xmrig | c8b39ecf555233d59a4221819e3aabe4db8f91939003be3235bf7ab15f4c6579

Analysis

max time kernel
121s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
Size

1.6MB
MD5

cffcc9b7963632edbaa56dadda560b10
SHA1

18b36e1c061a7f7059b1bf14f6319a0d79cc9c69
SHA256

c8b39ecf555233d59a4221819e3aabe4db8f91939003be3235bf7ab15f4c6579
SHA512

8814364d4efc505f55ceca9cedba044348dca10a15fe0da54f792ba198fa23a272095b8d9e175b2934d1b0debcf9a7e79ef59b491608c0fb83068cbafa2f2b8b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7K6WefmedkVoMFNi:Lz071uv4BPMkyW10/w16BvZuaX3

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/1704-18-0x00007FF7A5AD0000-0x00007FF7A5EC2000-memory.dmp	xmrig
behavioral2/memory/1168-620-0x00007FF647C00000-0x00007FF647FF2000-memory.dmp	xmrig
behavioral2/memory/3708-1220-0x00007FF609770000-0x00007FF609B62000-memory.dmp	xmrig
behavioral2/memory/2832-1219-0x00007FF7F61C0000-0x00007FF7F65B2000-memory.dmp	xmrig
behavioral2/memory/2260-1203-0x00007FF6049D0000-0x00007FF604DC2000-memory.dmp	xmrig
behavioral2/memory/4996-1201-0x00007FF672F50000-0x00007FF673342000-memory.dmp	xmrig
behavioral2/memory/3488-1205-0x00007FF769420000-0x00007FF769812000-memory.dmp	xmrig
behavioral2/memory/432-1043-0x00007FF743460000-0x00007FF743852000-memory.dmp	xmrig
behavioral2/memory/3120-1041-0x00007FF755B10000-0x00007FF755F02000-memory.dmp	xmrig
behavioral2/memory/4828-872-0x00007FF794730000-0x00007FF794B22000-memory.dmp	xmrig
behavioral2/memory/3572-787-0x00007FF70AEE0000-0x00007FF70B2D2000-memory.dmp	xmrig
behavioral2/memory/1040-628-0x00007FF669690000-0x00007FF669A82000-memory.dmp	xmrig
behavioral2/memory/4108-627-0x00007FF797EA0000-0x00007FF798292000-memory.dmp	xmrig
behavioral2/memory/4652-625-0x00007FF6C61C0000-0x00007FF6C65B2000-memory.dmp	xmrig
behavioral2/memory/548-624-0x00007FF695AB0000-0x00007FF695EA2000-memory.dmp	xmrig
behavioral2/memory/1828-623-0x00007FF6E5D40000-0x00007FF6E6132000-memory.dmp	xmrig
behavioral2/memory/3992-622-0x00007FF772D70000-0x00007FF773162000-memory.dmp	xmrig
behavioral2/memory/4548-621-0x00007FF6340B0000-0x00007FF6344A2000-memory.dmp	xmrig
behavioral2/memory/2572-618-0x00007FF7A4940000-0x00007FF7A4D32000-memory.dmp	xmrig
behavioral2/memory/1896-587-0x00007FF6F0AD0000-0x00007FF6F0EC2000-memory.dmp	xmrig
behavioral2/memory/4104-460-0x00007FF6D8470000-0x00007FF6D8862000-memory.dmp	xmrig
behavioral2/memory/3336-369-0x00007FF61ADA0000-0x00007FF61B192000-memory.dmp	xmrig
behavioral2/memory/4228-365-0x00007FF66FE10000-0x00007FF670202000-memory.dmp	xmrig
behavioral2/memory/1704-4365-0x00007FF7A5AD0000-0x00007FF7A5EC2000-memory.dmp	xmrig
behavioral2/memory/3488-4367-0x00007FF769420000-0x00007FF769812000-memory.dmp	xmrig
behavioral2/memory/1896-4369-0x00007FF6F0AD0000-0x00007FF6F0EC2000-memory.dmp	xmrig
behavioral2/memory/4104-4372-0x00007FF6D8470000-0x00007FF6D8862000-memory.dmp	xmrig
behavioral2/memory/3336-4373-0x00007FF61ADA0000-0x00007FF61B192000-memory.dmp	xmrig
behavioral2/memory/2832-4377-0x00007FF7F61C0000-0x00007FF7F65B2000-memory.dmp	xmrig
behavioral2/memory/4228-4375-0x00007FF66FE10000-0x00007FF670202000-memory.dmp	xmrig
behavioral2/memory/1828-4379-0x00007FF6E5D40000-0x00007FF6E6132000-memory.dmp	xmrig
behavioral2/memory/1168-4391-0x00007FF647C00000-0x00007FF647FF2000-memory.dmp	xmrig
behavioral2/memory/3676-4395-0x00007FF7D72E0000-0x00007FF7D76D2000-memory.dmp	xmrig
behavioral2/memory/3120-4406-0x00007FF755B10000-0x00007FF755F02000-memory.dmp	xmrig
behavioral2/memory/2260-4411-0x00007FF6049D0000-0x00007FF604DC2000-memory.dmp	xmrig
behavioral2/memory/4548-4416-0x00007FF6340B0000-0x00007FF6344A2000-memory.dmp	xmrig
behavioral2/memory/4828-4404-0x00007FF794730000-0x00007FF794B22000-memory.dmp	xmrig
behavioral2/memory/548-4400-0x00007FF695AB0000-0x00007FF695EA2000-memory.dmp	xmrig
behavioral2/memory/4996-4398-0x00007FF672F50000-0x00007FF673342000-memory.dmp	xmrig
behavioral2/memory/1040-4393-0x00007FF669690000-0x00007FF669A82000-memory.dmp	xmrig
behavioral2/memory/3708-4402-0x00007FF609770000-0x00007FF609B62000-memory.dmp	xmrig
behavioral2/memory/3992-4388-0x00007FF772D70000-0x00007FF773162000-memory.dmp	xmrig
behavioral2/memory/3572-4383-0x00007FF70AEE0000-0x00007FF70B2D2000-memory.dmp	xmrig
behavioral2/memory/432-4397-0x00007FF743460000-0x00007FF743852000-memory.dmp	xmrig
behavioral2/memory/2572-4386-0x00007FF7A4940000-0x00007FF7A4D32000-memory.dmp	xmrig
behavioral2/memory/4108-4382-0x00007FF797EA0000-0x00007FF798292000-memory.dmp	xmrig
behavioral2/memory/4652-4433-0x00007FF6C61C0000-0x00007FF6C65B2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5072	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1704	DZxIQpD.exe
3488	EeXNhec.exe
4228	gJAdzMf.exe
2832	WIfAqso.exe
3336	pqxfnls.exe
4104	omkQjzg.exe
1896	qEbejmH.exe
2572	tPwKjaU.exe
1168	XYUshSL.exe
4548	RTIdXiU.exe
3992	zdKZbZz.exe
1828	EpkAKSc.exe
548	xPSPvRP.exe
4652	HVRJiVI.exe
3676	qHXznBU.exe
4108	cihfezO.exe
1040	GrfyVzO.exe
3708	uHUskVs.exe
3572	jpUKmKs.exe
4828	deDvVlR.exe
3120	hJtBPud.exe
432	PBArdhO.exe
4996	KvBntOd.exe
2260	dblFJRj.exe
1192	KYoaaKg.exe
1352	xeKxCQQ.exe
2032	XwRaXSo.exe
2796	kMCRZWt.exe
3968	nNyUNDe.exe
4484	HwyJKVI.exe
2432	eyQLkAv.exe
3588	kcJDFjk.exe
648	isMsHwy.exe
3384	LwWRvNH.exe
2136	zoLPdNO.exe
2468	VhpruId.exe
2268	XYvtUdF.exe
2608	qXOTHfw.exe
5020	mPLjspy.exe
4664	fyODhSp.exe
1392	GXSbhXd.exe
3944	ssfYUtQ.exe
3092	JvGKHJO.exe
4024	DblWtrN.exe
4436	ydqPYBE.exe
4940	rANpVgC.exe
1316	GUPegoS.exe
4408	THpJjYi.exe
3156	TYHgOTc.exe
2624	ufvAVbq.exe
1544	Oyefriz.exe
4308	TIrPzsg.exe
2192	OZUNuWh.exe
2412	RzMpPFi.exe
1256	aEQEyRO.exe
2560	oMzOImj.exe
392	foBrlVK.exe
4656	uYpdvDM.exe
1480	lADjwNj.exe
3768	LlqyZDH.exe
4056	OrIvEWv.exe
2116	EDakvzB.exe
4624	ojorokN.exe
4716	iyCeBuL.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3812-0-0x00007FF79B1F0000-0x00007FF79B5E2000-memory.dmp	upx
behavioral2/files/0x000600000002326f-5.dat	upx
behavioral2/files/0x00070000000233e6-14.dat	upx
behavioral2/files/0x00080000000233e1-15.dat	upx
behavioral2/files/0x00070000000233e7-25.dat	upx
behavioral2/memory/1704-18-0x00007FF7A5AD0000-0x00007FF7A5EC2000-memory.dmp	upx
behavioral2/files/0x00070000000233e5-24.dat	upx
behavioral2/files/0x00070000000233e9-38.dat	upx
behavioral2/files/0x00070000000233fc-120.dat	upx
behavioral2/memory/1168-620-0x00007FF647C00000-0x00007FF647FF2000-memory.dmp	upx
behavioral2/memory/3676-626-0x00007FF7D72E0000-0x00007FF7D76D2000-memory.dmp	upx
behavioral2/memory/3708-1220-0x00007FF609770000-0x00007FF609B62000-memory.dmp	upx
behavioral2/memory/2832-1219-0x00007FF7F61C0000-0x00007FF7F65B2000-memory.dmp	upx
behavioral2/memory/2260-1203-0x00007FF6049D0000-0x00007FF604DC2000-memory.dmp	upx
behavioral2/memory/4996-1201-0x00007FF672F50000-0x00007FF673342000-memory.dmp	upx
behavioral2/memory/3488-1205-0x00007FF769420000-0x00007FF769812000-memory.dmp	upx
behavioral2/memory/432-1043-0x00007FF743460000-0x00007FF743852000-memory.dmp	upx
behavioral2/memory/3120-1041-0x00007FF755B10000-0x00007FF755F02000-memory.dmp	upx
behavioral2/memory/4828-872-0x00007FF794730000-0x00007FF794B22000-memory.dmp	upx
behavioral2/memory/3572-787-0x00007FF70AEE0000-0x00007FF70B2D2000-memory.dmp	upx
behavioral2/memory/1040-628-0x00007FF669690000-0x00007FF669A82000-memory.dmp	upx
behavioral2/memory/4108-627-0x00007FF797EA0000-0x00007FF798292000-memory.dmp	upx
behavioral2/memory/4652-625-0x00007FF6C61C0000-0x00007FF6C65B2000-memory.dmp	upx
behavioral2/memory/548-624-0x00007FF695AB0000-0x00007FF695EA2000-memory.dmp	upx
behavioral2/memory/1828-623-0x00007FF6E5D40000-0x00007FF6E6132000-memory.dmp	upx
behavioral2/memory/3992-622-0x00007FF772D70000-0x00007FF773162000-memory.dmp	upx
behavioral2/memory/4548-621-0x00007FF6340B0000-0x00007FF6344A2000-memory.dmp	upx
behavioral2/memory/2572-618-0x00007FF7A4940000-0x00007FF7A4D32000-memory.dmp	upx
behavioral2/memory/1896-587-0x00007FF6F0AD0000-0x00007FF6F0EC2000-memory.dmp	upx
behavioral2/memory/4104-460-0x00007FF6D8470000-0x00007FF6D8862000-memory.dmp	upx
behavioral2/memory/3336-369-0x00007FF61ADA0000-0x00007FF61B192000-memory.dmp	upx
behavioral2/memory/4228-365-0x00007FF66FE10000-0x00007FF670202000-memory.dmp	upx
behavioral2/files/0x00070000000233f8-203.dat	upx
behavioral2/files/0x000700000002340d-202.dat	upx
behavioral2/files/0x000700000002340c-191.dat	upx
behavioral2/files/0x00070000000233f6-189.dat	upx
behavioral2/files/0x000700000002340b-184.dat	upx
behavioral2/files/0x00070000000233f4-174.dat	upx
behavioral2/files/0x00070000000233f3-172.dat	upx
behavioral2/files/0x0007000000023408-170.dat	upx
behavioral2/files/0x00070000000233fe-167.dat	upx
behavioral2/files/0x0007000000023407-163.dat	upx
behavioral2/files/0x0007000000023406-157.dat	upx
behavioral2/files/0x00070000000233fb-150.dat	upx
behavioral2/files/0x0007000000023404-148.dat	upx
behavioral2/files/0x00070000000233f7-145.dat	upx
behavioral2/files/0x0007000000023403-181.dat	upx
behavioral2/files/0x0007000000023402-138.dat	upx
behavioral2/files/0x00070000000233f5-177.dat	upx
behavioral2/files/0x00070000000233f2-133.dat	upx
behavioral2/files/0x00070000000233f1-132.dat	upx
behavioral2/files/0x0007000000023400-131.dat	upx
behavioral2/files/0x0007000000023409-171.dat	upx
behavioral2/files/0x00070000000233ef-126.dat	upx
behavioral2/files/0x00070000000233ff-125.dat	upx
behavioral2/files/0x00070000000233ec-166.dat	upx
behavioral2/files/0x00070000000233ed-121.dat	upx
behavioral2/files/0x00070000000233fa-153.dat	upx
behavioral2/files/0x00070000000233f9-113.dat	upx
behavioral2/files/0x0007000000023401-136.dat	upx
behavioral2/files/0x00070000000233f0-96.dat	upx
behavioral2/files/0x00070000000233ea-93.dat	upx
behavioral2/files/0x00070000000233ee-83.dat	upx
behavioral2/files/0x00070000000233fd-124.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PpjHaDe.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\wIanUaG.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\hvyEDbI.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\CQhBXvP.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\Gejefzs.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\friFHlQ.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\XbskwBj.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\UanYPvn.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\nGgfdSp.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\fGXISah.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\rmtqdhO.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\PCBQMWA.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\uSiucCb.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\iDMPFyb.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\SBRFWzG.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\zBSIqwl.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\cgVKotA.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\HDSLJZg.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\kKpVaYV.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\YDWtdbY.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\rSFylVD.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\ZvMHrod.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\nqosGIx.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\RKZDdkW.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\cgEyDHq.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\JJFxFjt.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\HkdEsym.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\QlBGTfI.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\DcTbodC.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\cSlEZIV.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\rWdOjEO.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\pwwYSeL.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\ExosqQf.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\sQpGfCk.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\vslyXjW.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\QQupXHf.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\kcHmVKn.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\MNwhZhJ.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\cMNvMGv.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\aiZoFRF.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\ZTBiQYC.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\IfizBvb.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\ZwHqEYy.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\jPCyUwB.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\sNBiQWt.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\VfqBKzP.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\JFCQLsh.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\KrxEaLW.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\bCqEzmb.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\ugRtTcY.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\vcoxQlk.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\AKNpgoa.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\gcShSCc.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\pgxPfiH.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\csXVyXJ.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\dYymZrt.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\dQyVGeV.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\SfZLlxr.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\VvoPPkX.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\VeFGOIl.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\szDIsCe.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\fBOKkjC.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\mortHhZ.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
