVJik.exe
  C:\Windows\System\JKwVJik.exe
  2⤵
  PID:10244
- C:\Windows\System\CgVUTqm.exe
  C:\Windows\System\CgVUTqm.exe
  2⤵
  PID:10272
- C:\Windows\System\RvDyGnf.exe
  C:\Windows\System\RvDyGnf.exe
  2⤵
  PID:10288
- C:\Windows\System\mXIwTfD.exe
  C:\Windows\System\mXIwTfD.exe
  2⤵
  PID:10308
- C:\Windows\System\XgZGYFJ.exe
  C:\Windows\System\XgZGYFJ.exe
  2⤵
  PID:10328
- C:\Windows\System\HbmkeBM.exe
  C:\Windows\System\HbmkeBM.exe
  2⤵
  PID:10348
- C:\Windows\System\Kxraoye.exe
  C:\Windows\System\Kxraoye.exe
  2⤵
  PID:10372
- C:\Windows\System\VzgCRWv.exe
  C:\Windows\System\VzgCRWv.exe
  2⤵
  PID:10396
- C:\Windows\System\biSSdrh.exe
  C:\Windows\System\biSSdrh.exe
  2⤵
  PID:10416
- C:\Windows\System\XwFmuVa.exe
  C:\Windows\System\XwFmuVa.exe
  2⤵
  PID:10440
- C:\Windows\System\QDbnxWt.exe
  C:\Windows\System\QDbnxWt.exe
  2⤵
  PID:10456
- C:\Windows\System\uNweMsi.exe
  C:\Windows\System\uNweMsi.exe
  2⤵
  PID:10476
- C:\Windows\System\UMRwqiL.exe
  C:\Windows\System\UMRwqiL.exe
  2⤵
  PID:10500
- C:\Windows\System\HwuZppQ.exe
  C:\Windows\System\HwuZppQ.exe
  2⤵
  PID:10524
- C:\Windows\System\lKljWkP.exe
  C:\Windows\System\lKljWkP.exe
  2⤵
  PID:10548
- C:\Windows\System\fnLoITP.exe
  C:\Windows\System\fnLoITP.exe
  2⤵
  PID:10568
- C:\Windows\System\cTbGsLu.exe
  C:\Windows\System\cTbGsLu.exe
  2⤵
  PID:10588
- C:\Windows\System\kwUOOHB.exe
  C:\Windows\System\kwUOOHB.exe
  2⤵
  PID:10612
- C:\Windows\System\ADelEqV.exe
  C:\Windows\System\ADelEqV.exe
  2⤵
  PID:10632
- C:\Windows\System\SeSruhy.exe
  C:\Windows\System\SeSruhy.exe
  2⤵
  PID:10656
- C:\Windows\System\advRqaD.exe
  C:\Windows\System\advRqaD.exe
  2⤵
  PID:10688
- C:\Windows\System\wTrJOOr.exe
  C:\Windows\System\wTrJOOr.exe
  2⤵
  PID:10708
- C:\Windows\System\ZozTdYv.exe
  C:\Windows\System\ZozTdYv.exe
  2⤵
  PID:10736
- C:\Windows\System\cciDfvw.exe
  C:\Windows\System\cciDfvw.exe
  2⤵
  PID:10752
- C:\Windows\System\KAXbTIA.exe
  C:\Windows\System\KAXbTIA.exe
  2⤵
  PID:10772
- C:\Windows\System\nKUCtmD.exe
  C:\Windows\System\nKUCtmD.exe
  2⤵
  PID:10792
- C:\Windows\System\jJoSOTa.exe
  C:\Windows\System\jJoSOTa.exe
  2⤵
  PID:10816
- C:\Windows\System\rbVETbP.exe
  C:\Windows\System\rbVETbP.exe
  2⤵
  PID:10836
- C:\Windows\System\rPtrUZn.exe
  C:\Windows\System\rPtrUZn.exe
  2⤵
  PID:10864
- C:\Windows\System\qXkWuAw.exe
  C:\Windows\System\qXkWuAw.exe
  2⤵
  PID:10880
- C:\Windows\System\CcRjQsF.exe
  C:\Windows\System\CcRjQsF.exe
  2⤵
  PID:10896
- C:\Windows\System\pWUCSHc.exe
  C:\Windows\System\pWUCSHc.exe
  2⤵
  PID:10912
- C:\Windows\System\EfqCLHY.exe
  C:\Windows\System\EfqCLHY.exe
  2⤵
  PID:10928
- C:\Windows\System\GazXBPN.exe
  C:\Windows\System\GazXBPN.exe
  2⤵
  PID:10944
- C:\Windows\System\ugoITca.exe
  C:\Windows\System\ugoITca.exe
  2⤵
  PID:10964
- C:\Windows\System\ONArMVA.exe
  C:\Windows\System\ONArMVA.exe
  2⤵
  PID:10992
- C:\Windows\System\faMpoCr.exe
  C:\Windows\System\faMpoCr.exe
  2⤵
  PID:11012
- C:\Windows\System\MEUKlvd.exe
  C:\Windows\System\MEUKlvd.exe
  2⤵
  PID:11032
- C:\Windows\System\qVBUoVe.exe
  C:\Windows\System\qVBUoVe.exe
  2⤵
  PID:11056
- C:\Windows\System\CKfAFsV.exe
  C:\Windows\System\CKfAFsV.exe
  2⤵
  PID:11080
- C:\Windows\System\UIgUwHH.exe
  C:\Windows\System\UIgUwHH.exe
  2⤵
  PID:11100
- C:\Windows\System\HsPBfxb.exe
  C:\Windows\System\HsPBfxb.exe
  2⤵
  PID:11128
- C:\Windows\System\xZHgoiK.exe
  C:\Windows\System\xZHgoiK.exe
  2⤵
  PID:11144
- C:\Windows\System\LHKPLFS.exe
  C:\Windows\System\LHKPLFS.exe
  2⤵
  PID:11176
- C:\Windows\System\BLIDzQe.exe
  C:\Windows\System\BLIDzQe.exe
  2⤵
  PID:11196
- C:\Windows\System\DYdKRFE.exe
  C:\Windows\System\DYdKRFE.exe
  2⤵
  PID:11212
- C:\Windows\System\nOEsBSK.exe
  C:\Windows\System\nOEsBSK.exe
  2⤵
  PID:11240
- C:\Windows\System\WUlIIAO.exe
  C:\Windows\System\WUlIIAO.exe
  2⤵
  PID:11260
- C:\Windows\System\UHzviex.exe
  C:\Windows\System\UHzviex.exe
  2⤵
  PID:9336
- C:\Windows\System\mtkszvM.exe
  C:\Windows\System\mtkszvM.exe
  2⤵
  PID:7648
- C:\Windows\System\jlrALEh.exe
  C:\Windows\System\jlrALEh.exe
  2⤵
  PID:540
- C:\Windows\System\hVlxWDv.exe
  C:\Windows\System\hVlxWDv.exe
  2⤵
  PID:7736
- C:\Windows\System\sgNRJXa.exe
  C:\Windows\System\sgNRJXa.exe
  2⤵
  PID:9428
- C:\Windows\System\EZlUUpC.exe
  C:\Windows\System\EZlUUpC.exe
  2⤵
  PID:9508
- C:\Windows\System\jvOgvdL.exe
  C:\Windows\System\jvOgvdL.exe
  2⤵
  PID:8376
- C:\Windows\System\BCPjIjG.exe
  C:\Windows\System\BCPjIjG.exe
  2⤵
  PID:8324
- C:\Windows\System\hVZbzdA.exe
  C:\Windows\System\hVZbzdA.exe
  2⤵
  PID:9748
- C:\Windows\System\GMtQSjh.exe
  C:\Windows\System\GMtQSjh.exe
  2⤵
  PID:9804
- C:\Windows\System\HokKHXB.exe
  C:\Windows\System\HokKHXB.exe
  2⤵
  PID:9848
- C:\Windows\System\EMSVxOg.exe
  C:\Windows\System\EMSVxOg.exe
  2⤵
  PID:8672
- C:\Windows\System\aZZesha.exe
  C:\Windows\System\aZZesha.exe
  2⤵
  PID:9916
- C:\Windows\System\vWClrSW.exe
  C:\Windows\System\vWClrSW.exe
  2⤵
  PID:9996
- C:\Windows\System\xfEbgFG.exe
  C:\Windows\System\xfEbgFG.exe
  2⤵
  PID:8808
- C:\Windows\System\zfWlBDF.exe
  C:\Windows\System\zfWlBDF.exe
  2⤵
  PID:10072
- C:\Windows\System\fCXgRMi.exe
  C:\Windows\System\fCXgRMi.exe
  2⤵
  PID:8880
- C:\Windows\System\OLLPTTw.exe
  C:\Windows\System\OLLPTTw.exe
  2⤵
  PID:6820
- C:\Windows\System\tEGFtQx.exe
  C:\Windows\System\tEGFtQx.exe
  2⤵
  PID:5600
- C:\Windows\System\AOFcUUK.exe
  C:\Windows\System\AOFcUUK.exe
  2⤵
  PID:7784
- C:\Windows\System\rJnClyG.exe
  C:\Windows\System\rJnClyG.exe
  2⤵
  PID:8488
- C:\Windows\System\EemRAKp.exe
  C:\Windows\System\EemRAKp.exe
  2⤵
  PID:8648
- C:\Windows\System\SLKpOJD.exe
  C:\Windows\System\SLKpOJD.exe
  2⤵
  PID:11272
- C:\Windows\System\pQHHzYA.exe
  C:\Windows\System\pQHHzYA.exe
  2⤵
  PID:11292
- C:\Windows\System\ArEZRVE.exe
  C:\Windows\System\ArEZRVE.exe
  2⤵
  PID:11316
- C:\Windows\System\soSdCeR.exe
  C:\Windows\System\soSdCeR.exe
  2⤵
  PID:11340
- C:\Windows\System\cAxEtSV.exe
  C:\Windows\System\cAxEtSV.exe
  2⤵
  PID:11364
- C:\Windows\System\UYCJxQV.exe
  C:\Windows\System\UYCJxQV.exe
  2⤵
  PID:11400
- C:\Windows\System\xSdEIMQ.exe
  C:\Windows\System\xSdEIMQ.exe
  2⤵
  PID:11428
- C:\Windows\System\hWpOnwb.exe
  C:\Windows\System\hWpOnwb.exe
  2⤵
  PID:11448
- C:\Windows\System\cIQVaSq.exe
  C:\Windows\System\cIQVaSq.exe
  2⤵
  PID:11476
- C:\Windows\System\sBrYfBj.exe
  C:\Windows\System\sBrYfBj.exe
  2⤵
  PID:11500
- C:\Windows\System\UTwdKsW.exe
  C:\Windows\System\UTwdKsW.exe
  2⤵
  PID:11524
- C:\Windows\System\leMGQhY.exe
  C:\Windows\System\leMGQhY.exe
  2⤵
  PID:11544
- C:\Windows\System\iFDMzyp.exe
  C:\Windows\System\iFDMzyp.exe
  2⤵
  PID:11568
- C:\Windows\System\fgiBjUv.exe
  C:\Windows\System\fgiBjUv.exe
  2⤵
  PID:11588
- C:\Windows\System\ZlTCHZD.exe
  C:\Windows\System\ZlTCHZD.exe
  2⤵
  PID:11612
- C:\Windows\System\UvcRDfW.exe
  C:\Windows\System\UvcRDfW.exe
  2⤵
  PID:11640
- C:\Windows\System\UBLeVcZ.exe
  C:\Windows\System\UBLeVcZ.exe
  2⤵
  PID:11660
- C:\Windows\System\qmPbMMr.exe
  C:\Windows\System\qmPbMMr.exe
  2⤵
  PID:11680
- C:\Windows\System\slOfYMs.exe
  C:\Windows\System\slOfYMs.exe
  2⤵
  PID:11708
- C:\Windows\System\hTicTPy.exe
  C:\Windows\System\hTicTPy.exe
  2⤵
  PID:11728
- C:\Windows\System\zklHlQl.exe
  C:\Windows\System\zklHlQl.exe
  2⤵
  PID:11748
- C:\Windows\System\VSXSJVN.exe
  C:\Windows\System\VSXSJVN.exe
  2⤵
  PID:11772
- C:\Windows\System\KDuYRsC.exe
  C:\Windows\System\KDuYRsC.exe
  2⤵
  PID:11792
- C:\Windows\System\dtgBOuY.exe
  C:\Windows\System\dtgBOuY.exe
  2⤵
  PID:11816
- C:\Windows\System\EeiKwAX.exe
  C:\Windows\System\EeiKwAX.exe
  2⤵
  PID:11836
- C:\Windows\System\hePuVBD.exe
  C:\Windows\System\hePuVBD.exe
  2⤵
  PID:11860
- C:\Windows\System\ouaCKNs.exe
  C:\Windows\System\ouaCKNs.exe
  2⤵
  PID:11876
- C:\Windows\System\UgadPoR.exe
  C:\Windows\System\UgadPoR.exe
  2⤵
  PID:11892
- C:\Windows\System\VQAcmam.exe
  C:\Windows\System\VQAcmam.exe
  2⤵
  PID:11912
- C:\Windows\System\AoopScO.exe
  C:\Windows\System\AoopScO.exe
  2⤵
  PID:11928
