xmrig | cc47e3893c888aea8b27968448eaec4f7a62dd1fa584ff33b4174d7f09a62ec1

Analysis

max time kernel
121s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
Size

1.3MB
MD5

e8051a9643c9bba650cde2f1d61bcc70
SHA1

5cccf7cd36bdb3e7a24bff4e251291397d582c42
SHA256

cc47e3893c888aea8b27968448eaec4f7a62dd1fa584ff33b4174d7f09a62ec1
SHA512

d8b48b5e08bf534e7ddf71a6ca66f2706a7ccd04164578a4b1734fe82f8005a7d222f3f6e627a97957b5b3038df1f7c3e658604e679f18e1a56a5964a656eeee
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHezeqV92K:Lz071uv4BPMkibTIA5CeZD

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/1216-314-0x00007FF7E29C0000-0x00007FF7E2DB2000-memory.dmp	xmrig
behavioral2/memory/848-379-0x00007FF7D4180000-0x00007FF7D4572000-memory.dmp	xmrig
behavioral2/memory/3932-387-0x00007FF63E660000-0x00007FF63EA52000-memory.dmp	xmrig
behavioral2/memory/4748-388-0x00007FF672DD0000-0x00007FF6731C2000-memory.dmp	xmrig
behavioral2/memory/1252-386-0x00007FF63E710000-0x00007FF63EB02000-memory.dmp	xmrig
behavioral2/memory/4008-385-0x00007FF6F7120000-0x00007FF6F7512000-memory.dmp	xmrig
behavioral2/memory/4044-384-0x00007FF652A40000-0x00007FF652E32000-memory.dmp	xmrig
behavioral2/memory/2008-383-0x00007FF6C7700000-0x00007FF6C7AF2000-memory.dmp	xmrig
behavioral2/memory/4376-382-0x00007FF660920000-0x00007FF660D12000-memory.dmp	xmrig
behavioral2/memory/4440-381-0x00007FF75BDB0000-0x00007FF75C1A2000-memory.dmp	xmrig
behavioral2/memory/4564-380-0x00007FF7039F0000-0x00007FF703DE2000-memory.dmp	xmrig
behavioral2/memory/1584-378-0x00007FF72FDC0000-0x00007FF7301B2000-memory.dmp	xmrig
behavioral2/memory/4580-377-0x00007FF6FB420000-0x00007FF6FB812000-memory.dmp	xmrig
behavioral2/memory/4652-327-0x00007FF6E83C0000-0x00007FF6E87B2000-memory.dmp	xmrig
behavioral2/memory/4152-221-0x00007FF7DE410000-0x00007FF7DE802000-memory.dmp	xmrig
behavioral2/memory/3040-220-0x00007FF6130E0000-0x00007FF6134D2000-memory.dmp	xmrig
behavioral2/memory/2892-195-0x00007FF757E70000-0x00007FF758262000-memory.dmp	xmrig
behavioral2/memory/4868-136-0x00007FF684680000-0x00007FF684A72000-memory.dmp	xmrig
behavioral2/memory/2252-90-0x00007FF763460000-0x00007FF763852000-memory.dmp	xmrig
behavioral2/memory/2784-2811-0x00007FF7180C0000-0x00007FF7184B2000-memory.dmp	xmrig
behavioral2/memory/2148-2845-0x00007FF650430000-0x00007FF650822000-memory.dmp	xmrig
behavioral2/memory/3040-2866-0x00007FF6130E0000-0x00007FF6134D2000-memory.dmp	xmrig
behavioral2/memory/4868-2870-0x00007FF684680000-0x00007FF684A72000-memory.dmp	xmrig
behavioral2/memory/1252-2872-0x00007FF63E710000-0x00007FF63EB02000-memory.dmp	xmrig
behavioral2/memory/3576-2869-0x00007FF79F700000-0x00007FF79FAF2000-memory.dmp	xmrig
behavioral2/memory/2252-2860-0x00007FF763460000-0x00007FF763852000-memory.dmp	xmrig
behavioral2/memory/3212-2849-0x00007FF7C5960000-0x00007FF7C5D52000-memory.dmp	xmrig
behavioral2/memory/4652-2878-0x00007FF6E83C0000-0x00007FF6E87B2000-memory.dmp	xmrig
behavioral2/memory/4008-2880-0x00007FF6F7120000-0x00007FF6F7512000-memory.dmp	xmrig
behavioral2/memory/4580-2884-0x00007FF6FB420000-0x00007FF6FB812000-memory.dmp	xmrig
behavioral2/memory/1216-2882-0x00007FF7E29C0000-0x00007FF7E2DB2000-memory.dmp	xmrig
behavioral2/memory/4748-2877-0x00007FF672DD0000-0x00007FF6731C2000-memory.dmp	xmrig
behavioral2/memory/848-2875-0x00007FF7D4180000-0x00007FF7D4572000-memory.dmp	xmrig
behavioral2/memory/4564-2888-0x00007FF7039F0000-0x00007FF703DE2000-memory.dmp	xmrig
behavioral2/memory/2892-2902-0x00007FF757E70000-0x00007FF758262000-memory.dmp	xmrig
behavioral2/memory/3932-2901-0x00007FF63E660000-0x00007FF63EA52000-memory.dmp	xmrig
behavioral2/memory/2008-2898-0x00007FF6C7700000-0x00007FF6C7AF2000-memory.dmp	xmrig
behavioral2/memory/4152-2896-0x00007FF7DE410000-0x00007FF7DE802000-memory.dmp	xmrig
behavioral2/memory/4884-2894-0x00007FF654F30000-0x00007FF655322000-memory.dmp	xmrig
behavioral2/memory/4376-2892-0x00007FF660920000-0x00007FF660D12000-memory.dmp	xmrig
behavioral2/memory/1584-2891-0x00007FF72FDC0000-0x00007FF7301B2000-memory.dmp	xmrig
behavioral2/memory/4440-2886-0x00007FF75BDB0000-0x00007FF75C1A2000-memory.dmp	xmrig
behavioral2/memory/4044-2937-0x00007FF652A40000-0x00007FF652E32000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3272	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2784	aaRiBsu.exe
2148	obGnFcl.exe
3212	euJCQaB.exe
1252	sqnxXjQ.exe
3576	xPQiaKz.exe
2252	Uicsseq.exe
4868	QkIksxp.exe
3932	kpuXjJP.exe
4884	wEMBHuP.exe
2892	FevrQer.exe
3040	jcucAou.exe
4748	OHDMeDz.exe
4152	qURxUJK.exe
1216	ivixCAT.exe
4652	zuLzZEg.exe
4580	kJmetUr.exe
1584	XArwpIb.exe
848	vUtrccl.exe
4564	suVIORz.exe
4440	rxfOJgu.exe
4376	kNiEEGy.exe
2008	GshMzHA.exe
4044	YKtCBNh.exe
4008	fjCOIFr.exe
2516	HDnqNuI.exe
3472	DldfjHg.exe
3976	ItpIdro.exe
4144	GSMKiIg.exe
3252	hWfOIVG.exe
4428	XOOMWuD.exe
1748	rutxXdP.exe
4508	xcPKCsB.exe
1492	YOtGEFB.exe
4860	iNGZQWg.exe
404	dGnnkVb.exe
3540	DLiJOXB.exe
1072	BeaqHTJ.exe
1188	qYeAMdD.exe
3468	FCeHaWw.exe
4160	oOnUqSu.exe
3028	uJkymOM.exe
4660	rbFLOEc.exe
752	UGjvzZY.exe
4352	gRQXpkF.exe
1292	UQgghJw.exe
3240	QbtEvSQ.exe
1712	ajnwyjX.exe
1988	UQkXbCc.exe
1840	DUAFUZR.exe
3384	gbqpfUP.exe
2360	oWJstJJ.exe
5108	rTNTNXk.exe
4304	KyLGkOk.exe
4484	KJmOIyG.exe
60	GcCKDhz.exe
2944	rukYuHW.exe
3908	MhyYWwX.exe
4228	eFEeRzj.exe
3008	wQlVqZy.exe
3312	grkxEPP.exe
4572	xgBqTid.exe
2196	nhFPfWw.exe
228	LvtUeem.exe
4400	VkvnnyF.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5040-0-0x00007FF755A50000-0x00007FF755E42000-memory.dmp	upx
behavioral2/files/0x0008000000023405-5.dat	upx
behavioral2/files/0x000700000002340c-23.dat	upx
behavioral2/files/0x0007000000023413-46.dat	upx
behavioral2/files/0x0007000000023417-55.dat	upx
behavioral2/files/0x0007000000023414-75.dat	upx
behavioral2/files/0x0007000000023412-165.dat	upx
behavioral2/memory/1216-314-0x00007FF7E29C0000-0x00007FF7E2DB2000-memory.dmp	upx
behavioral2/memory/848-379-0x00007FF7D4180000-0x00007FF7D4572000-memory.dmp	upx
behavioral2/memory/3932-387-0x00007FF63E660000-0x00007FF63EA52000-memory.dmp	upx
behavioral2/memory/4748-388-0x00007FF672DD0000-0x00007FF6731C2000-memory.dmp	upx
behavioral2/memory/1252-386-0x00007FF63E710000-0x00007FF63EB02000-memory.dmp	upx
behavioral2/memory/4008-385-0x00007FF6F7120000-0x00007FF6F7512000-memory.dmp	upx
behavioral2/memory/4044-384-0x00007FF652A40000-0x00007FF652E32000-memory.dmp	upx
behavioral2/memory/2008-383-0x00007FF6C7700000-0x00007FF6C7AF2000-memory.dmp	upx
behavioral2/memory/4376-382-0x00007FF660920000-0x00007FF660D12000-memory.dmp	upx
behavioral2/memory/4440-381-0x00007FF75BDB0000-0x00007FF75C1A2000-memory.dmp	upx
behavioral2/memory/4564-380-0x00007FF7039F0000-0x00007FF703DE2000-memory.dmp	upx
behavioral2/memory/1584-378-0x00007FF72FDC0000-0x00007FF7301B2000-memory.dmp	upx
behavioral2/memory/4580-377-0x00007FF6FB420000-0x00007FF6FB812000-memory.dmp	upx
behavioral2/memory/4652-327-0x00007FF6E83C0000-0x00007FF6E87B2000-memory.dmp	upx
behavioral2/memory/4152-221-0x00007FF7DE410000-0x00007FF7DE802000-memory.dmp	upx
behavioral2/memory/3040-220-0x00007FF6130E0000-0x00007FF6134D2000-memory.dmp	upx
behavioral2/files/0x0007000000023431-198.dat	upx
behavioral2/files/0x0007000000023430-197.dat	upx
behavioral2/memory/2892-195-0x00007FF757E70000-0x00007FF758262000-memory.dmp	upx
behavioral2/files/0x000700000002342e-194.dat	upx
behavioral2/files/0x000700000002342d-193.dat	upx
behavioral2/files/0x000700000002342c-192.dat	upx
behavioral2/files/0x000700000002342b-191.dat	upx
behavioral2/files/0x0007000000023423-189.dat	upx
behavioral2/files/0x000700000002342a-188.dat	upx
behavioral2/files/0x0007000000023429-187.dat	upx
behavioral2/files/0x0007000000023428-186.dat	upx
behavioral2/files/0x0007000000023425-185.dat	upx
behavioral2/files/0x0007000000023427-183.dat	upx
behavioral2/files/0x0007000000023419-179.dat	upx
behavioral2/files/0x0007000000023415-159.dat	upx
behavioral2/files/0x0007000000023420-154.dat	upx
behavioral2/files/0x000700000002341f-145.dat	upx
behavioral2/files/0x000700000002341e-143.dat	upx
behavioral2/memory/4884-142-0x00007FF654F30000-0x00007FF655322000-memory.dmp	upx
behavioral2/memory/4868-136-0x00007FF684680000-0x00007FF684A72000-memory.dmp	upx
behavioral2/files/0x000700000002342f-196.dat	upx
behavioral2/files/0x000700000002341c-129.dat	upx
behavioral2/files/0x000700000002341b-126.dat	upx
behavioral2/files/0x0007000000023426-122.dat	upx
behavioral2/files/0x0007000000023416-117.dat	upx
behavioral2/files/0x000700000002341d-114.dat	upx
behavioral2/files/0x0008000000023409-113.dat	upx
behavioral2/files/0x0007000000023424-112.dat	upx
behavioral2/files/0x0007000000023422-105.dat	upx
behavioral2/files/0x0007000000023421-101.dat	upx
behavioral2/memory/2252-90-0x00007FF763460000-0x00007FF763852000-memory.dmp	upx
behavioral2/files/0x000700000002341a-108.dat	upx
behavioral2/files/0x000700000002340f-68.dat	upx
behavioral2/files/0x0007000000023411-65.dat	upx
behavioral2/files/0x0007000000023418-59.dat	upx
behavioral2/memory/3576-52-0x00007FF79F700000-0x00007FF79FAF2000-memory.dmp	upx
behavioral2/memory/3212-42-0x00007FF7C5960000-0x00007FF7C5D52000-memory.dmp	upx
behavioral2/files/0x000700000002340d-36.dat	upx
behavioral2/files/0x0007000000023410-29.dat	upx
behavioral2/files/0x000700000002340e-32.dat	upx
behavioral2/memory/2148-19-0x00007FF650430000-0x00007FF650822000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xkNxrtD.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\QbtEvSQ.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\ybFVzyB.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\rvrbXRk.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\PUYAbtM.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\wmDwMVs.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\rpkywCX.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\KJfyfwz.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\ZikrHiG.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\aAMkMbH.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\OqDvRre.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\xvHLlAe.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\hkVcqir.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\kdzDXBX.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\oZhvlke.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\XxZmtkR.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\OCCYRTU.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\vMaimsv.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\BRMdxyo.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\GJqQYgB.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\PTaImuq.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\lPKenca.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\JFIwABo.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\wastVqn.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\IzpTOiC.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\uhuVIfX.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\OypXOxW.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\ZtVOeIl.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\JTWdJxp.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\MTOODOt.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\vCDgvGl.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\OJZkzrh.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\ZJMTTNC.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\nsDCeSt.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\NxPYOcJ.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\pSCaGLt.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\RugVzZo.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\TnzwvHx.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\OpMQdxU.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\dSjlfKP.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\ZHhiCuf.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\alyPlhc.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\fmlhggr.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\HRqbNNx.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\iaGGmhx.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\tTwgDjK.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\JKGUFZZ.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\RIUAtAj.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\DNTACay.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\YPvuhlI.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\SwMOMVV.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\ZwnlIlI.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\sclnKRJ.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\WCkjkzi.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\CoTzkfX.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\oAFhyHV.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\kHAGrVh.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\WaSFAKM.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\LofSRPt.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\lfUaJBX.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\CBRHwpb.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\SYMFiwF.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\BmZyGkJ.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
File created	C:\Windows\System\PMFmYSB.exe	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
Token: SeDebugPrivilege	3272	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 3272	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	86
