xmrig | 549f1f4f292d5223a96ef7eefbfea4767ed20b1c74c6bd7ef4aad37e596e7eed

Analysis

max time kernel
152s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
Size 2.6MB
Sample240518-vv1m7aed96
SHA256 549f1f4f292d5223a96ef7eefbfea4767ed20b1c74c6bd7ef4aad37e596e7eed
MD5 19c94ffe907cbf9c8a57d8ae909ab800
SHA1 2990acaadb896aff38ea0e6bf8f0784c8b5d0e49
SHA512 f8b6b72243fb2ab1fa8583f9708660e3c6f0cf391954e99e1d275c94768a7c1c9343f38fb055cdb20ac54eb7abf5a9b7f2e82e47c065ecf2b099f16cc5ae3942
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2i:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4752-0-0x00007FF696E30000-0x00007FF697226000-memory.dmp	xmrig
behavioral2/files/0x0008000000023256-12.dat	xmrig
behavioral2/memory/440-20-0x00007FF63EC60000-0x00007FF63F056000-memory.dmp	xmrig
behavioral2/files/0x000800000002325e-24.dat	xmrig
behavioral2/memory/1184-27-0x00007FF602290000-0x00007FF602686000-memory.dmp	xmrig
behavioral2/files/0x0009000000023259-23.dat	xmrig
behavioral2/memory/4280-35-0x00007FF6BD7C0000-0x00007FF6BDBB6000-memory.dmp	xmrig
behavioral2/files/0x000800000002325a-36.dat	xmrig
behavioral2/memory/4992-40-0x00007FF615320000-0x00007FF615716000-memory.dmp	xmrig
behavioral2/files/0x000900000002325c-42.dat	xmrig
behavioral2/memory/4696-45-0x00007FF67A840000-0x00007FF67AC36000-memory.dmp	xmrig
behavioral2/files/0x000700000002325f-49.dat	xmrig
behavioral2/files/0x0007000000023260-54.dat	xmrig
behavioral2/memory/2620-58-0x00007FF71E5E0000-0x00007FF71E9D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023261-60.dat	xmrig
behavioral2/memory/4752-59-0x00007FF696E30000-0x00007FF697226000-memory.dmp	xmrig
behavioral2/files/0x0007000000023262-66.dat	xmrig
behavioral2/memory/692-72-0x00007FF747E30000-0x00007FF748226000-memory.dmp	xmrig
behavioral2/files/0x0007000000023264-74.dat	xmrig
behavioral2/files/0x0007000000023265-89.dat	xmrig
behavioral2/files/0x0007000000023266-91.dat	xmrig
behavioral2/memory/1984-88-0x00007FF61F3E0000-0x00007FF61F7D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023267-96.dat	xmrig
behavioral2/files/0x0007000000023263-79.dat	xmrig
behavioral2/memory/2164-75-0x00007FF71D190000-0x00007FF71D586000-memory.dmp	xmrig
behavioral2/files/0x0007000000023269-101.dat	xmrig
behavioral2/files/0x000700000002326a-106.dat	xmrig
behavioral2/files/0x000700000002326b-111.dat	xmrig
behavioral2/files/0x000700000002326c-114.dat	xmrig
behavioral2/files/0x000700000002326d-121.dat	xmrig
behavioral2/files/0x000700000002326e-126.dat	xmrig
behavioral2/files/0x000700000002326f-128.dat	xmrig
behavioral2/files/0x0007000000023270-135.dat	xmrig
behavioral2/files/0x0007000000023271-141.dat	xmrig
behavioral2/files/0x0007000000023272-146.dat	xmrig
behavioral2/files/0x0007000000023273-150.dat	xmrig
behavioral2/files/0x0007000000023275-160.dat	xmrig
behavioral2/files/0x0007000000023276-166.dat	xmrig
behavioral2/files/0x0007000000023278-173.dat	xmrig
behavioral2/files/0x0007000000023279-181.dat	xmrig
behavioral2/files/0x000700000002327a-186.dat	xmrig
behavioral2/files/0x0007000000023277-174.dat	xmrig
behavioral2/memory/1188-229-0x00007FF777A60000-0x00007FF777E56000-memory.dmp	xmrig
behavioral2/files/0x0007000000023274-156.dat	xmrig
behavioral2/memory/3772-259-0x00007FF739F70000-0x00007FF73A366000-memory.dmp	xmrig
behavioral2/memory/3624-288-0x00007FF6048C0000-0x00007FF604CB6000-memory.dmp	xmrig
behavioral2/memory/4072-315-0x00007FF76DF20000-0x00007FF76E316000-memory.dmp	xmrig
behavioral2/memory/3936-333-0x00007FF666C00000-0x00007FF666FF6000-memory.dmp	xmrig
behavioral2/memory/1484-304-0x00007FF74F5D0000-0x00007FF74F9C6000-memory.dmp	xmrig
behavioral2/memory/2108-303-0x00007FF707E20000-0x00007FF708216000-memory.dmp	xmrig
behavioral2/memory/2212-348-0x00007FF6BBA50000-0x00007FF6BBE46000-memory.dmp	xmrig
behavioral2/memory/4604-387-0x00007FF63A090000-0x00007FF63A486000-memory.dmp	xmrig
behavioral2/memory/3508-410-0x00007FF7AD800000-0x00007FF7ADBF6000-memory.dmp	xmrig
behavioral2/memory/5112-391-0x00007FF69A4E0000-0x00007FF69A8D6000-memory.dmp	xmrig
behavioral2/memory/4064-381-0x00007FF78ACD0000-0x00007FF78B0C6000-memory.dmp	xmrig
behavioral2/memory/4408-280-0x00007FF6E80C0000-0x00007FF6E84B6000-memory.dmp	xmrig
behavioral2/memory/3104-269-0x00007FF6F2FB0000-0x00007FF6F33A6000-memory.dmp	xmrig
behavioral2/memory/1596-254-0x00007FF627810000-0x00007FF627C06000-memory.dmp	xmrig
behavioral2/memory/440-1402-0x00007FF63EC60000-0x00007FF63F056000-memory.dmp	xmrig
behavioral2/memory/1184-1429-0x00007FF602290000-0x00007FF602686000-memory.dmp	xmrig
behavioral2/memory/4280-1474-0x00007FF6BD7C0000-0x00007FF6BDBB6000-memory.dmp	xmrig
behavioral2/memory/4696-1519-0x00007FF67A840000-0x00007FF67AC36000-memory.dmp	xmrig
behavioral2/memory/4992-1500-0x00007FF615320000-0x00007FF615716000-memory.dmp	xmrig
behavioral2/memory/2620-1562-0x00007FF71E5E0000-0x00007FF71E9D6000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
3	2236	powershell.exe
6	2236	powershell.exe
43	2236	powershell.exe
44	2236	powershell.exe
47	2236	powershell.exe
50	2236	powershell.exe
51	2236	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2236	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
440	XIDAdmf.exe
1184	KSfxEAh.exe
4280	zMxMcSH.exe
4992	RbuWnPK.exe
4696	pooGaHi.exe
2620	EtZganU.exe
692	nZmAeDk.exe
1984	xLJXFGT.exe
2164	wfDvgkl.exe
1188	eNdteEa.exe
1596	QYVwqnT.exe
3772	qDmvaQj.exe
5112	HMmDdvU.exe
3508	ZSLAtZa.exe
3104	IXbxYzp.exe
4408	WaEBVgR.exe
3624	nDFkujy.exe
2108	GVIRENo.exe
1484	UyHYLVG.exe
4072	VSKmuUN.exe
3936	FftVdhR.exe
2212	kxQenBl.exe
4064	ZgkkvQz.exe
4604	mIIlhaz.exe
1888	ZdNilbk.exe
1624	BitSNeC.exe
532	IWjfNAU.exe
3976	XFcvMZL.exe
4356	UUybcDI.exe
1780	gCflAKE.exe
1132	GZQbYCq.exe
2136	OznXhFM.exe
3868	yaitjoS.exe
820	VFwEpjT.exe
2312	DzYluMf.exe
1252	PQMjTzk.exe
1172	rqAiidl.exe
436	GTJdvuK.exe
640	gOnZKYE.exe
3540	KPyPKpn.exe
3224	AGFvCsq.exe
4068	UiJSegQ.exe
4332	baFlmnj.exe
452	VdIxdYe.exe
4212	GgcgKCM.exe
4624	kytfWbh.exe
1128	YOqKdmb.exe
3752	ZsniVlx.exe
4988	KDdBZtM.exe
2660	wVgTZLY.exe
3852	RyLDync.exe
1100	kBSQHyw.exe
1556	MlHvXVn.exe
3176	HoekgEq.exe
4480	DDhiOdB.exe
3940	bcImeUJ.exe
2296	lMpErNB.exe
2908	vWBjmsO.exe
3628	bDXQKGD.exe
4892	LGUoDrV.exe
2852	DJIpEHb.exe
2344	NJHhGCZ.exe
2364	KXnfPgf.exe
2528	istXefo.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4752-0-0x00007FF696E30000-0x00007FF697226000-memory.dmp	upx
behavioral2/files/0x0008000000023256-12.dat	upx
behavioral2/memory/440-20-0x00007FF63EC60000-0x00007FF63F056000-memory.dmp	upx
behavioral2/files/0x000800000002325e-24.dat	upx
behavioral2/memory/1184-27-0x00007FF602290000-0x00007FF602686000-memory.dmp	upx
behavioral2/files/0x0009000000023259-23.dat	upx
behavioral2/memory/4280-35-0x00007FF6BD7C0000-0x00007FF6BDBB6000-memory.dmp	upx
behavioral2/files/0x000800000002325a-36.dat	upx
behavioral2/memory/4992-40-0x00007FF615320000-0x00007FF615716000-memory.dmp	upx
behavioral2/files/0x000900000002325c-42.dat	upx
behavioral2/memory/4696-45-0x00007FF67A840000-0x00007FF67AC36000-memory.dmp	upx
behavioral2/files/0x000700000002325f-49.dat	upx
behavioral2/files/0x0007000000023260-54.dat	upx
behavioral2/memory/2620-58-0x00007FF71E5E0000-0x00007FF71E9D6000-memory.dmp	upx
behavioral2/files/0x0007000000023261-60.dat	upx
behavioral2/memory/4752-59-0x00007FF696E30000-0x00007FF697226000-memory.dmp	upx
behavioral2/files/0x0007000000023262-66.dat	upx
behavioral2/memory/692-72-0x00007FF747E30000-0x00007FF748226000-memory.dmp	upx
behavioral2/files/0x0007000000023264-74.dat	upx
behavioral2/files/0x0007000000023265-89.dat	upx
behavioral2/files/0x0007000000023266-91.dat	upx
behavioral2/memory/1984-88-0x00007FF61F3E0000-0x00007FF61F7D6000-memory.dmp	upx
behavioral2/files/0x0007000000023267-96.dat	upx
behavioral2/files/0x0007000000023263-79.dat	upx
behavioral2/memory/2164-75-0x00007FF71D190000-0x00007FF71D586000-memory.dmp	upx
behavioral2/files/0x0007000000023269-101.dat	upx
behavioral2/files/0x000700000002326a-106.dat	upx
behavioral2/files/0x000700000002326b-111.dat	upx
behavioral2/files/0x000700000002326c-114.dat	upx
behavioral2/files/0x000700000002326d-121.dat	upx
behavioral2/files/0x000700000002326e-126.dat	upx
behavioral2/files/0x000700000002326f-128.dat	upx
behavioral2/files/0x0007000000023270-135.dat	upx
behavioral2/files/0x0007000000023271-141.dat	upx
behavioral2/files/0x0007000000023272-146.dat	upx
behavioral2/files/0x0007000000023273-150.dat	upx
behavioral2/files/0x0007000000023275-160.dat	upx
behavioral2/files/0x0007000000023276-166.dat	upx
behavioral2/files/0x0007000000023278-173.dat	upx
behavioral2/files/0x0007000000023279-181.dat	upx
behavioral2/files/0x000700000002327a-186.dat	upx
behavioral2/files/0x0007000000023277-174.dat	upx
behavioral2/memory/1188-229-0x00007FF777A60000-0x00007FF777E56000-memory.dmp	upx
behavioral2/files/0x0007000000023274-156.dat	upx
