xmrig | a08b81fca74f535bedeaf4d8e0b23a5e4ef10e4bf327eaf9eb3ee0b25864a1c6

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
Size

1.8MB
MD5

c11337c76446143004c4363e62e3bd50
SHA1

5ae01fb2d5bf2b18e0b235cb9f2c26f1d549dc27
SHA256

a08b81fca74f535bedeaf4d8e0b23a5e4ef10e4bf327eaf9eb3ee0b25864a1c6
SHA512

cec3208b1ba62ccbe636aa6103fedf77779c89d2608293cd7ba19b53c7feacd8ee90c891b4ea46660281ff8dd97853df5c44764981d8fe1e6f4777ccab4fa190
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl0a:NAB2

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3916-393-0x00007FF6F34E0000-0x00007FF6F38D2000-memory.dmp	xmrig
behavioral2/memory/1036-474-0x00007FF6CF340000-0x00007FF6CF732000-memory.dmp	xmrig
behavioral2/memory/1520-498-0x00007FF6B4B30000-0x00007FF6B4F22000-memory.dmp	xmrig
behavioral2/memory/4456-500-0x00007FF79C280000-0x00007FF79C672000-memory.dmp	xmrig
behavioral2/memory/2276-503-0x00007FF764E00000-0x00007FF7651F2000-memory.dmp	xmrig
behavioral2/memory/2244-506-0x00007FF6D0860000-0x00007FF6D0C52000-memory.dmp	xmrig
behavioral2/memory/1064-507-0x00007FF6C5A90000-0x00007FF6C5E82000-memory.dmp	xmrig
behavioral2/memory/4692-505-0x00007FF75D670000-0x00007FF75DA62000-memory.dmp	xmrig
behavioral2/memory/1052-504-0x00007FF6FA0E0000-0x00007FF6FA4D2000-memory.dmp	xmrig
behavioral2/memory/3872-502-0x00007FF625260000-0x00007FF625652000-memory.dmp	xmrig
behavioral2/memory/4984-501-0x00007FF60E9A0000-0x00007FF60ED92000-memory.dmp	xmrig
behavioral2/memory/2716-499-0x00007FF636070000-0x00007FF636462000-memory.dmp	xmrig
behavioral2/memory/4436-497-0x00007FF7A7B20000-0x00007FF7A7F12000-memory.dmp	xmrig
behavioral2/memory/2592-473-0x00007FF7CB820000-0x00007FF7CBC12000-memory.dmp	xmrig
behavioral2/memory/4252-330-0x00007FF7685E0000-0x00007FF7689D2000-memory.dmp	xmrig
behavioral2/memory/2972-323-0x00007FF752A50000-0x00007FF752E42000-memory.dmp	xmrig
behavioral2/memory/3868-282-0x00007FF791300000-0x00007FF7916F2000-memory.dmp	xmrig
behavioral2/memory/4896-280-0x00007FF77D110000-0x00007FF77D502000-memory.dmp	xmrig
behavioral2/memory/2736-240-0x00007FF6D8760000-0x00007FF6D8B52000-memory.dmp	xmrig
behavioral2/memory/2356-198-0x00007FF632EC0000-0x00007FF6332B2000-memory.dmp	xmrig
behavioral2/memory/1020-191-0x00007FF63A030000-0x00007FF63A422000-memory.dmp	xmrig
behavioral2/memory/4056-160-0x00007FF7C6700000-0x00007FF7C6AF2000-memory.dmp	xmrig
behavioral2/memory/1716-112-0x00007FF79B7E0000-0x00007FF79BBD2000-memory.dmp	xmrig
behavioral2/memory/3156-53-0x00007FF70C650000-0x00007FF70CA42000-memory.dmp	xmrig
behavioral2/memory/2276-3192-0x00007FF764E00000-0x00007FF7651F2000-memory.dmp	xmrig
behavioral2/memory/3156-3195-0x00007FF70C650000-0x00007FF70CA42000-memory.dmp	xmrig
behavioral2/memory/4056-3196-0x00007FF7C6700000-0x00007FF7C6AF2000-memory.dmp	xmrig
behavioral2/memory/1716-3202-0x00007FF79B7E0000-0x00007FF79BBD2000-memory.dmp	xmrig
behavioral2/memory/1020-3200-0x00007FF63A030000-0x00007FF63A422000-memory.dmp	xmrig
behavioral2/memory/4252-3204-0x00007FF7685E0000-0x00007FF7689D2000-memory.dmp	xmrig
behavioral2/memory/2736-3199-0x00007FF6D8760000-0x00007FF6D8B52000-memory.dmp	xmrig
behavioral2/memory/1052-3209-0x00007FF6FA0E0000-0x00007FF6FA4D2000-memory.dmp	xmrig
behavioral2/memory/2972-3210-0x00007FF752A50000-0x00007FF752E42000-memory.dmp	xmrig
behavioral2/memory/4896-3212-0x00007FF77D110000-0x00007FF77D502000-memory.dmp	xmrig
behavioral2/memory/2356-3207-0x00007FF632EC0000-0x00007FF6332B2000-memory.dmp	xmrig
behavioral2/memory/4692-3214-0x00007FF75D670000-0x00007FF75DA62000-memory.dmp	xmrig
behavioral2/memory/1036-3216-0x00007FF6CF340000-0x00007FF6CF732000-memory.dmp	xmrig
behavioral2/memory/3868-3220-0x00007FF791300000-0x00007FF7916F2000-memory.dmp	xmrig
behavioral2/memory/4436-3219-0x00007FF7A7B20000-0x00007FF7A7F12000-memory.dmp	xmrig
behavioral2/memory/4456-3225-0x00007FF79C280000-0x00007FF79C672000-memory.dmp	xmrig
behavioral2/memory/2592-3232-0x00007FF7CB820000-0x00007FF7CBC12000-memory.dmp	xmrig
behavioral2/memory/1064-3228-0x00007FF6C5A90000-0x00007FF6C5E82000-memory.dmp	xmrig
behavioral2/memory/1520-3227-0x00007FF6B4B30000-0x00007FF6B4F22000-memory.dmp	xmrig
behavioral2/memory/3916-3233-0x00007FF6F34E0000-0x00007FF6F38D2000-memory.dmp	xmrig
behavioral2/memory/4984-3239-0x00007FF60E9A0000-0x00007FF60ED92000-memory.dmp	xmrig
behavioral2/memory/3872-3237-0x00007FF625260000-0x00007FF625652000-memory.dmp	xmrig
behavioral2/memory/2716-3252-0x00007FF636070000-0x00007FF636462000-memory.dmp	xmrig
behavioral2/memory/2244-3246-0x00007FF6D0860000-0x00007FF6D0C52000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3288	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2276	tQfemKR.exe
3156	sAZnEqb.exe
1716	DGVVJiy.exe
4056	LrARqUU.exe
1020	eCzcbGv.exe
2356	VopCZKB.exe
2736	lxQbmFa.exe
4896	YJcXrhY.exe
3868	ZfmmzWJ.exe
2972	CjuGMQl.exe
4252	yVbhSwM.exe
1052	sFmBezG.exe
4692	qFqoaLZ.exe
3916	IrgoIrD.exe
2592	oHIabWD.exe
1036	MUmKLDm.exe
4436	CrguieZ.exe
1520	GgMHqBA.exe
2716	ryJFQyV.exe
4456	FBWvILL.exe
2244	IEtoftN.exe
1064	KBluSYm.exe
4984	WSQiMWc.exe
3872	iWpsCcU.exe
1104	vVGADuV.exe
4528	KdEHCtK.exe
4604	OljcoWR.exe
3256	OHRqgde.exe
1220	NktknuI.exe
4608	XMkCfnK.exe
3968	wtogwNZ.exe
432	FRHhxzN.exe
464	LtLmFwu.exe
3240	brjWWEF.exe
2476	EvotMWN.exe
2488	dsJxEvv.exe
1268	QvRdVXS.exe
3332	Jktkaog.exe
4920	NAHtzbT.exe
444	OgmSFfw.exe
1624	KJoXGit.exe
4544	HxAORTC.exe
2120	WHICKxw.exe
1040	PnzjSjp.exe
4944	IDmHYfX.exe
3260	rYROtRA.exe
4968	khOZrhn.exe
1400	lQOQvpX.exe
1864	LExuruM.exe
4208	wZAacWH.exe
4452	VioZoJw.exe
1484	fYPjEUw.exe
2948	rZSwMQP.exe
1480	XHibvBZ.exe
1596	uNzwNjF.exe
4356	iqhrSve.exe
1912	AvhUBeM.exe
3068	jETcawo.exe
1112	eASSmyI.exe
792	cVtTbXo.exe
3416	gavZYVe.exe
2604	KUkNGMA.exe
2856	EvEscFJ.exe
4848	cnCDGfR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3424-0-0x00007FF7A7350000-0x00007FF7A7742000-memory.dmp	upx
behavioral2/files/0x0007000000023431-6.dat	upx
behavioral2/files/0x000900000002342b-28.dat	upx
behavioral2/files/0x0007000000023433-44.dat	upx
behavioral2/files/0x000700000002343d-74.dat	upx
behavioral2/files/0x0007000000023442-96.dat	upx
behavioral2/files/0x0007000000023441-95.dat	upx
behavioral2/files/0x0007000000023440-81.dat	upx
behavioral2/files/0x000700000002343f-79.dat	upx
behavioral2/files/0x000700000002343e-78.dat	upx
behavioral2/files/0x0007000000023434-72.dat	upx
behavioral2/files/0x000700000002343c-71.dat	upx
behavioral2/files/0x000700000002343a-70.dat	upx
behavioral2/files/0x000700000002343b-68.dat	upx
behavioral2/files/0x0007000000023436-64.dat	upx
behavioral2/files/0x0007000000023439-62.dat	upx
behavioral2/files/0x0007000000023435-56.dat	upx
behavioral2/files/0x0007000000023437-73.dat	upx
behavioral2/files/0x0007000000023443-100.dat	upx
behavioral2/files/0x000800000002342e-139.dat	upx
behavioral2/files/0x0007000000023456-201.dat	upx
behavioral2/files/0x0007000000023447-166.dat	upx
behavioral2/memory/3916-393-0x00007FF6F34E0000-0x00007FF6F38D2000-memory.dmp	upx
behavioral2/memory/1036-474-0x00007FF6CF340000-0x00007FF6CF732000-memory.dmp	upx
behavioral2/memory/1520-498-0x00007FF6B4B30000-0x00007FF6B4F22000-memory.dmp	upx
behavioral2/memory/4456-500-0x00007FF79C280000-0x00007FF79C672000-memory.dmp	upx
behavioral2/memory/2276-503-0x00007FF764E00000-0x00007FF7651F2000-memory.dmp	upx
behavioral2/memory/2244-506-0x00007FF6D0860000-0x00007FF6D0C52000-memory.dmp	upx
behavioral2/memory/1064-507-0x00007FF6C5A90000-0x00007FF6C5E82000-memory.dmp	upx
behavioral2/memory/4692-505-0x00007FF75D670000-0x00007FF75DA62000-memory.dmp	upx
behavioral2/memory/1052-504-0x00007FF6FA0E0000-0x00007FF6FA4D2000-memory.dmp	upx
behavioral2/memory/3872-502-0x00007FF625260000-0x00007FF625652000-memory.dmp	upx
behavioral2/memory/4984-501-0x00007FF60E9A0000-0x00007FF60ED92000-memory.dmp	upx
behavioral2/memory/2716-499-0x00007FF636070000-0x00007FF636462000-memory.dmp	upx
behavioral2/memory/4436-497-0x00007FF7A7B20000-0x00007FF7A7F12000-memory.dmp	upx
behavioral2/memory/2592-473-0x00007FF7CB820000-0x00007FF7CBC12000-memory.dmp	upx
behavioral2/memory/4252-330-0x00007FF7685E0000-0x00007FF7689D2000-memory.dmp	upx
behavioral2/memory/2972-323-0x00007FF752A50000-0x00007FF752E42000-memory.dmp	upx
behavioral2/memory/3868-282-0x00007FF791300000-0x00007FF7916F2000-memory.dmp	upx
behavioral2/memory/4896-280-0x00007FF77D110000-0x00007FF77D502000-memory.dmp	upx
behavioral2/memory/2736-240-0x00007FF6D8760000-0x00007FF6D8B52000-memory.dmp	upx
behavioral2/memory/2356-198-0x00007FF632EC0000-0x00007FF6332B2000-memory.dmp	upx
behavioral2/files/0x000800000002344f-193.dat	upx
behavioral2/memory/1020-191-0x00007FF63A030000-0x00007FF63A422000-memory.dmp	upx
behavioral2/files/0x0007000000023455-186.dat	upx
behavioral2/files/0x000700000002344c-182.dat	upx
behavioral2/files/0x0007000000023454-179.dat	upx
behavioral2/files/0x0007000000023451-173.dat	upx
behavioral2/files/0x0007000000023444-202.dat	upx
behavioral2/files/0x000700000002344d-165.dat	upx
behavioral2/files/0x0007000000023453-178.dat	upx
behavioral2/files/0x000700000002344a-177.dat	upx
behavioral2/files/0x0007000000023449-152.dat	upx
behavioral2/files/0x0007000000023446-147.dat	upx
behavioral2/files/0x0007000000023450-172.dat	upx
behavioral2/files/0x0007000000023448-142.dat	upx
behavioral2/files/0x0007000000023445-141.dat	upx
behavioral2/memory/4056-160-0x00007FF7C6700000-0x00007FF7C6AF2000-memory.dmp	upx
behavioral2/files/0x000700000002344b-155.dat	upx
behavioral2/files/0x0007000000023438-115.dat	upx
behavioral2/memory/1716-112-0x00007FF79B7E0000-0x00007FF79BBD2000-memory.dmp	upx
behavioral2/memory/3156-53-0x00007FF70C650000-0x00007FF70CA42000-memory.dmp	upx
behavioral2/files/0x0007000000023432-19.dat	upx
behavioral2/files/0x0006000000023288-12.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EEXTaLW.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\PaQgiHW.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\KqlEWSt.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\sugLszX.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\cHOVUJG.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\XxWroRo.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\rdQyePf.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\gryJrce.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\BswObYu.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\pTGgbPc.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\iAVKOtX.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\eVkYQOG.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\TDYiGaY.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\OFkQuOR.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\VObvnWb.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\MpkjImh.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\lToWUtN.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\kGuxnkU.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\AvHwPJd.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\vayBCWA.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\YYzkctn.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\lDaRLOV.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\cKLLCfc.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\GMUlpLZ.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\MkNHozg.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\PKxVLun.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\yGIngwI.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\KjAWgZf.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\olVErAK.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\SGRwtNN.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\ZAhFxcw.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\PaqVCCc.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\rIkLEdo.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\kCLwRLV.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\BabvZhx.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\ZIMAXWE.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\FLgkiMZ.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\NgloWqw.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\IqALcOw.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\lgZleQm.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\cRIcesH.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\CrguieZ.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\RoXGflL.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\OrSGSmT.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\mflCZHX.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\dsJxEvv.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\BtYJfur.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\JFyqwdJ.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\GqiyWEw.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\mWwjeki.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\STahvdz.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\PaXNeyh.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\lHQEogG.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\auJZUOz.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\sFmBezG.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\WSQiMWc.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\PDSdUmC.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\AKEUdRE.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\STiSEEs.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\gXvLJhu.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\VpakMyI.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\nYabavl.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\iHXKVPq.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