PID 5040 wrote to memory of 3272	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	86
PID 5040 wrote to memory of 2784	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	87
PID 5040 wrote to memory of 2784	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	87
PID 5040 wrote to memory of 2148	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	88
PID 5040 wrote to memory of 2148	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	88
PID 5040 wrote to memory of 1252	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	89
PID 5040 wrote to memory of 1252	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	89
PID 5040 wrote to memory of 3212	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	90
PID 5040 wrote to memory of 3212	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	90
PID 5040 wrote to memory of 3576	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	91
PID 5040 wrote to memory of 3576	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	91
PID 5040 wrote to memory of 2252	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	92
PID 5040 wrote to memory of 2252	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	92
PID 5040 wrote to memory of 4868	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	93
PID 5040 wrote to memory of 4868	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	93
PID 5040 wrote to memory of 4884	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	94
PID 5040 wrote to memory of 4884	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	94
PID 5040 wrote to memory of 3932	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	95
PID 5040 wrote to memory of 3932	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	95
PID 5040 wrote to memory of 4748	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	96
PID 5040 wrote to memory of 4748	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	96
PID 5040 wrote to memory of 4152	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	97
PID 5040 wrote to memory of 4152	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	97
PID 5040 wrote to memory of 1216	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	98
PID 5040 wrote to memory of 1216	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	98
PID 5040 wrote to memory of 2892	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	99
PID 5040 wrote to memory of 2892	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	99
PID 5040 wrote to memory of 3040	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	100
PID 5040 wrote to memory of 3040	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	100
PID 5040 wrote to memory of 2008	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	101
PID 5040 wrote to memory of 2008	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	101
PID 5040 wrote to memory of 4652	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	102
PID 5040 wrote to memory of 4652	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	102
PID 5040 wrote to memory of 4580	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	103
PID 5040 wrote to memory of 4580	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	103
PID 5040 wrote to memory of 1584	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	104
PID 5040 wrote to memory of 1584	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	104
PID 5040 wrote to memory of 848	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	105
PID 5040 wrote to memory of 848	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	105
PID 5040 wrote to memory of 4564	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	106
PID 5040 wrote to memory of 4564	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	106
PID 5040 wrote to memory of 4440	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	107
PID 5040 wrote to memory of 4440	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	107
PID 5040 wrote to memory of 4376	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	108
PID 5040 wrote to memory of 4376	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	108
PID 5040 wrote to memory of 4044	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	109
PID 5040 wrote to memory of 4044	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	109
PID 5040 wrote to memory of 4008	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	110
PID 5040 wrote to memory of 4008	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	110
PID 5040 wrote to memory of 2516	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	111
PID 5040 wrote to memory of 2516	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	111
PID 5040 wrote to memory of 3472	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	112
PID 5040 wrote to memory of 3472	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	112
PID 5040 wrote to memory of 3976	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	113
PID 5040 wrote to memory of 3976	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	113
PID 5040 wrote to memory of 4428	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	114
PID 5040 wrote to memory of 4428	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	114
PID 5040 wrote to memory of 4144	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	115
PID 5040 wrote to memory of 4144	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	115
PID 5040 wrote to memory of 3252	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	116
PID 5040 wrote to memory of 3252	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	116
PID 5040 wrote to memory of 1748	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	117
PID 5040 wrote to memory of 1748	5040	e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e8051a9643c9bba650cde2f1d61bcc70_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3272
- C:\Windows\System\aaRiBsu.exe
  C:\Windows\System\aaRiBsu.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\obGnFcl.exe
  C:\Windows\System\obGnFcl.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\sqnxXjQ.exe
  C:\Windows\System\sqnxXjQ.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\euJCQaB.exe
  C:\Windows\System\euJCQaB.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\xPQiaKz.exe
  C:\Windows\System\xPQiaKz.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\Uicsseq.exe
  C:\Windows\System\Uicsseq.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\QkIksxp.exe
  C:\Windows\System\QkIksxp.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\wEMBHuP.exe
  C:\Windows\System\wEMBHuP.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\kpuXjJP.exe
  C:\Windows\System\kpuXjJP.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\OHDMeDz.exe
  C:\Windows\System\OHDMeDz.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\qURxUJK.exe
  C:\Windows\System\qURxUJK.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\ivixCAT.exe
  C:\Windows\System\ivixCAT.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\FevrQer.exe
  C:\Windows\System\FevrQer.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\jcucAou.exe
  C:\Windows\System\jcucAou.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\GshMzHA.exe
  C:\Windows\System\GshMzHA.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\zuLzZEg.exe
  C:\Windows\System\zuLzZEg.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\kJmetUr.exe
  C:\Windows\System\kJmetUr.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\XArwpIb.exe
  C:\Windows\System\XArwpIb.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\vUtrccl.exe
  C:\Windows\System\vUtrccl.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\suVIORz.exe
  C:\Windows\System\suVIORz.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\rxfOJgu.exe
  C:\Windows\System\rxfOJgu.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\kNiEEGy.exe
  C:\Windows\System\kNiEEGy.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\YKtCBNh.exe
  C:\Windows\System\YKtCBNh.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\fjCOIFr.exe
  C:\Windows\System\fjCOIFr.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\HDnqNuI.exe
  C:\Windows\System\HDnqNuI.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\DldfjHg.exe
  C:\Windows\System\DldfjHg.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\ItpIdro.exe
  C:\Windows\System\ItpIdro.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\XOOMWuD.exe
  C:\Windows\System\XOOMWuD.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\GSMKiIg.exe
  C:\Windows\System\GSMKiIg.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\hWfOIVG.exe
  C:\Windows\System\hWfOIVG.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\rutxXdP.exe
  C:\Windows\System\rutxXdP.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\xcPKCsB.exe
  C:\Windows\System\xcPKCsB.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\YOtGEFB.exe
  C:\Windows\System\YOtGEFB.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\iNGZQWg.exe
  C:\Windows\System\iNGZQWg.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\dGnnkVb.exe
  C:\Windows\System\dGnnkVb.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\DLiJOXB.exe
  C:\Windows\System\DLiJOXB.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\BeaqHTJ.exe
  C:\Windows\System\BeaqHTJ.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\qYeAMdD.exe
  C:\Windows\System\qYeAMdD.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\FCeHaWw.exe
  C:\Windows\System\FCeHaWw.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\oOnUqSu.exe
  C:\Windows\System\oOnUqSu.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\uJkymOM.exe
  C:\Windows\System\uJkymOM.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\rbFLOEc.exe
  C:\Windows\System\rbFLOEc.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\UGjvzZY.exe
  C:\Windows\System\UGjvzZY.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\gRQXpkF.exe
  C:\Windows\System\gRQXpkF.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\UQgghJw.exe
  C:\Windows\System\UQgghJw.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\QbtEvSQ.exe
  C:\Windows\System\QbtEvSQ.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\ajnwyjX.exe
  C:\Windows\System\ajnwyjX.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\UQkXbCc.exe
  C:\Windows\System\UQkXbCc.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\DUAFUZR.exe
  C:\Windows\System\DUAFUZR.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\gbqpfUP.exe
  C:\Windows\System\gbqpfUP.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\oWJstJJ.exe
  C:\Windows\System\oWJstJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\rTNTNXk.exe
  C:\Windows\System\rTNTNXk.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\KyLGkOk.exe
  C:\Windows\System\KyLGkOk.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\KJmOIyG.exe
  C:\Windows\System\KJmOIyG.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\GcCKDhz.exe
  C:\Windows\System\GcCKDhz.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\rukYuHW.exe
  C:\Windows\System\rukYuHW.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\MhyYWwX.exe
  C:\Windows\System\MhyYWwX.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\eFEeRzj.exe
  C:\Windows\System\eFEeRzj.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\wQlVqZy.exe
  C:\Windows\System\wQlVqZy.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\grkxEPP.exe
  C:\Windows\System\grkxEPP.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\xgBqTid.exe
  C:\Windows\System\xgBqTid.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\nhFPfWw.exe
  C:\Windows\System\nhFPfWw.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\LvtUeem.exe
  C:\Windows\System\LvtUeem.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\VkvnnyF.exe
  C:\Windows\System\VkvnnyF.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\JkuZIIf.exe
  C:\Windows\System\JkuZIIf.exe
  2⤵
  PID:5072
- C:\Windows\System\EuwneJx.exe
  C:\Windows\System\EuwneJx.exe
  2⤵
  PID:4000
- C:\Windows\System\aAnwgxH.exe
  C:\Windows\System\aAnwgxH.exe
  2⤵
  PID:5132
- C:\Windows\System\WKgHeba.exe
  C:\Windows\System\WKgHeba.exe
  2⤵
  PID:5148
- C:\Windows\System\xCmTupE.exe
  C:\Windows\System\xCmTupE.exe
  2⤵
  PID:5172
- C:\Windows\System\RjYRkvP.exe
  C:\Windows\System\RjYRkvP.exe
  2⤵
  PID:5192
- C:\Windows\System\sclnKRJ.exe
  C:\Windows\System\sclnKRJ.exe
  2⤵
  PID:5224
- C:\Windows\System\eUbDOFx.exe
  C:\Windows\System\eUbDOFx.exe
  2⤵
  PID:5244
- C:\Windows\System\gnMcTzy.exe
  C:\Windows\System\gnMcTzy.exe
  2⤵
  PID:5260
- C:\Windows\System\KJfyfwz.exe
  C:\Windows\System\KJfyfwz.exe
  2⤵
  PID:5284
- C:\Windows\System\YtafxhE.exe
  C:\Windows\System\YtafxhE.exe
  2⤵
  PID:5308
- C:\Windows\System\jchKjxl.exe
  C:\Windows\System\jchKjxl.exe
  2⤵
  PID:5324
- C:\Windows\System\IzpTOiC.exe
  C:\Windows\System\IzpTOiC.exe
  2⤵
  PID:5340
- C:\Windows\System\ZQlTDuH.exe
  C:\Windows\System\ZQlTDuH.exe
  2⤵
  PID:5356
- C:\Windows\System\VVkAQzE.exe
  C:\Windows\System\VVkAQzE.exe
  2⤵
  PID:5372
- C:\Windows\System\HgFIOvi.exe
  C:\Windows\System\HgFIOvi.exe
  2⤵
  PID:5460
- C:\Windows\System\mWRRKuw.exe
  C:\Windows\System\mWRRKuw.exe
  2⤵
  PID:5476
- C:\Windows\System\gBtrrci.exe
  C:\Windows\System\gBtrrci.exe
  2⤵
  PID:5492
- C:\Windows\System\RnzXkyd.exe
  C:\Windows\System\RnzXkyd.exe
  2⤵
  PID:5516
- C:\Windows\System\iCXynua.exe
  C:\Windows\System\iCXynua.exe
  2⤵
  PID:5532
- C:\Windows\System\zZfmgyN.exe
  C:\Windows\System\zZfmgyN.exe
  2⤵
  PID:5552
- C:\Windows\System\RIoVmhL.exe