behavioral2/memory/3772-259-0x00007FF739F70000-0x00007FF73A366000-memory.dmp	upx
behavioral2/memory/3624-288-0x00007FF6048C0000-0x00007FF604CB6000-memory.dmp	upx
behavioral2/memory/4072-315-0x00007FF76DF20000-0x00007FF76E316000-memory.dmp	upx
behavioral2/memory/3936-333-0x00007FF666C00000-0x00007FF666FF6000-memory.dmp	upx
behavioral2/memory/1484-304-0x00007FF74F5D0000-0x00007FF74F9C6000-memory.dmp	upx
behavioral2/memory/2108-303-0x00007FF707E20000-0x00007FF708216000-memory.dmp	upx
behavioral2/memory/2212-348-0x00007FF6BBA50000-0x00007FF6BBE46000-memory.dmp	upx
behavioral2/memory/4604-387-0x00007FF63A090000-0x00007FF63A486000-memory.dmp	upx
behavioral2/memory/3508-410-0x00007FF7AD800000-0x00007FF7ADBF6000-memory.dmp	upx
behavioral2/memory/5112-391-0x00007FF69A4E0000-0x00007FF69A8D6000-memory.dmp	upx
behavioral2/memory/4064-381-0x00007FF78ACD0000-0x00007FF78B0C6000-memory.dmp	upx
behavioral2/memory/4408-280-0x00007FF6E80C0000-0x00007FF6E84B6000-memory.dmp	upx
behavioral2/memory/3104-269-0x00007FF6F2FB0000-0x00007FF6F33A6000-memory.dmp	upx
behavioral2/memory/1596-254-0x00007FF627810000-0x00007FF627C06000-memory.dmp	upx
behavioral2/memory/440-1402-0x00007FF63EC60000-0x00007FF63F056000-memory.dmp	upx
behavioral2/memory/1184-1429-0x00007FF602290000-0x00007FF602686000-memory.dmp	upx
behavioral2/memory/4280-1474-0x00007FF6BD7C0000-0x00007FF6BDBB6000-memory.dmp	upx
behavioral2/memory/4696-1519-0x00007FF67A840000-0x00007FF67AC36000-memory.dmp	upx
behavioral2/memory/4992-1500-0x00007FF615320000-0x00007FF615716000-memory.dmp	upx
behavioral2/memory/2620-1562-0x00007FF71E5E0000-0x00007FF71E9D6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\GVByKIs.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\vZVIyBn.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\AdBSAgO.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\wKDaMQS.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\RyLDync.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\twYQffS.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\LuWUzDS.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\xpspmtk.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\WrGQjZC.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\XcGZLzM.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\ndWNdFD.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\FcdEEnX.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\gjGRwYo.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\wUIQHNJ.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\ssIxZzy.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\JiTgOUx.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\oKIheQD.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\cLWWees.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\wNUywNx.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\eEaMfqk.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\nMYhkxD.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\PzgrcGW.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\aGUxCkY.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\xiDdHzg.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\aZEcZJN.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\mpUwfyf.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\VSDhWYs.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\HXjbxjj.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\BoiUIDe.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\ajeVCnz.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\zMbnNvb.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\yxHgRiY.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\qrHGzPT.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\wpOYIyy.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\kECIIuL.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\moiPQxL.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\VXWFNfy.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\kJlSKiI.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\OEiKuyZ.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\PKEFGea.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\fPJMbiX.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\FUUjjuF.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\CtPCLCX.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\kbkEizT.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\LLvGrCa.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\KmguWIJ.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\NenFEOs.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\rAJygSC.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\ZSjXOql.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\gVZCdgX.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\AabqLLT.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\feeNuia.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\bGYqjKH.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\ttghlro.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\jVNqRxa.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\RfXUdDn.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\lmgKUvv.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\PlWLXYn.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\zINQEgg.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\hsMpGeR.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\GIEuWrd.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\PiaWgUx.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\vKPGDPn.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
File created	C:\Windows\System\HvrKKrX.exe	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2236	powershell.exe
2236	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeLockMemoryPrivilege	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 2236	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	91
PID 4752 wrote to memory of 2236	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	91
PID 4752 wrote to memory of 440	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	92
PID 4752 wrote to memory of 440	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	92
PID 4752 wrote to memory of 1184	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	93
PID 4752 wrote to memory of 1184	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	93
PID 4752 wrote to memory of 4280	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	94
PID 4752 wrote to memory of 4280	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	94
PID 4752 wrote to memory of 4992	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	95
PID 4752 wrote to memory of 4992	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	95
PID 4752 wrote to memory of 4696	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	96
PID 4752 wrote to memory of 4696	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	96
PID 4752 wrote to memory of 2620	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	97
PID 4752 wrote to memory of 2620	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	97
PID 4752 wrote to memory of 692	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	98
PID 4752 wrote to memory of 692	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	98
PID 4752 wrote to memory of 1984	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	99
PID 4752 wrote to memory of 1984	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	99
PID 4752 wrote to memory of 2164	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	100
PID 4752 wrote to memory of 2164	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	100
PID 4752 wrote to memory of 1188	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	101
PID 4752 wrote to memory of 1188	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	101
PID 4752 wrote to memory of 1596	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	102
PID 4752 wrote to memory of 1596	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	102
PID 4752 wrote to memory of 3772	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	103
PID 4752 wrote to memory of 3772	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	103
PID 4752 wrote to memory of 5112	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	104
PID 4752 wrote to memory of 5112	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	104
PID 4752 wrote to memory of 3508	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	105
PID 4752 wrote to memory of 3508	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	105
PID 4752 wrote to memory of 3104	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	106
PID 4752 wrote to memory of 3104	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	106
PID 4752 wrote to memory of 4408	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	107
PID 4752 wrote to memory of 4408	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	107