- C:\Windows\System\XbIVjkc.exe
  C:\Windows\System\XbIVjkc.exe
  2⤵
  PID:11944
- C:\Windows\System\gnRkHNQ.exe
  C:\Windows\System\gnRkHNQ.exe
  2⤵
  PID:11960
- C:\Windows\System\cKgqlUg.exe
  C:\Windows\System\cKgqlUg.exe
  2⤵
  PID:11976
- C:\Windows\System\JWAVjmk.exe
  C:\Windows\System\JWAVjmk.exe
  2⤵
  PID:12000
- C:\Windows\System\GrCgtsj.exe
  C:\Windows\System\GrCgtsj.exe
  2⤵
  PID:12020
- C:\Windows\System\cBXJoYN.exe
  C:\Windows\System\cBXJoYN.exe
  2⤵
  PID:12040
- C:\Windows\System\tEZLyuD.exe
  C:\Windows\System\tEZLyuD.exe
  2⤵
  PID:12060
- C:\Windows\System\TwxAfQu.exe
  C:\Windows\System\TwxAfQu.exe
  2⤵
  PID:12092
- C:\Windows\System\bwlaENt.exe
  C:\Windows\System\bwlaENt.exe
  2⤵
  PID:12108
- C:\Windows\System\OkcBxvU.exe
  C:\Windows\System\OkcBxvU.exe
  2⤵
  PID:12124
- C:\Windows\System\fRyzGCo.exe
  C:\Windows\System\fRyzGCo.exe
  2⤵
  PID:12144
- C:\Windows\System\HLsyRVi.exe
  C:\Windows\System\HLsyRVi.exe
  2⤵
  PID:12164
- C:\Windows\System\ubNVdwU.exe
  C:\Windows\System\ubNVdwU.exe
  2⤵
  PID:12188
- C:\Windows\System\edErvEF.exe
  C:\Windows\System\edErvEF.exe
  2⤵
  PID:12212
- C:\Windows\System\krpjqpM.exe
  C:\Windows\System\krpjqpM.exe
  2⤵
  PID:12232
- C:\Windows\System\BfKQjcj.exe
  C:\Windows\System\BfKQjcj.exe
  2⤵
  PID:12252
- C:\Windows\System\rgfbLjF.exe
  C:\Windows\System\rgfbLjF.exe
  2⤵
  PID:12272
- C:\Windows\System\GZTcxOr.exe
  C:\Windows\System\GZTcxOr.exe
  2⤵
  PID:8840
- C:\Windows\System\QyCqKVn.exe
  C:\Windows\System\QyCqKVn.exe
  2⤵
  PID:9240
- C:\Windows\System\ujazhZs.exe
  C:\Windows\System\ujazhZs.exe
  2⤵
  PID:9248
- C:\Windows\System\sErJGxw.exe
  C:\Windows\System\sErJGxw.exe
  2⤵
  PID:9316
- C:\Windows\System\kmJLFeE.exe
  C:\Windows\System\kmJLFeE.exe
  2⤵
  PID:10368
- C:\Windows\System\TYdNFrV.exe
  C:\Windows\System\TYdNFrV.exe
  2⤵
  PID:10412
- C:\Windows\System\HpwSWEj.exe
  C:\Windows\System\HpwSWEj.exe
  2⤵
  PID:9448
- C:\Windows\System\HEnKEHH.exe
  C:\Windows\System\HEnKEHH.exe
  2⤵
  PID:9484
- C:\Windows\System\TCuGqfD.exe
  C:\Windows\System\TCuGqfD.exe
  2⤵
  PID:9576
- C:\Windows\System\zZYolnb.exe
  C:\Windows\System\zZYolnb.exe
  2⤵
  PID:9620
- C:\Windows\System\MwkfCgl.exe
  C:\Windows\System\MwkfCgl.exe
  2⤵
  PID:9648
- C:\Windows\System\qFIYkep.exe
  C:\Windows\System\qFIYkep.exe
  2⤵
  PID:10788
- C:\Windows\System\dgDJITI.exe
  C:\Windows\System\dgDJITI.exe
  2⤵
  PID:9820
- C:\Windows\System\CgHFZnw.exe
  C:\Windows\System\CgHFZnw.exe
  2⤵
  PID:9880
- C:\Windows\System\pSPyqQf.exe
  C:\Windows\System\pSPyqQf.exe
  2⤵
  PID:10844
- C:\Windows\System\rupHUNB.exe
  C:\Windows\System\rupHUNB.exe
  2⤵
  PID:9984
- C:\Windows\System\rtcSiJm.exe
  C:\Windows\System\rtcSiJm.exe
  2⤵
  PID:7076
- C:\Windows\System\vnGOFvm.exe
  C:\Windows\System\vnGOFvm.exe
  2⤵
  PID:6724
- C:\Windows\System\WAxoFiq.exe
  C:\Windows\System\WAxoFiq.exe
  2⤵
  PID:6656
- C:\Windows\System\acBLkRg.exe
  C:\Windows\System\acBLkRg.exe
  2⤵
  PID:9524
- C:\Windows\System\NFpmRyy.exe
  C:\Windows\System\NFpmRyy.exe
  2⤵
  PID:8340
- C:\Windows\System\pxypxUm.exe
  C:\Windows\System\pxypxUm.exe
  2⤵
  PID:9768
- C:\Windows\System\dDuisCq.exe
  C:\Windows\System\dDuisCq.exe
  2⤵
  PID:6888
- C:\Windows\System\tlKyUws.exe
  C:\Windows\System\tlKyUws.exe
  2⤵
  PID:8704
- C:\Windows\System\wTzPmhT.exe
  C:\Windows\System\wTzPmhT.exe
  2⤵
  PID:9208
- C:\Windows\System\PwdZFEk.exe
  C:\Windows\System\PwdZFEk.exe
  2⤵
  PID:7320
- C:\Windows\System\Ciifasj.exe
  C:\Windows\System\Ciifasj.exe
  2⤵
  PID:8620
- C:\Windows\System\qnrgNmz.exe
  C:\Windows\System\qnrgNmz.exe
  2⤵
  PID:8100
- C:\Windows\System\vtBYEje.exe
  C:\Windows\System\vtBYEje.exe
  2⤵
  PID:5748
- C:\Windows\System\OSSWpgi.exe
  C:\Windows\System\OSSWpgi.exe
  2⤵
  PID:12308
- C:\Windows\System\HraZAOn.exe
  C:\Windows\System\HraZAOn.exe
  2⤵
  PID:12332
- C:\Windows\System\INckRKd.exe
  C:\Windows\System\INckRKd.exe
  2⤵
  PID:12352
- C:\Windows\System\KSAdYBS.exe
  C:\Windows\System\KSAdYBS.exe
  2⤵
  PID:12372
- C:\Windows\System\GPsknPu.exe
  C:\Windows\System\GPsknPu.exe
  2⤵
  PID:12396
- C:\Windows\System\WCvrhiz.exe
  C:\Windows\System\WCvrhiz.exe
  2⤵
  PID:12420
- C:\Windows\System\wVfotit.exe
  C:\Windows\System\wVfotit.exe
  2⤵
  PID:12440
- C:\Windows\System\viUlzzd.exe
  C:\Windows\System\viUlzzd.exe
  2⤵
  PID:12468
- C:\Windows\System\XbNMNnd.exe
  C:\Windows\System\XbNMNnd.exe
  2⤵
  PID:12492
- C:\Windows\System\qJmBgXe.exe
  C:\Windows\System\qJmBgXe.exe
  2⤵
  PID:12512
- C:\Windows\System\IBQvXFo.exe
  C:\Windows\System\IBQvXFo.exe
  2⤵
  PID:12540
- C:\Windows\System\SiTUaFx.exe
  C:\Windows\System\SiTUaFx.exe
  2⤵
  PID:12564
- C:\Windows\System\CEhMGgT.exe
  C:\Windows\System\CEhMGgT.exe
  2⤵
  PID:12596
- C:\Windows\System\npchMUq.exe
  C:\Windows\System\npchMUq.exe
  2⤵
  PID:12620
- C:\Windows\System\edZiqgt.exe
  C:\Windows\System\edZiqgt.exe
  2⤵
  PID:12644
- C:\Windows\System\WzlKLEm.exe
  C:\Windows\System\WzlKLEm.exe
  2⤵
  PID:12668
- C:\Windows\System\JYLANCf.exe
  C:\Windows\System\JYLANCf.exe
  2⤵
  PID:12684
- C:\Windows\System\NRcgVqO.exe
  C:\Windows\System\NRcgVqO.exe
  2⤵
  PID:12700
- C:\Windows\System\jBNPOJa.exe
  C:\Windows\System\jBNPOJa.exe
  2⤵
  PID:12716
- C:\Windows\System\ORpxcVI.exe
  C:\Windows\System\ORpxcVI.exe
  2⤵
  PID:12732
- C:\Windows\System\OIwKfqI.exe
  C:\Windows\System\OIwKfqI.exe
  2⤵
  PID:12748
- C:\Windows\System\tBTmJpU.exe
  C:\Windows\System\tBTmJpU.exe
  2⤵
  PID:12764
- C:\Windows\System\Rledmaj.exe
  C:\Windows\System\Rledmaj.exe
  2⤵
  PID:12780
- C:\Windows\System\MjzvoZS.exe
  C:\Windows\System\MjzvoZS.exe
  2⤵
  PID:12800
- C:\Windows\System\sOyqXmQ.exe
  C:\Windows\System\sOyqXmQ.exe
  2⤵
  PID:12816
- C:\Windows\System\KBJsMyl.exe
  C:\Windows\System\KBJsMyl.exe
  2⤵
  PID:12832
- C:\Windows\System\OySHrJi.exe
  C:\Windows\System\OySHrJi.exe
  2⤵
  PID:12848
- C:\Windows\System\ymFgdmk.exe
  C:\Windows\System\ymFgdmk.exe
  2⤵
  PID:12868
- C:\Windows\System\BJMMBKJ.exe
  C:\Windows\System\BJMMBKJ.exe
  2⤵
  PID:12888
- C:\Windows\System\SKWQiaP.exe
  C:\Windows\System\SKWQiaP.exe
  2⤵
  PID:12912
- C:\Windows\System\bXKAjqr.exe
  C:\Windows\System\bXKAjqr.exe
  2⤵
  PID:12932
- C:\Windows\System\hrVkytg.exe
  C:\Windows\System\hrVkytg.exe
  2⤵
  PID:12952
- C:\Windows\System\LfdqckP.exe
  C:\Windows\System\LfdqckP.exe
  2⤵
  PID:12976
- C:\Windows\System\xbsACDm.exe
  C:\Windows\System\xbsACDm.exe
  2⤵
  PID:13000
- C:\Windows\System\axuWmaf.exe
  C:\Windows\System\axuWmaf.exe
  2⤵
  PID:13020
- C:\Windows\System\VXqbeGL.exe
  C:\Windows\System\VXqbeGL.exe
  2⤵
  PID:12656
- C:\Windows\System\SqJFFfu.exe
  C:\Windows\System\SqJFFfu.exe
  2⤵
  PID:12856
- C:\Windows\System\kVtFUwd.exe
  C:\Windows\System\kVtFUwd.exe
  2⤵
  PID:10560
- C:\Windows\System\MdAUiNI.exe
  C:\Windows\System\MdAUiNI.exe
  2⤵
  PID:12996
- C:\Windows\System\NwwBRrP.exe
  C:\Windows\System\NwwBRrP.exe
  2⤵
  PID:13052
- C:\Windows\System\rCpNqLv.exe
  C:\Windows\System\rCpNqLv.exe
  2⤵
  PID:13056
- C:\Windows\System\ioNmkan.exe
  C:\Windows\System\ioNmkan.exe
  2⤵
  PID:10892
- C:\Windows\System\mPbljHU.exe
  C:\Windows\System\mPbljHU.exe
  2⤵
  PID:9868
- C:\Windows\System\DWOszgV.exe
  C:\Windows\System\DWOszgV.exe
  2⤵
  PID:11284
- C:\Windows\System\txRLKNt.exe
  C:\Windows\System\txRLKNt.exe
  2⤵
  PID:7132
- C:\Windows\System\QHGRlvc.exe
  C:\Windows\System\QHGRlvc.exe
  2⤵
  PID:9784
- C:\Windows\System\MOuBSLJ.exe
  C:\Windows\System\MOuBSLJ.exe
  2⤵
  PID:2680
- C:\Windows\System\bQZgzdm.exe
  C:\Windows\System\bQZgzdm.exe
  2⤵
  PID:9904
- C:\Windows\System\tXgdxXz.exe
  C:\Windows\System\tXgdxXz.exe
  2⤵
  PID:10180
- C:\Windows\System\JVuVjrN.exe
  C:\Windows\System\JVuVjrN.exe
  2⤵
  PID:7276
- C:\Windows\System\pvhGjeL.exe
  C:\Windows\System\pvhGjeL.exe
  2⤵
  PID:6012
- C:\Windows\System\RnVmQKA.exe
  C:\Windows\System\RnVmQKA.exe
  2⤵
  PID:13280
- C:\Windows\System\yoPAUIg.exe
  C:\Windows\System\yoPAUIg.exe
  2⤵
  PID:13276
- C:\Windows\System\PRPtVQG.exe
  C:\Windows\System\PRPtVQG.exe
  2⤵