  C:\Windows\System\RIoVmhL.exe
  2⤵
  PID:5572
- C:\Windows\System\MpkuGIW.exe
  C:\Windows\System\MpkuGIW.exe
  2⤵
  PID:5592
- C:\Windows\System\fmlhggr.exe
  C:\Windows\System\fmlhggr.exe
  2⤵
  PID:5608
- C:\Windows\System\XsAcAAg.exe
  C:\Windows\System\XsAcAAg.exe
  2⤵
  PID:5636
- C:\Windows\System\KCSaRlb.exe
  C:\Windows\System\KCSaRlb.exe
  2⤵
  PID:5660
- C:\Windows\System\ZikrHiG.exe
  C:\Windows\System\ZikrHiG.exe
  2⤵
  PID:5680
- C:\Windows\System\QaPhXTf.exe
  C:\Windows\System\QaPhXTf.exe
  2⤵
  PID:5700
- C:\Windows\System\jyWHsIh.exe
  C:\Windows\System\jyWHsIh.exe
  2⤵
  PID:5716
- C:\Windows\System\HhZtivM.exe
  C:\Windows\System\HhZtivM.exe
  2⤵
  PID:5732
- C:\Windows\System\FSWROQv.exe
  C:\Windows\System\FSWROQv.exe
  2⤵
  PID:5756
- C:\Windows\System\VkUuqxF.exe
  C:\Windows\System\VkUuqxF.exe
  2⤵
  PID:5772
- C:\Windows\System\PPISVYo.exe
  C:\Windows\System\PPISVYo.exe
  2⤵
  PID:5856
- C:\Windows\System\roWHQXE.exe
  C:\Windows\System\roWHQXE.exe
  2⤵
  PID:5872
- C:\Windows\System\wvdfETt.exe
  C:\Windows\System\wvdfETt.exe
  2⤵
  PID:5900
- C:\Windows\System\waCrGTd.exe
  C:\Windows\System\waCrGTd.exe
  2⤵
  PID:5952
- C:\Windows\System\NWTzjlY.exe
  C:\Windows\System\NWTzjlY.exe
  2⤵
  PID:5968
- C:\Windows\System\gjbuBOF.exe
  C:\Windows\System\gjbuBOF.exe
  2⤵
  PID:6000
- C:\Windows\System\ImbBLAw.exe
  C:\Windows\System\ImbBLAw.exe
  2⤵
  PID:6024
- C:\Windows\System\TmzoMdP.exe
  C:\Windows\System\TmzoMdP.exe
  2⤵
  PID:6040
- C:\Windows\System\ZHhiCuf.exe
  C:\Windows\System\ZHhiCuf.exe
  2⤵
  PID:6064
- C:\Windows\System\fpdBoYI.exe
  C:\Windows\System\fpdBoYI.exe
  2⤵
  PID:6080
- C:\Windows\System\BRMdxyo.exe
  C:\Windows\System\BRMdxyo.exe
  2⤵
  PID:6104
- C:\Windows\System\QvifSmr.exe
  C:\Windows\System\QvifSmr.exe
  2⤵
  PID:6120
- C:\Windows\System\hYgWSSa.exe
  C:\Windows\System\hYgWSSa.exe
  2⤵
  PID:6140
- C:\Windows\System\kDLZqdJ.exe
  C:\Windows\System\kDLZqdJ.exe
  2⤵
  PID:2548
- C:\Windows\System\JTclIGJ.exe
  C:\Windows\System\JTclIGJ.exe
  2⤵
  PID:456
- C:\Windows\System\nzCwFkL.exe
  C:\Windows\System\nzCwFkL.exe
  2⤵
  PID:3448
- C:\Windows\System\NvMIXrQ.exe
  C:\Windows\System\NvMIXrQ.exe
  2⤵
  PID:3700
- C:\Windows\System\PYuqHpp.exe
  C:\Windows\System\PYuqHpp.exe
  2⤵
  PID:4068
- C:\Windows\System\LLemcME.exe
  C:\Windows\System\LLemcME.exe
  2⤵
  PID:2596
- C:\Windows\System\pFkeMkF.exe
  C:\Windows\System\pFkeMkF.exe
  2⤵
  PID:2060
- C:\Windows\System\HzISbCA.exe
  C:\Windows\System\HzISbCA.exe
  2⤵
  PID:4932
- C:\Windows\System\ImNQfRI.exe
  C:\Windows\System\ImNQfRI.exe
  2⤵
  PID:1160
- C:\Windows\System\VAIZfyN.exe
  C:\Windows\System\VAIZfyN.exe
  2⤵
  PID:3856
- C:\Windows\System\YIYZNWu.exe
  C:\Windows\System\YIYZNWu.exe
  2⤵
  PID:5036
- C:\Windows\System\bPhtNDT.exe
  C:\Windows\System\bPhtNDT.exe
  2⤵
  PID:3496
- C:\Windows\System\hMlEsLj.exe
  C:\Windows\System\hMlEsLj.exe
  2⤵
  PID:3632
- C:\Windows\System\kSLgZjE.exe
  C:\Windows\System\kSLgZjE.exe
  2⤵
  PID:5164
- C:\Windows\System\UEgsgFi.exe
  C:\Windows\System\UEgsgFi.exe
  2⤵
  PID:5188
- C:\Windows\System\YTRNsOF.exe
  C:\Windows\System\YTRNsOF.exe
  2⤵
  PID:5368
- C:\Windows\System\oIGEJBu.exe
  C:\Windows\System\oIGEJBu.exe
  2⤵
  PID:6128
- C:\Windows\System\uxzEOwc.exe
  C:\Windows\System\uxzEOwc.exe
  2⤵
  PID:4092
- C:\Windows\System\pJfGbqK.exe
  C:\Windows\System\pJfGbqK.exe
  2⤵
  PID:6148
- C:\Windows\System\MTOODOt.exe
  C:\Windows\System\MTOODOt.exe
  2⤵
  PID:6320
- C:\Windows\System\WIWipTU.exe
  C:\Windows\System\WIWipTU.exe
  2⤵
  PID:6336
- C:\Windows\System\TEXCzLx.exe
  C:\Windows\System\TEXCzLx.exe
  2⤵
  PID:6360
- C:\Windows\System\YrpVCGn.exe
  C:\Windows\System\YrpVCGn.exe
  2⤵
  PID:6380
- C:\Windows\System\IbTZHqM.exe
  C:\Windows\System\IbTZHqM.exe
  2⤵
  PID:6400
- C:\Windows\System\AtTsXzH.exe
  C:\Windows\System\AtTsXzH.exe
  2⤵
  PID:6432
- C:\Windows\System\dEwkgbJ.exe
  C:\Windows\System\dEwkgbJ.exe
  2⤵
  PID:6456
- C:\Windows\System\LblKvht.exe
  C:\Windows\System\LblKvht.exe
  2⤵
  PID:6472
- C:\Windows\System\VSALKPN.exe
  C:\Windows\System\VSALKPN.exe
  2⤵
  PID:6492
- C:\Windows\System\NsnoCKk.exe
  C:\Windows\System\NsnoCKk.exe
  2⤵
  PID:6544
- C:\Windows\System\hBEJrRY.exe
  C:\Windows\System\hBEJrRY.exe
  2⤵
  PID:6560
- C:\Windows\System\ZqaEsYz.exe
  C:\Windows\System\ZqaEsYz.exe
  2⤵
  PID:6584
- C:\Windows\System\CDLQlwH.exe
  C:\Windows\System\CDLQlwH.exe
  2⤵
  PID:6608
- C:\Windows\System\khDfyHI.exe
  C:\Windows\System\khDfyHI.exe
  2⤵
  PID:6624
- C:\Windows\System\JwCCQuk.exe
  C:\Windows\System\JwCCQuk.exe
  2⤵
  PID:6644
- C:\Windows\System\WMPYgPX.exe
  C:\Windows\System\WMPYgPX.exe
  2⤵
  PID:6660
- C:\Windows\System\ZnJZeHa.exe
  C:\Windows\System\ZnJZeHa.exe
  2⤵
  PID:6676
- C:\Windows\System\lqouGNM.exe
  C:\Windows\System\lqouGNM.exe
  2⤵
  PID:6732
- C:\Windows\System\FrtjZiX.exe
  C:\Windows\System\FrtjZiX.exe
  2⤵
  PID:6752
- C:\Windows\System\YfgmweF.exe
  C:\Windows\System\YfgmweF.exe
  2⤵
  PID:6768
- C:\Windows\System\HYweUFC.exe
  C:\Windows\System\HYweUFC.exe
  2⤵
  PID:6792
- C:\Windows\System\HIojDQb.exe
  C:\Windows\System\HIojDQb.exe
  2⤵
  PID:6808
- C:\Windows\System\tYCDivH.exe
  C:\Windows\System\tYCDivH.exe
  2⤵
  PID:6828
- C:\Windows\System\mgfLtfe.exe
  C:\Windows\System\mgfLtfe.exe
  2⤵
  PID:6844
- C:\Windows\System\seqnyMs.exe
  C:\Windows\System\seqnyMs.exe
  2⤵
  PID:6888
- C:\Windows\System\kWapZPA.exe
  C:\Windows\System\kWapZPA.exe
  2⤵
  PID:6920
- C:\Windows\System\JJuWzeC.exe
  C:\Windows\System\JJuWzeC.exe
  2⤵
  PID:6980
- C:\Windows\System\rQDsihC.exe
  C:\Windows\System\rQDsihC.exe
  2⤵
  PID:7000
- C:\Windows\System\vkAAwkx.exe
  C:\Windows\System\vkAAwkx.exe
  2⤵
  PID:7016
- C:\Windows\System\mIGZgci.exe
  C:\Windows\System\mIGZgci.exe
  2⤵
  PID:7036
- C:\Windows\System\pmFOjiD.exe
  C:\Windows\System\pmFOjiD.exe
  2⤵
  PID:7052
- C:\Windows\System\VuJBLzr.exe
  C:\Windows\System\VuJBLzr.exe
  2⤵
  PID:7080
- C:\Windows\System\oAYMpqM.exe
  C:\Windows\System\oAYMpqM.exe
  2⤵
  PID:7096
- C:\Windows\System\HRqbNNx.exe
  C:\Windows\System\HRqbNNx.exe
  2⤵
  PID:7124
- C:\Windows\System\eHsnFCi.exe
  C:\Windows\System\eHsnFCi.exe
  2⤵
  PID:7140
- C:\Windows\System\OBsWMmk.exe
  C:\Windows\System\OBsWMmk.exe
  2⤵
  PID:7160
- C:\Windows\System\TYRwxcQ.exe
  C:\Windows\System\TYRwxcQ.exe
  2⤵
  PID:4856
- C:\Windows\System\XnPtGZA.exe
  C:\Windows\System\XnPtGZA.exe
  2⤵
  PID:6056
- C:\Windows\System\rXNNkUo.exe
  C:\Windows\System\rXNNkUo.exe
  2⤵
  PID:5980
- C:\Windows\System\dUUULVS.exe
  C:\Windows\System\dUUULVS.exe
  2⤵
  PID:5884
- C:\Windows\System\tvAEpXK.exe
  C:\Windows\System\tvAEpXK.exe
  2⤵
  PID:5272
- C:\Windows\System\xGFiXIL.exe
  C:\Windows\System\xGFiXIL.exe
  2⤵
  PID:2368
- C:\Windows\System\lJibHRR.exe
  C:\Windows\System\lJibHRR.exe
  2⤵
  PID:4616
- C:\Windows\System\FpWUiGa.exe
  C:\Windows\System\FpWUiGa.exe
  2⤵
  PID:4804
- C:\Windows\System\tTwgDjK.exe
  C:\Windows\System\tTwgDjK.exe
  2⤵
  PID:2144
- C:\Windows\System\aAMkMbH.exe
  C:\Windows\System\aAMkMbH.exe
  2⤵
  PID:3508
- C:\Windows\System\CcLPKEk.exe
  C:\Windows\System\CcLPKEk.exe
  2⤵
  PID:4080
- C:\Windows\System\KJjQzmN.exe
  C:\Windows\System\KJjQzmN.exe
  2⤵
  PID:1740
- C:\Windows\System\FKSNRbw.exe
  C:\Windows\System\FKSNRbw.exe
  2⤵
  PID:816
- C:\Windows\System\hLqvdem.exe
  C:\Windows\System\hLqvdem.exe
  2⤵
  PID:5124
- C:\Windows\System\erSozUu.exe
  C:\Windows\System\erSozUu.exe
  2⤵
  PID:2004
- C:\Windows\System\ghuzqoO.exe
  C:\Windows\System\ghuzqoO.exe
  2⤵
  PID:4896
- C:\Windows\System\ijFqUPK.exe
  C:\Windows\System\ijFqUPK.exe
  2⤵
  PID:5316
- C:\Windows\System\iMBXCiz.exe
  C:\Windows\System\iMBXCiz.exe
  2⤵
  PID:5524
- C:\Windows\System\YHRpfKO.exe
  C:\Windows\System\YHRpfKO.exe
  2⤵
  PID:2176
- C:\Windows\System\kxJdoJj.exe
  C:\Windows\System\kxJdoJj.exe
  2⤵
  PID:6008
- C:\Windows\System\Hxbjzhf.exe
  C:\Windows\System\Hxbjzhf.exe
  2⤵
  PID:6060
- C:\Windows\System\WIyrMky.exe
  C:\Windows\System\WIyrMky.exe
  2⤵
  PID:4956
- C:\Windows\System\fjiLpdd.exe
  C:\Windows\System\fjiLpdd.exe
  2⤵
  PID:6224
- C:\Windows\System\lBParxu.exe
  C:\Windows\System\lBParxu.exe
  2⤵
  PID:6260
- C:\Windows\System\ZotHRek.exe
  C:\Windows\System\ZotHRek.exe
  2⤵
  PID:6304
- C:\Windows\System\CBpMSHM.exe
  C:\Windows\System\CBpMSHM.exe
  2⤵
  PID:2616
- C:\Windows\System\ugkGFxa.exe
  C:\Windows\System\ugkGFxa.exe
  2⤵
  PID:6332
- C:\Windows\System\dUIuVOJ.exe
  C:\Windows\System\dUIuVOJ.exe
  2⤵
  PID:6896
- C:\Windows\System\FTTMpPq.exe
  C:\Windows\System\FTTMpPq.exe
  2⤵
  PID:6392
- C:\Windows\System\kwlYNth.exe
  C:\Windows\System\kwlYNth.exe
  2⤵
  PID:6464
- C:\Windows\System\ffzfbeh.exe
  C:\Windows\System\ffzfbeh.exe
  2⤵
  PID:6488
- C:\Windows\System\jIcFaYw.exe
  C:\Windows\System\jIcFaYw.exe
  2⤵
  PID:6536
- C:\Windows\System\SmJlBzl.exe
  C:\Windows\System\SmJlBzl.exe
  2⤵
  PID:6556
- C:\Windows\System\cTnJSpT.exe
  C:\Windows\System\cTnJSpT.exe
  2⤵
  PID:6656
- C:\Windows\System\qGZnQFa.exe
  C:\Windows\System\qGZnQFa.exe
  2⤵
  PID:7008
- C:\Windows\System\LZAUlWv.exe
  C:\Windows\System\LZAUlWv.exe
  2⤵
  PID:7028
- C:\Windows\System\UpiQhuw.exe
  C:\Windows\System\UpiQhuw.exe
  2⤵
  PID:5864
- C:\Windows\System\rDjFNhQ.exe
  C:\Windows\System\rDjFNhQ.exe
  2⤵
  PID:3176
- C:\Windows\System\FzyXaKe.exe
  C:\Windows\System\FzyXaKe.exe
  2⤵
  PID:1040
- C:\Windows\System\NptgERa.exe
  C:\Windows\System\NptgERa.exe
  2⤵
  PID:3244
- C:\Windows\System\AVxkhlK.exe
  C:\Windows\System\AVxkhlK.exe
  2⤵
  PID:6776
- C:\Windows\System\sGLhIDx.exe
  C:\Windows\System\sGLhIDx.exe
  2⤵
  PID:6804
- C:\Windows\System\yHixrro.exe
  C:\Windows\System\yHixrro.exe
  2⤵
  PID:6840
- C:\Windows\System\sQcwDrB.exe
  C:\Windows\System\sQcwDrB.exe
  2⤵
  PID:6860
- C:\Windows\System\hJcSGTD.exe
  C:\Windows\System\hJcSGTD.exe
  2⤵
  PID:6928
- C:\Windows\System\AlSBCaf.exe
  C:\Windows\System\AlSBCaf.exe
  2⤵
  PID:7132
- C:\Windows\System\xDIGrCs.exe
  C:\Windows\System\xDIGrCs.exe
  2⤵
  PID:7184
- C:\Windows\System\sZjzPZk.exe
  C:\Windows\System\sZjzPZk.exe
  2⤵
  PID:7200
- C:\Windows\System\HtVGRYt.exe
  C:\Windows\System\HtVGRYt.exe
  2⤵
  PID:7220
- C:\Windows\System\SgifTtg.exe
  C:\Windows\System\SgifTtg.exe
  2⤵
  PID:7240
- C:\Windows\System\nlqulUZ.exe
  C:\Windows\System\nlqulUZ.exe
  2⤵
  PID:7264
- C:\Windows\System\zQupXCv.exe
  C:\Windows\System\zQupXCv.exe
  2⤵
  PID:7284
- C:\Windows\System\Lhbwzek.exe
  C:\Windows\System\Lhbwzek.exe
  2⤵
  PID:7300
- C:\Windows\System\BUcrids.exe
  C:\Windows\System\BUcrids.exe
  2⤵
  PID:7324
- C:\Windows\System\nPlhjfj.exe
  C:\Windows\System\nPlhjfj.exe
  2⤵
  PID:7344
- C:\Windows\System\HlIwtry.exe
  C:\Windows\System\HlIwtry.exe
  2⤵
  PID:7364
- C:\Windows\System\SBaIAde.exe
  C:\Windows\System\SBaIAde.exe
  2⤵
  PID:7380
- C:\Windows\System\iRcgBvI.exe
  C:\Windows\System\iRcgBvI.exe
  2⤵
  PID:7408
- C:\Windows\System\pLSowKk.exe
  C:\Windows\System\pLSowKk.exe
  2⤵
  PID:7428
- C:\Windows\System\IPSIeGn.exe
  C:\Windows\System\IPSIeGn.exe
  2⤵
  PID:7444
- C:\Windows\System\FOWbNmz.exe
  C:\Windows\System\FOWbNmz.exe
  2⤵
  PID:7460
- C:\Windows\System\GJqQYgB.exe
  C:\Windows\System\GJqQYgB.exe
  2⤵
  PID:7480
- C:\Windows\System\cpOGcJp.exe
  C:\Windows\System\cpOGcJp.exe
  2⤵
  PID:7496
- C:\Windows\System\dhtfRQT.exe
  C:\Windows\System\dhtfRQT.exe
  2⤵
  PID:7512
- C:\Windows\System\VNDxPLD.exe
  C:\Windows\System\VNDxPLD.exe
  2⤵
  PID:7528
- C:\Windows\System\nMMyGzK.exe
  C:\Windows\System\nMMyGzK.exe
  2⤵
  PID:7548
- C:\Windows\System\PMFmYSB.exe
  C:\Windows\System\PMFmYSB.exe
  2⤵
  PID:7572
- C:\Windows\System\LlgMjub.exe
  C:\Windows\System\LlgMjub.exe
  2⤵
  PID:7592
- C:\Windows\System\OuRjXQB.exe
  C:\Windows\System\OuRjXQB.exe
  2⤵
  PID:7616
- C:\Windows\System\LaZHvBE.exe
  C:\Windows\System\LaZHvBE.exe
  2⤵
  PID:7632
- C:\Windows\System\JBHFXsY.exe
  C:\Windows\System\JBHFXsY.exe
  2⤵
  PID:7656
- C:\Windows\System\LZsOONY.exe
  C:\Windows\System\LZsOONY.exe
  2⤵
  PID:7676
- C:\Windows\System\QkgyiOA.exe
  C:\Windows\System\QkgyiOA.exe
  2⤵
  PID:7692
- C:\Windows\System\BGrhakk.exe
  C:\Windows\System\BGrhakk.exe
  2⤵
  PID:7716
- C:\Windows\System\DRHTyJq.exe
  C:\Windows\System\DRHTyJq.exe
  2⤵
  PID:7740
- C:\Windows\System\ndRAnwd.exe
  C:\Windows\System\ndRAnwd.exe
  2⤵
  PID:7756
- C:\Windows\System\eCGkmaX.exe
  C:\Windows\System\eCGkmaX.exe
  2⤵
  PID:7788
- C:\Windows\System\iGrHIbQ.exe
  C:\Windows\System\iGrHIbQ.exe
  2⤵
  PID:7808
- C:\Windows\System\vGKtMwt.exe
  C:\Windows\System\vGKtMwt.exe
  2⤵
  PID:7832
- C:\Windows\System\lAypnqE.exe
  C:\Windows\System\lAypnqE.exe
  2⤵
  PID:7848
- C:\Windows\System\JWymuEe.exe
  C:\Windows\System\JWymuEe.exe
  2⤵
  PID:7872
- C:\Windows\System\uPwfIDt.exe
  C:\Windows\System\uPwfIDt.exe
  2⤵
  PID:7888
- C:\Windows\System\pMQfOYg.exe
  C:\Windows\System\pMQfOYg.exe
  2⤵
  PID:7916
- C:\Windows\System\HBFYBdf.exe
  C:\Windows\System\HBFYBdf.exe
  2⤵
  PID:7932
- C:\Windows\System\QgSXPFb.exe
  C:\Windows\System\QgSXPFb.exe
  2⤵
  PID:7960
- C:\Windows\System\TAzleta.exe
  C:\Windows\System\TAzleta.exe
  2⤵
  PID:7976
- C:\Windows\System\SqEWSMo.exe
  C:\Windows\System\SqEWSMo.exe
  2⤵
  PID:8004
- C:\Windows\System\sAoVhLl.exe
  C:\Windows\System\sAoVhLl.exe
  2⤵
  PID:8024
- C:\Windows\System\CUBJdEY.exe
  C:\Windows\System\CUBJdEY.exe
  2⤵
  PID:8040
- C:\Windows\System\RFrRjvz.exe
  C:\Windows\System\RFrRjvz.exe
  2⤵
  PID:8060