File created	C:\Windows\System\BdpwVqC.exe	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3288	powershell.exe
3288	powershell.exe
3288	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3288	powershell.exe
Token: SeLockMemoryPrivilege	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 3288	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	83
PID 3424 wrote to memory of 3288	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	83
PID 3424 wrote to memory of 2276	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	84
PID 3424 wrote to memory of 2276	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	84
PID 3424 wrote to memory of 3156	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	85
PID 3424 wrote to memory of 3156	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	85
PID 3424 wrote to memory of 1716	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	86
PID 3424 wrote to memory of 1716	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	86
PID 3424 wrote to memory of 4056	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	87
PID 3424 wrote to memory of 4056	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	87
PID 3424 wrote to memory of 1020	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	88
PID 3424 wrote to memory of 1020	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	88
PID 3424 wrote to memory of 2356	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	89
PID 3424 wrote to memory of 2356	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	89
PID 3424 wrote to memory of 2736	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	90
PID 3424 wrote to memory of 2736	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	90
PID 3424 wrote to memory of 2972	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	91
PID 3424 wrote to memory of 2972	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	91
PID 3424 wrote to memory of 4896	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	92
PID 3424 wrote to memory of 4896	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	92
PID 3424 wrote to memory of 3868	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	93
PID 3424 wrote to memory of 3868	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	93
PID 3424 wrote to memory of 4252	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	94
PID 3424 wrote to memory of 4252	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	94
PID 3424 wrote to memory of 1052	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	95
PID 3424 wrote to memory of 1052	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	95
PID 3424 wrote to memory of 4692	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	96
PID 3424 wrote to memory of 4692	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	96
PID 3424 wrote to memory of 3916	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	97
PID 3424 wrote to memory of 3916	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	97
PID 3424 wrote to memory of 2592	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	98
PID 3424 wrote to memory of 2592	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	98
PID 3424 wrote to memory of 1036	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	99
PID 3424 wrote to memory of 1036	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	99
PID 3424 wrote to memory of 4436	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	100
PID 3424 wrote to memory of 4436	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	100
PID 3424 wrote to memory of 1520	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	101
PID 3424 wrote to memory of 1520	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	101
PID 3424 wrote to memory of 2716	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	102
PID 3424 wrote to memory of 2716	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	102
PID 3424 wrote to memory of 4456	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	103
PID 3424 wrote to memory of 4456	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	103
PID 3424 wrote to memory of 2244	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	104
PID 3424 wrote to memory of 2244	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	104
PID 3424 wrote to memory of 3872	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	105
PID 3424 wrote to memory of 3872	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	105
PID 3424 wrote to memory of 1104	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	106
PID 3424 wrote to memory of 1104	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	106
PID 3424 wrote to memory of 4604	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	107
PID 3424 wrote to memory of 4604	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	107
PID 3424 wrote to memory of 1064	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	108
PID 3424 wrote to memory of 1064	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	108
PID 3424 wrote to memory of 4984	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	109
PID 3424 wrote to memory of 4984	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	109
PID 3424 wrote to memory of 4528	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	110
PID 3424 wrote to memory of 4528	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	110
PID 3424 wrote to memory of 3256	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	111
PID 3424 wrote to memory of 3256	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	111
PID 3424 wrote to memory of 3240	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	112
PID 3424 wrote to memory of 3240	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	112
PID 3424 wrote to memory of 1220	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	113
PID 3424 wrote to memory of 1220	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	113
PID 3424 wrote to memory of 4608	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	114
PID 3424 wrote to memory of 4608	3424	c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c11337c76446143004c4363e62e3bd50_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3288
- C:\Windows\System\tQfemKR.exe
  C:\Windows\System\tQfemKR.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\sAZnEqb.exe
  C:\Windows\System\sAZnEqb.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\DGVVJiy.exe
  C:\Windows\System\DGVVJiy.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\LrARqUU.exe
  C:\Windows\System\LrARqUU.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\eCzcbGv.exe
  C:\Windows\System\eCzcbGv.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\VopCZKB.exe
  C:\Windows\System\VopCZKB.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\lxQbmFa.exe
  C:\Windows\System\lxQbmFa.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\CjuGMQl.exe
  C:\Windows\System\CjuGMQl.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\YJcXrhY.exe
  C:\Windows\System\YJcXrhY.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\ZfmmzWJ.exe
  C:\Windows\System\ZfmmzWJ.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\yVbhSwM.exe
  C:\Windows\System\yVbhSwM.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\sFmBezG.exe
  C:\Windows\System\sFmBezG.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\qFqoaLZ.exe
  C:\Windows\System\qFqoaLZ.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\IrgoIrD.exe
  C:\Windows\System\IrgoIrD.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\oHIabWD.exe
  C:\Windows\System\oHIabWD.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\MUmKLDm.exe
  C:\Windows\System\MUmKLDm.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\CrguieZ.exe
  C:\Windows\System\CrguieZ.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\GgMHqBA.exe
  C:\Windows\System\GgMHqBA.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\ryJFQyV.exe
  C:\Windows\System\ryJFQyV.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\FBWvILL.exe
  C:\Windows\System\FBWvILL.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\IEtoftN.exe
  C:\Windows\System\IEtoftN.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\iWpsCcU.exe
  C:\Windows\System\iWpsCcU.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\vVGADuV.exe
  C:\Windows\System\vVGADuV.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\OljcoWR.exe
  C:\Windows\System\OljcoWR.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\KBluSYm.exe
  C:\Windows\System\KBluSYm.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\WSQiMWc.exe
  C:\Windows\System\WSQiMWc.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\KdEHCtK.exe
  C:\Windows\System\KdEHCtK.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\OHRqgde.exe
  C:\Windows\System\OHRqgde.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\brjWWEF.exe
  C:\Windows\System\brjWWEF.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\NktknuI.exe
  C:\Windows\System\NktknuI.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\XMkCfnK.exe
  C:\Windows\System\XMkCfnK.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\wtogwNZ.exe
  C:\Windows\System\wtogwNZ.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\FRHhxzN.exe
  C:\Windows\System\FRHhxzN.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\LtLmFwu.exe
  C:\Windows\System\LtLmFwu.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\KJoXGit.exe
  C:\Windows\System\KJoXGit.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\EvotMWN.exe
  C:\Windows\System\EvotMWN.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\dsJxEvv.exe
  C:\Windows\System\dsJxEvv.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\QvRdVXS.exe
  C:\Windows\System\QvRdVXS.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\Jktkaog.exe
  C:\Windows\System\Jktkaog.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\NAHtzbT.exe
  C:\Windows\System\NAHtzbT.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\OgmSFfw.exe
  C:\Windows\System\OgmSFfw.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\HxAORTC.exe
  C:\Windows\System\HxAORTC.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\WHICKxw.exe
  C:\Windows\System\WHICKxw.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\PnzjSjp.exe
  C:\Windows\System\PnzjSjp.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\IDmHYfX.exe
  C:\Windows\System\IDmHYfX.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\rYROtRA.exe
  C:\Windows\System\rYROtRA.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\khOZrhn.exe
  C:\Windows\System\khOZrhn.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\lQOQvpX.exe
  C:\Windows\System\lQOQvpX.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\LExuruM.exe
  C:\Windows\System\LExuruM.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\KUkNGMA.exe
  C:\Windows\System\KUkNGMA.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\wZAacWH.exe
  C:\Windows\System\wZAacWH.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\VioZoJw.exe
  C:\Windows\System\VioZoJw.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\fYPjEUw.exe
  C:\Windows\System\fYPjEUw.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\rZSwMQP.exe
  C:\Windows\System\rZSwMQP.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\XHibvBZ.exe
  C:\Windows\System\XHibvBZ.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\uNzwNjF.exe
  C:\Windows\System\uNzwNjF.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\iqhrSve.exe
  C:\Windows\System\iqhrSve.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\OJluAcX.exe
  C:\Windows\System\OJluAcX.exe
  2⤵
  PID:4368
- C:\Windows\System\AvhUBeM.exe
  C:\Windows\System\AvhUBeM.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\jETcawo.exe
  C:\Windows\System\jETcawo.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\eASSmyI.exe
  C:\Windows\System\eASSmyI.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\cVtTbXo.exe
  C:\Windows\System\cVtTbXo.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\gavZYVe.exe
  C:\Windows\System\gavZYVe.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\EvEscFJ.exe
  C:\Windows\System\EvEscFJ.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\cnCDGfR.exe
  C:\Windows\System\cnCDGfR.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\eMIDnXE.exe
  C:\Windows\System\eMIDnXE.exe
  2⤵
  PID:3008
- C:\Windows\System\gXvinFw.exe
  C:\Windows\System\gXvinFw.exe
  2⤵
  PID:4272
- C:\Windows\System\FLgkiMZ.exe
  C:\Windows\System\FLgkiMZ.exe
  2⤵
  PID:3948
- C:\Windows\System\IjNPAwq.exe
  C:\Windows\System\IjNPAwq.exe
  2⤵
  PID:3844
- C:\Windows\System\UvhzquG.exe
  C:\Windows\System\UvhzquG.exe
  2⤵
  PID:3912
- C:\Windows\System\IeAvxRi.exe