  PID:8860
- C:\Windows\System\yzCqwDQ.exe
  C:\Windows\System\yzCqwDQ.exe
  2⤵
  PID:13096
- C:\Windows\System\jKoflRC.exe
  C:\Windows\System\jKoflRC.exe
  2⤵
  PID:13112
- C:\Windows\System\RAqoZGo.exe
  C:\Windows\System\RAqoZGo.exe
  2⤵
  PID:13192
- C:\Windows\System\mYySjsK.exe
  C:\Windows\System\mYySjsK.exe
  2⤵
  PID:13224
- C:\Windows\System\uQyZGVv.exe
  C:\Windows\System\uQyZGVv.exe
  2⤵
  PID:10744
- C:\Windows\System\CGQxCfk.exe
  C:\Windows\System\CGQxCfk.exe
  2⤵
  PID:10164
- C:\Windows\System\ZNsnMuT.exe
  C:\Windows\System\ZNsnMuT.exe
  2⤵
  PID:11724
- C:\Windows\System\DKuoadn.exe
  C:\Windows\System\DKuoadn.exe
  2⤵
  PID:9452
- C:\Windows\System\HLSgHgG.exe
  C:\Windows\System\HLSgHgG.exe
  2⤵
  PID:5160
- C:\Windows\System\rtjQVwj.exe
  C:\Windows\System\rtjQVwj.exe
  2⤵
  PID:9964
- C:\Windows\System\RyNFawJ.exe
  C:\Windows\System\RyNFawJ.exe
  2⤵
  PID:10596
- C:\Windows\System\baqXRXa.exe
  C:\Windows\System\baqXRXa.exe
  2⤵
  PID:11508
- C:\Windows\System\xGgGkhq.exe
  C:\Windows\System\xGgGkhq.exe
  2⤵
  PID:12660
- C:\Windows\System\xMbcFSk.exe
  C:\Windows\System\xMbcFSk.exe
  2⤵
  PID:12896
- C:\Windows\System\qZxFyqi.exe
  C:\Windows\System\qZxFyqi.exe
  2⤵
  PID:10728
- C:\Windows\System\eksjelG.exe
  C:\Windows\System\eksjelG.exe
  2⤵
  PID:11044
- C:\Windows\System\ooERjFK.exe
  C:\Windows\System\ooERjFK.exe
  2⤵
  PID:11920
- C:\Windows\System\Mkavyfs.exe
  C:\Windows\System\Mkavyfs.exe
  2⤵
  PID:13092
- C:\Windows\System\jjkedCM.exe
  C:\Windows\System\jjkedCM.exe
  2⤵
  PID:8284
- C:\Windows\System\qOGjpfq.exe
  C:\Windows\System\qOGjpfq.exe
  2⤵
  PID:12452
- C:\Windows\System\QxzHqdq.exe
  C:\Windows\System\QxzHqdq.exe
  2⤵
  PID:8784
- C:\Windows\System\NWQdpqY.exe
  C:\Windows\System\NWQdpqY.exe
  2⤵
  PID:13040
- C:\Windows\System\ePEsqIT.exe
  C:\Windows\System\ePEsqIT.exe
  2⤵
  PID:10108
- C:\Windows\System\whMTSEe.exe
  C:\Windows\System\whMTSEe.exe
  2⤵
  PID:10192
- C:\Windows\System\SQHppVZ.exe
  C:\Windows\System\SQHppVZ.exe
  2⤵
  PID:8312
- C:\Windows\System\XWXRWQz.exe
  C:\Windows\System\XWXRWQz.exe
  2⤵
  PID:13316
- C:\Windows\System\eZyQdBT.exe
  C:\Windows\System\eZyQdBT.exe
  2⤵
  PID:13332
- C:\Windows\System\BNjNNkC.exe
  C:\Windows\System\BNjNNkC.exe
  2⤵
  PID:13356
- C:\Windows\System\XyhVBnX.exe
  C:\Windows\System\XyhVBnX.exe
  2⤵
  PID:13388
- C:\Windows\System\LBzkUYc.exe
  C:\Windows\System\LBzkUYc.exe
  2⤵
  PID:13416
- C:\Windows\System\rTiixES.exe
  C:\Windows\System\rTiixES.exe
  2⤵
  PID:13436
- C:\Windows\System\yTTBpBg.exe
  C:\Windows\System\yTTBpBg.exe
  2⤵
  PID:13460
- C:\Windows\System\lheLZGu.exe
  C:\Windows\System\lheLZGu.exe
  2⤵
  PID:13488
- C:\Windows\System\rEeCsrs.exe
  C:\Windows\System\rEeCsrs.exe
  2⤵
  PID:13508
- C:\Windows\System\EfzayQC.exe
  C:\Windows\System\EfzayQC.exe
  2⤵
  PID:13532
- C:\Windows\System\EeAmlwn.exe
  C:\Windows\System\EeAmlwn.exe
  2⤵
  PID:13552
- C:\Windows\System\VpHyteg.exe
  C:\Windows\System\VpHyteg.exe
  2⤵
  PID:13572
- C:\Windows\System\KXYNBEd.exe
  C:\Windows\System\KXYNBEd.exe
  2⤵
  PID:13720
- C:\Windows\System\ghyPFaU.exe
  C:\Windows\System\ghyPFaU.exe
  2⤵
  PID:13788
- C:\Windows\System\DAMsEuo.exe
  C:\Windows\System\DAMsEuo.exe
  2⤵
  PID:13812
- C:\Windows\System\gmXqSWl.exe
  C:\Windows\System\gmXqSWl.exe
  2⤵
  PID:10508
- C:\Windows\System\VlOfUOj.exe
  C:\Windows\System\VlOfUOj.exe
  2⤵
  PID:9580
- C:\Windows\System\MVgYhQo.exe
  C:\Windows\System\MVgYhQo.exe
  2⤵
  PID:11968
- C:\Windows\System\qcqHlIM.exe
  C:\Windows\System\qcqHlIM.exe
  2⤵
  PID:12160
- C:\Windows\System\dRGxkJo.exe
  C:\Windows\System\dRGxkJo.exe
  2⤵
  PID:8140
- C:\Windows\System\ThwcYRB.exe
  C:\Windows\System\ThwcYRB.exe
  2⤵
  PID:7404
- C:\Windows\System\lmggKxm.exe
  C:\Windows\System\lmggKxm.exe
  2⤵
  PID:13300
- C:\Windows\System\VRZVhqC.exe
  C:\Windows\System\VRZVhqC.exe
  2⤵
  PID:12152
- C:\Windows\System\zZrLTrz.exe
  C:\Windows\System\zZrLTrz.exe
  2⤵
  PID:13164
- C:\Windows\System\AswQUzb.exe
  C:\Windows\System\AswQUzb.exe
  2⤵
  PID:9980
- C:\Windows\System\ZiuTupt.exe
  C:\Windows\System\ZiuTupt.exe
  2⤵
  PID:13408
- C:\Windows\System\uvPSvBK.exe
  C:\Windows\System\uvPSvBK.exe
  2⤵
  PID:9676
- C:\Windows\System\ZQyAHwB.exe
  C:\Windows\System\ZQyAHwB.exe
  2⤵
  PID:13504
- C:\Windows\System\QcuLSJi.exe
  C:\Windows\System\QcuLSJi.exe
  2⤵
  PID:13548
- C:\Windows\System\RHkGbcR.exe
  C:\Windows\System\RHkGbcR.exe
  2⤵
  PID:11756
- C:\Windows\System\ixnaaFU.exe
  C:\Windows\System\ixnaaFU.exe
  2⤵
  PID:11536
- C:\Windows\System\jaxyKdW.exe
  C:\Windows\System\jaxyKdW.exe
  2⤵
  PID:9892
- C:\Windows\System\IthSatT.exe
  C:\Windows\System\IthSatT.exe
  2⤵
  PID:12344
- C:\Windows\System\JlDJvce.exe
  C:\Windows\System\JlDJvce.exe
  2⤵
  PID:14000
- C:\Windows\System\aqhOowD.exe
  C:\Windows\System\aqhOowD.exe
  2⤵
  PID:14028
- C:\Windows\System\ySwfGyb.exe
  C:\Windows\System\ySwfGyb.exe
  2⤵
  PID:132
- C:\Windows\System\NsPAnfj.exe
  C:\Windows\System\NsPAnfj.exe
  2⤵
  PID:14140
- C:\Windows\System\SLNGINP.exe
  C:\Windows\System\SLNGINP.exe
  2⤵
  PID:14184
- C:\Windows\System\sKtBTjQ.exe
  C:\Windows\System\sKtBTjQ.exe
  2⤵
  PID:10640
- C:\Windows\System\tkcRQAj.exe
  C:\Windows\System\tkcRQAj.exe
  2⤵
  PID:13324
- C:\Windows\System\whfYFdK.exe
  C:\Windows\System\whfYFdK.exe
  2⤵
  PID:8768
- C:\Windows\System\sVOUcZy.exe
  C:\Windows\System\sVOUcZy.exe
  2⤵
  PID:8348
- C:\Windows\System\mrPlCwY.exe
  C:\Windows\System\mrPlCwY.exe
  2⤵
  PID:3608
- C:\Windows\System\VCVDlVt.exe
  C:\Windows\System\VCVDlVt.exe
  2⤵
  PID:13344
- C:\Windows\System\ZBIcwhe.exe
  C:\Windows\System\ZBIcwhe.exe
  2⤵
  PID:8708
- C:\Windows\System\iuteUZF.exe
  C:\Windows\System\iuteUZF.exe
  2⤵
  PID:12280
- C:\Windows\System\kEevgHy.exe
  C:\Windows\System\kEevgHy.exe
  2⤵
  PID:13544
- C:\Windows\System\xBoYxWc.exe
  C:\Windows\System\xBoYxWc.exe
  2⤵
  PID:13444
- C:\Windows\System\fEBjVZX.exe
  C:\Windows\System\fEBjVZX.exe
  2⤵
  PID:13780
- C:\Windows\System\wBjbxLV.exe
  C:\Windows\System\wBjbxLV.exe
  2⤵
  PID:13620
- C:\Windows\System\pzeseqt.exe
  C:\Windows\System\pzeseqt.exe
  2⤵
  PID:13688
- C:\Windows\System\cHXfRHO.exe
  C:\Windows\System\cHXfRHO.exe
  2⤵
  PID:13972
- C:\Windows\System\XiJajDG.exe
  C:\Windows\System\XiJajDG.exe
  2⤵
  PID:10716
- C:\Windows\System\eODgSIU.exe
  C:\Windows\System\eODgSIU.exe
  2⤵
  PID:13652
- C:\Windows\System\JVvMMJB.exe
  C:\Windows\System\JVvMMJB.exe
  2⤵
  PID:13680
- C:\Windows\System\jWbWqLO.exe
  C:\Windows\System\jWbWqLO.exe
  2⤵
  PID:13876
- C:\Windows\System\seWYZFU.exe
  C:\Windows\System\seWYZFU.exe
  2⤵
  PID:13892
- C:\Windows\System\vHjBpAQ.exe
  C:\Windows\System\vHjBpAQ.exe
  2⤵
  PID:14012
- C:\Windows\System\iJgZcMh.exe
  C:\Windows\System\iJgZcMh.exe
  2⤵
  PID:7996
- C:\Windows\System\GoYABbw.exe
  C:\Windows\System\GoYABbw.exe
  2⤵
  PID:9096
- C:\Windows\System\tzfJKWT.exe
  C:\Windows\System\tzfJKWT.exe
  2⤵
  PID:13348
- C:\Windows\System\mWLAxHv.exe
  C:\Windows\System\mWLAxHv.exe
  2⤵
  PID:13836
- C:\Windows\System\pHQxyxj.exe
  C:\Windows\System\pHQxyxj.exe
  2⤵
  PID:13820
- C:\Windows\System\ARmczLX.exe
  C:\Windows\System\ARmczLX.exe
  2⤵
  PID:13980
- C:\Windows\System\nUdFbNs.exe
  C:\Windows\System\nUdFbNs.exe
  2⤵
  PID:14076
- C:\Windows\System\TVJEDpy.exe
  C:\Windows\System\TVJEDpy.exe
  2⤵
  PID:14056
- C:\Windows\System\aivzJnk.exe
  C:\Windows\System\aivzJnk.exe
  2⤵
  PID:14068
- C:\Windows\System\DyisFxh.exe
  C:\Windows\System\DyisFxh.exe
  2⤵
  PID:14044
- C:\Windows\System\neKrAYi.exe
  C:\Windows\System\neKrAYi.exe
  2⤵
  PID:14092
- C:\Windows\System\pPWpmpW.exe
  C:\Windows\System\pPWpmpW.exe
  2⤵
  PID:13624
- C:\Windows\System\OEBHhwG.exe
  C:\Windows\System\OEBHhwG.exe
  2⤵
  PID:14168
- C:\Windows\System\CHBNBmH.exe
  C:\Windows\System\CHBNBmH.exe
  2⤵
  PID:14116
- C:\Windows\System\eHFnOdC.exe
  C:\Windows\System\eHFnOdC.exe
  2⤵
  PID:14120
- C:\Windows\System\diNIJKs.exe
  C:\Windows\System\diNIJKs.exe
  2⤵
  PID:14172
- C:\Windows\System\McLaQIH.exe
