xmrig | eebd538d16bbead19a7d1be2ca1a112cb15c21315341c0775c621c6bd66293f4

Analysis

max time kernel
147s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
Size

1.9MB
MD5

874c4fae506d8c99d61354f474986cd0
SHA1

2c0e094b394029aa917769ce3a69a70ceca922c7
SHA256

eebd538d16bbead19a7d1be2ca1a112cb15c21315341c0775c621c6bd66293f4
SHA512

ce35cf6c33b10d7d314f8c8fdf1d8a304a0543bae04d72ed59af4cd831d7c89ded18f13a94dddfcf3ce93ba37d1e9dcdbd7e3b261f328616cfb021d1df35fa38
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtJ:Lz071uv4BPMkibTIA5I4TNrpDGfFzcVs

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3096-511-0x00007FF6B6770000-0x00007FF6B6B62000-memory.dmp	xmrig
behavioral2/memory/2760-515-0x00007FF62A950000-0x00007FF62AD42000-memory.dmp	xmrig
behavioral2/memory/1032-517-0x00007FF7C6010000-0x00007FF7C6402000-memory.dmp	xmrig
behavioral2/memory/3576-522-0x00007FF612830000-0x00007FF612C22000-memory.dmp	xmrig
behavioral2/memory/1464-525-0x00007FF681900000-0x00007FF681CF2000-memory.dmp	xmrig
behavioral2/memory/4724-529-0x00007FF797830000-0x00007FF797C22000-memory.dmp	xmrig
behavioral2/memory/4960-530-0x00007FF65EB50000-0x00007FF65EF42000-memory.dmp	xmrig
behavioral2/memory/2380-528-0x00007FF61DDD0000-0x00007FF61E1C2000-memory.dmp	xmrig
behavioral2/memory/4496-527-0x00007FF688E70000-0x00007FF689262000-memory.dmp	xmrig
behavioral2/memory/1336-526-0x00007FF6F6CD0000-0x00007FF6F70C2000-memory.dmp	xmrig
behavioral2/memory/2384-524-0x00007FF78D780000-0x00007FF78DB72000-memory.dmp	xmrig
behavioral2/memory/2688-523-0x00007FF6902A0000-0x00007FF690692000-memory.dmp	xmrig
behavioral2/memory/3672-521-0x00007FF67F5A0000-0x00007FF67F992000-memory.dmp	xmrig
behavioral2/memory/3568-520-0x00007FF759490000-0x00007FF759882000-memory.dmp	xmrig
behavioral2/memory/4552-519-0x00007FF643A30000-0x00007FF643E22000-memory.dmp	xmrig
behavioral2/memory/388-518-0x00007FF77CAF0000-0x00007FF77CEE2000-memory.dmp	xmrig
behavioral2/memory/4300-516-0x00007FF7B6C00000-0x00007FF7B6FF2000-memory.dmp	xmrig
behavioral2/memory/3324-512-0x00007FF676D70000-0x00007FF677162000-memory.dmp	xmrig
behavioral2/memory/2036-458-0x00007FF78B600000-0x00007FF78B9F2000-memory.dmp	xmrig
behavioral2/memory/1036-353-0x00007FF67E430000-0x00007FF67E822000-memory.dmp	xmrig
behavioral2/memory/220-340-0x00007FF6135A0000-0x00007FF613992000-memory.dmp	xmrig
behavioral2/memory/2132-339-0x00007FF781490000-0x00007FF781882000-memory.dmp	xmrig
behavioral2/memory/2156-307-0x00007FF68C560000-0x00007FF68C952000-memory.dmp	xmrig
behavioral2/memory/2988-227-0x00007FF6ADB40000-0x00007FF6ADF32000-memory.dmp	xmrig
behavioral2/memory/4724-3005-0x00007FF797830000-0x00007FF797C22000-memory.dmp	xmrig
behavioral2/memory/2132-3007-0x00007FF781490000-0x00007FF781882000-memory.dmp	xmrig
behavioral2/memory/2156-3009-0x00007FF68C560000-0x00007FF68C952000-memory.dmp	xmrig
behavioral2/memory/220-3011-0x00007FF6135A0000-0x00007FF613992000-memory.dmp	xmrig
behavioral2/memory/4552-3019-0x00007FF643A30000-0x00007FF643E22000-memory.dmp	xmrig
behavioral2/memory/1036-3017-0x00007FF67E430000-0x00007FF67E822000-memory.dmp	xmrig
behavioral2/memory/2988-3021-0x00007FF6ADB40000-0x00007FF6ADF32000-memory.dmp	xmrig
behavioral2/memory/3324-3026-0x00007FF676D70000-0x00007FF677162000-memory.dmp	xmrig
behavioral2/memory/3096-3023-0x00007FF6B6770000-0x00007FF6B6B62000-memory.dmp	xmrig
behavioral2/memory/2036-3015-0x00007FF78B600000-0x00007FF78B9F2000-memory.dmp	xmrig
behavioral2/memory/4960-3014-0x00007FF65EB50000-0x00007FF65EF42000-memory.dmp	xmrig
behavioral2/memory/2688-3027-0x00007FF6902A0000-0x00007FF690692000-memory.dmp	xmrig
behavioral2/memory/4300-3029-0x00007FF7B6C00000-0x00007FF7B6FF2000-memory.dmp	xmrig
behavioral2/memory/1464-3058-0x00007FF681900000-0x00007FF681CF2000-memory.dmp	xmrig
behavioral2/memory/3568-3061-0x00007FF759490000-0x00007FF759882000-memory.dmp	xmrig
behavioral2/memory/2380-3051-0x00007FF61DDD0000-0x00007FF61E1C2000-memory.dmp	xmrig
behavioral2/memory/4496-3050-0x00007FF688E70000-0x00007FF689262000-memory.dmp	xmrig
behavioral2/memory/3576-3046-0x00007FF612830000-0x00007FF612C22000-memory.dmp	xmrig
behavioral2/memory/2760-3045-0x00007FF62A950000-0x00007FF62AD42000-memory.dmp	xmrig
behavioral2/memory/1032-3042-0x00007FF7C6010000-0x00007FF7C6402000-memory.dmp	xmrig
behavioral2/memory/1336-3040-0x00007FF6F6CD0000-0x00007FF6F70C2000-memory.dmp	xmrig
behavioral2/memory/3672-3034-0x00007FF67F5A0000-0x00007FF67F992000-memory.dmp	xmrig
behavioral2/memory/2384-3038-0x00007FF78D780000-0x00007FF78DB72000-memory.dmp	xmrig
behavioral2/memory/388-3032-0x00007FF77CAF0000-0x00007FF77CEE2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3092	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4724	VPRkHhv.exe
2988	KyrQXkD.exe
2156	JurxMqv.exe
2132	LiPdlfb.exe
220	miDHYUQ.exe
1036	tgOIWVb.exe
2036	REZnytR.exe
3096	IbtPUAX.exe
3324	YYdwdia.exe
2760	AfhYofJ.exe
4960	QfgaTtc.exe
4300	OXPrSYs.exe
1032	DEbHbLo.exe
388	sKNeLeB.exe
4552	YaBXwgV.exe
3568	ROtQCND.exe
3672	vvHoAvW.exe
3576	PgtZnpw.exe
2688	ktHSHfj.exe
2384	CXzBXdg.exe
1464	mZyIsiE.exe
1336	yHDOvGF.exe
4496	vOlMtLY.exe
2380	zmGeYBP.exe
4264	cpsTSsT.exe
3876	UsgTpvq.exe
1956	FzMIBse.exe
1812	uCMjOSe.exe
1752	HcnBsDx.exe
3740	UysYMyN.exe
1760	QYrVscs.exe
1872	ZYoDOKh.exe
1516	CAzIoGZ.exe
4276	cWvWSey.exe
4620	zhHNSxQ.exe
1660	nUraAxr.exe
4228	VoEDcTI.exe
4676	DFOWKBi.exe
1148	fAfscCN.exe
4776	ogYzXuO.exe
1608	FklfNUX.exe
1680	JmbLNrC.exe
1404	IzUXbks.exe
3628	EfDpwMY.exe
4392	iwWnbSM.exe
3636	bdkKCrN.exe
60	MjSmxOs.exe
4184	NNGISVp.exe
4836	kuhkauc.exe
4632	OMkXyrg.exe
3552	KeiMkbu.exe
3812	EYNCyyc.exe
3856	waFJxEB.exe
2000	otMemwW.exe
4636	oOvnJrF.exe
2492	LeCUiyZ.exe
764	XCjaVvO.exe
4944	CEHRvyI.exe
1912	gvnPtzF.exe
1440	QpHZDfo.exe
2512	wjjXAiu.exe
4348	ebgLIKq.exe
4520	yBKEAzl.exe
1836	rYAiees.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1296-0-0x00007FF694EF0000-0x00007FF6952E2000-memory.dmp	upx
behavioral2/files/0x0007000000023405-16.dat	upx
behavioral2/files/0x000700000002340e-57.dat	upx
behavioral2/files/0x0007000000023414-91.dat	upx
behavioral2/memory/3096-511-0x00007FF6B6770000-0x00007FF6B6B62000-memory.dmp	upx
behavioral2/memory/2760-515-0x00007FF62A950000-0x00007FF62AD42000-memory.dmp	upx
behavioral2/memory/1032-517-0x00007FF7C6010000-0x00007FF7C6402000-memory.dmp	upx
behavioral2/memory/3576-522-0x00007FF612830000-0x00007FF612C22000-memory.dmp	upx
behavioral2/memory/1464-525-0x00007FF681900000-0x00007FF681CF2000-memory.dmp	upx
behavioral2/memory/4724-529-0x00007FF797830000-0x00007FF797C22000-memory.dmp	upx
behavioral2/memory/4960-530-0x00007FF65EB50000-0x00007FF65EF42000-memory.dmp	upx
behavioral2/memory/2380-528-0x00007FF61DDD0000-0x00007FF61E1C2000-memory.dmp	upx
behavioral2/memory/4496-527-0x00007FF688E70000-0x00007FF689262000-memory.dmp	upx
behavioral2/memory/1336-526-0x00007FF6F6CD0000-0x00007FF6F70C2000-memory.dmp	upx
behavioral2/memory/2384-524-0x00007FF78D780000-0x00007FF78DB72000-memory.dmp	upx
behavioral2/memory/2688-523-0x00007FF6902A0000-0x00007FF690692000-memory.dmp	upx
behavioral2/memory/3672-521-0x00007FF67F5A0000-0x00007FF67F992000-memory.dmp	upx
behavioral2/memory/3568-520-0x00007FF759490000-0x00007FF759882000-memory.dmp	upx
behavioral2/memory/4552-519-0x00007FF643A30000-0x00007FF643E22000-memory.dmp	upx
behavioral2/memory/388-518-0x00007FF77CAF0000-0x00007FF77CEE2000-memory.dmp	upx
behavioral2/memory/4300-516-0x00007FF7B6C00000-0x00007FF7B6FF2000-memory.dmp	upx
behavioral2/memory/3324-512-0x00007FF676D70000-0x00007FF677162000-memory.dmp	upx
behavioral2/memory/2036-458-0x00007FF78B600000-0x00007FF78B9F2000-memory.dmp	upx
behavioral2/memory/1036-353-0x00007FF67E430000-0x00007FF67E822000-memory.dmp	upx
behavioral2/memory/220-340-0x00007FF6135A0000-0x00007FF613992000-memory.dmp	upx
behavioral2/memory/2132-339-0x00007FF781490000-0x00007FF781882000-memory.dmp	upx
behavioral2/memory/2156-307-0x00007FF68C560000-0x00007FF68C952000-memory.dmp	upx
behavioral2/memory/2988-227-0x00007FF6ADB40000-0x00007FF6ADF32000-memory.dmp	upx
behavioral2/files/0x0007000000023419-188.dat	upx
behavioral2/files/0x000700000002342b-183.dat	upx
behavioral2/files/0x0007000000023425-182.dat	upx
behavioral2/files/0x0007000000023418-176.dat	upx
behavioral2/files/0x000700000002342a-175.dat	upx
behavioral2/files/0x0007000000023429-174.dat	upx
behavioral2/files/0x0008000000023401-173.dat	upx
behavioral2/files/0x0007000000023428-167.dat	upx
behavioral2/files/0x000700000002340f-166.dat	upx
behavioral2/files/0x0007000000023415-157.dat	upx
behavioral2/files/0x0007000000023426-153.dat	upx
behavioral2/files/0x0007000000023413-186.dat	upx
behavioral2/files/0x0007000000023424-149.dat	upx
behavioral2/files/0x0007000000023417-178.dat	upx
behavioral2/files/0x0007000000023410-143.dat	upx
behavioral2/files/0x0007000000023423-142.dat	upx
behavioral2/files/0x0007000000023422-141.dat	upx
behavioral2/files/0x0007000000023421-138.dat	upx
behavioral2/files/0x0007000000023420-135.dat	upx
behavioral2/files/0x000700000002341f-134.dat	upx
behavioral2/files/0x000700000002341e-131.dat	upx
behavioral2/files/0x000700000002341d-126.dat	upx
behavioral2/files/0x000700000002341c-125.dat	upx
behavioral2/files/0x000700000002341b-124.dat	upx
behavioral2/files/0x000700000002341a-123.dat	upx
behavioral2/files/0x0007000000023411-116.dat	upx
behavioral2/files/0x0007000000023416-109.dat	upx
behavioral2/files/0x000700000002340c-108.dat	upx
behavioral2/files/0x000700000002340b-102.dat	upx
behavioral2/files/0x000700000002340a-97.dat	upx
behavioral2/files/0x000700000002340d-86.dat	upx
behavioral2/files/0x0007000000023407-77.dat	upx
behavioral2/files/0x0007000000023409-75.dat	upx
behavioral2/files/0x0007000000023412-73.dat	upx
behavioral2/files/0x0008000000023400-58.dat	upx
behavioral2/files/0x0007000000023408-63.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WPQCIgd.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\qTJmrJu.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\reBqqCr.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\nztIThB.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\QJOalrX.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\LLTFkno.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\JDGqqHd.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\JHFQsdK.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\Dguuvor.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\HcnBsDx.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\wVVdGpY.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\mdUeLsO.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\IgSYLEd.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\qUiWuye.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\QiIWCvc.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\BZkzMSN.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\XrwQRTR.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\lqMVTLr.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\rLGHHQL.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\jEeYMbt.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\cvkklSR.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\nGppAsK.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\HvfciCq.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\cPqBoNw.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\IFgSXnS.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\AtGbUJU.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\gaVqTgX.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\rIbaxZu.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\gNqlfHE.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\GFefeuk.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\YuHzxAw.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\XIxVfVk.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\LoLwQiP.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\JeOejZA.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\ulkYUMq.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\NhhJFKP.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\mYPndms.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\bWVUJpu.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\IpEFXyx.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\UpVyrfg.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\ksPsrUJ.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\BrZxuHT.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\tNIdXEi.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\wfRjfms.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\AFGEKjd.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\QwvIVVi.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\nRHWjWV.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\jDWfmuW.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\TCgzrRg.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\IMuANRA.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\tLnkARD.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\ITAGWJb.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\tSKmgDw.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\ZRsmefW.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\XVCLHlH.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\MPhdxID.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\YrUAwQa.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\ybILFAi.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\pDGPnfc.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\WncQofC.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\LvPOQGR.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\zNFuzyj.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\shTFQtq.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