File created	C:\Windows\System\RYUIXAH.exe	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5072	powershell.exe
5072	powershell.exe
5072	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
Token: SeDebugPrivilege	5072	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 5072	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	82
PID 3812 wrote to memory of 5072	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	82
PID 3812 wrote to memory of 1704	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	83
PID 3812 wrote to memory of 1704	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	83
PID 3812 wrote to memory of 4228	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	84
PID 3812 wrote to memory of 4228	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	84
PID 3812 wrote to memory of 2832	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	85
PID 3812 wrote to memory of 2832	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	85
PID 3812 wrote to memory of 3488	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	86
PID 3812 wrote to memory of 3488	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	86
PID 3812 wrote to memory of 3336	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	87
PID 3812 wrote to memory of 3336	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	87
PID 3812 wrote to memory of 4104	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	88
PID 3812 wrote to memory of 4104	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	88
PID 3812 wrote to memory of 1896	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	89
PID 3812 wrote to memory of 1896	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	89
PID 3812 wrote to memory of 2572	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	90
PID 3812 wrote to memory of 2572	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	90
PID 3812 wrote to memory of 1168	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	91
PID 3812 wrote to memory of 1168	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	91
PID 3812 wrote to memory of 4548	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	92
PID 3812 wrote to memory of 4548	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	92
PID 3812 wrote to memory of 3992	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	93
PID 3812 wrote to memory of 3992	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	93
PID 3812 wrote to memory of 1828	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	94
PID 3812 wrote to memory of 1828	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	94
PID 3812 wrote to memory of 548	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	95
PID 3812 wrote to memory of 548	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	95
PID 3812 wrote to memory of 4652	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	96
PID 3812 wrote to memory of 4652	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	96
PID 3812 wrote to memory of 2796	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	97
PID 3812 wrote to memory of 2796	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	97
PID 3812 wrote to memory of 3968	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	98
PID 3812 wrote to memory of 3968	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	98
PID 3812 wrote to memory of 3676	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	99
PID 3812 wrote to memory of 3676	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	99
PID 3812 wrote to memory of 4108	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	100
PID 3812 wrote to memory of 4108	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	100
PID 3812 wrote to memory of 1040	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	101
PID 3812 wrote to memory of 1040	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	101
PID 3812 wrote to memory of 3708	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	102
PID 3812 wrote to memory of 3708	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	102
PID 3812 wrote to memory of 3572	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	103
PID 3812 wrote to memory of 3572	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	103
PID 3812 wrote to memory of 4828	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	104
PID 3812 wrote to memory of 4828	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	104
PID 3812 wrote to memory of 3120	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	105
PID 3812 wrote to memory of 3120	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	105
PID 3812 wrote to memory of 432	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	106
PID 3812 wrote to memory of 432	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	106
PID 3812 wrote to memory of 4996	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	107
PID 3812 wrote to memory of 4996	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	107
PID 3812 wrote to memory of 2260	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	108
PID 3812 wrote to memory of 2260	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	108
PID 3812 wrote to memory of 1192	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	109
PID 3812 wrote to memory of 1192	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	109
PID 3812 wrote to memory of 2136	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	110
PID 3812 wrote to memory of 2136	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	110
PID 3812 wrote to memory of 1352	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	111
PID 3812 wrote to memory of 1352	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	111
PID 3812 wrote to memory of 2032	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	112
PID 3812 wrote to memory of 2032	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	112
PID 3812 wrote to memory of 4484	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	113
PID 3812 wrote to memory of 4484	3812	cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\cffcc9b7963632edbaa56dadda560b10_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5072
- C:\Windows\System\DZxIQpD.exe
  C:\Windows\System\DZxIQpD.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\gJAdzMf.exe
  C:\Windows\System\gJAdzMf.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\WIfAqso.exe
  C:\Windows\System\WIfAqso.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\EeXNhec.exe
  C:\Windows\System\EeXNhec.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\pqxfnls.exe
  C:\Windows\System\pqxfnls.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\omkQjzg.exe
  C:\Windows\System\omkQjzg.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\qEbejmH.exe
  C:\Windows\System\qEbejmH.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\tPwKjaU.exe
  C:\Windows\System\tPwKjaU.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\XYUshSL.exe
  C:\Windows\System\XYUshSL.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\RTIdXiU.exe
  C:\Windows\System\RTIdXiU.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\zdKZbZz.exe
  C:\Windows\System\zdKZbZz.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\EpkAKSc.exe
  C:\Windows\System\EpkAKSc.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\xPSPvRP.exe
  C:\Windows\System\xPSPvRP.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\HVRJiVI.exe
  C:\Windows\System\HVRJiVI.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\kMCRZWt.exe
  C:\Windows\System\kMCRZWt.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\nNyUNDe.exe
  C:\Windows\System\nNyUNDe.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\qHXznBU.exe
  C:\Windows\System\qHXznBU.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\cihfezO.exe
  C:\Windows\System\cihfezO.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\GrfyVzO.exe
  C:\Windows\System\GrfyVzO.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\uHUskVs.exe
  C:\Windows\System\uHUskVs.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\jpUKmKs.exe
  C:\Windows\System\jpUKmKs.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\deDvVlR.exe
  C:\Windows\System\deDvVlR.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\hJtBPud.exe
  C:\Windows\System\hJtBPud.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\PBArdhO.exe
  C:\Windows\System\PBArdhO.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\KvBntOd.exe
  C:\Windows\System\KvBntOd.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\dblFJRj.exe
  C:\Windows\System\dblFJRj.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\KYoaaKg.exe
  C:\Windows\System\KYoaaKg.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\zoLPdNO.exe
  C:\Windows\System\zoLPdNO.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\xeKxCQQ.exe
  C:\Windows\System\xeKxCQQ.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\XwRaXSo.exe
  C:\Windows\System\XwRaXSo.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\HwyJKVI.exe
  C:\Windows\System\HwyJKVI.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\eyQLkAv.exe
  C:\Windows\System\eyQLkAv.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\qXOTHfw.exe
  C:\Windows\System\qXOTHfw.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\kcJDFjk.exe
  C:\Windows\System\kcJDFjk.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\JvGKHJO.exe
  C:\Windows\System\JvGKHJO.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\isMsHwy.exe
  C:\Windows\System\isMsHwy.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\LwWRvNH.exe
  C:\Windows\System\LwWRvNH.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\VhpruId.exe
  C:\Windows\System\VhpruId.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\XYvtUdF.exe
  C:\Windows\System\XYvtUdF.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\Oyefriz.exe
  C:\Windows\System\Oyefriz.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\mPLjspy.exe
  C:\Windows\System\mPLjspy.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\fyODhSp.exe
  C:\Windows\System\fyODhSp.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\GXSbhXd.exe
  C:\Windows\System\GXSbhXd.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\ssfYUtQ.exe
  C:\Windows\System\ssfYUtQ.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\DblWtrN.exe
  C:\Windows\System\DblWtrN.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\ydqPYBE.exe
  C:\Windows\System\ydqPYBE.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\rANpVgC.exe
  C:\Windows\System\rANpVgC.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\GUPegoS.exe
  C:\Windows\System\GUPegoS.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\THpJjYi.exe
  C:\Windows\System\THpJjYi.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\TYHgOTc.exe
  C:\Windows\System\TYHgOTc.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\ufvAVbq.exe
  C:\Windows\System\ufvAVbq.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\TIrPzsg.exe
  C:\Windows\System\TIrPzsg.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\OZUNuWh.exe
  C:\Windows\System\OZUNuWh.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\RzMpPFi.exe
  C:\Windows\System\RzMpPFi.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\aEQEyRO.exe
  C:\Windows\System\aEQEyRO.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\oMzOImj.exe
  C:\Windows\System\oMzOImj.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\yztPUIV.exe
  C:\Windows\System\yztPUIV.exe
  2⤵
  PID:4972
- C:\Windows\System\foBrlVK.exe
  C:\Windows\System\foBrlVK.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\uYpdvDM.exe
  C:\Windows\System\uYpdvDM.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\lADjwNj.exe
  C:\Windows\System\lADjwNj.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\LlqyZDH.exe
  C:\Windows\System\LlqyZDH.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\OrIvEWv.exe
  C:\Windows\System\OrIvEWv.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\EDakvzB.exe
  C:\Windows\System\EDakvzB.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\OxvXneS.exe
  C:\Windows\System\OxvXneS.exe
  2⤵
  PID:3024
- C:\Windows\System\dqWiEqU.exe
  C:\Windows\System\dqWiEqU.exe
  2⤵
  PID:2892
- C:\Windows\System\ojorokN.exe
  C:\Windows\System\ojorokN.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\iyCeBuL.exe
  C:\Windows\System\iyCeBuL.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\KjAiWMb.exe
  C:\Windows\System\KjAiWMb.exe
  2⤵
  PID:4788
- C:\Windows\System\dVJCbPT.exe
  C:\Windows\System\dVJCbPT.exe
  2⤵
  PID:4572
- C:\Windows\System\IdYIukP.exe
  C:\Windows\System\IdYIukP.exe
  2⤵
  PID:1652
- C:\Windows\System\pJTusQP.exe
  C:\Windows\System\pJTusQP.exe
  2⤵
  PID:2704
- C:\Windows\System\SXtvEOE.exe
  C:\Windows\System\SXtvEOE.exe
  2⤵
  PID:4376
- C:\Windows\System\eCNBQiV.exe
  C:\Windows\System\eCNBQiV.exe
  2⤵
  PID:4440
- C:\Windows\System\CHAqlin.exe
  C:\Windows\System\CHAqlin.exe
  2⤵
  PID:4792
- C:\Windows\System\thkVgSR.exe
  C:\Windows\System\thkVgSR.exe
  2⤵
  PID:2792
- C:\Windows\System\HrjJXOd.exe
  C:\Windows\System\HrjJXOd.exe
  2⤵
  PID:3864
- C:\Windows\System\KbjqYtD.exe
  C:\Windows\System\KbjqYtD.exe
  2⤵
  PID:2052
- C:\Windows\System\WQdsVjr.exe
  C:\Windows\System\WQdsVjr.exe
  2⤵
  PID:4900
- C:\Windows\System\FwQmldM.exe
  C:\Windows\System\FwQmldM.exe
  2⤵
  PID:1976
- C:\Windows\System\ClXiOVe.exe
  C:\Windows\System\ClXiOVe.exe
  2⤵
  PID:1552
- C:\Windows\System\XvvsSlY.exe
  C:\Windows\System\XvvsSlY.exe
  2⤵