PID 4752 wrote to memory of 3624	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	108
PID 4752 wrote to memory of 3624	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	108
PID 4752 wrote to memory of 2108	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	109
PID 4752 wrote to memory of 2108	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	109
PID 4752 wrote to memory of 1484	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	110
PID 4752 wrote to memory of 1484	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	110
PID 4752 wrote to memory of 4072	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	111
PID 4752 wrote to memory of 4072	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	111
PID 4752 wrote to memory of 3936	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	112
PID 4752 wrote to memory of 3936	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	112
PID 4752 wrote to memory of 2212	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	113
PID 4752 wrote to memory of 2212	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	113
PID 4752 wrote to memory of 4064	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	114
PID 4752 wrote to memory of 4064	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	114
PID 4752 wrote to memory of 4604	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	115
PID 4752 wrote to memory of 4604	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	115
PID 4752 wrote to memory of 1888	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	116
PID 4752 wrote to memory of 1888	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	116
PID 4752 wrote to memory of 1624	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	117
PID 4752 wrote to memory of 1624	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	117
PID 4752 wrote to memory of 532	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	118
PID 4752 wrote to memory of 532	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	118
PID 4752 wrote to memory of 3976	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	119
PID 4752 wrote to memory of 3976	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	119
PID 4752 wrote to memory of 4356	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	120
PID 4752 wrote to memory of 4356	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	120
PID 4752 wrote to memory of 1780	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	121
PID 4752 wrote to memory of 1780	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	121
PID 4752 wrote to memory of 1132	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	122
PID 4752 wrote to memory of 1132	4752	19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe	122

C:\Users\Admin\AppData\Local\Temp\19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\19c94ffe907cbf9c8a57d8ae909ab800_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2236
- C:\Windows\System\XIDAdmf.exe
  C:\Windows\System\XIDAdmf.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\KSfxEAh.exe
  C:\Windows\System\KSfxEAh.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\zMxMcSH.exe
  C:\Windows\System\zMxMcSH.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\RbuWnPK.exe
  C:\Windows\System\RbuWnPK.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\pooGaHi.exe
  C:\Windows\System\pooGaHi.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\EtZganU.exe
  C:\Windows\System\EtZganU.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\nZmAeDk.exe
  C:\Windows\System\nZmAeDk.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\xLJXFGT.exe
  C:\Windows\System\xLJXFGT.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\wfDvgkl.exe
  C:\Windows\System\wfDvgkl.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\eNdteEa.exe
  C:\Windows\System\eNdteEa.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\QYVwqnT.exe
  C:\Windows\System\QYVwqnT.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\qDmvaQj.exe
  C:\Windows\System\qDmvaQj.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\HMmDdvU.exe
  C:\Windows\System\HMmDdvU.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\ZSLAtZa.exe
  C:\Windows\System\ZSLAtZa.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\IXbxYzp.exe
  C:\Windows\System\IXbxYzp.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\WaEBVgR.exe
  C:\Windows\System\WaEBVgR.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\nDFkujy.exe
  C:\Windows\System\nDFkujy.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\GVIRENo.exe
  C:\Windows\System\GVIRENo.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\UyHYLVG.exe
  C:\Windows\System\UyHYLVG.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\VSKmuUN.exe
  C:\Windows\System\VSKmuUN.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\FftVdhR.exe
  C:\Windows\System\FftVdhR.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\kxQenBl.exe
  C:\Windows\System\kxQenBl.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\ZgkkvQz.exe
  C:\Windows\System\ZgkkvQz.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\mIIlhaz.exe
  C:\Windows\System\mIIlhaz.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\ZdNilbk.exe
  C:\Windows\System\ZdNilbk.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\BitSNeC.exe
  C:\Windows\System\BitSNeC.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\IWjfNAU.exe
  C:\Windows\System\IWjfNAU.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\XFcvMZL.exe
  C:\Windows\System\XFcvMZL.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\UUybcDI.exe
  C:\Windows\System\UUybcDI.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\gCflAKE.exe
  C:\Windows\System\gCflAKE.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\GZQbYCq.exe
  C:\Windows\System\GZQbYCq.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\OznXhFM.exe
  C:\Windows\System\OznXhFM.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\yaitjoS.exe
  C:\Windows\System\yaitjoS.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\VFwEpjT.exe
  C:\Windows\System\VFwEpjT.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\DzYluMf.exe
  C:\Windows\System\DzYluMf.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\PQMjTzk.exe
  C:\Windows\System\PQMjTzk.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\rqAiidl.exe
  C:\Windows\System\rqAiidl.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\GTJdvuK.exe
  C:\Windows\System\GTJdvuK.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\gOnZKYE.exe
  C:\Windows\System\gOnZKYE.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\KPyPKpn.exe
  C:\Windows\System\KPyPKpn.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\AGFvCsq.exe
  C:\Windows\System\AGFvCsq.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\UiJSegQ.exe
  C:\Windows\System\UiJSegQ.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\baFlmnj.exe
  C:\Windows\System\baFlmnj.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\VdIxdYe.exe
  C:\Windows\System\VdIxdYe.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\ZsniVlx.exe
  C:\Windows\System\ZsniVlx.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\GgcgKCM.exe
  C:\Windows\System\GgcgKCM.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\kytfWbh.exe
  C:\Windows\System\kytfWbh.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\YOqKdmb.exe
  C:\Windows\System\YOqKdmb.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\KDdBZtM.exe
  C:\Windows\System\KDdBZtM.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\wVgTZLY.exe
  C:\Windows\System\wVgTZLY.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\RyLDync.exe
  C:\Windows\System\RyLDync.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\kBSQHyw.exe
  C:\Windows\System\kBSQHyw.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\MlHvXVn.exe
  C:\Windows\System\MlHvXVn.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\HoekgEq.exe
  C:\Windows\System\HoekgEq.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\DDhiOdB.exe
  C:\Windows\System\DDhiOdB.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\bcImeUJ.exe
  C:\Windows\System\bcImeUJ.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\lMpErNB.exe
  C:\Windows\System\lMpErNB.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\vWBjmsO.exe
  C:\Windows\System\vWBjmsO.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\bDXQKGD.exe
  C:\Windows\System\bDXQKGD.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\LGUoDrV.exe
  C:\Windows\System\LGUoDrV.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\KXnfPgf.exe
  C:\Windows\System\KXnfPgf.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\DJIpEHb.exe
  C:\Windows\System\DJIpEHb.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\NJHhGCZ.exe