File created	C:\Windows\System\AzvRRdS.exe	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3092	powershell.exe
3092	powershell.exe
3092	powershell.exe
3092	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3092	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 3092	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	84
PID 1296 wrote to memory of 3092	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	84
PID 1296 wrote to memory of 2988	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	85
PID 1296 wrote to memory of 2988	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	85
PID 1296 wrote to memory of 4724	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	86
PID 1296 wrote to memory of 4724	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	86
PID 1296 wrote to memory of 2156	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	87
PID 1296 wrote to memory of 2156	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	87
PID 1296 wrote to memory of 2132	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	88
PID 1296 wrote to memory of 2132	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	88
PID 1296 wrote to memory of 2036	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	89
PID 1296 wrote to memory of 2036	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	89
PID 1296 wrote to memory of 220	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	90
PID 1296 wrote to memory of 220	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	90
PID 1296 wrote to memory of 1036	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	91
PID 1296 wrote to memory of 1036	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	91
PID 1296 wrote to memory of 3096	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	92
PID 1296 wrote to memory of 3096	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	92
PID 1296 wrote to memory of 3324	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	93
PID 1296 wrote to memory of 3324	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	93
PID 1296 wrote to memory of 2760	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	94
PID 1296 wrote to memory of 2760	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	94
PID 1296 wrote to memory of 4960	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	95
PID 1296 wrote to memory of 4960	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	95
PID 1296 wrote to memory of 4300	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	96
PID 1296 wrote to memory of 4300	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	96
PID 1296 wrote to memory of 1032	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	97
PID 1296 wrote to memory of 1032	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	97
PID 1296 wrote to memory of 388	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	98
PID 1296 wrote to memory of 388	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	98
PID 1296 wrote to memory of 1464	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	99
PID 1296 wrote to memory of 1464	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	99
PID 1296 wrote to memory of 4552	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	100
PID 1296 wrote to memory of 4552	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	100
PID 1296 wrote to memory of 3568	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	101
PID 1296 wrote to memory of 3568	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	101
PID 1296 wrote to memory of 3672	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	102
PID 1296 wrote to memory of 3672	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	102
PID 1296 wrote to memory of 3576	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	103
PID 1296 wrote to memory of 3576	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	103
PID 1296 wrote to memory of 2688	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	104
PID 1296 wrote to memory of 2688	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	104
PID 1296 wrote to memory of 2384	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	105
PID 1296 wrote to memory of 2384	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	105
PID 1296 wrote to memory of 1336	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	106
PID 1296 wrote to memory of 1336	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	106
PID 1296 wrote to memory of 4496	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	107
PID 1296 wrote to memory of 4496	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	107
PID 1296 wrote to memory of 2380	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	108
PID 1296 wrote to memory of 2380	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	108
PID 1296 wrote to memory of 4264	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	109
PID 1296 wrote to memory of 4264	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	109
PID 1296 wrote to memory of 3876	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	110
PID 1296 wrote to memory of 3876	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	110
PID 1296 wrote to memory of 1956	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	111
PID 1296 wrote to memory of 1956	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	111
PID 1296 wrote to memory of 1812	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	112
PID 1296 wrote to memory of 1812	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	112
PID 1296 wrote to memory of 1752	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	113
PID 1296 wrote to memory of 1752	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	113
PID 1296 wrote to memory of 3740	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	114
PID 1296 wrote to memory of 3740	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	114
PID 1296 wrote to memory of 1760	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	115
PID 1296 wrote to memory of 1760	1296	874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\874c4fae506d8c99d61354f474986cd0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3092
- C:\Windows\System\KyrQXkD.exe
  C:\Windows\System\KyrQXkD.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\VPRkHhv.exe
  C:\Windows\System\VPRkHhv.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\JurxMqv.exe
  C:\Windows\System\JurxMqv.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\LiPdlfb.exe
  C:\Windows\System\LiPdlfb.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\REZnytR.exe
  C:\Windows\System\REZnytR.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\miDHYUQ.exe
  C:\Windows\System\miDHYUQ.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\tgOIWVb.exe
  C:\Windows\System\tgOIWVb.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\IbtPUAX.exe
  C:\Windows\System\IbtPUAX.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\YYdwdia.exe
  C:\Windows\System\YYdwdia.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\AfhYofJ.exe
  C:\Windows\System\AfhYofJ.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\QfgaTtc.exe
  C:\Windows\System\QfgaTtc.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\OXPrSYs.exe
  C:\Windows\System\OXPrSYs.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\DEbHbLo.exe
  C:\Windows\System\DEbHbLo.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\sKNeLeB.exe
  C:\Windows\System\sKNeLeB.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\mZyIsiE.exe
  C:\Windows\System\mZyIsiE.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\YaBXwgV.exe
  C:\Windows\System\YaBXwgV.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\ROtQCND.exe
  C:\Windows\System\ROtQCND.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\vvHoAvW.exe
  C:\Windows\System\vvHoAvW.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\PgtZnpw.exe
  C:\Windows\System\PgtZnpw.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\ktHSHfj.exe
  C:\Windows\System\ktHSHfj.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\CXzBXdg.exe
  C:\Windows\System\CXzBXdg.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\yHDOvGF.exe
  C:\Windows\System\yHDOvGF.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\vOlMtLY.exe
  C:\Windows\System\vOlMtLY.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\zmGeYBP.exe
  C:\Windows\System\zmGeYBP.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\cpsTSsT.exe
  C:\Windows\System\cpsTSsT.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\UsgTpvq.exe
  C:\Windows\System\UsgTpvq.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\FzMIBse.exe
  C:\Windows\System\FzMIBse.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\uCMjOSe.exe
  C:\Windows\System\uCMjOSe.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\HcnBsDx.exe
  C:\Windows\System\HcnBsDx.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\UysYMyN.exe
  C:\Windows\System\UysYMyN.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\QYrVscs.exe
  C:\Windows\System\QYrVscs.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\ZYoDOKh.exe
  C:\Windows\System\ZYoDOKh.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\CAzIoGZ.exe
  C:\Windows\System\CAzIoGZ.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\cWvWSey.exe
  C:\Windows\System\cWvWSey.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\ogYzXuO.exe
  C:\Windows\System\ogYzXuO.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\zhHNSxQ.exe
  C:\Windows\System\zhHNSxQ.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\JmbLNrC.exe
  C:\Windows\System\JmbLNrC.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\nUraAxr.exe
  C:\Windows\System\nUraAxr.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\VoEDcTI.exe
  C:\Windows\System\VoEDcTI.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\DFOWKBi.exe
  C:\Windows\System\DFOWKBi.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\fAfscCN.exe
  C:\Windows\System\fAfscCN.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\FklfNUX.exe
  C:\Windows\System\FklfNUX.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\IzUXbks.exe
  C:\Windows\System\IzUXbks.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\EfDpwMY.exe
  C:\Windows\System\EfDpwMY.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\iwWnbSM.exe
  C:\Windows\System\iwWnbSM.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\wjjXAiu.exe
  C:\Windows\System\wjjXAiu.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\bdkKCrN.exe
  C:\Windows\System\bdkKCrN.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\MjSmxOs.exe
  C:\Windows\System\MjSmxOs.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\NNGISVp.exe
  C:\Windows\System\NNGISVp.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\kuhkauc.exe
  C:\Windows\System\kuhkauc.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\OMkXyrg.exe
  C:\Windows\System\OMkXyrg.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\KeiMkbu.exe
  C:\Windows\System\KeiMkbu.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\EYNCyyc.exe
  C:\Windows\System\EYNCyyc.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\waFJxEB.exe
  C:\Windows\System\waFJxEB.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\otMemwW.exe
  C:\Windows\System\otMemwW.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\oOvnJrF.exe
  C:\Windows\System\oOvnJrF.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\LeCUiyZ.exe
  C:\Windows\System\LeCUiyZ.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\XCjaVvO.exe