- C:\Windows\System\nPaFoYg.exe
  C:\Windows\System\nPaFoYg.exe
  2⤵
  PID:8084
- C:\Windows\System\HCBYIfe.exe
  C:\Windows\System\HCBYIfe.exe
  2⤵
  PID:8104
- C:\Windows\System\HbbcGDr.exe
  C:\Windows\System\HbbcGDr.exe
  2⤵
  PID:8124
- C:\Windows\System\NbTGSsY.exe
  C:\Windows\System\NbTGSsY.exe
  2⤵
  PID:8144
- C:\Windows\System\uQYQMyP.exe
  C:\Windows\System\uQYQMyP.exe
  2⤵
  PID:8164
- C:\Windows\System\KuSbVlV.exe
  C:\Windows\System\KuSbVlV.exe
  2⤵
  PID:8188
- C:\Windows\System\MgDakIV.exe
  C:\Windows\System\MgDakIV.exe
  2⤵
  PID:6512
- C:\Windows\System\wGlDDWE.exe
  C:\Windows\System\wGlDDWE.exe
  2⤵
  PID:1556
- C:\Windows\System\BHgLYRm.exe
  C:\Windows\System\BHgLYRm.exe
  2⤵
  PID:7088
- C:\Windows\System\uhuVIfX.exe
  C:\Windows\System\uhuVIfX.exe
  2⤵
  PID:6996
- C:\Windows\System\jKKmOMT.exe
  C:\Windows\System\jKKmOMT.exe
  2⤵
  PID:6240
- C:\Windows\System\lYfCecy.exe
  C:\Windows\System\lYfCecy.exe
  2⤵
  PID:3504
- C:\Windows\System\tEjpiPr.exe
  C:\Windows\System\tEjpiPr.exe
  2⤵
  PID:6372
- C:\Windows\System\OAySfeR.exe
  C:\Windows\System\OAySfeR.exe
  2⤵
  PID:5892
- C:\Windows\System\siLIyYH.exe
  C:\Windows\System\siLIyYH.exe
  2⤵
  PID:1460
- C:\Windows\System\JABcFhL.exe
  C:\Windows\System\JABcFhL.exe
  2⤵
  PID:3188
- C:\Windows\System\FWQSRLE.exe
  C:\Windows\System\FWQSRLE.exe
  2⤵
  PID:5128
- C:\Windows\System\ZCSYfEa.exe
  C:\Windows\System\ZCSYfEa.exe
  2⤵
  PID:1144
- C:\Windows\System\TPWyNVc.exe
  C:\Windows\System\TPWyNVc.exe
  2⤵
  PID:5708
- C:\Windows\System\LOonzwk.exe
  C:\Windows\System\LOonzwk.exe
  2⤵
  PID:6072
- C:\Windows\System\gJmdafa.exe
  C:\Windows\System\gJmdafa.exe
  2⤵
  PID:6156
- C:\Windows\System\RLPKeaY.exe
  C:\Windows\System\RLPKeaY.exe
  2⤵
  PID:7700
- C:\Windows\System\txCiTEK.exe
  C:\Windows\System\txCiTEK.exe
  2⤵
  PID:6316
- C:\Windows\System\GdiIXsc.exe
  C:\Windows\System\GdiIXsc.exe
  2⤵
  PID:1848
- C:\Windows\System\WCkjkzi.exe
  C:\Windows\System\WCkjkzi.exe
  2⤵
  PID:8200
- C:\Windows\System\QvIOeiJ.exe
  C:\Windows\System\QvIOeiJ.exe
  2⤵
  PID:8232
- C:\Windows\System\HchDLUx.exe
  C:\Windows\System\HchDLUx.exe
  2⤵
  PID:8256
- C:\Windows\System\dtdNYxl.exe
  C:\Windows\System\dtdNYxl.exe
  2⤵
  PID:8272
- C:\Windows\System\BkkLdVr.exe
  C:\Windows\System\BkkLdVr.exe
  2⤵
  PID:8292
- C:\Windows\System\cQkKPrZ.exe
  C:\Windows\System\cQkKPrZ.exe
  2⤵
  PID:8308
- C:\Windows\System\xUZHaTa.exe
  C:\Windows\System\xUZHaTa.exe
  2⤵
  PID:8328
- C:\Windows\System\gSFrtcP.exe
  C:\Windows\System\gSFrtcP.exe
  2⤵
  PID:8344
- C:\Windows\System\HdWEENM.exe
  C:\Windows\System\HdWEENM.exe
  2⤵
  PID:8376
- C:\Windows\System\yWOzhtO.exe
  C:\Windows\System\yWOzhtO.exe
  2⤵
  PID:8400
- C:\Windows\System\kdzDXBX.exe
  C:\Windows\System\kdzDXBX.exe
  2⤵
  PID:8416
- C:\Windows\System\kbvknbD.exe
  C:\Windows\System\kbvknbD.exe
  2⤵
  PID:8440
- C:\Windows\System\IJlVzta.exe
  C:\Windows\System\IJlVzta.exe
  2⤵
  PID:8456
- C:\Windows\System\qRTZywX.exe
  C:\Windows\System\qRTZywX.exe
  2⤵
  PID:8476
- C:\Windows\System\WcdhSTT.exe
  C:\Windows\System\WcdhSTT.exe
  2⤵
  PID:8500
- C:\Windows\System\AVQtZzV.exe
  C:\Windows\System\AVQtZzV.exe
  2⤵
  PID:8524
- C:\Windows\System\RWDNjwh.exe
  C:\Windows\System\RWDNjwh.exe
  2⤵
  PID:8544
- C:\Windows\System\oBdLxPH.exe
  C:\Windows\System\oBdLxPH.exe
  2⤵
  PID:8560
- C:\Windows\System\onQYQrB.exe
  C:\Windows\System\onQYQrB.exe
  2⤵
  PID:8580
- C:\Windows\System\gIFopWH.exe
  C:\Windows\System\gIFopWH.exe
  2⤵
  PID:8604
- C:\Windows\System\kzduUvG.exe
  C:\Windows\System\kzduUvG.exe
  2⤵
  PID:8628
- C:\Windows\System\mcgmcPL.exe
  C:\Windows\System\mcgmcPL.exe
  2⤵
  PID:8648
- C:\Windows\System\WcpkGso.exe
  C:\Windows\System\WcpkGso.exe
  2⤵
  PID:8668
- C:\Windows\System\sMQjjox.exe
  C:\Windows\System\sMQjjox.exe
  2⤵
  PID:8692
- C:\Windows\System\ejyhSNE.exe
  C:\Windows\System\ejyhSNE.exe
  2⤵
  PID:8708
- C:\Windows\System\EEbsAnu.exe
  C:\Windows\System\EEbsAnu.exe
  2⤵
  PID:8744
- C:\Windows\System\MDEsaUH.exe
  C:\Windows\System\MDEsaUH.exe
  2⤵
  PID:8764
- C:\Windows\System\WPHjfuE.exe
  C:\Windows\System\WPHjfuE.exe
  2⤵
  PID:8792
- C:\Windows\System\rDHeaRH.exe
  C:\Windows\System\rDHeaRH.exe
  2⤵
  PID:8816
- C:\Windows\System\eFQYUOx.exe
  C:\Windows\System\eFQYUOx.exe
  2⤵
  PID:8836
- C:\Windows\System\zXbhECY.exe
  C:\Windows\System\zXbhECY.exe
  2⤵
  PID:8852
- C:\Windows\System\afBOpac.exe
  C:\Windows\System\afBOpac.exe
  2⤵
  PID:8868
- C:\Windows\System\zhBePtB.exe
  C:\Windows\System\zhBePtB.exe
  2⤵
  PID:8900
- C:\Windows\System\uLegGSx.exe
  C:\Windows\System\uLegGSx.exe
  2⤵
  PID:8924
- C:\Windows\System\zUAgvwQ.exe
  C:\Windows\System\zUAgvwQ.exe
  2⤵
  PID:8944
- C:\Windows\System\PGceRCV.exe
  C:\Windows\System\PGceRCV.exe
  2⤵
  PID:8968
- C:\Windows\System\vYnckQt.exe
  C:\Windows\System\vYnckQt.exe
  2⤵
  PID:8992
- C:\Windows\System\jDnizQt.exe
  C:\Windows\System\jDnizQt.exe
  2⤵
  PID:9016
- C:\Windows\System\KHRmVur.exe
  C:\Windows\System\KHRmVur.exe
  2⤵
  PID:9032
- C:\Windows\System\NqOjuyZ.exe
  C:\Windows\System\NqOjuyZ.exe
  2⤵
  PID:9052
- C:\Windows\System\RXqaJaj.exe
  C:\Windows\System\RXqaJaj.exe
  2⤵
  PID:9076
- C:\Windows\System\djazcoi.exe
  C:\Windows\System\djazcoi.exe
  2⤵
  PID:9100
- C:\Windows\System\PQABiVh.exe
  C:\Windows\System\PQABiVh.exe
  2⤵
  PID:9124
- C:\Windows\System\lxGgcgp.exe
  C:\Windows\System\lxGgcgp.exe
  2⤵
  PID:9140
- C:\Windows\System\IQwZCOX.exe
  C:\Windows\System\IQwZCOX.exe
  2⤵
  PID:9164
- C:\Windows\System\DRNaTQT.exe
  C:\Windows\System\DRNaTQT.exe
  2⤵
  PID:9184
- C:\Windows\System\MhpaMvG.exe
  C:\Windows\System\MhpaMvG.exe
  2⤵
  PID:9208
- C:\Windows\System\OyCWwlt.exe
  C:\Windows\System\OyCWwlt.exe
  2⤵
  PID:3480
- C:\Windows\System\BiaBCXD.exe
  C:\Windows\System\BiaBCXD.exe
  2⤵
  PID:6816
- C:\Windows\System\AgVuDku.exe
  C:\Windows\System\AgVuDku.exe
  2⤵
  PID:3256
- C:\Windows\System\YqgWHkK.exe
  C:\Windows\System\YqgWHkK.exe
  2⤵
  PID:7216
- C:\Windows\System\Conesce.exe
  C:\Windows\System\Conesce.exe
  2⤵
  PID:7864
- C:\Windows\System\zHVSUFJ.exe
  C:\Windows\System\zHVSUFJ.exe
  2⤵
  PID:7276
- C:\Windows\System\TYWJFJP.exe
  C:\Windows\System\TYWJFJP.exe
  2⤵
  PID:6600
- C:\Windows\System\MZpTlXW.exe
  C:\Windows\System\MZpTlXW.exe
  2⤵
  PID:6616
- C:\Windows\System\buNduFc.exe
  C:\Windows\System\buNduFc.exe
  2⤵
  PID:6440
- C:\Windows\System\AeokGCZ.exe
  C:\Windows\System\AeokGCZ.exe
  2⤵
  PID:4560
- C:\Windows\System\JCszIGJ.exe
  C:\Windows\System\JCszIGJ.exe
  2⤵
  PID:7308
- C:\Windows\System\JStCfWi.exe
  C:\Windows\System\JStCfWi.exe
  2⤵
  PID:4412
- C:\Windows\System\EXbdxXU.exe
  C:\Windows\System\EXbdxXU.exe
  2⤵
  PID:1052
- C:\Windows\System\mNtQLgT.exe
  C:\Windows\System\mNtQLgT.exe
  2⤵
  PID:6636
- C:\Windows\System\QSWzIqP.exe
  C:\Windows\System\QSWzIqP.exe
  2⤵
  PID:6788
- C:\Windows\System\KnbxuAJ.exe
  C:\Windows\System\KnbxuAJ.exe
  2⤵
  PID:8368
- C:\Windows\System\fDkvZvZ.exe
  C:\Windows\System\fDkvZvZ.exe
  2⤵
  PID:8436
- C:\Windows\System\mfEVVaI.exe
  C:\Windows\System\mfEVVaI.exe
  2⤵
  PID:7904
- C:\Windows\System\kJfEqLq.exe
  C:\Windows\System\kJfEqLq.exe
  2⤵
  PID:9236
- C:\Windows\System\QISjDkV.exe
  C:\Windows\System\QISjDkV.exe
  2⤵
  PID:9252
- C:\Windows\System\dwqGbpZ.exe
  C:\Windows\System\dwqGbpZ.exe
  2⤵
  PID:9268
- C:\Windows\System\HnLdAje.exe
  C:\Windows\System\HnLdAje.exe
  2⤵
  PID:9292
- C:\Windows\System\uLqZcZl.exe
  C:\Windows\System\uLqZcZl.exe
  2⤵
  PID:9308
- C:\Windows\System\uSPqNpI.exe
  C:\Windows\System\uSPqNpI.exe
  2⤵
  PID:9332
- C:\Windows\System\fLvxoRN.exe
  C:\Windows\System\fLvxoRN.exe
  2⤵
  PID:9352
- C:\Windows\System\pXTuHOU.exe
  C:\Windows\System\pXTuHOU.exe
  2⤵
  PID:9376
- C:\Windows\System\nVMRyIW.exe
  C:\Windows\System\nVMRyIW.exe
  2⤵
  PID:9400
- C:\Windows\System\gQeepnC.exe
  C:\Windows\System\gQeepnC.exe
  2⤵
  PID:9424
- C:\Windows\System\CoTzkfX.exe
  C:\Windows\System\CoTzkfX.exe
  2⤵
  PID:9440
- C:\Windows\System\wtvkIth.exe
  C:\Windows\System\wtvkIth.exe
  2⤵
  PID:9464
- C:\Windows\System\bWshZGS.exe
  C:\Windows\System\bWshZGS.exe
  2⤵
  PID:9484
- C:\Windows\System\eSbxTQO.exe
  C:\Windows\System\eSbxTQO.exe
  2⤵
  PID:9504
- C:\Windows\System\zrZyvyA.exe
  C:\Windows\System\zrZyvyA.exe
  2⤵
  PID:9528
- C:\Windows\System\zhMGhki.exe
  C:\Windows\System\zhMGhki.exe
  2⤵
  PID:9544
- C:\Windows\System\vjmOndY.exe
  C:\Windows\System\vjmOndY.exe
  2⤵
  PID:9572
- C:\Windows\System\XMtbcxI.exe
  C:\Windows\System\XMtbcxI.exe
  2⤵
  PID:9588
- C:\Windows\System\xGCEHoU.exe
  C:\Windows\System\xGCEHoU.exe
  2⤵
  PID:9608
- C:\Windows\System\ewnnmMJ.exe
  C:\Windows\System\ewnnmMJ.exe
  2⤵
  PID:9628
- C:\Windows\System\mFrQmLO.exe
  C:\Windows\System\mFrQmLO.exe
  2⤵
  PID:9644
- C:\Windows\System\PLJZzoC.exe
  C:\Windows\System\PLJZzoC.exe
  2⤵
  PID:9668
- C:\Windows\System\NXLfjSj.exe
  C:\Windows\System\NXLfjSj.exe
  2⤵
  PID:9684
- C:\Windows\System\SdPAlXj.exe
  C:\Windows\System\SdPAlXj.exe
  2⤵
  PID:9712
- C:\Windows\System\UuJHFvC.exe
  C:\Windows\System\UuJHFvC.exe
  2⤵
  PID:9732
- C:\Windows\System\nhkZCkG.exe
  C:\Windows\System\nhkZCkG.exe
  2⤵
  PID:9748
- C:\Windows\System\luQXAxv.exe
  C:\Windows\System\luQXAxv.exe
  2⤵
  PID:9764
- C:\Windows\System\jjnTNvm.exe
  C:\Windows\System\jjnTNvm.exe
  2⤵
  PID:9780
- C:\Windows\System\heguPGz.exe
  C:\Windows\System\heguPGz.exe
  2⤵
  PID:9804
- C:\Windows\System\HLcssBQ.exe
  C:\Windows\System\HLcssBQ.exe
  2⤵
  PID:9820
- C:\Windows\System\QnpBVLD.exe
  C:\Windows\System\QnpBVLD.exe
  2⤵
  PID:9848
- C:\Windows\System\NPYMkVj.exe
  C:\Windows\System\NPYMkVj.exe
  2⤵
  PID:9864
- C:\Windows\System\LofSRPt.exe
  C:\Windows\System\LofSRPt.exe
  2⤵
  PID:9888
- C:\Windows\System\SIEkqBQ.exe
  C:\Windows\System\SIEkqBQ.exe
  2⤵
  PID:9912
- C:\Windows\System\CPCEYlV.exe
  C:\Windows\System\CPCEYlV.exe
  2⤵
  PID:9932
- C:\Windows\System\gBSKDVk.exe
  C:\Windows\System\gBSKDVk.exe
  2⤵
  PID:9952
- C:\Windows\System\QGUsfox.exe
  C:\Windows\System\QGUsfox.exe
  2⤵
  PID:9976
- C:\Windows\System\pJCXOUg.exe
  C:\Windows\System\pJCXOUg.exe
  2⤵
  PID:9992
- C:\Windows\System\CooEZQs.exe
  C:\Windows\System\CooEZQs.exe
  2⤵
  PID:10012
- C:\Windows\System\oAFhyHV.exe
  C:\Windows\System\oAFhyHV.exe
  2⤵
  PID:10032
- C:\Windows\System\xnvpBaX.exe
  C:\Windows\System\xnvpBaX.exe
  2⤵
  PID:10052
- C:\Windows\System\vacwBiH.exe
  C:\Windows\System\vacwBiH.exe
  2⤵
  PID:10068
- C:\Windows\System\oRYWrYQ.exe
  C:\Windows\System\oRYWrYQ.exe
  2⤵
  PID:10088
- C:\Windows\System\tTFBdPp.exe
  C:\Windows\System\tTFBdPp.exe
  2⤵
  PID:10116
- C:\Windows\System\FEDXkSs.exe
  C:\Windows\System\FEDXkSs.exe
  2⤵
  PID:10132
- C:\Windows\System\wRzCBim.exe
  C:\Windows\System\wRzCBim.exe
  2⤵
  PID:10156
- C:\Windows\System\iiFfwIe.exe
  C:\Windows\System\iiFfwIe.exe
  2⤵
  PID:10176
- C:\Windows\System\rRORspA.exe
  C:\Windows\System\rRORspA.exe
  2⤵
  PID:10192
- C:\Windows\System\tmEDZbe.exe
  C:\Windows\System\tmEDZbe.exe
  2⤵
  PID:10216
- C:\Windows\System\dcgvbri.exe
  C:\Windows\System\dcgvbri.exe
  2⤵
  PID:10236
- C:\Windows\System\ZKsiXoM.exe
  C:\Windows\System\ZKsiXoM.exe
  2⤵
  PID:7340
- C:\Windows\System\cKHSHMy.exe
  C:\Windows\System\cKHSHMy.exe
  2⤵
  PID:8624
- C:\Windows\System\mRYVbWK.exe
  C:\Windows\System\mRYVbWK.exe
  2⤵
  PID:7436
- C:\Windows\System\zrQuYTr.exe
  C:\Windows\System\zrQuYTr.exe
  2⤵
  PID:8760
- C:\Windows\System\TtTQtRO.exe
  C:\Windows\System\TtTQtRO.exe
  2⤵
  PID:7504
- C:\Windows\System\ZjuYfLR.exe
  C:\Windows\System\ZjuYfLR.exe
  2⤵
  PID:8832
- C:\Windows\System\VRSuncG.exe
  C:\Windows\System\VRSuncG.exe
  2⤵
  PID:7604
- C:\Windows\System\heeVwmA.exe
  C:\Windows\System\heeVwmA.exe
  2⤵
  PID:412
- C:\Windows\System\FOayEai.exe
  C:\Windows\System\FOayEai.exe
  2⤵
  PID:7176
- C:\Windows\System\rxbOQWx.exe
  C:\Windows\System\rxbOQWx.exe
  2⤵
  PID:7644
- C:\Windows\System\zRIdNNv.exe
  C:\Windows\System\zRIdNNv.exe
  2⤵
  PID:2056
- C:\Windows\System\nRVLTBO.exe
  C:\Windows\System\nRVLTBO.exe
  2⤵
  PID:3136
- C:\Windows\System\dOwEDTW.exe
  C:\Windows\System\dOwEDTW.exe
  2⤵
  PID:5212
- C:\Windows\System\IZexKHi.exe
  C:\Windows\System\IZexKHi.exe
  2⤵
  PID:632
- C:\Windows\System\nxCAftB.exe
  C:\Windows\System\nxCAftB.exe
  2⤵
  PID:7232
- C:\Windows\System\epddaPW.exe
  C:\Windows\System\epddaPW.exe
  2⤵
  PID:7316
- C:\Windows\System\HiUfwZO.exe
  C:\Windows\System\HiUfwZO.exe
  2⤵
  PID:8252
- C:\Windows\System\flGOfyG.exe
  C:\Windows\System\flGOfyG.exe
  2⤵
  PID:8320
- C:\Windows\System\BnOmMqh.exe
  C:\Windows\System\BnOmMqh.exe
  2⤵
  PID:6132
- C:\Windows\System\jjChZwH.exe
  C:\Windows\System\jjChZwH.exe
  2⤵
  PID:10264
- C:\Windows\System\muwwiok.exe
  C:\Windows\System\muwwiok.exe
  2⤵
  PID:10288
- C:\Windows\System\FSLOxyN.exe
  C:\Windows\System\FSLOxyN.exe
  2⤵
  PID:10308
- C:\Windows\System\TJNzHRR.exe
  C:\Windows\System\TJNzHRR.exe
  2⤵
  PID:10332
- C:\Windows\System\wgHqynC.exe
  C:\Windows\System\wgHqynC.exe
  2⤵
  PID:10356
- C:\Windows\System\GjYXVbm.exe
  C:\Windows\System\GjYXVbm.exe
  2⤵
  PID:10376
- C:\Windows\System\PiSayiL.exe
  C:\Windows\System\PiSayiL.exe
  2⤵
  PID:10400
- C:\Windows\System\usOHQDi.exe
  C:\Windows\System\usOHQDi.exe
  2⤵
  PID:10416
- C:\Windows\System\iLaxZVP.exe
  C:\Windows\System\iLaxZVP.exe
  2⤵
  PID:10440
- C:\Windows\System\DSJwhjX.exe
  C:\Windows\System\DSJwhjX.exe
  2⤵
  PID:10468
- C:\Windows\System\bsDpPKP.exe