  C:\Windows\System\NJHhGCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\RqphDDt.exe
  C:\Windows\System\RqphDDt.exe
  2⤵
  PID:1040
- C:\Windows\System\istXefo.exe
  C:\Windows\System\istXefo.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\UlOkjye.exe
  C:\Windows\System\UlOkjye.exe
  2⤵
  PID:4372
- C:\Windows\System\fzwhtqf.exe
  C:\Windows\System\fzwhtqf.exe
  2⤵
  PID:1856
- C:\Windows\System\hYxFzOP.exe
  C:\Windows\System\hYxFzOP.exe
  2⤵
  PID:4336
- C:\Windows\System\xpspmtk.exe
  C:\Windows\System\xpspmtk.exe
  2⤵
  PID:2608
- C:\Windows\System\pEeMtmr.exe
  C:\Windows\System\pEeMtmr.exe
  2⤵
  PID:1164
- C:\Windows\System\rqnSnRT.exe
  C:\Windows\System\rqnSnRT.exe
  2⤵
  PID:5124
- C:\Windows\System\aehYpKl.exe
  C:\Windows\System\aehYpKl.exe
  2⤵
  PID:5140
- C:\Windows\System\qRYpdZc.exe
  C:\Windows\System\qRYpdZc.exe
  2⤵
  PID:5160
- C:\Windows\System\LSFgNJz.exe
  C:\Windows\System\LSFgNJz.exe
  2⤵
  PID:5184
- C:\Windows\System\aAjEbyP.exe
  C:\Windows\System\aAjEbyP.exe
  2⤵
  PID:5216
- C:\Windows\System\DltkDMn.exe
  C:\Windows\System\DltkDMn.exe
  2⤵
  PID:5236
- C:\Windows\System\ssIxZzy.exe
  C:\Windows\System\ssIxZzy.exe
  2⤵
  PID:5264
- C:\Windows\System\RCOiyEi.exe
  C:\Windows\System\RCOiyEi.exe
  2⤵
  PID:5292
- C:\Windows\System\qbBzCnX.exe
  C:\Windows\System\qbBzCnX.exe
  2⤵
  PID:5324
- C:\Windows\System\DHdTgJK.exe
  C:\Windows\System\DHdTgJK.exe
  2⤵
  PID:5344
- C:\Windows\System\zTbVOiJ.exe
  C:\Windows\System\zTbVOiJ.exe
  2⤵
  PID:5372
- C:\Windows\System\lXHNtba.exe
  C:\Windows\System\lXHNtba.exe
  2⤵
  PID:5396
- C:\Windows\System\EmmfAfd.exe
  C:\Windows\System\EmmfAfd.exe
  2⤵
  PID:5412
- C:\Windows\System\dknVSPN.exe
  C:\Windows\System\dknVSPN.exe
  2⤵
  PID:5440
- C:\Windows\System\CtRxzaQ.exe
  C:\Windows\System\CtRxzaQ.exe
  2⤵
  PID:5468
- C:\Windows\System\jPOYAve.exe
  C:\Windows\System\jPOYAve.exe
  2⤵
  PID:5500
- C:\Windows\System\rFLNbQU.exe
  C:\Windows\System\rFLNbQU.exe
  2⤵
  PID:5600
- C:\Windows\System\lmgKUvv.exe
  C:\Windows\System\lmgKUvv.exe
  2⤵
  PID:5636
- C:\Windows\System\pAUTdrF.exe
  C:\Windows\System\pAUTdrF.exe
  2⤵
  PID:5672
- C:\Windows\System\hKEiApV.exe
  C:\Windows\System\hKEiApV.exe
  2⤵
  PID:5728
- C:\Windows\System\caEVKtf.exe
  C:\Windows\System\caEVKtf.exe
  2⤵
  PID:5772
- C:\Windows\System\sQBYYER.exe
  C:\Windows\System\sQBYYER.exe
  2⤵
  PID:5808
- C:\Windows\System\KGtpagM.exe
  C:\Windows\System\KGtpagM.exe
  2⤵
  PID:5872
- C:\Windows\System\GSgxQkm.exe
  C:\Windows\System\GSgxQkm.exe
  2⤵
  PID:5912
- C:\Windows\System\VJaUxMt.exe
  C:\Windows\System\VJaUxMt.exe
  2⤵
  PID:5936
- C:\Windows\System\MOnRmPW.exe
  C:\Windows\System\MOnRmPW.exe
  2⤵
  PID:5968
- C:\Windows\System\iIXOCLQ.exe
  C:\Windows\System\iIXOCLQ.exe
  2⤵
  PID:6000
- C:\Windows\System\cXvHHkl.exe
  C:\Windows\System\cXvHHkl.exe
  2⤵
  PID:6036
- C:\Windows\System\hFhFtLY.exe
  C:\Windows\System\hFhFtLY.exe
  2⤵
  PID:6080
- C:\Windows\System\kSKoxhJ.exe
  C:\Windows\System\kSKoxhJ.exe
  2⤵
  PID:6100
- C:\Windows\System\vrfPOUL.exe
  C:\Windows\System\vrfPOUL.exe
  2⤵
  PID:6124
- C:\Windows\System\lAKrHkR.exe
  C:\Windows\System\lAKrHkR.exe
  2⤵
  PID:6140
- C:\Windows\System\PbFbXql.exe
  C:\Windows\System\PbFbXql.exe
  2⤵
  PID:2388
- C:\Windows\System\ZxaWgQe.exe
  C:\Windows\System\ZxaWgQe.exe
  2⤵
  PID:1488
- C:\Windows\System\NkTdzBj.exe
  C:\Windows\System\NkTdzBj.exe
  2⤵
  PID:5132
- C:\Windows\System\IbnDWXv.exe
  C:\Windows\System\IbnDWXv.exe
  2⤵
  PID:3084
- C:\Windows\System\UTeSRIP.exe
  C:\Windows\System\UTeSRIP.exe
  2⤵
  PID:5360
- C:\Windows\System\heRvOcs.exe
  C:\Windows\System\heRvOcs.exe
  2⤵
  PID:4780
- C:\Windows\System\HyODDNg.exe
  C:\Windows\System\HyODDNg.exe
  2⤵
  PID:5384
- C:\Windows\System\NLlhQRG.exe
  C:\Windows\System\NLlhQRG.exe
  2⤵
  PID:5496
- C:\Windows\System\GYGDWWn.exe
  C:\Windows\System\GYGDWWn.exe
  2⤵
  PID:5628
- C:\Windows\System\QopNZNH.exe
  C:\Windows\System\QopNZNH.exe
  2⤵
  PID:5720
- C:\Windows\System\bYPYiuv.exe
  C:\Windows\System\bYPYiuv.exe
  2⤵
  PID:5780
- C:\Windows\System\dJlildk.exe
  C:\Windows\System\dJlildk.exe
  2⤵
  PID:5832
- C:\Windows\System\TtvtpBB.exe
  C:\Windows\System\TtvtpBB.exe
  2⤵
  PID:5904
- C:\Windows\System\JpXRdXp.exe
  C:\Windows\System\JpXRdXp.exe
  2⤵
  PID:1416
- C:\Windows\System\NPJLBIe.exe
  C:\Windows\System\NPJLBIe.exe
  2⤵
  PID:6024
- C:\Windows\System\yQHDncv.exe
  C:\Windows\System\yQHDncv.exe
  2⤵
  PID:6052
- C:\Windows\System\FPtXaGQ.exe
  C:\Windows\System\FPtXaGQ.exe
  2⤵
  PID:6088
- C:\Windows\System\UItyDZC.exe
  C:\Windows\System\UItyDZC.exe
  2⤵
  PID:5152
- C:\Windows\System\VulJPyN.exe
  C:\Windows\System\VulJPyN.exe
  2⤵
  PID:1892
- C:\Windows\System\XyJhKtA.exe
  C:\Windows\System\XyJhKtA.exe
  2⤵
  PID:5388
- C:\Windows\System\fPSnEct.exe
  C:\Windows\System\fPSnEct.exe
  2⤵
  PID:5484
- C:\Windows\System\GlGhDax.exe
  C:\Windows\System\GlGhDax.exe
  2⤵
  PID:5492
- C:\Windows\System\KMeRphA.exe
  C:\Windows\System\KMeRphA.exe
  2⤵
  PID:5824
- C:\Windows\System\tBqxQmQ.exe
  C:\Windows\System\tBqxQmQ.exe
  2⤵
  PID:5956
- C:\Windows\System\xLJbRHZ.exe
  C:\Windows\System\xLJbRHZ.exe
  2⤵
  PID:6060
- C:\Windows\System\LWsbhOW.exe
  C:\Windows\System\LWsbhOW.exe
  2⤵
  PID:6136
- C:\Windows\System\OvROnIP.exe
  C:\Windows\System\OvROnIP.exe
  2⤵
  PID:5280
- C:\Windows\System\BeplsWd.exe
  C:\Windows\System\BeplsWd.exe
  2⤵
  PID:5680
- C:\Windows\System\vEVQDAN.exe
  C:\Windows\System\vEVQDAN.exe
  2⤵
  PID:3872
- C:\Windows\System\wYvQfOE.exe
  C:\Windows\System\wYvQfOE.exe
  2⤵
  PID:5580
- C:\Windows\System\kKFvfFF.exe
  C:\Windows\System\kKFvfFF.exe
  2⤵
  PID:3828
- C:\Windows\System\VeijLrs.exe
  C:\Windows\System\VeijLrs.exe
  2⤵
  PID:4124
- C:\Windows\System\FFmwjLm.exe
  C:\Windows\System\FFmwjLm.exe
  2⤵
  PID:5920
- C:\Windows\System\bONSfVp.exe
  C:\Windows\System\bONSfVp.exe
  2⤵
  PID:5016
- C:\Windows\System\uuHHOYY.exe
  C:\Windows\System\uuHHOYY.exe
  2⤵
  PID:6156
- C:\Windows\System\kLuyOyO.exe
  C:\Windows\System\kLuyOyO.exe
  2⤵
  PID:6184
- C:\Windows\System\vhvCnlf.exe
  C:\Windows\System\vhvCnlf.exe
  2⤵
  PID:6220
- C:\Windows\System\fOTZwsz.exe
  C:\Windows\System\fOTZwsz.exe
  2⤵
  PID:6252
- C:\Windows\System\LKzVzGT.exe
  C:\Windows\System\LKzVzGT.exe
  2⤵
  PID:6276
- C:\Windows\System\mUkjnFL.exe
  C:\Windows\System\mUkjnFL.exe
  2⤵
  PID:6304
- C:\Windows\System\dGeKtUi.exe
  C:\Windows\System\dGeKtUi.exe
  2⤵
  PID:6336
- C:\Windows\System\DSeYJaS.exe
  C:\Windows\System\DSeYJaS.exe
  2⤵
  PID:6364
- C:\Windows\System\JWIypdQ.exe
  C:\Windows\System\JWIypdQ.exe
  2⤵
  PID:6392
- C:\Windows\System\YWEnNJo.exe
  C:\Windows\System\YWEnNJo.exe
  2⤵
  PID:6408
- C:\Windows\System\YLWpONf.exe
  C:\Windows\System\YLWpONf.exe
  2⤵
  PID:6424
- C:\Windows\System\fCbginG.exe
  C:\Windows\System\fCbginG.exe
  2⤵
  PID:6448
- C:\Windows\System\qcDSteV.exe
  C:\Windows\System\qcDSteV.exe
  2⤵
  PID:6484
- C:\Windows\System\UFyqQBD.exe
  C:\Windows\System\UFyqQBD.exe
  2⤵
  PID:6512
- C:\Windows\System\HCkOrqu.exe
  C:\Windows\System\HCkOrqu.exe
  2⤵
  PID:6544
- C:\Windows\System\cgutIyV.exe
  C:\Windows\System\cgutIyV.exe
  2⤵
  PID:6576
- C:\Windows\System\wOhEZEr.exe
  C:\Windows\System\wOhEZEr.exe
  2⤵
  PID:6604
- C:\Windows\System\VjOOMgz.exe
  C:\Windows\System\VjOOMgz.exe
  2⤵
  PID:6632
- C:\Windows\System\oGZJVBJ.exe
  C:\Windows\System\oGZJVBJ.exe
  2⤵
  PID:6664
- C:\Windows\System\uNoMgPT.exe
  C:\Windows\System\uNoMgPT.exe
  2⤵
  PID:6692
- C:\Windows\System\oRlyLjb.exe
  C:\Windows\System\oRlyLjb.exe
  2⤵
  PID:6724
- C:\Windows\System\yxDVooB.exe
  C:\Windows\System\yxDVooB.exe
  2⤵
  PID:6760
- C:\Windows\System\VcsElsx.exe
  C:\Windows\System\VcsElsx.exe
  2⤵
  PID:6788
- C:\Windows\System\BupcgHW.exe
  C:\Windows\System\BupcgHW.exe
  2⤵
  PID:6816
- C:\Windows\System\rBHXhHa.exe
  C:\Windows\System\rBHXhHa.exe
  2⤵
  PID:6844
- C:\Windows\System\WWrsrEi.exe
  C:\Windows\System\WWrsrEi.exe
  2⤵
  PID:6872
- C:\Windows\System\nMyfKRf.exe
  C:\Windows\System\nMyfKRf.exe
  2⤵
  PID:6900
- C:\Windows\System\AArZLQz.exe
  C:\Windows\System\AArZLQz.exe
  2⤵
  PID:6928
- C:\Windows\System\SmKCAOT.exe
  C:\Windows\System\SmKCAOT.exe
  2⤵
  PID:6952
- C:\Windows\System\Znlxszi.exe
  C:\Windows\System\Znlxszi.exe
  2⤵
  PID:6984
- C:\Windows\System\viSloRj.exe
  C:\Windows\System\viSloRj.exe
  2⤵
  PID:7012
- C:\Windows\System\UwywVjA.exe
  C:\Windows\System\UwywVjA.exe
  2⤵
  PID:7040
- C:\Windows\System\ogcnLIt.exe
  C:\Windows\System\ogcnLIt.exe
  2⤵
  PID:7068
- C:\Windows\System\dySdUeW.exe
  C:\Windows\System\dySdUeW.exe
  2⤵
  PID:7096
- C:\Windows\System\xsXxJAW.exe
  C:\Windows\System\xsXxJAW.exe
  2⤵
  PID:7124
- C:\Windows\System\InUATpm.exe
  C:\Windows\System\InUATpm.exe
  2⤵