  PID:1028
- C:\Windows\System\VphTOzA.exe
  C:\Windows\System\VphTOzA.exe
  2⤵
  PID:3164
- C:\Windows\System\NpIAZbH.exe
  C:\Windows\System\NpIAZbH.exe
  2⤵
  PID:1920
- C:\Windows\System\LJJXCuw.exe
  C:\Windows\System\LJJXCuw.exe
  2⤵
  PID:3136
- C:\Windows\System\PouFgKq.exe
  C:\Windows\System\PouFgKq.exe
  2⤵
  PID:3088
- C:\Windows\System\TgOWZMk.exe
  C:\Windows\System\TgOWZMk.exe
  2⤵
  PID:3536
- C:\Windows\System\ueNdzWJ.exe
  C:\Windows\System\ueNdzWJ.exe
  2⤵
  PID:692
- C:\Windows\System\iXEaxGS.exe
  C:\Windows\System\iXEaxGS.exe
  2⤵
  PID:4444
- C:\Windows\System\XcWBTtX.exe
  C:\Windows\System\XcWBTtX.exe
  2⤵
  PID:5004
- C:\Windows\System\NmzVWaS.exe
  C:\Windows\System\NmzVWaS.exe
  2⤵
  PID:1072
- C:\Windows\System\UOeZfcL.exe
  C:\Windows\System\UOeZfcL.exe
  2⤵
  PID:2940
- C:\Windows\System\IaljZYL.exe
  C:\Windows\System\IaljZYL.exe
  2⤵
  PID:2628
- C:\Windows\System\lDOmAvM.exe
  C:\Windows\System\lDOmAvM.exe
  2⤵
  PID:1504
- C:\Windows\System\xPgEJbT.exe
  C:\Windows\System\xPgEJbT.exe
  2⤵
  PID:2436
- C:\Windows\System\pjIJQJN.exe
  C:\Windows\System\pjIJQJN.exe
  2⤵
  PID:5128
- C:\Windows\System\qXPmHNm.exe
  C:\Windows\System\qXPmHNm.exe
  2⤵
  PID:5148
- C:\Windows\System\hDTSHyC.exe
  C:\Windows\System\hDTSHyC.exe
  2⤵
  PID:5168
- C:\Windows\System\JPaQVoQ.exe
  C:\Windows\System\JPaQVoQ.exe
  2⤵
  PID:5192
- C:\Windows\System\nmCuhys.exe
  C:\Windows\System\nmCuhys.exe
  2⤵
  PID:5212
- C:\Windows\System\KlVGbIm.exe
  C:\Windows\System\KlVGbIm.exe
  2⤵
  PID:5252
- C:\Windows\System\zpRuQOl.exe
  C:\Windows\System\zpRuQOl.exe
  2⤵
  PID:5276
- C:\Windows\System\bwVnmio.exe
  C:\Windows\System\bwVnmio.exe
  2⤵
  PID:5292
- C:\Windows\System\BfhXBOX.exe
  C:\Windows\System\BfhXBOX.exe
  2⤵
  PID:5308
- C:\Windows\System\pfUCAAV.exe
  C:\Windows\System\pfUCAAV.exe
  2⤵
  PID:5332
- C:\Windows\System\vXKqnJj.exe
  C:\Windows\System\vXKqnJj.exe
  2⤵
  PID:5348
- C:\Windows\System\kBGMjOM.exe
  C:\Windows\System\kBGMjOM.exe
  2⤵
  PID:5376
- C:\Windows\System\hPePjsD.exe
  C:\Windows\System\hPePjsD.exe
  2⤵
  PID:5392
- C:\Windows\System\SAPrVwD.exe
  C:\Windows\System\SAPrVwD.exe
  2⤵
  PID:5420
- C:\Windows\System\DLXHEdv.exe
  C:\Windows\System\DLXHEdv.exe
  2⤵
  PID:5460
- C:\Windows\System\MPmYrvt.exe
  C:\Windows\System\MPmYrvt.exe
  2⤵
  PID:5480
- C:\Windows\System\NIsWsAO.exe
  C:\Windows\System\NIsWsAO.exe
  2⤵
  PID:5512
- C:\Windows\System\gomfOKy.exe
  C:\Windows\System\gomfOKy.exe
  2⤵
  PID:5536
- C:\Windows\System\xLkrQQH.exe
  C:\Windows\System\xLkrQQH.exe
  2⤵
  PID:5552
- C:\Windows\System\awjmVVI.exe
  C:\Windows\System\awjmVVI.exe
  2⤵
  PID:5576
- C:\Windows\System\EutkIFO.exe
  C:\Windows\System\EutkIFO.exe
  2⤵
  PID:5592
- C:\Windows\System\evcPTbJ.exe
  C:\Windows\System\evcPTbJ.exe
  2⤵
  PID:5616
- C:\Windows\System\HrYfQGC.exe
  C:\Windows\System\HrYfQGC.exe
  2⤵
  PID:5632
- C:\Windows\System\gpbYKlp.exe
  C:\Windows\System\gpbYKlp.exe
  2⤵
  PID:5652
- C:\Windows\System\HXGCOFZ.exe
  C:\Windows\System\HXGCOFZ.exe
  2⤵
  PID:5672
- C:\Windows\System\qrsPXUg.exe
  C:\Windows\System\qrsPXUg.exe
  2⤵
  PID:5688
- C:\Windows\System\PncPCSy.exe
  C:\Windows\System\PncPCSy.exe
  2⤵
  PID:5712
- C:\Windows\System\HmJrfhp.exe
  C:\Windows\System\HmJrfhp.exe
  2⤵
  PID:5736
- C:\Windows\System\wKGrZqC.exe
  C:\Windows\System\wKGrZqC.exe
  2⤵
  PID:5756
- C:\Windows\System\eIPKhfD.exe
  C:\Windows\System\eIPKhfD.exe
  2⤵
  PID:5772
- C:\Windows\System\ZnahXVB.exe
  C:\Windows\System\ZnahXVB.exe
  2⤵
  PID:5800
- C:\Windows\System\jNBorGQ.exe
  C:\Windows\System\jNBorGQ.exe
  2⤵
  PID:5816
- C:\Windows\System\barIswU.exe
  C:\Windows\System\barIswU.exe
  2⤵
  PID:5840
- C:\Windows\System\CZNhrzM.exe
  C:\Windows\System\CZNhrzM.exe
  2⤵
  PID:5856
- C:\Windows\System\iTSxqqW.exe
  C:\Windows\System\iTSxqqW.exe
  2⤵
  PID:5872
- C:\Windows\System\YzeBIYi.exe
  C:\Windows\System\YzeBIYi.exe
  2⤵
  PID:5892
- C:\Windows\System\ejHXLQD.exe
  C:\Windows\System\ejHXLQD.exe
  2⤵
  PID:5912
- C:\Windows\System\qVsQNQz.exe
  C:\Windows\System\qVsQNQz.exe
  2⤵
  PID:5944
- C:\Windows\System\hlqbNUp.exe
  C:\Windows\System\hlqbNUp.exe
  2⤵
  PID:5968
- C:\Windows\System\rRwZAbX.exe
  C:\Windows\System\rRwZAbX.exe
  2⤵
  PID:5992
- C:\Windows\System\WaLKWUd.exe
  C:\Windows\System\WaLKWUd.exe
  2⤵
  PID:6012
- C:\Windows\System\UanYPvn.exe
  C:\Windows\System\UanYPvn.exe
  2⤵
  PID:6032
- C:\Windows\System\PgSLLJg.exe
  C:\Windows\System\PgSLLJg.exe
  2⤵
  PID:6052
- C:\Windows\System\UpzbpBl.exe
  C:\Windows\System\UpzbpBl.exe
  2⤵
  PID:6084
- C:\Windows\System\ZYLRzwX.exe
  C:\Windows\System\ZYLRzwX.exe
  2⤵
  PID:6100
- C:\Windows\System\JSNmwBD.exe
  C:\Windows\System\JSNmwBD.exe
  2⤵
  PID:6132
- C:\Windows\System\dUNZzYK.exe
  C:\Windows\System\dUNZzYK.exe
  2⤵
  PID:1772
- C:\Windows\System\HkLTccm.exe
  C:\Windows\System\HkLTccm.exe
  2⤵
  PID:4252
- C:\Windows\System\jUXLGaI.exe
  C:\Windows\System\jUXLGaI.exe
  2⤵
  PID:1288
- C:\Windows\System\dQFvxvF.exe
  C:\Windows\System\dQFvxvF.exe
  2⤵
  PID:3392
- C:\Windows\System\ZDWSSaa.exe
  C:\Windows\System\ZDWSSaa.exe
  2⤵
  PID:2056
- C:\Windows\System\TCeTYLN.exe
  C:\Windows\System\TCeTYLN.exe
  2⤵
  PID:2396
- C:\Windows\System\mBqeMsd.exe
  C:\Windows\System\mBqeMsd.exe
  2⤵
  PID:1096
- C:\Windows\System\wozrcOu.exe
  C:\Windows\System\wozrcOu.exe
  2⤵
  PID:1460
- C:\Windows\System\RRyXAnv.exe
  C:\Windows\System\RRyXAnv.exe
  2⤵
  PID:940
- C:\Windows\System\XqQCmkT.exe
  C:\Windows\System\XqQCmkT.exe
  2⤵
  PID:1172
- C:\Windows\System\iDRubFj.exe
  C:\Windows\System\iDRubFj.exe
  2⤵
  PID:5176
- C:\Windows\System\qzewbmJ.exe
  C:\Windows\System\qzewbmJ.exe
  2⤵
  PID:5264
- C:\Windows\System\GSPLZOS.exe
  C:\Windows\System\GSPLZOS.exe
  2⤵
  PID:5364
- C:\Windows\System\avBQOjh.exe
  C:\Windows\System\avBQOjh.exe
  2⤵
  PID:2596
- C:\Windows\System\XkBDqzW.exe
  C:\Windows\System\XkBDqzW.exe
  2⤵
  PID:2280
- C:\Windows\System\FRvhqYK.exe
  C:\Windows\System\FRvhqYK.exe
  2⤵
  PID:2188
- C:\Windows\System\ZenWCPr.exe
  C:\Windows\System\ZenWCPr.exe
  2⤵
  PID:1796
- C:\Windows\System\hvHIAuv.exe
  C:\Windows\System\hvHIAuv.exe
  2⤵
  PID:3264
- C:\Windows\System\BqNWQjZ.exe
  C:\Windows\System\BqNWQjZ.exe
  2⤵
  PID:5664
- C:\Windows\System\GqQHTyg.exe
  C:\Windows\System\GqQHTyg.exe
  2⤵
  PID:5708
- C:\Windows\System\QQDBSHt.exe
  C:\Windows\System\QQDBSHt.exe
  2⤵
  PID:6148
- C:\Windows\System\fPlDdvj.exe
  C:\Windows\System\fPlDdvj.exe
  2⤵
  PID:6168
- C:\Windows\System\hwMdXeh.exe
  C:\Windows\System\hwMdXeh.exe
  2⤵
  PID:6188
- C:\Windows\System\EXpdwVX.exe
  C:\Windows\System\EXpdwVX.exe
  2⤵
  PID:6208
- C:\Windows\System\DRUTcgb.exe
  C:\Windows\System\DRUTcgb.exe
  2⤵
  PID:6232
- C:\Windows\System\roNowSJ.exe
  C:\Windows\System\roNowSJ.exe
  2⤵
  PID:6256
- C:\Windows\System\SKfGeqk.exe
  C:\Windows\System\SKfGeqk.exe
  2⤵
  PID:6276
- C:\Windows\System\VvzdfzG.exe
  C:\Windows\System\VvzdfzG.exe
  2⤵
  PID:6296
- C:\Windows\System\jLwjSeo.exe
  C:\Windows\System\jLwjSeo.exe
  2⤵
  PID:6316
- C:\Windows\System\OzbwxBG.exe
  C:\Windows\System\OzbwxBG.exe
  2⤵
  PID:6336
- C:\Windows\System\kkMiIug.exe
  C:\Windows\System\kkMiIug.exe
  2⤵
  PID:6352
- C:\Windows\System\PtrOTpE.exe
  C:\Windows\System\PtrOTpE.exe
  2⤵
  PID:6376
- C:\Windows\System\QSJvHfI.exe
  C:\Windows\System\QSJvHfI.exe
  2⤵
  PID:6404
- C:\Windows\System\UAPVDir.exe
  C:\Windows\System\UAPVDir.exe
  2⤵
  PID:6420
- C:\Windows\System\JdKtImq.exe
  C:\Windows\System\JdKtImq.exe
  2⤵
  PID:6440
- C:\Windows\System\ktHUykV.exe
  C:\Windows\System\ktHUykV.exe
  2⤵
  PID:6456
- C:\Windows\System\xPMmOri.exe
  C:\Windows\System\xPMmOri.exe
  2⤵
  PID:6476
- C:\Windows\System\fDhLDPD.exe
  C:\Windows\System\fDhLDPD.exe
  2⤵
  PID:6492
- C:\Windows\System\aXIWWPp.exe
  C:\Windows\System\aXIWWPp.exe
  2⤵
  PID:6512
- C:\Windows\System\QuxTMok.exe
  C:\Windows\System\QuxTMok.exe
  2⤵
  PID:6532
- C:\Windows\System\YfDRKfv.exe
  C:\Windows\System\YfDRKfv.exe
  2⤵
  PID:6552
- C:\Windows\System\aLZVpuC.exe
  C:\Windows\System\aLZVpuC.exe
  2⤵
  PID:6580
- C:\Windows\System\uKfRXDB.exe
  C:\Windows\System\uKfRXDB.exe
  2⤵
  PID:6600
- C:\Windows\System\YgyPJvR.exe
  C:\Windows\System\YgyPJvR.exe
  2⤵
  PID:6636
- C:\Windows\System\FjuMxac.exe
  C:\Windows\System\FjuMxac.exe
  2⤵
  PID:6656
- C:\Windows\System\UWDmsiE.exe
  C:\Windows\System\UWDmsiE.exe
  2⤵
  PID:6676
- C:\Windows\System\HGgdWIt.exe
  C:\Windows\System\HGgdWIt.exe
  2⤵
  PID:6700
- C:\Windows\System\dRLeCvs.exe
  C:\Windows\System\dRLeCvs.exe
  2⤵
  PID:6716
- C:\Windows\System\UXMHoSy.exe
  C:\Windows\System\UXMHoSy.exe
  2⤵
  PID:6740
- C:\Windows\System\eitqOwr.exe
  C:\Windows\System\eitqOwr.exe
  2⤵
  PID:6768
- C:\Windows\System\pxgiprs.exe
  C:\Windows\System\pxgiprs.exe
  2⤵
  PID:6788
- C:\Windows\System\yvkOlwb.exe
  C:\Windows\System\yvkOlwb.exe
  2⤵
  PID:6820
- C:\Windows\System\KXSxQFn.exe
  C:\Windows\System\KXSxQFn.exe
  2⤵
  PID:6840
- C:\Windows\System\cpKSfUr.exe
  C:\Windows\System\cpKSfUr.exe
  2⤵
  PID:6856
- C:\Windows\System\mqusYTW.exe
  C:\Windows\System\mqusYTW.exe
  2⤵
  PID:6880
- C:\Windows\System\RfAAQHB.exe
  C:\Windows\System\RfAAQHB.exe
  2⤵
  PID:6896
- C:\Windows\System\VgEXeWf.exe
  C:\Windows\System\VgEXeWf.exe
  2⤵
  PID:6920
- C:\Windows\System\kcvfoRV.exe
  C:\Windows\System\kcvfoRV.exe
  2⤵
  PID:6948
- C:\Windows\System\yjzfojY.exe
  C:\Windows\System\yjzfojY.exe
  2⤵
  PID:6972
- C:\Windows\System\muvgFoC.exe
  C:\Windows\System\muvgFoC.exe
  2⤵
  PID:6996
- C:\Windows\System\yuurnlA.exe
  C:\Windows\System\yuurnlA.exe
  2⤵
  PID:7016
- C:\Windows\System\OCTPTFv.exe
  C:\Windows\System\OCTPTFv.exe
  2⤵
  PID:7032
- C:\Windows\System\pJjIxCg.exe
  C:\Windows\System\pJjIxCg.exe
  2⤵
  PID:7052
- C:\Windows\System\Vojwfxv.exe
  C:\Windows\System\Vojwfxv.exe
  2⤵
  PID:7068
- C:\Windows\System\EIsigcN.exe
  C:\Windows\System\EIsigcN.exe
  2⤵
  PID:7092
- C:\Windows\System\vkuPFec.exe
  C:\Windows\System\vkuPFec.exe
  2⤵
  PID:7108
- C:\Windows\System\NpVSwxt.exe
  C:\Windows\System\NpVSwxt.exe
  2⤵
  PID:7128
- C:\Windows\System\FYlHvBN.exe
  C:\Windows\System\FYlHvBN.exe
  2⤵
  PID:7152
- C:\Windows\System\njZeumG.exe
  C:\Windows\System\njZeumG.exe
  2⤵
  PID:1016
- C:\Windows\System\WixyenG.exe
  C:\Windows\System\WixyenG.exe
  2⤵
  PID:1364
- C:\Windows\System\SjvidYS.exe
  C:\Windows\System\SjvidYS.exe
  2⤵
  PID:116
- C:\Windows\System\KfcHjEp.exe
  C:\Windows\System\KfcHjEp.exe
  2⤵
  PID:5204
- C:\Windows\System\ScTdOXb.exe
  C:\Windows\System\ScTdOXb.exe
  2⤵
  PID:5008
- C:\Windows\System\eZmowXR.exe
  C:\Windows\System\eZmowXR.exe
  2⤵
  PID:4092
- C:\Windows\System\AAZvYKX.exe
  C:\Windows\System\AAZvYKX.exe
  2⤵
  PID:5388
- C:\Windows\System\bRtyozA.exe
  C:\Windows\System\bRtyozA.exe
  2⤵
  PID:6048
- C:\Windows\System\MsrnItD.exe
  C:\Windows\System\MsrnItD.exe
  2⤵
  PID:3160
- C:\Windows\System\vKKLcMc.exe
  C:\Windows\System\vKKLcMc.exe
  2⤵
  PID:5244
- C:\Windows\System\CHedkKo.exe
  C:\Windows\System\CHedkKo.exe
  2⤵
  PID:5324
- C:\Windows\System\QbxDgwa.exe
  C:\Windows\System\QbxDgwa.exe
  2⤵
  PID:5432
- C:\Windows\System\irqCOHC.exe
  C:\Windows\System\irqCOHC.exe
  2⤵
  PID:5544
- C:\Windows\System\fHlVYzV.exe
  C:\Windows\System\fHlVYzV.exe
  2⤵
  PID:5528
- C:\Windows\System\BBOAoEO.exe
  C:\Windows\System\BBOAoEO.exe
  2⤵
  PID:5624
- C:\Windows\System\DDikLbv.exe
  C:\Windows\System\DDikLbv.exe
  2⤵
  PID:5764
- C:\Windows\System\lNXKraC.exe
  C:\Windows\System\lNXKraC.exe
  2⤵
  PID:5796
- C:\Windows\System\OXVOuFW.exe
  C:\Windows\System\OXVOuFW.exe
  2⤵
  PID:5836
- C:\Windows\System\wknAjLe.exe
  C:\Windows\System\wknAjLe.exe
  2⤵
  PID:5884
- C:\Windows\System\whlxltC.exe
  C:\Windows\System\whlxltC.exe
  2⤵
  PID:5956
- C:\Windows\System\YKeTSuF.exe
  C:\Windows\System\YKeTSuF.exe
  2⤵
  PID:6076
- C:\Windows\System\ePILZoI.exe
  C:\Windows\System\ePILZoI.exe
  2⤵
  PID:6108
- C:\Windows\System\RVgCNPS.exe
  C:\Windows\System\RVgCNPS.exe
  2⤵
  PID:4500
- C:\Windows\System\OkwiYGD.exe
  C:\Windows\System\OkwiYGD.exe
  2⤵
  PID:2044
- C:\Windows\System\CTjWHSw.exe
  C:\Windows\System\CTjWHSw.exe
  2⤵
  PID:1536
- C:\Windows\System\tmWjMpX.exe
  C:\Windows\System\tmWjMpX.exe
  2⤵
  PID:1620
- C:\Windows\System\pMrxMcx.exe
  C:\Windows\System\pMrxMcx.exe
  2⤵
  PID:5724
- C:\Windows\System\TFzHWZz.exe
  C:\Windows\System\TFzHWZz.exe
  2⤵
  PID:6284
- C:\Windows\System\dKqmvRB.exe
  C:\Windows\System\dKqmvRB.exe
  2⤵
  PID:6464
- C:\Windows\System\fmnwYUP.exe
  C:\Windows\System\fmnwYUP.exe
  2⤵
  PID:6724
- C:\Windows\System\TVXoUuR.exe
  C:\Windows\System\TVXoUuR.exe
  2⤵
  PID:6328
- C:\Windows\System\URWzBis.exe
  C:\Windows\System\URWzBis.exe
  2⤵
  PID:6416
- C:\Windows\System\cCOqhjC.exe
  C:\Windows\System\cCOqhjC.exe
  2⤵
  PID:6472
- C:\Windows\System\YLVPsRy.exe
  C:\Windows\System\YLVPsRy.exe
  2⤵
  PID:6520
- C:\Windows\System\BWJMDuT.exe
  C:\Windows\System\BWJMDuT.exe
  2⤵
  PID:6652
- C:\Windows\System\gMOUSrw.exe
  C:\Windows\System\gMOUSrw.exe
  2⤵
  PID:6708
- C:\Windows\System\LSuyWns.exe
  C:\Windows\System\LSuyWns.exe
  2⤵
  PID:6832
- C:\Windows\System\CCTPFyM.exe
  C:\Windows\System\CCTPFyM.exe
  2⤵
  PID:6892
- C:\Windows\System\sVhFQHc.exe
  C:\Windows\System\sVhFQHc.exe
  2⤵
  PID:7028
- C:\Windows\System\bvGmVWi.exe
  C:\Windows\System\bvGmVWi.exe
  2⤵
  PID:7188
- C:\Windows\System\XrMXkgI.exe
  C:\Windows\System\XrMXkgI.exe
  2⤵
  PID:7204
- C:\Windows\System\uwWUAzW.exe
  C:\Windows\System\uwWUAzW.exe
  2⤵
  PID:7228
- C:\Windows\System\HhcqNbn.exe