  C:\Windows\System\IeAvxRi.exe
  2⤵
  PID:4348
- C:\Windows\System\pyiyBcQ.exe
  C:\Windows\System\pyiyBcQ.exe
  2⤵
  PID:2900
- C:\Windows\System\BIFIYRs.exe
  C:\Windows\System\BIFIYRs.exe
  2⤵
  PID:4676
- C:\Windows\System\FrGgRBN.exe
  C:\Windows\System\FrGgRBN.exe
  2⤵
  PID:3612
- C:\Windows\System\OuIHXVH.exe
  C:\Windows\System\OuIHXVH.exe
  2⤵
  PID:4788
- C:\Windows\System\xdmTNym.exe
  C:\Windows\System\xdmTNym.exe
  2⤵
  PID:3092
- C:\Windows\System\agVfSXo.exe
  C:\Windows\System\agVfSXo.exe
  2⤵
  PID:2920
- C:\Windows\System\LSuLGyP.exe
  C:\Windows\System\LSuLGyP.exe
  2⤵
  PID:812
- C:\Windows\System\KitQppG.exe
  C:\Windows\System\KitQppG.exe
  2⤵
  PID:4344
- C:\Windows\System\QwHRlnM.exe
  C:\Windows\System\QwHRlnM.exe
  2⤵
  PID:2376
- C:\Windows\System\KfjGnbd.exe
  C:\Windows\System\KfjGnbd.exe
  2⤵
  PID:5000
- C:\Windows\System\eYjmkPG.exe
  C:\Windows\System\eYjmkPG.exe
  2⤵
  PID:1376
- C:\Windows\System\wNOeyBK.exe
  C:\Windows\System\wNOeyBK.exe
  2⤵
  PID:4556
- C:\Windows\System\fVUwjJS.exe
  C:\Windows\System\fVUwjJS.exe
  2⤵
  PID:5144
- C:\Windows\System\boDQCBw.exe
  C:\Windows\System\boDQCBw.exe
  2⤵
  PID:5180
- C:\Windows\System\uHBccgd.exe
  C:\Windows\System\uHBccgd.exe
  2⤵
  PID:5204
- C:\Windows\System\XMbtwHO.exe
  C:\Windows\System\XMbtwHO.exe
  2⤵
  PID:5220
- C:\Windows\System\eAjGLsK.exe
  C:\Windows\System\eAjGLsK.exe
  2⤵
  PID:5260
- C:\Windows\System\VKkjGRl.exe
  C:\Windows\System\VKkjGRl.exe
  2⤵
  PID:5288
- C:\Windows\System\hiZjcJO.exe
  C:\Windows\System\hiZjcJO.exe
  2⤵
  PID:5308
- C:\Windows\System\YuCUWKD.exe
  C:\Windows\System\YuCUWKD.exe
  2⤵
  PID:5332
- C:\Windows\System\JqaRllX.exe
  C:\Windows\System\JqaRllX.exe
  2⤵
  PID:5352
- C:\Windows\System\YuHqoON.exe
  C:\Windows\System\YuHqoON.exe
  2⤵
  PID:5380
- C:\Windows\System\hhUPaOi.exe
  C:\Windows\System\hhUPaOi.exe
  2⤵
  PID:5408
- C:\Windows\System\CNxfeCK.exe
  C:\Windows\System\CNxfeCK.exe
  2⤵
  PID:5428
- C:\Windows\System\YEksvKw.exe
  C:\Windows\System\YEksvKw.exe
  2⤵
  PID:5448
- C:\Windows\System\IJATKBA.exe
  C:\Windows\System\IJATKBA.exe
  2⤵
  PID:5468
- C:\Windows\System\CCMVTbX.exe
  C:\Windows\System\CCMVTbX.exe
  2⤵
  PID:5484
- C:\Windows\System\cYmndkb.exe
  C:\Windows\System\cYmndkb.exe
  2⤵
  PID:5508
- C:\Windows\System\aQDlZMx.exe
  C:\Windows\System\aQDlZMx.exe
  2⤵
  PID:5532
- C:\Windows\System\HVMAJus.exe
  C:\Windows\System\HVMAJus.exe
  2⤵
  PID:5548
- C:\Windows\System\TTrnHJJ.exe
  C:\Windows\System\TTrnHJJ.exe
  2⤵
  PID:5564
- C:\Windows\System\NPSvPIy.exe
  C:\Windows\System\NPSvPIy.exe
  2⤵
  PID:5584
- C:\Windows\System\cNSXeZi.exe
  C:\Windows\System\cNSXeZi.exe
  2⤵
  PID:5616
- C:\Windows\System\EtIlxrG.exe
  C:\Windows\System\EtIlxrG.exe
  2⤵
  PID:5632
- C:\Windows\System\ekIbCmI.exe
  C:\Windows\System\ekIbCmI.exe
  2⤵
  PID:5652
- C:\Windows\System\dvCUTGt.exe
  C:\Windows\System\dvCUTGt.exe
  2⤵
  PID:5672
- C:\Windows\System\ieQRsie.exe
  C:\Windows\System\ieQRsie.exe
  2⤵
  PID:5700
- C:\Windows\System\VEwzqlq.exe
  C:\Windows\System\VEwzqlq.exe
  2⤵
  PID:5720
- C:\Windows\System\gVjrZQa.exe
  C:\Windows\System\gVjrZQa.exe
  2⤵
  PID:5752
- C:\Windows\System\ORpXaVy.exe
  C:\Windows\System\ORpXaVy.exe
  2⤵
  PID:5768
- C:\Windows\System\cEMrFur.exe
  C:\Windows\System\cEMrFur.exe
  2⤵
  PID:5784
- C:\Windows\System\bgeXBQs.exe
  C:\Windows\System\bgeXBQs.exe
  2⤵
  PID:5808
- C:\Windows\System\bVPWhau.exe
  C:\Windows\System\bVPWhau.exe
  2⤵
  PID:5836
- C:\Windows\System\JORqXMs.exe
  C:\Windows\System\JORqXMs.exe
  2⤵
  PID:5856
- C:\Windows\System\OfBnoBz.exe
  C:\Windows\System\OfBnoBz.exe
  2⤵
  PID:5876
- C:\Windows\System\MQyjGFB.exe
  C:\Windows\System\MQyjGFB.exe
  2⤵
  PID:5892
- C:\Windows\System\vyIxrOE.exe
  C:\Windows\System\vyIxrOE.exe
  2⤵
  PID:5920
- C:\Windows\System\lBMmLOo.exe
  C:\Windows\System\lBMmLOo.exe
  2⤵
  PID:5956
- C:\Windows\System\PdDAKTe.exe
  C:\Windows\System\PdDAKTe.exe
  2⤵
  PID:5980
- C:\Windows\System\GikTJES.exe
  C:\Windows\System\GikTJES.exe
  2⤵
  PID:6004
- C:\Windows\System\PlvXgPU.exe
  C:\Windows\System\PlvXgPU.exe
  2⤵
  PID:6028
- C:\Windows\System\RMlhpHX.exe
  C:\Windows\System\RMlhpHX.exe
  2⤵
  PID:6048
- C:\Windows\System\ANlqWLz.exe
  C:\Windows\System\ANlqWLz.exe
  2⤵
  PID:6072
- C:\Windows\System\dhGJGSY.exe
  C:\Windows\System\dhGJGSY.exe
  2⤵
  PID:6088
- C:\Windows\System\OpoNSWb.exe
  C:\Windows\System\OpoNSWb.exe
  2⤵
  PID:6116
- C:\Windows\System\jjOboFJ.exe
  C:\Windows\System\jjOboFJ.exe
  2⤵
  PID:6136
- C:\Windows\System\DuyLjTl.exe
  C:\Windows\System\DuyLjTl.exe
  2⤵
  PID:4184
- C:\Windows\System\fDRWXrH.exe
  C:\Windows\System\fDRWXrH.exe
  2⤵
  PID:932
- C:\Windows\System\fTdgzkN.exe
  C:\Windows\System\fTdgzkN.exe
  2⤵
  PID:620
- C:\Windows\System\fMoUlYm.exe
  C:\Windows\System\fMoUlYm.exe
  2⤵
  PID:3452
- C:\Windows\System\XpVdQnN.exe
  C:\Windows\System\XpVdQnN.exe
  2⤵
  PID:3988
- C:\Windows\System\cseWOAF.exe
  C:\Windows\System\cseWOAF.exe
  2⤵
  PID:4484
- C:\Windows\System\KzNtBGk.exe
  C:\Windows\System\KzNtBGk.exe
  2⤵
  PID:4572
- C:\Windows\System\KYxhNdc.exe
  C:\Windows\System\KYxhNdc.exe
  2⤵
  PID:5192
- C:\Windows\System\iVcvCVL.exe
  C:\Windows\System\iVcvCVL.exe
  2⤵
  PID:1288
- C:\Windows\System\RoXGflL.exe
  C:\Windows\System\RoXGflL.exe
  2⤵
  PID:5236
- C:\Windows\System\fNAJSyB.exe
  C:\Windows\System\fNAJSyB.exe
  2⤵
  PID:5344
- C:\Windows\System\DObNLsi.exe
  C:\Windows\System\DObNLsi.exe
  2⤵
  PID:4668
- C:\Windows\System\BXXkKME.exe
  C:\Windows\System\BXXkKME.exe
  2⤵
  PID:5520
- C:\Windows\System\UvPhGEP.exe
  C:\Windows\System\UvPhGEP.exe
  2⤵
  PID:5556
- C:\Windows\System\JewglBC.exe
  C:\Windows\System\JewglBC.exe
  2⤵
  PID:5152
- C:\Windows\System\cajTduX.exe
  C:\Windows\System\cajTduX.exe
  2⤵
  PID:796
- C:\Windows\System\dbqnAAj.exe
  C:\Windows\System\dbqnAAj.exe
  2⤵
  PID:4672
- C:\Windows\System\mgCxiGA.exe
  C:\Windows\System\mgCxiGA.exe
  2⤵
  PID:5188
- C:\Windows\System\PeQcBDs.exe
  C:\Windows\System\PeQcBDs.exe
  2⤵
  PID:5780
- C:\Windows\System\SvdcDiQ.exe
  C:\Windows\System\SvdcDiQ.exe
  2⤵
  PID:4508
- C:\Windows\System\kCDfkCF.exe
  C:\Windows\System\kCDfkCF.exe
  2⤵
  PID:5040
- C:\Windows\System\XnnIhyw.exe
  C:\Windows\System\XnnIhyw.exe
  2⤵
  PID:5828
- C:\Windows\System\tUBqxgc.exe
  C:\Windows\System\tUBqxgc.exe
  2⤵
  PID:2188
- C:\Windows\System\PYZXzoi.exe
  C:\Windows\System\PYZXzoi.exe
  2⤵
  PID:5316
- C:\Windows\System\MqiEmru.exe
  C:\Windows\System\MqiEmru.exe
  2⤵
  PID:6148
- C:\Windows\System\rkbqzut.exe
  C:\Windows\System\rkbqzut.exe
  2⤵
  PID:6184
- C:\Windows\System\FVUnEZg.exe
  C:\Windows\System\FVUnEZg.exe
  2⤵
  PID:6204
- C:\Windows\System\EmnoRrA.exe
  C:\Windows\System\EmnoRrA.exe
  2⤵
  PID:6220
- C:\Windows\System\suoOodv.exe
  C:\Windows\System\suoOodv.exe
  2⤵
  PID:6244
- C:\Windows\System\UhWSaed.exe
  C:\Windows\System\UhWSaed.exe
  2⤵
  PID:6268
- C:\Windows\System\GffxcNP.exe
  C:\Windows\System\GffxcNP.exe
  2⤵
  PID:6288
- C:\Windows\System\UynibHs.exe
  C:\Windows\System\UynibHs.exe
  2⤵
  PID:6312
- C:\Windows\System\RSSPWoK.exe
  C:\Windows\System\RSSPWoK.exe
  2⤵
  PID:6328
- C:\Windows\System\nBdnIvl.exe
  C:\Windows\System\nBdnIvl.exe
  2⤵
  PID:6476
- C:\Windows\System\TDlAILg.exe
  C:\Windows\System\TDlAILg.exe
  2⤵
  PID:6492
- C:\Windows\System\bWmGFKi.exe
  C:\Windows\System\bWmGFKi.exe
  2⤵
  PID:6508
- C:\Windows\System\Aeywvxs.exe
  C:\Windows\System\Aeywvxs.exe
  2⤵
  PID:6524
- C:\Windows\System\tNyHbGi.exe
  C:\Windows\System\tNyHbGi.exe
  2⤵
  PID:6540
- C:\Windows\System\tgGufGD.exe
  C:\Windows\System\tgGufGD.exe
  2⤵
  PID:6556
- C:\Windows\System\xjrMikW.exe
  C:\Windows\System\xjrMikW.exe
  2⤵
  PID:6572
- C:\Windows\System\dZMpNIi.exe
  C:\Windows\System\dZMpNIi.exe
  2⤵
  PID:6588
- C:\Windows\System\uUCbXbe.exe
  C:\Windows\System\uUCbXbe.exe
  2⤵
  PID:6604
- C:\Windows\System\eecJHXP.exe
  C:\Windows\System\eecJHXP.exe
  2⤵
  PID:6620
- C:\Windows\System\VWXiwNf.exe
  C:\Windows\System\VWXiwNf.exe
  2⤵
  PID:6676
- C:\Windows\System\gStkbQy.exe
  C:\Windows\System\gStkbQy.exe
  2⤵
  PID:6808
- C:\Windows\System\MNWPrlF.exe
  C:\Windows\System\MNWPrlF.exe
  2⤵
  PID:6824
- C:\Windows\System\gDFjDha.exe
  C:\Windows\System\gDFjDha.exe
  2⤵
  PID:6840
- C:\Windows\System\zutMakv.exe
  C:\Windows\System\zutMakv.exe
  2⤵
  PID:6892
- C:\Windows\System\YLQlffc.exe
  C:\Windows\System\YLQlffc.exe
  2⤵
  PID:6916
- C:\Windows\System\raMzFGa.exe
  C:\Windows\System\raMzFGa.exe
  2⤵
  PID:6932
- C:\Windows\System\OdwawAQ.exe
  C:\Windows\System\OdwawAQ.exe
  2⤵
  PID:6948
- C:\Windows\System\AtjSynu.exe
  C:\Windows\System\AtjSynu.exe
  2⤵
  PID:6972
- C:\Windows\System\nYabavl.exe
  C:\Windows\System\nYabavl.exe
  2⤵
  PID:6992
- C:\Windows\System\LjIPdiH.exe
  C:\Windows\System\LjIPdiH.exe
  2⤵
  PID:7012
- C:\Windows\System\eATsAHS.exe
  C:\Windows\System\eATsAHS.exe
  2⤵
  PID:7032
- C:\Windows\System\LMaQQyp.exe
  C:\Windows\System\LMaQQyp.exe
  2⤵
  PID:7064
- C:\Windows\System\VJRAycb.exe
  C:\Windows\System\VJRAycb.exe
  2⤵
  PID:7080
- C:\Windows\System\ajUhptQ.exe
  C:\Windows\System\ajUhptQ.exe
  2⤵
  PID:7104
- C:\Windows\System\aoszAnh.exe
  C:\Windows\System\aoszAnh.exe
  2⤵
  PID:7128
- C:\Windows\System\EwvuglH.exe
  C:\Windows\System\EwvuglH.exe
  2⤵
  PID:7148
- C:\Windows\System\cUMaMSA.exe
  C:\Windows\System\cUMaMSA.exe
  2⤵
  PID:5544
- C:\Windows\System\plMLVkl.exe
  C:\Windows\System\plMLVkl.exe
  2⤵
  PID:5268
- C:\Windows\System\dVwaClN.exe
  C:\Windows\System\dVwaClN.exe
  2⤵
  PID:5360
- C:\Windows\System\xeeTCUn.exe
  C:\Windows\System\xeeTCUn.exe
  2⤵
  PID:5420
- C:\Windows\System\jUOrSWu.exe
  C:\Windows\System\jUOrSWu.exe
  2⤵
  PID:5464
- C:\Windows\System\yodjOqU.exe
  C:\Windows\System\yodjOqU.exe
  2⤵
  PID:5580
- C:\Windows\System\NxkNCnT.exe
  C:\Windows\System\NxkNCnT.exe
  2⤵
  PID:5664
- C:\Windows\System\DYsOmGy.exe
  C:\Windows\System\DYsOmGy.exe
  2⤵
  PID:5716
- C:\Windows\System\hrKVLlb.exe
  C:\Windows\System\hrKVLlb.exe
  2⤵
  PID:5844
- C:\Windows\System\aohlfBt.exe
  C:\Windows\System\aohlfBt.exe
  2⤵
  PID:5948
- C:\Windows\System\ApOFFli.exe
  C:\Windows\System\ApOFFli.exe
  2⤵
  PID:5992
- C:\Windows\System\APipfwq.exe
  C:\Windows\System\APipfwq.exe
  2⤵
  PID:6044
- C:\Windows\System\IiJPGCY.exe
  C:\Windows\System\IiJPGCY.exe
  2⤵
  PID:6096
- C:\Windows\System\JVOzoIZ.exe
  C:\Windows\System\JVOzoIZ.exe
  2⤵
  PID:4312
- C:\Windows\System\GLkDKLv.exe
  C:\Windows\System\GLkDKLv.exe
  2⤵
  PID:5628
- C:\Windows\System\XoJvoPy.exe
  C:\Windows\System\XoJvoPy.exe
  2⤵
  PID:6156
- C:\Windows\System\qZResyF.exe
  C:\Windows\System\qZResyF.exe
  2⤵
  PID:3904
- C:\Windows\System\YFoXNzz.exe
  C:\Windows\System\YFoXNzz.exe
  2⤵
  PID:5080
- C:\Windows\System\UnfCSyv.exe
  C:\Windows\System\UnfCSyv.exe
  2⤵
  PID:4336
- C:\Windows\System\VvJdSrc.exe
  C:\Windows\System\VvJdSrc.exe
  2⤵
  PID:5500
- C:\Windows\System\MmXWVWK.exe
  C:\Windows\System\MmXWVWK.exe
  2⤵
  PID:2332
- C:\Windows\System\WKWpGad.exe
  C:\Windows\System\WKWpGad.exe
  2⤵
  PID:5728
- C:\Windows\System\egNjSIr.exe
  C:\Windows\System\egNjSIr.exe
  2⤵
  PID:4852
- C:\Windows\System\pZXKQvi.exe
  C:\Windows\System\pZXKQvi.exe
  2⤵
  PID:5888
- C:\Windows\System\MYaoOSy.exe
  C:\Windows\System\MYaoOSy.exe
  2⤵
  PID:6172
- C:\Windows\System\VyikvIk.exe
  C:\Windows\System\VyikvIk.exe
  2⤵
  PID:6216
- C:\Windows\System\QjCaOCO.exe
  C:\Windows\System\QjCaOCO.exe
  2⤵
  PID:6280
- C:\Windows\System\PZjYTQF.exe
  C:\Windows\System\PZjYTQF.exe
  2⤵
  PID:6320
- C:\Windows\System\bfUGorc.exe
  C:\Windows\System\bfUGorc.exe
  2⤵
  PID:4564
- C:\Windows\System\wgnXGBB.exe
  C:\Windows\System\wgnXGBB.exe
  2⤵
  PID:7176
- C:\Windows\System\aADMgNE.exe
  C:\Windows\System\aADMgNE.exe
  2⤵
  PID:7192
- C:\Windows\System\yenqpCG.exe
  C:\Windows\System\yenqpCG.exe
  2⤵
  PID:7212
- C:\Windows\System\KnfpsDO.exe
  C:\Windows\System\KnfpsDO.exe
  2⤵
  PID:7232
- C:\Windows\System\JejLIiS.exe
  C:\Windows\System\JejLIiS.exe
  2⤵
  PID:7248
- C:\Windows\System\eiDQnTe.exe
  C:\Windows\System\eiDQnTe.exe
  2⤵
  PID:7268
- C:\Windows\System\CRpbmMx.exe
  C:\Windows\System\CRpbmMx.exe
  2⤵
  PID:7288
- C:\Windows\System\JPwbZcS.exe
  C:\Windows\System\JPwbZcS.exe
  2⤵
  PID:7304
- C:\Windows\System\debCUwN.exe
  C:\Windows\System\debCUwN.exe
  2⤵
  PID:7324
- C:\Windows\System\yejXlYm.exe
  C:\Windows\System\yejXlYm.exe
  2⤵
  PID:7344
- C:\Windows\System\woVCIyy.exe
  C:\Windows\System\woVCIyy.exe
  2⤵
  PID:7364
- C:\Windows\System\WlRQbxa.exe
  C:\Windows\System\WlRQbxa.exe
  2⤵
  PID:7380
- C:\Windows\System\mAeuQDk.exe
  C:\Windows\System\mAeuQDk.exe
  2⤵
  PID:7400
- C:\Windows\System\bOlnkSE.exe
  C:\Windows\System\bOlnkSE.exe
  2⤵
  PID:7420
- C:\Windows\System\RZQjLDs.exe
  C:\Windows\System\RZQjLDs.exe
  2⤵
  PID:7440
- C:\Windows\System\wsQQHEv.exe
  C:\Windows\System\wsQQHEv.exe
  2⤵
  PID:7456
- C:\Windows\System\gQJGeJl.exe
  C:\Windows\System\gQJGeJl.exe
  2⤵
  PID:7476
- C:\Windows\System\ArWPAhn.exe
  C:\Windows\System\ArWPAhn.exe
  2⤵
  PID:7496
- C:\Windows\System\PBCMINp.exe
  C:\Windows\System\PBCMINp.exe