  C:\Windows\System\XCjaVvO.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\CEHRvyI.exe
  C:\Windows\System\CEHRvyI.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\gvnPtzF.exe
  C:\Windows\System\gvnPtzF.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\QpHZDfo.exe
  C:\Windows\System\QpHZDfo.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\ebgLIKq.exe
  C:\Windows\System\ebgLIKq.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\yBKEAzl.exe
  C:\Windows\System\yBKEAzl.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\rYAiees.exe
  C:\Windows\System\rYAiees.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\VUzBzgc.exe
  C:\Windows\System\VUzBzgc.exe
  2⤵
  PID:4736
- C:\Windows\System\dUuqUjE.exe
  C:\Windows\System\dUuqUjE.exe
  2⤵
  PID:2940
- C:\Windows\System\FxHDFtF.exe
  C:\Windows\System\FxHDFtF.exe
  2⤵
  PID:3112
- C:\Windows\System\KGjQWaL.exe
  C:\Windows\System\KGjQWaL.exe
  2⤵
  PID:3668
- C:\Windows\System\puaKoxy.exe
  C:\Windows\System\puaKoxy.exe
  2⤵
  PID:1020
- C:\Windows\System\jVqXtaY.exe
  C:\Windows\System\jVqXtaY.exe
  2⤵
  PID:4488
- C:\Windows\System\amgcjzq.exe
  C:\Windows\System\amgcjzq.exe
  2⤵
  PID:1704
- C:\Windows\System\hpvtOfy.exe
  C:\Windows\System\hpvtOfy.exe
  2⤵
  PID:4876
- C:\Windows\System\nHGvJrY.exe
  C:\Windows\System\nHGvJrY.exe
  2⤵
  PID:5016
- C:\Windows\System\VZrfEKb.exe
  C:\Windows\System\VZrfEKb.exe
  2⤵
  PID:700
- C:\Windows\System\ZRsmefW.exe
  C:\Windows\System\ZRsmefW.exe
  2⤵
  PID:3848
- C:\Windows\System\IpEFXyx.exe
  C:\Windows\System\IpEFXyx.exe
  2⤵
  PID:4504
- C:\Windows\System\XUbLqpU.exe
  C:\Windows\System\XUbLqpU.exe
  2⤵
  PID:4156
- C:\Windows\System\YBxCQbh.exe
  C:\Windows\System\YBxCQbh.exe
  2⤵
  PID:316
- C:\Windows\System\dqklfjS.exe
  C:\Windows\System\dqklfjS.exe
  2⤵
  PID:3144
- C:\Windows\System\fRtxuQF.exe
  C:\Windows\System\fRtxuQF.exe
  2⤵
  PID:3660
- C:\Windows\System\fghMsOa.exe
  C:\Windows\System\fghMsOa.exe
  2⤵
  PID:4012
- C:\Windows\System\GsriWWM.exe
  C:\Windows\System\GsriWWM.exe
  2⤵
  PID:3976
- C:\Windows\System\YRiGXXu.exe
  C:\Windows\System\YRiGXXu.exe
  2⤵
  PID:1624
- C:\Windows\System\aXlWYhU.exe
  C:\Windows\System\aXlWYhU.exe
  2⤵
  PID:5140
- C:\Windows\System\sVSbikp.exe
  C:\Windows\System\sVSbikp.exe
  2⤵
  PID:5156
- C:\Windows\System\nBbgHnw.exe
  C:\Windows\System\nBbgHnw.exe
  2⤵
  PID:5180
- C:\Windows\System\dBokVGL.exe
  C:\Windows\System\dBokVGL.exe
  2⤵
  PID:5200
- C:\Windows\System\XVCLHlH.exe
  C:\Windows\System\XVCLHlH.exe
  2⤵
  PID:5220
- C:\Windows\System\clHmabx.exe
  C:\Windows\System\clHmabx.exe
  2⤵
  PID:5244
- C:\Windows\System\VrujrpO.exe
  C:\Windows\System\VrujrpO.exe
  2⤵
  PID:5260
- C:\Windows\System\dOQRWID.exe
  C:\Windows\System\dOQRWID.exe
  2⤵
  PID:5284
- C:\Windows\System\lBONmhH.exe
  C:\Windows\System\lBONmhH.exe
  2⤵
  PID:5304
- C:\Windows\System\NAKyolS.exe
  C:\Windows\System\NAKyolS.exe
  2⤵
  PID:5388
- C:\Windows\System\dNWcxlB.exe
  C:\Windows\System\dNWcxlB.exe
  2⤵
  PID:5420
- C:\Windows\System\TNRIyBA.exe
  C:\Windows\System\TNRIyBA.exe
  2⤵
  PID:5468
- C:\Windows\System\aWaQUyO.exe
  C:\Windows\System\aWaQUyO.exe
  2⤵
  PID:5492
- C:\Windows\System\PHxIXBJ.exe
  C:\Windows\System\PHxIXBJ.exe
  2⤵
  PID:5516
- C:\Windows\System\HdTdTQT.exe
  C:\Windows\System\HdTdTQT.exe
  2⤵
  PID:5532
- C:\Windows\System\nFcLsdt.exe
  C:\Windows\System\nFcLsdt.exe
  2⤵
  PID:5556
- C:\Windows\System\EqmcCPo.exe
  C:\Windows\System\EqmcCPo.exe
  2⤵
  PID:5572
- C:\Windows\System\KRKOqxp.exe
  C:\Windows\System\KRKOqxp.exe
  2⤵
  PID:5592
- C:\Windows\System\OchGkBn.exe
  C:\Windows\System\OchGkBn.exe
  2⤵
  PID:5620
- C:\Windows\System\WSDOZGI.exe
  C:\Windows\System\WSDOZGI.exe
  2⤵
  PID:5636
- C:\Windows\System\fyLVtLF.exe
  C:\Windows\System\fyLVtLF.exe
  2⤵
  PID:5664
- C:\Windows\System\OWNltcJ.exe
  C:\Windows\System\OWNltcJ.exe
  2⤵
  PID:5760
- C:\Windows\System\DTQlvBv.exe
  C:\Windows\System\DTQlvBv.exe
  2⤵
  PID:5788
- C:\Windows\System\WZeTsgc.exe
  C:\Windows\System\WZeTsgc.exe
  2⤵
  PID:5804
- C:\Windows\System\atsGGbr.exe
  C:\Windows\System\atsGGbr.exe
  2⤵
  PID:5860
- C:\Windows\System\pDmBqsw.exe
  C:\Windows\System\pDmBqsw.exe
  2⤵
  PID:5884
- C:\Windows\System\MuYGDcn.exe
  C:\Windows\System\MuYGDcn.exe
  2⤵
  PID:5904
- C:\Windows\System\ogtLUvP.exe
  C:\Windows\System\ogtLUvP.exe
  2⤵
  PID:5924
- C:\Windows\System\hjXrJDg.exe
  C:\Windows\System\hjXrJDg.exe
  2⤵
  PID:5944
- C:\Windows\System\rQdYPsQ.exe
  C:\Windows\System\rQdYPsQ.exe
  2⤵
  PID:5964
- C:\Windows\System\OCorYtG.exe
  C:\Windows\System\OCorYtG.exe
  2⤵
  PID:5988
- C:\Windows\System\lEYxKZW.exe
  C:\Windows\System\lEYxKZW.exe
  2⤵
  PID:6008
- C:\Windows\System\CJGIMkX.exe
  C:\Windows\System\CJGIMkX.exe
  2⤵
  PID:6028
- C:\Windows\System\GPhciEk.exe
  C:\Windows\System\GPhciEk.exe
  2⤵
  PID:6052
- C:\Windows\System\POPUMkr.exe
  C:\Windows\System\POPUMkr.exe
  2⤵
  PID:6076
- C:\Windows\System\zIQJOwH.exe
  C:\Windows\System\zIQJOwH.exe
  2⤵
  PID:3928
- C:\Windows\System\TnfmpHF.exe
  C:\Windows\System\TnfmpHF.exe
  2⤵
  PID:400
- C:\Windows\System\XhxFrFk.exe
  C:\Windows\System\XhxFrFk.exe
  2⤵
  PID:2904
- C:\Windows\System\AeKJgWI.exe
  C:\Windows\System\AeKJgWI.exe
  2⤵
  PID:5228
- C:\Windows\System\XIFFisP.exe
  C:\Windows\System\XIFFisP.exe
  2⤵
  PID:5256
- C:\Windows\System\TiKPekc.exe
  C:\Windows\System\TiKPekc.exe
  2⤵
  PID:3348
- C:\Windows\System\pwWDLZy.exe
  C:\Windows\System\pwWDLZy.exe
  2⤵
  PID:4480
- C:\Windows\System\SmebqOA.exe
  C:\Windows\System\SmebqOA.exe
  2⤵
  PID:3532
- C:\Windows\System\TcrvFLK.exe
  C:\Windows\System\TcrvFLK.exe
  2⤵
  PID:1528
- C:\Windows\System\dnYOuYU.exe
  C:\Windows\System\dnYOuYU.exe
  2⤵
  PID:1420
- C:\Windows\System\QlDScVo.exe
  C:\Windows\System\QlDScVo.exe
  2⤵
  PID:1796
- C:\Windows\System\fGSLixW.exe
  C:\Windows\System\fGSLixW.exe
  2⤵
  PID:5096
- C:\Windows\System\zNGpCQd.exe
  C:\Windows\System\zNGpCQd.exe
  2⤵
  PID:2196
- C:\Windows\System\GuUawYX.exe
  C:\Windows\System\GuUawYX.exe
  2⤵
  PID:768
- C:\Windows\System\PqSoGwM.exe
  C:\Windows\System\PqSoGwM.exe
  2⤵
  PID:404
- C:\Windows\System\wbfnxtL.exe
  C:\Windows\System\wbfnxtL.exe
  2⤵
  PID:1808
- C:\Windows\System\MffhNPA.exe
  C:\Windows\System\MffhNPA.exe
  2⤵
  PID:1160
- C:\Windows\System\RhnJlaW.exe
  C:\Windows\System\RhnJlaW.exe
  2⤵
  PID:1056
- C:\Windows\System\mdkiIdU.exe
  C:\Windows\System\mdkiIdU.exe
  2⤵
  PID:1620
- C:\Windows\System\sMUMzBZ.exe
  C:\Windows\System\sMUMzBZ.exe
  2⤵
  PID:5296
- C:\Windows\System\jEkJFdS.exe
  C:\Windows\System\jEkJFdS.exe
  2⤵
  PID:5192
- C:\Windows\System\TnLQSOq.exe
  C:\Windows\System\TnLQSOq.exe
  2⤵
  PID:5148
- C:\Windows\System\xtTSmyl.exe
  C:\Windows\System\xtTSmyl.exe
  2⤵
  PID:2828
- C:\Windows\System\YnvEEOc.exe
  C:\Windows\System\YnvEEOc.exe
  2⤵
  PID:5748
- C:\Windows\System\gDHylpX.exe
  C:\Windows\System\gDHylpX.exe
  2⤵
  PID:6156
- C:\Windows\System\dNURtHn.exe
  C:\Windows\System\dNURtHn.exe
  2⤵
  PID:6236
- C:\Windows\System\DRukooh.exe
  C:\Windows\System\DRukooh.exe
  2⤵
  PID:6256
- C:\Windows\System\CXWiUlf.exe
  C:\Windows\System\CXWiUlf.exe
  2⤵
  PID:6276
- C:\Windows\System\qoCUHpo.exe
  C:\Windows\System\qoCUHpo.exe
  2⤵
  PID:6300
- C:\Windows\System\vlFSLol.exe
  C:\Windows\System\vlFSLol.exe
  2⤵
  PID:6320
- C:\Windows\System\UhsIMws.exe
  C:\Windows\System\UhsIMws.exe
  2⤵
  PID:6344
- C:\Windows\System\ssEXxTq.exe
  C:\Windows\System\ssEXxTq.exe
  2⤵
  PID:6364
- C:\Windows\System\QDVlbLB.exe
  C:\Windows\System\QDVlbLB.exe
  2⤵
  PID:6392
- C:\Windows\System\llhTSAI.exe
  C:\Windows\System\llhTSAI.exe
  2⤵
  PID:6408
- C:\Windows\System\YoaKgPF.exe
  C:\Windows\System\YoaKgPF.exe
  2⤵
  PID:6432
- C:\Windows\System\YcnFIKe.exe
  C:\Windows\System\YcnFIKe.exe
  2⤵
  PID:6452
- C:\Windows\System\HeENjwk.exe
  C:\Windows\System\HeENjwk.exe
  2⤵
  PID:6476
- C:\Windows\System\pUCUxir.exe
  C:\Windows\System\pUCUxir.exe
  2⤵
  PID:6496
- C:\Windows\System\tKlIsPI.exe
  C:\Windows\System\tKlIsPI.exe
  2⤵
  PID:6524
- C:\Windows\System\qExCMFH.exe
  C:\Windows\System\qExCMFH.exe
  2⤵
  PID:6540
- C:\Windows\System\ahxxOko.exe
  C:\Windows\System\ahxxOko.exe
  2⤵
  PID:6564
- C:\Windows\System\peyrqJA.exe
  C:\Windows\System\peyrqJA.exe
  2⤵
  PID:6592
- C:\Windows\System\kKEdPdQ.exe
  C:\Windows\System\kKEdPdQ.exe
  2⤵
  PID:6608
- C:\Windows\System\JGfHsNS.exe
  C:\Windows\System\JGfHsNS.exe
  2⤵
  PID:6628
- C:\Windows\System\sFjtFsV.exe
  C:\Windows\System\sFjtFsV.exe
  2⤵
  PID:6832
- C:\Windows\System\GItnErL.exe
  C:\Windows\System\GItnErL.exe
  2⤵
  PID:6848
- C:\Windows\System\pqgYqrW.exe
  C:\Windows\System\pqgYqrW.exe
  2⤵
  PID:6864
- C:\Windows\System\VlcCLzx.exe
  C:\Windows\System\VlcCLzx.exe
  2⤵
  PID:6880
- C:\Windows\System\ATShReo.exe
  C:\Windows\System\ATShReo.exe
  2⤵
  PID:6896
- C:\Windows\System\iszrjGV.exe
  C:\Windows\System\iszrjGV.exe
  2⤵
  PID:6912
- C:\Windows\System\ZskGJDn.exe
  C:\Windows\System\ZskGJDn.exe
  2⤵
  PID:6928
- C:\Windows\System\Ifzuoik.exe
  C:\Windows\System\Ifzuoik.exe
  2⤵
  PID:6944
- C:\Windows\System\NpXNVwe.exe
  C:\Windows\System\NpXNVwe.exe
  2⤵
  PID:6960
- C:\Windows\System\lmDDjvN.exe
  C:\Windows\System\lmDDjvN.exe
  2⤵
  PID:6988
- C:\Windows\System\CPquBlh.exe
  C:\Windows\System\CPquBlh.exe
  2⤵
  PID:7004
- C:\Windows\System\AzWJbcw.exe
  C:\Windows\System\AzWJbcw.exe
  2⤵
  PID:7028
- C:\Windows\System\yKeQtsn.exe
  C:\Windows\System\yKeQtsn.exe
  2⤵
  PID:7048
- C:\Windows\System\IAEThEY.exe
  C:\Windows\System\IAEThEY.exe
  2⤵
  PID:7064
- C:\Windows\System\sjwceZK.exe
  C:\Windows\System\sjwceZK.exe
  2⤵
  PID:7084
- C:\Windows\System\uIXlenW.exe
  C:\Windows\System\uIXlenW.exe
  2⤵
  PID:7104
- C:\Windows\System\ntUBGzx.exe
  C:\Windows\System\ntUBGzx.exe
  2⤵
  PID:7124
- C:\Windows\System\ZhUMKOv.exe
  C:\Windows\System\ZhUMKOv.exe
  2⤵
  PID:7144
- C:\Windows\System\nztIThB.exe
  C:\Windows\System\nztIThB.exe
  2⤵
  PID:7164
- C:\Windows\System\SOOnJKk.exe
  C:\Windows\System\SOOnJKk.exe
  2⤵
  PID:5252
- C:\Windows\System\huhgleq.exe
  C:\Windows\System\huhgleq.exe
  2⤵
  PID:4356
- C:\Windows\System\QmJvsiL.exe
  C:\Windows\System\QmJvsiL.exe
  2⤵
  PID:5448
- C:\Windows\System\bsejWGr.exe
  C:\Windows\System\bsejWGr.exe
  2⤵
  PID:5500
- C:\Windows\System\kUhywcY.exe
  C:\Windows\System\kUhywcY.exe
  2⤵
  PID:5548
- C:\Windows\System\SlqIJFL.exe
  C:\Windows\System\SlqIJFL.exe
  2⤵
  PID:5656
- C:\Windows\System\fNOUmmC.exe
  C:\Windows\System\fNOUmmC.exe
  2⤵
  PID:3492
- C:\Windows\System\RxUfzfA.exe
  C:\Windows\System\RxUfzfA.exe
  2⤵
  PID:5768
- C:\Windows\System\DRlSWLs.exe
  C:\Windows\System\DRlSWLs.exe
  2⤵
  PID:5856
- C:\Windows\System\gqRsMJh.exe
  C:\Windows\System\gqRsMJh.exe
  2⤵
  PID:5912
- C:\Windows\System\yPGJyFU.exe
  C:\Windows\System\yPGJyFU.exe
  2⤵
  PID:5936
- C:\Windows\System\jClXIla.exe
  C:\Windows\System\jClXIla.exe
  2⤵
  PID:5980
- C:\Windows\System\oeuWTaJ.exe
  C:\Windows\System\oeuWTaJ.exe
  2⤵
  PID:6024
- C:\Windows\System\zzpYQrh.exe
  C:\Windows\System\zzpYQrh.exe
  2⤵
  PID:6084
- C:\Windows\System\xBKORbi.exe
  C:\Windows\System\xBKORbi.exe
  2⤵
  PID:6124
- C:\Windows\System\cIiJZYP.exe
  C:\Windows\System\cIiJZYP.exe
  2⤵
  PID:3772
- C:\Windows\System\JVMjvxJ.exe
  C:\Windows\System\JVMjvxJ.exe
  2⤵
  PID:5316
- C:\Windows\System\eJketUN.exe
  C:\Windows\System\eJketUN.exe
  2⤵
  PID:1304
- C:\Windows\System\CqaojcH.exe
  C:\Windows\System\CqaojcH.exe
  2⤵
  PID:5128
- C:\Windows\System\hOUWFGQ.exe
  C:\Windows\System\hOUWFGQ.exe
  2⤵
  PID:5796
- C:\Windows\System\WNxITAF.exe
  C:\Windows\System\WNxITAF.exe
  2⤵
  PID:3652
- C:\Windows\System\kgPHkiu.exe
  C:\Windows\System\kgPHkiu.exe
  2⤵
  PID:6228
- C:\Windows\System\VIyfQvR.exe
  C:\Windows\System\VIyfQvR.exe
  2⤵
  PID:6264
- C:\Windows\System\IcKANPC.exe
  C:\Windows\System\IcKANPC.exe
  2⤵
  PID:6576
- C:\Windows\System\ksdyWGK.exe
  C:\Windows\System\ksdyWGK.exe
  2⤵
  PID:6312
- C:\Windows\System\gvDXUBT.exe
  C:\Windows\System\gvDXUBT.exe
  2⤵
  PID:6380
- C:\Windows\System\VnqMzqu.exe
  C:\Windows\System\VnqMzqu.exe
  2⤵
  PID:6572
- C:\Windows\System\qegNnHW.exe
  C:\Windows\System\qegNnHW.exe
  2⤵
  PID:6356
- C:\Windows\System\dnIxDUU.exe
  C:\Windows\System\dnIxDUU.exe
  2⤵
  PID:6824
- C:\Windows\System\LQhykWk.exe
  C:\Windows\System\LQhykWk.exe
  2⤵
  PID:6920
- C:\Windows\System\ceZiRiU.exe
  C:\Windows\System\ceZiRiU.exe
  2⤵
  PID:7020
- C:\Windows\System\hSlrbjv.exe
  C:\Windows\System\hSlrbjv.exe
  2⤵
  PID:5528
- C:\Windows\System\pWSTRcL.exe
  C:\Windows\System\pWSTRcL.exe
  2⤵
  PID:5628