  C:\Windows\System\bsDpPKP.exe
  2⤵
  PID:10484
- C:\Windows\System\yQzhzYA.exe
  C:\Windows\System\yQzhzYA.exe
  2⤵
  PID:10512
- C:\Windows\System\DKBnXpE.exe
  C:\Windows\System\DKBnXpE.exe
  2⤵
  PID:10528
- C:\Windows\System\oNWkTHH.exe
  C:\Windows\System\oNWkTHH.exe
  2⤵
  PID:10544
- C:\Windows\System\vsZPhZL.exe
  C:\Windows\System\vsZPhZL.exe
  2⤵
  PID:10572
- C:\Windows\System\AiAwvqp.exe
  C:\Windows\System\AiAwvqp.exe
  2⤵
  PID:10596
- C:\Windows\System\LcWKVUa.exe
  C:\Windows\System\LcWKVUa.exe
  2⤵
  PID:10616
- C:\Windows\System\XyhIKad.exe
  C:\Windows\System\XyhIKad.exe
  2⤵
  PID:10636
- C:\Windows\System\HoTJjHB.exe
  C:\Windows\System\HoTJjHB.exe
  2⤵
  PID:10660
- C:\Windows\System\jjkSVgR.exe
  C:\Windows\System\jjkSVgR.exe
  2⤵
  PID:10680
- C:\Windows\System\jPCpAHS.exe
  C:\Windows\System\jPCpAHS.exe
  2⤵
  PID:10700
- C:\Windows\System\cxZWyYM.exe
  C:\Windows\System\cxZWyYM.exe
  2⤵
  PID:10720
- C:\Windows\System\pSsfhZc.exe
  C:\Windows\System\pSsfhZc.exe
  2⤵
  PID:10756
- C:\Windows\System\xMGNhcY.exe
  C:\Windows\System\xMGNhcY.exe
  2⤵
  PID:10776
- C:\Windows\System\AdZaFNP.exe
  C:\Windows\System\AdZaFNP.exe
  2⤵
  PID:10800
- C:\Windows\System\DsKTgvu.exe
  C:\Windows\System\DsKTgvu.exe
  2⤵
  PID:10816
- C:\Windows\System\KdBCorF.exe
  C:\Windows\System\KdBCorF.exe
  2⤵
  PID:10844
- C:\Windows\System\UPQthdj.exe
  C:\Windows\System\UPQthdj.exe
  2⤵
  PID:10868
- C:\Windows\System\DZFkNpF.exe
  C:\Windows\System\DZFkNpF.exe
  2⤵
  PID:10888
- C:\Windows\System\kebBVrE.exe
  C:\Windows\System\kebBVrE.exe
  2⤵
  PID:10920
- C:\Windows\System\MklLwyK.exe
  C:\Windows\System\MklLwyK.exe
  2⤵
  PID:10940
- C:\Windows\System\SuTcrLJ.exe
  C:\Windows\System\SuTcrLJ.exe
  2⤵
  PID:10960
- C:\Windows\System\nIKYYbT.exe
  C:\Windows\System\nIKYYbT.exe
  2⤵
  PID:10988
- C:\Windows\System\MTQirMK.exe
  C:\Windows\System\MTQirMK.exe
  2⤵
  PID:11024
- C:\Windows\System\BxSppqU.exe
  C:\Windows\System\BxSppqU.exe
  2⤵
  PID:11044
- C:\Windows\System\lFMPclD.exe
  C:\Windows\System\lFMPclD.exe
  2⤵
  PID:11064
- C:\Windows\System\wQmlbtB.exe
  C:\Windows\System\wQmlbtB.exe
  2⤵
  PID:11092
- C:\Windows\System\GsvLfUl.exe
  C:\Windows\System\GsvLfUl.exe
  2⤵
  PID:11112
- C:\Windows\System\uMyOKYx.exe
  C:\Windows\System\uMyOKYx.exe
  2⤵
  PID:11132
- C:\Windows\System\lwapVDm.exe
  C:\Windows\System\lwapVDm.exe
  2⤵
  PID:11152
- C:\Windows\System\XLONzto.exe
  C:\Windows\System\XLONzto.exe
  2⤵
  PID:11176
- C:\Windows\System\GneuOcf.exe
  C:\Windows\System\GneuOcf.exe
  2⤵
  PID:11196
- C:\Windows\System\JArmpVQ.exe
  C:\Windows\System\JArmpVQ.exe
  2⤵
  PID:11216
- C:\Windows\System\OaXYviZ.exe
  C:\Windows\System\OaXYviZ.exe
  2⤵
  PID:11248
- C:\Windows\System\kGTDeZu.exe
  C:\Windows\System\kGTDeZu.exe
  2⤵
  PID:8452
- C:\Windows\System\kHAGrVh.exe
  C:\Windows\System\kHAGrVh.exe
  2⤵
  PID:9248
- C:\Windows\System\NChquHx.exe
  C:\Windows\System\NChquHx.exe
  2⤵
  PID:7952
- C:\Windows\System\vCDgvGl.exe
  C:\Windows\System\vCDgvGl.exe
  2⤵
  PID:8704
- C:\Windows\System\dIiBxfj.exe
  C:\Windows\System\dIiBxfj.exe
  2⤵
  PID:8032
- C:\Windows\System\HFEcguE.exe
  C:\Windows\System\HFEcguE.exe
  2⤵
  PID:8052
- C:\Windows\System\uJuaqXG.exe
  C:\Windows\System\uJuaqXG.exe
  2⤵
  PID:8100
- C:\Windows\System\rzBtqDZ.exe
  C:\Windows\System\rzBtqDZ.exe
  2⤵
  PID:8156
- C:\Windows\System\FiRtcMq.exe
  C:\Windows\System\FiRtcMq.exe
  2⤵
  PID:8180
- C:\Windows\System\pjoPZuG.exe
  C:\Windows\System\pjoPZuG.exe
  2⤵
  PID:9756
- C:\Windows\System\PyWAXkO.exe
  C:\Windows\System\PyWAXkO.exe
  2⤵
  PID:5268
- C:\Windows\System\faDBFOD.exe
  C:\Windows\System\faDBFOD.exe
  2⤵
  PID:7112
- C:\Windows\System\mASCQzS.exe
  C:\Windows\System\mASCQzS.exe
  2⤵
  PID:6976
- C:\Windows\System\NpvazfP.exe
  C:\Windows\System\NpvazfP.exe
  2⤵
  PID:10060
- C:\Windows\System\GcaPhCc.exe
  C:\Windows\System\GcaPhCc.exe
  2⤵
  PID:5540
- C:\Windows\System\tghVifn.exe
  C:\Windows\System\tghVifn.exe
  2⤵
  PID:7684
- C:\Windows\System\FCOtfAi.exe
  C:\Windows\System\FCOtfAi.exe
  2⤵
  PID:7804
- C:\Windows\System\RjFgBzC.exe
  C:\Windows\System\RjFgBzC.exe
  2⤵
  PID:2264
- C:\Windows\System\KFdPBhQ.exe
  C:\Windows\System\KFdPBhQ.exe
  2⤵
  PID:11280
- C:\Windows\System\ybFVzyB.exe
  C:\Windows\System\ybFVzyB.exe
  2⤵
  PID:11308
- C:\Windows\System\jioUmTF.exe
  C:\Windows\System\jioUmTF.exe
  2⤵
  PID:11328
- C:\Windows\System\HIvFDtf.exe
  C:\Windows\System\HIvFDtf.exe
  2⤵
  PID:11348
- C:\Windows\System\OypXOxW.exe
  C:\Windows\System\OypXOxW.exe
  2⤵
  PID:11372
- C:\Windows\System\nhmkeCK.exe
  C:\Windows\System\nhmkeCK.exe
  2⤵
  PID:11388
- C:\Windows\System\WlinKmm.exe
  C:\Windows\System\WlinKmm.exe
  2⤵
  PID:11404
- C:\Windows\System\eSVuUgK.exe
  C:\Windows\System\eSVuUgK.exe
  2⤵
  PID:11420
- C:\Windows\System\ZPVQJAi.exe
  C:\Windows\System\ZPVQJAi.exe
  2⤵
  PID:11440
- C:\Windows\System\GSzGSTi.exe
  C:\Windows\System\GSzGSTi.exe
  2⤵
  PID:11456
- C:\Windows\System\IvsQwPy.exe
  C:\Windows\System\IvsQwPy.exe
  2⤵
  PID:11484
- C:\Windows\System\vRXzxXu.exe
  C:\Windows\System\vRXzxXu.exe
  2⤵
  PID:11512
- C:\Windows\System\gkcljDA.exe
  C:\Windows\System\gkcljDA.exe
  2⤵
  PID:11544
- C:\Windows\System\QUUPMrW.exe
  C:\Windows\System\QUUPMrW.exe
  2⤵
  PID:11564
- C:\Windows\System\dASBmMf.exe
  C:\Windows\System\dASBmMf.exe
  2⤵
  PID:11592
- C:\Windows\System\KzXcQmR.exe
  C:\Windows\System\KzXcQmR.exe
  2⤵
  PID:11616
- C:\Windows\System\fOTviuD.exe
  C:\Windows\System\fOTviuD.exe
  2⤵
  PID:11636
- C:\Windows\System\Wnetzrk.exe
  C:\Windows\System\Wnetzrk.exe
  2⤵
  PID:11664
- C:\Windows\System\zgGyQgN.exe
  C:\Windows\System\zgGyQgN.exe
  2⤵
  PID:11688
- C:\Windows\System\XeIIwtz.exe
  C:\Windows\System\XeIIwtz.exe
  2⤵
  PID:11712
- C:\Windows\System\qAMDkqE.exe
  C:\Windows\System\qAMDkqE.exe
  2⤵
  PID:11728
- C:\Windows\System\JKGUFZZ.exe
  C:\Windows\System\JKGUFZZ.exe
  2⤵
  PID:11780
- C:\Windows\System\ElXWSVi.exe
  C:\Windows\System\ElXWSVi.exe
  2⤵
  PID:11800
- C:\Windows\System\NOFFBwT.exe
  C:\Windows\System\NOFFBwT.exe
  2⤵
  PID:11816
- C:\Windows\System\rDxOmMc.exe
  C:\Windows\System\rDxOmMc.exe
  2⤵
  PID:11856
- C:\Windows\System\uaaJfEi.exe
  C:\Windows\System\uaaJfEi.exe
  2⤵
  PID:11880
- C:\Windows\System\PerNsZL.exe
  C:\Windows\System\PerNsZL.exe
  2⤵
  PID:11908
- C:\Windows\System\zZSmaKl.exe
  C:\Windows\System\zZSmaKl.exe
  2⤵
  PID:11924
- C:\Windows\System\PERvYAL.exe
  C:\Windows\System\PERvYAL.exe
  2⤵
  PID:11948
- C:\Windows\System\UxVfiDU.exe
  C:\Windows\System\UxVfiDU.exe
  2⤵
  PID:11968
- C:\Windows\System\sTVnmDu.exe
  C:\Windows\System\sTVnmDu.exe
  2⤵
  PID:11996
- C:\Windows\System\lQJdXnN.exe
  C:\Windows\System\lQJdXnN.exe
  2⤵
  PID:12012
- C:\Windows\System\ymgcNPF.exe
  C:\Windows\System\ymgcNPF.exe
  2⤵
  PID:12040
- C:\Windows\System\lDAGWoB.exe
  C:\Windows\System\lDAGWoB.exe
  2⤵
  PID:12056
- C:\Windows\System\pDDsMfI.exe
  C:\Windows\System\pDDsMfI.exe
  2⤵
  PID:12080
- C:\Windows\System\kmyVQPF.exe
  C:\Windows\System\kmyVQPF.exe
  2⤵
  PID:12096
- C:\Windows\System\ybpzEAy.exe
  C:\Windows\System\ybpzEAy.exe
  2⤵
  PID:12124
- C:\Windows\System\QFiovsV.exe
  C:\Windows\System\QFiovsV.exe
  2⤵
  PID:12152
- C:\Windows\System\zPyLhAv.exe
  C:\Windows\System\zPyLhAv.exe
  2⤵
  PID:12172
- C:\Windows\System\LBePQOQ.exe
  C:\Windows\System\LBePQOQ.exe
  2⤵
  PID:12196
- C:\Windows\System\FMrFfGM.exe
  C:\Windows\System\FMrFfGM.exe
  2⤵
  PID:12220
- C:\Windows\System\tdgdwWw.exe
  C:\Windows\System\tdgdwWw.exe
  2⤵
  PID:12236
- C:\Windows\System\BfwEbpg.exe
  C:\Windows\System\BfwEbpg.exe
  2⤵
  PID:12260
- C:\Windows\System\zkhnwMc.exe
  C:\Windows\System\zkhnwMc.exe
  2⤵
  PID:12284
- C:\Windows\System\AMHNNHK.exe
  C:\Windows\System\AMHNNHK.exe
  2⤵
  PID:6820
- C:\Windows\System\ldeESZq.exe
  C:\Windows\System\ldeESZq.exe
  2⤵
  PID:8360
- C:\Windows\System\sgvzsFx.exe
  C:\Windows\System\sgvzsFx.exe
  2⤵
  PID:8424
- C:\Windows\System\yrVmIXf.exe
  C:\Windows\System\yrVmIXf.exe
  2⤵
  PID:8492
- C:\Windows\System\pOzqnHC.exe
  C:\Windows\System\pOzqnHC.exe
  2⤵
  PID:8552
- C:\Windows\System\ksZsThQ.exe
  C:\Windows\System\ksZsThQ.exe
  2⤵
  PID:8592
- C:\Windows\System\KPJDfYc.exe
  C:\Windows\System\KPJDfYc.exe
  2⤵
  PID:9408
- C:\Windows\System\FReKNre.exe
  C:\Windows\System\FReKNre.exe
  2⤵
  PID:10896
- C:\Windows\System\pHcNxaz.exe
  C:\Windows\System\pHcNxaz.exe
  2⤵
  PID:9744
- C:\Windows\System\xvbDLuf.exe
  C:\Windows\System\xvbDLuf.exe
  2⤵
  PID:8844
- C:\Windows\System\rvrbXRk.exe
  C:\Windows\System\rvrbXRk.exe
  2⤵
  PID:11168
- C:\Windows\System\UfDgXnc.exe
  C:\Windows\System\UfDgXnc.exe
  2⤵
  PID:11232
- C:\Windows\System\OrJOnoR.exe
  C:\Windows\System\OrJOnoR.exe
  2⤵
  PID:8964
- C:\Windows\System\FuMqoiz.exe
  C:\Windows\System\FuMqoiz.exe
  2⤵
  PID:9004
- C:\Windows\System\xnXTnFT.exe
  C:\Windows\System\xnXTnFT.exe
  2⤵
  PID:10064
- C:\Windows\System\mYbyfps.exe
  C:\Windows\System\mYbyfps.exe
  2⤵
  PID:9116
- C:\Windows\System\mzxqcgO.exe
  C:\Windows\System\mzxqcgO.exe
  2⤵
  PID:9156
- C:\Windows\System\jxElFBK.exe
  C:\Windows\System\jxElFBK.exe
  2⤵
  PID:8140
- C:\Windows\System\FQNGEcH.exe
  C:\Windows\System\FQNGEcH.exe
  2⤵
  PID:12304
- C:\Windows\System\tmzQAQc.exe
  C:\Windows\System\tmzQAQc.exe
  2⤵
  PID:12320
- C:\Windows\System\dAIEPxR.exe
  C:\Windows\System\dAIEPxR.exe
  2⤵
  PID:12336
- C:\Windows\System\LgBhGBt.exe
  C:\Windows\System\LgBhGBt.exe
  2⤵
  PID:12360
- C:\Windows\System\dIfGwHC.exe
  C:\Windows\System\dIfGwHC.exe
  2⤵
  PID:12380
- C:\Windows\System\dkknUOK.exe
  C:\Windows\System\dkknUOK.exe
  2⤵
  PID:12404
- C:\Windows\System\EethvOu.exe
  C:\Windows\System\EethvOu.exe
  2⤵
  PID:12424
- C:\Windows\System\VjPmmTZ.exe
  C:\Windows\System\VjPmmTZ.exe
  2⤵
  PID:12444
- C:\Windows\System\uOnWtHC.exe
  C:\Windows\System\uOnWtHC.exe
  2⤵
  PID:12472
- C:\Windows\System\JTuUseA.exe
  C:\Windows\System\JTuUseA.exe
  2⤵
  PID:12496
- C:\Windows\System\OGYRZCv.exe
  C:\Windows\System\OGYRZCv.exe
  2⤵
  PID:12520
- C:\Windows\System\CxiPrye.exe
  C:\Windows\System\CxiPrye.exe
  2⤵
  PID:12536
- C:\Windows\System\BlHLUVj.exe
  C:\Windows\System\BlHLUVj.exe
  2⤵
  PID:12556
- C:\Windows\System\dZfVJKd.exe
  C:\Windows\System\dZfVJKd.exe
  2⤵
  PID:12576
- C:\Windows\System\mtvmTbx.exe
  C:\Windows\System\mtvmTbx.exe
  2⤵
  PID:12596
- C:\Windows\System\pWZVKDC.exe
  C:\Windows\System\pWZVKDC.exe
  2⤵
  PID:12616
- C:\Windows\System\TzOlUlD.exe
  C:\Windows\System\TzOlUlD.exe
  2⤵
  PID:12640
- C:\Windows\System\gcrvxis.exe
  C:\Windows\System\gcrvxis.exe
  2⤵
  PID:12664
- C:\Windows\System\qvpvrkB.exe
  C:\Windows\System\qvpvrkB.exe
  2⤵
  PID:12688
- C:\Windows\System\StPsKkH.exe
  C:\Windows\System\StPsKkH.exe
  2⤵
  PID:12708
- C:\Windows\System\WDnulay.exe
  C:\Windows\System\WDnulay.exe
  2⤵
  PID:12724
- C:\Windows\System\TraIZLk.exe
  C:\Windows\System\TraIZLk.exe
  2⤵
  PID:12752
- C:\Windows\System\tALncMv.exe
  C:\Windows\System\tALncMv.exe
  2⤵
  PID:12772
- C:\Windows\System\eLMiCKj.exe
  C:\Windows\System\eLMiCKj.exe
  2⤵
  PID:12796
- C:\Windows\System\idqInNy.exe
  C:\Windows\System\idqInNy.exe
  2⤵
  PID:12824
- C:\Windows\System\alyPlhc.exe
  C:\Windows\System\alyPlhc.exe
  2⤵
  PID:12840
- C:\Windows\System\EvWqhHK.exe
  C:\Windows\System\EvWqhHK.exe
  2⤵
  PID:12864
- C:\Windows\System\EZVkADM.exe
  C:\Windows\System\EZVkADM.exe
  2⤵
  PID:12880
- C:\Windows\System\tusWbdO.exe
  C:\Windows\System\tusWbdO.exe
  2⤵
  PID:12900
- C:\Windows\System\ofrzfEE.exe
  C:\Windows\System\ofrzfEE.exe
  2⤵
  PID:12924
- C:\Windows\System\BwaZiLJ.exe
  C:\Windows\System\BwaZiLJ.exe
  2⤵
  PID:12944
- C:\Windows\System\zOuBcmy.exe
  C:\Windows\System\zOuBcmy.exe
  2⤵
  PID:12960
- C:\Windows\System\LpUHilK.exe
  C:\Windows\System\LpUHilK.exe
  2⤵
  PID:12992
- C:\Windows\System\xVzNuHE.exe
  C:\Windows\System\xVzNuHE.exe
  2⤵
  PID:13016
- C:\Windows\System\wSkkIuj.exe
  C:\Windows\System\wSkkIuj.exe
  2⤵
  PID:13036
- C:\Windows\System\BMLtkkl.exe
  C:\Windows\System\BMLtkkl.exe
  2⤵
  PID:13056
- C:\Windows\System\RIUAtAj.exe
  C:\Windows\System\RIUAtAj.exe
  2⤵
  PID:13080
- C:\Windows\System\syaiwpo.exe
  C:\Windows\System\syaiwpo.exe
  2⤵
  PID:13108
- C:\Windows\System\BGCSytp.exe
  C:\Windows\System\BGCSytp.exe
  2⤵
  PID:13136
- C:\Windows\System\adrVwoF.exe
  C:\Windows\System\adrVwoF.exe
  2⤵
  PID:13156
- C:\Windows\System\rOUrJcR.exe
  C:\Windows\System\rOUrJcR.exe
  2⤵
  PID:13180
- C:\Windows\System\UtdEPEu.exe
  C:\Windows\System\UtdEPEu.exe
  2⤵
  PID:13196
- C:\Windows\System\YyYUyBl.exe
  C:\Windows\System\YyYUyBl.exe
  2⤵
  PID:13224
- C:\Windows\System\iKYHrYq.exe
  C:\Windows\System\iKYHrYq.exe
  2⤵
  PID:13244
- C:\Windows\System\iTPnvaq.exe
  C:\Windows\System\iTPnvaq.exe
  2⤵
  PID:13264
- C:\Windows\System\OvORWeV.exe
  C:\Windows\System\OvORWeV.exe
  2⤵
  PID:13284
- C:\Windows\System\dlBJwof.exe
  C:\Windows\System\dlBJwof.exe
  2⤵
  PID:9584
- C:\Windows\System\sStTeFJ.exe
  C:\Windows\System\sStTeFJ.exe
  2⤵
  PID:10184
- C:\Windows\System\NIGKZQt.exe
  C:\Windows\System\NIGKZQt.exe
  2⤵
  PID:8184
- C:\Windows\System\HRGtjBY.exe
  C:\Windows\System\HRGtjBY.exe
  2⤵
  PID:6836
- C:\Windows\System\nUeCRTx.exe
  C:\Windows\System\nUeCRTx.exe
  2⤵
  PID:7048
- C:\Windows\System\iHNdhLU.exe
  C:\Windows\System\iHNdhLU.exe
  2⤵
  PID:7472
- C:\Windows\System\fXQzbmC.exe
  C:\Windows\System\fXQzbmC.exe
  2⤵
  PID:11796
- C:\Windows\System\kqEvXkd.exe