  C:\Windows\System\McLaQIH.exe
  2⤵
  PID:14284
- C:\Windows\System\gUGAxtU.exe
  C:\Windows\System\gUGAxtU.exe
  2⤵
  PID:10564
- C:\Windows\System\NjCfCYa.exe
  C:\Windows\System\NjCfCYa.exe
  2⤵
  PID:528
- C:\Windows\System\SmXYKPu.exe
  C:\Windows\System\SmXYKPu.exe
  2⤵
  PID:14264
- C:\Windows\System\oPqdPEY.exe
  C:\Windows\System\oPqdPEY.exe
  2⤵
  PID:11420
- C:\Windows\System\XKVaNdW.exe
  C:\Windows\System\XKVaNdW.exe
  2⤵
  PID:12884
- C:\Windows\System\Jzgqslu.exe
  C:\Windows\System\Jzgqslu.exe
  2⤵
  PID:14268
- C:\Windows\System\BhOsmqT.exe
  C:\Windows\System\BhOsmqT.exe
  2⤵
  PID:10812
- C:\Windows\System\kLDvhwr.exe
  C:\Windows\System\kLDvhwr.exe
  2⤵
  PID:3180
- C:\Windows\System\QnyFVLz.exe
  C:\Windows\System\QnyFVLz.exe
  2⤵
  PID:12120
- C:\Windows\System\ANtcaHy.exe
  C:\Windows\System\ANtcaHy.exe
  2⤵
  PID:4360
- C:\Windows\System\fciPKzs.exe
  C:\Windows\System\fciPKzs.exe
  2⤵
  PID:13084
- C:\Windows\System\mIoKczB.exe
  C:\Windows\System\mIoKczB.exe
  2⤵
  PID:12244
- C:\Windows\System\mEyrZfA.exe
  C:\Windows\System\mEyrZfA.exe
  2⤵
  PID:10536
- C:\Windows\System\BnfhRTX.exe
  C:\Windows\System\BnfhRTX.exe
  2⤵
  PID:2836
- C:\Windows\System\YpUStcY.exe
  C:\Windows\System\YpUStcY.exe
  2⤵
  PID:5108
- C:\Windows\System\CapROWy.exe
  C:\Windows\System\CapROWy.exe
  2⤵
  PID:3540
- C:\Windows\System\XqSZHFM.exe
  C:\Windows\System\XqSZHFM.exe
  2⤵
  PID:3524
- C:\Windows\System\EkRaXmp.exe
  C:\Windows\System\EkRaXmp.exe
  2⤵
  PID:13340
- C:\Windows\System\UlSGdSO.exe
  C:\Windows\System\UlSGdSO.exe
  2⤵
  PID:2452
- C:\Windows\System\KbCARKZ.exe
  C:\Windows\System\KbCARKZ.exe
  2⤵
  PID:3908
- C:\Windows\System\zVnbebZ.exe
  C:\Windows\System\zVnbebZ.exe
  2⤵
  PID:2476
- C:\Windows\System\KeLRJjc.exe
  C:\Windows\System\KeLRJjc.exe
  2⤵
  PID:2128
- C:\Windows\System\KvnSBGk.exe
  C:\Windows\System\KvnSBGk.exe
  2⤵
  PID:368
- C:\Windows\System\CVBjFKR.exe
  C:\Windows\System\CVBjFKR.exe
  2⤵
  PID:11596
- C:\Windows\System\qxuVPpw.exe
  C:\Windows\System\qxuVPpw.exe
  2⤵
  PID:10356
- C:\Windows\System\qZDygXT.exe
  C:\Windows\System\qZDygXT.exe
  2⤵
  PID:12712
- C:\Windows\System\TBqFLqU.exe
  C:\Windows\System\TBqFLqU.exe
  2⤵
  PID:6472
- C:\Windows\System\rcnbYpX.exe
  C:\Windows\System\rcnbYpX.exe
  2⤵
  PID:13740
- C:\Windows\System\IQygezN.exe
  C:\Windows\System\IQygezN.exe
  2⤵
  PID:13936
- C:\Windows\System\hungDsv.exe
  C:\Windows\System\hungDsv.exe
  2⤵
  PID:13888
- C:\Windows\System\lcCKHpV.exe
  C:\Windows\System\lcCKHpV.exe
  2⤵
  PID:13432
- C:\Windows\System\iBFRrNL.exe
  C:\Windows\System\iBFRrNL.exe
  2⤵
  PID:13640
- C:\Windows\System\xvMzhTy.exe
  C:\Windows\System\xvMzhTy.exe
  2⤵
  PID:13852
- C:\Windows\System\OGXDQvU.exe
  C:\Windows\System\OGXDQvU.exe
  2⤵
  PID:4372
- C:\Windows\System\dSGLqIG.exe
  C:\Windows\System\dSGLqIG.exe
  2⤵
  PID:13968
- C:\Windows\System\TRwWEQq.exe
  C:\Windows\System\TRwWEQq.exe
  2⤵
  PID:13844
- C:\Windows\System\PVFUFvO.exe
  C:\Windows\System\PVFUFvO.exe
  2⤵
  PID:13964
- C:\Windows\System\PSwcCGj.exe
  C:\Windows\System\PSwcCGj.exe
  2⤵
  PID:13632
- C:\Windows\System\WKaThiT.exe
  C:\Windows\System\WKaThiT.exe
  2⤵
  PID:14204
- C:\Windows\System\ZBBAfsI.exe
  C:\Windows\System\ZBBAfsI.exe
  2⤵
  PID:10052
- C:\Windows\System\QxUweZH.exe
  C:\Windows\System\QxUweZH.exe
  2⤵
  PID:12140
- C:\Windows\System\yReconn.exe
  C:\Windows\System\yReconn.exe
  2⤵
  PID:3248
- C:\Windows\System\lLAkpik.exe
  C:\Windows\System\lLAkpik.exe
  2⤵
  PID:13600
- C:\Windows\System\ContxtN.exe
  C:\Windows\System\ContxtN.exe
  2⤵
  PID:2428
- C:\Windows\System\aXJRiLN.exe
  C:\Windows\System\aXJRiLN.exe
  2⤵
  PID:4648
- C:\Windows\System\ZtxQRvT.exe
  C:\Windows\System\ZtxQRvT.exe
  2⤵
  PID:12632
- C:\Windows\System\NNrtZxv.exe
  C:\Windows\System\NNrtZxv.exe
  2⤵
  PID:9268
- C:\Windows\System\bHuKhRp.exe
  C:\Windows\System\bHuKhRp.exe
  2⤵
  PID:10008
- C:\Windows\System\znwaAwa.exe
  C:\Windows\System\znwaAwa.exe
  2⤵
  PID:13840
- C:\Windows\System\ieADNCt.exe
  C:\Windows\System\ieADNCt.exe
  2⤵
  PID:2648
- C:\Windows\System\Epkspie.exe
  C:\Windows\System\Epkspie.exe
  2⤵
  PID:13668
- C:\Windows\System\lVXQvjQ.exe
  C:\Windows\System\lVXQvjQ.exe
  2⤵
  PID:13896
- C:\Windows\System\rNdvXKE.exe
  C:\Windows\System\rNdvXKE.exe
  2⤵
  PID:9412
- C:\Windows\System\hnplAAG.exe
  C:\Windows\System\hnplAAG.exe
  2⤵
  PID:4548
- C:\Windows\System\ifQByfv.exe
  C:\Windows\System\ifQByfv.exe
  2⤵
  PID:2728
- C:\Windows\System\KrINDRP.exe
  C:\Windows\System\KrINDRP.exe
  2⤵
  PID:1528
- C:\Windows\System\pMYpygw.exe
  C:\Windows\System\pMYpygw.exe
  2⤵
  PID:4084
- C:\Windows\System\JEPPKaP.exe
  C:\Windows\System\JEPPKaP.exe
  2⤵
  PID:2688
- C:\Windows\System\exjRfFm.exe
  C:\Windows\System\exjRfFm.exe
  2⤵
  PID:8220
- C:\Windows\System\PSbmxPq.exe
  C:\Windows\System\PSbmxPq.exe
  2⤵
  PID:14236
- C:\Windows\System\cEdxXpw.exe
  C:\Windows\System\cEdxXpw.exe
  2⤵
  PID:4620
- C:\Windows\System\nzUaIZP.exe
  C:\Windows\System\nzUaIZP.exe
  2⤵
  PID:2392
- C:\Windows\System\LbcXRXO.exe
  C:\Windows\System\LbcXRXO.exe
  2⤵
  PID:1772
- C:\Windows\System\FxLrmZY.exe
  C:\Windows\System\FxLrmZY.exe
  2⤵
  PID:14052
- C:\Windows\System\vOQmZYU.exe
  C:\Windows\System\vOQmZYU.exe
  2⤵
  PID:972
- C:\Windows\System\iaDKjYl.exe
  C:\Windows\System\iaDKjYl.exe
  2⤵
  PID:3884
- C:\Windows\System\zthcACc.exe
  C:\Windows\System\zthcACc.exe
  2⤵
  PID:14200
- C:\Windows\System\TUOldjC.exe
  C:\Windows\System\TUOldjC.exe
  2⤵
  PID:14240
- C:\Windows\System\TPuhRsk.exe
  C:\Windows\System\TPuhRsk.exe
  2⤵
  PID:3928
- C:\Windows\System\ApCnJMG.exe
  C:\Windows\System\ApCnJMG.exe
  2⤵
  PID:14328
- C:\Windows\System\ohabzAa.exe
  C:\Windows\System\ohabzAa.exe
  2⤵
  PID:2384
- C:\Windows\System\LpiMyyq.exe
  C:\Windows\System\LpiMyyq.exe
  2⤵
  PID:3136
- C:\Windows\System\TeQkdXr.exe
  C:\Windows\System\TeQkdXr.exe
  2⤵
  PID:3004
- C:\Windows\System\pQcNZIz.exe
  C:\Windows\System\pQcNZIz.exe
  2⤵
  PID:2756
- C:\Windows\System\erqFKlS.exe
  C:\Windows\System\erqFKlS.exe
  2⤵
  PID:4040
- C:\Windows\System\zGdUPZG.exe
  C:\Windows\System\zGdUPZG.exe
  2⤵
  PID:3704
- C:\Windows\System\cuMGZAh.exe
  C:\Windows\System\cuMGZAh.exe
  2⤵
  PID:1784
- C:\Windows\System\lvMtEQE.exe
  C:\Windows\System\lvMtEQE.exe
  2⤵
  PID:2612
- C:\Windows\System\kjsvQGh.exe
  C:\Windows\System\kjsvQGh.exe
  2⤵
  PID:4740
- C:\Windows\System\DurmMcd.exe
  C:\Windows\System\DurmMcd.exe
  2⤵
  PID:4552
- C:\Windows\System\GdJxbLu.exe
  C:\Windows\System\GdJxbLu.exe
  2⤵
  PID:1800
- C:\Windows\System\SobOqqD.exe
  C:\Windows\System\SobOqqD.exe
  2⤵
  PID:3624
- C:\Windows\System\WEGNVNf.exe
  C:\Windows\System\WEGNVNf.exe
  2⤵
  PID:3152
- C:\Windows\System\lIoqPgH.exe
  C:\Windows\System\lIoqPgH.exe
  2⤵
  PID:872
- C:\Windows\System\WfwuYms.exe
  C:\Windows\System\WfwuYms.exe
  2⤵
  PID:10888
- C:\Windows\System\xyJmVZy.exe
  C:\Windows\System\xyJmVZy.exe
  2⤵
  PID:4948
- C:\Windows\System\piTaQaT.exe
  C:\Windows\System\piTaQaT.exe
  2⤵
  PID:2568
- C:\Windows\System\LpDcQGl.exe
  C:\Windows\System\LpDcQGl.exe
  2⤵
  PID:14228
- C:\Windows\System\fosRFnm.exe
  C:\Windows\System\fosRFnm.exe
  2⤵
  PID:13860
- C:\Windows\System\BiPlCEQ.exe
  C:\Windows\System\BiPlCEQ.exe
  2⤵
  PID:3512
- C:\Windows\System\mwaIJpc.exe
  C:\Windows\System\mwaIJpc.exe
  2⤵
  PID:2084
- C:\Windows\System\bgqfkQM.exe
  C:\Windows\System\bgqfkQM.exe
  2⤵
  PID:2720
- C:\Windows\System\NourDeb.exe
  C:\Windows\System\NourDeb.exe
  2⤵
  PID:2088
- C:\Windows\System\ZPFMzHl.exe
  C:\Windows\System\ZPFMzHl.exe
  2⤵
  PID:3536
- C:\Windows\System\iZjQmPs.exe
  C:\Windows\System\iZjQmPs.exe
  2⤵
  PID:14248
- C:\Windows\System\imATqXw.exe
  C:\Windows\System\imATqXw.exe
  2⤵
  PID:1788
- C:\Windows\System\CqBfnVd.exe
  C:\Windows\System\CqBfnVd.exe
  2⤵
  PID:11436
- C:\Windows\System\riKLJKr.exe
  C:\Windows\System\riKLJKr.exe
  2⤵
  PID:4508
- C:\Windows\System\xYcsrzu.exe
  C:\Windows\System\xYcsrzu.exe
  2⤵
  PID:12200
- C:\Windows\System\PjhxHTQ.exe
  C:\Windows\System\PjhxHTQ.exe