- C:\Windows\System\XuOuDeS.exe
  C:\Windows\System\XuOuDeS.exe
  2⤵
  PID:7196
- C:\Windows\System\RzraiXu.exe
  C:\Windows\System\RzraiXu.exe
  2⤵
  PID:7220
- C:\Windows\System\EqzCFMh.exe
  C:\Windows\System\EqzCFMh.exe
  2⤵
  PID:7240
- C:\Windows\System\VOYtOCs.exe
  C:\Windows\System\VOYtOCs.exe
  2⤵
  PID:7268
- C:\Windows\System\TATrYbj.exe
  C:\Windows\System\TATrYbj.exe
  2⤵
  PID:7292
- C:\Windows\System\dqmIKFv.exe
  C:\Windows\System\dqmIKFv.exe
  2⤵
  PID:7320
- C:\Windows\System\gFfKoZD.exe
  C:\Windows\System\gFfKoZD.exe
  2⤵
  PID:7348
- C:\Windows\System\XrwQRTR.exe
  C:\Windows\System\XrwQRTR.exe
  2⤵
  PID:7372
- C:\Windows\System\qxtdElY.exe
  C:\Windows\System\qxtdElY.exe
  2⤵
  PID:7392
- C:\Windows\System\nHegNUv.exe
  C:\Windows\System\nHegNUv.exe
  2⤵
  PID:7412
- C:\Windows\System\RdBHebm.exe
  C:\Windows\System\RdBHebm.exe
  2⤵
  PID:7436
- C:\Windows\System\AFGEKjd.exe
  C:\Windows\System\AFGEKjd.exe
  2⤵
  PID:7452
- C:\Windows\System\DysuKCW.exe
  C:\Windows\System\DysuKCW.exe
  2⤵
  PID:7476
- C:\Windows\System\vZyHoZK.exe
  C:\Windows\System\vZyHoZK.exe
  2⤵
  PID:7500
- C:\Windows\System\TZwIzPD.exe
  C:\Windows\System\TZwIzPD.exe
  2⤵
  PID:7520
- C:\Windows\System\QUUPYKj.exe
  C:\Windows\System\QUUPYKj.exe
  2⤵
  PID:7576
- C:\Windows\System\KAbhiUH.exe
  C:\Windows\System\KAbhiUH.exe
  2⤵
  PID:7592
- C:\Windows\System\iZybicH.exe
  C:\Windows\System\iZybicH.exe
  2⤵
  PID:7608
- C:\Windows\System\spEVHYs.exe
  C:\Windows\System\spEVHYs.exe
  2⤵
  PID:7624
- C:\Windows\System\aVVlKGD.exe
  C:\Windows\System\aVVlKGD.exe
  2⤵
  PID:7640
- C:\Windows\System\TGQHGDN.exe
  C:\Windows\System\TGQHGDN.exe
  2⤵
  PID:7656
- C:\Windows\System\QwvIVVi.exe
  C:\Windows\System\QwvIVVi.exe
  2⤵
  PID:7672
- C:\Windows\System\FNkdkFM.exe
  C:\Windows\System\FNkdkFM.exe
  2⤵
  PID:7688
- C:\Windows\System\wVVdGpY.exe
  C:\Windows\System\wVVdGpY.exe
  2⤵
  PID:7708
- C:\Windows\System\DspmLXv.exe
  C:\Windows\System\DspmLXv.exe
  2⤵
  PID:7724
- C:\Windows\System\JGbFdFF.exe
  C:\Windows\System\JGbFdFF.exe
  2⤵
  PID:7740
- C:\Windows\System\lqMVTLr.exe
  C:\Windows\System\lqMVTLr.exe
  2⤵
  PID:7756
- C:\Windows\System\ULlNtqL.exe
  C:\Windows\System\ULlNtqL.exe
  2⤵
  PID:7776
- C:\Windows\System\LVOjjMt.exe
  C:\Windows\System\LVOjjMt.exe
  2⤵
  PID:7800
- C:\Windows\System\BgzBLei.exe
  C:\Windows\System\BgzBLei.exe
  2⤵
  PID:7816
- C:\Windows\System\ehbqPiz.exe
  C:\Windows\System\ehbqPiz.exe
  2⤵
  PID:7836
- C:\Windows\System\dajXxOJ.exe
  C:\Windows\System\dajXxOJ.exe
  2⤵
  PID:7856
- C:\Windows\System\QtAsKGt.exe
  C:\Windows\System\QtAsKGt.exe
  2⤵
  PID:7876
- C:\Windows\System\TnvDgNS.exe
  C:\Windows\System\TnvDgNS.exe
  2⤵
  PID:7900
- C:\Windows\System\XCzZoto.exe
  C:\Windows\System\XCzZoto.exe
  2⤵
  PID:7944
- C:\Windows\System\mDrOnnE.exe
  C:\Windows\System\mDrOnnE.exe
  2⤵
  PID:7960
- C:\Windows\System\jgCOsSo.exe
  C:\Windows\System\jgCOsSo.exe
  2⤵
  PID:7988
- C:\Windows\System\XTPSgVO.exe
  C:\Windows\System\XTPSgVO.exe
  2⤵
  PID:8024
- C:\Windows\System\evhyfZQ.exe
  C:\Windows\System\evhyfZQ.exe
  2⤵
  PID:8060
- C:\Windows\System\MniHkaw.exe
  C:\Windows\System\MniHkaw.exe
  2⤵
  PID:8080
- C:\Windows\System\uAEFdYY.exe
  C:\Windows\System\uAEFdYY.exe
  2⤵
  PID:8100
- C:\Windows\System\URXuCdG.exe
  C:\Windows\System\URXuCdG.exe
  2⤵
  PID:8116
- C:\Windows\System\ajMiOxA.exe
  C:\Windows\System\ajMiOxA.exe
  2⤵
  PID:8144
- C:\Windows\System\OIAgILa.exe
  C:\Windows\System\OIAgILa.exe
  2⤵
  PID:8164
- C:\Windows\System\VvazhJr.exe
  C:\Windows\System\VvazhJr.exe
  2⤵
  PID:8184
- C:\Windows\System\tsJqIPY.exe
  C:\Windows\System\tsJqIPY.exe
  2⤵
  PID:5728
- C:\Windows\System\KkwoPWL.exe
  C:\Windows\System\KkwoPWL.exe
  2⤵
  PID:5972
- C:\Windows\System\SHLBKby.exe
  C:\Windows\System\SHLBKby.exe
  2⤵
  PID:2864
- C:\Windows\System\faFQgWB.exe
  C:\Windows\System\faFQgWB.exe
  2⤵
  PID:6296
- C:\Windows\System\RhtOKuJ.exe
  C:\Windows\System\RhtOKuJ.exe
  2⤵
  PID:6488
- C:\Windows\System\oMwfHvT.exe
  C:\Windows\System\oMwfHvT.exe
  2⤵
  PID:6620
- C:\Windows\System\CQNHKiN.exe
  C:\Windows\System\CQNHKiN.exe
  2⤵
  PID:6248
- C:\Windows\System\HSdwnvv.exe
  C:\Windows\System\HSdwnvv.exe
  2⤵
  PID:5600
- C:\Windows\System\YdGnfGI.exe
  C:\Windows\System\YdGnfGI.exe
  2⤵
  PID:5524
- C:\Windows\System\ulkYUMq.exe
  C:\Windows\System\ulkYUMq.exe
  2⤵
  PID:6472
- C:\Windows\System\chBgFcc.exe
  C:\Windows\System\chBgFcc.exe
  2⤵
  PID:7232
- C:\Windows\System\ATkqWDX.exe
  C:\Windows\System\ATkqWDX.exe
  2⤵
  PID:7284
- C:\Windows\System\LezSFJa.exe
  C:\Windows\System\LezSFJa.exe
  2⤵
  PID:7360
- C:\Windows\System\tWzKXtD.exe
  C:\Windows\System\tWzKXtD.exe
  2⤵
  PID:7408
- C:\Windows\System\bRxvZxh.exe
  C:\Windows\System\bRxvZxh.exe
  2⤵
  PID:7484
- C:\Windows\System\iyzmcgp.exe
  C:\Windows\System\iyzmcgp.exe
  2⤵
  PID:2388
- C:\Windows\System\iCOUwxf.exe
  C:\Windows\System\iCOUwxf.exe
  2⤵
  PID:8196
- C:\Windows\System\NhhJFKP.exe
  C:\Windows\System\NhhJFKP.exe
  2⤵
  PID:8220
- C:\Windows\System\SXFYYev.exe
  C:\Windows\System\SXFYYev.exe
  2⤵
  PID:8320
- C:\Windows\System\BHdxpGO.exe
  C:\Windows\System\BHdxpGO.exe
  2⤵
  PID:8336
- C:\Windows\System\HGtrdua.exe
  C:\Windows\System\HGtrdua.exe
  2⤵
  PID:8356
- C:\Windows\System\gcNejrI.exe
  C:\Windows\System\gcNejrI.exe
  2⤵
  PID:8380
- C:\Windows\System\UOzFoKb.exe
  C:\Windows\System\UOzFoKb.exe
  2⤵
  PID:8396
- C:\Windows\System\FIEkZGT.exe
  C:\Windows\System\FIEkZGT.exe
  2⤵
  PID:8420
- C:\Windows\System\VIEEdll.exe
  C:\Windows\System\VIEEdll.exe
  2⤵
  PID:8440
- C:\Windows\System\wvnqpqj.exe
  C:\Windows\System\wvnqpqj.exe
  2⤵
  PID:8460
- C:\Windows\System\sttvUzz.exe
  C:\Windows\System\sttvUzz.exe
  2⤵
  PID:8488
- C:\Windows\System\BRHjkna.exe
  C:\Windows\System\BRHjkna.exe
  2⤵
  PID:8504
- C:\Windows\System\KKRxrek.exe
  C:\Windows\System\KKRxrek.exe
  2⤵
  PID:8528
- C:\Windows\System\ifKKHno.exe
  C:\Windows\System\ifKKHno.exe
  2⤵
  PID:8544
- C:\Windows\System\CWIjLzO.exe
  C:\Windows\System\CWIjLzO.exe
  2⤵
  PID:8580
- C:\Windows\System\BAJeYwQ.exe
  C:\Windows\System\BAJeYwQ.exe
  2⤵
  PID:8600
- C:\Windows\System\ldXDqMD.exe
  C:\Windows\System\ldXDqMD.exe
  2⤵
  PID:8624
- C:\Windows\System\mdUeLsO.exe
  C:\Windows\System\mdUeLsO.exe
  2⤵
  PID:8652
- C:\Windows\System\bcqIfLo.exe
  C:\Windows\System\bcqIfLo.exe
  2⤵
  PID:8672
- C:\Windows\System\vxlhKHl.exe
  C:\Windows\System\vxlhKHl.exe
  2⤵
  PID:8692
- C:\Windows\System\ViIuYFu.exe
  C:\Windows\System\ViIuYFu.exe
  2⤵
  PID:8712
- C:\Windows\System\TupAfHh.exe
  C:\Windows\System\TupAfHh.exe
  2⤵
  PID:8740
- C:\Windows\System\fkrjQiC.exe
  C:\Windows\System\fkrjQiC.exe
  2⤵
  PID:8756
- C:\Windows\System\nRHWjWV.exe
  C:\Windows\System\nRHWjWV.exe
  2⤵
  PID:8780
- C:\Windows\System\PIEHyBq.exe
  C:\Windows\System\PIEHyBq.exe
  2⤵
  PID:8800
- C:\Windows\System\ipyHACf.exe
  C:\Windows\System\ipyHACf.exe
  2⤵
  PID:8820
- C:\Windows\System\gaVqTgX.exe
  C:\Windows\System\gaVqTgX.exe
  2⤵
  PID:8840
- C:\Windows\System\hytJMoW.exe
  C:\Windows\System\hytJMoW.exe
  2⤵
  PID:8860
- C:\Windows\System\orSWmJI.exe
  C:\Windows\System\orSWmJI.exe
  2⤵
  PID:8884
- C:\Windows\System\GsiLDjj.exe
  C:\Windows\System\GsiLDjj.exe
  2⤵
  PID:8904
- C:\Windows\System\MoJUrrB.exe
  C:\Windows\System\MoJUrrB.exe
  2⤵
  PID:8928
- C:\Windows\System\NCkJbpP.exe
  C:\Windows\System\NCkJbpP.exe
  2⤵
  PID:8952
- C:\Windows\System\YuHzxAw.exe
  C:\Windows\System\YuHzxAw.exe
  2⤵
  PID:8972
- C:\Windows\System\nxdkcOi.exe
  C:\Windows\System\nxdkcOi.exe
  2⤵
  PID:8996
- C:\Windows\System\IRkUCHE.exe
  C:\Windows\System\IRkUCHE.exe
  2⤵
  PID:9020
- C:\Windows\System\vGfAeGC.exe
  C:\Windows\System\vGfAeGC.exe
  2⤵
  PID:9040
- C:\Windows\System\IFgSXnS.exe
  C:\Windows\System\IFgSXnS.exe
  2⤵
  PID:9056
- C:\Windows\System\XIxVfVk.exe
  C:\Windows\System\XIxVfVk.exe
  2⤵
  PID:9088
- C:\Windows\System\TgcBDNC.exe
  C:\Windows\System\TgcBDNC.exe
  2⤵
  PID:9112
- C:\Windows\System\KYJvHPC.exe
  C:\Windows\System\KYJvHPC.exe
  2⤵
  PID:9144
- C:\Windows\System\iVCpwOK.exe
  C:\Windows\System\iVCpwOK.exe
  2⤵
  PID:9172
- C:\Windows\System\xTezoGd.exe
  C:\Windows\System\xTezoGd.exe
  2⤵
  PID:9196
- C:\Windows\System\WZfItSu.exe
  C:\Windows\System\WZfItSu.exe
  2⤵
  PID:6828
- C:\Windows\System\MNFjEBC.exe
  C:\Windows\System\MNFjEBC.exe
  2⤵
  PID:6876
- C:\Windows\System\VFQhvGR.exe
  C:\Windows\System\VFQhvGR.exe
  2⤵
  PID:5212
- C:\Windows\System\WfTIOAJ.exe
  C:\Windows\System\WfTIOAJ.exe
  2⤵
  PID:7888
- C:\Windows\System\HzKRysT.exe
  C:\Windows\System\HzKRysT.exe
  2⤵
  PID:7976
- C:\Windows\System\CcLsmXp.exe
  C:\Windows\System\CcLsmXp.exe
  2⤵
  PID:6952
- C:\Windows\System\kKFzRpB.exe
  C:\Windows\System\kKFzRpB.exe
  2⤵
  PID:8012
- C:\Windows\System\zpxKmNc.exe
  C:\Windows\System\zpxKmNc.exe
  2⤵
  PID:7208
- C:\Windows\System\gMHCkfL.exe
  C:\Windows\System\gMHCkfL.exe
  2⤵
  PID:7304
- C:\Windows\System\pSMbFDx.exe
  C:\Windows\System\pSMbFDx.exe
  2⤵
  PID:5920
- C:\Windows\System\DZXaxHs.exe
  C:\Windows\System\DZXaxHs.exe
  2⤵
  PID:7460
- C:\Windows\System\bJGsgPm.exe
  C:\Windows\System\bJGsgPm.exe
  2⤵
  PID:6404
- C:\Windows\System\LYzYyYv.exe
  C:\Windows\System\LYzYyYv.exe
  2⤵
  PID:7512
- C:\Windows\System\UCebrMG.exe
  C:\Windows\System\UCebrMG.exe
  2⤵
  PID:7228
- C:\Windows\System\nGsUZLB.exe
  C:\Windows\System\nGsUZLB.exe
  2⤵
  PID:7336
- C:\Windows\System\OklrAMW.exe
  C:\Windows\System\OklrAMW.exe
  2⤵
  PID:7448
- C:\Windows\System\YWaLrkM.exe
  C:\Windows\System\YWaLrkM.exe
  2⤵
  PID:1992
- C:\Windows\System\LafUyCV.exe
  C:\Windows\System\LafUyCV.exe
  2⤵
  PID:8240
- C:\Windows\System\DTAKMbj.exe
  C:\Windows\System\DTAKMbj.exe
  2⤵
  PID:1376
- C:\Windows\System\VrbsqDL.exe
  C:\Windows\System\VrbsqDL.exe
  2⤵
  PID:8376
- C:\Windows\System\aFiTgvI.exe
  C:\Windows\System\aFiTgvI.exe
  2⤵
  PID:7908
- C:\Windows\System\PiZkBIn.exe
  C:\Windows\System\PiZkBIn.exe
  2⤵
  PID:7924
- C:\Windows\System\UHtqyBp.exe
  C:\Windows\System\UHtqyBp.exe
  2⤵
  PID:5612
- C:\Windows\System\DhMSsst.exe
  C:\Windows\System\DhMSsst.exe
  2⤵
  PID:8588
- C:\Windows\System\cQdJcyq.exe
  C:\Windows\System\cQdJcyq.exe
  2⤵
  PID:8680
- C:\Windows\System\IltXRoR.exe
  C:\Windows\System\IltXRoR.exe
  2⤵
  PID:7260
- C:\Windows\System\rbRfBYi.exe
  C:\Windows\System\rbRfBYi.exe
  2⤵
  PID:9224
- C:\Windows\System\kWQwgwG.exe
  C:\Windows\System\kWQwgwG.exe
  2⤵
  PID:9244
- C:\Windows\System\SsSrmOf.exe
  C:\Windows\System\SsSrmOf.exe
  2⤵
  PID:9268
- C:\Windows\System\qFlgKpc.exe
  C:\Windows\System\qFlgKpc.exe
  2⤵
  PID:9288
- C:\Windows\System\oJPZmrT.exe
  C:\Windows\System\oJPZmrT.exe
  2⤵
  PID:9308
- C:\Windows\System\WKDJVfl.exe
  C:\Windows\System\WKDJVfl.exe
  2⤵
  PID:9332
- C:\Windows\System\FXnmWkL.exe
  C:\Windows\System\FXnmWkL.exe
  2⤵
  PID:9356
- C:\Windows\System\BguhiiT.exe
  C:\Windows\System\BguhiiT.exe
  2⤵
  PID:9392
- C:\Windows\System\UOfcWcF.exe
  C:\Windows\System\UOfcWcF.exe
  2⤵
  PID:9416
- C:\Windows\System\oxwxuww.exe
  C:\Windows\System\oxwxuww.exe
  2⤵
  PID:9436
- C:\Windows\System\WwttdYo.exe
  C:\Windows\System\WwttdYo.exe
  2⤵
  PID:9456
- C:\Windows\System\oQFchab.exe
  C:\Windows\System\oQFchab.exe
  2⤵
  PID:9476
- C:\Windows\System\LCGlupE.exe
  C:\Windows\System\LCGlupE.exe
  2⤵
  PID:9504
- C:\Windows\System\gPbfwoK.exe
  C:\Windows\System\gPbfwoK.exe
  2⤵
  PID:9524
- C:\Windows\System\zTkTIOU.exe
  C:\Windows\System\zTkTIOU.exe
  2⤵
  PID:9548
- C:\Windows\System\JStGQAm.exe
  C:\Windows\System\JStGQAm.exe
  2⤵
  PID:9592
- C:\Windows\System\ZuhjrfR.exe
  C:\Windows\System\ZuhjrfR.exe
  2⤵
  PID:9612
- C:\Windows\System\iHszxjF.exe
  C:\Windows\System\iHszxjF.exe
  2⤵
  PID:9632
- C:\Windows\System\mRbMmOy.exe
  C:\Windows\System\mRbMmOy.exe
  2⤵
  PID:9648
- C:\Windows\System\laSJpYG.exe
  C:\Windows\System\laSJpYG.exe
  2⤵
  PID:9672
- C:\Windows\System\GpqGAqJ.exe
  C:\Windows\System\GpqGAqJ.exe
  2⤵
  PID:9696
- C:\Windows\System\pWTXfWY.exe
  C:\Windows\System\pWTXfWY.exe
  2⤵
  PID:9716
- C:\Windows\System\cTuMuRd.exe
  C:\Windows\System\cTuMuRd.exe
  2⤵
  PID:9736
- C:\Windows\System\fLicPWA.exe
  C:\Windows\System\fLicPWA.exe
  2⤵
  PID:9760
- C:\Windows\System\tYAWCtI.exe
  C:\Windows\System\tYAWCtI.exe
  2⤵
  PID:9784
- C:\Windows\System\QSllgVq.exe
  C:\Windows\System\QSllgVq.exe
  2⤵
  PID:9800
- C:\Windows\System\nrVOOxV.exe
  C:\Windows\System\nrVOOxV.exe
  2⤵
  PID:9824
- C:\Windows\System\ZUdJMOZ.exe
  C:\Windows\System\ZUdJMOZ.exe
  2⤵
  PID:9848
- C:\Windows\System\QwEVWfq.exe
  C:\Windows\System\QwEVWfq.exe