  PID:7140
- C:\Windows\System\xiJjErf.exe
  C:\Windows\System\xiJjErf.exe
  2⤵
  PID:7156
- C:\Windows\System\ptcnVCJ.exe
  C:\Windows\System\ptcnVCJ.exe
  2⤵
  PID:6204
- C:\Windows\System\KNaIKae.exe
  C:\Windows\System\KNaIKae.exe
  2⤵
  PID:6244
- C:\Windows\System\ADQfDbi.exe
  C:\Windows\System\ADQfDbi.exe
  2⤵
  PID:6328
- C:\Windows\System\utzTLYz.exe
  C:\Windows\System\utzTLYz.exe
  2⤵
  PID:6376
- C:\Windows\System\iDlnMOC.exe
  C:\Windows\System\iDlnMOC.exe
  2⤵
  PID:6416
- C:\Windows\System\EMXSyuA.exe
  C:\Windows\System\EMXSyuA.exe
  2⤵
  PID:6528
- C:\Windows\System\QkOvKSt.exe
  C:\Windows\System\QkOvKSt.exe
  2⤵
  PID:6588
- C:\Windows\System\xblhQKD.exe
  C:\Windows\System\xblhQKD.exe
  2⤵
  PID:6676
- C:\Windows\System\AzrbRSB.exe
  C:\Windows\System\AzrbRSB.exe
  2⤵
  PID:6700
- C:\Windows\System\HjjAxgE.exe
  C:\Windows\System\HjjAxgE.exe
  2⤵
  PID:6772
- C:\Windows\System\JiTgOUx.exe
  C:\Windows\System\JiTgOUx.exe
  2⤵
  PID:6828
- C:\Windows\System\yvgavIN.exe
  C:\Windows\System\yvgavIN.exe
  2⤵
  PID:6896
- C:\Windows\System\KMnJjpl.exe
  C:\Windows\System\KMnJjpl.exe
  2⤵
  PID:6968
- C:\Windows\System\XISEomD.exe
  C:\Windows\System\XISEomD.exe
  2⤵
  PID:7032
- C:\Windows\System\bWLBnvi.exe
  C:\Windows\System\bWLBnvi.exe
  2⤵
  PID:7112
- C:\Windows\System\temJcoQ.exe
  C:\Windows\System\temJcoQ.exe
  2⤵
  PID:6196
- C:\Windows\System\IvbeMyV.exe
  C:\Windows\System\IvbeMyV.exe
  2⤵
  PID:6352
- C:\Windows\System\uzyKzZx.exe
  C:\Windows\System\uzyKzZx.exe
  2⤵
  PID:6388
- C:\Windows\System\YLYIEAh.exe
  C:\Windows\System\YLYIEAh.exe
  2⤵
  PID:6480
- C:\Windows\System\IicGwzG.exe
  C:\Windows\System\IicGwzG.exe
  2⤵
  PID:6568
- C:\Windows\System\lQhZWCn.exe
  C:\Windows\System\lQhZWCn.exe
  2⤵
  PID:6716
- C:\Windows\System\feeNuia.exe
  C:\Windows\System\feeNuia.exe
  2⤵
  PID:6864
- C:\Windows\System\AnnUPfq.exe
  C:\Windows\System\AnnUPfq.exe
  2⤵
  PID:6656
- C:\Windows\System\QlbXGlR.exe
  C:\Windows\System\QlbXGlR.exe
  2⤵
  PID:7092
- C:\Windows\System\ObwTRwR.exe
  C:\Windows\System\ObwTRwR.exe
  2⤵
  PID:6296
- C:\Windows\System\wEESsbG.exe
  C:\Windows\System\wEESsbG.exe
  2⤵
  PID:6620
- C:\Windows\System\YISnSbQ.exe
  C:\Windows\System\YISnSbQ.exe
  2⤵
  PID:7108
- C:\Windows\System\kCSpeDo.exe
  C:\Windows\System\kCSpeDo.exe
  2⤵
  PID:6420
- C:\Windows\System\QGfFQKj.exe
  C:\Windows\System\QGfFQKj.exe
  2⤵
  PID:7196
- C:\Windows\System\YDTrMGh.exe
  C:\Windows\System\YDTrMGh.exe
  2⤵
  PID:7232
- C:\Windows\System\cGUDpVo.exe
  C:\Windows\System\cGUDpVo.exe
  2⤵
  PID:7268
- C:\Windows\System\HMTIKov.exe
  C:\Windows\System\HMTIKov.exe
  2⤵
  PID:7304
- C:\Windows\System\KGBBQOA.exe
  C:\Windows\System\KGBBQOA.exe
  2⤵
  PID:7324
- C:\Windows\System\uJNpvfZ.exe
  C:\Windows\System\uJNpvfZ.exe
  2⤵
  PID:7352
- C:\Windows\System\HmEajWo.exe
  C:\Windows\System\HmEajWo.exe
  2⤵
  PID:7380
- C:\Windows\System\FUUjjuF.exe
  C:\Windows\System\FUUjjuF.exe
  2⤵
  PID:7416
- C:\Windows\System\DGdTuJT.exe
  C:\Windows\System\DGdTuJT.exe
  2⤵
  PID:7444
- C:\Windows\System\gNiQaRs.exe
  C:\Windows\System\gNiQaRs.exe
  2⤵
  PID:7472
- C:\Windows\System\PLOYJVT.exe
  C:\Windows\System\PLOYJVT.exe
  2⤵
  PID:7500
- C:\Windows\System\eMkFCmS.exe
  C:\Windows\System\eMkFCmS.exe
  2⤵
  PID:7532
- C:\Windows\System\OmdIEpd.exe
  C:\Windows\System\OmdIEpd.exe
  2⤵
  PID:7552
- C:\Windows\System\JJQTSJk.exe
  C:\Windows\System\JJQTSJk.exe
  2⤵
  PID:7580
- C:\Windows\System\fAobpJq.exe
  C:\Windows\System\fAobpJq.exe
  2⤵
  PID:7604
- C:\Windows\System\AaxBgjW.exe
  C:\Windows\System\AaxBgjW.exe
  2⤵
  PID:7632
- C:\Windows\System\AFqfeZD.exe
  C:\Windows\System\AFqfeZD.exe
  2⤵
  PID:7660
- C:\Windows\System\AfsbFgG.exe
  C:\Windows\System\AfsbFgG.exe
  2⤵
  PID:7720
- C:\Windows\System\xfrNrIS.exe
  C:\Windows\System\xfrNrIS.exe
  2⤵
  PID:7748
- C:\Windows\System\VKKBEmU.exe
  C:\Windows\System\VKKBEmU.exe
  2⤵
  PID:7764
- C:\Windows\System\QTuCcFU.exe
  C:\Windows\System\QTuCcFU.exe
  2⤵
  PID:7792
- C:\Windows\System\cKrBNsx.exe
  C:\Windows\System\cKrBNsx.exe
  2⤵
  PID:7820
- C:\Windows\System\mvuqkzp.exe
  C:\Windows\System\mvuqkzp.exe
  2⤵
  PID:7848
- C:\Windows\System\CRBBkge.exe
  C:\Windows\System\CRBBkge.exe
  2⤵
  PID:7876
- C:\Windows\System\ZvPqUQp.exe
  C:\Windows\System\ZvPqUQp.exe
  2⤵
  PID:7904
- C:\Windows\System\cVbzIrS.exe
  C:\Windows\System\cVbzIrS.exe
  2⤵
  PID:7932
- C:\Windows\System\JMKHYfC.exe
  C:\Windows\System\JMKHYfC.exe
  2⤵
  PID:7956
- C:\Windows\System\phWnIXS.exe
  C:\Windows\System\phWnIXS.exe
  2⤵
  PID:7988
- C:\Windows\System\vufTvzf.exe
  C:\Windows\System\vufTvzf.exe
  2⤵
  PID:8016
- C:\Windows\System\lMFvAtl.exe
  C:\Windows\System\lMFvAtl.exe
  2⤵
  PID:8040
- C:\Windows\System\ygcYXNQ.exe
  C:\Windows\System\ygcYXNQ.exe
  2⤵
  PID:8076
- C:\Windows\System\AkABHQw.exe
  C:\Windows\System\AkABHQw.exe
  2⤵
  PID:8100
- C:\Windows\System\NBNifjr.exe
  C:\Windows\System\NBNifjr.exe
  2⤵
  PID:8132
- C:\Windows\System\abaXTDP.exe
  C:\Windows\System\abaXTDP.exe
  2⤵
  PID:8164
- C:\Windows\System\sPyODDe.exe
  C:\Windows\System\sPyODDe.exe
  2⤵
  PID:5540
- C:\Windows\System\CPZUydw.exe
  C:\Windows\System\CPZUydw.exe
  2⤵
  PID:7224
- C:\Windows\System\LmONZIk.exe
  C:\Windows\System\LmONZIk.exe
  2⤵
  PID:7300
- C:\Windows\System\AJNlenW.exe
  C:\Windows\System\AJNlenW.exe
  2⤵
  PID:7372
- C:\Windows\System\owoOKFn.exe
  C:\Windows\System\owoOKFn.exe
  2⤵
  PID:7428
- C:\Windows\System\ChWSzTY.exe
  C:\Windows\System\ChWSzTY.exe
  2⤵
  PID:7516
- C:\Windows\System\CtPCLCX.exe
  C:\Windows\System\CtPCLCX.exe
  2⤵
  PID:7576
- C:\Windows\System\CdXoBeK.exe
  C:\Windows\System\CdXoBeK.exe
  2⤵
  PID:7620
- C:\Windows\System\kHIwbOf.exe
  C:\Windows\System\kHIwbOf.exe
  2⤵
  PID:6892
- C:\Windows\System\lgJqOvm.exe
  C:\Windows\System\lgJqOvm.exe
  2⤵
  PID:7528
- C:\Windows\System\PlWLXYn.exe
  C:\Windows\System\PlWLXYn.exe
  2⤵
  PID:7760
- C:\Windows\System\AvFFFsR.exe
  C:\Windows\System\AvFFFsR.exe
  2⤵
  PID:7816
- C:\Windows\System\WkBNOKH.exe
  C:\Windows\System\WkBNOKH.exe
  2⤵
  PID:7896
- C:\Windows\System\ZgtHiPa.exe
  C:\Windows\System\ZgtHiPa.exe
  2⤵
  PID:7924
- C:\Windows\System\pWEHWUd.exe
  C:\Windows\System\pWEHWUd.exe
  2⤵
  PID:7972
- C:\Windows\System\zyWfpPP.exe
  C:\Windows\System\zyWfpPP.exe
  2⤵
  PID:8032
- C:\Windows\System\VvjKiEo.exe
  C:\Windows\System\VvjKiEo.exe
  2⤵
  PID:8092
- C:\Windows\System\YJPvErD.exe
  C:\Windows\System\YJPvErD.exe
  2⤵
  PID:6564
- C:\Windows\System\wlnOYnu.exe
  C:\Windows\System\wlnOYnu.exe
  2⤵
  PID:7320
- C:\Windows\System\Nnhhlkq.exe
  C:\Windows\System\Nnhhlkq.exe
  2⤵
  PID:1216
- C:\Windows\System\kcsLxpY.exe
  C:\Windows\System\kcsLxpY.exe
  2⤵
  PID:7568
- C:\Windows\System\cLCREqS.exe
  C:\Windows\System\cLCREqS.exe
  2⤵
  PID:7784
- C:\Windows\System\pbyLvxs.exe
  C:\Windows\System\pbyLvxs.exe
  2⤵
  PID:7948
- C:\Windows\System\WhccvTK.exe
  C:\Windows\System\WhccvTK.exe
  2⤵
  PID:7288
- C:\Windows\System\ulpnWVV.exe
  C:\Windows\System\ulpnWVV.exe
  2⤵
  PID:7436
- C:\Windows\System\eeRVfQL.exe
  C:\Windows\System\eeRVfQL.exe
  2⤵
  PID:4896
- C:\Windows\System\gjtbPfO.exe
  C:\Windows\System\gjtbPfO.exe
  2⤵
  PID:3100
- C:\Windows\System\tmpQczD.exe
  C:\Windows\System\tmpQczD.exe
  2⤵
  PID:8232
- C:\Windows\System\czwODMa.exe
  C:\Windows\System\czwODMa.exe
  2⤵
  PID:8264
- C:\Windows\System\XmmreEp.exe
  C:\Windows\System\XmmreEp.exe
  2⤵
  PID:8304
- C:\Windows\System\AOZvRBo.exe
  C:\Windows\System\AOZvRBo.exe
  2⤵
  PID:8336
- C:\Windows\System\cznWKvZ.exe
  C:\Windows\System\cznWKvZ.exe
  2⤵
  PID:8368
- C:\Windows\System\fKrFtka.exe
  C:\Windows\System\fKrFtka.exe
  2⤵
  PID:8400
- C:\Windows\System\KwbAESF.exe
  C:\Windows\System\KwbAESF.exe
  2⤵
  PID:8428
- C:\Windows\System\XHsGkdq.exe
  C:\Windows\System\XHsGkdq.exe
  2⤵
  PID:8456
- C:\Windows\System\wCvcBaZ.exe
  C:\Windows\System\wCvcBaZ.exe
  2⤵
  PID:8496
- C:\Windows\System\mLaWUsB.exe
  C:\Windows\System\mLaWUsB.exe
  2⤵
  PID:8524
- C:\Windows\System\qWuZFMx.exe
  C:\Windows\System\qWuZFMx.exe
  2⤵
  PID:8540
- C:\Windows\System\xAjiAhK.exe
  C:\Windows\System\xAjiAhK.exe
  2⤵
  PID:8592
- C:\Windows\System\zELSQpf.exe
  C:\Windows\System\zELSQpf.exe
  2⤵
  PID:8620
- C:\Windows\System\YrjHIHt.exe
  C:\Windows\System\YrjHIHt.exe
  2⤵
  PID:8656
- C:\Windows\System\OxjrUAZ.exe
  C:\Windows\System\OxjrUAZ.exe
  2⤵
  PID:8692
- C:\Windows\System\KuHWkaE.exe
  C:\Windows\System\KuHWkaE.exe
  2⤵
  PID:8712
- C:\Windows\System\IcWBRlz.exe
  C:\Windows\System\IcWBRlz.exe
  2⤵
  PID:8744
- C:\Windows\System\NhLmoDN.exe
  C:\Windows\System\NhLmoDN.exe
  2⤵
  PID:8800
- C:\Windows\System\RCbiTHN.exe
  C:\Windows\System\RCbiTHN.exe
  2⤵
  PID:8836
- C:\Windows\System\XcOWOWy.exe
  C:\Windows\System\XcOWOWy.exe
  2⤵