  2⤵
  PID:7516
- C:\Windows\System\GTDuoVA.exe
  C:\Windows\System\GTDuoVA.exe
  2⤵
  PID:7532
- C:\Windows\System\MoqoQqi.exe
  C:\Windows\System\MoqoQqi.exe
  2⤵
  PID:7552
- C:\Windows\System\cHxZqat.exe
  C:\Windows\System\cHxZqat.exe
  2⤵
  PID:7572
- C:\Windows\System\AsabhHa.exe
  C:\Windows\System\AsabhHa.exe
  2⤵
  PID:7588
- C:\Windows\System\mpvIlKZ.exe
  C:\Windows\System\mpvIlKZ.exe
  2⤵
  PID:7608
- C:\Windows\System\StKIaOS.exe
  C:\Windows\System\StKIaOS.exe
  2⤵
  PID:7628
- C:\Windows\System\mAfjjLo.exe
  C:\Windows\System\mAfjjLo.exe
  2⤵
  PID:7644
- C:\Windows\System\BUltVHJ.exe
  C:\Windows\System\BUltVHJ.exe
  2⤵
  PID:7660
- C:\Windows\System\vzoRNJV.exe
  C:\Windows\System\vzoRNJV.exe
  2⤵
  PID:7676
- C:\Windows\System\ANcPzBi.exe
  C:\Windows\System\ANcPzBi.exe
  2⤵
  PID:7692
- C:\Windows\System\FMDBvDs.exe
  C:\Windows\System\FMDBvDs.exe
  2⤵
  PID:7712
- C:\Windows\System\YURsTyy.exe
  C:\Windows\System\YURsTyy.exe
  2⤵
  PID:7732
- C:\Windows\System\ysKRTvl.exe
  C:\Windows\System\ysKRTvl.exe
  2⤵
  PID:7752
- C:\Windows\System\qRwuXgE.exe
  C:\Windows\System\qRwuXgE.exe
  2⤵
  PID:7768
- C:\Windows\System\eSUQoEG.exe
  C:\Windows\System\eSUQoEG.exe
  2⤵
  PID:7784
- C:\Windows\System\ZTAvDlP.exe
  C:\Windows\System\ZTAvDlP.exe
  2⤵
  PID:7800
- C:\Windows\System\wXfUnAA.exe
  C:\Windows\System\wXfUnAA.exe
  2⤵
  PID:7816
- C:\Windows\System\PwIZRbe.exe
  C:\Windows\System\PwIZRbe.exe
  2⤵
  PID:8000
- C:\Windows\System\OXQMMzC.exe
  C:\Windows\System\OXQMMzC.exe
  2⤵
  PID:8016
- C:\Windows\System\rxTKiyj.exe
  C:\Windows\System\rxTKiyj.exe
  2⤵
  PID:8040
- C:\Windows\System\mdsPMyY.exe
  C:\Windows\System\mdsPMyY.exe
  2⤵
  PID:8060
- C:\Windows\System\gGdujZX.exe
  C:\Windows\System\gGdujZX.exe
  2⤵
  PID:8076
- C:\Windows\System\cqWyoaO.exe
  C:\Windows\System\cqWyoaO.exe
  2⤵
  PID:8092
- C:\Windows\System\RyakvMy.exe
  C:\Windows\System\RyakvMy.exe
  2⤵
  PID:8124
- C:\Windows\System\eLIWTXF.exe
  C:\Windows\System\eLIWTXF.exe
  2⤵
  PID:8156
- C:\Windows\System\VnrgYXO.exe
  C:\Windows\System\VnrgYXO.exe
  2⤵
  PID:6860
- C:\Windows\System\KDYgLGC.exe
  C:\Windows\System\KDYgLGC.exe
  2⤵
  PID:7112
- C:\Windows\System\lfpHWXZ.exe
  C:\Windows\System\lfpHWXZ.exe
  2⤵
  PID:8216
- C:\Windows\System\PblTvNh.exe
  C:\Windows\System\PblTvNh.exe
  2⤵
  PID:8244
- C:\Windows\System\sYtdeaJ.exe
  C:\Windows\System\sYtdeaJ.exe
  2⤵
  PID:8276
- C:\Windows\System\zccRTqw.exe
  C:\Windows\System\zccRTqw.exe
  2⤵
  PID:8308
- C:\Windows\System\HaqZgUL.exe
  C:\Windows\System\HaqZgUL.exe
  2⤵
  PID:8332
- C:\Windows\System\CFPfDWl.exe
  C:\Windows\System\CFPfDWl.exe
  2⤵
  PID:8352
- C:\Windows\System\lCDmImI.exe
  C:\Windows\System\lCDmImI.exe
  2⤵
  PID:8372
- C:\Windows\System\VpakMyI.exe
  C:\Windows\System\VpakMyI.exe
  2⤵
  PID:8388
- C:\Windows\System\ZewdVXP.exe
  C:\Windows\System\ZewdVXP.exe
  2⤵
  PID:8408
- C:\Windows\System\FszMbVS.exe
  C:\Windows\System\FszMbVS.exe
  2⤵
  PID:8428
- C:\Windows\System\xKPwoUx.exe
  C:\Windows\System\xKPwoUx.exe
  2⤵
  PID:8444
- C:\Windows\System\zxLKzij.exe
  C:\Windows\System\zxLKzij.exe
  2⤵
  PID:8460
- C:\Windows\System\nlYUZNR.exe
  C:\Windows\System\nlYUZNR.exe
  2⤵
  PID:8476
- C:\Windows\System\oDvvfZa.exe
  C:\Windows\System\oDvvfZa.exe
  2⤵
  PID:8492
- C:\Windows\System\JofYxrd.exe
  C:\Windows\System\JofYxrd.exe
  2⤵
  PID:8508
- C:\Windows\System\zHcUSAn.exe
  C:\Windows\System\zHcUSAn.exe
  2⤵
  PID:8564
- C:\Windows\System\nYHPVXD.exe
  C:\Windows\System\nYHPVXD.exe
  2⤵
  PID:8580
- C:\Windows\System\UnsFWwW.exe
  C:\Windows\System\UnsFWwW.exe
  2⤵
  PID:8596
- C:\Windows\System\GhjODIv.exe
  C:\Windows\System\GhjODIv.exe
  2⤵
  PID:8612
- C:\Windows\System\SJQlfTo.exe
  C:\Windows\System\SJQlfTo.exe
  2⤵
  PID:8628
- C:\Windows\System\VpqjrKZ.exe
  C:\Windows\System\VpqjrKZ.exe
  2⤵
  PID:8652
- C:\Windows\System\cRLyCwr.exe
  C:\Windows\System\cRLyCwr.exe
  2⤵
  PID:8668
- C:\Windows\System\DDzTNgA.exe
  C:\Windows\System\DDzTNgA.exe
  2⤵
  PID:8692
- C:\Windows\System\uDoiwgI.exe
  C:\Windows\System\uDoiwgI.exe
  2⤵
  PID:8712
- C:\Windows\System\zVATqLZ.exe
  C:\Windows\System\zVATqLZ.exe
  2⤵
  PID:8732
- C:\Windows\System\ugwSsYm.exe
  C:\Windows\System\ugwSsYm.exe
  2⤵
  PID:8756
- C:\Windows\System\TxmiSgE.exe
  C:\Windows\System\TxmiSgE.exe
  2⤵
  PID:8780
- C:\Windows\System\adFyBWp.exe
  C:\Windows\System\adFyBWp.exe
  2⤵
  PID:8800
- C:\Windows\System\HsCOyHa.exe
  C:\Windows\System\HsCOyHa.exe
  2⤵
  PID:8824
- C:\Windows\System\XWizIwf.exe
  C:\Windows\System\XWizIwf.exe
  2⤵
  PID:8844
- C:\Windows\System\EjBqMiv.exe
  C:\Windows\System\EjBqMiv.exe
  2⤵
  PID:8864
- C:\Windows\System\slFzTNY.exe
  C:\Windows\System\slFzTNY.exe
  2⤵
  PID:8884
- C:\Windows\System\IonZdAJ.exe
  C:\Windows\System\IonZdAJ.exe
  2⤵
  PID:8904
- C:\Windows\System\VOjCBtA.exe
  C:\Windows\System\VOjCBtA.exe
  2⤵
  PID:8920
- C:\Windows\System\xFxkvLL.exe
  C:\Windows\System\xFxkvLL.exe
  2⤵
  PID:8944
- C:\Windows\System\EEGwoUr.exe
  C:\Windows\System\EEGwoUr.exe
  2⤵
  PID:8968
- C:\Windows\System\rKMbIeE.exe
  C:\Windows\System\rKMbIeE.exe
  2⤵
  PID:8992
- C:\Windows\System\ESSVCpp.exe
  C:\Windows\System\ESSVCpp.exe
  2⤵
  PID:9012
- C:\Windows\System\GbcEhHW.exe
  C:\Windows\System\GbcEhHW.exe
  2⤵
  PID:9036
- C:\Windows\System\QDwBHKL.exe
  C:\Windows\System\QDwBHKL.exe
  2⤵
  PID:9060
- C:\Windows\System\gnnkAII.exe
  C:\Windows\System\gnnkAII.exe
  2⤵
  PID:9084
- C:\Windows\System\dSpjCar.exe
  C:\Windows\System\dSpjCar.exe
  2⤵
  PID:9100
- C:\Windows\System\BdpwVqC.exe
  C:\Windows\System\BdpwVqC.exe
  2⤵
  PID:9124
- C:\Windows\System\brtMpAs.exe
  C:\Windows\System\brtMpAs.exe
  2⤵
  PID:9148
- C:\Windows\System\LXlJkIY.exe
  C:\Windows\System\LXlJkIY.exe
  2⤵
  PID:9172
- C:\Windows\System\vayBCWA.exe
  C:\Windows\System\vayBCWA.exe
  2⤵
  PID:9192
- C:\Windows\System\rWbzAst.exe
  C:\Windows\System\rWbzAst.exe
  2⤵
  PID:928
- C:\Windows\System\bEncDic.exe
  C:\Windows\System\bEncDic.exe
  2⤵
  PID:1496
- C:\Windows\System\OtQaUMw.exe
  C:\Windows\System\OtQaUMw.exe
  2⤵
  PID:4532
- C:\Windows\System\vWexPDH.exe
  C:\Windows\System\vWexPDH.exe
  2⤵
  PID:7224
- C:\Windows\System\NgloWqw.exe
  C:\Windows\System\NgloWqw.exe
  2⤵
  PID:7280
- C:\Windows\System\grSBPyF.exe
  C:\Windows\System\grSBPyF.exe
  2⤵
  PID:7336
- C:\Windows\System\XeUoulE.exe
  C:\Windows\System\XeUoulE.exe
  2⤵
  PID:7392
- C:\Windows\System\YYzkctn.exe
  C:\Windows\System\YYzkctn.exe
  2⤵
  PID:5076
- C:\Windows\System\SDwQrQY.exe
  C:\Windows\System\SDwQrQY.exe
  2⤵
  PID:6864
- C:\Windows\System\ASdZjLB.exe
  C:\Windows\System\ASdZjLB.exe
  2⤵
  PID:6068
- C:\Windows\System\QJgazbG.exe
  C:\Windows\System\QJgazbG.exe
  2⤵
  PID:5044
- C:\Windows\System\FRaqDne.exe
  C:\Windows\System\FRaqDne.exe
  2⤵
  PID:7244
- C:\Windows\System\OhKoxeJ.exe
  C:\Windows\System\OhKoxeJ.exe
  2⤵
  PID:6468
- C:\Windows\System\lWvTbDF.exe
  C:\Windows\System\lWvTbDF.exe
  2⤵
  PID:6520
- C:\Windows\System\RUzyfLi.exe
  C:\Windows\System\RUzyfLi.exe
  2⤵
  PID:6552
- C:\Windows\System\zgmOubA.exe
  C:\Windows\System\zgmOubA.exe
  2⤵
  PID:6600
- C:\Windows\System\itPXpqb.exe
  C:\Windows\System\itPXpqb.exe
  2⤵
  PID:6816
- C:\Windows\System\XTqNvzJ.exe
  C:\Windows\System\XTqNvzJ.exe
  2⤵
  PID:6852
- C:\Windows\System\SsrMDkw.exe
  C:\Windows\System\SsrMDkw.exe
  2⤵
  PID:6884
- C:\Windows\System\wLzMjJa.exe
  C:\Windows\System\wLzMjJa.exe
  2⤵
  PID:6924
- C:\Windows\System\vHdaSzA.exe
  C:\Windows\System\vHdaSzA.exe
  2⤵
  PID:7004
- C:\Windows\System\KoqijRL.exe
  C:\Windows\System\KoqijRL.exe
  2⤵
  PID:7040
- C:\Windows\System\Ofhsjxk.exe
  C:\Windows\System\Ofhsjxk.exe
  2⤵
  PID:7160
- C:\Windows\System\RueeEGP.exe
  C:\Windows\System\RueeEGP.exe
  2⤵
  PID:3448
- C:\Windows\System\oCNILeJ.exe
  C:\Windows\System\oCNILeJ.exe
  2⤵
  PID:4180
- C:\Windows\System\zEvDoqu.exe
  C:\Windows\System\zEvDoqu.exe
  2⤵
  PID:5404
- C:\Windows\System\OKLHWec.exe
  C:\Windows\System\OKLHWec.exe
  2⤵
  PID:6132
- C:\Windows\System\HxCjIVK.exe
  C:\Windows\System\HxCjIVK.exe
  2⤵
  PID:5708
- C:\Windows\System\zOMJQdk.exe
  C:\Windows\System\zOMJQdk.exe
  2⤵
  PID:5964
- C:\Windows\System\ypJpzRj.exe
  C:\Windows\System\ypJpzRj.exe
  2⤵
  PID:6064
- C:\Windows\System\GFkWhdh.exe
  C:\Windows\System\GFkWhdh.exe
  2⤵
  PID:5272
- C:\Windows\System\UTLcArs.exe
  C:\Windows\System\UTLcArs.exe
  2⤵
  PID:5596
- C:\Windows\System\yZLsuIf.exe
  C:\Windows\System\yZLsuIf.exe
  2⤵
  PID:6212
- C:\Windows\System\xAXEmQP.exe
  C:\Windows\System\xAXEmQP.exe
  2⤵
  PID:6260
- C:\Windows\System\KbukghD.exe
  C:\Windows\System\KbukghD.exe
  2⤵
  PID:4700
- C:\Windows\System\TfnTwOV.exe
  C:\Windows\System\TfnTwOV.exe
  2⤵
  PID:7204
- C:\Windows\System\PbooJmT.exe
  C:\Windows\System\PbooJmT.exe
  2⤵
  PID:7360
- C:\Windows\System\ryjViCc.exe
  C:\Windows\System\ryjViCc.exe
  2⤵
  PID:7432
- C:\Windows\System\SfjgSPZ.exe
  C:\Windows\System\SfjgSPZ.exe
  2⤵
  PID:7472
- C:\Windows\System\lUriCtz.exe
  C:\Windows\System\lUriCtz.exe
  2⤵
  PID:7512
- C:\Windows\System\nzGspHW.exe
  C:\Windows\System\nzGspHW.exe
  2⤵
  PID:7564
- C:\Windows\System\RQNNasc.exe
  C:\Windows\System\RQNNasc.exe
  2⤵
  PID:7600
- C:\Windows\System\ZeoEESn.exe
  C:\Windows\System\ZeoEESn.exe
  2⤵
  PID:7656
- C:\Windows\System\cgqiViG.exe
  C:\Windows\System\cgqiViG.exe
  2⤵
  PID:7704
- C:\Windows\System\RhRIJzN.exe
  C:\Windows\System\RhRIJzN.exe
  2⤵
  PID:7740
- C:\Windows\System\YfdNtRh.exe
  C:\Windows\System\YfdNtRh.exe
  2⤵
  PID:7776
- C:\Windows\System\nzqSkdb.exe
  C:\Windows\System\nzqSkdb.exe
  2⤵
  PID:8516
- C:\Windows\System\bjqQXqW.exe
  C:\Windows\System\bjqQXqW.exe
  2⤵
  PID:7992
- C:\Windows\System\DcXFJuX.exe
  C:\Windows\System\DcXFJuX.exe
  2⤵
  PID:8024
- C:\Windows\System\eZyNLIa.exe
  C:\Windows\System\eZyNLIa.exe
  2⤵
  PID:8056
- C:\Windows\System\boyEBRp.exe
  C:\Windows\System\boyEBRp.exe
  2⤵
  PID:8100
- C:\Windows\System\jgZFboO.exe
  C:\Windows\System\jgZFboO.exe
  2⤵
  PID:8172
- C:\Windows\System\GfBIaHn.exe
  C:\Windows\System\GfBIaHn.exe
  2⤵
  PID:8212
- C:\Windows\System\FHpyjhU.exe
  C:\Windows\System\FHpyjhU.exe
  2⤵
  PID:8304
- C:\Windows\System\knNhTps.exe
  C:\Windows\System\knNhTps.exe
  2⤵
  PID:8348
- C:\Windows\System\ZVtDSpt.exe
  C:\Windows\System\ZVtDSpt.exe
  2⤵
  PID:8396
- C:\Windows\System\OMCZaic.exe
  C:\Windows\System\OMCZaic.exe
  2⤵
  PID:8436
- C:\Windows\System\HhFwqZT.exe
  C:\Windows\System\HhFwqZT.exe
  2⤵
  PID:8484
- C:\Windows\System\lnJLyRB.exe
  C:\Windows\System\lnJLyRB.exe
  2⤵
  PID:3724
- C:\Windows\System\qrFyjPW.exe
  C:\Windows\System\qrFyjPW.exe
  2⤵
  PID:9224
- C:\Windows\System\sOwSaNH.exe
  C:\Windows\System\sOwSaNH.exe
  2⤵
  PID:9248
- C:\Windows\System\jEmGblc.exe
  C:\Windows\System\jEmGblc.exe
  2⤵
  PID:9268
- C:\Windows\System\LssqieM.exe
  C:\Windows\System\LssqieM.exe
  2⤵
  PID:9288
- C:\Windows\System\XzVcFiu.exe
  C:\Windows\System\XzVcFiu.exe
  2⤵
  PID:9312
- C:\Windows\System\vnUsupF.exe
  C:\Windows\System\vnUsupF.exe
  2⤵
  PID:9328
- C:\Windows\System\pyMFRAj.exe
  C:\Windows\System\pyMFRAj.exe
  2⤵
  PID:9352
- C:\Windows\System\KvJSKGi.exe
  C:\Windows\System\KvJSKGi.exe
  2⤵
  PID:9368
- C:\Windows\System\vTQOWbK.exe
  C:\Windows\System\vTQOWbK.exe
  2⤵
  PID:9392
- C:\Windows\System\fcONXka.exe
  C:\Windows\System\fcONXka.exe
  2⤵
  PID:9416
- C:\Windows\System\QzPatSY.exe
  C:\Windows\System\QzPatSY.exe
  2⤵
  PID:9440
- C:\Windows\System\KTaCIfa.exe
  C:\Windows\System\KTaCIfa.exe
  2⤵
  PID:9472
- C:\Windows\System\LFzuahg.exe
  C:\Windows\System\LFzuahg.exe
  2⤵
  PID:9496
- C:\Windows\System\vgmLypr.exe
  C:\Windows\System\vgmLypr.exe
  2⤵
  PID:9520
- C:\Windows\System\ZmTItvz.exe
  C:\Windows\System\ZmTItvz.exe
  2⤵
  PID:9540
- C:\Windows\System\ZzONWkz.exe
  C:\Windows\System\ZzONWkz.exe
  2⤵
  PID:9568
- C:\Windows\System\LkyewJh.exe
  C:\Windows\System\LkyewJh.exe
  2⤵
  PID:9588
- C:\Windows\System\rVwLFnN.exe
  C:\Windows\System\rVwLFnN.exe
  2⤵
  PID:9612
- C:\Windows\System\gqbUgVd.exe
  C:\Windows\System\gqbUgVd.exe
  2⤵
  PID:9632
- C:\Windows\System\CJScfwX.exe
  C:\Windows\System\CJScfwX.exe
  2⤵
  PID:9652
- C:\Windows\System\bmKkSzj.exe
  C:\Windows\System\bmKkSzj.exe
  2⤵
  PID:9680
- C:\Windows\System\UOSjZmt.exe
  C:\Windows\System\UOSjZmt.exe
  2⤵
  PID:9696
- C:\Windows\System\IMNbsbS.exe
  C:\Windows\System\IMNbsbS.exe
  2⤵
  PID:9720
- C:\Windows\System\XarWywJ.exe
  C:\Windows\System\XarWywJ.exe
  2⤵
  PID:9744
- C:\Windows\System\rJExyWg.exe
  C:\Windows\System\rJExyWg.exe
  2⤵
  PID:9768
- C:\Windows\System\WUFRvrO.exe
  C:\Windows\System\WUFRvrO.exe
  2⤵
  PID:9784
- C:\Windows\System\uSigmOi.exe
  C:\Windows\System\uSigmOi.exe
  2⤵
  PID:9808
- C:\Windows\System\qYwGTkG.exe
  C:\Windows\System\qYwGTkG.exe
  2⤵
  PID:9836
- C:\Windows\System\UouCbtc.exe
  C:\Windows\System\UouCbtc.exe
  2⤵
  PID:9856
- C:\Windows\System\USSrNQr.exe
  C:\Windows\System\USSrNQr.exe
  2⤵
  PID:9884
- C:\Windows\System\cgTUmNM.exe
  C:\Windows\System\cgTUmNM.exe
  2⤵
  PID:9904
- C:\Windows\System\VuYnQsE.exe
  C:\Windows\System\VuYnQsE.exe
  2⤵
  PID:9924