  C:\Windows\System\HhcqNbn.exe
  2⤵
  PID:7244
- C:\Windows\System\URysYtX.exe
  C:\Windows\System\URysYtX.exe
  2⤵
  PID:7264
- C:\Windows\System\IlUocof.exe
  C:\Windows\System\IlUocof.exe
  2⤵
  PID:7284
- C:\Windows\System\IQJReJI.exe
  C:\Windows\System\IQJReJI.exe
  2⤵
  PID:7308
- C:\Windows\System\psNtgNi.exe
  C:\Windows\System\psNtgNi.exe
  2⤵
  PID:7324
- C:\Windows\System\TDtGCdc.exe
  C:\Windows\System\TDtGCdc.exe
  2⤵
  PID:7348
- C:\Windows\System\ZgGyndo.exe
  C:\Windows\System\ZgGyndo.exe
  2⤵
  PID:7364
- C:\Windows\System\ZVfOswQ.exe
  C:\Windows\System\ZVfOswQ.exe
  2⤵
  PID:7384
- C:\Windows\System\rCeEjec.exe
  C:\Windows\System\rCeEjec.exe
  2⤵
  PID:7400
- C:\Windows\System\PRMgHvp.exe
  C:\Windows\System\PRMgHvp.exe
  2⤵
  PID:7420
- C:\Windows\System\rQVbyXN.exe
  C:\Windows\System\rQVbyXN.exe
  2⤵
  PID:7436
- C:\Windows\System\gsOqIYt.exe
  C:\Windows\System\gsOqIYt.exe
  2⤵
  PID:7456
- C:\Windows\System\cMeKanV.exe
  C:\Windows\System\cMeKanV.exe
  2⤵
  PID:7472
- C:\Windows\System\NxpbqtR.exe
  C:\Windows\System\NxpbqtR.exe
  2⤵
  PID:7496
- C:\Windows\System\oIqboUz.exe
  C:\Windows\System\oIqboUz.exe
  2⤵
  PID:7516
- C:\Windows\System\RIcVodU.exe
  C:\Windows\System\RIcVodU.exe
  2⤵
  PID:7536
- C:\Windows\System\RjxiKAN.exe
  C:\Windows\System\RjxiKAN.exe
  2⤵
  PID:7552
- C:\Windows\System\UDMciMg.exe
  C:\Windows\System\UDMciMg.exe
  2⤵
  PID:7576
- C:\Windows\System\LmuToQs.exe
  C:\Windows\System\LmuToQs.exe
  2⤵
  PID:7592
- C:\Windows\System\WcEJhjj.exe
  C:\Windows\System\WcEJhjj.exe
  2⤵
  PID:7616
- C:\Windows\System\tdKinip.exe
  C:\Windows\System\tdKinip.exe
  2⤵
  PID:7640
- C:\Windows\System\RTTyHwT.exe
  C:\Windows\System\RTTyHwT.exe
  2⤵
  PID:7660
- C:\Windows\System\fKYeLDH.exe
  C:\Windows\System\fKYeLDH.exe
  2⤵
  PID:7684
- C:\Windows\System\hPZEVkP.exe
  C:\Windows\System\hPZEVkP.exe
  2⤵
  PID:7704
- C:\Windows\System\AwsVdxe.exe
  C:\Windows\System\AwsVdxe.exe
  2⤵
  PID:7724
- C:\Windows\System\MOctrpO.exe
  C:\Windows\System\MOctrpO.exe
  2⤵
  PID:7744
- C:\Windows\System\pZJhEIU.exe
  C:\Windows\System\pZJhEIU.exe
  2⤵
  PID:7768
- C:\Windows\System\YrgmWIo.exe
  C:\Windows\System\YrgmWIo.exe
  2⤵
  PID:7788
- C:\Windows\System\VhIuqVM.exe
  C:\Windows\System\VhIuqVM.exe
  2⤵
  PID:7808
- C:\Windows\System\EdiCAkr.exe
  C:\Windows\System\EdiCAkr.exe
  2⤵
  PID:8108
- C:\Windows\System\Nzvscfu.exe
  C:\Windows\System\Nzvscfu.exe
  2⤵
  PID:8124
- C:\Windows\System\FfUQJBj.exe
  C:\Windows\System\FfUQJBj.exe
  2⤵
  PID:8148
- C:\Windows\System\KUFSZBl.exe
  C:\Windows\System\KUFSZBl.exe
  2⤵
  PID:8164
- C:\Windows\System\FqaDWFY.exe
  C:\Windows\System\FqaDWFY.exe
  2⤵
  PID:8184
- C:\Windows\System\synYNPQ.exe
  C:\Windows\System\synYNPQ.exe
  2⤵
  PID:1112
- C:\Windows\System\UDXbAWs.exe
  C:\Windows\System\UDXbAWs.exe
  2⤵
  PID:7044
- C:\Windows\System\iFOPcWo.exe
  C:\Windows\System\iFOPcWo.exe
  2⤵
  PID:4200
- C:\Windows\System\UuywNAA.exe
  C:\Windows\System\UuywNAA.exe
  2⤵
  PID:1360
- C:\Windows\System\NuHIIsR.exe
  C:\Windows\System\NuHIIsR.exe
  2⤵
  PID:8200
- C:\Windows\System\CkzEznN.exe
  C:\Windows\System\CkzEznN.exe
  2⤵
  PID:8224
- C:\Windows\System\ISgRlvS.exe
  C:\Windows\System\ISgRlvS.exe
  2⤵
  PID:8240
- C:\Windows\System\TjkKvyC.exe
  C:\Windows\System\TjkKvyC.exe
  2⤵
  PID:8256
- C:\Windows\System\CidzXnO.exe
  C:\Windows\System\CidzXnO.exe
  2⤵
  PID:8280
- C:\Windows\System\DnqrsAY.exe
  C:\Windows\System\DnqrsAY.exe
  2⤵
  PID:8296
- C:\Windows\System\TolrYzh.exe
  C:\Windows\System\TolrYzh.exe
  2⤵
  PID:8312
- C:\Windows\System\nEuqwFn.exe
  C:\Windows\System\nEuqwFn.exe
  2⤵
  PID:8332
- C:\Windows\System\swIZHAd.exe
  C:\Windows\System\swIZHAd.exe
  2⤵
  PID:8352
- C:\Windows\System\IIiFnBB.exe
  C:\Windows\System\IIiFnBB.exe
  2⤵
  PID:8368
- C:\Windows\System\qmNKeOy.exe
  C:\Windows\System\qmNKeOy.exe
  2⤵
  PID:8396
- C:\Windows\System\xiexlfn.exe
  C:\Windows\System\xiexlfn.exe
  2⤵
  PID:8416
- C:\Windows\System\rZwxnrF.exe
  C:\Windows\System\rZwxnrF.exe
  2⤵
  PID:8452
- C:\Windows\System\hcXhxcl.exe
  C:\Windows\System\hcXhxcl.exe
  2⤵
  PID:8472
- C:\Windows\System\lZZBFwp.exe
  C:\Windows\System\lZZBFwp.exe
  2⤵
  PID:8496
- C:\Windows\System\QHymzRn.exe
  C:\Windows\System\QHymzRn.exe
  2⤵
  PID:8516
- C:\Windows\System\RqJPIiQ.exe
  C:\Windows\System\RqJPIiQ.exe
  2⤵
  PID:8532
- C:\Windows\System\JWefLzs.exe
  C:\Windows\System\JWefLzs.exe
  2⤵
  PID:8552
- C:\Windows\System\ZgMpehm.exe
  C:\Windows\System\ZgMpehm.exe
  2⤵
  PID:8576
- C:\Windows\System\HUGzMkK.exe
  C:\Windows\System\HUGzMkK.exe
  2⤵
  PID:8600
- C:\Windows\System\piwOIko.exe
  C:\Windows\System\piwOIko.exe
  2⤵
  PID:8628
- C:\Windows\System\VdVmCsk.exe
  C:\Windows\System\VdVmCsk.exe
  2⤵
  PID:8644
- C:\Windows\System\UICrahw.exe
  C:\Windows\System\UICrahw.exe
  2⤵
  PID:8668
- C:\Windows\System\iQwUwFO.exe
  C:\Windows\System\iQwUwFO.exe
  2⤵
  PID:8692
- C:\Windows\System\LTmKUpW.exe
  C:\Windows\System\LTmKUpW.exe
  2⤵
  PID:8708
- C:\Windows\System\IxbhWgt.exe
  C:\Windows\System\IxbhWgt.exe
  2⤵
  PID:8732
- C:\Windows\System\btlnLKU.exe
  C:\Windows\System\btlnLKU.exe
  2⤵
  PID:8752
- C:\Windows\System\hOxaKqo.exe
  C:\Windows\System\hOxaKqo.exe
  2⤵
  PID:8772
- C:\Windows\System\ERawmSH.exe
  C:\Windows\System\ERawmSH.exe
  2⤵
  PID:8792
- C:\Windows\System\hqFlaLO.exe
  C:\Windows\System\hqFlaLO.exe
  2⤵
  PID:8832
- C:\Windows\System\oYVIbxR.exe
  C:\Windows\System\oYVIbxR.exe
  2⤵
  PID:8848
- C:\Windows\System\RpcVpCK.exe
  C:\Windows\System\RpcVpCK.exe
  2⤵
  PID:8868
- C:\Windows\System\GBlouTs.exe
  C:\Windows\System\GBlouTs.exe
  2⤵
  PID:8884
- C:\Windows\System\jzeaTdo.exe
  C:\Windows\System\jzeaTdo.exe
  2⤵
  PID:8980
- C:\Windows\System\ptgzRMf.exe
  C:\Windows\System\ptgzRMf.exe
  2⤵
  PID:9004
- C:\Windows\System\sfHqoyi.exe
  C:\Windows\System\sfHqoyi.exe
  2⤵
  PID:9024
- C:\Windows\System\tjXawdq.exe
  C:\Windows\System\tjXawdq.exe
  2⤵
  PID:9044
- C:\Windows\System\CcsSVdy.exe
  C:\Windows\System\CcsSVdy.exe
  2⤵
  PID:9068
- C:\Windows\System\xNpSdGn.exe
  C:\Windows\System\xNpSdGn.exe
  2⤵
  PID:9084
- C:\Windows\System\tOgFiWz.exe
  C:\Windows\System\tOgFiWz.exe
  2⤵
  PID:9108
- C:\Windows\System\dqeVNlP.exe
  C:\Windows\System\dqeVNlP.exe
  2⤵
  PID:9132
- C:\Windows\System\tpszcSh.exe
  C:\Windows\System\tpszcSh.exe
  2⤵
  PID:9148
- C:\Windows\System\qwhHmWB.exe
  C:\Windows\System\qwhHmWB.exe
  2⤵
  PID:9168
- C:\Windows\System\ySZYpFc.exe
  C:\Windows\System\ySZYpFc.exe
  2⤵
  PID:9188
- C:\Windows\System\jtJjrAO.exe
  C:\Windows\System\jtJjrAO.exe
  2⤵
  PID:9212
- C:\Windows\System\rYlXvKP.exe
  C:\Windows\System\rYlXvKP.exe
  2⤵
  PID:7764
- C:\Windows\System\shjoaxF.exe
  C:\Windows\System\shjoaxF.exe
  2⤵
  PID:6156
- C:\Windows\System\iQWwCmC.exe
  C:\Windows\System\iQWwCmC.exe
  2⤵
  PID:6204
- C:\Windows\System\mXeQdTG.exe
  C:\Windows\System\mXeQdTG.exe
  2⤵
  PID:6268
- C:\Windows\System\djUlEAj.exe
  C:\Windows\System\djUlEAj.exe
  2⤵
  PID:6308
- C:\Windows\System\SqTobWq.exe
  C:\Windows\System\SqTobWq.exe
  2⤵
  PID:6508
- C:\Windows\System\sRcIkfJ.exe
  C:\Windows\System\sRcIkfJ.exe
  2⤵
  PID:6628
- C:\Windows\System\kMSdTtQ.exe
  C:\Windows\System\kMSdTtQ.exe
  2⤵
  PID:6796
- C:\Windows\System\EORedvQ.exe
  C:\Windows\System\EORedvQ.exe
  2⤵
  PID:6956
- C:\Windows\System\FOXaZyr.exe
  C:\Windows\System\FOXaZyr.exe
  2⤵
  PID:7100
- C:\Windows\System\CLMCGth.exe
  C:\Windows\System\CLMCGth.exe
  2⤵
  PID:512
- C:\Windows\System\ExSKhaa.exe
  C:\Windows\System\ExSKhaa.exe
  2⤵
  PID:8100
- C:\Windows\System\cKXhsKV.exe
  C:\Windows\System\cKXhsKV.exe
  2⤵
  PID:9224
- C:\Windows\System\WrdZcob.exe
  C:\Windows\System\WrdZcob.exe
  2⤵
  PID:9244
- C:\Windows\System\GZrUogX.exe
  C:\Windows\System\GZrUogX.exe
  2⤵
  PID:9260
- C:\Windows\System\KjROnXD.exe
  C:\Windows\System\KjROnXD.exe
  2⤵
  PID:9284
- C:\Windows\System\grkhsUh.exe
  C:\Windows\System\grkhsUh.exe
  2⤵
  PID:9308
- C:\Windows\System\rQGQyLZ.exe
  C:\Windows\System\rQGQyLZ.exe
  2⤵
  PID:9328
- C:\Windows\System\GIfvuim.exe
  C:\Windows\System\GIfvuim.exe
  2⤵
  PID:9348
- C:\Windows\System\ojqTObF.exe
  C:\Windows\System\ojqTObF.exe
  2⤵
  PID:9368
- C:\Windows\System\eHXsKtX.exe
  C:\Windows\System\eHXsKtX.exe
  2⤵
  PID:9384
- C:\Windows\System\cJnpPoG.exe
  C:\Windows\System\cJnpPoG.exe
  2⤵
  PID:9400
- C:\Windows\System\ptPoROs.exe
  C:\Windows\System\ptPoROs.exe
  2⤵
  PID:9416
- C:\Windows\System\UMShaNL.exe
  C:\Windows\System\UMShaNL.exe
  2⤵
  PID:9432
- C:\Windows\System\LKosfbC.exe
  C:\Windows\System\LKosfbC.exe
  2⤵
  PID:9448
- C:\Windows\System\vveyLEG.exe
  C:\Windows\System\vveyLEG.exe
  2⤵
  PID:9464
- C:\Windows\System\xWSOfQv.exe
  C:\Windows\System\xWSOfQv.exe
  2⤵
  PID:9480
- C:\Windows\System\kYOJZUw.exe
  C:\Windows\System\kYOJZUw.exe
  2⤵
  PID:9500
- C:\Windows\System\UYsTASi.exe
  C:\Windows\System\UYsTASi.exe
  2⤵
  PID:9520
- C:\Windows\System\TSzLusu.exe
  C:\Windows\System\TSzLusu.exe
  2⤵
  PID:9544
- C:\Windows\System\avJlRbh.exe
  C:\Windows\System\avJlRbh.exe
  2⤵
  PID:9564
- C:\Windows\System\ZmYCJJC.exe
  C:\Windows\System\ZmYCJJC.exe
  2⤵
  PID:9580
- C:\Windows\System\SuqKjGN.exe
  C:\Windows\System\SuqKjGN.exe
  2⤵
  PID:9604
- C:\Windows\System\piGLSIa.exe
  C:\Windows\System\piGLSIa.exe
  2⤵
  PID:9624
- C:\Windows\System\RWQTDXJ.exe
  C:\Windows\System\RWQTDXJ.exe
  2⤵
  PID:9644
- C:\Windows\System\FPvpMPU.exe
  C:\Windows\System\FPvpMPU.exe
  2⤵
  PID:9660
- C:\Windows\System\QjVpYCX.exe
  C:\Windows\System\QjVpYCX.exe
  2⤵
  PID:9680
- C:\Windows\System\dnEmsos.exe
  C:\Windows\System\dnEmsos.exe
  2⤵
  PID:9696
- C:\Windows\System\MzaGnAJ.exe
  C:\Windows\System\MzaGnAJ.exe
  2⤵
  PID:9712
- C:\Windows\System\xYzRFRg.exe
  C:\Windows\System\xYzRFRg.exe
  2⤵
  PID:9732
- C:\Windows\System\ufqKXox.exe
  C:\Windows\System\ufqKXox.exe
  2⤵
  PID:9748
- C:\Windows\System\XXjdNVN.exe
  C:\Windows\System\XXjdNVN.exe
  2⤵
  PID:9776
- C:\Windows\System\OjvVlgq.exe
  C:\Windows\System\OjvVlgq.exe
  2⤵
  PID:9796
- C:\Windows\System\KMfrNzx.exe
  C:\Windows\System\KMfrNzx.exe
  2⤵
  PID:9812
- C:\Windows\System\gzFFTlO.exe
  C:\Windows\System\gzFFTlO.exe
  2⤵
  PID:9832
- C:\Windows\System\DHEuTRd.exe
  C:\Windows\System\DHEuTRd.exe
  2⤵
  PID:9864
- C:\Windows\System\wbwlRoy.exe
  C:\Windows\System\wbwlRoy.exe
  2⤵
  PID:9884
- C:\Windows\System\sMdvnYr.exe
  C:\Windows\System\sMdvnYr.exe
  2⤵
  PID:9900
- C:\Windows\System\AAoDnke.exe
  C:\Windows\System\AAoDnke.exe
  2⤵
  PID:9924
- C:\Windows\System\SrRdSKi.exe
  C:\Windows\System\SrRdSKi.exe
  2⤵
  PID:9948
- C:\Windows\System\vaEQLMH.exe
  C:\Windows\System\vaEQLMH.exe
  2⤵
  PID:9968
- C:\Windows\System\uuwUyYB.exe
  C:\Windows\System\uuwUyYB.exe
  2⤵
  PID:9984
- C:\Windows\System\FXiUaRY.exe
  C:\Windows\System\FXiUaRY.exe
  2⤵
  PID:10008
- C:\Windows\System\AmQhCTZ.exe
  C:\Windows\System\AmQhCTZ.exe
  2⤵
  PID:10100
- C:\Windows\System\XteJYDt.exe
  C:\Windows\System\XteJYDt.exe
  2⤵
  PID:10120
- C:\Windows\System\TgKMlTa.exe
  C:\Windows\System\TgKMlTa.exe
  2⤵
  PID:10144
- C:\Windows\System\kruXaxV.exe
  C:\Windows\System\kruXaxV.exe
  2⤵
  PID:10160
- C:\Windows\System\JKUTVPn.exe
  C:\Windows\System\JKUTVPn.exe
  2⤵
  PID:10184
- C:\Windows\System\ZlwmczR.exe
  C:\Windows\System\ZlwmczR.exe
  2⤵
  PID:10200
- C:\Windows\System\MBVkrIE.exe
  C:\Windows\System\MBVkrIE.exe
  2⤵
  PID:10224
- C:\Windows\System\ZsAwTKC.exe
  C:\Windows\System\ZsAwTKC.exe
  2⤵
  PID:8196
- C:\Windows\System\ofXrEUR.exe
  C:\Windows\System\ofXrEUR.exe
  2⤵
  PID:8292
- C:\Windows\System\mtpKBcw.exe
  C:\Windows\System\mtpKBcw.exe
  2⤵
  PID:8360
- C:\Windows\System\cDVWhco.exe
  C:\Windows\System\cDVWhco.exe
  2⤵
  PID:8464
- C:\Windows\System\ToTPJfW.exe
  C:\Windows\System\ToTPJfW.exe
  2⤵
  PID:7716
- C:\Windows\System\NGsGZiw.exe
  C:\Windows\System\NGsGZiw.exe
  2⤵
  PID:8512
- C:\Windows\System\jPuhEQs.exe
  C:\Windows\System\jPuhEQs.exe
  2⤵
  PID:8560
- C:\Windows\System\PTQbXti.exe
  C:\Windows\System\PTQbXti.exe
  2⤵
  PID:8700
- C:\Windows\System\NlLdFkz.exe
  C:\Windows\System\NlLdFkz.exe
  2⤵
  PID:1812
- C:\Windows\System\MXwCNTq.exe
  C:\Windows\System\MXwCNTq.exe
  2⤵
  PID:1624
- C:\Windows\System\rcssxHl.exe
  C:\Windows\System\rcssxHl.exe
  2⤵
  PID:5304
- C:\Windows\System\cOATeen.exe
  C:\Windows\System\cOATeen.exe
  2⤵
  PID:2544
- C:\Windows\System\rpqCcAu.exe
  C:\Windows\System\rpqCcAu.exe
  2⤵
  PID:5744
- C:\Windows\System\LfxnICz.exe
  C:\Windows\System\LfxnICz.exe
  2⤵
  PID:5864
- C:\Windows\System\IUxNCSK.exe
  C:\Windows\System\IUxNCSK.exe
  2⤵
  PID:6028
- C:\Windows\System\yLxVCMA.exe
  C:\Windows\System\yLxVCMA.exe
  2⤵
  PID:5056
- C:\Windows\System\boQtiLK.exe
  C:\Windows\System\boQtiLK.exe
  2⤵
  PID:3224
- C:\Windows\System\HBbIyvQ.exe
  C:\Windows\System\HBbIyvQ.exe
  2⤵
  PID:1640
- C:\Windows\System\MgLSkZd.exe
  C:\Windows\System\MgLSkZd.exe
  2⤵
  PID:6388
- C:\Windows\System\FbhDnro.exe
  C:\Windows\System\FbhDnro.exe
  2⤵
  PID:6800
- C:\Windows\System\rHleSTo.exe
  C:\Windows\System\rHleSTo.exe
  2⤵
  PID:6468
- C:\Windows\System\eEmJMmD.exe
  C:\Windows\System\eEmJMmD.exe
  2⤵
  PID:6692
- C:\Windows\System\pDqJJLX.exe
  C:\Windows\System\pDqJJLX.exe
  2⤵
  PID:7024
- C:\Windows\System\VQlPMBf.exe
  C:\Windows\System\VQlPMBf.exe
  2⤵
  PID:7212
- C:\Windows\System\eMAkvYl.exe
  C:\Windows\System\eMAkvYl.exe
  2⤵
  PID:7252
- C:\Windows\System\BArZDJe.exe
  C:\Windows\System\BArZDJe.exe
  2⤵
  PID:7292
- C:\Windows\System\tXaIpUM.exe
  C:\Windows\System\tXaIpUM.exe