  2⤵
  PID:9868
- C:\Windows\System\ymWgZOm.exe
  C:\Windows\System\ymWgZOm.exe
  2⤵
  PID:9892
- C:\Windows\System\EYnxWKn.exe
  C:\Windows\System\EYnxWKn.exe
  2⤵
  PID:9912
- C:\Windows\System\CQQRvtD.exe
  C:\Windows\System\CQQRvtD.exe
  2⤵
  PID:9936
- C:\Windows\System\HFMPfxr.exe
  C:\Windows\System\HFMPfxr.exe
  2⤵
  PID:9956
- C:\Windows\System\LqFMxaM.exe
  C:\Windows\System\LqFMxaM.exe
  2⤵
  PID:9976
- C:\Windows\System\VaUGDKI.exe
  C:\Windows\System\VaUGDKI.exe
  2⤵
  PID:10064
- C:\Windows\System\oGgiKbS.exe
  C:\Windows\System\oGgiKbS.exe
  2⤵
  PID:10084
- C:\Windows\System\PqRwzVu.exe
  C:\Windows\System\PqRwzVu.exe
  2⤵
  PID:10108
- C:\Windows\System\zJZXUrH.exe
  C:\Windows\System\zJZXUrH.exe
  2⤵
  PID:10132
- C:\Windows\System\DTWZTwM.exe
  C:\Windows\System\DTWZTwM.exe
  2⤵
  PID:10156
- C:\Windows\System\dOqhtXb.exe
  C:\Windows\System\dOqhtXb.exe
  2⤵
  PID:10180
- C:\Windows\System\UWIoXNp.exe
  C:\Windows\System\UWIoXNp.exe
  2⤵
  PID:10200
- C:\Windows\System\xDAoYoZ.exe
  C:\Windows\System\xDAoYoZ.exe
  2⤵
  PID:10224
- C:\Windows\System\agnwYom.exe
  C:\Windows\System\agnwYom.exe
  2⤵
  PID:8788
- C:\Windows\System\wrCPgxF.exe
  C:\Windows\System\wrCPgxF.exe
  2⤵
  PID:8828
- C:\Windows\System\YAWwVFh.exe
  C:\Windows\System\YAWwVFh.exe
  2⤵
  PID:8856
- C:\Windows\System\VrqPhnL.exe
  C:\Windows\System\VrqPhnL.exe
  2⤵
  PID:8968
- C:\Windows\System\hRolwge.exe
  C:\Windows\System\hRolwge.exe
  2⤵
  PID:9032
- C:\Windows\System\kjoyQdb.exe
  C:\Windows\System\kjoyQdb.exe
  2⤵
  PID:9160
- C:\Windows\System\XwoRfcp.exe
  C:\Windows\System\XwoRfcp.exe
  2⤵
  PID:7568
- C:\Windows\System\mZdKUQv.exe
  C:\Windows\System\mZdKUQv.exe
  2⤵
  PID:7604
- C:\Windows\System\zSVgehm.exe
  C:\Windows\System\zSVgehm.exe
  2⤵
  PID:7444
- C:\Windows\System\jovESQG.exe
  C:\Windows\System\jovESQG.exe
  2⤵
  PID:8472
- C:\Windows\System\OqXtEBW.exe
  C:\Windows\System\OqXtEBW.exe
  2⤵
  PID:8572
- C:\Windows\System\wkiBfLz.exe
  C:\Windows\System\wkiBfLz.exe
  2⤵
  PID:8664
- C:\Windows\System\YTcbHdA.exe
  C:\Windows\System\YTcbHdA.exe
  2⤵
  PID:9376
- C:\Windows\System\rtfELTT.exe
  C:\Windows\System\rtfELTT.exe
  2⤵
  PID:8940
- C:\Windows\System\lyTlKoN.exe
  C:\Windows\System\lyTlKoN.exe
  2⤵
  PID:4452
- C:\Windows\System\ouMzCQe.exe
  C:\Windows\System\ouMzCQe.exe
  2⤵
  PID:10252
- C:\Windows\System\POFeGow.exe
  C:\Windows\System\POFeGow.exe
  2⤵
  PID:10276
- C:\Windows\System\CEdiRJq.exe
  C:\Windows\System\CEdiRJq.exe
  2⤵
  PID:10296
- C:\Windows\System\iPIkOTy.exe
  C:\Windows\System\iPIkOTy.exe
  2⤵
  PID:10316
- C:\Windows\System\vLLVvqo.exe
  C:\Windows\System\vLLVvqo.exe
  2⤵
  PID:10336
- C:\Windows\System\BlOeDkg.exe
  C:\Windows\System\BlOeDkg.exe
  2⤵
  PID:10368
- C:\Windows\System\cWirLPM.exe
  C:\Windows\System\cWirLPM.exe
  2⤵
  PID:10396
- C:\Windows\System\hWJqNyM.exe
  C:\Windows\System\hWJqNyM.exe
  2⤵
  PID:10416
- C:\Windows\System\cwUGSnb.exe
  C:\Windows\System\cwUGSnb.exe
  2⤵
  PID:10444
- C:\Windows\System\tfPrsyJ.exe
  C:\Windows\System\tfPrsyJ.exe
  2⤵
  PID:10472
- C:\Windows\System\osVnMjK.exe
  C:\Windows\System\osVnMjK.exe
  2⤵
  PID:10492
- C:\Windows\System\xKfiZHf.exe
  C:\Windows\System\xKfiZHf.exe
  2⤵
  PID:10512
- C:\Windows\System\XSeGeIX.exe
  C:\Windows\System\XSeGeIX.exe
  2⤵
  PID:10548
- C:\Windows\System\bYaSZyS.exe
  C:\Windows\System\bYaSZyS.exe
  2⤵
  PID:10568
- C:\Windows\System\RjeMeAg.exe
  C:\Windows\System\RjeMeAg.exe
  2⤵
  PID:10584
- C:\Windows\System\skFVses.exe
  C:\Windows\System\skFVses.exe
  2⤵
  PID:10644
- C:\Windows\System\pXUpjro.exe
  C:\Windows\System\pXUpjro.exe
  2⤵
  PID:10664
- C:\Windows\System\ocWGbwn.exe
  C:\Windows\System\ocWGbwn.exe
  2⤵
  PID:10684
- C:\Windows\System\eCZxrLE.exe
  C:\Windows\System\eCZxrLE.exe
  2⤵
  PID:10704
- C:\Windows\System\QmeaMMQ.exe
  C:\Windows\System\QmeaMMQ.exe
  2⤵
  PID:10732
- C:\Windows\System\DSOLtID.exe
  C:\Windows\System\DSOLtID.exe
  2⤵
  PID:10752
- C:\Windows\System\HhABLWP.exe
  C:\Windows\System\HhABLWP.exe
  2⤵
  PID:10768
- C:\Windows\System\cWdrgXO.exe
  C:\Windows\System\cWdrgXO.exe
  2⤵
  PID:10788
- C:\Windows\System\cfeMWTi.exe
  C:\Windows\System\cfeMWTi.exe
  2⤵
  PID:10812
- C:\Windows\System\yLfntNo.exe
  C:\Windows\System\yLfntNo.exe
  2⤵
  PID:10832
- C:\Windows\System\XwarcdM.exe
  C:\Windows\System\XwarcdM.exe
  2⤵
  PID:10852
- C:\Windows\System\BIcKuGl.exe
  C:\Windows\System\BIcKuGl.exe
  2⤵
  PID:10872
- C:\Windows\System\JRCdBWU.exe
  C:\Windows\System\JRCdBWU.exe
  2⤵
  PID:10900
- C:\Windows\System\CRWuDhW.exe
  C:\Windows\System\CRWuDhW.exe
  2⤵
  PID:10920
- C:\Windows\System\MDxSTfq.exe
  C:\Windows\System\MDxSTfq.exe
  2⤵
  PID:10944
- C:\Windows\System\NsIMoBy.exe
  C:\Windows\System\NsIMoBy.exe
  2⤵
  PID:10968
- C:\Windows\System\EgdcPBU.exe
  C:\Windows\System\EgdcPBU.exe
  2⤵
  PID:10992
- C:\Windows\System\qvFkAYd.exe
  C:\Windows\System\qvFkAYd.exe
  2⤵
  PID:11016
- C:\Windows\System\PHxahqF.exe
  C:\Windows\System\PHxahqF.exe
  2⤵
  PID:11040
- C:\Windows\System\rUJfFKR.exe
  C:\Windows\System\rUJfFKR.exe
  2⤵
  PID:11068
- C:\Windows\System\EOmURca.exe
  C:\Windows\System\EOmURca.exe
  2⤵
  PID:11084
- C:\Windows\System\LhuSumX.exe
  C:\Windows\System\LhuSumX.exe
  2⤵
  PID:11112
- C:\Windows\System\YPbDTbp.exe
  C:\Windows\System\YPbDTbp.exe
  2⤵
  PID:11132
- C:\Windows\System\VJxbahD.exe
  C:\Windows\System\VJxbahD.exe
  2⤵
  PID:11160
- C:\Windows\System\xSPzHPR.exe
  C:\Windows\System\xSPzHPR.exe
  2⤵
  PID:11176
- C:\Windows\System\bjuYUCa.exe
  C:\Windows\System\bjuYUCa.exe
  2⤵
  PID:11204
- C:\Windows\System\JGvSPUE.exe
  C:\Windows\System\JGvSPUE.exe
  2⤵
  PID:11236
- C:\Windows\System\oCyzOPa.exe
  C:\Windows\System\oCyzOPa.exe
  2⤵
  PID:8216
- C:\Windows\System\vfiYryM.exe
  C:\Windows\System\vfiYryM.exe
  2⤵
  PID:3504
- C:\Windows\System\nggplTe.exe
  C:\Windows\System\nggplTe.exe
  2⤵
  PID:9780
- C:\Windows\System\IcpIorF.exe
  C:\Windows\System\IcpIorF.exe
  2⤵
  PID:9900
- C:\Windows\System\nDBkNUL.exe
  C:\Windows\System\nDBkNUL.exe
  2⤵
  PID:9944
- C:\Windows\System\shTFQtq.exe
  C:\Windows\System\shTFQtq.exe
  2⤵
  PID:8328
- C:\Windows\System\liXYEul.exe
  C:\Windows\System\liXYEul.exe
  2⤵
  PID:8456
- C:\Windows\System\HLSyaoJ.exe
  C:\Windows\System\HLSyaoJ.exe
  2⤵
  PID:5896
- C:\Windows\System\hAleWuC.exe
  C:\Windows\System\hAleWuC.exe
  2⤵
  PID:10152
- C:\Windows\System\MCxOqyA.exe
  C:\Windows\System\MCxOqyA.exe
  2⤵
  PID:6624
- C:\Windows\System\ejiWQEe.exe
  C:\Windows\System\ejiWQEe.exe
  2⤵
  PID:7380
- C:\Windows\System\jRqcLXx.exe
  C:\Windows\System\jRqcLXx.exe
  2⤵
  PID:7356
- C:\Windows\System\ivsSRwB.exe
  C:\Windows\System\ivsSRwB.exe
  2⤵
  PID:5484
- C:\Windows\System\JXQLmRG.exe
  C:\Windows\System\JXQLmRG.exe
  2⤵
  PID:7664
- C:\Windows\System\illclDn.exe
  C:\Windows\System\illclDn.exe
  2⤵
  PID:8404
- C:\Windows\System\huGuOiy.exe
  C:\Windows\System\huGuOiy.exe
  2⤵
  PID:8512
- C:\Windows\System\ArSRaoL.exe
  C:\Windows\System\ArSRaoL.exe
  2⤵
  PID:8708
- C:\Windows\System\qCDDKxi.exe
  C:\Windows\System\qCDDKxi.exe
  2⤵
  PID:8632
- C:\Windows\System\txJJDfZ.exe
  C:\Windows\System\txJJDfZ.exe
  2⤵
  PID:8764
- C:\Windows\System\xXfcaIy.exe
  C:\Windows\System\xXfcaIy.exe
  2⤵
  PID:9276
- C:\Windows\System\fjzEPVs.exe
  C:\Windows\System\fjzEPVs.exe
  2⤵
  PID:8816
- C:\Windows\System\yumndmJ.exe
  C:\Windows\System\yumndmJ.exe
  2⤵
  PID:9448
- C:\Windows\System\IuaypKs.exe
  C:\Windows\System\IuaypKs.exe
  2⤵
  PID:11288
- C:\Windows\System\zRwLtdJ.exe
  C:\Windows\System\zRwLtdJ.exe
  2⤵
  PID:11304
- C:\Windows\System\zHMWmZW.exe
  C:\Windows\System\zHMWmZW.exe
  2⤵
  PID:11332
- C:\Windows\System\QOFQPHG.exe
  C:\Windows\System\QOFQPHG.exe
  2⤵
  PID:11352
- C:\Windows\System\yHsHGvL.exe
  C:\Windows\System\yHsHGvL.exe
  2⤵
  PID:11368
- C:\Windows\System\XBVsHDB.exe
  C:\Windows\System\XBVsHDB.exe
  2⤵
  PID:11392
- C:\Windows\System\rrYLsIF.exe
  C:\Windows\System\rrYLsIF.exe
  2⤵
  PID:11420
- C:\Windows\System\GGkXZQP.exe
  C:\Windows\System\GGkXZQP.exe
  2⤵
  PID:11444
- C:\Windows\System\ZNSsjDz.exe
  C:\Windows\System\ZNSsjDz.exe
  2⤵
  PID:11460
- C:\Windows\System\jkYmqdz.exe
  C:\Windows\System\jkYmqdz.exe
  2⤵
  PID:11484
- C:\Windows\System\NYFchNt.exe
  C:\Windows\System\NYFchNt.exe
  2⤵
  PID:11504
- C:\Windows\System\JvEMjkb.exe
  C:\Windows\System\JvEMjkb.exe
  2⤵
  PID:11520
- C:\Windows\System\yYtWbkH.exe
  C:\Windows\System\yYtWbkH.exe
  2⤵
  PID:11544
- C:\Windows\System\gBbTDXJ.exe
  C:\Windows\System\gBbTDXJ.exe
  2⤵
  PID:11560
- C:\Windows\System\lRHThXn.exe
  C:\Windows\System\lRHThXn.exe
  2⤵
  PID:11576
- C:\Windows\System\qgtOjLb.exe
  C:\Windows\System\qgtOjLb.exe
  2⤵
  PID:11592
- C:\Windows\System\TYdVzQH.exe
  C:\Windows\System\TYdVzQH.exe
  2⤵
  PID:11608
- C:\Windows\System\khBVRYo.exe
  C:\Windows\System\khBVRYo.exe
  2⤵
  PID:11624
- C:\Windows\System\FFrFlgJ.exe
  C:\Windows\System\FFrFlgJ.exe
  2⤵
  PID:11648
- C:\Windows\System\WdHpdsj.exe
  C:\Windows\System\WdHpdsj.exe
  2⤵
  PID:11676
- C:\Windows\System\hvXSOUt.exe
  C:\Windows\System\hvXSOUt.exe
  2⤵
  PID:11704
- C:\Windows\System\iYUdEoF.exe
  C:\Windows\System\iYUdEoF.exe
  2⤵
  PID:11720
- C:\Windows\System\WJSFyIR.exe
  C:\Windows\System\WJSFyIR.exe
  2⤵
  PID:11752
- C:\Windows\System\dBlvhsM.exe
  C:\Windows\System\dBlvhsM.exe
  2⤵
  PID:11776
- C:\Windows\System\BvYAXNa.exe
  C:\Windows\System\BvYAXNa.exe
  2⤵
  PID:11796
- C:\Windows\System\yIJZOUu.exe
  C:\Windows\System\yIJZOUu.exe
  2⤵
  PID:11828
- C:\Windows\System\vEtJgcQ.exe
  C:\Windows\System\vEtJgcQ.exe
  2⤵
  PID:11848
- C:\Windows\System\wlGNUal.exe
  C:\Windows\System\wlGNUal.exe
  2⤵
  PID:11872
- C:\Windows\System\hFZTvoB.exe
  C:\Windows\System\hFZTvoB.exe
  2⤵
  PID:11892
- C:\Windows\System\pbpJamS.exe
  C:\Windows\System\pbpJamS.exe
  2⤵
  PID:11916
- C:\Windows\System\zwAsHvC.exe
  C:\Windows\System\zwAsHvC.exe
  2⤵
  PID:11936
- C:\Windows\System\SNBhwwy.exe
  C:\Windows\System\SNBhwwy.exe
  2⤵
  PID:11952
- C:\Windows\System\DlakChr.exe
  C:\Windows\System\DlakChr.exe
  2⤵
  PID:11972
- C:\Windows\System\ydvVICr.exe
  C:\Windows\System\ydvVICr.exe
  2⤵
  PID:11992
- C:\Windows\System\TawAuWu.exe
  C:\Windows\System\TawAuWu.exe
  2⤵
  PID:12008
- C:\Windows\System\MzCHSjq.exe
  C:\Windows\System\MzCHSjq.exe
  2⤵
  PID:12036
- C:\Windows\System\bxpTrKJ.exe
  C:\Windows\System\bxpTrKJ.exe
  2⤵
  PID:12052
- C:\Windows\System\zBQqfBO.exe
  C:\Windows\System\zBQqfBO.exe
  2⤵
  PID:12072
- C:\Windows\System\EJIJULC.exe
  C:\Windows\System\EJIJULC.exe
  2⤵
  PID:12100
- C:\Windows\System\kNOtrJY.exe
  C:\Windows\System\kNOtrJY.exe
  2⤵
  PID:12116
- C:\Windows\System\EAoBaLk.exe
  C:\Windows\System\EAoBaLk.exe
  2⤵
  PID:12140
- C:\Windows\System\IgSYLEd.exe
  C:\Windows\System\IgSYLEd.exe
  2⤵
  PID:12156
- C:\Windows\System\pXuENDw.exe
  C:\Windows\System\pXuENDw.exe
  2⤵
  PID:12180
- C:\Windows\System\DzrMhwJ.exe
  C:\Windows\System\DzrMhwJ.exe
  2⤵
  PID:9836
- C:\Windows\System\RRNfizq.exe
  C:\Windows\System\RRNfizq.exe
  2⤵
  PID:10460
- C:\Windows\System\OtSTnct.exe
  C:\Windows\System\OtSTnct.exe
  2⤵
  PID:6148
- C:\Windows\System\ZzYgCFu.exe
  C:\Windows\System\ZzYgCFu.exe
  2⤵
  PID:6888
- C:\Windows\System\fRNkFcI.exe
  C:\Windows\System\fRNkFcI.exe
  2⤵
  PID:3624
- C:\Windows\System\xVixPBH.exe
  C:\Windows\System\xVixPBH.exe
  2⤵
  PID:9236
- C:\Windows\System\yrhbEEW.exe
  C:\Windows\System\yrhbEEW.exe
  2⤵
  PID:9328
- C:\Windows\System\HSzmoPo.exe
  C:\Windows\System\HSzmoPo.exe
  2⤵
  PID:9444
- C:\Windows\System\YzgphVP.exe
  C:\Windows\System\YzgphVP.exe
  2⤵
  PID:11312
- C:\Windows\System\JxtUPuH.exe
  C:\Windows\System\JxtUPuH.exe
  2⤵
  PID:9500
- C:\Windows\System\tJyYjMy.exe
  C:\Windows\System\tJyYjMy.exe
  2⤵
  PID:12296
- C:\Windows\System\AiyywRW.exe
  C:\Windows\System\AiyywRW.exe
  2⤵
  PID:12320
- C:\Windows\System\RlHXlJJ.exe
  C:\Windows\System\RlHXlJJ.exe
  2⤵
  PID:12340
- C:\Windows\System\pJCbkTz.exe
  C:\Windows\System\pJCbkTz.exe
  2⤵
  PID:12360
- C:\Windows\System\pDGPnfc.exe
  C:\Windows\System\pDGPnfc.exe
  2⤵
  PID:12380
- C:\Windows\System\rPMwRPp.exe
  C:\Windows\System\rPMwRPp.exe
  2⤵
  PID:12404
- C:\Windows\System\JdcxiWJ.exe
  C:\Windows\System\JdcxiWJ.exe
  2⤵
  PID:12420
- C:\Windows\System\TRUsXuB.exe
  C:\Windows\System\TRUsXuB.exe
  2⤵
  PID:12440
- C:\Windows\System\ZTrtKRg.exe
  C:\Windows\System\ZTrtKRg.exe
  2⤵
  PID:12460
- C:\Windows\System\rCldJuc.exe
  C:\Windows\System\rCldJuc.exe
  2⤵
  PID:12484
- C:\Windows\System\UYozsDx.exe
  C:\Windows\System\UYozsDx.exe
  2⤵
  PID:12504