  C:\Windows\System\kqEvXkd.exe
  2⤵
  PID:11864
- C:\Windows\System\ygbdaPb.exe
  C:\Windows\System\ygbdaPb.exe
  2⤵
  PID:10304
- C:\Windows\System\PxxOjpP.exe
  C:\Windows\System\PxxOjpP.exe
  2⤵
  PID:11984
- C:\Windows\System\PTaImuq.exe
  C:\Windows\System\PTaImuq.exe
  2⤵
  PID:12008
- C:\Windows\System\rxJKtcj.exe
  C:\Windows\System\rxJKtcj.exe
  2⤵
  PID:12068
- C:\Windows\System\GSjikET.exe
  C:\Windows\System\GSjikET.exe
  2⤵
  PID:12136
- C:\Windows\System\bMBnLrY.exe
  C:\Windows\System\bMBnLrY.exe
  2⤵
  PID:12252
- C:\Windows\System\IWUZWru.exe
  C:\Windows\System\IWUZWru.exe
  2⤵
  PID:5116
- C:\Windows\System\duUeaLT.exe
  C:\Windows\System\duUeaLT.exe
  2⤵
  PID:11808
- C:\Windows\System\MsFImsI.exe
  C:\Windows\System\MsFImsI.exe
  2⤵
  PID:8228
- C:\Windows\System\EtqEKXw.exe
  C:\Windows\System\EtqEKXw.exe
  2⤵
  PID:8464
- C:\Windows\System\tDohttW.exe
  C:\Windows\System\tDohttW.exe
  2⤵
  PID:8644
- C:\Windows\System\YEJRLXg.exe
  C:\Windows\System\YEJRLXg.exe
  2⤵
  PID:11144
- C:\Windows\System\yvZmXFc.exe
  C:\Windows\System\yvZmXFc.exe
  2⤵
  PID:9180
- C:\Windows\System\DljfJEz.exe
  C:\Windows\System\DljfJEz.exe
  2⤵
  PID:12332
- C:\Windows\System\AorVirq.exe
  C:\Windows\System\AorVirq.exe
  2⤵
  PID:12376
- C:\Windows\System\NxPYOcJ.exe
  C:\Windows\System\NxPYOcJ.exe
  2⤵
  PID:12464
- C:\Windows\System\iiLamrU.exe
  C:\Windows\System\iiLamrU.exe
  2⤵
  PID:12512
- C:\Windows\System\GacPMiR.exe
  C:\Windows\System\GacPMiR.exe
  2⤵
  PID:12548
- C:\Windows\System\fCSKjUC.exe
  C:\Windows\System\fCSKjUC.exe
  2⤵
  PID:12572
- C:\Windows\System\FrqVIUi.exe
  C:\Windows\System\FrqVIUi.exe
  2⤵
  PID:12672
- C:\Windows\System\yTblonz.exe
  C:\Windows\System\yTblonz.exe
  2⤵
  PID:12720
- C:\Windows\System\Mknsjpa.exe
  C:\Windows\System\Mknsjpa.exe
  2⤵
  PID:12788
- C:\Windows\System\AdlPrOq.exe
  C:\Windows\System\AdlPrOq.exe
  2⤵
  PID:9872
- C:\Windows\System\VxXjYdx.exe
  C:\Windows\System\VxXjYdx.exe
  2⤵
  PID:12956
- C:\Windows\System\raqnCoF.exe
  C:\Windows\System\raqnCoF.exe
  2⤵
  PID:12932
- C:\Windows\System\ifnPBIK.exe
  C:\Windows\System\ifnPBIK.exe
  2⤵
  PID:13120
- C:\Windows\System\jOREBJo.exe
  C:\Windows\System\jOREBJo.exe
  2⤵
  PID:9908
- C:\Windows\System\VYoTYgW.exe
  C:\Windows\System\VYoTYgW.exe
  2⤵
  PID:13164
- C:\Windows\System\wVFJHOH.exe
  C:\Windows\System\wVFJHOH.exe
  2⤵
  PID:13232
- C:\Windows\System\LoyHgiV.exe
  C:\Windows\System\LoyHgiV.exe
  2⤵
  PID:13300
- C:\Windows\System\SwMOMVV.exe
  C:\Windows\System\SwMOMVV.exe
  2⤵
  PID:7800
- C:\Windows\System\yIJAzJn.exe
  C:\Windows\System\yIJAzJn.exe
  2⤵
  PID:9200
- C:\Windows\System\NqILDXg.exe
  C:\Windows\System\NqILDXg.exe
  2⤵
  PID:6328
- C:\Windows\System\HyjLTfi.exe
  C:\Windows\System\HyjLTfi.exe
  2⤵
  PID:10044
- C:\Windows\System\xTLIOFz.exe
  C:\Windows\System\xTLIOFz.exe
  2⤵
  PID:10916
- C:\Windows\System\oZhvlke.exe
  C:\Windows\System\oZhvlke.exe
  2⤵
  PID:9432
- C:\Windows\System\ALQyIOk.exe
  C:\Windows\System\ALQyIOk.exe
  2⤵
  PID:9388
- C:\Windows\System\DzeHmxk.exe
  C:\Windows\System\DzeHmxk.exe
  2⤵
  PID:9364
- C:\Windows\System\NGitEYN.exe
  C:\Windows\System\NGitEYN.exe
  2⤵
  PID:12280
- C:\Windows\System\WykfeeQ.exe
  C:\Windows\System\WykfeeQ.exe
  2⤵
  PID:4756
- C:\Windows\System\GaBQSlq.exe
  C:\Windows\System\GaBQSlq.exe
  2⤵
  PID:9812
- C:\Windows\System\HVpQPKQ.exe
  C:\Windows\System\HVpQPKQ.exe
  2⤵
  PID:11452
- C:\Windows\System\TywIlxR.exe
  C:\Windows\System\TywIlxR.exe
  2⤵
  PID:9640
- C:\Windows\System\xljPATA.exe
  C:\Windows\System\xljPATA.exe
  2⤵
  PID:4368
- C:\Windows\System\RepiGAX.exe
  C:\Windows\System\RepiGAX.exe
  2⤵
  PID:7332
- C:\Windows\System\RISBOwS.exe
  C:\Windows\System\RISBOwS.exe
  2⤵
  PID:1076
- C:\Windows\System\JTebJLM.exe
  C:\Windows\System\JTebJLM.exe
  2⤵
  PID:10996
- C:\Windows\System\KGpqqfR.exe
  C:\Windows\System\KGpqqfR.exe
  2⤵
  PID:11772
- C:\Windows\System\pSCaGLt.exe
  C:\Windows\System\pSCaGLt.exe
  2⤵
  PID:10280
- C:\Windows\System\RZBcOwY.exe
  C:\Windows\System\RZBcOwY.exe
  2⤵
  PID:10456
- C:\Windows\System\sLrPtFM.exe
  C:\Windows\System\sLrPtFM.exe
  2⤵
  PID:10628
- C:\Windows\System\zdfrYRf.exe
  C:\Windows\System\zdfrYRf.exe
  2⤵
  PID:10520
- C:\Windows\System\BiByVuH.exe
  C:\Windows\System\BiByVuH.exe
  2⤵
  PID:10852
- C:\Windows\System\STjFXRb.exe
  C:\Windows\System\STjFXRb.exe
  2⤵
  PID:10880
- C:\Windows\System\ZbtfTrw.exe
  C:\Windows\System\ZbtfTrw.exe
  2⤵
  PID:12208
- C:\Windows\System\mHZSwYu.exe
  C:\Windows\System\mHZSwYu.exe
  2⤵
  PID:4356
- C:\Windows\System\CjISJiV.exe
  C:\Windows\System\CjISJiV.exe
  2⤵
  PID:9108
- C:\Windows\System\gihAgZd.exe
  C:\Windows\System\gihAgZd.exe
  2⤵
  PID:11900
- C:\Windows\System\CaTAhvy.exe
  C:\Windows\System\CaTAhvy.exe
  2⤵
  PID:11680
- C:\Windows\System\mwiisVP.exe
  C:\Windows\System\mwiisVP.exe
  2⤵
  PID:12120
- C:\Windows\System\PlcOFVa.exe
  C:\Windows\System\PlcOFVa.exe
  2⤵
  PID:2708
- C:\Windows\System\lPKenca.exe
  C:\Windows\System\lPKenca.exe
  2⤵
  PID:8808
- C:\Windows\System\jMyzPzD.exe
  C:\Windows\System\jMyzPzD.exe
  2⤵
  PID:12316
- C:\Windows\System\YDifQqr.exe
  C:\Windows\System\YDifQqr.exe
  2⤵
  PID:12248
- C:\Windows\System\EuzFeGf.exe
  C:\Windows\System\EuzFeGf.exe
  2⤵
  PID:12784
- C:\Windows\System\RugVzZo.exe
  C:\Windows\System\RugVzZo.exe
  2⤵
  PID:12416
- C:\Windows\System\SsKSvaT.exe
  C:\Windows\System\SsKSvaT.exe
  2⤵
  PID:13240
- C:\Windows\System\CCobALa.exe
  C:\Windows\System\CCobALa.exe
  2⤵
  PID:12780
- C:\Windows\System\QnKSxZR.exe
  C:\Windows\System\QnKSxZR.exe
  2⤵
  PID:11224
- C:\Windows\System\OJZkzrh.exe
  C:\Windows\System\OJZkzrh.exe
  2⤵
  PID:3168
- C:\Windows\System\yfGigGx.exe
  C:\Windows\System\yfGigGx.exe
  2⤵
  PID:13336
- C:\Windows\System\BXgSunx.exe
  C:\Windows\System\BXgSunx.exe
  2⤵
  PID:13356
- C:\Windows\System\spnisQE.exe
  C:\Windows\System\spnisQE.exe
  2⤵
  PID:13380
- C:\Windows\System\TGMfWnG.exe
  C:\Windows\System\TGMfWnG.exe
  2⤵
  PID:13400
- C:\Windows\System\lApWyzY.exe
  C:\Windows\System\lApWyzY.exe
  2⤵
  PID:13416
- C:\Windows\System\PIdglSi.exe
  C:\Windows\System\PIdglSi.exe
  2⤵
  PID:13440
- C:\Windows\System\vMBeKTo.exe
  C:\Windows\System\vMBeKTo.exe
  2⤵
  PID:13456
- C:\Windows\System\uGuTAKJ.exe
  C:\Windows\System\uGuTAKJ.exe
  2⤵
  PID:13480
- C:\Windows\System\TxfXopw.exe
  C:\Windows\System\TxfXopw.exe
  2⤵
  PID:13500
- C:\Windows\System\vKBQogy.exe
  C:\Windows\System\vKBQogy.exe
  2⤵
  PID:13524
- C:\Windows\System\nGEdEEU.exe
  C:\Windows\System\nGEdEEU.exe
  2⤵
  PID:13544
- C:\Windows\System\MlHkmwM.exe
  C:\Windows\System\MlHkmwM.exe
  2⤵
  PID:13564
- C:\Windows\System\WWDoWaT.exe
  C:\Windows\System\WWDoWaT.exe
  2⤵
  PID:13588
- C:\Windows\System\BbdZqGP.exe
  C:\Windows\System\BbdZqGP.exe
  2⤵
  PID:13608
- C:\Windows\System\dTbNpfo.exe
  C:\Windows\System\dTbNpfo.exe
  2⤵
  PID:13624
- C:\Windows\System\uHghEzP.exe
  C:\Windows\System\uHghEzP.exe
  2⤵
  PID:13648
- C:\Windows\System\rDCisHm.exe
  C:\Windows\System\rDCisHm.exe
  2⤵
  PID:13668
- C:\Windows\System\AoJWqQL.exe
  C:\Windows\System\AoJWqQL.exe
  2⤵
  PID:13688
- C:\Windows\System\PJHgHJt.exe
  C:\Windows\System\PJHgHJt.exe
  2⤵
  PID:13488
- C:\Windows\System\bpwkCzm.exe
  C:\Windows\System\bpwkCzm.exe
  2⤵
  PID:3156
- C:\Windows\System\rIRnfXZ.exe
  C:\Windows\System\rIRnfXZ.exe
  2⤵
  PID:10508
- C:\Windows\System\CPjkBtq.exe
  C:\Windows\System\CPjkBtq.exe
  2⤵
  PID:10556
- C:\Windows\System\FnbCycc.exe
  C:\Windows\System\FnbCycc.exe
  2⤵
  PID:8172
- C:\Windows\System\LLZKxpO.exe
  C:\Windows\System\LLZKxpO.exe
  2⤵
  PID:13728
- C:\Windows\System\RLxXpJR.exe
  C:\Windows\System\RLxXpJR.exe
  2⤵
  PID:4876
- C:\Windows\System\AlegpZd.exe
  C:\Windows\System\AlegpZd.exe
  2⤵
  PID:11724
- C:\Windows\System\HsWuhcy.exe
  C:\Windows\System\HsWuhcy.exe
  2⤵
  PID:9600
- C:\Windows\System\vwsjYhr.exe
  C:\Windows\System\vwsjYhr.exe
  2⤵
  PID:11228
- C:\Windows\System\mUzTlKB.exe
  C:\Windows\System\mUzTlKB.exe
  2⤵
  PID:13848
- C:\Windows\System\jdLDavV.exe
  C:\Windows\System\jdLDavV.exe
  2⤵
  PID:13320
- C:\Windows\System\TbOGAkQ.exe
  C:\Windows\System\TbOGAkQ.exe
  2⤵
  PID:13868
- C:\Windows\System\jkCYLUs.exe
  C:\Windows\System\jkCYLUs.exe
  2⤵
  PID:13412
- C:\Windows\System\VKWERQE.exe
  C:\Windows\System\VKWERQE.exe
  2⤵
  PID:10836
- C:\Windows\System\NbIIsYn.exe
  C:\Windows\System\NbIIsYn.exe
  2⤵
  PID:13716
- C:\Windows\System\GbDqDVI.exe
  C:\Windows\System\GbDqDVI.exe
  2⤵
  PID:7652
- C:\Windows\System\zPpgFpU.exe
  C:\Windows\System\zPpgFpU.exe
  2⤵
  PID:9884
- C:\Windows\System\UzlzmjO.exe
  C:\Windows\System\UzlzmjO.exe
  2⤵
  PID:9604
- C:\Windows\System\eaLbVfz.exe
  C:\Windows\System\eaLbVfz.exe
  2⤵
  PID:13872
- C:\Windows\System\zgISQOf.exe
  C:\Windows\System\zgISQOf.exe
  2⤵
  PID:13372
- C:\Windows\System\mectQPM.exe
  C:\Windows\System\mectQPM.exe
  2⤵
  PID:13432
- C:\Windows\System\CdFeZUi.exe
  C:\Windows\System\CdFeZUi.exe
  2⤵
  PID:13536
- C:\Windows\System\swQgfDx.exe
  C:\Windows\System\swQgfDx.exe
  2⤵
  PID:13620
- C:\Windows\System\yBHGUkd.exe
  C:\Windows\System\yBHGUkd.exe
  2⤵
  PID:13664
- C:\Windows\System\LFRVZja.exe
  C:\Windows\System\LFRVZja.exe
  2⤵
  PID:13744
- C:\Windows\System\kpCqQzW.exe
  C:\Windows\System\kpCqQzW.exe
  2⤵
  PID:13764
- C:\Windows\System\pSgZIcy.exe
  C:\Windows\System\pSgZIcy.exe
  2⤵
  PID:13796
- C:\Windows\System\jsDHDGX.exe
  C:\Windows\System\jsDHDGX.exe
  2⤵
  PID:13832
- C:\Windows\System\wEzHhgT.exe
  C:\Windows\System\wEzHhgT.exe
  2⤵
  PID:13076
- C:\Windows\System\mPukzYg.exe
  C:\Windows\System\mPukzYg.exe
  2⤵
  PID:14256
- C:\Windows\System\gDBDgkI.exe
  C:\Windows\System\gDBDgkI.exe
  2⤵
  PID:13976
- C:\Windows\System\ATXioXG.exe
  C:\Windows\System\ATXioXG.exe
  2⤵
  PID:14260
- C:\Windows\System\tUhpLKJ.exe
  C:\Windows\System\tUhpLKJ.exe
  2⤵
  PID:6048
- C:\Windows\System\HvYCpBQ.exe
  C:\Windows\System\HvYCpBQ.exe
  2⤵
  PID:13780
- C:\Windows\System\OxkadGi.exe
  C:\Windows\System\OxkadGi.exe
  2⤵
  PID:13172
- C:\Windows\System\UUhbQkP.exe
  C:\Windows\System\UUhbQkP.exe
  2⤵
  PID:14032
- C:\Windows\System\FLPYNXi.exe
  C:\Windows\System\FLPYNXi.exe
  2⤵
  PID:13984
- C:\Windows\System\VflbjhN.exe
  C:\Windows\System\VflbjhN.exe
  2⤵
  PID:14252
- C:\Windows\System\PUYAbtM.exe
  C:\Windows\System\PUYAbtM.exe
  2⤵
  PID:14156
- C:\Windows\System\UejhVDc.exe
  C:\Windows\System\UejhVDc.exe
  2⤵
  PID:14132
- C:\Windows\System\meJCtVf.exe
  C:\Windows\System\meJCtVf.exe
  2⤵
  PID:14092
- C:\Windows\System\HKXQlxx.exe
  C:\Windows\System\HKXQlxx.exe
  2⤵
  PID:13988
- C:\Windows\System\cxcCYaC.exe
  C:\Windows\System\cxcCYaC.exe
  2⤵
  PID:13952
- C:\Windows\System\BmkEuyg.exe
  C:\Windows\System\BmkEuyg.exe
  2⤵
  PID:9304
- C:\Windows\System\HZcWGLt.exe
  C:\Windows\System\HZcWGLt.exe
  2⤵
  PID:9700
- C:\Windows\System\UOYsSvE.exe
  C:\Windows\System\UOYsSvE.exe
  2⤵
  PID:13012
- C:\Windows\System\aEVEiiH.exe
  C:\Windows\System\aEVEiiH.exe
  2⤵
  PID:14160
- C:\Windows\System\HfBAloc.exe
  C:\Windows\System\HfBAloc.exe
  2⤵
  PID:12024
- C:\Windows\System\TnzwvHx.exe
  C:\Windows\System\TnzwvHx.exe
  2⤵
  PID:13296
- C:\Windows\System\KgiIkSm.exe
  C:\Windows\System\KgiIkSm.exe
  2⤵
  PID:13452
- C:\Windows\System\jEIqmDn.exe
  C:\Windows\System\jEIqmDn.exe
  2⤵
  PID:10784
- C:\Windows\System\jebPamU.exe
  C:\Windows\System\jebPamU.exe
  2⤵
  PID:12104
- C:\Windows\System\CBRHwpb.exe
  C:\Windows\System\CBRHwpb.exe
  2⤵
  PID:13364
- C:\Windows\System\axBHSdK.exe
  C:\Windows\System\axBHSdK.exe
  2⤵
  PID:13676
- C:\Windows\System\rXXpgFj.exe
  C:\Windows\System\rXXpgFj.exe
  2⤵
  PID:14112
- C:\Windows\System\rySIsYu.exe
  C:\Windows\System\rySIsYu.exe
  2⤵
  PID:14232
- C:\Windows\System\tDvSJTm.exe
  C:\Windows\System\tDvSJTm.exe
  2⤵
  PID:9664
- C:\Windows\System\tJCbWCA.exe
  C:\Windows\System\tJCbWCA.exe
  2⤵
  PID:13024
- C:\Windows\System\zuuYBZK.exe
  C:\Windows\System\zuuYBZK.exe
  2⤵
  PID:11956
- C:\Windows\System\QMOFhRU.exe
  C:\Windows\System\QMOFhRU.exe
  2⤵
  PID:8636
- C:\Windows\System\rDoXYeN.exe
  C:\Windows\System\rDoXYeN.exe
  2⤵
  PID:7148
- C:\Windows\System\SYMFiwF.exe
  C:\Windows\System\SYMFiwF.exe
  2⤵
  PID:12484
- C:\Windows\System\NwARprf.exe
  C:\Windows\System\NwARprf.exe
  2⤵
  PID:13752
- C:\Windows\System\GcjFlOv.exe
  C:\Windows\System\GcjFlOv.exe
  2⤵
  PID:11448
- C:\Windows\System\lSUKvvI.exe
  C:\Windows\System\lSUKvvI.exe
  2⤵
  PID:1044
- C:\Windows\System\EUdDigG.exe
  C:\Windows\System\EUdDigG.exe
  2⤵
  PID:9244
- C:\Windows\System\UScvSDV.exe
  C:\Windows\System\UScvSDV.exe
  2⤵
  PID:2688
- C:\Windows\System\iuejslc.exe
  C:\Windows\System\iuejslc.exe
  2⤵
  PID:928
- C:\Windows\System\frkHWAk.exe
  C:\Windows\System\frkHWAk.exe
  2⤵
  PID:13176
- C:\Windows\System\cBPQAbN.exe
  C:\Windows\System\cBPQAbN.exe
  2⤵
  PID:9176
- C:\Windows\System\VIoKEMr.exe
  C:\Windows\System\VIoKEMr.exe
  2⤵
  PID:5840
- C:\Windows\System\lXnfGoA.exe
  C:\Windows\System\lXnfGoA.exe
  2⤵
  PID:3960
- C:\Windows\System\lJEqvHw.exe
  C:\Windows\System\lJEqvHw.exe
  2⤵
  PID:9348
- C:\Windows\System\IiTYEkH.exe
  C:\Windows\System\IiTYEkH.exe
  2⤵
  PID:5696
- C:\Windows\System\gKfcxbd.exe
  C:\Windows\System\gKfcxbd.exe
  2⤵
  PID:11160
- C:\Windows\System\LGChOTw.exe
  C:\Windows\System\LGChOTw.exe
  2⤵
  PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yvgpzbgx.ojy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BeaqHTJ.exe