  2⤵
  PID:11356
- C:\Windows\System\hKBaKLS.exe
  C:\Windows\System\hKBaKLS.exe
  2⤵
  PID:3984
- C:\Windows\System\pAxzdFm.exe
  C:\Windows\System\pAxzdFm.exe
  2⤵
  PID:3188
- C:\Windows\System\WglOZAR.exe
  C:\Windows\System\WglOZAR.exe
  2⤵
  PID:13684
- C:\Windows\System\TvzkDKF.exe
  C:\Windows\System\TvzkDKF.exe
  2⤵
  PID:2016
- C:\Windows\System\pcJwZnk.exe
  C:\Windows\System\pcJwZnk.exe
  2⤵
  PID:456
- C:\Windows\System\mQiIzSe.exe
  C:\Windows\System\mQiIzSe.exe
  2⤵
  PID:2408
- C:\Windows\System\WyDfCdR.exe
  C:\Windows\System\WyDfCdR.exe
  2⤵
  PID:11424
- C:\Windows\System\JcpmDKY.exe
  C:\Windows\System\JcpmDKY.exe
  2⤵
  PID:3504
- C:\Windows\System\giiloZE.exe
  C:\Windows\System\giiloZE.exe
  2⤵
  PID:2416
- C:\Windows\System\ZKOyKSn.exe
  C:\Windows\System\ZKOyKSn.exe
  2⤵
  PID:4356
- C:\Windows\System\nIpyDiB.exe
  C:\Windows\System\nIpyDiB.exe
  2⤵
  PID:2472
- C:\Windows\System\sgkvkfg.exe
  C:\Windows\System\sgkvkfg.exe
  2⤵
  PID:4424
- C:\Windows\System\wgUkBPO.exe
  C:\Windows\System\wgUkBPO.exe
  2⤵
  PID:3892
- C:\Windows\System\XIQqNxG.exe
  C:\Windows\System\XIQqNxG.exe
  2⤵
  PID:4776
- C:\Windows\System\IXsAaWE.exe
  C:\Windows\System\IXsAaWE.exe
  2⤵
  PID:4764
- C:\Windows\System\vzJDXkZ.exe
  C:\Windows\System\vzJDXkZ.exe
  2⤵
  PID:388
- C:\Windows\System\NCxMfcM.exe
  C:\Windows\System\NCxMfcM.exe
  2⤵
  PID:3732
- C:\Windows\System\tMDleho.exe
  C:\Windows\System\tMDleho.exe
  2⤵
  PID:11788
- C:\Windows\System\LTIAwQA.exe
  C:\Windows\System\LTIAwQA.exe
  2⤵
  PID:3788
- C:\Windows\System\roxDvbx.exe
  C:\Windows\System\roxDvbx.exe
  2⤵
  PID:4504
- C:\Windows\System\ImXVEUy.exe
  C:\Windows\System\ImXVEUy.exe
  2⤵
  PID:3604
- C:\Windows\System\BsSHwsw.exe
  C:\Windows\System\BsSHwsw.exe
  2⤵
  PID:4140
- C:\Windows\System\JTxOhmF.exe
  C:\Windows\System\JTxOhmF.exe
  2⤵
  PID:2056
- C:\Windows\System\FOUspaP.exe
  C:\Windows\System\FOUspaP.exe
  2⤵
  PID:4072
- C:\Windows\System\HLQaVaC.exe
  C:\Windows\System\HLQaVaC.exe
  2⤵
  PID:14100
- C:\Windows\System\FpMcavE.exe
  C:\Windows\System\FpMcavE.exe
  2⤵
  PID:4332
- C:\Windows\System\SaUNUkK.exe
  C:\Windows\System\SaUNUkK.exe
  2⤵
  PID:2792
- C:\Windows\System\cqlGUVn.exe
  C:\Windows\System\cqlGUVn.exe
  2⤵
  PID:4500
- C:\Windows\System\taigAMG.exe
  C:\Windows\System\taigAMG.exe
  2⤵
  PID:1796
- C:\Windows\System\LZPoDtq.exe
  C:\Windows\System\LZPoDtq.exe
  2⤵
  PID:2876
- C:\Windows\System\gAYgBhL.exe
  C:\Windows\System\gAYgBhL.exe
  2⤵
  PID:4224
- C:\Windows\System\UaHdLlS.exe
  C:\Windows\System\UaHdLlS.exe
  2⤵
  PID:2624
- C:\Windows\System\jgMLarv.exe
  C:\Windows\System\jgMLarv.exe
  2⤵
  PID:2732
- C:\Windows\System\UsNQdIF.exe
  C:\Windows\System\UsNQdIF.exe
  2⤵
  PID:4208
- C:\Windows\System\TnfQUWm.exe
  C:\Windows\System\TnfQUWm.exe
  2⤵
  PID:1876
- C:\Windows\System\tLavoIJ.exe
  C:\Windows\System\tLavoIJ.exe
  2⤵
  PID:1816
- C:\Windows\System\mKhDDEg.exe
  C:\Windows\System\mKhDDEg.exe
  2⤵
  PID:2696
- C:\Windows\System\EASltnZ.exe
  C:\Windows\System\EASltnZ.exe
  2⤵
  PID:2952
- C:\Windows\System\daZPnsJ.exe
  C:\Windows\System\daZPnsJ.exe
  2⤵
  PID:1760
- C:\Windows\System\YNaTtGF.exe
  C:\Windows\System\YNaTtGF.exe
  2⤵
  PID:4476
- C:\Windows\System\azDcFvl.exe
  C:\Windows\System\azDcFvl.exe
  2⤵
  PID:4388
- C:\Windows\System\pFtnuIt.exe
  C:\Windows\System\pFtnuIt.exe
  2⤵
  PID:4988
- C:\Windows\System\RGvxQRz.exe
  C:\Windows\System\RGvxQRz.exe
  2⤵
  PID:2092
- C:\Windows\System\HsXthtY.exe
  C:\Windows\System\HsXthtY.exe
  2⤵
  PID:4464
- C:\Windows\System\IFneNkQ.exe
  C:\Windows\System\IFneNkQ.exe
  2⤵
  PID:1192
- C:\Windows\System\ciZXOvs.exe
  C:\Windows\System\ciZXOvs.exe
  2⤵
  PID:948
- C:\Windows\System\NFCOzPf.exe
  C:\Windows\System\NFCOzPf.exe
  2⤵
  PID:5272
- C:\Windows\System\qhVHbgf.exe
  C:\Windows\System\qhVHbgf.exe
  2⤵
  PID:5168
- C:\Windows\System\BxEYmCQ.exe
  C:\Windows\System\BxEYmCQ.exe
  2⤵
  PID:5340
- C:\Windows\System\VdsGkZE.exe
  C:\Windows\System\VdsGkZE.exe
  2⤵
  PID:5608
- C:\Windows\System\zWbcXlV.exe
  C:\Windows\System\zWbcXlV.exe
  2⤵
  PID:3936
- C:\Windows\System\XqxMnzm.exe
  C:\Windows\System\XqxMnzm.exe
  2⤵
  PID:5528
- C:\Windows\System\qrBCIza.exe
  C:\Windows\System\qrBCIza.exe
  2⤵
  PID:2936
- C:\Windows\System\BwNeheP.exe
  C:\Windows\System\BwNeheP.exe
  2⤵
  PID:5872
- C:\Windows\System\UeInAwF.exe
  C:\Windows\System\UeInAwF.exe
  2⤵
  PID:1032
- C:\Windows\System\mtQVDBz.exe
  C:\Windows\System\mtQVDBz.exe
  2⤵
  PID:6164
- C:\Windows\System\FsnjnVo.exe
  C:\Windows\System\FsnjnVo.exe
  2⤵
  PID:3872
- C:\Windows\System\Ycxgqqj.exe
  C:\Windows\System\Ycxgqqj.exe
  2⤵
  PID:6300
- C:\Windows\System\jarDVtN.exe
  C:\Windows\System\jarDVtN.exe
  2⤵
  PID:5740
- C:\Windows\System\lmrMRAp.exe
  C:\Windows\System\lmrMRAp.exe
  2⤵
  PID:6436
- C:\Windows\System\uzdxZtP.exe
  C:\Windows\System\uzdxZtP.exe
  2⤵
  PID:5020
- C:\Windows\System\RtLNHQP.exe
  C:\Windows\System\RtLNHQP.exe
  2⤵
  PID:6632
- C:\Windows\System\IhhAXRM.exe
  C:\Windows\System\IhhAXRM.exe
  2⤵
  PID:6824
- C:\Windows\System\MEVtlgF.exe
  C:\Windows\System\MEVtlgF.exe
  2⤵
  PID:5172
- C:\Windows\System\BGmVAlW.exe
  C:\Windows\System\BGmVAlW.exe
  2⤵
  PID:6020
- C:\Windows\System\TdiJxAg.exe
  C:\Windows\System\TdiJxAg.exe
  2⤵
  PID:6584
- C:\Windows\System\yvfHvgE.exe
  C:\Windows\System\yvfHvgE.exe
  2⤵
  PID:13496
- C:\Windows\System\YgZbZsQ.exe
  C:\Windows\System\YgZbZsQ.exe
  2⤵
  PID:3700
- C:\Windows\System\IAOCwhz.exe
  C:\Windows\System\IAOCwhz.exe
  2⤵
  PID:5504
- C:\Windows\System\sUvZeZR.exe
  C:\Windows\System\sUvZeZR.exe
  2⤵
  PID:5708
- C:\Windows\System\CJCPkhS.exe
  C:\Windows\System\CJCPkhS.exe
  2⤵
  PID:14324
- C:\Windows\System\rnElbNG.exe
  C:\Windows\System\rnElbNG.exe
  2⤵
  PID:5992
- C:\Windows\System\bcTKGuq.exe
  C:\Windows\System\bcTKGuq.exe
  2⤵
  PID:5332
- C:\Windows\System\VMUixOa.exe
  C:\Windows\System\VMUixOa.exe
  2⤵
  PID:6836
- C:\Windows\System\Lioxvdn.exe
  C:\Windows\System\Lioxvdn.exe
  2⤵
  PID:5916
- C:\Windows\System\UZogeuc.exe
  C:\Windows\System\UZogeuc.exe
  2⤵
  PID:6992
- C:\Windows\System\IFBmeTj.exe
  C:\Windows\System\IFBmeTj.exe
  2⤵
  PID:7032
- C:\Windows\System\zGnyDwS.exe
  C:\Windows\System\zGnyDwS.exe
  2⤵
  PID:1520
- C:\Windows\System\WufiuHc.exe
  C:\Windows\System\WufiuHc.exe
  2⤵
  PID:5980
- C:\Windows\System\AyOKEAN.exe
  C:\Windows\System\AyOKEAN.exe
  2⤵
  PID:5268
- C:\Windows\System\DmJfpUt.exe
  C:\Windows\System\DmJfpUt.exe
  2⤵
  PID:5380
- C:\Windows\System\XhodcNG.exe
  C:\Windows\System\XhodcNG.exe
  2⤵
  PID:7844
- C:\Windows\System\jMeVctd.exe
  C:\Windows\System\jMeVctd.exe
  2⤵
  PID:6344
- C:\Windows\System\yiVsNfE.exe
  C:\Windows\System\yiVsNfE.exe
  2⤵
  PID:5296
- C:\Windows\System\yJkFIhq.exe
  C:\Windows\System\yJkFIhq.exe
  2⤵
  PID:832
- C:\Windows\System\wOUSvSX.exe
  C:\Windows\System\wOUSvSX.exe
  2⤵
  PID:7620
- C:\Windows\System\gRIgxSL.exe
  C:\Windows\System\gRIgxSL.exe
  2⤵
  PID:5536
- C:\Windows\System\xlwVOJp.exe
  C:\Windows\System\xlwVOJp.exe
  2⤵
  PID:7144
- C:\Windows\System\YsKSTPV.exe
  C:\Windows\System\YsKSTPV.exe
  2⤵
  PID:7928
- C:\Windows\System\sZteTLs.exe
  C:\Windows\System\sZteTLs.exe
  2⤵
  PID:7408
- C:\Windows\System\LKQBvRk.exe
  C:\Windows\System\LKQBvRk.exe
  2⤵
  PID:7424
- C:\Windows\System\bugGcfd.exe
  C:\Windows\System\bugGcfd.exe
  2⤵
  PID:14280
- C:\Windows\System\sVZGSjY.exe
  C:\Windows\System\sVZGSjY.exe
  2⤵
  PID:8004
- C:\Windows\System\WhSRAFt.exe
  C:\Windows\System\WhSRAFt.exe
  2⤵
  PID:8020
- C:\Windows\System\BXTtFuh.exe
  C:\Windows\System\BXTtFuh.exe
  2⤵
  PID:8760
- C:\Windows\System\zyvnYtf.exe
  C:\Windows\System\zyvnYtf.exe
  2⤵
  PID:6728
- C:\Windows\System\KKUkbav.exe
  C:\Windows\System\KKUkbav.exe
  2⤵
  PID:4644
- C:\Windows\System\LftywRD.exe
  C:\Windows\System\LftywRD.exe
  2⤵
  PID:3780
- C:\Windows\System\nsaEozb.exe
  C:\Windows\System\nsaEozb.exe
  2⤵
  PID:6128
- C:\Windows\System\vOeTlJs.exe
  C:\Windows\System\vOeTlJs.exe
  2⤵
  PID:5252
- C:\Windows\System\uuwPPzd.exe