  2⤵
  PID:7344
- C:\Windows\System\zIEOtTM.exe
  C:\Windows\System\zIEOtTM.exe
  2⤵
  PID:7380
- C:\Windows\System\BamqOra.exe
  C:\Windows\System\BamqOra.exe
  2⤵
  PID:7416
- C:\Windows\System\SrmhAol.exe
  C:\Windows\System\SrmhAol.exe
  2⤵
  PID:7464
- C:\Windows\System\IqfJkHb.exe
  C:\Windows\System\IqfJkHb.exe
  2⤵
  PID:7512
- C:\Windows\System\KkDjzmw.exe
  C:\Windows\System\KkDjzmw.exe
  2⤵
  PID:7548
- C:\Windows\System\wOcjkqq.exe
  C:\Windows\System\wOcjkqq.exe
  2⤵
  PID:7584
- C:\Windows\System\pIfWuqC.exe
  C:\Windows\System\pIfWuqC.exe
  2⤵
  PID:7636
- C:\Windows\System\ZQTxakd.exe
  C:\Windows\System\ZQTxakd.exe
  2⤵
  PID:9040
- C:\Windows\System\QxZTOXB.exe
  C:\Windows\System\QxZTOXB.exe
  2⤵
  PID:4880
- C:\Windows\System\ZEdAdiu.exe
  C:\Windows\System\ZEdAdiu.exe
  2⤵
  PID:9156
- C:\Windows\System\HeSFMja.exe
  C:\Windows\System\HeSFMja.exe
  2⤵
  PID:6252
- C:\Windows\System\zMgEWOb.exe
  C:\Windows\System\zMgEWOb.exe
  2⤵
  PID:10632
- C:\Windows\System\MXNFBal.exe
  C:\Windows\System\MXNFBal.exe
  2⤵
  PID:10900
- C:\Windows\System\mmaPpIU.exe
  C:\Windows\System\mmaPpIU.exe
  2⤵
  PID:10920
- C:\Windows\System\qVBRNzx.exe
  C:\Windows\System\qVBRNzx.exe
  2⤵
  PID:10944
- C:\Windows\System\oOqjedq.exe
  C:\Windows\System\oOqjedq.exe
  2⤵
  PID:10968
- C:\Windows\System\ldwnReT.exe
  C:\Windows\System\ldwnReT.exe
  2⤵
  PID:10988
- C:\Windows\System\jqTLpWk.exe
  C:\Windows\System\jqTLpWk.exe
  2⤵
  PID:11012
- C:\Windows\System\VavVAcl.exe
  C:\Windows\System\VavVAcl.exe
  2⤵
  PID:11044
- C:\Windows\System\zZwmJsu.exe
  C:\Windows\System\zZwmJsu.exe
  2⤵
  PID:11068
- C:\Windows\System\DEQZGsN.exe
  C:\Windows\System\DEQZGsN.exe
  2⤵
  PID:11088
- C:\Windows\System\XkxUmLc.exe
  C:\Windows\System\XkxUmLc.exe
  2⤵
  PID:11112
- C:\Windows\System\xURQyty.exe
  C:\Windows\System\xURQyty.exe
  2⤵
  PID:11140
- C:\Windows\System\SIueFMe.exe
  C:\Windows\System\SIueFMe.exe
  2⤵
  PID:11160
- C:\Windows\System\uluRarT.exe
  C:\Windows\System\uluRarT.exe
  2⤵
  PID:11180
- C:\Windows\System\BObZxuv.exe
  C:\Windows\System\BObZxuv.exe
  2⤵
  PID:11208
- C:\Windows\System\eHMjuut.exe
  C:\Windows\System\eHMjuut.exe
  2⤵
  PID:11232
- C:\Windows\System\OsCtMFA.exe
  C:\Windows\System\OsCtMFA.exe
  2⤵
  PID:11252
- C:\Windows\System\IMfEDKL.exe
  C:\Windows\System\IMfEDKL.exe
  2⤵
  PID:7060
- C:\Windows\System\YCIVLiE.exe
  C:\Windows\System\YCIVLiE.exe
  2⤵
  PID:7124
- C:\Windows\System\LVBaNuu.exe
  C:\Windows\System\LVBaNuu.exe
  2⤵
  PID:3128
- C:\Windows\System\lsgBCKl.exe
  C:\Windows\System\lsgBCKl.exe
  2⤵
  PID:7008
- C:\Windows\System\GTPJhxv.exe
  C:\Windows\System\GTPJhxv.exe
  2⤵
  PID:8272
- C:\Windows\System\srEyErl.exe
  C:\Windows\System\srEyErl.exe
  2⤵
  PID:8392
- C:\Windows\System\zwyVqKZ.exe
  C:\Windows\System\zwyVqKZ.exe
  2⤵
  PID:9656
- C:\Windows\System\yePSxZS.exe
  C:\Windows\System\yePSxZS.exe
  2⤵
  PID:8640
- C:\Windows\System\ebkgFdL.exe
  C:\Windows\System\ebkgFdL.exe
  2⤵
  PID:9184
- C:\Windows\System\ClbUEaO.exe
  C:\Windows\System\ClbUEaO.exe
  2⤵
  PID:6228
- C:\Windows\System\XUSaxOd.exe
  C:\Windows\System\XUSaxOd.exe
  2⤵
  PID:7332
- C:\Windows\System\RISZiRD.exe
  C:\Windows\System\RISZiRD.exe
  2⤵
  PID:7412
- C:\Windows\System\OETURtd.exe
  C:\Windows\System\OETURtd.exe
  2⤵
  PID:9236
- C:\Windows\System\JsnosvJ.exe
  C:\Windows\System\JsnosvJ.exe
  2⤵
  PID:5572
- C:\Windows\System\xrMhqWI.exe
  C:\Windows\System\xrMhqWI.exe
  2⤵
  PID:8616
- C:\Windows\System\VIpJUbq.exe
  C:\Windows\System\VIpJUbq.exe
  2⤵
  PID:5928
- C:\Windows\System\XXJrueE.exe
  C:\Windows\System\XXJrueE.exe
  2⤵
  PID:8120
- C:\Windows\System\zltccNj.exe
  C:\Windows\System\zltccNj.exe
  2⤵
  PID:9304
- C:\Windows\System\wRDTscF.exe
  C:\Windows\System\wRDTscF.exe
  2⤵
  PID:11300
- C:\Windows\System\oAnyCCr.exe
  C:\Windows\System\oAnyCCr.exe
  2⤵
  PID:11320
- C:\Windows\System\IKrZXrr.exe
  C:\Windows\System\IKrZXrr.exe
  2⤵
  PID:11340
- C:\Windows\System\tMzcUXy.exe
  C:\Windows\System\tMzcUXy.exe
  2⤵
  PID:11360
- C:\Windows\System\cBHOvfR.exe
  C:\Windows\System\cBHOvfR.exe
  2⤵
  PID:11380
- C:\Windows\System\DyqvGAY.exe
  C:\Windows\System\DyqvGAY.exe
  2⤵
  PID:11396
- C:\Windows\System\XKABjzk.exe
  C:\Windows\System\XKABjzk.exe
  2⤵
  PID:11416
- C:\Windows\System\LrboTJP.exe
  C:\Windows\System\LrboTJP.exe
  2⤵
  PID:11436
- C:\Windows\System\dxrKqaI.exe
  C:\Windows\System\dxrKqaI.exe
  2⤵
  PID:11456
- C:\Windows\System\mLctoBn.exe
  C:\Windows\System\mLctoBn.exe
  2⤵
  PID:11472
- C:\Windows\System\ZBSbFri.exe
  C:\Windows\System\ZBSbFri.exe
  2⤵
  PID:11496
- C:\Windows\System\YvWLcBQ.exe
  C:\Windows\System\YvWLcBQ.exe
  2⤵
  PID:11516
- C:\Windows\System\fYRUiDi.exe
  C:\Windows\System\fYRUiDi.exe
  2⤵
  PID:11536
- C:\Windows\System\YJXSfZb.exe
  C:\Windows\System\YJXSfZb.exe
  2⤵
  PID:11560
- C:\Windows\System\YNngnMW.exe
  C:\Windows\System\YNngnMW.exe
  2⤵
  PID:11576
- C:\Windows\System\gsLnEHC.exe
  C:\Windows\System\gsLnEHC.exe
  2⤵
  PID:11592
- C:\Windows\System\asRTFOt.exe
  C:\Windows\System\asRTFOt.exe
  2⤵
  PID:11608
- C:\Windows\System\YOgwscJ.exe
  C:\Windows\System\YOgwscJ.exe
  2⤵
  PID:11624
- C:\Windows\System\KScDxpc.exe
  C:\Windows\System\KScDxpc.exe
  2⤵
  PID:11644
- C:\Windows\System\WSoVDKX.exe
  C:\Windows\System\WSoVDKX.exe
  2⤵
  PID:11660
- C:\Windows\System\cKuWQma.exe
  C:\Windows\System\cKuWQma.exe
  2⤵
  PID:11676
- C:\Windows\System\vQveYbS.exe
  C:\Windows\System\vQveYbS.exe
  2⤵
  PID:11696
- C:\Windows\System\gpXpiuu.exe
  C:\Windows\System\gpXpiuu.exe
  2⤵
  PID:11720
- C:\Windows\System\uCBPSGK.exe
  C:\Windows\System\uCBPSGK.exe
  2⤵
  PID:11740
- C:\Windows\System\cwBFEUq.exe
  C:\Windows\System\cwBFEUq.exe
  2⤵
  PID:11768
- C:\Windows\System\jxhCflS.exe
  C:\Windows\System\jxhCflS.exe
  2⤵
  PID:11792
- C:\Windows\System\gKcHRNx.exe
  C:\Windows\System\gKcHRNx.exe
  2⤵
  PID:11816
- C:\Windows\System\fDIMQYh.exe
  C:\Windows\System\fDIMQYh.exe
  2⤵
  PID:11836
- C:\Windows\System\VvexbLX.exe
  C:\Windows\System\VvexbLX.exe
  2⤵
  PID:11868
- C:\Windows\System\CVJYwMQ.exe
  C:\Windows\System\CVJYwMQ.exe
  2⤵
  PID:11900
- C:\Windows\System\FrqpaLI.exe
  C:\Windows\System\FrqpaLI.exe
  2⤵
  PID:11920
- C:\Windows\System\eTgkYnq.exe
  C:\Windows\System\eTgkYnq.exe
  2⤵
  PID:11944
- C:\Windows\System\gElzAGu.exe
  C:\Windows\System\gElzAGu.exe
  2⤵
  PID:11972
- C:\Windows\System\nhZhild.exe
  C:\Windows\System\nhZhild.exe
  2⤵
  PID:11992
- C:\Windows\System\lcmhYDm.exe
  C:\Windows\System\lcmhYDm.exe
  2⤵
  PID:12016
- C:\Windows\System\txrCfaZ.exe
  C:\Windows\System\txrCfaZ.exe
  2⤵
  PID:12040
- C:\Windows\System\teXusYK.exe
  C:\Windows\System\teXusYK.exe
  2⤵
  PID:12064
- C:\Windows\System\gcrBMPl.exe
  C:\Windows\System\gcrBMPl.exe
  2⤵
  PID:12088
- C:\Windows\System\TlBsICg.exe
  C:\Windows\System\TlBsICg.exe
  2⤵
  PID:12108
- C:\Windows\System\oabDoIV.exe
  C:\Windows\System\oabDoIV.exe
  2⤵
  PID:12132
- C:\Windows\System\fjnSwAu.exe
  C:\Windows\System\fjnSwAu.exe
  2⤵
  PID:12148
- C:\Windows\System\fVkwBzc.exe
  C:\Windows\System\fVkwBzc.exe
  2⤵
  PID:12172
- C:\Windows\System\YLwbQRK.exe
  C:\Windows\System\YLwbQRK.exe
  2⤵
  PID:12196
- C:\Windows\System\eNKBnTb.exe
  C:\Windows\System\eNKBnTb.exe
  2⤵
  PID:12216
- C:\Windows\System\ZvMHrod.exe
  C:\Windows\System\ZvMHrod.exe
  2⤵
  PID:12236
- C:\Windows\System\ypeGjTk.exe
  C:\Windows\System\ypeGjTk.exe
  2⤵
  PID:12260
- C:\Windows\System\hpFCIjg.exe
  C:\Windows\System\hpFCIjg.exe
  2⤵
  PID:12276
- C:\Windows\System\APgmqLL.exe
  C:\Windows\System\APgmqLL.exe
  2⤵
  PID:9456
- C:\Windows\System\jXgeHtX.exe
  C:\Windows\System\jXgeHtX.exe
  2⤵
  PID:9556
- C:\Windows\System\BGmqUHn.exe
  C:\Windows\System\BGmqUHn.exe
  2⤵
  PID:10316
- C:\Windows\System\WJidbnX.exe
  C:\Windows\System\WJidbnX.exe
  2⤵
  PID:11000
- C:\Windows\System\ebhmyGn.exe
  C:\Windows\System\ebhmyGn.exe
  2⤵
  PID:11056
- C:\Windows\System\oZkMnHA.exe
  C:\Windows\System\oZkMnHA.exe
  2⤵
  PID:11128
- C:\Windows\System\blHJUGz.exe
  C:\Windows\System\blHJUGz.exe
  2⤵
  PID:11200
- C:\Windows\System\HSWpREQ.exe
  C:\Windows\System\HSWpREQ.exe
  2⤵
  PID:9744
- C:\Windows\System\rMjonrW.exe
  C:\Windows\System\rMjonrW.exe
  2⤵
  PID:11260
- C:\Windows\System\SgCgUxg.exe
  C:\Windows\System\SgCgUxg.exe
  2⤵
  PID:12320
- C:\Windows\System\qHVZYIj.exe
  C:\Windows\System\qHVZYIj.exe
  2⤵
  PID:12340
- C:\Windows\System\sSbOjlb.exe
  C:\Windows\System\sSbOjlb.exe
  2⤵
  PID:12364
- C:\Windows\System\SoAODgf.exe
  C:\Windows\System\SoAODgf.exe
  2⤵
  PID:12388
- C:\Windows\System\zgUuHzm.exe
  C:\Windows\System\zgUuHzm.exe
  2⤵
  PID:12404
- C:\Windows\System\MvtBbKH.exe
  C:\Windows\System\MvtBbKH.exe
  2⤵
  PID:12420
- C:\Windows\System\OkfsRUg.exe
  C:\Windows\System\OkfsRUg.exe
  2⤵
  PID:12440
- C:\Windows\System\YDoHiey.exe
  C:\Windows\System\YDoHiey.exe
  2⤵
  PID:12456
- C:\Windows\System\wSvzrJI.exe
  C:\Windows\System\wSvzrJI.exe
  2⤵
  PID:12472
- C:\Windows\System\EriQZfT.exe
  C:\Windows\System\EriQZfT.exe
  2⤵
  PID:12488
- C:\Windows\System\hvgqzQW.exe
  C:\Windows\System\hvgqzQW.exe
  2⤵
  PID:12504
- C:\Windows\System\FbXnBII.exe
  C:\Windows\System\FbXnBII.exe
  2⤵
  PID:12520
- C:\Windows\System\wqZhInJ.exe
  C:\Windows\System\wqZhInJ.exe
  2⤵
  PID:12536
- C:\Windows\System\PDGIUBZ.exe
  C:\Windows\System\PDGIUBZ.exe
  2⤵
  PID:12552
- C:\Windows\System\SdSjxZd.exe
  C:\Windows\System\SdSjxZd.exe
  2⤵
  PID:12572
- C:\Windows\System\gNsGCOA.exe
  C:\Windows\System\gNsGCOA.exe
  2⤵
  PID:12592
- C:\Windows\System\Lmcctqp.exe
  C:\Windows\System\Lmcctqp.exe
  2⤵
  PID:12612
- C:\Windows\System\WSHGwno.exe
  C:\Windows\System\WSHGwno.exe
  2⤵
  PID:12636
- C:\Windows\System\ZcCyfsr.exe
  C:\Windows\System\ZcCyfsr.exe
  2⤵
  PID:12668
- C:\Windows\System\YXfpOhy.exe
  C:\Windows\System\YXfpOhy.exe
  2⤵
  PID:12692
- C:\Windows\System\LoAIRGH.exe
  C:\Windows\System\LoAIRGH.exe
  2⤵
  PID:12716
- C:\Windows\System\AkiisTH.exe
  C:\Windows\System\AkiisTH.exe
  2⤵
  PID:12780
- C:\Windows\System\DvhqjSI.exe
  C:\Windows\System\DvhqjSI.exe
  2⤵
  PID:12796
- C:\Windows\System\KSHunFj.exe
  C:\Windows\System\KSHunFj.exe
  2⤵
  PID:12812
- C:\Windows\System\EGpRqLE.exe
  C:\Windows\System\EGpRqLE.exe
  2⤵
  PID:12828
- C:\Windows\System\CcmGFDw.exe
  C:\Windows\System\CcmGFDw.exe
  2⤵
  PID:12844
- C:\Windows\System\GDqfJED.exe
  C:\Windows\System\GDqfJED.exe
  2⤵
  PID:12860
- C:\Windows\System\yiVNzLa.exe
  C:\Windows\System\yiVNzLa.exe
  2⤵
  PID:12876
- C:\Windows\System\AyOHSDc.exe
  C:\Windows\System\AyOHSDc.exe
  2⤵
  PID:12892
- C:\Windows\System\WsgLLaR.exe
  C:\Windows\System\WsgLLaR.exe
  2⤵
  PID:12908
- C:\Windows\System\YOQdpgh.exe
  C:\Windows\System\YOQdpgh.exe
  2⤵
  PID:12924
- C:\Windows\System\PUkCLzy.exe
  C:\Windows\System\PUkCLzy.exe
  2⤵
  PID:12976
- C:\Windows\System\XDFHdnR.exe
  C:\Windows\System\XDFHdnR.exe
  2⤵
  PID:13056
- C:\Windows\System\gOTVhbd.exe
  C:\Windows\System\gOTVhbd.exe
  2⤵
  PID:13072
- C:\Windows\System\xCwZTUQ.exe
  C:\Windows\System\xCwZTUQ.exe
  2⤵
  PID:13088
- C:\Windows\System\ztGYktJ.exe
  C:\Windows\System\ztGYktJ.exe
  2⤵
  PID:13104
- C:\Windows\System\ZwSOWqR.exe
  C:\Windows\System\ZwSOWqR.exe
  2⤵
  PID:13124
- C:\Windows\System\RnoDgHl.exe
  C:\Windows\System\RnoDgHl.exe
  2⤵
  PID:13144
- C:\Windows\System\lIPbPvx.exe
  C:\Windows\System\lIPbPvx.exe
  2⤵
  PID:13160
- C:\Windows\System\mGwARyb.exe
  C:\Windows\System\mGwARyb.exe
  2⤵
  PID:13180
- C:\Windows\System\SGipapf.exe
  C:\Windows\System\SGipapf.exe
  2⤵
  PID:13204
- C:\Windows\System\gBsceHF.exe
  C:\Windows\System\gBsceHF.exe
  2⤵
  PID:13224
- C:\Windows\System\ilSFJVJ.exe
  C:\Windows\System\ilSFJVJ.exe
  2⤵
  PID:13248
- C:\Windows\System\LcPZapr.exe
  C:\Windows\System\LcPZapr.exe
  2⤵
  PID:13272
- C:\Windows\System\oaSIpTk.exe
  C:\Windows\System\oaSIpTk.exe
  2⤵
  PID:13292
- C:\Windows\System\ueDwtjk.exe
  C:\Windows\System\ueDwtjk.exe
  2⤵
  PID:9764
- C:\Windows\System\NaxErDY.exe
  C:\Windows\System\NaxErDY.exe
  2⤵
  PID:8328
- C:\Windows\System\gTeJNGO.exe
  C:\Windows\System\gTeJNGO.exe
  2⤵
  PID:9640
- C:\Windows\System\JcDrAPf.exe
  C:\Windows\System\JcDrAPf.exe
  2⤵
  PID:3440
- C:\Windows\System\SfpzOAH.exe
  C:\Windows\System\SfpzOAH.exe
  2⤵
  PID:4876
- C:\Windows\System\pTsWygW.exe
  C:\Windows\System\pTsWygW.exe
  2⤵
  PID:4516
- C:\Windows\System\qNbATad.exe
  C:\Windows\System\qNbATad.exe
  2⤵
  PID:9016
- C:\Windows\System\shtvniU.exe
  C:\Windows\System\shtvniU.exe
  2⤵
  PID:9144
- C:\Windows\System\swCUNTz.exe
  C:\Windows\System\swCUNTz.exe
  2⤵
  PID:6632
- C:\Windows\System\iNmmDUU.exe
  C:\Windows\System\iNmmDUU.exe
  2⤵
  PID:11348
- C:\Windows\System\TRBAxmN.exe
  C:\Windows\System\TRBAxmN.exe
  2⤵
  PID:11376
- C:\Windows\System\bkvCPwq.exe
  C:\Windows\System\bkvCPwq.exe
  2⤵
  PID:3712
- C:\Windows\System\ncVIlNZ.exe
  C:\Windows\System\ncVIlNZ.exe
  2⤵
  PID:9344
- C:\Windows\System\luZbxVo.exe
  C:\Windows\System\luZbxVo.exe
  2⤵
  PID:9396
- C:\Windows\System\UFiyTGk.exe
  C:\Windows\System\UFiyTGk.exe
  2⤵
  PID:11284
- C:\Windows\System\JXyUCgY.exe
  C:\Windows\System\JXyUCgY.exe
  2⤵
  PID:11316
- C:\Windows\System\HjXCEGZ.exe
  C:\Windows\System\HjXCEGZ.exe
  2⤵
  PID:11504
- C:\Windows\System\xdFSXcz.exe
  C:\Windows\System\xdFSXcz.exe
  2⤵
  PID:5240
- C:\Windows\System\biBkPiB.exe
  C:\Windows\System\biBkPiB.exe
  2⤵
  PID:8436
- C:\Windows\System\VPCQllW.exe
  C:\Windows\System\VPCQllW.exe
  2⤵
  PID:11636
- C:\Windows\System\eQYzoJD.exe