- C:\Windows\System\DRQigjD.exe
  C:\Windows\System\DRQigjD.exe
  2⤵
  PID:9952
- C:\Windows\System\SIKoipx.exe
  C:\Windows\System\SIKoipx.exe
  2⤵
  PID:9972
- C:\Windows\System\egdZbtA.exe
  C:\Windows\System\egdZbtA.exe
  2⤵
  PID:10000
- C:\Windows\System\SIawNmR.exe
  C:\Windows\System\SIawNmR.exe
  2⤵
  PID:10024
- C:\Windows\System\TJNAghR.exe
  C:\Windows\System\TJNAghR.exe
  2⤵
  PID:10040
- C:\Windows\System\ZQyNLZd.exe
  C:\Windows\System\ZQyNLZd.exe
  2⤵
  PID:10064
- C:\Windows\System\XaCOVIl.exe
  C:\Windows\System\XaCOVIl.exe
  2⤵
  PID:10088
- C:\Windows\System\oQHjJKG.exe
  C:\Windows\System\oQHjJKG.exe
  2⤵
  PID:10108
- C:\Windows\System\rtlipyc.exe
  C:\Windows\System\rtlipyc.exe
  2⤵
  PID:10132
- C:\Windows\System\vaGjhjr.exe
  C:\Windows\System\vaGjhjr.exe
  2⤵
  PID:10148
- C:\Windows\System\FulWZCW.exe
  C:\Windows\System\FulWZCW.exe
  2⤵
  PID:10164
- C:\Windows\System\oXWaEBd.exe
  C:\Windows\System\oXWaEBd.exe
  2⤵
  PID:10180
- C:\Windows\System\isHDjcq.exe
  C:\Windows\System\isHDjcq.exe
  2⤵
  PID:10196
- C:\Windows\System\NaLZdaF.exe
  C:\Windows\System\NaLZdaF.exe
  2⤵
  PID:10224
- C:\Windows\System\wXTHGsf.exe
  C:\Windows\System\wXTHGsf.exe
  2⤵
  PID:8960
- C:\Windows\System\BkcgcsY.exe
  C:\Windows\System\BkcgcsY.exe
  2⤵
  PID:9140
- C:\Windows\System\liDqfFr.exe
  C:\Windows\System\liDqfFr.exe
  2⤵
  PID:7320
- C:\Windows\System\Oepledl.exe
  C:\Windows\System\Oepledl.exe
  2⤵
  PID:10252
- C:\Windows\System\UEsgxGx.exe
  C:\Windows\System\UEsgxGx.exe
  2⤵
  PID:10280
- C:\Windows\System\BaBqOAw.exe
  C:\Windows\System\BaBqOAw.exe
  2⤵
  PID:10300
- C:\Windows\System\sugLszX.exe
  C:\Windows\System\sugLszX.exe
  2⤵
  PID:10324
- C:\Windows\System\dZjttSr.exe
  C:\Windows\System\dZjttSr.exe
  2⤵
  PID:10344
- C:\Windows\System\uPPYtlm.exe
  C:\Windows\System\uPPYtlm.exe
  2⤵
  PID:10368
- C:\Windows\System\KZlKnxP.exe
  C:\Windows\System\KZlKnxP.exe
  2⤵
  PID:10392
- C:\Windows\System\OodTAwx.exe
  C:\Windows\System\OodTAwx.exe
  2⤵
  PID:10412
- C:\Windows\System\CyOaSDy.exe
  C:\Windows\System\CyOaSDy.exe
  2⤵
  PID:10436
- C:\Windows\System\cWXMXKF.exe
  C:\Windows\System\cWXMXKF.exe
  2⤵
  PID:10452
- C:\Windows\System\jqZvWwk.exe
  C:\Windows\System\jqZvWwk.exe
  2⤵
  PID:10684
- C:\Windows\System\mOdbwbL.exe
  C:\Windows\System\mOdbwbL.exe
  2⤵
  PID:10704
- C:\Windows\System\HpCaCvm.exe
  C:\Windows\System\HpCaCvm.exe
  2⤵
  PID:10724
- C:\Windows\System\GgKUvoi.exe
  C:\Windows\System\GgKUvoi.exe
  2⤵
  PID:10748
- C:\Windows\System\EQrwgAR.exe
  C:\Windows\System\EQrwgAR.exe
  2⤵
  PID:10764
- C:\Windows\System\pWUlIFJ.exe
  C:\Windows\System\pWUlIFJ.exe
  2⤵
  PID:10780
- C:\Windows\System\SctKMzU.exe
  C:\Windows\System\SctKMzU.exe
  2⤵
  PID:10808
- C:\Windows\System\YhlThsS.exe
  C:\Windows\System\YhlThsS.exe
  2⤵
  PID:10832
- C:\Windows\System\csNewxF.exe
  C:\Windows\System\csNewxF.exe
  2⤵
  PID:10864
- C:\Windows\System\WhlcBBe.exe
  C:\Windows\System\WhlcBBe.exe
  2⤵
  PID:10884
- C:\Windows\System\wyIkqjm.exe
  C:\Windows\System\wyIkqjm.exe
  2⤵
  PID:10904
- C:\Windows\System\jNtUMRM.exe
  C:\Windows\System\jNtUMRM.exe
  2⤵
  PID:10932
- C:\Windows\System\TaJYiTq.exe
  C:\Windows\System\TaJYiTq.exe
  2⤵
  PID:10956
- C:\Windows\System\kTNbZxq.exe
  C:\Windows\System\kTNbZxq.exe
  2⤵
  PID:10980
- C:\Windows\System\mWwjeki.exe
  C:\Windows\System\mWwjeki.exe
  2⤵
  PID:11000
- C:\Windows\System\OGePwjz.exe
  C:\Windows\System\OGePwjz.exe
  2⤵
  PID:11028
- C:\Windows\System\EsHjCtV.exe
  C:\Windows\System\EsHjCtV.exe
  2⤵
  PID:11052
- C:\Windows\System\GMUTikI.exe
  C:\Windows\System\GMUTikI.exe
  2⤵
  PID:11072
- C:\Windows\System\KxaRgPq.exe
  C:\Windows\System\KxaRgPq.exe
  2⤵
  PID:11088
- C:\Windows\System\qrRBLqX.exe
  C:\Windows\System\qrRBLqX.exe
  2⤵
  PID:11104
- C:\Windows\System\uJRdmvX.exe
  C:\Windows\System\uJRdmvX.exe
  2⤵
  PID:11120
- C:\Windows\System\mGEKall.exe
  C:\Windows\System\mGEKall.exe
  2⤵
  PID:11136
- C:\Windows\System\giihDnQ.exe
  C:\Windows\System\giihDnQ.exe
  2⤵
  PID:11152
- C:\Windows\System\QgxNOoR.exe
  C:\Windows\System\QgxNOoR.exe
  2⤵
  PID:11172
- C:\Windows\System\NtsKXZF.exe
  C:\Windows\System\NtsKXZF.exe
  2⤵
  PID:11196
- C:\Windows\System\AOlAnyg.exe
  C:\Windows\System\AOlAnyg.exe
  2⤵
  PID:11216
- C:\Windows\System\EmMGVHQ.exe
  C:\Windows\System\EmMGVHQ.exe
  2⤵
  PID:11240
- C:\Windows\System\cqgMeqm.exe
  C:\Windows\System\cqgMeqm.exe
  2⤵
  PID:11260
- C:\Windows\System\zayLWMx.exe
  C:\Windows\System\zayLWMx.exe
  2⤵
  PID:6876
- C:\Windows\System\obAFtcT.exe
  C:\Windows\System\obAFtcT.exe
  2⤵
  PID:6968
- C:\Windows\System\cGuLmPW.exe
  C:\Windows\System\cGuLmPW.exe
  2⤵
  PID:8608
- C:\Windows\System\YRpbxgC.exe
  C:\Windows\System\YRpbxgC.exe
  2⤵
  PID:5916
- C:\Windows\System\IHAhNEZ.exe
  C:\Windows\System\IHAhNEZ.exe
  2⤵
  PID:7428
- C:\Windows\System\PbKlkjw.exe
  C:\Windows\System\PbKlkjw.exe
  2⤵
  PID:7504
- C:\Windows\System\GEByfrt.exe
  C:\Windows\System\GEByfrt.exe
  2⤵
  PID:7684
- C:\Windows\System\pttrBiA.exe
  C:\Windows\System\pttrBiA.exe
  2⤵
  PID:6104
- C:\Windows\System\pgYxItf.exe
  C:\Windows\System\pgYxItf.exe
  2⤵
  PID:8364
- C:\Windows\System\QgARVBZ.exe
  C:\Windows\System\QgARVBZ.exe
  2⤵
  PID:9260
- C:\Windows\System\AScdcVR.exe
  C:\Windows\System\AScdcVR.exe
  2⤵
  PID:8648
- C:\Windows\System\sGQcSiy.exe
  C:\Windows\System\sGQcSiy.exe
  2⤵
  PID:8708
- C:\Windows\System\MprjVUm.exe
  C:\Windows\System\MprjVUm.exe
  2⤵
  PID:8748
- C:\Windows\System\GjXhlyB.exe
  C:\Windows\System\GjXhlyB.exe
  2⤵
  PID:9516
- C:\Windows\System\dgbeUkn.exe
  C:\Windows\System\dgbeUkn.exe
  2⤵
  PID:9560
- C:\Windows\System\oRNLhHR.exe
  C:\Windows\System\oRNLhHR.exe
  2⤵
  PID:9644
- C:\Windows\System\uCYhgLf.exe
  C:\Windows\System\uCYhgLf.exe
  2⤵
  PID:9764
- C:\Windows\System\FnBBSaY.exe
  C:\Windows\System\FnBBSaY.exe
  2⤵
  PID:9824
- C:\Windows\System\jSwZOXU.exe
  C:\Windows\System\jSwZOXU.exe
  2⤵
  PID:9892
- C:\Windows\System\VtqozTE.exe
  C:\Windows\System\VtqozTE.exe
  2⤵
  PID:9964
- C:\Windows\System\JwdPmgy.exe
  C:\Windows\System\JwdPmgy.exe
  2⤵
  PID:9164
- C:\Windows\System\jRReeLP.exe
  C:\Windows\System\jRReeLP.exe
  2⤵
  PID:436
- C:\Windows\System\BNbFJfV.exe
  C:\Windows\System\BNbFJfV.exe
  2⤵
  PID:10156
- C:\Windows\System\bmBLwit.exe
  C:\Windows\System\bmBLwit.exe
  2⤵
  PID:6336
- C:\Windows\System\mvtiRtD.exe
  C:\Windows\System\mvtiRtD.exe
  2⤵
  PID:7260
- C:\Windows\System\TovSElV.exe
  C:\Windows\System\TovSElV.exe
  2⤵
  PID:7636
- C:\Windows\System\HASEAnH.exe
  C:\Windows\System\HASEAnH.exe
  2⤵
  PID:5232
- C:\Windows\System\dkdLAoN.exe
  C:\Windows\System\dkdLAoN.exe
  2⤵
  PID:10248
- C:\Windows\System\NYTrcwq.exe
  C:\Windows\System\NYTrcwq.exe
  2⤵
  PID:6660
- C:\Windows\System\DmuoDbg.exe
  C:\Windows\System\DmuoDbg.exe
  2⤵
  PID:10332
- C:\Windows\System\HRaYowA.exe
  C:\Windows\System\HRaYowA.exe
  2⤵
  PID:10364
- C:\Windows\System\vdZWoCC.exe
  C:\Windows\System\vdZWoCC.exe
  2⤵
  PID:6940
- C:\Windows\System\gveaKdw.exe
  C:\Windows\System\gveaKdw.exe
  2⤵
  PID:11272
- C:\Windows\System\MIkaJUw.exe
  C:\Windows\System\MIkaJUw.exe
  2⤵
  PID:11336
- C:\Windows\System\mCPiICf.exe
  C:\Windows\System\mCPiICf.exe
  2⤵
  PID:11352
- C:\Windows\System\djoLOhz.exe
  C:\Windows\System\djoLOhz.exe
  2⤵
  PID:11384
- C:\Windows\System\AVyyZZd.exe
  C:\Windows\System\AVyyZZd.exe
  2⤵
  PID:11436
- C:\Windows\System\fPhxbkQ.exe
  C:\Windows\System\fPhxbkQ.exe
  2⤵
  PID:11460
- C:\Windows\System\upsDewB.exe
  C:\Windows\System\upsDewB.exe
  2⤵
  PID:11484
- C:\Windows\System\ssEyRNX.exe
  C:\Windows\System\ssEyRNX.exe
  2⤵
  PID:11504
- C:\Windows\System\gDyTJTT.exe
  C:\Windows\System\gDyTJTT.exe
  2⤵
  PID:11528
- C:\Windows\System\xpVIQkV.exe
  C:\Windows\System\xpVIQkV.exe
  2⤵
  PID:11552
- C:\Windows\System\QvxlEsH.exe
  C:\Windows\System\QvxlEsH.exe
  2⤵
  PID:11568
- C:\Windows\System\eJUcSMM.exe
  C:\Windows\System\eJUcSMM.exe
  2⤵
  PID:11592
- C:\Windows\System\rUpaJhS.exe
  C:\Windows\System\rUpaJhS.exe
  2⤵
  PID:11624
- C:\Windows\System\JcFrrbF.exe
  C:\Windows\System\JcFrrbF.exe
  2⤵
  PID:11648
- C:\Windows\System\UpLtHbT.exe
  C:\Windows\System\UpLtHbT.exe
  2⤵
  PID:11664
- C:\Windows\System\wwPSJSs.exe
  C:\Windows\System\wwPSJSs.exe
  2⤵
  PID:11680
- C:\Windows\System\LyfsPLt.exe
  C:\Windows\System\LyfsPLt.exe
  2⤵
  PID:11696
- C:\Windows\System\beJEwMG.exe
  C:\Windows\System\beJEwMG.exe
  2⤵
  PID:11716
- C:\Windows\System\IpykWQl.exe
  C:\Windows\System\IpykWQl.exe
  2⤵
  PID:11732
- C:\Windows\System\BphcWoP.exe
  C:\Windows\System\BphcWoP.exe
  2⤵
  PID:11756
- C:\Windows\System\PXDBoJY.exe
  C:\Windows\System\PXDBoJY.exe
  2⤵
  PID:11780
- C:\Windows\System\JUmOkWL.exe
  C:\Windows\System\JUmOkWL.exe
  2⤵
  PID:11800
- C:\Windows\System\mVVElna.exe
  C:\Windows\System\mVVElna.exe
  2⤵
  PID:11816
- C:\Windows\System\uRcwwAK.exe
  C:\Windows\System\uRcwwAK.exe
  2⤵
  PID:11840
- C:\Windows\System\eVkYQOG.exe
  C:\Windows\System\eVkYQOG.exe
  2⤵
  PID:11868
- C:\Windows\System\rQpOjVp.exe
  C:\Windows\System\rQpOjVp.exe
  2⤵
  PID:11888
- C:\Windows\System\RJZpWmy.exe
  C:\Windows\System\RJZpWmy.exe
  2⤵
  PID:11908
- C:\Windows\System\SidjbMy.exe
  C:\Windows\System\SidjbMy.exe
  2⤵
  PID:11932
- C:\Windows\System\hlVIOcT.exe
  C:\Windows\System\hlVIOcT.exe
  2⤵
  PID:11952
- C:\Windows\System\TWCqaQz.exe
  C:\Windows\System\TWCqaQz.exe
  2⤵
  PID:11972
- C:\Windows\System\KOMGURb.exe
  C:\Windows\System\KOMGURb.exe
  2⤵
  PID:11992
- C:\Windows\System\tdVjbBh.exe
  C:\Windows\System\tdVjbBh.exe
  2⤵
  PID:12020
- C:\Windows\System\LLPmYPP.exe
  C:\Windows\System\LLPmYPP.exe
  2⤵
  PID:12036
- C:\Windows\System\OduicAD.exe
  C:\Windows\System\OduicAD.exe
  2⤵
  PID:12056
- C:\Windows\System\GFYafVd.exe
  C:\Windows\System\GFYafVd.exe
  2⤵
  PID:12080
- C:\Windows\System\DKDxYHq.exe
  C:\Windows\System\DKDxYHq.exe
  2⤵
  PID:12104
- C:\Windows\System\zxrfYVQ.exe
  C:\Windows\System\zxrfYVQ.exe
  2⤵
  PID:12124
- C:\Windows\System\afjjiUe.exe
  C:\Windows\System\afjjiUe.exe
  2⤵
  PID:12144
- C:\Windows\System\aJTxlOc.exe
  C:\Windows\System\aJTxlOc.exe
  2⤵
  PID:12172
- C:\Windows\System\dIjNWDH.exe
  C:\Windows\System\dIjNWDH.exe
  2⤵
  PID:12192
- C:\Windows\System\wziiBuc.exe
  C:\Windows\System\wziiBuc.exe
  2⤵
  PID:12212
- C:\Windows\System\jyfIdlj.exe
  C:\Windows\System\jyfIdlj.exe
  2⤵
  PID:12236
- C:\Windows\System\ZWHBtsP.exe
  C:\Windows\System\ZWHBtsP.exe
  2⤵
  PID:12256
- C:\Windows\System\jkVoJZc.exe
  C:\Windows\System\jkVoJZc.exe
  2⤵
  PID:12280
- C:\Windows\System\obWJMbI.exe
  C:\Windows\System\obWJMbI.exe
  2⤵
  PID:6472
- C:\Windows\System\BrhRrdr.exe
  C:\Windows\System\BrhRrdr.exe
  2⤵
  PID:7560
- C:\Windows\System\bGjuYUP.exe
  C:\Windows\System\bGjuYUP.exe
  2⤵
  PID:8624
- C:\Windows\System\taqRvBV.exe
  C:\Windows\System\taqRvBV.exe
  2⤵
  PID:1748
- C:\Windows\System\MFuYgCb.exe
  C:\Windows\System\MFuYgCb.exe
  2⤵
  PID:10696
- C:\Windows\System\JsUkvsB.exe
  C:\Windows\System\JsUkvsB.exe
  2⤵
  PID:8148
- C:\Windows\System\jzvFRrt.exe
  C:\Windows\System\jzvFRrt.exe
  2⤵
  PID:8420
- C:\Windows\System\PDSdUmC.exe
  C:\Windows\System\PDSdUmC.exe
  2⤵
  PID:9220
- C:\Windows\System\STahvdz.exe
  C:\Windows\System\STahvdz.exe
  2⤵
  PID:9296
- C:\Windows\System\vQrsDFP.exe
  C:\Windows\System\vQrsDFP.exe
  2⤵
  PID:9384
- C:\Windows\System\iKxGtVV.exe
  C:\Windows\System\iKxGtVV.exe
  2⤵
  PID:8636
- C:\Windows\System\pzEVTUK.exe
  C:\Windows\System\pzEVTUK.exe
  2⤵
  PID:11064
- C:\Windows\System\yHvlYVZ.exe
  C:\Windows\System\yHvlYVZ.exe
  2⤵
  PID:11212
- C:\Windows\System\qBWbBCo.exe
  C:\Windows\System\qBWbBCo.exe
  2⤵
  PID:6820
- C:\Windows\System\LbDUEvc.exe
  C:\Windows\System\LbDUEvc.exe
  2⤵
  PID:892
- C:\Windows\System\wXtzfiH.exe
  C:\Windows\System\wXtzfiH.exe
  2⤵
  PID:7468
- C:\Windows\System\apzbVBh.exe
  C:\Windows\System\apzbVBh.exe
  2⤵
  PID:8928
- C:\Windows\System\zXZfrDH.exe
  C:\Windows\System\zXZfrDH.exe
  2⤵
  PID:12304
- C:\Windows\System\woMczLO.exe
  C:\Windows\System\woMczLO.exe
  2⤵
  PID:12324
- C:\Windows\System\GxbzWug.exe
  C:\Windows\System\GxbzWug.exe
  2⤵
  PID:12340
- C:\Windows\System\WayQCzA.exe
  C:\Windows\System\WayQCzA.exe
  2⤵
  PID:12364
- C:\Windows\System\PaqVCCc.exe
  C:\Windows\System\PaqVCCc.exe
  2⤵
  PID:12388
- C:\Windows\System\WcltzIg.exe
  C:\Windows\System\WcltzIg.exe
  2⤵
  PID:12412
- C:\Windows\System\XEnZccO.exe
  C:\Windows\System\XEnZccO.exe
  2⤵
  PID:12440
- C:\Windows\System\GHbtHGC.exe
  C:\Windows\System\GHbtHGC.exe
  2⤵
  PID:12460
- C:\Windows\System\LKiBQBn.exe
  C:\Windows\System\LKiBQBn.exe
  2⤵
  PID:12488
- C:\Windows\System\eYJUByo.exe
  C:\Windows\System\eYJUByo.exe
  2⤵
  PID:12508
- C:\Windows\System\PturkFD.exe
  C:\Windows\System\PturkFD.exe
  2⤵
  PID:12528
- C:\Windows\System\jSKJPlw.exe
  C:\Windows\System\jSKJPlw.exe
  2⤵
  PID:12556
- C:\Windows\System\DzRjHIy.exe
  C:\Windows\System\DzRjHIy.exe
  2⤵
  PID:12576
- C:\Windows\System\BnTtNwd.exe
  C:\Windows\System\BnTtNwd.exe
  2⤵
  PID:12608
- C:\Windows\System\agwqrVK.exe
  C:\Windows\System\agwqrVK.exe