  PID:8860
- C:\Windows\System\rquzgCp.exe
  C:\Windows\System\rquzgCp.exe
  2⤵
  PID:8880
- C:\Windows\System\SDgVTKu.exe
  C:\Windows\System\SDgVTKu.exe
  2⤵
  PID:8900
- C:\Windows\System\KgvSMtA.exe
  C:\Windows\System\KgvSMtA.exe
  2⤵
  PID:8928
- C:\Windows\System\PpvvXyk.exe
  C:\Windows\System\PpvvXyk.exe
  2⤵
  PID:8960
- C:\Windows\System\zPGatKL.exe
  C:\Windows\System\zPGatKL.exe
  2⤵
  PID:8984
- C:\Windows\System\eKFaidG.exe
  C:\Windows\System\eKFaidG.exe
  2⤵
  PID:9016
- C:\Windows\System\uYuOSuO.exe
  C:\Windows\System\uYuOSuO.exe
  2⤵
  PID:9036
- C:\Windows\System\rEQXruD.exe
  C:\Windows\System\rEQXruD.exe
  2⤵
  PID:9056
- C:\Windows\System\xKdJsHP.exe
  C:\Windows\System\xKdJsHP.exe
  2⤵
  PID:9088
- C:\Windows\System\fMAMtUB.exe
  C:\Windows\System\fMAMtUB.exe
  2⤵
  PID:9112
- C:\Windows\System\IyXOJLk.exe
  C:\Windows\System\IyXOJLk.exe
  2⤵
  PID:9140
- C:\Windows\System\GTopHUV.exe
  C:\Windows\System\GTopHUV.exe
  2⤵
  PID:9164
- C:\Windows\System\NenFEOs.exe
  C:\Windows\System\NenFEOs.exe
  2⤵
  PID:9200
- C:\Windows\System\IReuquD.exe
  C:\Windows\System\IReuquD.exe
  2⤵
  PID:8288
- C:\Windows\System\ibejjRb.exe
  C:\Windows\System\ibejjRb.exe
  2⤵
  PID:8356
- C:\Windows\System\lRqxQUq.exe
  C:\Windows\System\lRqxQUq.exe
  2⤵
  PID:8380
- C:\Windows\System\yfxTmxz.exe
  C:\Windows\System\yfxTmxz.exe
  2⤵
  PID:8420
- C:\Windows\System\tqqwPKp.exe
  C:\Windows\System\tqqwPKp.exe
  2⤵
  PID:8440
- C:\Windows\System\vtxkCOo.exe
  C:\Windows\System\vtxkCOo.exe
  2⤵
  PID:2712
- C:\Windows\System\HfnWdrx.exe
  C:\Windows\System\HfnWdrx.exe
  2⤵
  PID:8616
- C:\Windows\System\vIiWmJi.exe
  C:\Windows\System\vIiWmJi.exe
  2⤵
  PID:8704
- C:\Windows\System\ztNLHNb.exe
  C:\Windows\System\ztNLHNb.exe
  2⤵
  PID:8780
- C:\Windows\System\QkMyTEh.exe
  C:\Windows\System\QkMyTEh.exe
  2⤵
  PID:8828
- C:\Windows\System\ylJbBqz.exe
  C:\Windows\System\ylJbBqz.exe
  2⤵
  PID:8896
- C:\Windows\System\PjNZWKy.exe
  C:\Windows\System\PjNZWKy.exe
  2⤵
  PID:8944
- C:\Windows\System\uIlmUHN.exe
  C:\Windows\System\uIlmUHN.exe
  2⤵
  PID:8972
- C:\Windows\System\seVsMvN.exe
  C:\Windows\System\seVsMvN.exe
  2⤵
  PID:9028
- C:\Windows\System\EzPrgwa.exe
  C:\Windows\System\EzPrgwa.exe
  2⤵
  PID:9124
- C:\Windows\System\OZsWDAK.exe
  C:\Windows\System\OZsWDAK.exe
  2⤵
  PID:9108
- C:\Windows\System\yoobYYM.exe
  C:\Windows\System\yoobYYM.exe
  2⤵
  PID:9192
- C:\Windows\System\lPcRZrn.exe
  C:\Windows\System\lPcRZrn.exe
  2⤵
  PID:8476
- C:\Windows\System\Manbynr.exe
  C:\Windows\System\Manbynr.exe
  2⤵
  PID:8644
- C:\Windows\System\ipXgEbF.exe
  C:\Windows\System\ipXgEbF.exe
  2⤵
  PID:8820
- C:\Windows\System\BexftrG.exe
  C:\Windows\System\BexftrG.exe
  2⤵
  PID:8768
- C:\Windows\System\nitHnQY.exe
  C:\Windows\System\nitHnQY.exe
  2⤵
  PID:9100
- C:\Windows\System\SmdrLSh.exe
  C:\Windows\System\SmdrLSh.exe
  2⤵
  PID:8220
- C:\Windows\System\KKHEilP.exe
  C:\Windows\System\KKHEilP.exe
  2⤵
  PID:8468
- C:\Windows\System\EDxoLFY.exe
  C:\Windows\System\EDxoLFY.exe
  2⤵
  PID:9048
- C:\Windows\System\BoiUIDe.exe
  C:\Windows\System\BoiUIDe.exe
  2⤵
  PID:9152
- C:\Windows\System\dDDXpTr.exe
  C:\Windows\System\dDDXpTr.exe
  2⤵
  PID:8876
- C:\Windows\System\hNSFuPM.exe
  C:\Windows\System\hNSFuPM.exe
  2⤵
  PID:9252
- C:\Windows\System\ROrnhAk.exe
  C:\Windows\System\ROrnhAk.exe
  2⤵
  PID:9284
- C:\Windows\System\VPYhFls.exe
  C:\Windows\System\VPYhFls.exe
  2⤵
  PID:9324
- C:\Windows\System\UqlfkTI.exe
  C:\Windows\System\UqlfkTI.exe
  2⤵
  PID:9348
- C:\Windows\System\ALoCDtk.exe
  C:\Windows\System\ALoCDtk.exe
  2⤵
  PID:9368
- C:\Windows\System\AeuTRti.exe
  C:\Windows\System\AeuTRti.exe
  2⤵
  PID:9392
- C:\Windows\System\XkaGuhX.exe
  C:\Windows\System\XkaGuhX.exe
  2⤵
  PID:9424
- C:\Windows\System\njwbarT.exe
  C:\Windows\System\njwbarT.exe
  2⤵
  PID:9456
- C:\Windows\System\YzxOXzF.exe
  C:\Windows\System\YzxOXzF.exe
  2⤵
  PID:9480
- C:\Windows\System\rUpDRQs.exe
  C:\Windows\System\rUpDRQs.exe
  2⤵
  PID:9508
- C:\Windows\System\AETjyOS.exe
  C:\Windows\System\AETjyOS.exe
  2⤵
  PID:9548
- C:\Windows\System\pvWckYQ.exe
  C:\Windows\System\pvWckYQ.exe
  2⤵
  PID:9576
- C:\Windows\System\cfHXKfm.exe
  C:\Windows\System\cfHXKfm.exe
  2⤵
  PID:9592
- C:\Windows\System\KxVBhjs.exe
  C:\Windows\System\KxVBhjs.exe
  2⤵
  PID:9624
- C:\Windows\System\AabqLLT.exe
  C:\Windows\System\AabqLLT.exe
  2⤵
  PID:9652
- C:\Windows\System\aClmJYD.exe
  C:\Windows\System\aClmJYD.exe
  2⤵
  PID:9688
- C:\Windows\System\hAUpjUZ.exe
  C:\Windows\System\hAUpjUZ.exe
  2⤵
  PID:9716
- C:\Windows\System\bmXXvXw.exe
  C:\Windows\System\bmXXvXw.exe
  2⤵
  PID:9748
- C:\Windows\System\FkOiXGW.exe
  C:\Windows\System\FkOiXGW.exe
  2⤵
  PID:9764
- C:\Windows\System\IVkwTIb.exe
  C:\Windows\System\IVkwTIb.exe
  2⤵
  PID:9792
- C:\Windows\System\VqLmzmi.exe
  C:\Windows\System\VqLmzmi.exe
  2⤵
  PID:9820
- C:\Windows\System\rbyIVhr.exe
  C:\Windows\System\rbyIVhr.exe
  2⤵
  PID:9848
- C:\Windows\System\AuEvisZ.exe
  C:\Windows\System\AuEvisZ.exe
  2⤵
  PID:9880
- C:\Windows\System\FgbPnik.exe
  C:\Windows\System\FgbPnik.exe
  2⤵
  PID:9904
- C:\Windows\System\yaexjMn.exe
  C:\Windows\System\yaexjMn.exe
  2⤵
  PID:9936
- C:\Windows\System\xqfeFVm.exe
  C:\Windows\System\xqfeFVm.exe
  2⤵
  PID:9960
- C:\Windows\System\bfBplKb.exe
  C:\Windows\System\bfBplKb.exe
  2⤵
  PID:9980
- C:\Windows\System\oimkSlx.exe
  C:\Windows\System\oimkSlx.exe
  2⤵
  PID:10004
- C:\Windows\System\loDbApQ.exe
  C:\Windows\System\loDbApQ.exe
  2⤵
  PID:10036
- C:\Windows\System\eZEARLW.exe
  C:\Windows\System\eZEARLW.exe
  2⤵
  PID:10068
- C:\Windows\System\ILicXti.exe
  C:\Windows\System\ILicXti.exe
  2⤵
  PID:10092
- C:\Windows\System\cfKeMMU.exe
  C:\Windows\System\cfKeMMU.exe
  2⤵
  PID:10124
- C:\Windows\System\yVkVOzm.exe
  C:\Windows\System\yVkVOzm.exe
  2⤵
  PID:10148
- C:\Windows\System\nPxqZGY.exe
  C:\Windows\System\nPxqZGY.exe
  2⤵
  PID:10180
- C:\Windows\System\asYHIiQ.exe
  C:\Windows\System\asYHIiQ.exe
  2⤵
  PID:10204
- C:\Windows\System\zMXHODw.exe
  C:\Windows\System\zMXHODw.exe
  2⤵
  PID:10236
- C:\Windows\System\eOgvTQc.exe
  C:\Windows\System\eOgvTQc.exe
  2⤵
  PID:9240
- C:\Windows\System\qzsOThp.exe
  C:\Windows\System\qzsOThp.exe
  2⤵
  PID:9336
- C:\Windows\System\qlmyzHb.exe
  C:\Windows\System\qlmyzHb.exe
  2⤵
  PID:9404
- C:\Windows\System\QDPGTsx.exe
  C:\Windows\System\QDPGTsx.exe
  2⤵
  PID:9444
- C:\Windows\System\KMEVDTW.exe
  C:\Windows\System\KMEVDTW.exe
  2⤵
  PID:9536
- C:\Windows\System\Ekaqvua.exe
  C:\Windows\System\Ekaqvua.exe
  2⤵
  PID:9604
- C:\Windows\System\foSBYmy.exe
  C:\Windows\System\foSBYmy.exe
  2⤵
  PID:9616
- C:\Windows\System\kaukZkB.exe
  C:\Windows\System\kaukZkB.exe
  2⤵
  PID:9712
- C:\Windows\System\jyinRkX.exe
  C:\Windows\System\jyinRkX.exe
  2⤵
  PID:9804
- C:\Windows\System\acKTOFW.exe
  C:\Windows\System\acKTOFW.exe
  2⤵
  PID:9860
- C:\Windows\System\bGYqjKH.exe
  C:\Windows\System\bGYqjKH.exe
  2⤵
  PID:9916
- C:\Windows\System\GCzbsAx.exe
  C:\Windows\System\GCzbsAx.exe
  2⤵
  PID:9968
- C:\Windows\System\LhWcMAe.exe
  C:\Windows\System\LhWcMAe.exe
  2⤵
  PID:10056
- C:\Windows\System\qlALBOI.exe
  C:\Windows\System\qlALBOI.exe
  2⤵
  PID:10112
- C:\Windows\System\cRjFhGK.exe
  C:\Windows\System\cRjFhGK.exe
  2⤵
  PID:10200
- C:\Windows\System\GPnPpYe.exe
  C:\Windows\System\GPnPpYe.exe
  2⤵
  PID:10224
- C:\Windows\System\mmTUuiM.exe
  C:\Windows\System\mmTUuiM.exe
  2⤵
  PID:9296
- C:\Windows\System\xwokjxL.exe
  C:\Windows\System\xwokjxL.exe
  2⤵
  PID:9564
- C:\Windows\System\TiriHpN.exe
  C:\Windows\System\TiriHpN.exe
  2⤵
  PID:9676
- C:\Windows\System\qviqMUU.exe
  C:\Windows\System\qviqMUU.exe
  2⤵
  PID:9756
- C:\Windows\System\clNDlyn.exe
  C:\Windows\System\clNDlyn.exe
  2⤵
  PID:9944
- C:\Windows\System\qxOQsec.exe
  C:\Windows\System\qxOQsec.exe
  2⤵
  PID:10104
- C:\Windows\System\VTHRztA.exe
  C:\Windows\System\VTHRztA.exe
  2⤵
  PID:9268
- C:\Windows\System\yXGgxlU.exe
  C:\Windows\System\yXGgxlU.exe
  2⤵
  PID:9636
- C:\Windows\System\kYHrPet.exe
  C:\Windows\System\kYHrPet.exe
  2⤵
  PID:10028
- C:\Windows\System\kzKTnYU.exe
  C:\Windows\System\kzKTnYU.exe
  2⤵
  PID:9832
- C:\Windows\System\gItMQRL.exe
  C:\Windows\System\gItMQRL.exe
  2⤵
  PID:10244
- C:\Windows\System\dIpBkUN.exe
  C:\Windows\System\dIpBkUN.exe
  2⤵
  PID:10272
- C:\Windows\System\rCphTPR.exe
  C:\Windows\System\rCphTPR.exe
  2⤵
  PID:10292
- C:\Windows\System\aTuinVk.exe
  C:\Windows\System\aTuinVk.exe
  2⤵
  PID:10312
- C:\Windows\System\bZDTlOI.exe
  C:\Windows\System\bZDTlOI.exe
  2⤵
  PID:10332
- C:\Windows\System\aRQYJkb.exe
  C:\Windows\System\aRQYJkb.exe
  2⤵
  PID:10360
- C:\Windows\System\cXmIfsy.exe
  C:\Windows\System\cXmIfsy.exe
  2⤵
  PID:10388
- C:\Windows\System\zzAixwh.exe