  C:\Windows\System\eQYzoJD.exe
  2⤵
  PID:11692
- C:\Windows\System\eVCSnmo.exe
  C:\Windows\System\eVCSnmo.exe
  2⤵
  PID:11788
- C:\Windows\System\LGDUDee.exe
  C:\Windows\System\LGDUDee.exe
  2⤵
  PID:8288
- C:\Windows\System\iqbfvwV.exe
  C:\Windows\System\iqbfvwV.exe
  2⤵
  PID:11980
- C:\Windows\System\AbGntSi.exe
  C:\Windows\System\AbGntSi.exe
  2⤵
  PID:8596
- C:\Windows\System\SjszVxF.exe
  C:\Windows\System\SjszVxF.exe
  2⤵
  PID:12124
- C:\Windows\System\zHYZdPx.exe
  C:\Windows\System\zHYZdPx.exe
  2⤵
  PID:12160
- C:\Windows\System\FSFZrSJ.exe
  C:\Windows\System\FSFZrSJ.exe
  2⤵
  PID:12252
- C:\Windows\System\ouZcvid.exe
  C:\Windows\System\ouZcvid.exe
  2⤵
  PID:9444
- C:\Windows\System\GwzhxFh.exe
  C:\Windows\System\GwzhxFh.exe
  2⤵
  PID:9540
- C:\Windows\System\JeFlDgs.exe
  C:\Windows\System\JeFlDgs.exe
  2⤵
  PID:11096
- C:\Windows\System\kqLisjZ.exe
  C:\Windows\System\kqLisjZ.exe
  2⤵
  PID:6004
- C:\Windows\System\OitnNgf.exe
  C:\Windows\System\OitnNgf.exe
  2⤵
  PID:1020
- C:\Windows\System\fQGRpHn.exe
  C:\Windows\System\fQGRpHn.exe
  2⤵
  PID:11248
- C:\Windows\System\Xczxmth.exe
  C:\Windows\System\Xczxmth.exe
  2⤵
  PID:12348
- C:\Windows\System\BsGdRxo.exe
  C:\Windows\System\BsGdRxo.exe
  2⤵
  PID:12400
- C:\Windows\System\GYgfeId.exe
  C:\Windows\System\GYgfeId.exe
  2⤵
  PID:12432
- C:\Windows\System\MaFrtMZ.exe
  C:\Windows\System\MaFrtMZ.exe
  2⤵
  PID:12480
- C:\Windows\System\yxoINsv.exe
  C:\Windows\System\yxoINsv.exe
  2⤵
  PID:12516
- C:\Windows\System\cxdAlCL.exe
  C:\Windows\System\cxdAlCL.exe
  2⤵
  PID:12560
- C:\Windows\System\LqrPuhp.exe
  C:\Windows\System\LqrPuhp.exe
  2⤵
  PID:12604
- C:\Windows\System\BTntvMb.exe
  C:\Windows\System\BTntvMb.exe
  2⤵
  PID:12724
- C:\Windows\System\knuuJML.exe
  C:\Windows\System\knuuJML.exe
  2⤵
  PID:4280
- C:\Windows\System\QlYjelF.exe
  C:\Windows\System\QlYjelF.exe
  2⤵
  PID:12804
- C:\Windows\System\wtmDWqU.exe
  C:\Windows\System\wtmDWqU.exe
  2⤵
  PID:12836
- C:\Windows\System\bowSCzd.exe
  C:\Windows\System\bowSCzd.exe
  2⤵
  PID:12868
- C:\Windows\System\GjAHjZZ.exe
  C:\Windows\System\GjAHjZZ.exe
  2⤵
  PID:12900
- C:\Windows\System\jDBJkIO.exe
  C:\Windows\System\jDBJkIO.exe
  2⤵
  PID:12932
- C:\Windows\System\OrswtLt.exe
  C:\Windows\System\OrswtLt.exe
  2⤵
  PID:12948
- C:\Windows\System\pApusBn.exe
  C:\Windows\System\pApusBn.exe
  2⤵
  PID:12960
- C:\Windows\System\CEHLOBm.exe
  C:\Windows\System\CEHLOBm.exe
  2⤵
  PID:13052
- C:\Windows\System\nYrNiAg.exe
  C:\Windows\System\nYrNiAg.exe
  2⤵
  PID:13120
- C:\Windows\System\lpxHjpN.exe
  C:\Windows\System\lpxHjpN.exe
  2⤵
  PID:13152
- C:\Windows\System\zAtAqVW.exe
  C:\Windows\System\zAtAqVW.exe
  2⤵
  PID:13212
- C:\Windows\System\hMGabXV.exe
  C:\Windows\System\hMGabXV.exe
  2⤵
  PID:13256
- C:\Windows\System\hAhSFgj.exe
  C:\Windows\System\hAhSFgj.exe
  2⤵
  PID:13300
- C:\Windows\System\OztKsqg.exe
  C:\Windows\System\OztKsqg.exe
  2⤵
  PID:9852
- C:\Windows\System\TLPMFuX.exe
  C:\Windows\System\TLPMFuX.exe
  2⤵
  PID:7736
- C:\Windows\System\clSHjxD.exe
  C:\Windows\System\clSHjxD.exe
  2⤵
  PID:8480
- C:\Windows\System\iIvXKtG.exe
  C:\Windows\System\iIvXKtG.exe
  2⤵
  PID:5696
- C:\Windows\System\ZnTzTCk.exe
  C:\Windows\System\ZnTzTCk.exe
  2⤵
  PID:3436
- C:\Windows\System\ISsZVzR.exe
  C:\Windows\System\ISsZVzR.exe
  2⤵
  PID:6504
- C:\Windows\System\KulObwQ.exe
  C:\Windows\System\KulObwQ.exe
  2⤵
  PID:7572
- C:\Windows\System\aeRzdHA.exe
  C:\Windows\System\aeRzdHA.exe
  2⤵
  PID:9092
- C:\Windows\System\tugYjvV.exe
  C:\Windows\System\tugYjvV.exe
  2⤵
  PID:9128
- C:\Windows\System\RAeOqFz.exe
  C:\Windows\System\RAeOqFz.exe
  2⤵
  PID:7360
- C:\Windows\System\fyoXjHb.exe
  C:\Windows\System\fyoXjHb.exe
  2⤵
  PID:10088
- C:\Windows\System\rsdNXZc.exe
  C:\Windows\System\rsdNXZc.exe
  2⤵
  PID:9804
- C:\Windows\System\dvQFBrM.exe
  C:\Windows\System\dvQFBrM.exe
  2⤵
  PID:9616
- C:\Windows\System\Plwgyka.exe
  C:\Windows\System\Plwgyka.exe
  2⤵
  PID:10696
- C:\Windows\System\toArLnx.exe
  C:\Windows\System\toArLnx.exe
  2⤵
  PID:11640
- C:\Windows\System\zljeuxx.exe
  C:\Windows\System\zljeuxx.exe
  2⤵
  PID:10068
- C:\Windows\System\cpTJQZv.exe
  C:\Windows\System\cpTJQZv.exe
  2⤵
  PID:9440
- C:\Windows\System\nBDkgfI.exe
  C:\Windows\System\nBDkgfI.exe
  2⤵
  PID:11356
- C:\Windows\System\qSwvxga.exe
  C:\Windows\System\qSwvxga.exe
  2⤵
  PID:11480
- C:\Windows\System\lCrKhEe.exe
  C:\Windows\System\lCrKhEe.exe
  2⤵
  PID:11572
- C:\Windows\System\AmwpFNp.exe
  C:\Windows\System\AmwpFNp.exe
  2⤵
  PID:10836
- C:\Windows\System\JTXqXnf.exe
  C:\Windows\System\JTXqXnf.exe
  2⤵
  PID:11888
- C:\Windows\System\TXUfTjA.exe
  C:\Windows\System\TXUfTjA.exe
  2⤵
  PID:11032
- C:\Windows\System\lHRumGY.exe
  C:\Windows\System\lHRumGY.exe
  2⤵
  PID:12208
- C:\Windows\System\aHkKWjz.exe
  C:\Windows\System\aHkKWjz.exe
  2⤵
  PID:7300
- C:\Windows\System\CBRmFgE.exe
  C:\Windows\System\CBRmFgE.exe
  2⤵
  PID:10488
- C:\Windows\System\JKnaDQC.exe
  C:\Windows\System\JKnaDQC.exe
  2⤵
  PID:11784
- C:\Windows\System\yCFZxEL.exe
  C:\Windows\System\yCFZxEL.exe
  2⤵
  PID:6592
- C:\Windows\System\SGqkYqO.exe
  C:\Windows\System\SGqkYqO.exe
  2⤵
  PID:4672
- C:\Windows\System\uaVeFck.exe
  C:\Windows\System\uaVeFck.exe
  2⤵
  PID:1492
- C:\Windows\System\dgieHTb.exe
  C:\Windows\System\dgieHTb.exe
  2⤵
  PID:4424
- C:\Windows\System\KYWZTcD.exe
  C:\Windows\System\KYWZTcD.exe
  2⤵
  PID:2872
- C:\Windows\System\UcSqlXa.exe
  C:\Windows\System\UcSqlXa.exe
  2⤵
  PID:3612
- C:\Windows\System\DhjZFWz.exe
  C:\Windows\System\DhjZFWz.exe
  2⤵
  PID:1564
- C:\Windows\System\CdRKfBd.exe
  C:\Windows\System\CdRKfBd.exe
  2⤵
  PID:348
- C:\Windows\System\sriOYZI.exe
  C:\Windows\System\sriOYZI.exe
  2⤵
  PID:1312
- C:\Windows\System\CzlqnCa.exe
  C:\Windows\System\CzlqnCa.exe
  2⤵
  PID:912
- C:\Windows\System\pgvrUKw.exe
  C:\Windows\System\pgvrUKw.exe
  2⤵
  PID:10392
- C:\Windows\System\KUNBITl.exe
  C:\Windows\System\KUNBITl.exe
  2⤵
  PID:3232
- C:\Windows\System\EsbPOCK.exe
  C:\Windows\System\EsbPOCK.exe
  2⤵
  PID:8568
- C:\Windows\System\RQGhMOO.exe
  C:\Windows\System\RQGhMOO.exe
  2⤵
  PID:10620
- C:\Windows\System\ZMLImbp.exe
  C:\Windows\System\ZMLImbp.exe
  2⤵
  PID:4336
- C:\Windows\System\NqNZbDf.exe
  C:\Windows\System\NqNZbDf.exe
  2⤵
  PID:4800
- C:\Windows\System\kHWIjQN.exe
  C:\Windows\System\kHWIjQN.exe
  2⤵
  PID:4920
- C:\Windows\System\cnXhwTY.exe
  C:\Windows\System\cnXhwTY.exe
  2⤵
  PID:8768
- C:\Windows\System\glTZMFt.exe
  C:\Windows\System\glTZMFt.exe
  2⤵
  PID:8804
- C:\Windows\System\zkgGYMT.exe
  C:\Windows\System\zkgGYMT.exe
  2⤵
  PID:9240
- C:\Windows\System\MzdqXop.exe
  C:\Windows\System\MzdqXop.exe
  2⤵
  PID:9364
- C:\Windows\System\xotYlxg.exe
  C:\Windows\System\xotYlxg.exe
  2⤵
  PID:10412
- C:\Windows\System\uIKRYJG.exe
  C:\Windows\System\uIKRYJG.exe
  2⤵
  PID:9908
- C:\Windows\System\FkVhNca.exe
  C:\Windows\System\FkVhNca.exe
  2⤵
  PID:11668
- C:\Windows\System\RUtEwxg.exe
  C:\Windows\System\RUtEwxg.exe
  2⤵
  PID:3652
- C:\Windows\System\IbYorMe.exe
  C:\Windows\System\IbYorMe.exe
  2⤵
  PID:11108
- C:\Windows\System\zlIkJLM.exe
  C:\Windows\System\zlIkJLM.exe
  2⤵
  PID:8684
- C:\Windows\System\sWiIpxy.exe
  C:\Windows\System\sWiIpxy.exe
  2⤵
  PID:9208
- C:\Windows\System\NgJznaE.exe
  C:\Windows\System\NgJznaE.exe
  2⤵
  PID:12104
- C:\Windows\System\rQIqnCM.exe
  C:\Windows\System\rQIqnCM.exe
  2⤵
  PID:9300
- C:\Windows\System\yZJGxxW.exe
  C:\Windows\System\yZJGxxW.exe
  2⤵
  PID:13100
- C:\Windows\System\PcYvxdD.exe
  C:\Windows\System\PcYvxdD.exe
  2⤵
  PID:11244
- C:\Windows\System\SrvkYch.exe
  C:\Windows\System\SrvkYch.exe
  2⤵
  PID:12372
- C:\Windows\System\YqHOHZJ.exe
  C:\Windows\System\YqHOHZJ.exe
  2⤵
  PID:3876
- C:\Windows\System\fQQfOwL.exe
  C:\Windows\System\fQQfOwL.exe
  2⤵
  PID:3368
- C:\Windows\System\myhLUrD.exe
  C:\Windows\System\myhLUrD.exe
  2⤵
  PID:11876
- C:\Windows\System\nqosGIx.exe
  C:\Windows\System\nqosGIx.exe
  2⤵
  PID:9180
- C:\Windows\System\OKQKSiR.exe
  C:\Windows\System\OKQKSiR.exe
  2⤵
  PID:11432
- C:\Windows\System\XiKaywO.exe
  C:\Windows\System\XiKaywO.exe
  2⤵
  PID:2984
- C:\Windows\System\QPIkOpt.exe
  C:\Windows\System\QPIkOpt.exe
  2⤵
  PID:8784
- C:\Windows\System\dskGNRj.exe
  C:\Windows\System\dskGNRj.exe
  2⤵
  PID:11832
- C:\Windows\System\bofAJnR.exe
  C:\Windows\System\bofAJnR.exe
  2⤵
  PID:9740
- C:\Windows\System\VpHHrPf.exe
  C:\Windows\System\VpHHrPf.exe
  2⤵
  PID:12824
- C:\Windows\System\qNDlGCj.exe
  C:\Windows\System\qNDlGCj.exe
  2⤵
  PID:10292
- C:\Windows\System\tqaOFtY.exe
  C:\Windows\System\tqaOFtY.exe
  2⤵
  PID:11548
- C:\Windows\System\ZcUAaaY.exe
  C:\Windows\System\ZcUAaaY.exe
  2⤵
  PID:2064
- C:\Windows\System\RlZnVXt.exe
  C:\Windows\System\RlZnVXt.exe
  2⤵
  PID:3444
- C:\Windows\System\OzDZNub.exe
  C:\Windows\System\OzDZNub.exe
  2⤵
  PID:7528
- C:\Windows\System\INxYkHt.exe
  C:\Windows\System\INxYkHt.exe
  2⤵
  PID:4620
- C:\Windows\System\iSnQaCA.exe
  C:\Windows\System\iSnQaCA.exe
  2⤵
  PID:13136
- C:\Windows\System\IRnSXVi.exe
  C:\Windows\System\IRnSXVi.exe
  2⤵
  PID:12484
- C:\Windows\System\DqhoHDT.exe
  C:\Windows\System\DqhoHDT.exe
  2⤵
  PID:11312
- C:\Windows\System\tsJgQkz.exe
  C:\Windows\System\tsJgQkz.exe
  2⤵
  PID:9848
- C:\Windows\System\WCISSMJ.exe
  C:\Windows\System\WCISSMJ.exe
  2⤵
  PID:7164
- C:\Windows\System\tLjnRhP.exe
  C:\Windows\System\tLjnRhP.exe
  2⤵
  PID:12944
- C:\Windows\System\ckNXQnJ.exe
  C:\Windows\System\ckNXQnJ.exe
  2⤵
  PID:9892
- C:\Windows\System\RehnTTf.exe
  C:\Windows\System\RehnTTf.exe
  2⤵
  PID:9976
- C:\Windows\System\gaucuHG.exe
  C:\Windows\System\gaucuHG.exe
  2⤵
  PID:4260
- C:\Windows\System\wllwauz.exe
  C:\Windows\System\wllwauz.exe
  2⤵
  PID:12428
- C:\Windows\System\RiIoCNU.exe
  C:\Windows\System\RiIoCNU.exe
  2⤵
  PID:12532
- C:\Windows\System\KSRmWtb.exe
  C:\Windows\System\KSRmWtb.exe
  2⤵
  PID:13400
- C:\Windows\System\vxKESEL.exe
  C:\Windows\System\vxKESEL.exe
  2⤵
  PID:13420
- C:\Windows\System\KKYJhin.exe
  C:\Windows\System\KKYJhin.exe
  2⤵
  PID:13436
- C:\Windows\System\mXrmKnA.exe
  C:\Windows\System\mXrmKnA.exe
  2⤵
  PID:13540
- C:\Windows\System\WZJKomw.exe
  C:\Windows\System\WZJKomw.exe
  2⤵
  PID:13560
- C:\Windows\System\jzQlJBl.exe
  C:\Windows\System\jzQlJBl.exe
  2⤵
  PID:14172
- C:\Windows\System\FUovjxg.exe
  C:\Windows\System\FUovjxg.exe
  2⤵
  PID:14216
- C:\Windows\System\gjMvEqP.exe
  C:\Windows\System\gjMvEqP.exe
  2⤵
  PID:14236
- C:\Windows\System\qUtmNGc.exe
  C:\Windows\System\qUtmNGc.exe
  2⤵
  PID:14260
- C:\Windows\System\utEhzGX.exe
  C:\Windows\System\utEhzGX.exe
  2⤵
  PID:14300
- C:\Windows\System\IwUbBhc.exe
  C:\Windows\System\IwUbBhc.exe
  2⤵
  PID:14316
- C:\Windows\System\ruPrNKc.exe
  C:\Windows\System\ruPrNKc.exe
  2⤵
  PID:12544
- C:\Windows\System\tpoEVYb.exe
  C:\Windows\System\tpoEVYb.exe
  2⤵
  PID:12956
- C:\Windows\System\htyCUZM.exe
  C:\Windows\System\htyCUZM.exe
  2⤵
  PID:11424
- C:\Windows\System\jgHqzHA.exe
  C:\Windows\System\jgHqzHA.exe
  2⤵
  PID:4988
- C:\Windows\System\gqHtiWw.exe
  C:\Windows\System\gqHtiWw.exe
  2⤵
  PID:10032
- C:\Windows\System\XCfxItd.exe
  C:\Windows\System\XCfxItd.exe
  2⤵
  PID:3908
- C:\Windows\System\vBNEAnL.exe
  C:\Windows\System\vBNEAnL.exe
  2⤵
  PID:13332
- C:\Windows\System\oerTmAJ.exe
  C:\Windows\System\oerTmAJ.exe
  2⤵
  PID:13372
- C:\Windows\System\ZdThDJs.exe
  C:\Windows\System\ZdThDJs.exe
  2⤵
  PID:5160
- C:\Windows\System\WrKprWo.exe
  C:\Windows\System\WrKprWo.exe
  2⤵
  PID:10192
- C:\Windows\System\gbniBpX.exe
  C:\Windows\System\gbniBpX.exe
  2⤵
  PID:2308
- C:\Windows\System\koOMQDy.exe
  C:\Windows\System\koOMQDy.exe
  2⤵
  PID:13516
- C:\Windows\System\dwVaZWv.exe
  C:\Windows\System\dwVaZWv.exe
  2⤵
  PID:13680
- C:\Windows\System\zYwFIuu.exe
  C:\Windows\System\zYwFIuu.exe
  2⤵
  PID:13588
- C:\Windows\System\orRuiUw.exe
  C:\Windows\System\orRuiUw.exe
  2⤵
  PID:13716
- C:\Windows\System\gQIEhux.exe
  C:\Windows\System\gQIEhux.exe
  2⤵
  PID:13696
- C:\Windows\System\SOxBRgH.exe
  C:\Windows\System\SOxBRgH.exe
  2⤵
  PID:13448
- C:\Windows\System\wRRGsKl.exe
  C:\Windows\System\wRRGsKl.exe
  2⤵
  PID:13724
- C:\Windows\System\dEkKkgd.exe
  C:\Windows\System\dEkKkgd.exe
  2⤵
  PID:13784
- C:\Windows\System\iMosJHA.exe
  C:\Windows\System\iMosJHA.exe
  2⤵
  PID:13860
- C:\Windows\System\IlkLMtm.exe
  C:\Windows\System\IlkLMtm.exe
  2⤵
  PID:13772
- C:\Windows\System\DMfeEoO.exe
  C:\Windows\System\DMfeEoO.exe
  2⤵
  PID:13668
- C:\Windows\System\BrAACuR.exe
  C:\Windows\System\BrAACuR.exe
  2⤵
  PID:13460
- C:\Windows\System\DzKlBZr.exe
  C:\Windows\System\DzKlBZr.exe
  2⤵
  PID:7372
- C:\Windows\System\PuJCqTy.exe
  C:\Windows\System\PuJCqTy.exe
  2⤵
  PID:13940
- C:\Windows\System\EfAKaim.exe
  C:\Windows\System\EfAKaim.exe
  2⤵
  PID:13868
- C:\Windows\System\dRKAOSF.exe
  C:\Windows\System\dRKAOSF.exe
  2⤵
  PID:14056
- C:\Windows\System\ofimCHW.exe
  C:\Windows\System\ofimCHW.exe
  2⤵
  PID:11292
- C:\Windows\System\SudrHdI.exe
  C:\Windows\System\SudrHdI.exe
  2⤵
  PID:14180
- C:\Windows\System\vxZmmXx.exe
  C:\Windows\System\vxZmmXx.exe
  2⤵
  PID:4240
- C:\Windows\System\mklHSpA.exe
  C:\Windows\System\mklHSpA.exe
  2⤵
  PID:13528
- C:\Windows\System\LBwgOat.exe
  C:\Windows\System\LBwgOat.exe
  2⤵
  PID:13536
- C:\Windows\System\lbvqaIk.exe
  C:\Windows\System\lbvqaIk.exe
  2⤵
  PID:12396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3wnbkal2.j0a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DZxIQpD.exe