- C:\Windows\System\glCKGKN.exe
  C:\Windows\System\glCKGKN.exe
  2⤵
  PID:12524
- C:\Windows\System\UieMQSj.exe
  C:\Windows\System\UieMQSj.exe
  2⤵
  PID:12544
- C:\Windows\System\aDnQLtY.exe
  C:\Windows\System\aDnQLtY.exe
  2⤵
  PID:12572
- C:\Windows\System\OhfznkN.exe
  C:\Windows\System\OhfznkN.exe
  2⤵
  PID:12592
- C:\Windows\System\eAdjZFk.exe
  C:\Windows\System\eAdjZFk.exe
  2⤵
  PID:12608
- C:\Windows\System\VJMfCoK.exe
  C:\Windows\System\VJMfCoK.exe
  2⤵
  PID:12628
- C:\Windows\System\qPArSHO.exe
  C:\Windows\System\qPArSHO.exe
  2⤵
  PID:12644
- C:\Windows\System\YoqHRtj.exe
  C:\Windows\System\YoqHRtj.exe
  2⤵
  PID:12668
- C:\Windows\System\NZEPudK.exe
  C:\Windows\System\NZEPudK.exe
  2⤵
  PID:12688
- C:\Windows\System\WncQofC.exe
  C:\Windows\System\WncQofC.exe
  2⤵
  PID:12708
- C:\Windows\System\gabHzah.exe
  C:\Windows\System\gabHzah.exe
  2⤵
  PID:12732
- C:\Windows\System\FErfezu.exe
  C:\Windows\System\FErfezu.exe
  2⤵
  PID:12756
- C:\Windows\System\HcSkzQw.exe
  C:\Windows\System\HcSkzQw.exe
  2⤵
  PID:12780
- C:\Windows\System\amAszNu.exe
  C:\Windows\System\amAszNu.exe
  2⤵
  PID:12796
- C:\Windows\System\JrpLRva.exe
  C:\Windows\System\JrpLRva.exe
  2⤵
  PID:12816
- C:\Windows\System\CxhdOsU.exe
  C:\Windows\System\CxhdOsU.exe
  2⤵
  PID:12836
- C:\Windows\System\ZheOQCN.exe
  C:\Windows\System\ZheOQCN.exe
  2⤵
  PID:12856
- C:\Windows\System\WkATLvF.exe
  C:\Windows\System\WkATLvF.exe
  2⤵
  PID:12872
- C:\Windows\System\TCgzrRg.exe
  C:\Windows\System\TCgzrRg.exe
  2⤵
  PID:12896
- C:\Windows\System\BYVwvSF.exe
  C:\Windows\System\BYVwvSF.exe
  2⤵
  PID:12920
- C:\Windows\System\deTXfzU.exe
  C:\Windows\System\deTXfzU.exe
  2⤵
  PID:12944
- C:\Windows\System\qGCxPLS.exe
  C:\Windows\System\qGCxPLS.exe
  2⤵
  PID:12968
- C:\Windows\System\YtpkeWw.exe
  C:\Windows\System\YtpkeWw.exe
  2⤵
  PID:12992
- C:\Windows\System\sWoYAID.exe
  C:\Windows\System\sWoYAID.exe
  2⤵
  PID:13012
- C:\Windows\System\pTxlUej.exe
  C:\Windows\System\pTxlUej.exe
  2⤵
  PID:13032
- C:\Windows\System\HSHZoDW.exe
  C:\Windows\System\HSHZoDW.exe
  2⤵
  PID:13064
- C:\Windows\System\optACpA.exe
  C:\Windows\System\optACpA.exe
  2⤵
  PID:13100
- C:\Windows\System\YUseVYK.exe
  C:\Windows\System\YUseVYK.exe
  2⤵
  PID:13124
- C:\Windows\System\TjvMbHd.exe
  C:\Windows\System\TjvMbHd.exe
  2⤵
  PID:13148
- C:\Windows\System\ijxwoIF.exe
  C:\Windows\System\ijxwoIF.exe
  2⤵
  PID:13164
- C:\Windows\System\tUEqMSK.exe
  C:\Windows\System\tUEqMSK.exe
  2⤵
  PID:13180
- C:\Windows\System\xkZxVTR.exe
  C:\Windows\System\xkZxVTR.exe
  2⤵
  PID:13196
- C:\Windows\System\xVIcagf.exe
  C:\Windows\System\xVIcagf.exe
  2⤵
  PID:13212
- C:\Windows\System\vsgHTLN.exe
  C:\Windows\System\vsgHTLN.exe
  2⤵
  PID:13228
- C:\Windows\System\xSCILho.exe
  C:\Windows\System\xSCILho.exe
  2⤵
  PID:13244
- C:\Windows\System\kcmTdDp.exe
  C:\Windows\System\kcmTdDp.exe
  2⤵
  PID:13260
- C:\Windows\System\MDDboJl.exe
  C:\Windows\System\MDDboJl.exe
  2⤵
  PID:8988
- C:\Windows\System\XnepBpe.exe
  C:\Windows\System\XnepBpe.exe
  2⤵
  PID:10284
- C:\Windows\System\spcIYuE.exe
  C:\Windows\System\spcIYuE.exe
  2⤵
  PID:11908
- C:\Windows\System\eKranyh.exe
  C:\Windows\System\eKranyh.exe
  2⤵
  PID:11924
- C:\Windows\System\TpGpfxA.exe
  C:\Windows\System\TpGpfxA.exe
  2⤵
  PID:10888
- C:\Windows\System\RtyxIsS.exe
  C:\Windows\System\RtyxIsS.exe
  2⤵
  PID:10936
- C:\Windows\System\NLADuWc.exe
  C:\Windows\System\NLADuWc.exe
  2⤵
  PID:11144
- C:\Windows\System\qwlzWTO.exe
  C:\Windows\System\qwlzWTO.exe
  2⤵
  PID:11196
- C:\Windows\System\iJYVwNL.exe
  C:\Windows\System\iJYVwNL.exe
  2⤵
  PID:12492
- C:\Windows\System\bYKAllU.exe
  C:\Windows\System\bYKAllU.exe
  2⤵
  PID:10192
- C:\Windows\System\XthWDBY.exe
  C:\Windows\System\XthWDBY.exe
  2⤵
  PID:12292
- C:\Windows\System\UcuHOoz.exe
  C:\Windows\System\UcuHOoz.exe
  2⤵
  PID:12988
- C:\Windows\System\UqcNskw.exe
  C:\Windows\System\UqcNskw.exe
  2⤵
  PID:13088
- C:\Windows\System\IFVMHKv.exe
  C:\Windows\System\IFVMHKv.exe
  2⤵
  PID:13256
- C:\Windows\System\WbmXRsX.exe
  C:\Windows\System\WbmXRsX.exe
  2⤵
  PID:11588
- C:\Windows\System\TPWjXRz.exe
  C:\Windows\System\TPWjXRz.exe
  2⤵
  PID:12752
- C:\Windows\System\RmyBpSI.exe
  C:\Windows\System\RmyBpSI.exe
  2⤵
  PID:11668
- C:\Windows\System\HGMEKtA.exe
  C:\Windows\System\HGMEKtA.exe
  2⤵
  PID:11856
- C:\Windows\System\ywxpzpD.exe
  C:\Windows\System\ywxpzpD.exe
  2⤵
  PID:10328
- C:\Windows\System\YsYYMcT.exe
  C:\Windows\System\YsYYMcT.exe
  2⤵
  PID:9640
- C:\Windows\System\IzrWoLe.exe
  C:\Windows\System\IzrWoLe.exe
  2⤵
  PID:9684
- C:\Windows\System\NWlOrFp.exe
  C:\Windows\System\NWlOrFp.exe
  2⤵
  PID:9792
- C:\Windows\System\aChWaRU.exe
  C:\Windows\System\aChWaRU.exe
  2⤵
  PID:9948
- C:\Windows\System\AgCPRhN.exe
  C:\Windows\System\AgCPRhN.exe
  2⤵
  PID:10044
- C:\Windows\System\TyYNLxd.exe
  C:\Windows\System\TyYNLxd.exe
  2⤵
  PID:10176
- C:\Windows\System\XSQwKjK.exe
  C:\Windows\System\XSQwKjK.exe
  2⤵
  PID:10880
- C:\Windows\System\jrpalBV.exe
  C:\Windows\System\jrpalBV.exe
  2⤵
  PID:12772
- C:\Windows\System\pfawMKj.exe
  C:\Windows\System\pfawMKj.exe
  2⤵
  PID:11944
- C:\Windows\System\fSgecZg.exe
  C:\Windows\System\fSgecZg.exe
  2⤵
  PID:10380
- C:\Windows\System\qZXVEpM.exe
  C:\Windows\System\qZXVEpM.exe
  2⤵
  PID:3188
- C:\Windows\System\XYKUUyY.exe
  C:\Windows\System\XYKUUyY.exe
  2⤵
  PID:5076
- C:\Windows\System\TBPTxyO.exe
  C:\Windows\System\TBPTxyO.exe
  2⤵
  PID:10676
- C:\Windows\System\iROUdni.exe
  C:\Windows\System\iROUdni.exe
  2⤵
  PID:10000
- C:\Windows\System\hYsbbpP.exe
  C:\Windows\System\hYsbbpP.exe
  2⤵
  PID:3516
- C:\Windows\System\NtKbjll.exe
  C:\Windows\System\NtKbjll.exe
  2⤵
  PID:10144
- C:\Windows\System\soyuXdy.exe
  C:\Windows\System\soyuXdy.exe
  2⤵
  PID:7404
- C:\Windows\System\BRCeoVD.exe
  C:\Windows\System\BRCeoVD.exe
  2⤵
  PID:8228
- C:\Windows\System\XewicHj.exe
  C:\Windows\System\XewicHj.exe
  2⤵
  PID:2680
- C:\Windows\System\EeGqqWE.exe
  C:\Windows\System\EeGqqWE.exe
  2⤵
  PID:11400
- C:\Windows\System\zFPAuVu.exe
  C:\Windows\System\zFPAuVu.exe
  2⤵
  PID:7652
- C:\Windows\System\lsHZnWG.exe
  C:\Windows\System\lsHZnWG.exe
  2⤵
  PID:8668
- C:\Windows\System\uyYJbQT.exe
  C:\Windows\System\uyYJbQT.exe
  2⤵
  PID:7192
- C:\Windows\System\nwOhIxd.exe
  C:\Windows\System\nwOhIxd.exe
  2⤵
  PID:8812
- C:\Windows\System\bmydtfh.exe
  C:\Windows\System\bmydtfh.exe
  2⤵
  PID:9252
- C:\Windows\System\mjuSYDg.exe
  C:\Windows\System\mjuSYDg.exe
  2⤵
  PID:7112
- C:\Windows\System\yEeLFdD.exe
  C:\Windows\System\yEeLFdD.exe
  2⤵
  PID:2812
- C:\Windows\System\HSuAyrj.exe
  C:\Windows\System\HSuAyrj.exe
  2⤵
  PID:12416
- C:\Windows\System\ijrhQRe.exe
  C:\Windows\System\ijrhQRe.exe
  2⤵
  PID:13204
- C:\Windows\System\suQbkZe.exe
  C:\Windows\System\suQbkZe.exe
  2⤵
  PID:12740
- C:\Windows\System\zXzsIpo.exe
  C:\Windows\System\zXzsIpo.exe
  2⤵
  PID:2112
- C:\Windows\System\HPeeBix.exe
  C:\Windows\System\HPeeBix.exe
  2⤵
  PID:9656
- C:\Windows\System\glQdyPD.exe
  C:\Windows\System\glQdyPD.exe
  2⤵
  PID:8880
- C:\Windows\System\zwuGJah.exe
  C:\Windows\System\zwuGJah.exe
  2⤵
  PID:11100
- C:\Windows\System\cuhiwLi.exe
  C:\Windows\System\cuhiwLi.exe
  2⤵
  PID:4516
- C:\Windows\System\PxPdBJg.exe
  C:\Windows\System\PxPdBJg.exe
  2⤵
  PID:2548
- C:\Windows\System\NEGwSdx.exe
  C:\Windows\System\NEGwSdx.exe
  2⤵
  PID:12940
- C:\Windows\System\wXLlXjE.exe
  C:\Windows\System\wXLlXjE.exe
  2⤵
  PID:12788
- C:\Windows\System\ROMZvNZ.exe
  C:\Windows\System\ROMZvNZ.exe
  2⤵
  PID:10348
- C:\Windows\System\MAKpOdk.exe
  C:\Windows\System\MAKpOdk.exe
  2⤵
  PID:9344
- C:\Windows\System\doJnVat.exe
  C:\Windows\System\doJnVat.exe
  2⤵
  PID:10140
- C:\Windows\System\CgyubZD.exe
  C:\Windows\System\CgyubZD.exe
  2⤵
  PID:8772
- C:\Windows\System\OeNHHnm.exe
  C:\Windows\System\OeNHHnm.exe
  2⤵
  PID:3640
- C:\Windows\System\DSSjmeF.exe
  C:\Windows\System\DSSjmeF.exe
  2⤵
  PID:2280
- C:\Windows\System\cDWjlZD.exe
  C:\Windows\System\cDWjlZD.exe
  2⤵
  PID:13156
- C:\Windows\System\GqrxwGZ.exe
  C:\Windows\System\GqrxwGZ.exe
  2⤵
  PID:4332
- C:\Windows\System\hqTefbs.exe
  C:\Windows\System\hqTefbs.exe
  2⤵
  PID:8752
- C:\Windows\System\pBsWBUm.exe
  C:\Windows\System\pBsWBUm.exe
  2⤵
  PID:11900
- C:\Windows\System\HciGsGo.exe
  C:\Windows\System\HciGsGo.exe
  2⤵
  PID:2840
- C:\Windows\System\BEIZZlp.exe
  C:\Windows\System\BEIZZlp.exe
  2⤵
  PID:1820
- C:\Windows\System\xmqopVv.exe
  C:\Windows\System\xmqopVv.exe
  2⤵
  PID:7560
- C:\Windows\System\dycvowq.exe
  C:\Windows\System\dycvowq.exe
  2⤵
  PID:5004
- C:\Windows\System\TCoJpGM.exe
  C:\Windows\System\TCoJpGM.exe
  2⤵
  PID:6764
- C:\Windows\System\tMkKguv.exe
  C:\Windows\System\tMkKguv.exe
  2⤵
  PID:12032
- C:\Windows\System\iVeCmoy.exe
  C:\Windows\System\iVeCmoy.exe
  2⤵
  PID:12356
- C:\Windows\System\aRvmHhN.exe
  C:\Windows\System\aRvmHhN.exe
  2⤵
  PID:11632
- C:\Windows\System\pKJVjWG.exe
  C:\Windows\System\pKJVjWG.exe
  2⤵
  PID:11344
- C:\Windows\System\VYjqZFM.exe
  C:\Windows\System\VYjqZFM.exe
  2⤵
  PID:6168
- C:\Windows\System\jEeYMbt.exe
  C:\Windows\System\jEeYMbt.exe
  2⤵
  PID:1824
- C:\Windows\System\iTeUmhf.exe
  C:\Windows\System\iTeUmhf.exe
  2⤵
  PID:4940
- C:\Windows\System\vPtCvdq.exe
  C:\Windows\System\vPtCvdq.exe
  2⤵
  PID:9220
- C:\Windows\System\uqdkCeL.exe
  C:\Windows\System\uqdkCeL.exe
  2⤵
  PID:10640
- C:\Windows\System\KnzYCSq.exe
  C:\Windows\System\KnzYCSq.exe
  2⤵
  PID:12864
- C:\Windows\System\EhkeHgb.exe
  C:\Windows\System\EhkeHgb.exe
  2⤵
  PID:2292
- C:\Windows\System\HcAgAOG.exe
  C:\Windows\System\HcAgAOG.exe
  2⤵
  PID:3012
- C:\Windows\System\XBpFJkQ.exe
  C:\Windows\System\XBpFJkQ.exe
  2⤵
  PID:9832
- C:\Windows\System\uHKgCek.exe
  C:\Windows\System\uHKgCek.exe
  2⤵
  PID:13008
- C:\Windows\System\NjiICWJ.exe
  C:\Windows\System\NjiICWJ.exe
  2⤵
  PID:12636
- C:\Windows\System\mnfOOMV.exe
  C:\Windows\System\mnfOOMV.exe
  2⤵
  PID:6760
- C:\Windows\System\VooYyoP.exe
  C:\Windows\System\VooYyoP.exe
  2⤵
  PID:5688
- C:\Windows\System\culBXoL.exe
  C:\Windows\System\culBXoL.exe
  2⤵
  PID:6776
- C:\Windows\System\kwyMXIO.exe
  C:\Windows\System\kwyMXIO.exe
  2⤵
  PID:6796
- C:\Windows\System\LvPOQGR.exe
  C:\Windows\System\LvPOQGR.exe
  2⤵
  PID:2200
- C:\Windows\System\wxLInos.exe
  C:\Windows\System\wxLInos.exe
  2⤵
  PID:12724
- C:\Windows\System\MKaotcE.exe
  C:\Windows\System\MKaotcE.exe
  2⤵
  PID:10124
- C:\Windows\System\MMGUVEP.exe
  C:\Windows\System\MMGUVEP.exe
  2⤵
  PID:11684
- C:\Windows\System\rwqptVl.exe
  C:\Windows\System\rwqptVl.exe
  2⤵
  PID:2304
- C:\Windows\System\OgBYrDV.exe
  C:\Windows\System\OgBYrDV.exe
  2⤵
  PID:3472
- C:\Windows\System\SYENoiU.exe
  C:\Windows\System\SYENoiU.exe
  2⤵
  PID:12452
- C:\Windows\System\ISQqJOb.exe
  C:\Windows\System\ISQqJOb.exe
  2⤵
  PID:10908
- C:\Windows\System\RsGukGW.exe
  C:\Windows\System\RsGukGW.exe
  2⤵
  PID:12904
- C:\Windows\System\seAemDr.exe
  C:\Windows\System\seAemDr.exe
  2⤵
  PID:1272
- C:\Windows\System\UJhvdFn.exe
  C:\Windows\System\UJhvdFn.exe
  2⤵
  PID:6800
- C:\Windows\System\mMvepzN.exe
  C:\Windows\System\mMvepzN.exe
  2⤵
  PID:4924
- C:\Windows\System\qxpXwMr.exe
  C:\Windows\System\qxpXwMr.exe
  2⤵
  PID:6820
- C:\Windows\System\Shsigbw.exe
  C:\Windows\System\Shsigbw.exe
  2⤵
  PID:6812
- C:\Windows\System\UpVyrfg.exe
  C:\Windows\System\UpVyrfg.exe
  2⤵
  PID:13324
- C:\Windows\System\FAPMUwH.exe
  C:\Windows\System\FAPMUwH.exe
  2⤵
  PID:13348
- C:\Windows\System\KAIDNme.exe
  C:\Windows\System\KAIDNme.exe
  2⤵
  PID:13368
- C:\Windows\System\dXDJPqm.exe
  C:\Windows\System\dXDJPqm.exe
  2⤵
  PID:13388
- C:\Windows\System\hmZhIRB.exe
  C:\Windows\System\hmZhIRB.exe
  2⤵
  PID:13416
- C:\Windows\System\RjIGlNk.exe
  C:\Windows\System\RjIGlNk.exe
  2⤵
  PID:13436
- C:\Windows\System\BrZxuHT.exe
  C:\Windows\System\BrZxuHT.exe
  2⤵
  PID:13456
- C:\Windows\System\kXoCenk.exe
  C:\Windows\System\kXoCenk.exe
  2⤵
  PID:13660
- C:\Windows\System\jqPzvJe.exe
  C:\Windows\System\jqPzvJe.exe
  2⤵
  PID:13988
- C:\Windows\System\twoWzvq.exe
  C:\Windows\System\twoWzvq.exe
  2⤵
  PID:14040
- C:\Windows\System\JTAMEnr.exe
  C:\Windows\System\JTAMEnr.exe
  2⤵
  PID:14084
- C:\Windows\System\WLdvrkT.exe
  C:\Windows\System\WLdvrkT.exe
  2⤵
  PID:14152
- C:\Windows\System\raMXjVu.exe
  C:\Windows\System\raMXjVu.exe
  2⤵
  PID:14176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:10000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rtxln2fo.zof.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AfhYofJ.exe