  2⤵
  PID:12624
- C:\Windows\System\IWYLCHQ.exe
  C:\Windows\System\IWYLCHQ.exe
  2⤵
  PID:12640
- C:\Windows\System\TYyDCID.exe
  C:\Windows\System\TYyDCID.exe
  2⤵
  PID:12656
- C:\Windows\System\UTQKjrY.exe
  C:\Windows\System\UTQKjrY.exe
  2⤵
  PID:12672
- C:\Windows\System\RBWxcKb.exe
  C:\Windows\System\RBWxcKb.exe
  2⤵
  PID:12692
- C:\Windows\System\LolvbKS.exe
  C:\Windows\System\LolvbKS.exe
  2⤵
  PID:12712
- C:\Windows\System\vNTBDlr.exe
  C:\Windows\System\vNTBDlr.exe
  2⤵
  PID:12732
- C:\Windows\System\ZYarkHf.exe
  C:\Windows\System\ZYarkHf.exe
  2⤵
  PID:12756
- C:\Windows\System\lmhNPnI.exe
  C:\Windows\System\lmhNPnI.exe
  2⤵
  PID:12780
- C:\Windows\System\rCVjRqT.exe
  C:\Windows\System\rCVjRqT.exe
  2⤵
  PID:12796
- C:\Windows\System\DxMiTEM.exe
  C:\Windows\System\DxMiTEM.exe
  2⤵
  PID:12824
- C:\Windows\System\cIjzrji.exe
  C:\Windows\System\cIjzrji.exe
  2⤵
  PID:12848
- C:\Windows\System\KwPFOug.exe
  C:\Windows\System\KwPFOug.exe
  2⤵
  PID:12872
- C:\Windows\System\iWodgPk.exe
  C:\Windows\System\iWodgPk.exe
  2⤵
  PID:12888
- C:\Windows\System\Fstjjne.exe
  C:\Windows\System\Fstjjne.exe
  2⤵
  PID:12908
- C:\Windows\System\BlFnLIW.exe
  C:\Windows\System\BlFnLIW.exe
  2⤵
  PID:12932
- C:\Windows\System\aLpgMqk.exe
  C:\Windows\System\aLpgMqk.exe
  2⤵
  PID:12952
- C:\Windows\System\bjgHJkK.exe
  C:\Windows\System\bjgHJkK.exe
  2⤵
  PID:12972
- C:\Windows\System\bnHGTBW.exe
  C:\Windows\System\bnHGTBW.exe
  2⤵
  PID:12996
- C:\Windows\System\xQranFX.exe
  C:\Windows\System\xQranFX.exe
  2⤵
  PID:13020
- C:\Windows\System\XWBZelB.exe
  C:\Windows\System\XWBZelB.exe
  2⤵
  PID:10976
- C:\Windows\System\dfzzwHv.exe
  C:\Windows\System\dfzzwHv.exe
  2⤵
  PID:12032
- C:\Windows\System\DXbwcUO.exe
  C:\Windows\System\DXbwcUO.exe
  2⤵
  PID:12116
- C:\Windows\System\NRWrfDN.exe
  C:\Windows\System\NRWrfDN.exe
  2⤵
  PID:12700
- C:\Windows\System\qvDhSDP.exe
  C:\Windows\System\qvDhSDP.exe
  2⤵
  PID:10232
- C:\Windows\System\mlLOCnF.exe
  C:\Windows\System\mlLOCnF.exe
  2⤵
  PID:10084
- C:\Windows\System\BtYJfur.exe
  C:\Windows\System\BtYJfur.exe
  2⤵
  PID:6300
- C:\Windows\System\UfYzlEw.exe
  C:\Windows\System\UfYzlEw.exe
  2⤵
  PID:10820
- C:\Windows\System\PaXNeyh.exe
  C:\Windows\System\PaXNeyh.exe
  2⤵
  PID:32
- C:\Windows\System\goHqWuQ.exe
  C:\Windows\System\goHqWuQ.exe
  2⤵
  PID:3648
- C:\Windows\System\hykSEtm.exe
  C:\Windows\System\hykSEtm.exe
  2⤵
  PID:10408
- C:\Windows\System\CBTyhJI.exe
  C:\Windows\System\CBTyhJI.exe
  2⤵
  PID:12184
- C:\Windows\System\qgjeeRl.exe
  C:\Windows\System\qgjeeRl.exe
  2⤵
  PID:8048
- C:\Windows\System\TvsPrJk.exe
  C:\Windows\System\TvsPrJk.exe
  2⤵
  PID:9452
- C:\Windows\System\azjegfq.exe
  C:\Windows\System\azjegfq.exe
  2⤵
  PID:9704
- C:\Windows\System\roqYlBk.exe
  C:\Windows\System\roqYlBk.exe
  2⤵
  PID:12300
- C:\Windows\System\FKWfFKv.exe
  C:\Windows\System\FKWfFKv.exe
  2⤵
  PID:12332
- C:\Windows\System\kYJuMYr.exe
  C:\Windows\System\kYJuMYr.exe
  2⤵
  PID:12468
- C:\Windows\System\FGeDQcT.exe
  C:\Windows\System\FGeDQcT.exe
  2⤵
  PID:12524
- C:\Windows\System\DbZtFaA.exe
  C:\Windows\System\DbZtFaA.exe
  2⤵
  PID:12652
- C:\Windows\System\eRiKklN.exe
  C:\Windows\System\eRiKklN.exe
  2⤵
  PID:12740
- C:\Windows\System\wYEJocB.exe
  C:\Windows\System\wYEJocB.exe
  2⤵
  PID:12812
- C:\Windows\System\BkCXinh.exe
  C:\Windows\System\BkCXinh.exe
  2⤵
  PID:12896
- C:\Windows\System\isavFZt.exe
  C:\Windows\System\isavFZt.exe
  2⤵
  PID:12964
- C:\Windows\System\BieduIV.exe
  C:\Windows\System\BieduIV.exe
  2⤵
  PID:13012
- C:\Windows\System\QcGRGFu.exe
  C:\Windows\System\QcGRGFu.exe
  2⤵
  PID:13052
- C:\Windows\System\EsnWHaR.exe
  C:\Windows\System\EsnWHaR.exe
  2⤵
  PID:13084
- C:\Windows\System\crewFuF.exe
  C:\Windows\System\crewFuF.exe
  2⤵
  PID:13120
- C:\Windows\System\SUFSInZ.exe
  C:\Windows\System\SUFSInZ.exe
  2⤵
  PID:13156
- C:\Windows\System\VEAjTTA.exe
  C:\Windows\System\VEAjTTA.exe
  2⤵
  PID:9932
- C:\Windows\System\NkJCIqx.exe
  C:\Windows\System\NkJCIqx.exe
  2⤵
  PID:12100
- C:\Windows\System\jLPWfRh.exe
  C:\Windows\System\jLPWfRh.exe
  2⤵
  PID:12264
- C:\Windows\System\eRSnyzl.exe
  C:\Windows\System\eRSnyzl.exe
  2⤵
  PID:8572
- C:\Windows\System\RVnvGMS.exe
  C:\Windows\System\RVnvGMS.exe
  2⤵
  PID:7088
- C:\Windows\System\MoCPQuo.exe
  C:\Windows\System\MoCPQuo.exe
  2⤵
  PID:9664
- C:\Windows\System\NezEvDj.exe
  C:\Windows\System\NezEvDj.exe
  2⤵
  PID:10008
- C:\Windows\System\NbpjxRX.exe
  C:\Windows\System\NbpjxRX.exe
  2⤵
  PID:9620
- C:\Windows\System\OrSGSmT.exe
  C:\Windows\System\OrSGSmT.exe
  2⤵
  PID:9336
- C:\Windows\System\WjyllWG.exe
  C:\Windows\System\WjyllWG.exe
  2⤵
  PID:1108
- C:\Windows\System\zdwlPAa.exe
  C:\Windows\System\zdwlPAa.exe
  2⤵
  PID:10544
- C:\Windows\System\fYZyoFZ.exe
  C:\Windows\System\fYZyoFZ.exe
  2⤵
  PID:12428
- C:\Windows\System\ltBHLOW.exe
  C:\Windows\System\ltBHLOW.exe
  2⤵
  PID:8520
- C:\Windows\System\jXiFWlP.exe
  C:\Windows\System\jXiFWlP.exe
  2⤵
  PID:10276
- C:\Windows\System\bNidEpo.exe
  C:\Windows\System\bNidEpo.exe
  2⤵
  PID:9692
- C:\Windows\System\BTimOsz.exe
  C:\Windows\System\BTimOsz.exe
  2⤵
  PID:5800
- C:\Windows\System\IIqyVzR.exe
  C:\Windows\System\IIqyVzR.exe
  2⤵
  PID:12044
- C:\Windows\System\zVFuGbI.exe
  C:\Windows\System\zVFuGbI.exe
  2⤵
  PID:10604
- C:\Windows\System\zhOFWwC.exe
  C:\Windows\System\zhOFWwC.exe
  2⤵
  PID:13192
- C:\Windows\System\ExOugok.exe
  C:\Windows\System\ExOugok.exe
  2⤵
  PID:10340
- C:\Windows\System\qPNFaKX.exe
  C:\Windows\System\qPNFaKX.exe
  2⤵
  PID:10124
- C:\Windows\System\HmDmWxz.exe
  C:\Windows\System\HmDmWxz.exe
  2⤵
  PID:5492
- C:\Windows\System\ZbVyuOT.exe
  C:\Windows\System\ZbVyuOT.exe
  2⤵
  PID:13092
- C:\Windows\System\SjCDMwJ.exe
  C:\Windows\System\SjCDMwJ.exe
  2⤵
  PID:12344
- C:\Windows\System\zxismqf.exe
  C:\Windows\System\zxismqf.exe
  2⤵
  PID:12940
- C:\Windows\System\ZmcWIkF.exe
  C:\Windows\System\ZmcWIkF.exe
  2⤵
  PID:4408
- C:\Windows\System\TDYiGaY.exe
  C:\Windows\System\TDYiGaY.exe
  2⤵
  PID:2596
- C:\Windows\System\ppHRtvt.exe
  C:\Windows\System\ppHRtvt.exe
  2⤵
  PID:1500
- C:\Windows\System\SglctWJ.exe
  C:\Windows\System\SglctWJ.exe
  2⤵
  PID:11752
- C:\Windows\System\fUIDCyl.exe
  C:\Windows\System\fUIDCyl.exe
  2⤵
  PID:13216
- C:\Windows\System\OaoMbmk.exe
  C:\Windows\System\OaoMbmk.exe
  2⤵
  PID:9628
- C:\Windows\System\NGCgRRN.exe
  C:\Windows\System\NGCgRRN.exe
  2⤵
  PID:12496
- C:\Windows\System\xSjlvDo.exe
  C:\Windows\System\xSjlvDo.exe
  2⤵
  PID:11900
- C:\Windows\System\frpYeIZ.exe
  C:\Windows\System\frpYeIZ.exe
  2⤵
  PID:9552
- C:\Windows\System\wWnozTi.exe
  C:\Windows\System\wWnozTi.exe
  2⤵
  PID:12584
- C:\Windows\System\adZZKoi.exe
  C:\Windows\System\adZZKoi.exe
  2⤵
  PID:12840
- C:\Windows\System\EbGuLiB.exe
  C:\Windows\System\EbGuLiB.exe
  2⤵
  PID:13080
- C:\Windows\System\kBRlwqH.exe
  C:\Windows\System\kBRlwqH.exe
  2⤵
  PID:9092
- C:\Windows\System\gOVXvFg.exe
  C:\Windows\System\gOVXvFg.exe
  2⤵
  PID:1944
- C:\Windows\System\TrtPJlX.exe
  C:\Windows\System\TrtPJlX.exe
  2⤵
  PID:7724
- C:\Windows\System\AprBBfp.exe
  C:\Windows\System\AprBBfp.exe
  2⤵
  PID:7748
- C:\Windows\System\sBrLAde.exe
  C:\Windows\System\sBrLAde.exe
  2⤵
  PID:9584
- C:\Windows\System\GBfldPK.exe
  C:\Windows\System\GBfldPK.exe
  2⤵
  PID:10192
- C:\Windows\System\VbVsLlk.exe
  C:\Windows\System\VbVsLlk.exe
  2⤵
  PID:12384
- C:\Windows\System\ESjvmxJ.exe
  C:\Windows\System\ESjvmxJ.exe
  2⤵
  PID:10128
- C:\Windows\System\lmkeORZ.exe
  C:\Windows\System\lmkeORZ.exe
  2⤵
  PID:11060
- C:\Windows\System\tiVdEEA.exe
  C:\Windows\System\tiVdEEA.exe
  2⤵
  PID:2200
- C:\Windows\System\UkJzqim.exe
  C:\Windows\System\UkJzqim.exe
  2⤵
  PID:1628
- C:\Windows\System\ZYedHOv.exe
  C:\Windows\System\ZYedHOv.exe
  2⤵
  PID:10448
- C:\Windows\System\xnVeLvV.exe
  C:\Windows\System\xnVeLvV.exe
  2⤵
  PID:11164
- C:\Windows\System\kjNxArV.exe
  C:\Windows\System\kjNxArV.exe
  2⤵
  PID:10988
- C:\Windows\System\zBlRWaU.exe
  C:\Windows\System\zBlRWaU.exe
  2⤵
  PID:5816
- C:\Windows\System\PhMjGlW.exe
  C:\Windows\System\PhMjGlW.exe
  2⤵
  PID:908
- C:\Windows\System\GgyVrsn.exe
  C:\Windows\System\GgyVrsn.exe
  2⤵
  PID:1256
- C:\Windows\System\EDnewFp.exe
  C:\Windows\System\EDnewFp.exe
  2⤵
  PID:3836
- C:\Windows\System\nPoChgO.exe
  C:\Windows\System\nPoChgO.exe
  2⤵
  PID:8264
- C:\Windows\System\gunwOoM.exe
  C:\Windows\System\gunwOoM.exe
  2⤵
  PID:11748
- C:\Windows\System\NjAyHLv.exe
  C:\Windows\System\NjAyHLv.exe
  2⤵
  PID:12708
- C:\Windows\System\YTruTBc.exe
  C:\Windows\System\YTruTBc.exe
  2⤵
  PID:12568
- C:\Windows\System\TRkDOiF.exe
  C:\Windows\System\TRkDOiF.exe
  2⤵
  PID:12636
- C:\Windows\System\OXfekZk.exe
  C:\Windows\System\OXfekZk.exe
  2⤵
  PID:12968
- C:\Windows\System\ZBVSyIb.exe
  C:\Windows\System\ZBVSyIb.exe
  2⤵
  PID:13560
- C:\Windows\System\RconYMz.exe
  C:\Windows\System\RconYMz.exe
  2⤵
  PID:13580
- C:\Windows\System\YNRaklH.exe
  C:\Windows\System\YNRaklH.exe
  2⤵
  PID:13612
- C:\Windows\System\dwcYZty.exe
  C:\Windows\System\dwcYZty.exe
  2⤵
  PID:13732
- C:\Windows\System\QaOHYBQ.exe
  C:\Windows\System\QaOHYBQ.exe
  2⤵
  PID:13820
- C:\Windows\System\ajPEYIO.exe
  C:\Windows\System\ajPEYIO.exe
  2⤵
  PID:13840
- C:\Windows\System\oRzpHzk.exe
  C:\Windows\System\oRzpHzk.exe
  2⤵
  PID:13872
- C:\Windows\System\csXBEVT.exe
  C:\Windows\System\csXBEVT.exe
  2⤵
  PID:14020
- C:\Windows\System\tUpVuoR.exe
  C:\Windows\System\tUpVuoR.exe
  2⤵
  PID:14036
- C:\Windows\System\pVrhfPm.exe
  C:\Windows\System\pVrhfPm.exe
  2⤵
  PID:14076
- C:\Windows\System\kAFBJCN.exe
  C:\Windows\System\kAFBJCN.exe
  2⤵
  PID:14112
- C:\Windows\System\rNUmyOU.exe
  C:\Windows\System\rNUmyOU.exe
  2⤵
  PID:14236
- C:\Windows\System\EboCEyb.exe
  C:\Windows\System\EboCEyb.exe
  2⤵
  PID:14256
- C:\Windows\System\WxgYmlO.exe
  C:\Windows\System\WxgYmlO.exe
  2⤵
  PID:14284
- C:\Windows\System\VnnJMWA.exe
  C:\Windows\System\VnnJMWA.exe
  2⤵
  PID:14304
- C:\Windows\System\vlPMZHP.exe
  C:\Windows\System\vlPMZHP.exe
  2⤵
  PID:14332
- C:\Windows\System\RWUvtoc.exe
  C:\Windows\System\RWUvtoc.exe
  2⤵
  PID:13524
- C:\Windows\System\tgGEaEi.exe
  C:\Windows\System\tgGEaEi.exe
  2⤵
  PID:13440
- C:\Windows\System\oQuGwRG.exe
  C:\Windows\System\oQuGwRG.exe
  2⤵
  PID:13716
- C:\Windows\System\jpzfwwI.exe
  C:\Windows\System\jpzfwwI.exe
  2⤵
  PID:13748
- C:\Windows\System\SGjYNyJ.exe
  C:\Windows\System\SGjYNyJ.exe
  2⤵
  PID:13776
- C:\Windows\System\tFNWvfR.exe
  C:\Windows\System\tFNWvfR.exe
  2⤵
  PID:13624
- C:\Windows\System\SRHslAr.exe
  C:\Windows\System\SRHslAr.exe
  2⤵
  PID:13836
- C:\Windows\System\lzOKGpn.exe
  C:\Windows\System\lzOKGpn.exe
  2⤵
  PID:13860
- C:\Windows\System\EoYulwB.exe
  C:\Windows\System\EoYulwB.exe
  2⤵
  PID:13880
- C:\Windows\System\hcrRJMM.exe
  C:\Windows\System\hcrRJMM.exe
  2⤵
  PID:6432
- C:\Windows\System\gTucxat.exe
  C:\Windows\System\gTucxat.exe
  2⤵
  PID:14064
- C:\Windows\System\FeCqPnW.exe
  C:\Windows\System\FeCqPnW.exe
  2⤵
  PID:14156
- C:\Windows\System\WJecOWr.exe
  C:\Windows\System\WJecOWr.exe
  2⤵
  PID:9688
- C:\Windows\System\hrBViZr.exe
  C:\Windows\System\hrBViZr.exe
  2⤵
  PID:14296
- C:\Windows\System\vzZsfUE.exe
  C:\Windows\System\vzZsfUE.exe
  2⤵
  PID:9484
- C:\Windows\System\MRVPIIk.exe
  C:\Windows\System\MRVPIIk.exe
  2⤵
  PID:13412
- C:\Windows\System\djLhuyH.exe
  C:\Windows\System\djLhuyH.exe
  2⤵
  PID:5392
- C:\Windows\System\WtMLtFg.exe
  C:\Windows\System\WtMLtFg.exe
  2⤵
  PID:13420
- C:\Windows\System\rUzsDjd.exe
  C:\Windows\System\rUzsDjd.exe
  2⤵
  PID:13656
- C:\Windows\System\TWJCsPD.exe
  C:\Windows\System\TWJCsPD.exe
  2⤵
  PID:13684
- C:\Windows\System\pgkNknW.exe
  C:\Windows\System\pgkNknW.exe
  2⤵
  PID:13884
- C:\Windows\System\cRIcesH.exe
  C:\Windows\System\cRIcesH.exe
  2⤵
  PID:13556
- C:\Windows\System\gZOzuue.exe
  C:\Windows\System\gZOzuue.exe
  2⤵
  PID:7620
- C:\Windows\System\OkPMQMR.exe
  C:\Windows\System\OkPMQMR.exe
  2⤵
  PID:14124
- C:\Windows\System\PWFCLTq.exe
  C:\Windows\System\PWFCLTq.exe
  2⤵
  PID:4596
- C:\Windows\System\DAUokIT.exe
  C:\Windows\System\DAUokIT.exe
  2⤵
  PID:12768
- C:\Windows\System\oBQYVGq.exe
  C:\Windows\System\oBQYVGq.exe
  2⤵
  PID:14056
- C:\Windows\System\ymnzEig.exe
  C:\Windows\System\ymnzEig.exe
  2⤵
  PID:13392
- C:\Windows\System\tuObqIJ.exe
  C:\Windows\System\tuObqIJ.exe
  2⤵
  PID:12200
- C:\Windows\System\rWNtBQU.exe
  C:\Windows\System\rWNtBQU.exe
  2⤵
  PID:13320
- C:\Windows\System\nZhHSlv.exe
  C:\Windows\System\nZhHSlv.exe
  2⤵
  PID:632
- C:\Windows\System\mesxaQQ.exe
  C:\Windows\System\mesxaQQ.exe
  2⤵
  PID:14188
- C:\Windows\System\eqErgXn.exe
  C:\Windows\System\eqErgXn.exe
  2⤵
  PID:13116
- C:\Windows\System\zzNsccT.exe
  C:\Windows\System\zzNsccT.exe
  2⤵
  PID:4548
- C:\Windows\System\HcURTQl.exe
  C:\Windows\System\HcURTQl.exe
  2⤵
  PID:13548
- C:\Windows\System\YgKGLfZ.exe
  C:\Windows\System\YgKGLfZ.exe
  2⤵
  PID:14120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_02uuxdlr.nfr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CjuGMQl.exe