Filesize
1.3MB

MD5
6bc427df10afbd1d815c5fe69789ecd3

SHA1
7d2613cc946bab5623bf0300b968509399a49acc

SHA256
203f6fb60c21db490dee5e1b3392baadb49a20fdc93bdff0a79eda10dd7c4885

SHA512
710a859c3eb2e5e5595457c2b9777120c675ee38afe3e93c769e36cc9005abfe7e17a137d1b1b7b06d2fe6cce7f42fb76475f701546d4c44dc833b2b094fdb00

Download Submit
C:\Windows\System\DLiJOXB.exe

Filesize
1.3MB

MD5
edb096a064696b265e83e66f5e0ad450

SHA1
5651e5d82926efa9790cbedd84c571b6085a374c

SHA256
8eb8775c5ecdc10c1aed47bc8fc50187f5ed43b910802f95e55c0981767aa8f9

SHA512
10cc4997803be7b9d513da1a59a5e8bdc3c67b1524ab1ff5e05636b3abac939b4ede6a0ac85bfd75d5456d29779a7841cd48e15cc1ce94760866c96874ff2741

Download Submit
C:\Windows\System\DldfjHg.exe

Filesize
1.3MB

MD5
9b482ae7d43e876f6dee4dad267700f3

SHA1
8945e51c5aaf1ae9ca2e8aa3d99089ffaa0e9f5d

SHA256
dd960098d94cfe66a6c8f1028f468392ec00225eaa951fb3c6554a5b561b0a12

SHA512
aa359dab02c672f6a20c248eac6481a3d97be3aac69e24a4b9eccee9a4ddd93f1b47bd9fdf30d11ab243626e58bd6a217e44a7275b6dc6e09477c02dc6184a3d

Download Submit
C:\Windows\System\FCeHaWw.exe

Filesize
1.3MB

MD5
f8956f78b6c49ff854710eeb5a7ffe32

SHA1
1e7c4cb7989003d86247b872d7f8deb02b992737

SHA256
839c4ec9d2e16011e986044a48a55fa63a70481ae008f0ce6a713652de9d9b4a

SHA512
feb9a41f5c748bfe180feca2b5e64503f6ef7573c29250f5a309fbb3283f657afc8a2e350dbb73e1e9687e8334fb2730f06c32d1ecee0070dfa6a4785b0faca5

Download Submit
C:\Windows\System\FevrQer.exe

Filesize
1.3MB

MD5
1e3bac84dbd7649a30e2b44434bd8496

SHA1
334d63b82180f89a2825b40b25993ffdb0c61330

SHA256
592b373f96e8a202fc8524490b9bfb18ba8217bd2b3e3145918ce2c7a3711315

SHA512
6a24a30cd8e2e35137a30990be9612e0d85a251b2819eb1c5aba8bf8f821779ad8ecbd3505bb33977170d174defd421f29e2da6392b5924536d08c2ac3c08bab

Download Submit
C:\Windows\System\GSMKiIg.exe

Filesize
1.3MB

MD5
1ba1057d0e492d1919b7578133a9fcb1

SHA1
11d7bc05d5fc0ffa617ac7e5ee21b308e875d09e

SHA256
4187312ccfb98c0d804da8ea2854a0008f8d5bbee76026bf46abd73216806662

SHA512
5c9b582f08d952fc599cbb9d784c7f022d8837738a18b4fad29c860c45abc1f0663f267e4ce27b42f40aa8ebc9b631fb7f93e05a50817d2bf4a5567f7ec13eed

Download Submit
C:\Windows\System\GshMzHA.exe

Filesize
1.3MB

MD5
3971ddc4f11875b90a37724cae8a4152

SHA1
98f28b26931c37b04a1394d878c3e62e98c54389

SHA256
395a0c0112e9e0d427ec1026163291ffd00b07ddc059510e0f3bacdc5b892d3b

SHA512
abee0a758b93c958d8672cab817a047a580946c21fdf489496d54957c2a1359226036b7ebf14c47ce743c42c5bb268f611159e47fede56c8f8226d30e664eff6

Download Submit
C:\Windows\System\HDnqNuI.exe

Filesize
1.3MB

MD5
0b620b62d3ebf1ae33b7b500dc206280

SHA1
f2449bf554a444ecc7678b0edc09dcbe427d23ab

SHA256
6f9f3748e93f5541c7d8721c1547d5691a9cd63818dbcbd54b9e42ccc0683db6

SHA512
3044a39121d24fd8ba6fbabdd13bfe93fa27f842e30b4fe21a6d0535de05dcad03da1535ba7653f47e782135fb229215a6e8be204ed6ea66ee1c15daf8cb1229

Download Submit
C:\Windows\System\ItpIdro.exe

Filesize
1.3MB

MD5
b94e999d837b8bbe576b01f3f3f4abd5

SHA1
42a49bacf5dfe290956fe4bc13c9abe706209f1b

SHA256
8e22236ddf67a6ccfd0bfb014fe92861f0e111b3d918a84790aa02033a679d9f

SHA512
44f32852e4486304711923bd962440fa8ef7e47021021de3afc17c45a46502c10f1a186cfd9c023837bf9f7b95b3336186af28495826dc417bfc78f65b92442c

Download Submit
C:\Windows\System\OHDMeDz.exe

Filesize
1.3MB

MD5
a3950b4c4cdcf3cffcf4cdd2f3023046

SHA1
7430ac979eab488e8a87796b774ca7e1a6d482f0

SHA256
79ff9c8d747ab31078a1ba6f2800c3fd51ac3b88280958f0a56c04a49bd92e00

SHA512
9446208336ead1e862fccf1ca59382b32d582afb8db8095f25d3ed76d65b2423c5b4591346b57eaf4a38d390ec3aa3ef8571e3430cc8e1b5a3799f9bb73d957a

Download Submit
C:\Windows\System\QkIksxp.exe

Filesize
1.3MB

MD5
d9ad575dadedb15ce34fb4dc205e14a4

SHA1
db386b454a10a6429fea914f1613dc9d4f0add37

SHA256
f69b826ee31f9e7a2bcac36f1cbebc0e5bf56cd1e047dfa627365d7d6b199732

SHA512
a03a0927893004fa98103fbfd5995663832b558e5943a104d7b4e8a4cba88bae72f6ad0b12eb23160e1f591418e959b7eb5b037c106ff9f6fdd8c5041378e975

Download Submit
C:\Windows\System\Uicsseq.exe

Filesize
1.3MB

MD5
d67dd87b7586f111d52265d1794add44

SHA1
3e67b121969a73f8a545bff418646341b7787199

SHA256
24ebff25f31375aa49a6c86d51ead65f52e9c520c7db9cc467ab5fb9a2784794

SHA512
7d4921732c09d3deaca2309cee8b24047bfaaab74d7d34045f23c08e61d95f687267e3102503f3669e407403f2019be9e3fa9a7c46621b9fc3e383c127845a56

Download Submit
C:\Windows\System\XArwpIb.exe

Filesize
1.3MB

MD5
729ee9503fcca1fa0d2ccee378bcd1ab

SHA1
851bb87c711683a741678573d847ddf2e9476bdb

SHA256
f65dbfcd44bda609667cec0d9e749b486e0916c09cc4b3b28b3c9e25f4b80d64

SHA512
f5dadc2c52593b72abfd3b29f50483bb4bd2af72d00058bdbf9f48c63791c85412febaea986b726c7c0be934a330d25e9d42d07207e585727064b7812fbfcf95

Download Submit
C:\Windows\System\XOOMWuD.exe

Filesize
1.3MB

MD5
28a06b94c97d8579efa7d1daab1a0af6

SHA1
4c2c71648fa73456d819f780c0b502b468391717

SHA256
08edb09327e22ea721be974e5411f76935ed543b40c2696a40ac4afadca79fed

SHA512
22f7f85110500225a7efde0ffdaa9eaa7b2bbbe8b01f497647c366aae74d42358bf0b5488d45e7c4143b9e20e7663235241039e1535d1028eb4da6ec31d811e6

Download Submit
C:\Windows\System\YFeaOLX.exe

Filesize
8B

MD5
9cb4bf9fd9671df0839f651b7291ada1

SHA1
65a07e22b4bb88cf278eb1826c308150ded29593

SHA256
7188099eb9c8547d41ed9f4696ce901a0066852814ae83835a5ed6cbffc1cf40

SHA512
6f35a15b3248c656029fbcfa880774f447f590d87875077936e1e0e583b3b4b43f507832937ba7994137923090cc3abaa893880b066cf5189f7fd87f77593929

Download Submit
C:\Windows\System\YKtCBNh.exe

Filesize
1.3MB

MD5
84b264a73ad41f1e5fbef999ebd6db4c

SHA1
20aa74eef262621a76034e9e84d68931ad03dbfc

SHA256
2b08de724c6f6047b419c49c07ad45d63ff8f4017c6fc1d2bdbebb8c5b3a69ae

SHA512
52fb5009ad8b5f8b53cc4639a0904b5c5235cafbfc17459594374ead1e78a843ee2121bbdfe9bc5017b7dfc3d1c36bcbfc959687a76f3314f6805ab098f9b036

Download Submit
C:\Windows\System\YOtGEFB.exe

Filesize
1.3MB

MD5
f9b785091614f41692235197dca65c52

SHA1
35f47e5cd44fd499e1ccb7c8819d9fd5457475dc

SHA256
e60bd0243e399a386224dafed897ec21bbca9c5c91acc8be06205c17336220f7

SHA512
ce666b850a0e91ea072599c4d4ea805d08df6da038a7cb47c523ea22b06e8d2cff212cd6a869d26375ab36b08f45a4ac8d766a9bca701a10279ce601a26ed572

Download Submit
C:\Windows\System\aaRiBsu.exe

Filesize
1.3MB

MD5
f8453ba371ab48700c68e7b0b3e440ab

SHA1
76da3711a502eedde1b04d86c94152f03acd159c

SHA256
723a8cf019b596709aa121eb5e71861d79724eade77a8bb6415b3c3c5e7e375f

SHA512
b55e81b5a6ac6efbfc54d386aea26e2f41269016672d220d289507a6674300e08c592fe77aea210d32702c2f656319541579efc128146c2ea3e9ca6380fa69de

Download Submit
C:\Windows\System\dGnnkVb.exe

Filesize
1.3MB

MD5
2198e76d670d6fca4346e736948fa876

SHA1
e4cc46008aa408f8c99961d660c9b204096ec2b9

SHA256
fc7ac77d99dd5a879e539e74ee90e92d0e5e673cac4c2023c349e0e8d0da59ed

SHA512
c7a74e2ebb0270f119289a94e47cac21a9e790e8d0caf9cfb6e41f422eaae93abd54f40720b579944bb056e592b518718553769a4ebc8ff67cedc785dc9be631

Download Submit
C:\Windows\System\euJCQaB.exe

Filesize
1.3MB

MD5
7b20faa31ccadc38efa34a97f12cb4f7

SHA1
18f8cae87e1b31f32421f68a020f528ff7dd1b17

SHA256
4b48658b5937013ec8b8da0d4175a729b8d4f8bd68d62afd9d0b9eaa2b50ad95

SHA512
e221b09efc2cba0d4fc02c9088af962d573cacf04facd4618d315ee6576b22857dedb157734a0a3c926f4067efa87d94d488a2f3e6873b59b3a817103f76783e