Filesize
1.6MB

MD5
926c9095d6fc4bbaceb616b1df96c1a0

SHA1
657c751c39d3062916281a75cdc8823fccfe6d4f

SHA256
340d64fd1b3ae9aba09104e2251d8b7a55c44f3ac28d0b7e4de6e5efba03cee9

SHA512
3be8a87f3ec926b9dce3956c8bb668c1091592f6829d651005aac19c4b844233e478ab706cb5cd9a93ebf1f20e5238709d6e6eb6890a4a10c6d61d010bcc1518

Download Submit
C:\Windows\System\EeXNhec.exe

Filesize
1.6MB

MD5
a054c76a4e976f4348076dc3217a7b0b

SHA1
cb75cb4fdf20c25893fa1f81c88a1a350f6423c5

SHA256
8e7bc7cb96db68a3aad5a1c584828a08ea772faf71d451ac2b86ff4610d4eb6c

SHA512
db35405a3d4aa1fde70606dfaaba34e953f1237fa08aa6a0af6be8643cf37998903229fbbded8a0a05bfdddf0fea5d876fa10272189c14b3920b8eb40cbdf6b4

Download Submit
C:\Windows\System\EpkAKSc.exe

Filesize
1.6MB

MD5
d16aab9d3265539580b248371651dba1

SHA1
371bbf6637d264e43f9455ff57f3fc3b9b0d5fb2

SHA256
748420828802f79f912391719c9456a0104443fafd42dc263d1de560dffd66a0

SHA512
240c7a67599ea713d6dba837f00488540964a624a871308d5a37fa3d7f20fd12b1ab43b4aedcc6de14b4d4d8c2c55cf36252af52229f308b48f0a05226cdae0d

Download Submit
C:\Windows\System\GXSbhXd.exe

Filesize
1.6MB

MD5
8ddae0e81ed79a2269950ddc062864b2

SHA1
edc0e41ae05fb5e99285189eb755bdb11d81f614

SHA256
1068dabc5df8660b11e569d24cfb8171b786e68de01a0f2958a2adb404e4c930

SHA512
115a0effeaec7e136ab3edaa74b1ca5728dab93028d630d7ad8bdc2812767a54bc69609cb758179d257e73304500f3cb0d1722df980aa43b7098a4f8b171ed8e

Download Submit
C:\Windows\System\GrfyVzO.exe

Filesize
1.6MB

MD5
23a42aae1df4d8444e016a076c7ffa84

SHA1
a5b201bd62323e8730c1d59dd64cf22601c07f1b

SHA256
b7289a95574ed4c9ca7fb1bcda3011412f64e9df941f4c65af6d6b8f6cc641e1

SHA512
4ce6e3f8a7101daa8e83e8ae7ab27f6fa3541d3e99a54112b9e87abfe9b5aeba5ff9ab5aeecfa31ce5da227bfa795cc6b594c9d06c6df854d7684d17c17c493b

Download Submit
C:\Windows\System\HVRJiVI.exe

Filesize
1.6MB

MD5
ab7410ef42c384e6ea7615d28806cf65

SHA1
8875cf18c045b46b3218d645cfb80d0408c0eb92

SHA256
f3282afa9184a3ffc127c437f8ebb3c241723ce9d6f6edf9e1f76214d393fbca

SHA512
3aeba74d501db66c068d59313c7548f927293c380acb36848b4c617f27b30d713d258518b34791c03897020c6e4e6f4c27ef524cf640fb7249043255de1736c1

Download Submit
C:\Windows\System\HwyJKVI.exe

Filesize
1.6MB

MD5
85cf8244c5093d430902556e5a7ae6ad

SHA1
b265d694abf89e16cb62a25ba4079febe2574837

SHA256
a3398c6aaf0ea5b5eb6dc6f982ca799f9d706dc6e2431867927996eee8a14e80

SHA512
206452f15f3996e4cf2f9d842bff9589511941d5bfa411e9ce1dbf3866860285323cf1819f49d91f34cc0f2e57d5ae393c0b9695473e52ccc405533933e8bda5

Download Submit
C:\Windows\System\KYoaaKg.exe

Filesize
1.6MB

MD5
9177edae62e1e1cdc37d1d8d300ad60f

SHA1
82cc14bca191649a4f688ed7c634d18089926d56

SHA256
c5cc448527500a3bb54ff986263ad172b6b61b3ef5c0dadf411adb08b6a1be10

SHA512
d037cb6a5078f52481d346fb4face9a146bf92f3a011b116a71c8b58b1a6dccd550081618569e73bf54f54eca8e1cc46908e18e359135b502677cdf909bd5de7

Download Submit
C:\Windows\System\KvBntOd.exe

Filesize
1.6MB

MD5
1ec2000d24cfc6dd3400092dda3c4e5e

SHA1
4432d421d6863839e5cf07f9ed4fdfd5580ea261

SHA256
351a39d4ba7678d842ae510285a552562b0e28be45d27da83aeccac06d22faf4

SHA512
62930b773a5346de0fbe13dc993fc6f4f7e46b7a4415ff2c0c1282993a09228953c97b4a1a46da277f33a690c396221de91cd71de828bf338f40a0fc2975c68e

Download Submit
C:\Windows\System\LwWRvNH.exe

Filesize
1.6MB

MD5
b38603608272da5660e908aa5c8e89ce

SHA1
d615d56c6a0360497e6865bf4e33ee938cdb5aa8

SHA256
4086aa8aea89c63bc69fe20c3b64394908ee2bc4c1b040055826e2466b2239ea

SHA512
bf5850b0cf24def9b25df0714ecdf2bd0780d9cb41d8a78e459ab93e2b7b8b23a71dd3aa509de09f39c7417f17248fbc2ed105a44493e5620d6b7da8dbbebc9c

Download Submit
C:\Windows\System\PBArdhO.exe

Filesize
1.6MB

MD5
3188a0503927a9b5e188b52db4967b42

SHA1
5fd86ef118690352cd1c5221c703d826516204cc

SHA256
d31254a178b46b4bd6a7687802c6e1deb9256a3d4c17a7a937018de63a3e700f

SHA512
ed022fba62bfbaf6451556d1aad46d7e05b627659ffd7c5728cc55d71e1fa1db975d52b628ed50c629b8349b7fa07a02e4032c3029810a3efc1d14db362bb6f5

Download Submit
C:\Windows\System\RTIdXiU.exe

Filesize
1.6MB

MD5
38aaadfb1f3f0720e9f4e0fd7680bf67

SHA1
59a57ca3c3c6439890ae5a2320c9142a7da8a44d

SHA256
fc2a6ab210761855a7995698470d808e44930397365f113c03bc85acc99b000b

SHA512
98a423a4c6ba09483453ca4fff85ff104822dd845907fec07dab369a041084d374eec7790ef1981c0f33a9eed859f3b096abf2f241388c795b7130870e774199

Download Submit
C:\Windows\System\VhpruId.exe

Filesize
1.6MB

MD5
fa56dbef92cb0fe6effffd1b39dec06d

SHA1
1ebd6265eb0fe6acdcce31808166427ea574bdae

SHA256
abdf92fdbb8fe02f88d92b1fb728d8c1a771e951d8befcbd839ed24c345f74d3

SHA512
0e5d12dc391d253eaaf5418029014cfde815ee9fcc5e04ed99c2a5b318c067da37c3084380fc185affc3d386d8bbac699c1f95bcc5741b02df2e61854fbcc5af

Download Submit
C:\Windows\System\WIfAqso.exe

Filesize
1.6MB

MD5
df41ad3dcd977f7ab958cb2029d144b4

SHA1
df64dd06fb1135eaf543f22633260acd16b00058

SHA256
31d85de7cf205577fac5315f0de86a7686aea0144445106f22c1e0de6f97bfd8

SHA512
621a347d3de2a975354634b1449e803d311b83ed3022530ed52a9cca345dcbd6456beb157a5c2a6764b241562896462af40d3f429fd4389441c53f682670d14a

Download Submit
C:\Windows\System\XYUshSL.exe

Filesize
1.6MB

MD5
8e61e1a46dd0001149b3f10746f19540

SHA1
f44eed1c09ebe85e09a8c5520f45d547d09dc1a6

SHA256
3cda35957dabb5c141d93c04761f10724acb94adb316f600273fd439b7568026

SHA512
dad82d1e2fadda25d906b4c87221838d883e4547bee9381f03ece7de6fc2a04cded4dba8ac01dfa68de39945cd9807526f94f1e7a3ea0cf204f54a88a253f0e9

Download Submit
C:\Windows\System\XYvtUdF.exe

Filesize
1.6MB

MD5
a96733b95c2abce8c86bb2d1d56be19d

SHA1
0e7ddb17eba2e50fa50613984433c1b7a45cb4cf

SHA256
a6386ba740694c372df707cd5bf789a41d5989a7a321193a4321c7db1e09dc4a

SHA512
b9aa75da69e6c754be1cb824d9e355dac3ee9d02a5aa6f6aed93eecdbdf4000dc6d6bb55eb3eea60632345c49e4e7781653cc5bf2f872599e21cadcfb06b164c

Download Submit
C:\Windows\System\XwRaXSo.exe

Filesize
1.6MB

MD5
e16a0bd93ce32fbd846b8c9214350fb7

SHA1
432c59166c497ccd1e0908c4314ce26153a38815

SHA256
a070e0a889edae5a595fd0cdda8bd38f47d4d9ac4ced4e3d175b5a053fffb6c8

SHA512
e482ecc6d558aa500e74201987064fe9e165632bc8517a028c3c29d309768f34a4f79e384a216940ae04e88f3cc4bc548415a7fbde12c01d268ef6202ebd0b43

Download Submit
C:\Windows\System\cihfezO.exe

Filesize
1.6MB

MD5
c35426be115fc1787e1c1b6f3f2b5cd0

SHA1
715ddcf0e0d5d6e2e305aba4cf6dca8992c3f15d

SHA256
06d57fa724c2e3499404ae98cf59bca0aa571ae2a2f30421ad56965816cfa4bd

SHA512
3b7077ef6082316e76865d21bd52bda86b74d7e3f85015d1d3397f5daa078b792f82e15c7a2ae0031ce45735a5d25a40255c5e3ffe3f4bf94cf032fabe5a9b71

Download Submit
C:\Windows\System\dblFJRj.exe

Filesize
1.6MB

MD5
d5265cc1e52e7bce0366d6828fafd329

SHA1
a4fc6b742512d02de7f14ed607d1695c5edc8883

SHA256
e18e89e6180686216ac491f025204bb5d1b6834f86ca6e94afd443f1835830f6

SHA512
4c297c422b61681c4b4af28bea268c3086beec10ed3d86a53ba6d76b220157bdb992c47edbe3bfce0c492b791ecbe8c92dcd442325acd1bd280c549157ac001e

Download Submit
C:\Windows\System\deDvVlR.exe

Filesize
1.6MB

MD5
f5077c3c7a0027a6357a2303bd472cfb

SHA1
dd70ae0cc81fde5e88720ac4ec6ab2aff9075b10

SHA256
b1f6efe024eb8b435a8e18dd8a2ff65ea36982b3f069ee050bfb542b39f589f4

SHA512
860b32a562979641c6502c1df27d0a98f305c43a0da18eba786afd55905d9d7f37c56aa7a36e763c4944f0b300ccd558c10a277ff60acd0d92bf2084c2645184

Download Submit
C:\Windows\System\eyQLkAv.exe

Filesize
1.6MB

MD5
6a847d62721908dfc7b2c202256dbae9

SHA1
d1a0825cae50431cffa4129f4d0d726e446416f4

SHA256
fc537975018a0ef969495ea6dc5dc43909d624016b4d4ba928bc6cdb83aaf2ca

SHA512
9012ba90e5e84ea2adf5f1bdb52ab7f9f61eb0b6a4e2508cc6b59e169a0eb239c665eda745e04e240b57d78db97a6b47a591fe58e139498315783e956634b7f5