Filesize
1.8MB

MD5
6bec3791035d9342f295ebbab0b1786f

SHA1
ec6b783e2857a8b1ba92feb9e004c856b88e2952

SHA256
53cbdfdb60620760c792620761997f06986f83fb8519a4500e7a9f6a3fbabf63

SHA512
008d4203e34b839731bb393745dd17dd812a05e006880557d28ab632603f1584e848e78e4bceffd1a4b9bd1ad36a7d93b1021f6a9855a77db0d3588a5973b4b2

Download Submit
C:\Windows\System\CrguieZ.exe

Filesize
1.8MB

MD5
56e338dac2bb3872c0eae4a98a47648b

SHA1
9a21edb7526433266ab4883451bdd5e177fd08b4

SHA256
da7aa3de4aed557245339cecbd5a1fdc382c80df0d15199bd41e9ab3701139f6

SHA512
6c8f03d84436e29854c89fc3b91156474ef983fb1df1ea9020d52ef47e5a619c5cceebcc185cdd8c20e4c5be4fa75a1d248772bebf80a10ac907146c42fa4c83

Download Submit
C:\Windows\System\DGVVJiy.exe

Filesize
1.8MB

MD5
15f3b56677d31b003819589f7465712b

SHA1
b102e91969cecd22fd8b3ab6845a8e746426f338

SHA256
2d887cc1137e00176eab66bb49a593737f50e43d79affc45c0dd354a264826e4

SHA512
aed7f1c8db6b463802c16704ce4e42dc7525d4aa3cc4fb4dc7a399b6079b2bb41ed236bf2964e30cf210bd8d2ae3a16d68ec877f7ee7d24d129cda90d3b53368

Download Submit
C:\Windows\System\EvotMWN.exe

Filesize
1.9MB

MD5
534c50fa67ba7424c242a4c66479801d

SHA1
b2a81c59445dcf272885c526720d4e56be035376

SHA256
3648d6536913cd1e46b1ab4945050b688f636f0a17e9b24c202d9c6da5f24a23

SHA512
204437a95c227dfa4283502d9fe1a721f7657600dc5092327b9875616295b74607fc7d660c4b325e34cfbc83534192ebe4adb9fd2cb004b457ce51486c49aedf

Download Submit
C:\Windows\System\FBWvILL.exe

Filesize
1.8MB

MD5
a166105beb3cddd5226f4e957d413dcd

SHA1
97af938decbd0bcfc77208e23bb24ddc22112be4

SHA256
93d33ad39d42beae033a0714032b3874f349a391f834151e3ce7218082deb699

SHA512
fc2f55a01d9f81e4739cd7cae640fb4718302eb26958fc29c4f7dda3764bc338a2ebd8f2b64b163cdba4c80b9e5df7099fa4f8f2fcdc3f80b787eba4f8d4259c

Download Submit
C:\Windows\System\FRHhxzN.exe

Filesize
1.9MB

MD5
cab48438f19a536fc5a6af378e85fa81

SHA1
12888bd8acce57a40a483a6bd755172a0f328e5e

SHA256
86d49f754d2c6c14cb6c68238ce0e5d4a8ff4830374262b597e7c5c4ee256a0a

SHA512
ede8fb76107e1d7afa3cd81dce5bd41e999aed5bbe5ca992e9c3cff41aef5f643d58357be3f2570543c2b1a57fdefc1719bf22adfe79ef6b0c9c6ec55f4432cf

Download Submit
C:\Windows\System\GgMHqBA.exe

Filesize
1.8MB

MD5
c451f744e32d8aa4cfde4e0f64027cbe

SHA1
a495c80e9a47c10eae89d5332e0b16b04727a016

SHA256
24f362bc5975147447d397fcc285c99bc5336576b87cea4775b8845828ed40ac

SHA512
9fe7141816a765129982173ddd4c074ba6ffee383fe687fe68cfd1023841ea908fe1be69ba1192b9013ee10b3d18f663bd991fc24ff25e660a0caebb0c4a8127

Download Submit
C:\Windows\System\IEtoftN.exe

Filesize
1.8MB

MD5
8982d11b052994fc46371d03c02079e7

SHA1
dfa0ac6e2524253ff845e00e8f6bace7517d4ca0

SHA256
ee4bb563113663ab3ef43fa90eebb9ec366b742d005c52f5055bfd14a0c4e355

SHA512
b94e91cfa0d0acac52f4443c0b36347fae5540a43d80fe999537e65c3cc1a09542b46ca53125badd9708d2721a22885583712c2fff3d1404cf0ec759131bde0f

Download Submit
C:\Windows\System\IrgoIrD.exe

Filesize
1.8MB

MD5
748eb0c3d9eb3a570edb5767692f4884

SHA1
9048b2b39e89fa118d8a1098a96fb781b173309e

SHA256
5264e20cdef283481caac55bf4c4997f5fd0287e8510ae35f452eacb2255f9e0

SHA512
e06a5128efdc882b5ca392eceda45c32209865483a9fa158d550d88cac0a10f06e542a3c35155cf26d2055af1b576816ec5f071791ee604ab19a0879ebfc1795

Download Submit
C:\Windows\System\Jktkaog.exe

Filesize
1.9MB

MD5
17d6be5b4badbeb97f6ee80ba9c2ae01

SHA1
34c4bdd2cddbe53472a5f75b5b504f606f00d522

SHA256
2535b520897b509f04982bd2e155ddc0b4f758405ce099a77c1f0290b0ba17f1

SHA512
f3cbd261d4c16589db0cffdab47d50a9ce07cbe08403fefb5d413a299568e1c0778755e5d76b482bfaafcebd6cdde1948db5c358b77edc63f83f79f8df381608

Download Submit
C:\Windows\System\KBluSYm.exe

Filesize
1.9MB

MD5
c015c09f844b1b8c333ca0f925e5d86a

SHA1
1eaeb1aa751807c2f1d3fd16c4fada7c6af48e7d

SHA256
1bf599216556a471bd038c34428af2db133b3759bc35c8374e63287bac4e33e1

SHA512
717f0cbbb392438df12d3cecc2ab5715ef332bbece366d81c208ab360484c6929d7f067abc64268d0d75d0c4f064bd555657f7cdd99f429a9906d1fecfb4061b

Download Submit
C:\Windows\System\KdEHCtK.exe

Filesize
1.9MB

MD5
cc4d47de1261ae4d917b4dd0e519478c

SHA1
5bd00b304d31b3f9869d96a375aa3e5a9f05f042

SHA256
236ef78f041c640c715f34fd13fd9db248be661970ead9337fb0b6c38d9f8cd7

SHA512
b24aed6654fb4305875d54d40834d5ff1915beeef30f067af1d8d0b6929907be0bb8cdd9ea7667909254882543f314da961477981d1dd8d30f00a9e4ae90d04b

Download Submit
C:\Windows\System\LrARqUU.exe

Filesize
1.8MB

MD5
bbf9ceb705f4180429eba94cd2e22f18

SHA1
82e253117bd1b5528dd55d3c4bd2c20c4808b835

SHA256
f367f7a7588089ed25e1c65a8ecbcc2c17ed3d9781ead387f9796fad2d738ce8

SHA512
6af9fa9c5d8fbe219b6a5cc5d0cdefc664e005c194e0e6e65432e45af3eee7628e5173183496b61f13727fe534643481ea8aa89e4768b658e0529e00f58362b7

Download Submit
C:\Windows\System\LtLmFwu.exe

Filesize
1.9MB

MD5
eaf4a613b984c86a8305462eede85fdd

SHA1
b83c0ac94d8034bcaa9214f54cf303dce6f9f764

SHA256
94326eb64620138a95a5d7de7d62577cad387cd4fcf5617f15d832f81f34a9ba

SHA512
b6ef2e000339afb31ce11d4130fe451e151fcbb496aabe20ff4ebeb80c0889e4645c92157c81225dc0f683b597a3e5b08259e7672bf69bf01bccdaa3151af352

Download Submit
C:\Windows\System\MUmKLDm.exe

Filesize
1.8MB

MD5
99063394429a1bcf5ea8db847b21909c

SHA1
c2c08a4605a733785881df100303c4312a09dba0

SHA256
e646b9476812d84bc8104dbb776bd32f1ebad19d723ea7a2491ddcb8114e7ca6

SHA512
f03222636c2a508753c34f974df2923eb4eed4ce1a434f39e18d0ed614c2f8e0090654a8abe768e42bb9e49949780b812aacf1f7a4b059c6ae1c40d16700564f

Download Submit
C:\Windows\System\NAHtzbT.exe

Filesize
1.9MB

MD5
36feb4739221ca8e31a6d4b79f17752d

SHA1
4e3305a4268b3ea9968e70c6ce51710ed067ee3b

SHA256
27807eaa8c931791a982a0a4529e0d7bf5e1ef56f966f3a336f365f124db8ecc

SHA512
d06b3db7a8aa939123b95ec61f199e7ebdb09282ec7bb604fb08c3eeb4230bf5e320b2ed017bd62363573b852bb2b2680529b771bea657cb4a94ef4698d58784

Download Submit
C:\Windows\System\NktknuI.exe

Filesize
1.9MB

MD5
41871dd63061cc7dd91c4ea93955b72e

SHA1
6760564454c4660f510b1ba458efa4cca6af50c2

SHA256
e7800391c08a8c60d554ea8e203e0171addfab4020058142f8f49a01ef38ae75

SHA512
b98fed7c291de0b573ae5a69cfe5612639a89d0c4ca3f1b308a0255a9841cb3370170b4ea0cae15a7dc546a98d96b7e024f93e7c64ea06353ae25aa9d3372d5f

Download Submit
C:\Windows\System\OHRqgde.exe

Filesize
1.9MB

MD5
a9badf08fbc57122aebbdd6848f309fe

SHA1
a5022b320989a63cb0cd328240ec27926e7430c5

SHA256
0995ec62ba7d36b322715c725f93db490aa70387f0e6b2146573b4ad6cb08acf

SHA512
c173a547939a8d750c94a4d518d70f16483b1ba04b743897ccf0b9a96ea059b711fa86da7d4d9df18a9ff49fc2482b623a397cc581dcbd89d22d7319cffcdfba

Download Submit
C:\Windows\System\OljcoWR.exe

Filesize
1.9MB

MD5
f289179a1018748d80f7c328e9c1a598

SHA1
c84e9d9e72829ad5936f4bcefbae8b2258e82f1f

SHA256
094e6981d3a7338886fcf855c21e96139d1d553c13bdb465aa295843289ef7c3

SHA512
6c8aa51f532c732124d7e42827061ff23b89334a516c33f52a54ca82a863ac16898c04c2bd215d8578204ed23247bafc111f4a15963a248d2c9ed50b820d3bb1

Download Submit
C:\Windows\System\QvRdVXS.exe

Filesize
1.9MB

MD5
60cab4d2e44f37bdc219c0d77083fcc5

SHA1
90d44762487407f4806b6d2bf7a15b55a0cb8a32

SHA256
a824fed83829fe67d6a89d061e218e49afcca989d202f21b7c2d7556d16c046f

SHA512
ee6ef6e7e81f1eb2e81eadc4b7b53fd0f202ce077646540e2069f2e6033dcce3e65cb60cc6adf18fced76f64f8389a76cf3c175d58a6541494312177c2e6e6e6

Download Submit
C:\Windows\System\VopCZKB.exe

Filesize
1.8MB

MD5
0782a3a90fbb70afdbcd6bf39b705c43

SHA1
81c6e04bbd6d11f7fbfe9c09faa65980063f05d9

SHA256
1e894ba64222e1a4085ec8b35e33fdfc7ff147dfb02e1b93845c238372603c02

SHA512
c31371d6f0bcbaabf5d8687bdc22d4252ddf7139fc1b1efb839c2710a7cd993e2d0a96146492248c511e85dbc523470f395a5e7d335791d7791ca48049dd7613