Filesize
1.9MB

MD5
c8b3df545542d63bda13398693c6db5c

SHA1
c99c94c78b44b4fa6be894bc49362a739df82e5e

SHA256
2616feba30a35672b19f56051bf85fd472ab29e71487ea89d5712c2f89fb93a3

SHA512
da9f085f1278c424039d58783d33fd90b968d798bf65e4923d93522dcf2c4db883c73192619c17a332996bf0d4986a28032d23b749d5ba755547f572d0ba57d0

Download Submit
C:\Windows\System\CAzIoGZ.exe

Filesize
1.9MB

MD5
17868e3cd132a71a2ac9b59533877018

SHA1
ded69888c2fd37c21e64ac6f3da4d3d9995e2ce3

SHA256
b604f74b2e3f2358b7a931b4f48de865933d0260ff0934dba23717f580bfcc95

SHA512
055669a4c771a6b9f258ab124026ea21e7d5463033956462e153f439a577c9e22de98b123fa7c59a19dbc6a4bde07bac746a2c1f306624809e608c2072651b4b

Download Submit
C:\Windows\System\CXzBXdg.exe

Filesize
1.9MB

MD5
c7f1c73251ec1a5c94e1fe522c499cc0

SHA1
787eb56d66c98de2bcd4152d3aaee70dfa1144af

SHA256
e1b42d9ce1db290bcf759a6db67d1aff0ed5eb28004297a44321e8ca7deccce9

SHA512
f4662789ad3df25ad9e906e5efa787c9f2705a7f9affed10d4bac1980c877285de5ae47fc3b376e225bd3c7aa24f406c8467081bbdbc24f9b63d68bc4d937cc9

Download Submit
C:\Windows\System\DEbHbLo.exe

Filesize
1.9MB

MD5
3d16fe04939ca371179c0cade55fc764

SHA1
68588f96fe74f7f3c5455a0b8aa73b48c0f13a09

SHA256
e0b2db0856b5a7831f905768175772a00db408a165c397d9691a0c5dd14cb0ab

SHA512
19df711b1d743815b6f29410f1d21f7e9fa0c6dca33f5c19e17228e51c69b47fee4271a02b653141f6b1cc8d45c4ef834b9934f2ab7d7ecd772071384a47beda

Download Submit
C:\Windows\System\DFOWKBi.exe

Filesize
1.9MB

MD5
37c3838df98c6b26e6e7514f9c65c0fe

SHA1
0a6e4fdd601dce132a6a9b26ba6d69e2879e9ade

SHA256
e55bf97c498a3db67b1ba8e4fe72bd6357adb7e4d272d3c569dc012577be1e88

SHA512
853a7fa5d992cb187543a70ea99b99b83004190f85d419abc628b29c052eb3716ba7eb0fba436e0989bd7a1dccb0e4367d05ac4f1fea66464f535e38b82b5fd4

Download Submit
C:\Windows\System\FklfNUX.exe

Filesize
1.9MB

MD5
c363123be2d2a102057b44bf4d667e38

SHA1
f756d275220e5f80673fc824f3c7f00919d15e69

SHA256
b3675744ca3831eabdf0f56a020855ffa8d21efb5eab6bc64400424e4af4801e

SHA512
779fd08e8944f5fe6525d76118e5f5a88ad60887a21a9066bf0605c3a7d736b045c00e1efdff575c9345ca791d3cb7e758da1b30ce855d72645ae3339d1875e4

Download Submit
C:\Windows\System\FzMIBse.exe

Filesize
1.9MB

MD5
6b754072011fb17ba2c47280b031cd7a

SHA1
cc25c6b5130a8830ba53f0d6f054aef955561d2f

SHA256
ff09438baf0b842b1668540d0e153914484fff32e12ac6e010717196e520433d

SHA512
1da0ca5f897944dcabe5688e2b8aeb725cc953500487ac97cdcd63a2b38fd8c1ec3bc92019bf4ef2c0e1bc5ed1fcd13bbc2176362dfc2306b69fd3baecf16cc5

Download Submit
C:\Windows\System\HcnBsDx.exe

Filesize
1.9MB

MD5
37a8605eae5cd1d24bf86855c6e5f8be

SHA1
3c39c5921fcb165faded5efb968f297b6a919817

SHA256
7e3baa3cd845e5eb33e716585b88ff8e2571dd42c2cb26dbbebf0fe2a5ed04cd

SHA512
a19339a37c6e5778821639f435fe891f36e0ea684c907a3e2be50cbbb396b412b6e1de9932e69859ca17f00049ae0597e1069540d5d23906d006be4c8a3e81bb

Download Submit
C:\Windows\System\IbtPUAX.exe

Filesize
1.9MB

MD5
16e6fb042e8aecb0ff5a8062897df4fa

SHA1
c7d18818e9df98f4f29519bd53d860ca3699f787

SHA256
3ef9d7b35f6608ff14cbcf9f1eff975d939a523add8a5ae4757f2960fa18cec4

SHA512
fa25b264686a522adc866913c8e3e90de78e510995b3c9926243554db00b80b4e17aef1920be084263ab580a4770d74d8756fa72625cc5cfc9d24c9db875917b

Download Submit
C:\Windows\System\JurxMqv.exe

Filesize
1.9MB

MD5
a08cf9c7f2b81511ec110d19474be0c6

SHA1
3e6f8ed9c761be139a06826c84e9060eff1053c2

SHA256
0bb0c596317cfb468fe074862efa30610ca3a2aaed8effa2fb2c116e6ba965d7

SHA512
e4b09ee49d46958d72815a13551ac04ccfe24dff5ab884d23c94a66ab0d65ce2c75e098c074b28bedda9f166d0d128cfd1be2f388500f5ffc3fe85d170d5e8f6

Download Submit
C:\Windows\System\KyrQXkD.exe

Filesize
1.9MB

MD5
5138bec0da2d824b9a76cd2406b6178e

SHA1
5844f3bb2ab4be7e281f8af15c7e981cef24268e

SHA256
1808d317dafb96d94437a0be8c75d63f59593ef19114c660687bae3a7f8b9826

SHA512
e6a59de8b744b6685876f37ae8c4f03f24204cc4b0e899d8aa755480b429e65442c3053d26aad8d82676dcfb20c6eb4d8ad55fa6977970f2cc39f21284971937

Download Submit
C:\Windows\System\LiPdlfb.exe

Filesize
1.9MB

MD5
e014031453c26ae9e760f6e930855fb4

SHA1
72d609fd8778b77cf76561faca93970a1f8bab16

SHA256
fe5fd1758ac408ef172154978b0a47ce0e23b1e9617a7fcc934ac06cb9927d5b

SHA512
02830519e42c2cc74553f270e5cdd53123fd6dff66d8e0d4dcdf8d922535652309e0744cabfc546d26768ae4216a644613c68224df00a337360d93d46a547355

Download Submit
C:\Windows\System\OXPrSYs.exe

Filesize
1.9MB

MD5
8a6d4744f5a1b7f4a9d2984510488bd6

SHA1
66a70cb4a9981ce4453d5948b8348467ae94efda

SHA256
15bde39a93e76595b55bdfcc82e6b42957fe0f086aa12252346e58b2f54487ad

SHA512
709665be89e3754751f32cbc8c56148d524b43fcc6ef88326f66b63a3536c6691110ecfa680846a7c3602631ef0c31c2e96fe0e1254653e9b139051e0a96dd1d

Download Submit
C:\Windows\System\PgtZnpw.exe

Filesize
1.9MB

MD5
8972f029f484ee9c53b8a7071d80255a

SHA1
ab1021ea1a873d33f54cb67c7d25208c10e1aeb3

SHA256
aa5d8fa4415d8332a0343e76ac26ba1f037bd3891703b08376f8897d14417d20

SHA512
09981c59dcd5e989963a2bb906cc4cf26d40b74cbb8773f3798395802834607e902e57c8bfbb6cfac46d0d71be69004ab9f129e3d26039df5ad12e39399d4b25

Download Submit
C:\Windows\System\QYrVscs.exe

Filesize
1.9MB

MD5
adbdef8fbad4fa24955f204486f8a42f

SHA1
3465aa524c61d804433f9d586fc393f91008b4eb

SHA256
e0d89d3ca3aaf37febb97ca0f60d23d761af8eff6ab4b619cd6cfcfe827d63f9

SHA512
ba5b04d9b6bfc8fdfa1cecdb59602c3bfcc8db5a5d9da17a5349d44154a62bab9815bf4a79d653b0d5a2fc20457a5b8aca66e17dadfc196866fbc0f69fe8498c

Download Submit
C:\Windows\System\QfgaTtc.exe

Filesize
1.9MB

MD5
ae6d4292b6d32f5f6d819ca1310e4c62

SHA1
8aff4056fff3e201718859743ac556c830265cde

SHA256
19be6ca307d86a46b8b364b28826c30c4fafb40df01a4f62502825510681e506

SHA512
b719ff4c7af915369d6737a6275173ec4b512bbd3b8606d61dc9cb065a2acfe81b3f084e3ea62e5849d89c0200edd1c20cf6b750845003cbaba871a5d8d7cfea

Download Submit
C:\Windows\System\REZnytR.exe

Filesize
1.9MB

MD5
d5e091474303213d2dfec1c472bb6d36

SHA1
bd1745470c154559fe48064010de0fb00fdd20af

SHA256
c7bce4bdaf8ebbaa35a8b660889fdbe263c653086152fa80fef95638902469d3

SHA512
eddc7919e5161dd61b0cd2e39a1deba60d0e5ec9f3de6b2050e68e859de3ea47c588a1bd68009f62f424d9632d2c69b698cad764daa461bd222c25fef6d8c8ca

Download Submit
C:\Windows\System\ROtQCND.exe

Filesize
1.9MB

MD5
5274fb96db0ffe5aa45e0e130e502192

SHA1
f2209e2ba4cb5a4be0fd15ef6ea2620955f39fa8

SHA256
9a7641584164ee7fddd779cb2792983c36e98d88abd3bc26bfd57f0c2bfceade

SHA512
e46b2564272b257b47b7e4b0ec29ce51547b777a2b398c5ab48094c43bcb5e4b50a34fdc4ab32bfa4da9bdfa1ba712fb30056e1cd67ed51332bb1a693a448541

Download Submit
C:\Windows\System\UsgTpvq.exe

Filesize
1.9MB

MD5
b50a40fbb3efa6ed8adec2b8dfaf2c3e

SHA1
c41b0679d8e072d598b2a118e8d7f121ebeba269

SHA256
6ae07580cc81cfd346f0def9d9c81562f4309331a83e62f6ec4f5ffa6c6409eb

SHA512
97e9f8c5fadc6af48905d387c2a9c5141e6c4f4f083d4d28ca47ad100d184eee232379f4f7b717bdf406adab73a1cfcbd1a6290e74d2b5355cf0c1adb5c4adf0

Download Submit
C:\Windows\System\UysYMyN.exe

Filesize
1.9MB

MD5
6c91a387af753a2c5a49393c6b7787c4

SHA1
a252cd8e76783f52ce1aab8333e171a3bdbbbf90

SHA256
4b1ccd2034a3fdcf1bd3184b68f2c8e2f10bc8bf62cabb0f519fe48088b8b450

SHA512
35d00d10d7f6802196c32810f284edca2774ff8df35523785cd04714228c8c117627fefd256a8ba5fd20074829d9ff63520285371acd76f42c7a9d3b9b736251

Download Submit
C:\Windows\System\VPRkHhv.exe

Filesize
1.9MB

MD5
66bebb9bf875c2437f8ffb45fd35dd8f

SHA1
66ac474f75b1b024fc4f157ca69d0c78b858bd1f

SHA256
490a4d319a4f0a5ff815041cf86e36a0fb584f74059ef15447a859b72aef8e2f

SHA512
59e827bdfad4770d227b55f208f22190759dcccb0f081baf45ca24391e4dcaaca773f7c9e46e9a254d7b70673ad78a7cb1689377b36ce0d7281cb6ccd769e82e

Download Submit
C:\Windows\System\VoEDcTI.exe

Filesize
1.9MB

MD5
ab1adbf1584eff6d4a17b2565865d970

SHA1
25d6fdc1da7352a00471c47210a1ed89bc2979d3

SHA256
ec3da80956e4154cc224240b18afd31d3b69ddf8edb776367cf9727eb5de4073

SHA512
68fab348a175bf94da081e8ca026957c654db5489dca295edc89f9e53609729867c007b03f2b14869f9bdfb7f900d0b64ef38e0bcf316b77100dd0e2198ad00b

Download Submit
C:\Windows\System\YYdwdia.exe

Filesize
1.9MB

MD5
38c769bd63a1a300d856ab5ca7c066cf

SHA1
d61ed9038448fd3b1c33c61a2a02a2d0a8f78262

SHA256
61d063e54818f9b7619107d5e3b336f9d5de67181d69a9562e6aa158487debe7

SHA512
dbe1670f2392b874879ffd2a28739ae634fc8d34951cc5cf9f5b82c08e153a1d7cd69a91b83ea766dc895f53511ab0d08e88351c67620e6f1b1d5202b152fffd

Download Submit
C:\Windows\System\YaBXwgV.exe

Filesize
1.9MB

MD5
37c6deda13c36368e0d4a4f570cab051

SHA1
24e5302da47b5e43a94ed07bf40f1b634a988a06

SHA256
8d79d7956a986c25682385672b69dac6e4bcf63342a55aac023666ff550a5d24

SHA512
4b79ed6651bf1e837aba1c439ebb64f7874f1def926d8b515728b828c307bf741e9076f98226096180ff8e92605f6b347eb614bac2964c59eca6a8ac993d18eb