  C:\Windows\System\uuwPPzd.exe
  2⤵
  PID:9144
- C:\Windows\System\ZDDUwOJ.exe
  C:\Windows\System\ZDDUwOJ.exe
  2⤵
  PID:9152
- C:\Windows\System\ZNmcqtL.exe
  C:\Windows\System\ZNmcqtL.exe
  2⤵
  PID:7840
- C:\Windows\System\vcuEwba.exe
  C:\Windows\System\vcuEwba.exe
  2⤵
  PID:7256
- C:\Windows\System\etdwFCC.exe
  C:\Windows\System\etdwFCC.exe
  2⤵
  PID:9180
- C:\Windows\System\dWLxXFV.exe
  C:\Windows\System\dWLxXFV.exe
  2⤵
  PID:4288
- C:\Windows\System\YfVlgyS.exe
  C:\Windows\System\YfVlgyS.exe
  2⤵
  PID:5824
- C:\Windows\System\rxfFMVF.exe
  C:\Windows\System\rxfFMVF.exe
  2⤵
  PID:6892
- C:\Windows\System\HoaLFqY.exe
  C:\Windows\System\HoaLFqY.exe
  2⤵
  PID:4460
- C:\Windows\System\xlBvjzf.exe
  C:\Windows\System\xlBvjzf.exe
  2⤵
  PID:8304
- C:\Windows\System\NGkILqC.exe
  C:\Windows\System\NGkILqC.exe
  2⤵
  PID:7616
- C:\Windows\System\eXKDwov.exe
  C:\Windows\System\eXKDwov.exe
  2⤵
  PID:7072
- C:\Windows\System\OokBZtZ.exe
  C:\Windows\System\OokBZtZ.exe
  2⤵
  PID:7532
- C:\Windows\System\gwALFUB.exe
  C:\Windows\System\gwALFUB.exe
  2⤵
  PID:7560
- C:\Windows\System\XYSVtcU.exe
  C:\Windows\System\XYSVtcU.exe
  2⤵
  PID:3148
- C:\Windows\System\LqAhoKN.exe
  C:\Windows\System\LqAhoKN.exe
  2⤵
  PID:8052
- C:\Windows\System\NdOhxNk.exe
  C:\Windows\System\NdOhxNk.exe
  2⤵
  PID:5360
- C:\Windows\System\alfDboe.exe
  C:\Windows\System\alfDboe.exe
  2⤵
  PID:9420
- C:\Windows\System\LoEXwsF.exe
  C:\Windows\System\LoEXwsF.exe
  2⤵
  PID:5212
- C:\Windows\System\OFmRSSI.exe
  C:\Windows\System\OFmRSSI.exe
  2⤵
  PID:7872
- C:\Windows\System\fdLKLPl.exe
  C:\Windows\System\fdLKLPl.exe
  2⤵
  PID:6260
- C:\Windows\System\DxrVEat.exe
  C:\Windows\System\DxrVEat.exe
  2⤵
  PID:6044
- C:\Windows\System\HxKtIFD.exe
  C:\Windows\System\HxKtIFD.exe
  2⤵
  PID:9856
- C:\Windows\System\VeHjmLw.exe
  C:\Windows\System\VeHjmLw.exe
  2⤵
  PID:7976
- C:\Windows\System\DIaMCep.exe
  C:\Windows\System\DIaMCep.exe
  2⤵
  PID:1676
- C:\Windows\System\pWbRZCM.exe
  C:\Windows\System\pWbRZCM.exe
  2⤵
  PID:7984
- C:\Windows\System\kGXNdli.exe
  C:\Windows\System\kGXNdli.exe
  2⤵
  PID:6376
- C:\Windows\System\aWYZCpL.exe
  C:\Windows\System\aWYZCpL.exe
  2⤵
  PID:9244
- C:\Windows\System\yEGUhUj.exe
  C:\Windows\System\yEGUhUj.exe
  2⤵
  PID:7876
- C:\Windows\System\dBZTSkq.exe
  C:\Windows\System\dBZTSkq.exe
  2⤵
  PID:10392
- C:\Windows\System\YQUOevb.exe
  C:\Windows\System\YQUOevb.exe
  2⤵
  PID:2040
- C:\Windows\System\scZjEHr.exe
  C:\Windows\System\scZjEHr.exe
  2⤵
  PID:6524
- C:\Windows\System\gLVUpIh.exe
  C:\Windows\System\gLVUpIh.exe
  2⤵
  PID:6212
- C:\Windows\System\kNoJaTO.exe
  C:\Windows\System\kNoJaTO.exe
  2⤵
  PID:5472
- C:\Windows\System\uHzrIrV.exe
  C:\Windows\System\uHzrIrV.exe
  2⤵
  PID:8480
- C:\Windows\System\jcFicYh.exe
  C:\Windows\System\jcFicYh.exe
  2⤵
  PID:11048
- C:\Windows\System\cXemUKi.exe
  C:\Windows\System\cXemUKi.exe
  2⤵
  PID:11108
- C:\Windows\System\VRDPGkv.exe
  C:\Windows\System\VRDPGkv.exe
  2⤵
  PID:11156
- C:\Windows\System\paqaPaG.exe
  C:\Windows\System\paqaPaG.exe
  2⤵
  PID:11168
- C:\Windows\System\tSNLXGn.exe
  C:\Windows\System\tSNLXGn.exe
  2⤵
  PID:6000
- C:\Windows\System\paejFNj.exe
  C:\Windows\System\paejFNj.exe
  2⤵
  PID:8236
- C:\Windows\System\kLpdFGM.exe
  C:\Windows\System\kLpdFGM.exe
  2⤵
  PID:6544
- C:\Windows\System\zdksFFK.exe
  C:\Windows\System\zdksFFK.exe
  2⤵
  PID:2984
- C:\Windows\System\qHrTIbm.exe
  C:\Windows\System\qHrTIbm.exe
  2⤵
  PID:11472
- C:\Windows\System\nocqQXn.exe
  C:\Windows\System\nocqQXn.exe
  2⤵
  PID:5780
- C:\Windows\System\RlHucyS.exe
  C:\Windows\System\RlHucyS.exe
  2⤵
  PID:2996
- C:\Windows\System\wSzNduC.exe
  C:\Windows\System\wSzNduC.exe
  2⤵
  PID:11812
- C:\Windows\System\QcexBkf.exe
  C:\Windows\System\QcexBkf.exe
  2⤵
  PID:9164
- C:\Windows\System\tneqnki.exe
  C:\Windows\System\tneqnki.exe
  2⤵
  PID:6056
- C:\Windows\System\JlWkazz.exe
  C:\Windows\System\JlWkazz.exe
  2⤵
  PID:6732
- C:\Windows\System\nuYeWnV.exe
  C:\Windows\System\nuYeWnV.exe
  2⤵
  PID:7000
- C:\Windows\System\vJzpzst.exe
  C:\Windows\System\vJzpzst.exe
  2⤵
  PID:12172
- C:\Windows\System\CaYIFLx.exe
  C:\Windows\System\CaYIFLx.exe
  2⤵
  PID:6452
- C:\Windows\System\LWTtKon.exe
  C:\Windows\System\LWTtKon.exe
  2⤵
  PID:6256
- C:\Windows\System\pIWAaWG.exe
  C:\Windows\System\pIWAaWG.exe
  2⤵
  PID:9716
- C:\Windows\System\mudyCru.exe
  C:\Windows\System\mudyCru.exe
  2⤵
  PID:6648
- C:\Windows\System\uMdhRCR.exe
  C:\Windows\System\uMdhRCR.exe
  2⤵
  PID:4488
- C:\Windows\System\vfsxExA.exe
  C:\Windows\System\vfsxExA.exe
  2⤵
  PID:11488
- C:\Windows\System\bazCCVu.exe
  C:\Windows\System\bazCCVu.exe
  2⤵
  PID:12608
- C:\Windows\System\woKjySF.exe
  C:\Windows\System\woKjySF.exe
  2⤵
  PID:11552
- C:\Windows\System\njgAJoB.exe
  C:\Windows\System\njgAJoB.exe
  2⤵
  PID:6352
- C:\Windows\System\nhSEJVF.exe
  C:\Windows\System\nhSEJVF.exe
  2⤵
  PID:8072
- C:\Windows\System\WSNnBQc.exe
  C:\Windows\System\WSNnBQc.exe
  2⤵
  PID:8856
- C:\Windows\System\aogHfHN.exe
  C:\Windows\System\aogHfHN.exe
  2⤵
  PID:1172
- C:\Windows\System\WpLoRvE.exe
  C:\Windows\System\WpLoRvE.exe
  2⤵
  PID:11668
- C:\Windows\System\BOTxgMn.exe
  C:\Windows\System\BOTxgMn.exe
  2⤵
  PID:11908
- C:\Windows\System\lffvXfc.exe
  C:\Windows\System\lffvXfc.exe
  2⤵
  PID:5828
- C:\Windows\System\AKFgjMv.exe
  C:\Windows\System\AKFgjMv.exe
  2⤵
  PID:7868
- C:\Windows\System\NByPBYM.exe
  C:\Windows\System\NByPBYM.exe
  2⤵
  PID:7924
- C:\Windows\System\ZkrwhMY.exe
  C:\Windows\System\ZkrwhMY.exe
  2⤵
  PID:13184
- C:\Windows\System\GOqEokR.exe
  C:\Windows\System\GOqEokR.exe
  2⤵
  PID:13204
- C:\Windows\System\kNtKeKi.exe
  C:\Windows\System\kNtKeKi.exe
  2⤵
  PID:13236
- C:\Windows\System\hzqezmg.exe
  C:\Windows\System\hzqezmg.exe
  2⤵
  PID:5852
- C:\Windows\System\gvxxvrH.exe
  C:\Windows\System\gvxxvrH.exe
  2⤵
  PID:12384
- C:\Windows\System\IHHOxrQ.exe
  C:\Windows\System\IHHOxrQ.exe
  2⤵
  PID:7452
- C:\Windows\System\QjRBZPF.exe
  C:\Windows\System\QjRBZPF.exe
  2⤵
  PID:12500
- C:\Windows\System\hQCZDtg.exe
  C:\Windows\System\hQCZDtg.exe
  2⤵
  PID:9132
- C:\Windows\System\kexUQjR.exe
  C:\Windows\System\kexUQjR.exe
  2⤵
  PID:8992
- C:\Windows\System\JzFQEHY.exe
  C:\Windows\System\JzFQEHY.exe
  2⤵
  PID:6156
- C:\Windows\System\QaYbzar.exe
  C:\Windows\System\QaYbzar.exe
  2⤵
  PID:8788
- C:\Windows\System\EfloJlZ.exe
  C:\Windows\System\EfloJlZ.exe
  2⤵
  PID:6100
- C:\Windows\System\mfgZGpK.exe
  C:\Windows\System\mfgZGpK.exe
  2⤵
  PID:5540
- C:\Windows\System\WdhsLmA.exe
  C:\Windows\System\WdhsLmA.exe
  2⤵
  PID:13072
- C:\Windows\System\RdTYhvi.exe
  C:\Windows\System\RdTYhvi.exe
  2⤵
  PID:9872
- C:\Windows\System\SNWwrmP.exe
  C:\Windows\System\SNWwrmP.exe
  2⤵
  PID:13108
- C:\Windows\System\mZmukxO.exe
  C:\Windows\System\mZmukxO.exe
  2⤵
  PID:13148
- C:\Windows\System\xWMWAWC.exe
  C:\Windows\System\xWMWAWC.exe
  2⤵
  PID:13160
- C:\Windows\System\gunVZrb.exe
  C:\Windows\System\gunVZrb.exe
  2⤵
  PID:10076
- C:\Windows\System\TFoLEMB.exe
  C:\Windows\System\TFoLEMB.exe
  2⤵
  PID:4044
- C:\Windows\System\cxfUQwy.exe
  C:\Windows\System\cxfUQwy.exe
  2⤵
  PID:10432
- C:\Windows\System\PHmSmmP.exe
  C:\Windows\System\PHmSmmP.exe
  2⤵
  PID:12220
- C:\Windows\System\CrfCcFm.exe
  C:\Windows\System\CrfCcFm.exe
  2⤵
  PID:4316
- C:\Windows\System\SrhVOeR.exe
  C:\Windows\System\SrhVOeR.exe
  2⤵
  PID:10468
- C:\Windows\System\nRJlOjz.exe
  C:\Windows\System\nRJlOjz.exe
  2⤵
  PID:10124
- C:\Windows\System\jHQkwtz.exe
  C:\Windows\System\jHQkwtz.exe
  2⤵
  PID:3760
- C:\Windows\System\RchoWsA.exe
  C:\Windows\System\RchoWsA.exe
  2⤵
  PID:11220
- C:\Windows\System\YmlXMie.exe
  C:\Windows\System\YmlXMie.exe
  2⤵
  PID:11252
- C:\Windows\System\bzDkalz.exe
  C:\Windows\System\bzDkalz.exe
  2⤵
  PID:9688
- C:\Windows\System\uNtgPWA.exe
  C:\Windows\System\uNtgPWA.exe
  2⤵
  PID:10732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cqxab3dq.ozl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BOAxHzw.exe