Download Submit
C:\Windows\System\WSQiMWc.exe

Filesize
1.9MB

MD5
74819739be3cd058f3497cf03c459473

SHA1
b6d2429060225795a9fe347c5bb3eb2a268dd4e4

SHA256
ec5786576de2d444ea8105b1456074027a6a2e6bba2da8d87bf52f93080ced7f

SHA512
77845a1922e58abf5d80ceb6ddcbe1fadfb24912e233f7efd75c4ea663a1d75cf5c33bbff90c9901e8c14930489266010da43c93ec7d234ccd022679eca5fd71

Download Submit
C:\Windows\System\XMkCfnK.exe

Filesize
1.9MB

MD5
d7f82f5dd1096696ba0aee8db182c76a

SHA1
18cf519f304f9b02da29f3234f4013c2f4076631

SHA256
7f0775fc10ca6cc0ecfb83acbd9fe1bb91e31593d5257a0d2a76571eea755a58

SHA512
a4af2eb2ac2439aff8f8aae1dfb69830bee5b7a4101afac615a5c0616a047457142db01a2a7f39e0c4f90a67c4fd82a716537f6f7b933e4eafddd2918bd13706

Download Submit
C:\Windows\System\YJcXrhY.exe

Filesize
1.8MB

MD5
57af0a5381d062320314fcd8849d2cd0

SHA1
ecb80b65625205a2ed82ac21fdccdcce20380b19

SHA256
243844300281dfaae555d671db6fcc2a92e6b269166d9748939e96c9884fb4a9

SHA512
7f0e93be4d47e3a531466abe7cec79be47baa3cf71492cd532e1f05a5fd9a5e1bea321a75a189bcbbe29df826194f7170b7bed8a1120ca973bf73c5b71d804d2

Download Submit
C:\Windows\System\ZfmmzWJ.exe

Filesize
1.8MB

MD5
16115a1bb13496e2b7ee6f73cfa8d9fb

SHA1
7fd8bc5013927b60f03789a9701b65a9e981a8ce

SHA256
44fe4e8f0734641a6c316386724700a2df004db611687943ab2847be12d1c167

SHA512
1d376fd945d841ed28919143bc5ac751082524202ebe6f753eb93bf12dd2daf5424222ee370703b94fd44b7b47768588f684573aa0bd3a667b461609fb1b9ca7

Download Submit
C:\Windows\System\brjWWEF.exe

Filesize
1.9MB

MD5
bb85f1cb6f21db30a87dbdfc7fda4d53

SHA1
93edaa023d2901e9aba04a390e07dc8cd8a42194

SHA256
8c066bc49247a344c0c8ef4548e59393b3fe30c087a9fa58fc84b620bb37170d

SHA512
7b4d255e5d916b500af65ac4a330506597e10941902f55f5d0f01e7f1395d1f09b0a94c30805e9774e039ec6f969c4cf49c3aa5655b6434f7b260840841f2e06

Download Submit
C:\Windows\System\dsJxEvv.exe

Filesize
1.9MB

MD5
06567fc38130d0fa0e0efb4035d9f6b5

SHA1
00b052f6fefb017bd6bf176e7764bdd62f284dd2

SHA256
0a41781d02f113e8a5267f3eed63cee36308789615ad419697d45001797e84d9

SHA512
18816d874ff6bffeac95381056e734fc24b69644d6181bbc4f505ca4b0d76ac4fec4b93769de77e9f94ba4a7554ad21db22f0777d1db7360f5463e96f2f3726d

Download Submit
C:\Windows\System\eCzcbGv.exe

Filesize
1.8MB

MD5
c1de1e2ab1aaa7972efd7f36c0027fb7

SHA1
4ab86ff2864e7f08d5519568a15b5d1f5b05ea38

SHA256
1b8420b7de9fb82250bb88a498b76319295bf6c41d3c29b3b11fb3cc349aca6b

SHA512
ad2da2f7ab1d85350e8ab841197e6f0bcdc8ff09983c9df178cc6448a71d595ccb987fab3ba407e440c46c5f039ad3008a72c865922bc10ecd7fef6918aa08b5

Download Submit
C:\Windows\System\iWpsCcU.exe

Filesize
1.9MB

MD5
a57e8b11cb491696e8f1e2e912c1024d

SHA1
35fcbc49b5fc6a9307867481a9584ea335683f12

SHA256
5f468a17a6369356e03839a0facd152b62d6516b569a4f4b6251c64f732704bf

SHA512
787cde6416741956f4ee72fb7638944933b80f8ad26c3ab637e631de67bf5593b1a721557ed3cfbd81bc9586ed4e4d6ea31197396b62e8e16b0faec67645ce34

Download Submit
C:\Windows\System\ihtHyTx.exe

Filesize
8B

MD5
705d25b3ec0fea5575302c25e552a70b

SHA1
809ff158d608d95c7b67c94be003a088cfc01ba8

SHA256
bc924ae53e296c4843854faafff02340755c3d5f144f9daee7e0adbf14a629b3

SHA512
348fe56e111f8f28e13e6e37899f70af1aa0b441c5090bfbe9f9518fd93d1b55124acd6877d48ec85ca3de3917e53c946014165637b9c93be0e15afbd9733b5d

Download Submit
C:\Windows\System\lxQbmFa.exe

Filesize
1.8MB

MD5
7d2c648c08dd1125100b32c9196ba7b9

SHA1
f49886addbae7dba6ef049f05bbbc9e6c0661f65

SHA256
21506b3f79648bfc04aac54b888b4eae06664a3e280f0fc5a13fec0c41d7be26

SHA512
f3cf6a29380cb2539e57596b78dfe77429f561cdc4119eb7813b8c245dfb5960fdc21b1e70a959ca13c625930380a2482d0e20e8e2a0d3bbb1d35a313fd6f34f

Download Submit
C:\Windows\System\oHIabWD.exe

Filesize
1.8MB

MD5
a28970e3bbe2a7f5299d14f1edd38630

SHA1
f01409ddcde3eb31f36bbe4ab5904ed3fab97c99

SHA256
d7aa019d069f8984edcb588aefa637454ddccc99b2adfed233fa79919cddb86d

SHA512
91b8ab56730120448dd95bc1d024b5f43ebd0ddc199d8331a14085451163d651782f68e193a713c43f1f576274e3de9f160f54f403ad6eff5b755679c323294f

Download Submit
C:\Windows\System\qFqoaLZ.exe

Filesize
1.8MB

MD5
b2a4de8cfa4f5924c0bf2bf7717e7fc9

SHA1
b831604e84628c9886da63a68cbbff49279b9914

SHA256
a3ff9dcca6003ae58a26c577a293a1e2b362f7de1a0ba604a95fc639bdf6c915

SHA512
1d0fb68cc87312cee304174598e53f07d663724fa8b5f6f22c76f72c8984e6a0b6ce1df054f7266f0a3e5bc41ba27a9cc7c07b67d78c492857a7f65965e55e90

Download Submit
C:\Windows\System\ryJFQyV.exe

Filesize
1.8MB

MD5
a0a56c800d92c46a069230c018de0f27

SHA1
b748c3cde8fbcb1e4663614dc696bfa312685ced

SHA256
6d7848027f7733b2d8e2b2293fd37c8d0da73d20e9abc143525ddddda7051c5e

SHA512
b0914e7f6d6ba4ce4efc4ab64de89222296ad4b1478573b1824ae1f5408fbd18d05f20636efbd39fe00df7be5917d24d8aa3ce04733e42f8de8226668dcf9aeb

Download Submit
C:\Windows\System\sAZnEqb.exe

Filesize
1.8MB

MD5
b234c0b1cd36913073e4bcd182d284cc

SHA1
9e4538582531f2f83727eced9294975207a44212

SHA256
ee9acb297a162069a8d9ef8544ee99156993876bf535da5839c808f5c679a1a8

SHA512
24f58ea39b1b54a1a6f3395d4ad9ab90ba22347cd7a14d66380556bddcc27058fed355114bb3457abf6f914a67595480953cdba81b6f41e8e5d9a298e815f049

Download Submit
C:\Windows\System\sFmBezG.exe

Filesize
1.8MB

MD5
e8298a1c914bc721da679def4084d697

SHA1
51af7cd8cbbcabbf76575b4fdf647f8ec287f0c1

SHA256
222c4be5a79a683859f152144c7ec7816eb90a58a39cca6e47427603dbd52096

SHA512
6307384c324d6108fd5c0db2df6a04c779efa03210aeb68e154eaa20ba737ead9e389881ab9a988e757676b60d0e6c9b78c6dc2eac5eebb5bc65f22e04427a6c

Download Submit
C:\Windows\System\tQfemKR.exe

Filesize
1.8MB

MD5
2dab4e724c62e4965b3f3bde7ef75461

SHA1
ffbf70fd8e3999a4da47b419818c67f8ca6877eb

SHA256
cd2d3635fa6a5c977d09b18f04fecb8bdbdd86f82a3121341f651ab176768c5c

SHA512
b6701b7c3c343ae0515ea25b58aa0715c7905b6897293cc0d001c0321eef4af06fb1b187288b8fef0300b93f64cd66d8e115366180c969413557948312e78e00

Download Submit
C:\Windows\System\vVGADuV.exe

Filesize
1.9MB

MD5
8beaadf6a218f47a03e04fcae50aa024

SHA1
56709138c47d38bfd7b4a3ba25871fd598a0fa6a

SHA256
01551d5c44f67bc0a96f98ee923edef9b6681a2e9a0e7745b12d91578f09a5cb

SHA512
33bdeda825aafdb777f3444e2f6b7593fdd35523dce8d097b975163c9448d23a42be1d6fa570dd269d80a08ac37d926f18fea9ebf7bbdb4f15d957d2c2570154

Download Submit
C:\Windows\System\wtogwNZ.exe

Filesize
1.9MB

MD5
c8f250bcaefe0065087f4156bbf15091

SHA1
fc3515a5cef8dbbf0083cec56fdfe5947a912248

SHA256
db991f0da7b5e268721322b93318e39442e4e8d0aa6948768401689aec191f57

SHA512
9aa7c0219f7c10b4574b31db5cd2240b58be5aa5e4fb87a3566350c88e5592796a739e6be0909345947a5962e0bdebf10f0e622ec559f85c825996767efa9818

Download Submit
C:\Windows\System\yVbhSwM.exe

Filesize
1.8MB

MD5
18424284cb4ba078b7f6d65e732996c4

SHA1
19672181148740d582575dd851d5fe42cbcfacc6

SHA256
574f912170e595e14663bb4f7781c000dd228af78bc6b578f540b2f2960ef7e1

SHA512
efb3a43f87843c31f9c1f972d36cf9317ec03a66a4b25f7a443c21f345d8042916210f5c99ed06e8e8fccac3b8af2afc2f7cfbe9733e7d735789d82814383fb4

Download Submit
memory/1020-3200-0x00007FF63A030000-0x00007FF63A422000-memory.dmp

Filesize
3.9MB

Download
memory/1020-191-0x00007FF63A030000-0x00007FF63A422000-memory.dmp

Filesize
3.9MB

Download
memory/1036-474-0x00007FF6CF340000-0x00007FF6CF732000-memory.dmp

Filesize
3.9MB

Download
memory/1036-3216-0x00007FF6CF340000-0x00007FF6CF732000-memory.dmp

Filesize
3.9MB

Download
memory/1052-504-0x00007FF6FA0E0000-0x00007FF6FA4D2000-memory.dmp

Filesize
3.9MB

Download
memory/1052-3209-0x00007FF6FA0E0000-0x00007FF6FA4D2000-memory.dmp

Filesize
3.9MB

Download
memory/1064-3228-0x00007FF6C5A90000-0x00007FF6C5E82000-memory.dmp

Filesize
3.9MB

Download
memory/1064-507-0x00007FF6C5A90000-0x00007FF6C5E82000-memory.dmp

Filesize
3.9MB

Download
memory/1520-498-0x00007FF6B4B30000-0x00007FF6B4F22000-memory.dmp

Filesize
3.9MB

Download
memory/1520-3227-0x00007FF6B4B30000-0x00007FF6B4F22000-memory.dmp

Filesize
3.9MB

Download
memory/1716-112-0x00007FF79B7E0000-0x00007FF79BBD2000-memory.dmp

Filesize
3.9MB

Download
memory/1716-3202-0x00007FF79B7E0000-0x00007FF79BBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-506-0x00007FF6D0860000-0x00007FF6D0C52000-memory.dmp

Filesize
3.9MB

Download
memory/2244-3246-0x00007FF6D0860000-0x00007FF6D0C52000-memory.dmp

Filesize
3.9MB

Download
memory/2276-503-0x00007FF764E00000-0x00007FF7651F2000-memory.dmp

Filesize
3.9MB

Download
memory/2276-3192-0x00007FF764E00000-0x00007FF7651F2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-3207-0x00007FF632EC0000-0x00007FF6332B2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-198-0x00007FF632EC0000-0x00007FF6332B2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-3232-0x00007FF7CB820000-0x00007FF7CBC12000-memory.dmp

Filesize
3.9MB

Download
memory/2592-473-0x00007FF7CB820000-0x00007FF7CBC12000-memory.dmp

Filesize
3.9MB

Download
memory/2716-499-0x00007FF636070000-0x00007FF636462000-memory.dmp

Filesize
3.9MB

Download
memory/2716-3252-0x00007FF636070000-0x00007FF636462000-memory.dmp

Filesize
3.9MB

Download
memory/2736-3199-0x00007FF6D8760000-0x00007FF6D8B52000-memory.dmp

Filesize
3.9MB

Download
memory/2736-240-0x00007FF6D8760000-0x00007FF6D8B52000-memory.dmp

Filesize
3.9MB

Download
memory/2972-3210-0x00007FF752A50000-0x00007FF752E42000-memory.dmp

Filesize
3.9MB

Download
memory/2972-323-0x00007FF752A50000-0x00007FF752E42000-memory.dmp

Filesize
3.9MB

Download
memory/3156-53-0x00007FF70C650000-0x00007FF70CA42000-memory.dmp

Filesize
3.9MB

Download
memory/3156-3195-0x00007FF70C650000-0x00007FF70CA42000-memory.dmp

Filesize
3.9MB

Download
memory/3288-2030-0x00007FF844740000-0x00007FF845201000-memory.dmp

Filesize
10.8MB

Download
memory/3288-136-0x0000027EBD120000-0x0000027EBD142000-memory.dmp

Filesize
136KB

Download
memory/3288-91-0x00007FF844740000-0x00007FF845201000-memory.dmp

Filesize
10.8MB

Download
memory/3288-7-0x00007FF844743000-0x00007FF844745000-memory.dmp

Filesize
8KB

Download
memory/3288-40-0x00007FF844740000-0x00007FF845201000-memory.dmp

Filesize
10.8MB

Download
memory/3424-0-0x00007FF7A7350000-0x00007FF7A7742000-memory.dmp

Filesize
3.9MB

Download
memory/3424-1-0x00000207CD850000-0x00000207CD860000-memory.dmp

Filesize
64KB

Download
memory/3868-282-0x00007FF791300000-0x00007FF7916F2000-memory.dmp

Filesize
3.9MB

Download
memory/3868-3220-0x00007FF791300000-0x00007FF7916F2000-memory.dmp

Filesize
3.9MB

Download
memory/3872-3237-0x00007FF625260000-0x00007FF625652000-memory.dmp

Filesize
3.9MB

Download
memory/3872-502-0x00007FF625260000-0x00007FF625652000-memory.dmp

Filesize
3.9MB

Download
memory/3916-3233-0x00007FF6F34E0000-0x00007FF6F38D2000-memory.dmp

Filesize
3.9MB

Download
memory/3916-393-0x00007FF6F34E0000-0x00007FF6F38D2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-3196-0x00007FF7C6700000-0x00007FF7C6AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-160-0x00007FF7C6700000-0x00007FF7C6AF2000-memory.dmp

Filesize
3.9MB

Download
memory/4252-3204-0x00007FF7685E0000-0x00007FF7689D2000-memory.dmp

Filesize
3.9MB

Download
memory/4252-330-0x00007FF7685E0000-0x00007FF7689D2000-memory.dmp

Filesize
3.9MB

Download
memory/4436-3219-0x00007FF7A7B20000-0x00007FF7A7F12000-memory.dmp

Filesize
3.9MB

Download
memory/4436-497-0x00007FF7A7B20000-0x00007FF7A7F12000-memory.dmp

Filesize
3.9MB

Download
memory/4456-3225-0x00007FF79C280000-0x00007FF79C672000-memory.dmp

Filesize
3.9MB

Download
memory/4456-500-0x00007FF79C280000-0x00007FF79C672000-memory.dmp

Filesize
3.9MB

Download
memory/4692-505-0x00007FF75D670000-0x00007FF75DA62000-memory.dmp

Filesize
3.9MB

Download
memory/4692-3214-0x00007FF75D670000-0x00007FF75DA62000-memory.dmp

Filesize
3.9MB

Download
memory/4896-3212-0x00007FF77D110000-0x00007FF77D502000-memory.dmp

Filesize
3.9MB

Download
memory/4896-280-0x00007FF77D110000-0x00007FF77D502000-memory.dmp

Filesize
3.9MB

Download
memory/4984-501-0x00007FF60E9A0000-0x00007FF60ED92000-memory.dmp

Filesize
3.9MB

Download
memory/4984-3239-0x00007FF60E9A0000-0x00007FF60ED92000-memory.dmp

Filesize
3.9MB

Download