Download Submit
C:\Windows\System\ZYoDOKh.exe

Filesize
1.9MB

MD5
ee62b29754c3fdc2881ffb6989e04f72

SHA1
4274c0f9dd8e8b277d8c7722102e1fcd1a0bd252

SHA256
1ecffc9e9cfd18b48dffb51ca4a6a7d95d0639a35723b5d46fdf4f4c977fe12b

SHA512
36b258b7717d774602329eaf07847eddc80deec1f865dcd434308686c9ac9077adf91c683a8b59152f1a5fbd2c62b06e7d2e81cd02d27bb7fbc9b6888e603806

Download Submit
C:\Windows\System\ZuXofXO.exe

Filesize
8B

MD5
70d32c5686563edbb854aed29ea9d85c

SHA1
bd541445a50c65f1a6670fe5c95bea5d00e91b07

SHA256
7838364f90f7a979e688eff5ec314b7556d64c92bdfbd76fb1ec9602cec23e30

SHA512
23991ce500626bded4e2dc15b31393a89cfbbdda0d797292f12ec97001984de33a442b02e485bb8bd2704c63b7c242ef2cf2fc4fd62f7f428d253fd4da79e7f5

Download Submit
C:\Windows\System\cWvWSey.exe

Filesize
1.9MB

MD5
7cd073f68d0bed9fc511211eec45e20e

SHA1
b7c76d9d90b4ead6784418c7264cd77de4bf5906

SHA256
24cf62ed057ea8bcbf21f662dfcf495a7b5f690b2583e182086d3fc6e1ccae07

SHA512
80e370ca24d18c1e0a863006622878e13c26c17d38ff5e5f82a5f21880992eb05c360926bcacdfaa827129e426c9fe9f4d8019d3bff592c03d6a693e21773397

Download Submit
C:\Windows\System\cpsTSsT.exe

Filesize
1.9MB

MD5
e5f83ef766bbe44a31a293d14c0fabeb

SHA1
1b0c11b40882a099d6152f85f897f9ad28092e30

SHA256
9d7592bb001911c68ff25d0df3a8fcb0ecc7896251d5e285c21c3a808e063840

SHA512
7b92f529fb7eb38a991a833cccf268aa5b1cefecfcdcb8a3a3c6a4003fb5882c1f5dfb94baa71c1170d2e0c3bb7dd214000d0ccf7984a0f33bb3dc9e9230eb7a

Download Submit
C:\Windows\System\fAfscCN.exe

Filesize
1.9MB

MD5
040903d0116ddfbaf9a79982e684460d

SHA1
fbb152a78bb9b2ba86c887ef860c9e1da0f9eb75

SHA256
6f8815be9e3e0408f1342823dd1064f19c534ad74aadb23b92e8c6459caff9af

SHA512
3dfb42de72fe6258a448d274454587fae7c131e18e7a336b67881b6c0278b33448ab3d984bf57bddbaeaa7abe7b19b7dd9b3a51cf68ddb45740df63505a56acb

Download Submit
C:\Windows\System\ktHSHfj.exe

Filesize
1.9MB

MD5
cdc87912c80298dd979e70b50c7cc0ff

SHA1
08fe07af38699332e9a0a0a13c7928b2e083ba5a

SHA256
7ac4c07d44db9bf1ea4e018dd52c5b8656eb9ce9d564b2c59cda96bfc891cb93

SHA512
02cda8d74032e2ad9956717fdf0930f723e2502d76e65746a71cd0edb1af7f7d23514e435b38a2754c95ea874a93c49257eb78f342d424ed0579cd5c340b0c62

Download Submit
C:\Windows\System\mZyIsiE.exe

Filesize
1.9MB

MD5
a0b3e4b5ca1ac1b158a3475deb24c731

SHA1
126a5d3e2579acf4fc90cd5ca8756de284eff856

SHA256
7bfdf3496e67b80ffc480722310aef7e84c825d1609881494ccb3b4d9606ef4d

SHA512
759751aa5b3f07a179b8062ad83217917d0dceba931f89f53c3bf163bbf7188ba1b74da54e7d1c26e025506d4e864ee57b1956d017f8027d6231935b6c571575

Download Submit
C:\Windows\System\miDHYUQ.exe

Filesize
1.9MB

MD5
a9d42bb7c3538194992279f492070dee

SHA1
b41bfc55b864d53df93bf1b35197a10dbebba505

SHA256
808b9505272e8de40e85a9f9ab747b3d237ff81b5c35a084007e527ee3df6c49

SHA512
7554d2fc3c4f698dc55ae2bb68b1b5f242c4d9aad23d4dd49bd3f0b8d593ed2dc24deb49695746e2b1c8729ae93cd7c9e92358ccb71dac86d4c1e8b8e929bdf0

Download Submit
C:\Windows\System\nUraAxr.exe

Filesize
1.9MB

MD5
f7c1386a5cc147ff1d0d70ac8e686852

SHA1
ce6057f3d8a11c7e0a76e9c3d643f3c2cd17dea8

SHA256
4e4ffc1cb638de72f0c6b0716c6f7849a8619a0a38610fd8690686aa8043b7b2

SHA512
ad3255036adff1a906946395df4d367765d1ed5f05de2330b2314c64295b8ae0c39a3ad54c7c13395517a30380bb949e4e3b3b2180532ac1292dacb33539d1e5

Download Submit
C:\Windows\System\ogYzXuO.exe

Filesize
1.9MB

MD5
fbc49f44bd53328e6f8194de5fa6c56b

SHA1
6d19fa06a063faf4f23d9f79e2318bd15fc46c49

SHA256
7b3dad2861bfd7016cbdbcfe70a8f2c6157319ea1abcd0a6e880f59363b17838

SHA512
3024ca4546a41b087c176b14c007142946fe28c021b11f185fda1547b3428db8297fbc43935d1ee187e6d483325c14bac3ad404e5b2815ae4e7cd3ac64c6b74b

Download Submit
C:\Windows\System\sKNeLeB.exe

Filesize
1.9MB

MD5
962f1b8dd36998ab7906271bb5cb8de4

SHA1
a143dbc643bdbebe1118e06c4012e933c2e3c8e8

SHA256
7ae20da65fd7d5346d2bde1ed951509c1b05c02a51d47cc347608b6284e9de8b

SHA512
f69a357d6cf4fb2a6d940b6aea45882c1edf9c5a4382b89dc44343a711ae225d36406fd05f509abaf0632d75c16e936ff2eef42e17d12ae47a7d81bd5a737b68

Download Submit
C:\Windows\System\tgOIWVb.exe

Filesize
1.9MB

MD5
9d9af8f1f2aa211b6d5e71a43e175d54

SHA1
583a27818c89c46994e7c4487e586f9c812e4487

SHA256
c47973d6c5d9a0030e408392e1cf295dad10684b77e99a1b23f707d3ba9dd388

SHA512
0c096612e2d7d4ed4a5cbe3124e7d6e88fd5040b79813c4a9f2bc7a0353f98dc7a91fe77e5428bd19c16ba025f866080d09a4bdbd6e501921c051b6d79245b78

Download Submit
C:\Windows\System\uCMjOSe.exe

Filesize
1.9MB

MD5
f9859e0c30784ed815d48a87bd13295f

SHA1
69b72186dcff8467299d02acad54083ad5d88570

SHA256
98438f1788326efc8e20b677762707f8c03e816ffdb921924a327bab9660aaed

SHA512
0b64f4c35d5602cc5f13f46cc28f6f82308ea02ad1c4b80c0ed34c9e839c947c29dc423260db358dabacd4d0a39258d38c36c601c2dc636f6182e7d0abf46110

Download Submit
C:\Windows\System\vOlMtLY.exe

Filesize
1.9MB

MD5
ee17f428330d32dee70dd3a592d86379

SHA1
09537d36d81f08ffd45337d6a61c101463890e7f

SHA256
90ebad16f2dad45009b0d5c9015e1577536960ced37c9346895802fe13750f4a

SHA512
1c8122b1adbd6a5c0788be0d4d9ee8783d47555c3e2ec4e38b4726c05c9f8875e724b2bd0d0062ed66d812d6983275118a397f0ae7b8a7e5e41346ffee60ed9e

Download Submit
C:\Windows\System\vvHoAvW.exe

Filesize
1.9MB

MD5
ba8986222428670977b7c46306504868

SHA1
42b243b64bfd270d9020e7eace635d750f688c38

SHA256
74b0425634f5a582b850867210a6baf2e9178045e2f85ccf83449467ff825b3b

SHA512
9dccb6f8e9ed08fdf9e845f085c859222b76a5e032d4511657d81c21d786606bb92843b5ccee55213ad615f08d88eb25d18049ddba2185bb92e7fcadba4b838b

Download Submit
C:\Windows\System\yHDOvGF.exe

Filesize
1.9MB

MD5
141de7d54c6ce263773cccc157a9e2b3

SHA1
e1524ff26b83e7cbd34c3582b64cad1e073a6577

SHA256
07d1ce752ebb501b856c553535a00eefb89049e59dcc96f76a795e8aadeaccaf

SHA512
702ad1171912688dda36a12378c557be4b1980e863c1698dfde27f6eff7a07683eacad4b71ac05f5b7c1a15a61d18a713cd960e9b4bbd1fed84bbf6465c738e3

Download Submit
C:\Windows\System\zhHNSxQ.exe

Filesize
1.9MB

MD5
57b760609fc52ad4d9118555dd43c058

SHA1
08d5fb8772bef81eb9af6e1f7effcf34a93ab430

SHA256
741384a855385229bbb3747f9dbeb023bc1844c04c9d215f3d80d996a7674938

SHA512
0868610183cab78939f3ab71b30daf83ded222d223873eff98f0eb1590c1840178bb66e3fe78fa24ed6060d3fabe90dad02bd6bfdeedbe5e01c97da7e007da95

Download Submit
C:\Windows\System\zmGeYBP.exe

Filesize
1.9MB

MD5
ca2324a3df66741a3c56a09f0ae35637

SHA1
f451e52046e8de6cba520816ceaa993d7a577b2f

SHA256
82096d6604f29963debff1a5cea793a011d16c5a64d0cd600e0b9921d51e43e8

SHA512
2b16f0f82df05ff57c6bf2769ec4900235c7e76c9f466e177c47f5ae0a7796bf2c982f265aa735d9e2c242d807bdad1452c0c680d20161266192fa0646562977

Download Submit
memory/220-340-0x00007FF6135A0000-0x00007FF613992000-memory.dmp

Filesize
3.9MB

Download
memory/220-3011-0x00007FF6135A0000-0x00007FF613992000-memory.dmp

Filesize
3.9MB

Download
memory/388-518-0x00007FF77CAF0000-0x00007FF77CEE2000-memory.dmp

Filesize
3.9MB

Download
memory/388-3032-0x00007FF77CAF0000-0x00007FF77CEE2000-memory.dmp

Filesize
3.9MB

Download
memory/1032-517-0x00007FF7C6010000-0x00007FF7C6402000-memory.dmp

Filesize
3.9MB

Download
memory/1032-3042-0x00007FF7C6010000-0x00007FF7C6402000-memory.dmp

Filesize
3.9MB

Download
memory/1036-353-0x00007FF67E430000-0x00007FF67E822000-memory.dmp

Filesize
3.9MB

Download
memory/1036-3017-0x00007FF67E430000-0x00007FF67E822000-memory.dmp

Filesize
3.9MB

Download
memory/1296-1-0x0000020091710000-0x0000020091720000-memory.dmp

Filesize
64KB

Download
memory/1296-0-0x00007FF694EF0000-0x00007FF6952E2000-memory.dmp

Filesize
3.9MB

Download
memory/1336-526-0x00007FF6F6CD0000-0x00007FF6F70C2000-memory.dmp

Filesize
3.9MB

Download
memory/1336-3040-0x00007FF6F6CD0000-0x00007FF6F70C2000-memory.dmp

Filesize
3.9MB

Download
memory/1464-525-0x00007FF681900000-0x00007FF681CF2000-memory.dmp

Filesize
3.9MB

Download
memory/1464-3058-0x00007FF681900000-0x00007FF681CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-3015-0x00007FF78B600000-0x00007FF78B9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-458-0x00007FF78B600000-0x00007FF78B9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-339-0x00007FF781490000-0x00007FF781882000-memory.dmp

Filesize
3.9MB

Download
memory/2132-3007-0x00007FF781490000-0x00007FF781882000-memory.dmp

Filesize
3.9MB

Download
memory/2156-3009-0x00007FF68C560000-0x00007FF68C952000-memory.dmp

Filesize
3.9MB

Download
memory/2156-307-0x00007FF68C560000-0x00007FF68C952000-memory.dmp

Filesize
3.9MB

Download
memory/2380-528-0x00007FF61DDD0000-0x00007FF61E1C2000-memory.dmp

Filesize
3.9MB

Download
memory/2380-3051-0x00007FF61DDD0000-0x00007FF61E1C2000-memory.dmp

Filesize
3.9MB

Download
memory/2384-524-0x00007FF78D780000-0x00007FF78DB72000-memory.dmp

Filesize
3.9MB

Download
memory/2384-3038-0x00007FF78D780000-0x00007FF78DB72000-memory.dmp

Filesize
3.9MB

Download
memory/2688-523-0x00007FF6902A0000-0x00007FF690692000-memory.dmp

Filesize
3.9MB

Download
memory/2688-3027-0x00007FF6902A0000-0x00007FF690692000-memory.dmp

Filesize
3.9MB

Download
memory/2760-3045-0x00007FF62A950000-0x00007FF62AD42000-memory.dmp

Filesize
3.9MB

Download
memory/2760-515-0x00007FF62A950000-0x00007FF62AD42000-memory.dmp

Filesize
3.9MB

Download
memory/2988-3021-0x00007FF6ADB40000-0x00007FF6ADF32000-memory.dmp

Filesize
3.9MB

Download
memory/2988-227-0x00007FF6ADB40000-0x00007FF6ADF32000-memory.dmp

Filesize
3.9MB

Download
memory/3092-47-0x00007FFF38DF0000-0x00007FFF398B1000-memory.dmp

Filesize
10.8MB

Download
memory/3092-392-0x0000025EE2BD0000-0x0000025EE2BF2000-memory.dmp

Filesize
136KB

Download
memory/3092-151-0x00007FFF38DF0000-0x00007FFF398B1000-memory.dmp

Filesize
10.8MB

Download
memory/3092-7-0x00007FFF38DF3000-0x00007FFF38DF5000-memory.dmp

Filesize
8KB

Download
memory/3096-511-0x00007FF6B6770000-0x00007FF6B6B62000-memory.dmp

Filesize
3.9MB

Download
memory/3096-3023-0x00007FF6B6770000-0x00007FF6B6B62000-memory.dmp

Filesize
3.9MB

Download
memory/3324-512-0x00007FF676D70000-0x00007FF677162000-memory.dmp

Filesize
3.9MB

Download
memory/3324-3026-0x00007FF676D70000-0x00007FF677162000-memory.dmp

Filesize
3.9MB

Download
memory/3568-3061-0x00007FF759490000-0x00007FF759882000-memory.dmp

Filesize
3.9MB

Download
memory/3568-520-0x00007FF759490000-0x00007FF759882000-memory.dmp

Filesize
3.9MB

Download
memory/3576-3046-0x00007FF612830000-0x00007FF612C22000-memory.dmp

Filesize
3.9MB

Download
memory/3576-522-0x00007FF612830000-0x00007FF612C22000-memory.dmp

Filesize
3.9MB

Download
memory/3672-521-0x00007FF67F5A0000-0x00007FF67F992000-memory.dmp

Filesize
3.9MB

Download
memory/3672-3034-0x00007FF67F5A0000-0x00007FF67F992000-memory.dmp

Filesize
3.9MB

Download
memory/4300-516-0x00007FF7B6C00000-0x00007FF7B6FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4300-3029-0x00007FF7B6C00000-0x00007FF7B6FF2000-memory.dmp

Filesize
3.9MB

Download
memory/4496-3050-0x00007FF688E70000-0x00007FF689262000-memory.dmp

Filesize
3.9MB

Download
memory/4496-527-0x00007FF688E70000-0x00007FF689262000-memory.dmp

Filesize
3.9MB

Download
memory/4552-3019-0x00007FF643A30000-0x00007FF643E22000-memory.dmp

Filesize
3.9MB

Download
memory/4552-519-0x00007FF643A30000-0x00007FF643E22000-memory.dmp

Filesize
3.9MB

Download
memory/4724-529-0x00007FF797830000-0x00007FF797C22000-memory.dmp

Filesize
3.9MB

Download
memory/4724-3005-0x00007FF797830000-0x00007FF797C22000-memory.dmp

Filesize
3.9MB

Download
memory/4960-530-0x00007FF65EB50000-0x00007FF65EF42000-memory.dmp

Filesize
3.9MB

Download
memory/4960-3014-0x00007FF65EB50000-0x00007FF65EF42000-memory.dmp

Filesize
3.9MB

Download