Download Submit
C:\Windows\System\fyODhSp.exe

Filesize
1.6MB

MD5
5015623e2ac2d18784fc41e8330ab569

SHA1
29a79d8e428c9fe20e5e69121503755443523087

SHA256
b4bd15b7e2aa80178df4e58f81937416db9998254b6f59aba4bef107628b46a6

SHA512
d74280a613d4c0c4ba3dfab6abfe932457227a88b62ce1cd1266d060df8d8bff1f21e13631f1ef3c0bd33ced882bc70a3c5ef05f8359e132fcc270eecf56386e

Download Submit
C:\Windows\System\gJAdzMf.exe

Filesize
1.6MB

MD5
756cae45a47a6446889d909c66e24ae3

SHA1
63d205d0aa432311ab10d49b66495b637ebdc325

SHA256
966c7b74a9124334e6c4e4119652cde2223ebde982932def30509630a23cd9c4

SHA512
00b7cb7f6476a26ddeb6f888a4b7a26517e9c666a0169375ab978cc8684ee1a53a20bd95c968c96d60b689e8adadf86424716f318325c9c2567626b6a6b1d5a4

Download Submit
C:\Windows\System\hJtBPud.exe

Filesize
1.6MB

MD5
294babd7de49cb43cb7cc3dfd2657c1b

SHA1
ebd79190034b17bfadef3bb0b125d0f2200b214e

SHA256
617931ec97a66dacf54c6c2506af5c3250ddf7b7ac0715ecb9d07813216ca17a

SHA512
78266c2c0a3c13c1b42eed63c0112f0f20cc5b63e5710b4207df8befa90ecad95e96c4e1b7c42d7d04947ee6178529385aa7d1af4fb164fe0f23a76a2f1cfa99

Download Submit
C:\Windows\System\isMsHwy.exe

Filesize
1.6MB

MD5
f7b3f9adb8d1319414996f073ae03611

SHA1
3c89226926f8dab1f994c12c96cf27388ded4db6

SHA256
3aee8ca072209d29cc73805e734cf7e97d537e62ed145108de1dae92a139d8b6

SHA512
f62492343b0f6e5f5080a69da7d8b6d7e0a88fb16e5042c509b6c9caa50f275811cbc9a347c51fae8e7e5e95040e473a1d6b36f1843db1e20da6bd057a88c863

Download Submit
C:\Windows\System\jpUKmKs.exe

Filesize
1.6MB

MD5
cd08b423f65a92432ccbc48565e25246

SHA1
83fd7b4c0095b1970fe1acff22a449de7d4ef626

SHA256
ce9e6812e0ca2ebb296b6da3ab7b8ed1d6310bc1d7b14fafbdecbe5f9317ab97

SHA512
3aa3201825edc039a207db4292819d146689b89f452e4153c2c8dedf984ec4ffd6c153ff006e108d6bd3706644ae075d837b2bed6e92a875ab9edb9772264c46

Download Submit
C:\Windows\System\kMCRZWt.exe

Filesize
1.6MB

MD5
c790b62773dc8d49637a1cab85d4f984

SHA1
753abe11d5402b38ae41cc3a9bc89f58fd0343c6

SHA256
c9eeef1af0afb82b192c3c991085d1a4465d92b2fca49092162cfa26fa9a4800

SHA512
6b6e7539f73b77550daae9725cc8bf5a076b88ff2f548e7f8525633e3851f80f95fe74ad104f7ae989182d99b89f18535df110d76f7f4c89f7bf720f72af9ad8

Download Submit
C:\Windows\System\kcJDFjk.exe

Filesize
1.6MB

MD5
ad294b455cfeab4c6a6cd8fd9ac6abcd

SHA1
152ca2e9ecef717bd8e4ce83ca4fe7acd1b5e8e3

SHA256
3365c10020d8bcef9448dee168ab33b97a01c873527972fe284282c4d0c07018

SHA512
ecf38d0235fa6864b4159316fff71d6a0c112394892db74b65b3ab6f580f3da863a96b4dd77b2ace48a2789da670ba0b9e9dd1251607860dbb84c813f62c02fe

Download Submit
C:\Windows\System\mPLjspy.exe

Filesize
1.6MB

MD5
da107bad1334fe47cbf198ec65740dab

SHA1
dd8266302c375e0a62eb54c10e988eacb25e8026

SHA256
2e24532af41c0d6bcd1cc51bc6642cba1e9b849e5083bc297deb9e865ddb1574

SHA512
650c61ff7a04a01ad5c8538aa2029505614907af03ffa6674e74973fbf1588a062b4df5df8727270c62ac667b7f3d432dd4fa597c6a2915046bdbb68cdf68a9e

Download Submit
C:\Windows\System\nNyUNDe.exe

Filesize
1.6MB

MD5
7907c2e3faf71e087f6a3588db6d6be8

SHA1
558ae0d3a7f872b9b4b473fc628fdd4a6e2cf394

SHA256
1ac5d78e31e1e1d6e4d6b1db2ea17d8eae0e63dc8e01a9c4b8ad65b6c477d98b

SHA512
3c02d2343d74650ba7397eb104d2b0e831efe680c6cc075256bf6aec46f45cb7e9bf6dc7f6cd999956c078f1cca05e5f1d084211abdbca54b810c4eca11356d8

Download Submit
C:\Windows\System\omkQjzg.exe

Filesize
1.6MB

MD5
28836cd05811a13f93525ab06ac69aee

SHA1
d5496c210ae219ca4dd65835763cbee572ced4ca

SHA256
f56f38018131a17fd44f6bea75d3c68c1eb4db946db968cd1785ab6e97a06914

SHA512
c28ff3b794ac364977f707a51ea5c62f332d58312b7afcd9ddb2c079247593a71acba20d783a53edf9df8c93a262726bf4be33be74b7f7401af4d4602e4885c7

Download Submit
C:\Windows\System\pqxfnls.exe

Filesize
1.6MB

MD5
869f8915f9bd887a196625fb568ac2cc

SHA1
491c0efbf14b9b2eb73c81d40c97c8ce829bf57b

SHA256
18e6c19b118248c4a2cd2cbe6c5236debe5eb17d7f0ca79e1d867363153cdfa2

SHA512
b58bd71d90b57a9ce8a6bf13eaf93272c7e5740292b6b59dcccd7b2b7a281a63518048571717baf4db78f466cd6b58792f2a5c5b9393fb1ffc477b9834e19120

Download Submit
C:\Windows\System\qEbejmH.exe

Filesize
1.6MB

MD5
80549d9a522ec2503e8dd3a914716281

SHA1
f9bce9f6509937448f655d7ad3c9687dc73d978f

SHA256
7a664e4f61c631000250349b566efc1414741e40c5771f0abcec51468c460bb5

SHA512
e42cff4dc5019c1ad520443482fbe324f9872d4dad47b395a4ce8bc100a927c1b6226e4b431fad4f8e8c50c1eac790891f38be9a4f9a1dc9b4fc006396afb3da

Download Submit
C:\Windows\System\qHXznBU.exe

Filesize
1.6MB

MD5
ae19174e806d71efae569f0e26f13086

SHA1
2ca912a88a3efc7ef6e6d1e42a467d20372d29cc

SHA256
221e4d617b33b496c2128996012dfd600d1d72993bb4bf9b2e54f1a47805eaba

SHA512
a302ab365d00ad0962cafbc5dab65b03ecfdf0f05ed454acce4d8533d309341ffb669379da2f6447df20aa61124a24de3c59cd1c97d3e10430d2199681354de2

Download Submit
C:\Windows\System\qXOTHfw.exe

Filesize
1.6MB

MD5
210d3a90ecef9f2dae128c7c02befb4f

SHA1
7b29b8034a80977eea18452e697da3e2641a32ac

SHA256
4e812c7cfbb23b54e6e2730e8f7d473e921db1a32ac783a376c7772a05abc0e7

SHA512
3741124d18c6530b6e29dfe3724e98f0f2ab52e043cd782937dfa7b9618021344b8575db6e7a7111160e3b3a8887ba1784b33fe00792a4d2ffacb7ee8c46ad67

Download Submit
C:\Windows\System\tPwKjaU.exe

Filesize
1.6MB

MD5
2ee9fdc520d2166e05844031b713086e

SHA1
c4a4f9b4307c992004f8167374429e894f963ae4

SHA256
a1958230f46346f587830b882ec722ef52862a59cd0ff89d2c1f8205c6ae368b

SHA512
158c9ae98dbdba615144a4145c3e855800a1e0fbbdde3c42717d4a2c0cb1717ea163ff44a22e63b0182dc459a2a0cffa9175c83142afc4ecf18ba438b997fded

Download Submit
C:\Windows\System\uHUskVs.exe

Filesize
1.6MB

MD5
4530b100b1e058e9c1791f8722a5ee9a

SHA1
1f27052b0503d69f48a0568218239416496f5324

SHA256
2c047d8cedb58ac2430d19af63480b14a3493a706d825bd5755842c2a918b6ad

SHA512
549a47a1af1044a38cf2f925b98942934f09b496f793dac726ef6a0db5592103213e229a1090190ab2db3d1dc98d379195c8a37cb1deb8e0ae72e51cb3e0fc96

Download Submit
C:\Windows\System\vOGWord.exe

Filesize
8B

MD5
66bd487d69202ef8b2b1bb2e1931ebf3

SHA1
6297e827d2cc12ba96555851f82fc059665704b0

SHA256
4443ea8760d035c6b4f05df6df4c7e7ad9c5afa8dead954bce57dab5a5afcf1e

SHA512
9e09fc0a19c454ee0cecdc74d2823aed9c4a94ebbcd2ca5a3004beafcda66afd0bc9b7ffcaee69b05991566849eedce2fe3d3b28ecd596511f3194e8d04c5acc

Download Submit
C:\Windows\System\xPSPvRP.exe

Filesize
1.6MB

MD5
931af60c4eb1b6c7cf7a8009c00134bb

SHA1
9781becdb43ea9ebc5c38ac3b0fa2a4f49fb7f5d

SHA256
825172805c38ce23d261a335cc284e759908556a31a17af567b4edf9b71982a3

SHA512
2c79cae45bd300330553a31fb5fcce43a13a182e48ab9e69b3949cd104ef432a658ed792c753146a08ac48f5cc3b113b9d872c39d60e63d42a0be1e2dfb6cc47

Download Submit
C:\Windows\System\xeKxCQQ.exe

Filesize
1.6MB

MD5
25bea3b6c56e421858973176dfd36014

SHA1
2a0861fbc1fc7e742aff845059453d34b4c32400

SHA256
73ef7fbcf810089b88ab3970a5f51e4e3a756082ec2879d4efd6c8c621375174

SHA512
87f186062c2ceeaa3a31122ebb0b39608f065e577b8d100f3dd7028afbbdd18bab65e2127c68cf589b8ebac6af21d79fd4d3b5fec89ad97415e333062f018901

Download Submit
C:\Windows\System\zdKZbZz.exe

Filesize
1.6MB

MD5
0fdf8385fdb9f5b0a82e53887f75e49e

SHA1
88051d28370dc6e4fa70c6ab575beac77f1f6017

SHA256
a34d5f5d0203e7b27f5e8cb1a13d2ddb233f8c58eb20e8e362b763edfaa10fe9

SHA512
f84512208085da78d3b5d893cbe1411229e95330510ccf27f8cfa6a7dbc45cbcc67b8a700733c4619125aaad4a84a79b7cb196a1db60a87b7b0189cf70ed2e15

Download Submit
C:\Windows\System\zoLPdNO.exe

Filesize
1.6MB

MD5
230ea216e06abd7e6724d59d8a0520fe

SHA1
37f1ad181bb9aa76d7bb766240c011334733fbeb

SHA256
2ab1d8c7188f882453fc8e6a60172a5cc7a09b0bc6cf706e1f583ad7187723e5

SHA512
67eb1aeee1357077f42a87d94e4b1512e4bfb1acab89304fa6eec07f8a3546f69015c5c08e14a606e473143418d22a3ec0d5533c4183dea2fabe2cbe05c5ed89

Download Submit
memory/432-1043-0x00007FF743460000-0x00007FF743852000-memory.dmp

Filesize
3.9MB

Download
memory/432-4397-0x00007FF743460000-0x00007FF743852000-memory.dmp

Filesize
3.9MB

Download
memory/548-624-0x00007FF695AB0000-0x00007FF695EA2000-memory.dmp

Filesize
3.9MB

Download
memory/548-4400-0x00007FF695AB0000-0x00007FF695EA2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-4393-0x00007FF669690000-0x00007FF669A82000-memory.dmp

Filesize
3.9MB

Download
memory/1040-628-0x00007FF669690000-0x00007FF669A82000-memory.dmp

Filesize
3.9MB

Download
memory/1168-620-0x00007FF647C00000-0x00007FF647FF2000-memory.dmp

Filesize
3.9MB

Download
memory/1168-4391-0x00007FF647C00000-0x00007FF647FF2000-memory.dmp

Filesize
3.9MB

Download
memory/1704-18-0x00007FF7A5AD0000-0x00007FF7A5EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1704-4365-0x00007FF7A5AD0000-0x00007FF7A5EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1828-4379-0x00007FF6E5D40000-0x00007FF6E6132000-memory.dmp

Filesize
3.9MB

Download
memory/1828-623-0x00007FF6E5D40000-0x00007FF6E6132000-memory.dmp

Filesize
3.9MB

Download
memory/1896-587-0x00007FF6F0AD0000-0x00007FF6F0EC2000-memory.dmp

Filesize
3.9MB

Download
memory/1896-4369-0x00007FF6F0AD0000-0x00007FF6F0EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2260-4411-0x00007FF6049D0000-0x00007FF604DC2000-memory.dmp

Filesize
3.9MB

Download
memory/2260-1203-0x00007FF6049D0000-0x00007FF604DC2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-4386-0x00007FF7A4940000-0x00007FF7A4D32000-memory.dmp

Filesize
3.9MB

Download
memory/2572-618-0x00007FF7A4940000-0x00007FF7A4D32000-memory.dmp

Filesize
3.9MB

Download
memory/2832-1219-0x00007FF7F61C0000-0x00007FF7F65B2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-4377-0x00007FF7F61C0000-0x00007FF7F65B2000-memory.dmp

Filesize
3.9MB

Download
memory/3120-4406-0x00007FF755B10000-0x00007FF755F02000-memory.dmp

Filesize
3.9MB

Download
memory/3120-1041-0x00007FF755B10000-0x00007FF755F02000-memory.dmp

Filesize
3.9MB

Download
memory/3336-369-0x00007FF61ADA0000-0x00007FF61B192000-memory.dmp

Filesize
3.9MB

Download
memory/3336-4373-0x00007FF61ADA0000-0x00007FF61B192000-memory.dmp

Filesize
3.9MB

Download
memory/3488-4367-0x00007FF769420000-0x00007FF769812000-memory.dmp

Filesize
3.9MB

Download
memory/3488-1205-0x00007FF769420000-0x00007FF769812000-memory.dmp

Filesize
3.9MB

Download
memory/3572-787-0x00007FF70AEE0000-0x00007FF70B2D2000-memory.dmp

Filesize
3.9MB

Download
memory/3572-4383-0x00007FF70AEE0000-0x00007FF70B2D2000-memory.dmp

Filesize
3.9MB

Download
memory/3676-4395-0x00007FF7D72E0000-0x00007FF7D76D2000-memory.dmp

Filesize
3.9MB

Download
memory/3676-626-0x00007FF7D72E0000-0x00007FF7D76D2000-memory.dmp

Filesize
3.9MB

Download
memory/3708-4402-0x00007FF609770000-0x00007FF609B62000-memory.dmp

Filesize
3.9MB

Download
memory/3708-1220-0x00007FF609770000-0x00007FF609B62000-memory.dmp

Filesize
3.9MB

Download
memory/3812-1-0x0000023D701A0000-0x0000023D701B0000-memory.dmp

Filesize
64KB

Download
memory/3812-0-0x00007FF79B1F0000-0x00007FF79B5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3992-4388-0x00007FF772D70000-0x00007FF773162000-memory.dmp

Filesize
3.9MB

Download
memory/3992-622-0x00007FF772D70000-0x00007FF773162000-memory.dmp

Filesize
3.9MB

Download
memory/4104-460-0x00007FF6D8470000-0x00007FF6D8862000-memory.dmp

Filesize
3.9MB

Download
memory/4104-4372-0x00007FF6D8470000-0x00007FF6D8862000-memory.dmp

Filesize
3.9MB

Download
memory/4108-627-0x00007FF797EA0000-0x00007FF798292000-memory.dmp

Filesize
3.9MB

Download
memory/4108-4382-0x00007FF797EA0000-0x00007FF798292000-memory.dmp

Filesize
3.9MB

Download
memory/4228-4375-0x00007FF66FE10000-0x00007FF670202000-memory.dmp

Filesize
3.9MB

Download
memory/4228-365-0x00007FF66FE10000-0x00007FF670202000-memory.dmp

Filesize
3.9MB

Download
memory/4548-621-0x00007FF6340B0000-0x00007FF6344A2000-memory.dmp

Filesize
3.9MB

Download
memory/4548-4416-0x00007FF6340B0000-0x00007FF6344A2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-625-0x00007FF6C61C0000-0x00007FF6C65B2000-memory.dmp

Filesize
3.9MB

Download
memory/4652-4433-0x00007FF6C61C0000-0x00007FF6C65B2000-memory.dmp

Filesize
3.9MB

Download
memory/4828-4404-0x00007FF794730000-0x00007FF794B22000-memory.dmp

Filesize
3.9MB

Download
memory/4828-872-0x00007FF794730000-0x00007FF794B22000-memory.dmp

Filesize
3.9MB

Download
memory/4996-4398-0x00007FF672F50000-0x00007FF673342000-memory.dmp

Filesize
3.9MB

Download
memory/4996-1201-0x00007FF672F50000-0x00007FF673342000-memory.dmp

Filesize
3.9MB

Download
memory/5072-230-0x000002A0F6FC0000-0x000002A0F6FE2000-memory.dmp

Filesize
136KB

Download
memory/5072-104-0x00007FFB795C0000-0x00007FFB7A081000-memory.dmp

Filesize
10.8MB

Download
memory/5072-21-0x00007FFB795C3000-0x00007FFB795C5000-memory.dmp

Filesize
8KB

Download
memory/5072-195-0x00007FFB795C0000-0x00007FFB7A081000-memory.dmp

Filesize
10.8MB

Download