Filesize
1.8MB

MD5
ef87f3344e1ff170753815c55602095d

SHA1
0b632d02a4177ffb024d1efb0d1422106bf4b75c

SHA256
84ce3495cd3100aa2d6835bc3fb989b9bbc58b1879c64e9c303b69eb277800ab

SHA512
7ce7be592555d236787cd12e728ae2934ac4ef58bae5734046efc6ff06a0ee16e36e300eedf98af50b883dde0e19c1819c78e0aa2b67d270d06a8cabf771c7f7

Download Submit
C:\Windows\System\EfJLnsc.exe

Filesize
1.8MB

MD5
2bf469de06a3694672d0159f5d4adb77

SHA1
94a04758f3e1a85e19f008dd01cc53acab55ca73

SHA256
d841f865f2b8e0438c8edaba018bf1a79e361ce4693353ba0aec5269fcbd54c1

SHA512
c5c5ce992acf07409560c447dee8cedaeec0ab65374b24ff82975dbc8ef79f0e1329ad1e22fe968286f69a3d0ebece194c2de01417aebe2c2f1076dd0decb615

Download Submit
C:\Windows\System\FImpkkQ.exe

Filesize
1.8MB

MD5
97ed3355597d673ef39a898fc20aa9e4

SHA1
638529492f977cbed82829cf08fdaa250ac6a2da

SHA256
51e157f06be64e7ab6cb4d80fd925a8d62eeae271f40ee54a23944f0d0e88c74

SHA512
387fdfa58ee89921e9b0dca70b564757ee054859b1228f4a6aed67365b9dcf8978582c5589cf32a73ac7549780e14a60302f989e1cf81a848dedb5f6e08dd3e5

Download Submit
C:\Windows\System\FjnRggU.exe

Filesize
1.8MB

MD5
77a555493076479313465c11c38505ec

SHA1
bab3d40ee729fc0a6905138a17ab951f81f28ffd

SHA256
33ac9894a2e578f5e05f01c3271875138fddea594486f3096e7f9ebcca856245

SHA512
8bf9297ff7c42fdbdc868f009508a674a43033f1d6bd43bb0dd41f1f17dae5297324c6411bfa65e6845a71744f939378168ad3847e9f94c1946d21e180641ee5

Download Submit
C:\Windows\System\GjuhcTQ.exe

Filesize
1.8MB

MD5
24911c49bb911e787a98b6f149d47a88

SHA1
27660166dc199f79c27e5f2d6c0f966abea3507e

SHA256
fcd946c0472f36536d80786abdf7d9370bfea76583e68db7e6b38af4b7039c63

SHA512
1af101f24aa94463cda0e2193b19eb204e041aaf86e1e57f743dbcb4362cfa1c834d07f389c7ee962211f42bcdd2bdecd8333daafca133ae9ee133caa49020a0

Download Submit
C:\Windows\System\HAPmGpP.exe

Filesize
1.8MB

MD5
b9524c3b1c50721d127771e0b56fa03f

SHA1
179a782afdbcc5fbf7528d8d93cd598cdecb8926

SHA256
44de2e5cf5f7ffc611c6e0bad9c901d9d88f76f07d996e917cbb261b01fbda89

SHA512
9c93c317ede228c7f0a59791634b4d7d581cea2f825b1c7a7fc39f525bced68a07374284a27cf79a87f6597b2d5a64887f5e0b9e5a07e91f1b0d1e689b59e41a

Download Submit
C:\Windows\System\HqOAoPw.exe

Filesize
1.8MB

MD5
cfc261a3d7c333e65e42c5fbcab507cd

SHA1
4e3c19e00ca25500d6bcfeeae32f06fdf9134b25

SHA256
97ce518101f24fecbd4aedabdd06bf775b51298d46cb679cd6e036bf05544cad

SHA512
00724046d6ab3db90a8a0206a3cb94ed9e9f809141cfacf8a7398dd228a04b5bb37dd39636c3bd900733192e6e6e69dee17796367db93e75c4d0fc334d291492

Download Submit
C:\Windows\System\JClIZTM.exe

Filesize
1.8MB

MD5
9baa6a6431442f8a1af7ba3345c949c5

SHA1
a4d21d565e5c833d414519c7404b4864bdf720a7

SHA256
dfd3c36427461e1fbbf8f56f1cbbadfd0241b80edaf51581e3ce3ef4b5440460

SHA512
a9e9fcf5d4d3cce2a9f6c266700e6fec7e71f61a9fb74262e8b5fbcdb6ed7bbad535e1b8ecb468b86efdc62fa7ac38a15b405cce860c90998e95da5f1f143d91

Download Submit
C:\Windows\System\KLvhEvo.exe

Filesize
1.8MB

MD5
5e5730d224bc24e2c10acfef4229b8a3

SHA1
81ba76a4fff1ba5be2292cd5c7104a5ed94ad1e7

SHA256
fa995e549801e126d74e9e1ddc7a69fd46b9a6e48eb4e939bcc2bac7b3fa144e

SHA512
b037c5d35f883d364dd459aa90e9a980d15ce7136fe651e91e41ded150c17d2ffe985fe026e4c5c6d102a4824d4fb265aa53c07f27c5ba498522870f7139c3d8

Download Submit
C:\Windows\System\KNOOqXE.exe

Filesize
1.8MB

MD5
ccb7b4801a4a05f8461e2557f7f78497

SHA1
8f5d6e68a5d935ebf60b608748d1d6bf61ace477

SHA256
8877cb7d58ec64be012ebc8134b6c1d7e2fa7e37a3406c8b37889e669c1b1204

SHA512
ac9d4f4a1a4ef8ba3f1d994e0afb012b4b1d1cfcbb9f0d01840d6d6376e174ac8b28a4b491433dba4b9dcb45bf9fc2b70e0484168d41767686de4b8488a1381d

Download Submit
C:\Windows\System\LqDxzxt.exe

Filesize
1.8MB

MD5
2b5b1183c7a606bf48db4ba4369570de

SHA1
21c10aca6a1d8b92d48f01e8804489afa51161bf

SHA256
cfabe305bb5cd8a2a57b4dc89e532a1fc2b320adc12bbc2d2861ac5a2548ac58

SHA512
46d26de525e0739551b91fab9c04a642adef02ad041b7055ed4c4fea8e46a3df044558e450518e6e5b0c1c5556b55259a58403c2923b2a9f76422edb2f1f9579

Download Submit
C:\Windows\System\MjjrSvu.exe

Filesize
8B

MD5
da845550a975937159e66fa37f10ff6c

SHA1
e5cb4ac51083947d2e1c0e8348ae113bcebb4831

SHA256
a36bd8af622126db3772aa5f26c44677cc6d4725b09ba5540d0176a0abfd5c23

SHA512
678a6b78d5e2d41a650bcfcd42a4eb6fe0bcbb968ffad649d881fc75a3b6d30d02a56ff281cc12259e0bb2d93dffb16f61a5d132288c4914dcfb86329aa4ae28

Download Submit
C:\Windows\System\OdnvHIX.exe

Filesize
1.8MB

MD5
102b400a4134711bc47d5ef8d9410c78

SHA1
e6ca991ced9a1533975a2a7254dc884925a4ac7c

SHA256
2a95873f514ba16b6efe09dc124df1b141d8bbfeeddebdd5d3f94f88d4b69480

SHA512
80027e6077b71f6686409baee80eec1d045339ffefb3fa4d61d5ff8a3d644fa08798f89a861607f740cdda4038a40b7e166ea30d251cbfde37370b351864a2e8

Download Submit
C:\Windows\System\UjxBKkF.exe

Filesize
1.8MB

MD5
e5dd6cb8cae40b87932b030768b5a2a9

SHA1
03442784f1d2fa4d5a41a1b216565992ad5f81bb

SHA256
018ed909587183899c31ef0834ad022d3c2c35641c36692dccc5b7c9bc3b7f15

SHA512
ac62b10ad11bd1839c3619aca8c0892896e0da2805ddbc172b3c29c26c33fe4bfb695cb25c531ae3142ce7272a7c79c9190d4dd31673a6501357f73ec8e8aaac

Download Submit
C:\Windows\System\VCKwJZO.exe

Filesize
1.8MB

MD5
1bf8b66c9b0067d5054a9e21db975e83

SHA1
719bba9700e865ee1bbc4a684c67952efcfcd940

SHA256
8d9be9813b5dcca88dc0f34555a3c7ddb57ea781b56e2e5d38cb72b9bdc79f7d

SHA512
afdada0b22233595df34c6d3c20d984fd545c22b6c525049ac540d8366cab74e7217e986f8506e64e6f3e30e1ccfc6a64a277c3165ac12e528b3eac90f219bf4

Download Submit
C:\Windows\System\WTPruEy.exe

Filesize
1.8MB

MD5
64ae960e9bd48da8f5a3419a0d1a8e99

SHA1
18912fdc09d073405e1a90c6f8f309b2755fe8c0

SHA256
a8b6329e4845ab6c4e9a9f789d0ddeb8d59709a4c54fc70ed9cc4fdf037ff6ae

SHA512
f4b174d0284753d150fd0f48b15690d1ac136ada9822e7b3a347e93c48987234c440893b5401b7afcce8061c567d7db9edc637c1af20cce8c94dff5f4cac0afa

Download Submit
C:\Windows\System\WcXpylK.exe

Filesize
1.8MB

MD5
14c9804d1eef03b8c0f20a3e6d0787f7

SHA1
3521c5321c748af5b3e4e4bc05a016d180a9ba89

SHA256
63380221cba002df90fda158f8ce2fd700f02e0a5829b8883c1b791f4eda5dba

SHA512
30e54993ee6ee1e0942ca170b279c3b8b2d393a564d0906bdc14075695737d393fedd1b3c375d0254333102c898a8deb21e8ada45d93509b7a7fd5923de5e946

Download Submit
C:\Windows\System\XIGWdeC.exe

Filesize
1.8MB

MD5
a1e8d963f911c97b0123bdda3290a2e0

SHA1
96bdafd6536ba72112aeed9ec8ca8cf0e35e4df4

SHA256
5987dbdb570cd7505dec9eb2a17b22548213ba534270ff72f2254e4bd9732e63

SHA512
93a310861be289c655767fdfd3da845f1d9643902cd2a69d6d8c3811f4ad227e28f48af94536ecd7537dca6b026e58b4cccca11ce3a8762cca0f24594981bf7b

Download Submit
C:\Windows\System\XvtrUzx.exe

Filesize
1.8MB

MD5
95d2aff29c08b6f31556b22a33f7cc64

SHA1
fd19e74680f17b83c0a8efa6a399a82e6adcffe1

SHA256
a1fb4076e4b603ed699b456b8dda6a32bd541d6cd70fca6e5e66a5a4be6ed211

SHA512
9bd79c10d507f2ab0fdc7a89477fe9a4306e80fb9434cb3653daff171a5b7f5d26bae5298433765b5902541269ccef28e37155bb269d8939f34593322cb3b1a3

Download Submit
C:\Windows\System\YwIVbeo.exe

Filesize
1.8MB

MD5
0ecd52a67c0b229ab0a14924061f4513

SHA1
663798e612eedf18a2ee57d858741473383edfe6

SHA256
05b36e4f4be7189cd93155ed060e5b4dddcefe7688c555d3fd457ad750e90a73

SHA512
29d6afc79ac4ebf31b16d4f5277cfad9a7a982ba24e362d5f6bc40fa45ce3ee3f2b2fbc6550ef4104a3cb57201fa315f328d465f06b39dc1c2321b731ac071ed

Download Submit
C:\Windows\System\ZCsrJeY.exe

Filesize
1.8MB

MD5
176b121657fa437b891e2df5e8771b1d

SHA1
85e55fb5eb7dc49f453f5d9bb126711510be6b96

SHA256
87df872f066e76d872455f3ab880a3d624212395d23d13ee2c8165823fd4f172

SHA512
de2a4c6da446e14ba59864ab41d8a6147fde030311838ff233fabd8fd8c7d3cdc3c65def5a585fae9fdd8f526bfde7b88ee458e791cb2399da19159bebc82636

Download Submit
C:\Windows\System\bBDZWXQ.exe

Filesize
1.8MB

MD5
d3d9ead4f3894241566e421c18e7ab23

SHA1
4635327e54940ea71e8263ef26b02c9cfe077aaa

SHA256
4172a42c2130852928df8f3b95020503bb2c15c5d43795aaad355b1260977623

SHA512
ccbb2d11d0917821f72b43ff8676f029b3fc0aa9ec6930de40a8317e4c7aa07243eceeedeaaecdcdb1f4d8b6e5dd6f5992101f7089105aa618025c7f16ecd027

Download Submit
C:\Windows\System\eSLiLOE.exe

Filesize
1.8MB

MD5
d07b954cb9a87f4aeefc825718baff7c

SHA1
f101ebb177717e830349292e7c2a1d27a44db2ec

SHA256
9721a5563dc797177be264041d084f81cb42d8ded15f558789a01fb2d03727a3

SHA512
da6d412ea875628166e40947cf9cca77d741bf497e2c1762ca4c5562bebf183bdd1edd848633958fb763c30cb0203e69943dba665374a7da3797ed3daa6f2331

Download Submit
C:\Windows\System\euPdUWw.exe

Filesize
1.8MB

MD5
549cae9a6c9d24c86d2e555438cb8b43

SHA1
4bcd810412f3a40839739e3a01ae710039a7f9ea

SHA256
7400880a430c3b1c195c108935f11476ab078629ff756556acb14d44c6119d03

SHA512
b2bc0e07ad067e91a02c760b7567d3cbab6c5c3752101edc207a2bed8123029c852586ca9e47b6b62cdcbade76cd6eda9ad768e2398922a8850fadba51a3381c

Download Submit
C:\Windows\System\gbDgtSV.exe

Filesize
1.8MB

MD5
6a994011606d230d90d5446a78654594

SHA1
3f7554aed3b4bd73b6697557739f950f21278c6e

SHA256
675a3507ca759272b31bfc0a688e8d45b7e82dd291f04f754baec596feaafbc1

SHA512
91ca0c2e08998c2edeea266f52f979141fea8cedb8c177c607a3ba1561636526dcda149a9aacfc01e8ecb1cc89908a621ef5ba8f3b494bb965d5e9a74074f280

Download Submit
C:\Windows\System\hIZvvDE.exe

Filesize
1.8MB

MD5
470445285f81c09314e8a4801cf3b051

SHA1
abb29f41cc52c8aadf032aecfdfb84cacd712667

SHA256
6aa89e4eefc87985010787c74150999757e39beab432ae5c33cec7222bf9219d

SHA512
0bd846e01dec7b745d3cc4225ef1a03ada5fead462abfc0e71e26f245d4cd85f6c11cb2a1371f77600c991e8411aed48694344ff999948fd13212572c83b1cb0