  C:\Windows\System\zzAixwh.exe
  2⤵
  PID:10408
- C:\Windows\System\mFwMZwN.exe
  C:\Windows\System\mFwMZwN.exe
  2⤵
  PID:10432
- C:\Windows\System\SBHVSdc.exe
  C:\Windows\System\SBHVSdc.exe
  2⤵
  PID:10456
- C:\Windows\System\oFnhkxL.exe
  C:\Windows\System\oFnhkxL.exe
  2⤵
  PID:10476
- C:\Windows\System\lipRJBz.exe
  C:\Windows\System\lipRJBz.exe
  2⤵
  PID:10500
- C:\Windows\System\rKwTWii.exe
  C:\Windows\System\rKwTWii.exe
  2⤵
  PID:10516
- C:\Windows\System\VqSaEtA.exe
  C:\Windows\System\VqSaEtA.exe
  2⤵
  PID:10532
- C:\Windows\System\BrSCPRX.exe
  C:\Windows\System\BrSCPRX.exe
  2⤵
  PID:10556
- C:\Windows\System\sBBKJYG.exe
  C:\Windows\System\sBBKJYG.exe
  2⤵
  PID:10576
- C:\Windows\System\NifQFHF.exe
  C:\Windows\System\NifQFHF.exe
  2⤵
  PID:10596
- C:\Windows\System\MSgFyqj.exe
  C:\Windows\System\MSgFyqj.exe
  2⤵
  PID:10624
- C:\Windows\System\gCTfMyZ.exe
  C:\Windows\System\gCTfMyZ.exe
  2⤵
  PID:10652
- C:\Windows\System\LpmnVoH.exe
  C:\Windows\System\LpmnVoH.exe
  2⤵
  PID:10684
- C:\Windows\System\YIpYFru.exe
  C:\Windows\System\YIpYFru.exe
  2⤵
  PID:10716
- C:\Windows\System\HvrKKrX.exe
  C:\Windows\System\HvrKKrX.exe
  2⤵
  PID:10744
- C:\Windows\System\cPnXWkW.exe
  C:\Windows\System\cPnXWkW.exe
  2⤵
  PID:10772
- C:\Windows\System\oOuvnNQ.exe
  C:\Windows\System\oOuvnNQ.exe
  2⤵
  PID:10804
- C:\Windows\System\pIohwCV.exe
  C:\Windows\System\pIohwCV.exe
  2⤵
  PID:10868
- C:\Windows\System\raIXyxM.exe
  C:\Windows\System\raIXyxM.exe
  2⤵
  PID:10900
- C:\Windows\System\tPauQRE.exe
  C:\Windows\System\tPauQRE.exe
  2⤵
  PID:10944
- C:\Windows\System\xYJLEBP.exe
  C:\Windows\System\xYJLEBP.exe
  2⤵
  PID:10972
- C:\Windows\System\LLvfcaA.exe
  C:\Windows\System\LLvfcaA.exe
  2⤵
  PID:10988
- C:\Windows\System\HtwFxVa.exe
  C:\Windows\System\HtwFxVa.exe
  2⤵
  PID:11016
- C:\Windows\System\gzjYrBX.exe
  C:\Windows\System\gzjYrBX.exe
  2⤵
  PID:11040
- C:\Windows\System\WqgcKkV.exe
  C:\Windows\System\WqgcKkV.exe
  2⤵
  PID:11100
- C:\Windows\System\UQApxSQ.exe
  C:\Windows\System\UQApxSQ.exe
  2⤵
  PID:11116
- C:\Windows\System\yPoDGZD.exe
  C:\Windows\System\yPoDGZD.exe
  2⤵
  PID:11144
- C:\Windows\System\KUrMZCk.exe
  C:\Windows\System\KUrMZCk.exe
  2⤵
  PID:11160
- C:\Windows\System\pxYENRs.exe
  C:\Windows\System\pxYENRs.exe
  2⤵
  PID:11224
- C:\Windows\System\sbdCZRT.exe
  C:\Windows\System\sbdCZRT.exe
  2⤵
  PID:11252
- C:\Windows\System\RwUJgWb.exe
  C:\Windows\System\RwUJgWb.exe
  2⤵
  PID:1992
- C:\Windows\System\hGDiqgI.exe
  C:\Windows\System\hGDiqgI.exe
  2⤵
  PID:10284
- C:\Windows\System\wfrAGVp.exe
  C:\Windows\System\wfrAGVp.exe
  2⤵
  PID:10320
- C:\Windows\System\LmyAmPk.exe
  C:\Windows\System\LmyAmPk.exe
  2⤵
  PID:10380
- C:\Windows\System\LGktbeW.exe
  C:\Windows\System\LGktbeW.exe
  2⤵
  PID:10424
- C:\Windows\System\pWAcKDL.exe
  C:\Windows\System\pWAcKDL.exe
  2⤵
  PID:10464
- C:\Windows\System\dVjkWcL.exe
  C:\Windows\System\dVjkWcL.exe
  2⤵
  PID:10484
- C:\Windows\System\bJTJHpf.exe
  C:\Windows\System\bJTJHpf.exe
  2⤵
  PID:10584
- C:\Windows\System\DlUqgpn.exe
  C:\Windows\System\DlUqgpn.exe
  2⤵
  PID:10724
- C:\Windows\System\WAUAwwd.exe
  C:\Windows\System\WAUAwwd.exe
  2⤵
  PID:10896
- C:\Windows\System\YQQRuvP.exe
  C:\Windows\System\YQQRuvP.exe
  2⤵
  PID:11036
- C:\Windows\System\gbrNukZ.exe
  C:\Windows\System\gbrNukZ.exe
  2⤵
  PID:3816
- C:\Windows\System\NcDgshG.exe
  C:\Windows\System\NcDgshG.exe
  2⤵
  PID:2204
- C:\Windows\System\PNJJfWL.exe
  C:\Windows\System\PNJJfWL.exe
  2⤵
  PID:11132
- C:\Windows\System\ndWNdFD.exe
  C:\Windows\System\ndWNdFD.exe
  2⤵
  PID:11184
- C:\Windows\System\SltMXAp.exe
  C:\Windows\System\SltMXAp.exe
  2⤵
  PID:10252
- C:\Windows\System\KDJwJmK.exe
  C:\Windows\System\KDJwJmK.exe
  2⤵
  PID:8980
- C:\Windows\System\zHElrgm.exe
  C:\Windows\System\zHElrgm.exe
  2⤵
  PID:10280
- C:\Windows\System\IScOxRZ.exe
  C:\Windows\System\IScOxRZ.exe
  2⤵
  PID:10680
- C:\Windows\System\yAkjZnU.exe
  C:\Windows\System\yAkjZnU.exe
  2⤵
  PID:10640
- C:\Windows\System\MJBnoBE.exe
  C:\Windows\System\MJBnoBE.exe
  2⤵
  PID:11028
- C:\Windows\System\jmMBXUW.exe
  C:\Windows\System\jmMBXUW.exe
  2⤵
  PID:2592
- C:\Windows\System\izlZWzr.exe
  C:\Windows\System\izlZWzr.exe
  2⤵
  PID:3420
- C:\Windows\System\PSSpclr.exe
  C:\Windows\System\PSSpclr.exe
  2⤵
  PID:2604
- C:\Windows\System\XCJBgmz.exe
  C:\Windows\System\XCJBgmz.exe
  2⤵
  PID:4760
- C:\Windows\System\YteLgto.exe
  C:\Windows\System\YteLgto.exe
  2⤵
  PID:1068
- C:\Windows\System\oQBwRLO.exe
  C:\Windows\System\oQBwRLO.exe
  2⤵
  PID:8280
- C:\Windows\System\ADHQTUE.exe
  C:\Windows\System\ADHQTUE.exe
  2⤵
  PID:10916
- C:\Windows\System\cnXNlti.exe
  C:\Windows\System\cnXNlti.exe
  2⤵
  PID:1400
- C:\Windows\System\poZqZNM.exe
  C:\Windows\System\poZqZNM.exe
  2⤵
  PID:4728
- C:\Windows\System\dvlCRPt.exe
  C:\Windows\System\dvlCRPt.exe
  2⤵
  PID:10984
- C:\Windows\System\dtbYqSi.exe
  C:\Windows\System\dtbYqSi.exe
  2⤵
  PID:11108
- C:\Windows\System\lmlARCq.exe
  C:\Windows\System\lmlARCq.exe
  2⤵
  PID:856
- C:\Windows\System\OaXrFwt.exe
  C:\Windows\System\OaXrFwt.exe
  2⤵
  PID:1192
- C:\Windows\System\jBAIPnj.exe
  C:\Windows\System\jBAIPnj.exe
  2⤵
  PID:10340
- C:\Windows\System\SeovYMg.exe
  C:\Windows\System\SeovYMg.exe
  2⤵
  PID:4568
- C:\Windows\System\ZUChLRB.exe
  C:\Windows\System\ZUChLRB.exe
  2⤵
  PID:5004
- C:\Windows\System\frdeQTf.exe
  C:\Windows\System\frdeQTf.exe
  2⤵
  PID:4460
- C:\Windows\System\onsLYPi.exe
  C:\Windows\System\onsLYPi.exe
  2⤵
  PID:10592
- C:\Windows\System\shCaQZs.exe
  C:\Windows\System\shCaQZs.exe
  2⤵
  PID:1812
- C:\Windows\System\fceYPvD.exe
  C:\Windows\System\fceYPvD.exe
  2⤵
  PID:4116
- C:\Windows\System\xSAFjTN.exe
  C:\Windows\System\xSAFjTN.exe
  2⤵
  PID:2380
- C:\Windows\System\zNhMOgb.exe
  C:\Windows\System\zNhMOgb.exe
  2⤵
  PID:1920
- C:\Windows\System\GVByKIs.exe
  C:\Windows\System\GVByKIs.exe
  2⤵
  PID:1156
- C:\Windows\System\BSUZyLN.exe
  C:\Windows\System\BSUZyLN.exe
  2⤵
  PID:10568
- C:\Windows\System\ycdPing.exe
  C:\Windows\System\ycdPing.exe
  2⤵
  PID:2732
- C:\Windows\System\VGXTDWW.exe
  C:\Windows\System\VGXTDWW.exe
  2⤵
  PID:4968
- C:\Windows\System\bYRUHjN.exe
  C:\Windows\System\bYRUHjN.exe
  2⤵
  PID:8248
- C:\Windows\System\zINQEgg.exe
  C:\Windows\System\zINQEgg.exe
  2⤵
  PID:712
- C:\Windows\System\AvtZbzD.exe
  C:\Windows\System\AvtZbzD.exe
  2⤵
  PID:8188
- C:\Windows\System\lXCRTor.exe
  C:\Windows\System\lXCRTor.exe
  2⤵
  PID:11272
- C:\Windows\System\jlueepi.exe
  C:\Windows\System\jlueepi.exe
  2⤵
  PID:11296
- C:\Windows\System\lMmJuPX.exe
  C:\Windows\System\lMmJuPX.exe
  2⤵
  PID:11332
- C:\Windows\System\DAOgXAP.exe
  C:\Windows\System\DAOgXAP.exe
  2⤵
  PID:11360
- C:\Windows\System\HuulyvF.exe
  C:\Windows\System\HuulyvF.exe
  2⤵
  PID:11388
- C:\Windows\System\HsqGciE.exe
  C:\Windows\System\HsqGciE.exe
  2⤵
  PID:11420
- C:\Windows\System\TUpunPc.exe
  C:\Windows\System\TUpunPc.exe
  2⤵
  PID:11460
- C:\Windows\System\YaZiZmu.exe
  C:\Windows\System\YaZiZmu.exe
  2⤵
  PID:11496
- C:\Windows\System\BPILIci.exe
  C:\Windows\System\BPILIci.exe
  2⤵
  PID:11524
- C:\Windows\System\hlhbODR.exe
  C:\Windows\System\hlhbODR.exe
  2⤵
  PID:11548
- C:\Windows\System\bsvSeod.exe
  C:\Windows\System\bsvSeod.exe
  2⤵
  PID:11584
- C:\Windows\System\SVXECgZ.exe
  C:\Windows\System\SVXECgZ.exe
  2⤵
  PID:11624
- C:\Windows\System\NTCCBBZ.exe
  C:\Windows\System\NTCCBBZ.exe
  2⤵
  PID:11640
- C:\Windows\System\lrwMjXc.exe
  C:\Windows\System\lrwMjXc.exe
  2⤵
  PID:11680
- C:\Windows\System\tbBorHe.exe
  C:\Windows\System\tbBorHe.exe
  2⤵
  PID:11696
- C:\Windows\System\ZZFQZUR.exe
  C:\Windows\System\ZZFQZUR.exe
  2⤵
  PID:11716
- C:\Windows\System\xnDZjvo.exe
  C:\Windows\System\xnDZjvo.exe
  2⤵
  PID:11744
- C:\Windows\System\WCIvAjh.exe
  C:\Windows\System\WCIvAjh.exe
  2⤵
  PID:11768
- C:\Windows\System\ZVCKpcx.exe
  C:\Windows\System\ZVCKpcx.exe
  2⤵
  PID:11788
- C:\Windows\System\gFBXOrH.exe
  C:\Windows\System\gFBXOrH.exe
  2⤵
  PID:11812
- C:\Windows\System\neUexiR.exe
  C:\Windows\System\neUexiR.exe
  2⤵
  PID:11828
- C:\Windows\System\LqWzHgG.exe
  C:\Windows\System\LqWzHgG.exe
  2⤵
  PID:11872
- C:\Windows\System\cKAorbN.exe
  C:\Windows\System\cKAorbN.exe
  2⤵
  PID:11888
- C:\Windows\System\mEhWKmz.exe
  C:\Windows\System\mEhWKmz.exe
  2⤵
  PID:11920
- C:\Windows\System\TZrlQRL.exe
  C:\Windows\System\TZrlQRL.exe
  2⤵
  PID:11956
- C:\Windows\System\LrJZVEo.exe
  C:\Windows\System\LrJZVEo.exe
  2⤵
  PID:11988
- C:\Windows\System\wnzwrqq.exe
  C:\Windows\System\wnzwrqq.exe
  2⤵
  PID:12016
- C:\Windows\System\DbYMpis.exe
  C:\Windows\System\DbYMpis.exe
  2⤵
  PID:12040
- C:\Windows\System\moiPQxL.exe
  C:\Windows\System\moiPQxL.exe
  2⤵
  PID:12064
- C:\Windows\System\lSrdGKX.exe