Download Submit
C:\Windows\System\fjCOIFr.exe

Filesize
1.3MB

MD5
f761e96193e400167f7333e2dbc7ebd2

SHA1
005b1d3d1fe63f55e9c3be0cedf21050a7446c47

SHA256
6a84c2ac5f2a1fac30f392eb4b90d68594960fcb3f756792fd97bd40beb0a29a

SHA512
3480daef35446b1a8b45137f79f257f7c54c597d801749409bb08610df6c81743561c152c09729ef50b1de1a30e06ae550aa95044896f60af4b316dcc43b8ac0

Download Submit
C:\Windows\System\hWfOIVG.exe

Filesize
1.3MB

MD5
7d22f9a886cccf68868566e6824feca5

SHA1
71168023e4f79e6d9658a96452444b11846992d6

SHA256
06a6e8770f9506c64e57a3765ea392b7fc7d18160de563d4a52d107fbf577c99

SHA512
6f7533dfe7c210405fef653212eee8fff60e58a77736889a45c808238f38a6c04b0654467674a899fc9e7331f03bc30edf03d0f4c7b2d5911257a2446242ff5c

Download Submit
C:\Windows\System\iNGZQWg.exe

Filesize
1.3MB

MD5
862db127456467612b0a2e799aaae9a0

SHA1
115aa78b338edd0b12e8cf08b853601b456e9013

SHA256
a5d5ca48dbbb44641f88cde7028caa5361312759fb9d00b943df353101e78738

SHA512
dc653db211d631d8892a02b2d98a165c66316b3d0e2b9404daf79f47ec42a29d868ab23eb25ff47243449df56a4d99fca38d9ef1e0b7e9c8f2f870c65e7731e1

Download Submit
C:\Windows\System\ivixCAT.exe

Filesize
1.3MB

MD5
d7794ef00bd1a2cc9b87e1c4ed056767

SHA1
d2451822fff9974f381dc6a5c48c1e54e2563585

SHA256
c3c39ca3cef2385ac4928866ed31a069311d853ecb721724f671dfc201a31e27

SHA512
6b8ea1e6adfe5ad6dd9fbc3ed747cf6195b022641f8209cea9bf8f23c5271898624c6d5a439daec07652e437a8330c0876f672bdc37a1778ef1791a9c701f0de

Download Submit
C:\Windows\System\jcucAou.exe

Filesize
1.3MB

MD5
cfee1277ac570f92d25128bd769cea13

SHA1
f5a9b0b25cf6e8592036e36b036b7973a8fe6c3e

SHA256
74229d99f0e50d85a1cea6e33f0d5b48be164609ba989881a57a71d427c49278

SHA512
5f05550db73e3eb14bcffc9b638500547b1d829a2bbd8cac31d4904969025bc7f41e16de16c9ee0b214052e9708433db0db27d81b1d5f862a84ef8240d65d452

Download Submit
C:\Windows\System\kJmetUr.exe

Filesize
1.3MB

MD5
8a4d03aaeb679cea23759e6401c699f5

SHA1
c1b188f1806aeafec3978e3798404c3a0c16146a

SHA256
3370da5c704dc8662e76d8805e493ec340c268cf71269ac2c8de4cae86a8475c

SHA512
056ab23333184bdbb3e306143925ab065aafe15dffbc40fa2344e794e42637c26632b427c7bf49b5c28c9df0e6da96b8b7c5955bb566d3bfe5c94095d3d4a706

Download Submit
C:\Windows\System\kNiEEGy.exe

Filesize
1.3MB

MD5
c5f498b5c1439d405dd073963dc12cf7

SHA1
5eaa8cbb7b00071703b6911762419ef1b664fe46

SHA256
bae0d2ac8c1965a1b06c761a697b6986b463fadc28fb94bbfe4fc37d3647cd99

SHA512
ded0db6fac2b71c7974ab8794ba77a61e78ca3e6d5ffae6845b21ca12f6c7fc1596a250fa525461e4ef266d09e314e3f26fc71c02ac25b4711a159bd126d3872

Download Submit
C:\Windows\System\kpuXjJP.exe

Filesize
1.3MB

MD5
0845ec3ee59c43d50085374915cbfe10

SHA1
f765a02816058cbe440d1015591dfb327719cb11

SHA256
ffcadddc8509df8bc7e6682c1eb044394cb41c105bcdd140792a409bc252787d

SHA512
0073aaf142de55051e812c94de487dd6cc29c5d5658954d55a577666ca6729d50a5ff19ca34877ddccc75bd142b34757dfa623f00aac1ddb79a40117eb474767

Download Submit
C:\Windows\System\oOnUqSu.exe

Filesize
1.3MB

MD5
dd8f90ecc00f36c61100ad1542dda921

SHA1
0f752c339aefcf6619fae6bf7881b3518cd89d4a

SHA256
8f803193814406e283d45967cb874c315f08cb59b7f4a8022360c8c924a375e3

SHA512
ca984c755e62dc4d9c3cab6fbbe8c804f331bc39c43aa81ed8619b0c00c19f9a90cce5fc4781609b56ecf4cf22557fae68144c05030219ce7c022a6cb16de492

Download Submit
C:\Windows\System\obGnFcl.exe

Filesize
1.3MB

MD5
7fe7d080e3a04b5accc5c25669139b03

SHA1
f22c1a3707dc42e07affb558efb04d71895121ff

SHA256
e6c6d739e38cfa0083d85da65ccc96696fe2be009bbcae7ff92ad95a84977567

SHA512
6832abf81f309db74c69d5f24ff5031345e18a54a45a565224e6c659fc2aed008e1367f609d5dcbfbe7538b39ef7d97c8493fe5e13db866f3b3d1b07179c8563

Download Submit
C:\Windows\System\qURxUJK.exe

Filesize
1.3MB

MD5
191fc8c978eb417c703c620a7480e4f6

SHA1
842c623db05f0e253ca7d14911bd009b8d1ebbbd

SHA256
218643158e4cc12bbc46c286ddf6ef8d48a437dde49d339a2b751f43aada9641

SHA512
dbce0050e319f4404a99276f2524e6160b7c7f85b656d67aa52e1ed32154346b630cfee04e30388508e80adb57fdd7a65a96009df39876f26d09e31ea6026fad

Download Submit
C:\Windows\System\qYeAMdD.exe

Filesize
1.3MB

MD5
f6817847f0b97d23cd517e51e7f1a3e0

SHA1
410961b5d03af7685e2a04f8af77ee43bfc2c340

SHA256
e1201e925ac5ffe4075d9c4da403aa5239793d7081e30abac5ca4f119ab50df7

SHA512
1e2774387f0c3dffcb3b6b91b0f14cd4d37268ab98b001e6d2bb4cfd040a3702ea9500235f2256553c521d04a4ff7d0442340c3b9d897bcf931fc87fa9bc3c7e

Download Submit
C:\Windows\System\rutxXdP.exe

Filesize
1.3MB

MD5
8721ebd04e89ab23b412e3cf3c815d4a

SHA1
71adf5761f7c974610526a2b8ad3f6a356446f06

SHA256
a6288c5c9c2846f46d6bba7f93deade27c44a62faeaf327cc57364c1370ae2ab

SHA512
c0e8ebeaba10f95e23e21f53a5196e6dde9eb9c3bdd5963bf0d57612737899a977c068d27a9994944ed5ba183b2d4124aa8a33c30a65306d2f8e6009e4d69278

Download Submit
C:\Windows\System\rxfOJgu.exe

Filesize
1.3MB

MD5
28fbbfafcafc899525f7e09b8dc5a747

SHA1
44a2344c663c21adbd3d3fa00f8d7fda3c8a9e19

SHA256
64e728f5eb62a6ae9cddb4bc820f21f4e16ca51aaf55cb6105b4655d44f18832

SHA512
15902a58dedfff9d97d6fb428509e1a6c49558b837846f176e537958f3f5fb129c0c43ca559f55e384453df9377808cf01d1cbd0356b05b1614907dc1480b704

Download Submit
C:\Windows\System\sqnxXjQ.exe

Filesize
1.3MB

MD5
e9afd12a41d4dc94e0642c09916d91ca

SHA1
f516634fb239056352bc5edd681a0a3498923fd2

SHA256
7223997cb49082a31fd0e7eb8b08c21c36b8b3ddf7f00e7df8c4a3af373b3790

SHA512
af0e822fcd71df2723a762ea9f4bcf1e819b82ba108148c046901d16f8d9b13f5d6c38bc4a228655629a12feff1f440423b564021f08e1a735907147286c7e47

Download Submit
C:\Windows\System\suVIORz.exe

Filesize
1.3MB

MD5
c0ac60aa8bc15f6a504698465d4b7dbb

SHA1
6e43ae33a4d776d3220dc4dbb89fc86b67611e8b

SHA256
b86798ebe830fec3e710e8371530b9e5738667d5d978a889d8282025e59b8cfe

SHA512
e075b89e8ac86ed17c1520bbc6cd886be41fa92298ef4ec619495d2fb281beba04378dbf2ab89a73847216fbf3d3a83f166dc6ab87c6c5de117d389e42fdb46a

Download Submit
C:\Windows\System\vUtrccl.exe

Filesize
1.3MB

MD5
feca3bc8935aea113f6e7c601d91ac78

SHA1
bbbab27783190c20a87ca4aac32fb355d52eac34

SHA256
987853a32a4cad58fc3993938364434185a7736b853853b45d7e59e8f692aead

SHA512
4fd6a67d3d26eb97d28ab78003277cfdd23d126b42c3edea3ec50c9da6947e2324487285cd22449891e095476545eeee24ae04519398182138d241856cb1e5f6

Download Submit
C:\Windows\System\wEMBHuP.exe

Filesize
1.3MB

MD5
f663ad8934f5d4eb9ab0abc58134504e

SHA1
a17d8701d25a2c4e434fb33f532363b49f0337d2

SHA256
73433c56ab8a7c0beaf990d994a14ce268585a154cb66419a906411ed7d37e2e

SHA512
ce0b21ef49cebd47bd7e90b2398a7f6fb80e48a9f670834ab5bb3e92a7b1f2bae9613fb980d64bc3a3ede379c51e5205d1cf6bb1688bb6621a691af65fad81b1

Download Submit
C:\Windows\System\xPQiaKz.exe

Filesize
1.3MB

MD5
fede49ca07b8d61d731ccb9e1a1ef822

SHA1
968a656da8a27b41d77d860134340a58cea654d0

SHA256
4c4413b99abc6ac367c1ba19a4ee3ec72bc59f5a1b25a83dcdf7b03367c7f311

SHA512
659324bff352130d425c52c125d5f64802a1f918e7fec3aea169e929012f31d686879fba91362824e0136277b37e59dd85010fa7af06e0c8f91566cab69eaa8b

Download Submit
C:\Windows\System\xcPKCsB.exe

Filesize
1.3MB

MD5
5e00b166db55b6ef04bd24bc4ba11cfb

SHA1
616a2cfef67b82da9606452876ed2e43d2cbef02

SHA256
a3428c4438d3f974db798642530bc929e398a35f6c1bdec3d31de51db321f24f

SHA512
07fc3c1a7ac5db8f0f0deb866b3c13449f304d563bf8e98217470ac3905febac41e65b5aaa64cafb9af0ac893ada836c29e017836c1811e16abcb75f65066e45

Download Submit
C:\Windows\System\zuLzZEg.exe

Filesize
1.3MB

MD5
46d2de8bcc63aac880aee9e5fccbba32

SHA1
3bce656aa106b28b8ec1d75869ecfda04113a39b

SHA256
c94b0c25123746d53eebab36032fe95147d1a82c7656e01d5492db594599640b

SHA512
a28b12350442bbda5e259b8a0110d4b83ccdba40c751af04a13f9385c4a519441a049f14c66853b3c9defe10d3f41c6d947f898f6c5ec9927e3eff77da35b89c

Download Submit
memory/848-2875-0x00007FF7D4180000-0x00007FF7D4572000-memory.dmp

Filesize
3.9MB

Download
memory/848-379-0x00007FF7D4180000-0x00007FF7D4572000-memory.dmp

Filesize
3.9MB

Download
memory/1216-314-0x00007FF7E29C0000-0x00007FF7E2DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1216-2882-0x00007FF7E29C0000-0x00007FF7E2DB2000-memory.dmp

Filesize
3.9MB

Download
memory/1252-2872-0x00007FF63E710000-0x00007FF63EB02000-memory.dmp

Filesize
3.9MB

Download
memory/1252-386-0x00007FF63E710000-0x00007FF63EB02000-memory.dmp

Filesize
3.9MB

Download
memory/1584-2891-0x00007FF72FDC0000-0x00007FF7301B2000-memory.dmp

Filesize
3.9MB

Download
memory/1584-378-0x00007FF72FDC0000-0x00007FF7301B2000-memory.dmp

Filesize
3.9MB

Download
memory/2008-383-0x00007FF6C7700000-0x00007FF6C7AF2000-memory.dmp

Filesize
3.9MB

Download
memory/2008-2898-0x00007FF6C7700000-0x00007FF6C7AF2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-2845-0x00007FF650430000-0x00007FF650822000-memory.dmp

Filesize
3.9MB

Download
memory/2148-19-0x00007FF650430000-0x00007FF650822000-memory.dmp

Filesize
3.9MB

Download
memory/2252-2860-0x00007FF763460000-0x00007FF763852000-memory.dmp

Filesize
3.9MB

Download
memory/2252-90-0x00007FF763460000-0x00007FF763852000-memory.dmp

Filesize
3.9MB

Download
memory/2784-2811-0x00007FF7180C0000-0x00007FF7184B2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-11-0x00007FF7180C0000-0x00007FF7184B2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-195-0x00007FF757E70000-0x00007FF758262000-memory.dmp

Filesize
3.9MB

Download
memory/2892-2902-0x00007FF757E70000-0x00007FF758262000-memory.dmp

Filesize
3.9MB

Download
memory/3040-220-0x00007FF6130E0000-0x00007FF6134D2000-memory.dmp

Filesize
3.9MB

Download
memory/3040-2866-0x00007FF6130E0000-0x00007FF6134D2000-memory.dmp

Filesize
3.9MB

Download
memory/3212-42-0x00007FF7C5960000-0x00007FF7C5D52000-memory.dmp

Filesize
3.9MB

Download
memory/3212-2849-0x00007FF7C5960000-0x00007FF7C5D52000-memory.dmp

Filesize
3.9MB

Download
memory/3272-539-0x000001C2296E0000-0x000001C229702000-memory.dmp

Filesize
136KB

Download
memory/3576-52-0x00007FF79F700000-0x00007FF79FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/3576-2869-0x00007FF79F700000-0x00007FF79FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/3932-387-0x00007FF63E660000-0x00007FF63EA52000-memory.dmp

Filesize
3.9MB

Download
memory/3932-2901-0x00007FF63E660000-0x00007FF63EA52000-memory.dmp

Filesize
3.9MB

Download
memory/4008-2880-0x00007FF6F7120000-0x00007FF6F7512000-memory.dmp

Filesize
3.9MB

Download
memory/4008-385-0x00007FF6F7120000-0x00007FF6F7512000-memory.dmp

Filesize
3.9MB

Download
memory/4044-384-0x00007FF652A40000-0x00007FF652E32000-memory.dmp

Filesize
3.9MB

Download
memory/4044-2937-0x00007FF652A40000-0x00007FF652E32000-memory.dmp

Filesize
3.9MB

Download
memory/4152-221-0x00007FF7DE410000-0x00007FF7DE802000-memory.dmp

Filesize
3.9MB

Download
memory/4152-2896-0x00007FF7DE410000-0x00007FF7DE802000-memory.dmp

Filesize
3.9MB

Download
memory/4376-382-0x00007FF660920000-0x00007FF660D12000-memory.dmp

Filesize
3.9MB

Download
memory/4376-2892-0x00007FF660920000-0x00007FF660D12000-memory.dmp

Filesize
3.9MB

Download
memory/4440-381-0x00007FF75BDB0000-0x00007FF75C1A2000-memory.dmp

Filesize
3.9MB

Download
memory/4440-2886-0x00007FF75BDB0000-0x00007FF75C1A2000-memory.dmp

Filesize
3.9MB

Download
memory/4564-380-0x00007FF7039F0000-0x00007FF703DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4564-2888-0x00007FF7039F0000-0x00007FF703DE2000-memory.dmp

Filesize
3.9MB

Download
memory/4580-377-0x00007FF6FB420000-0x00007FF6FB812000-memory.dmp

Filesize
3.9MB

Download
memory/4580-2884-0x00007FF6FB420000-0x00007FF6FB812000-memory.dmp

Filesize
3.9MB

Download
memory/4652-2878-0x00007FF6E83C0000-0x00007FF6E87B2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-327-0x00007FF6E83C0000-0x00007FF6E87B2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-2877-0x00007FF672DD0000-0x00007FF6731C2000-memory.dmp

Filesize
3.9MB

Download
memory/4748-388-0x00007FF672DD0000-0x00007FF6731C2000-memory.dmp

Filesize
3.9MB

Download
memory/4868-2870-0x00007FF684680000-0x00007FF684A72000-memory.dmp

Filesize
3.9MB

Download
memory/4868-136-0x00007FF684680000-0x00007FF684A72000-memory.dmp

Filesize
3.9MB

Download
memory/4884-142-0x00007FF654F30000-0x00007FF655322000-memory.dmp

Filesize
3.9MB

Download
memory/4884-2894-0x00007FF654F30000-0x00007FF655322000-memory.dmp

Filesize
3.9MB

Download
memory/5040-0-0x00007FF755A50000-0x00007FF755E42000-memory.dmp

Filesize
3.9MB

Download
memory/5040-1-0x000001E5B0D70000-0x000001E5B0D80000-memory.dmp

Filesize
64KB

Download