Download Submit
C:\Windows\System\hgqODkg.exe

Filesize
1.8MB

MD5
873d49b37057566173a4abf562effc9d

SHA1
a2c24d0396c2b942bfe0190ba50ebff5e11b810d

SHA256
27f09d0a7b2c2bbb2220003253e0fccdabc30fe6593fd485b0444609dd332db4

SHA512
3aa6c6383ef98515694202051175df608827358562a820fbf1596e70b47829910603eeaebe6fb044cf4bfd79146eb104c59f07b53bdc17846e0af732e91c751a

Download Submit
C:\Windows\System\iFpmkqW.exe

Filesize
1.8MB

MD5
81887739e447dea4290acc1e121d1ee5

SHA1
eaf617690d9bb5dec068078055203bb0a08c50e9

SHA256
fe48bc3b9cbe5e0581bceddc08ed9c4ba33be48ed9471b95bd34f031735b89ee

SHA512
c1e1782ebcb7523ecadf17e7b74d05548cf4f07cc2a296468fe58200dd5e34591de469b08d25ea6b16740f7272e35e7992ea0829d1cb2a523d8ed75dee5817c6

Download Submit
C:\Windows\System\iXelnue.exe

Filesize
1.8MB

MD5
90bc965e1239241e2618e721987705c2

SHA1
1859487b16e79f2ac2d00c31388300f88bbc2a4d

SHA256
f5d29e816f636a0b4f811e177a75f33a26968b13c52637fec6720368af571764

SHA512
fb4026f737d883835bd3f214eef68249907dc39a63fd508ded6a52d61c9195e321b5d658c7bdca9384e1118bc66534f1a4df60e410e70a62ae9fbacc88cb22ab

Download Submit
C:\Windows\System\ixsrkzc.exe

Filesize
1.8MB

MD5
30f035f52106a69527cbca27e2dcc919

SHA1
db3d28732189ef52b21b7a88e8fac1cd0aa4b85b

SHA256
b08486be331c9231b51f1baee55d0d3c50b0efe3c838abc6d6204e66eb7e3cbb

SHA512
877156221891d91e90ad40ed7c95c6cc1e8b0b26c2cbba477814787592b590986f6b0be833b27f6779e76bd72a777324829a4c26bccd001da65721cb3f502827

Download Submit
C:\Windows\System\nhEfCKF.exe

Filesize
1.8MB

MD5
60dad0214378fc9f381f6743f0dbe74a

SHA1
37af47b96c4b3cfa5b3ff8640dfbac9b5cca4f54

SHA256
d75260f591158a471477cbe0d65e8755200500843e28f05703e0c82909ecb287

SHA512
a1374c7306da90f5b43ef3c07b2ff18f2213f14d6442e0c6136b7a78970d6d30061b1cf2c4d2dd6c2d2974d92ced905aafd1b2c06b2230a4f9dc3130ca71aaf3

Download Submit
C:\Windows\System\nzKFpej.exe

Filesize
1.8MB

MD5
fde72dd41923789cea504c843517132c

SHA1
525d866223097e50c480da55afc616ad86b61cbb

SHA256
df06921ae5be111a73ae6d80164781d1b07bf0a79370b79e8dc50a2b99bda8ff

SHA512
ffe9bad8830545f86c145c8575449a05f5ee1fec72f571d6db1cb6d1481ffb28af5f33b0298462078dd726b9ca6316b350a67c5cd06d4d92da9041dabb51087c

Download Submit
C:\Windows\System\pvUJohh.exe

Filesize
1.8MB

MD5
d6aff1ce3b24f1c0dfa1bd24c5aefb27

SHA1
f8ac3cf92f4a3ab4e2bd1b949798daf020504dcd

SHA256
facb58ad49f8ff5a4396090fc99df64cb0b78a975f4848a035adbf7ba2d7faad

SHA512
2980437e206fc06071ea5c6d986d73758499eb3c6042f62861474a110ae1be36279bdfaca328e7796b4c1b405f8b887bc5bf6c6aa675b69680c26a6d61d6fc8c

Download Submit
C:\Windows\System\qyWtOVv.exe

Filesize
1.8MB

MD5
28c885cc8c44283f7ffb145facb5b046

SHA1
bcbb68b826855872549ba17a78f7a112ba4cdb4e

SHA256
344eb0669c052e684c4eed4d574d8222bca3d582209e581adb07fb0125174ba5

SHA512
8585330b4f8197fa00820b91400fe0467ba4821ec501663d3c0046b95f7cff9deb72c96df6860c7d9f5d5a28731272189fcb972ed1ea5262aba3e5530fa241ea

Download Submit
C:\Windows\System\syDZZLk.exe

Filesize
1.8MB

MD5
d0ad48066cff3c4feed4c460d4255d26

SHA1
b8c60757d281fef794e700de90c442d262962676

SHA256
65bcc5254d670325a6d168616384c2ffa46892caee485e9d734a84647d6e263f

SHA512
e1c2b4c68617e5c0a523684f187a8eb0ca024b138e12215385f2dde404865f20c259215bfec5948ae3a19353dd6084f0670bab537cb184c055c73623f620d6c4

Download Submit
C:\Windows\System\wCLhkVh.exe

Filesize
1.8MB

MD5
d97544615a09077f656079cdfd186969

SHA1
96a15b9a5b01338f965a9fa835feaf1d1e762e7b

SHA256
2a16c36d0f7a0302eabbe2ecf9f9aa14cf52b727bfd9ce22e3a3397f70acac84

SHA512
a326895e6a90a46b2522808d7a2f7aae496bccb76604686c7dc78ffaea509d456bfe9f483ec9e19e25e6ef7aff4ebc642261d98bdd5a62ee8a264c121a099228

Download Submit
C:\Windows\System\wtxpXSs.exe

Filesize
1.8MB

MD5
2b593d66793efaec0fe08311708b659f

SHA1
05f1ab9d619453b9991c699caf6267903ba0b694

SHA256
187403e8000869973fe5b347bb1416302d9edfb71bd34061ce8dff05c3154d5d

SHA512
0877df16958b8eb0f9a772286cf03da2d47f51f147736f548c9c8e46445160e806bc5340f468297b7b2b350e591be92ef58566e0861119aec3b1b2e4128f87ff

Download Submit
C:\Windows\System\yEhbNQT.exe

Filesize
1.8MB

MD5
ac420c6c3439a78b8a977ec541961c91

SHA1
720ea6581415a4f3384b01c5620391ddb4336a3a

SHA256
2fec5bba55c24fd561a513453c14d4a7e616627c542ba1b59f6f162c9e1d0bb5

SHA512
e510dfecb7f19fad322f396c4324bbeef0e6bbe6ed7325918ca015948b542a6b893aa94bcfe519825e15c69a39fae7a54ae06c25cddd2e10b1ed6a8735b35bfd

Download Submit
memory/208-48-0x00007FF7DFAA0000-0x00007FF7DFE92000-memory.dmp

Filesize
3.9MB

Download
memory/208-6083-0x00007FF7DFAA0000-0x00007FF7DFE92000-memory.dmp

Filesize
3.9MB

Download
memory/532-6099-0x00007FF735B80000-0x00007FF735F72000-memory.dmp

Filesize
3.9MB

Download
memory/532-132-0x00007FF735B80000-0x00007FF735F72000-memory.dmp

Filesize
3.9MB

Download
memory/592-6073-0x00007FF6A8D60000-0x00007FF6A9152000-memory.dmp

Filesize
3.9MB

Download
memory/592-31-0x00007FF6A8D60000-0x00007FF6A9152000-memory.dmp

Filesize
3.9MB

Download
memory/1100-0-0x00007FF6D9F20000-0x00007FF6DA312000-memory.dmp

Filesize
3.9MB

Download
memory/1100-1-0x000001EB758A0000-0x000001EB758B0000-memory.dmp

Filesize
64KB

Download
memory/1540-126-0x00007FF60A200000-0x00007FF60A5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-6117-0x00007FF60A200000-0x00007FF60A5F2000-memory.dmp

Filesize
3.9MB

Download
memory/1568-233-0x000001F8AE1E0000-0x000001F8AE986000-memory.dmp

Filesize
7.6MB

Download
memory/1568-161-0x000001F8ACAC0000-0x000001F8ACAE2000-memory.dmp

Filesize
136KB

Download
memory/1912-141-0x00007FF72F350000-0x00007FF72F742000-memory.dmp

Filesize
3.9MB

Download
memory/1912-6093-0x00007FF72F350000-0x00007FF72F742000-memory.dmp

Filesize
3.9MB

Download
memory/1920-6111-0x00007FF65DE80000-0x00007FF65E272000-memory.dmp

Filesize
3.9MB

Download
memory/1920-143-0x00007FF65DE80000-0x00007FF65E272000-memory.dmp

Filesize
3.9MB

Download
memory/2036-6121-0x00007FF75E120000-0x00007FF75E512000-memory.dmp

Filesize
3.9MB

Download
memory/2036-133-0x00007FF75E120000-0x00007FF75E512000-memory.dmp

Filesize
3.9MB

Download
memory/2044-6123-0x00007FF6AEF30000-0x00007FF6AF322000-memory.dmp

Filesize
3.9MB

Download
memory/2044-109-0x00007FF6AEF30000-0x00007FF6AF322000-memory.dmp

Filesize
3.9MB

Download
memory/2312-6084-0x00007FF6BCAE0000-0x00007FF6BCED2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-36-0x00007FF6BCAE0000-0x00007FF6BCED2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-6129-0x00007FF7EFE80000-0x00007FF7F0272000-memory.dmp

Filesize
3.9MB

Download
memory/2860-145-0x00007FF7EFE80000-0x00007FF7F0272000-memory.dmp

Filesize
3.9MB

Download
memory/3156-6119-0x00007FF72ACB0000-0x00007FF72B0A2000-memory.dmp

Filesize
3.9MB

Download
memory/3156-139-0x00007FF72ACB0000-0x00007FF72B0A2000-memory.dmp

Filesize
3.9MB

Download
memory/3492-90-0x00007FF7F6400000-0x00007FF7F67F2000-memory.dmp

Filesize
3.9MB

Download
memory/3492-6113-0x00007FF7F6400000-0x00007FF7F67F2000-memory.dmp

Filesize
3.9MB

Download
memory/3584-101-0x00007FF620B90000-0x00007FF620F82000-memory.dmp

Filesize
3.9MB

Download
memory/3584-6125-0x00007FF620B90000-0x00007FF620F82000-memory.dmp

Filesize
3.9MB

Download
memory/3600-140-0x00007FF7F0A70000-0x00007FF7F0E62000-memory.dmp

Filesize
3.9MB

Download
memory/3600-6090-0x00007FF7F0A70000-0x00007FF7F0E62000-memory.dmp

Filesize
3.9MB

Download
memory/3808-138-0x00007FF76C3D0000-0x00007FF76C7C2000-memory.dmp

Filesize
3.9MB

Download
memory/3808-6126-0x00007FF76C3D0000-0x00007FF76C7C2000-memory.dmp

Filesize
3.9MB

Download
memory/4088-6107-0x00007FF600360000-0x00007FF600752000-memory.dmp

Filesize
3.9MB

Download
memory/4088-119-0x00007FF600360000-0x00007FF600752000-memory.dmp

Filesize
3.9MB

Download
memory/4168-137-0x00007FF6ED260000-0x00007FF6ED652000-memory.dmp

Filesize
3.9MB

Download
memory/4168-6115-0x00007FF6ED260000-0x00007FF6ED652000-memory.dmp

Filesize
3.9MB

Download
memory/4352-142-0x00007FF628630000-0x00007FF628A22000-memory.dmp

Filesize
3.9MB

Download
memory/4352-6095-0x00007FF628630000-0x00007FF628A22000-memory.dmp

Filesize
3.9MB

Download
memory/4416-146-0x00007FF6319F0000-0x00007FF631DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4416-6131-0x00007FF6319F0000-0x00007FF631DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4436-6103-0x00007FF7AD6E0000-0x00007FF7ADAD2000-memory.dmp

Filesize
3.9MB

Download
memory/4436-144-0x00007FF7AD6E0000-0x00007FF7ADAD2000-memory.dmp

Filesize
3.9MB

Download
memory/4528-134-0x00007FF66C770000-0x00007FF66CB62000-memory.dmp

Filesize
3.9MB

Download
memory/4528-6101-0x00007FF66C770000-0x00007FF66CB62000-memory.dmp

Filesize
3.9MB

Download
memory/4556-6105-0x00007FF65D5A0000-0x00007FF65D992000-memory.dmp

Filesize
3.9MB

Download
memory/4556-125-0x00007FF65D5A0000-0x00007FF65D992000-memory.dmp

Filesize
3.9MB

Download
memory/4868-6087-0x00007FF79E230000-0x00007FF79E622000-memory.dmp

Filesize
3.9MB

Download
memory/4868-88-0x00007FF79E230000-0x00007FF79E622000-memory.dmp

Filesize
3.9MB

Download
memory/4868-5420-0x00007FF79E230000-0x00007FF79E622000-memory.dmp

Filesize
3.9MB

Download
memory/5112-110-0x00007FF753DC0000-0x00007FF7541B2000-memory.dmp

Filesize
3.9MB

Download
memory/5112-6109-0x00007FF753DC0000-0x00007FF7541B2000-memory.dmp

Filesize
3.9MB

Download