  C:\Windows\System\lSrdGKX.exe
  2⤵
  PID:12124
- C:\Windows\System\LOeUeVb.exe
  C:\Windows\System\LOeUeVb.exe
  2⤵
  PID:12156
- C:\Windows\System\KebHpMZ.exe
  C:\Windows\System\KebHpMZ.exe
  2⤵
  PID:12180
- C:\Windows\System\bNBLswp.exe
  C:\Windows\System\bNBLswp.exe
  2⤵
  PID:12204
- C:\Windows\System\QBvVCPP.exe
  C:\Windows\System\QBvVCPP.exe
  2⤵
  PID:4916
- C:\Windows\System\ZUidlNu.exe
  C:\Windows\System\ZUidlNu.exe
  2⤵
  PID:11328
- C:\Windows\System\hNDQKNV.exe
  C:\Windows\System\hNDQKNV.exe
  2⤵
  PID:11380
- C:\Windows\System\uBHuARf.exe
  C:\Windows\System\uBHuARf.exe
  2⤵
  PID:11368
- C:\Windows\System\lGFArIA.exe
  C:\Windows\System\lGFArIA.exe
  2⤵
  PID:11428
- C:\Windows\System\SovaSIv.exe
  C:\Windows\System\SovaSIv.exe
  2⤵
  PID:11532
- C:\Windows\System\ZKkGolA.exe
  C:\Windows\System\ZKkGolA.exe
  2⤵
  PID:11568
- C:\Windows\System\HHXcAMm.exe
  C:\Windows\System\HHXcAMm.exe
  2⤵
  PID:11776
- C:\Windows\System\aRTMeAT.exe
  C:\Windows\System\aRTMeAT.exe
  2⤵
  PID:11840
- C:\Windows\System\eiWnAQN.exe
  C:\Windows\System\eiWnAQN.exe
  2⤵
  PID:11936
- C:\Windows\System\rAJygSC.exe
  C:\Windows\System\rAJygSC.exe
  2⤵
  PID:11824
- C:\Windows\System\NhqayRq.exe
  C:\Windows\System\NhqayRq.exe
  2⤵
  PID:11932
- C:\Windows\System\udwydyK.exe
  C:\Windows\System\udwydyK.exe
  2⤵
  PID:11908
- C:\Windows\System\iTwsRJO.exe
  C:\Windows\System\iTwsRJO.exe
  2⤵
  PID:5116
- C:\Windows\System\FxOOYdY.exe
  C:\Windows\System\FxOOYdY.exe
  2⤵
  PID:12108
- C:\Windows\System\RlMzmdT.exe
  C:\Windows\System\RlMzmdT.exe
  2⤵
  PID:12152
- C:\Windows\System\vWYNndj.exe
  C:\Windows\System\vWYNndj.exe
  2⤵
  PID:2888
- C:\Windows\System\gxfXxtA.exe
  C:\Windows\System\gxfXxtA.exe
  2⤵
  PID:12176
- C:\Windows\System\uzwpBgC.exe
  C:\Windows\System\uzwpBgC.exe
  2⤵
  PID:4584
- C:\Windows\System\OyGxrWq.exe
  C:\Windows\System\OyGxrWq.exe
  2⤵
  PID:5944
- C:\Windows\System\WBZPMyR.exe
  C:\Windows\System\WBZPMyR.exe
  2⤵
  PID:6032
- C:\Windows\System\CFLHGCI.exe
  C:\Windows\System\CFLHGCI.exe
  2⤵
  PID:2548
- C:\Windows\System\FMYhvzT.exe
  C:\Windows\System\FMYhvzT.exe
  2⤵
  PID:11340
- C:\Windows\System\VXWFNfy.exe
  C:\Windows\System\VXWFNfy.exe
  2⤵
  PID:5456
- C:\Windows\System\qfmMrXH.exe
  C:\Windows\System\qfmMrXH.exe
  2⤵
  PID:11316
- C:\Windows\System\twYQffS.exe
  C:\Windows\System\twYQffS.exe
  2⤵
  PID:5552
- C:\Windows\System\TAluOjC.exe
  C:\Windows\System\TAluOjC.exe
  2⤵
  PID:4196
- C:\Windows\System\hzLLBtL.exe
  C:\Windows\System\hzLLBtL.exe
  2⤵
  PID:11136
- C:\Windows\System\NeqGMGX.exe
  C:\Windows\System\NeqGMGX.exe
  2⤵
  PID:11536
- C:\Windows\System\yMdnqlV.exe
  C:\Windows\System\yMdnqlV.exe
  2⤵
  PID:12028
- C:\Windows\System\OmSjVzx.exe
  C:\Windows\System\OmSjVzx.exe
  2⤵
  PID:12276
- C:\Windows\System\ugLVhzh.exe
  C:\Windows\System\ugLVhzh.exe
  2⤵
  PID:6120
- C:\Windows\System\LODYrBY.exe
  C:\Windows\System\LODYrBY.exe
  2⤵
  PID:5036
- C:\Windows\System\GgUhYNB.exe
  C:\Windows\System\GgUhYNB.exe
  2⤵
  PID:4208
- C:\Windows\System\dwMVoLJ.exe
  C:\Windows\System\dwMVoLJ.exe
  2⤵
  PID:3536
- C:\Windows\System\TLNqcFP.exe
  C:\Windows\System\TLNqcFP.exe
  2⤵
  PID:1080
- C:\Windows\System\COmfKVu.exe
  C:\Windows\System\COmfKVu.exe
  2⤵
  PID:2288
- C:\Windows\System\lCkLQty.exe
  C:\Windows\System\lCkLQty.exe
  2⤵
  PID:6300
- C:\Windows\System\KYCbsER.exe
  C:\Windows\System\KYCbsER.exe
  2⤵
  PID:6380
- C:\Windows\System\saVvAja.exe
  C:\Windows\System\saVvAja.exe
  2⤵
  PID:11804
- C:\Windows\System\cAtxOao.exe
  C:\Windows\System\cAtxOao.exe
  2⤵
  PID:6584
- C:\Windows\System\LuWUzDS.exe
  C:\Windows\System\LuWUzDS.exe
  2⤵
  PID:11952
- C:\Windows\System\lDYHsBw.exe
  C:\Windows\System\lDYHsBw.exe
  2⤵
  PID:12032
- C:\Windows\System\evCgZnf.exe
  C:\Windows\System\evCgZnf.exe
  2⤵
  PID:3092
- C:\Windows\System\ucDLLUE.exe
  C:\Windows\System\ucDLLUE.exe
  2⤵
  PID:6880
- C:\Windows\System\HxgqBML.exe
  C:\Windows\System\HxgqBML.exe
  2⤵
  PID:5984
- C:\Windows\System\oDqjHSO.exe
  C:\Windows\System\oDqjHSO.exe
  2⤵
  PID:6948
- C:\Windows\System\ZRXXZcV.exe
  C:\Windows\System\ZRXXZcV.exe
  2⤵
  PID:6964
- C:\Windows\System\yhsazFf.exe
  C:\Windows\System\yhsazFf.exe
  2⤵
  PID:5320
- C:\Windows\System\IyJdQBX.exe
  C:\Windows\System\IyJdQBX.exe
  2⤵
  PID:7076
- C:\Windows\System\zJPrAJp.exe
  C:\Windows\System\zJPrAJp.exe
  2⤵
  PID:1220
- C:\Windows\System\bpDoYiP.exe
  C:\Windows\System\bpDoYiP.exe
  2⤵
  PID:7164
- C:\Windows\System\qVEvKlN.exe
  C:\Windows\System\qVEvKlN.exe
  2⤵
  PID:6384
- C:\Windows\System\yzHPSnA.exe
  C:\Windows\System\yzHPSnA.exe
  2⤵
  PID:11760
- C:\Windows\System\TMFLcYa.exe
  C:\Windows\System\TMFLcYa.exe
  2⤵
  PID:6648
- C:\Windows\System\UHKjASq.exe
  C:\Windows\System\UHKjASq.exe
  2⤵
  PID:6096
- C:\Windows\System\rbxdbJI.exe
  C:\Windows\System\rbxdbJI.exe
  2⤵
  PID:5176
- C:\Windows\System\mAfqfyQ.exe
  C:\Windows\System\mAfqfyQ.exe
  2⤵
  PID:6316
- C:\Windows\System\ihYdPuT.exe
  C:\Windows\System\ihYdPuT.exe
  2⤵
  PID:7132
- C:\Windows\System\iitJczQ.exe
  C:\Windows\System\iitJczQ.exe
  2⤵
  PID:6260
- C:\Windows\System\zpyYQyQ.exe
  C:\Windows\System\zpyYQyQ.exe
  2⤵
  PID:6356
- C:\Windows\System\bMuxdtR.exe
  C:\Windows\System\bMuxdtR.exe
  2⤵
  PID:4736
- C:\Windows\System\jJeZWVp.exe
  C:\Windows\System\jJeZWVp.exe
  2⤵
  PID:5560
- C:\Windows\System\ORimQyA.exe
  C:\Windows\System\ORimQyA.exe
  2⤵
  PID:6016
- C:\Windows\System\SNOvQcP.exe
  C:\Windows\System\SNOvQcP.exe
  2⤵
  PID:6980
- C:\Windows\System\HkeqgMb.exe
  C:\Windows\System\HkeqgMb.exe
  2⤵
  PID:7084
- C:\Windows\System\ORqaQGm.exe
  C:\Windows\System\ORqaQGm.exe
  2⤵
  PID:11284
- C:\Windows\System\JtcTtwE.exe
  C:\Windows\System\JtcTtwE.exe
  2⤵
  PID:11456
- C:\Windows\System\WSNpUPQ.exe
  C:\Windows\System\WSNpUPQ.exe
  2⤵
  PID:11692
- C:\Windows\System\LiownXc.exe
  C:\Windows\System\LiownXc.exe
  2⤵
  PID:6868
- C:\Windows\System\IxMiYNY.exe
  C:\Windows\System\IxMiYNY.exe
  2⤵
  PID:6812
- C:\Windows\System\hOrNtth.exe
  C:\Windows\System\hOrNtth.exe
  2⤵
  PID:5664
- C:\Windows\System\mSOAUhZ.exe
  C:\Windows\System\mSOAUhZ.exe
  2⤵
  PID:6228
- C:\Windows\System\tXeQozX.exe
  C:\Windows\System\tXeQozX.exe
  2⤵
  PID:6832
- C:\Windows\System\sECrqXj.exe
  C:\Windows\System\sECrqXj.exe
  2⤵
  PID:2460
- C:\Windows\System\DLiOAdg.exe
  C:\Windows\System\DLiOAdg.exe
  2⤵
  PID:4848
- C:\Windows\System\vrFPOYG.exe
  C:\Windows\System\vrFPOYG.exe
  2⤵
  PID:2220
- C:\Windows\System\xSPJhRL.exe
  C:\Windows\System\xSPJhRL.exe
  2⤵
  PID:2532
- C:\Windows\System\iWsVSbA.exe
  C:\Windows\System\iWsVSbA.exe
  2⤵
  PID:7708
- C:\Windows\System\UFZJfBe.exe
  C:\Windows\System\UFZJfBe.exe
  2⤵
  PID:5308
- C:\Windows\System\OpaAJfv.exe
  C:\Windows\System\OpaAJfv.exe
  2⤵
  PID:6912
- C:\Windows\System\WicUyvd.exe
  C:\Windows\System\WicUyvd.exe
  2⤵
  PID:12012
- C:\Windows\System\YAEXAtk.exe
  C:\Windows\System\YAEXAtk.exe
  2⤵
  PID:12088
- C:\Windows\System\gFSTFmb.exe
  C:\Windows\System\gFSTFmb.exe
  2⤵
  PID:11504
- C:\Windows\System\TWUyhjV.exe
  C:\Windows\System\TWUyhjV.exe
  2⤵
  PID:7316
- C:\Windows\System\whEtcaJ.exe
  C:\Windows\System\whEtcaJ.exe
  2⤵
  PID:5860
- C:\Windows\System\EVnITJy.exe
  C:\Windows\System\EVnITJy.exe
  2⤵
  PID:12292
- C:\Windows\System\yxHgRiY.exe
  C:\Windows\System\yxHgRiY.exe
  2⤵
  PID:12316
- C:\Windows\System\zgOyDyz.exe
  C:\Windows\System\zgOyDyz.exe
  2⤵
  PID:12344
- C:\Windows\System\BXJxGyJ.exe
  C:\Windows\System\BXJxGyJ.exe
  2⤵
  PID:12376
- C:\Windows\System\hlFSQXe.exe
  C:\Windows\System\hlFSQXe.exe
  2⤵
  PID:12412
- C:\Windows\System\iSVPepI.exe
  C:\Windows\System\iSVPepI.exe
  2⤵
  PID:12452
- C:\Windows\System\nZMSWcP.exe
  C:\Windows\System\nZMSWcP.exe
  2⤵
  PID:12472
- C:\Windows\System\ukIBIQX.exe
  C:\Windows\System\ukIBIQX.exe
  2⤵
  PID:12508
- C:\Windows\System\RAmwalb.exe
  C:\Windows\System\RAmwalb.exe
  2⤵
  PID:12532
- C:\Windows\System\yDVHklZ.exe
  C:\Windows\System\yDVHklZ.exe
  2⤵
  PID:12568
- C:\Windows\System\BRjusbS.exe
  C:\Windows\System\BRjusbS.exe
  2⤵
  PID:12588
- C:\Windows\System\HpsucVh.exe
  C:\Windows\System\HpsucVh.exe
  2⤵
  PID:12612
- C:\Windows\System\mQaImNp.exe
  C:\Windows\System\mQaImNp.exe
  2⤵
  PID:12640
- C:\Windows\System\IPvXxtS.exe
  C:\Windows\System\IPvXxtS.exe
  2⤵
  PID:12664
- C:\Windows\System\duSzeGc.exe
  C:\Windows\System\duSzeGc.exe
  2⤵
  PID:12688
- C:\Windows\System\ksqhugh.exe
  C:\Windows\System\ksqhugh.exe
  2⤵
  PID:12728
- C:\Windows\System\GBWBlUG.exe
  C:\Windows\System\GBWBlUG.exe
  2⤵
  PID:12752
- C:\Windows\System\XCHWeSY.exe
  C:\Windows\System\XCHWeSY.exe
  2⤵
  PID:12788
- C:\Windows\System\hTzbDGT.exe
  C:\Windows\System\hTzbDGT.exe
  2⤵
  PID:12812
- C:\Windows\System\jduLqNl.exe
  C:\Windows\System\jduLqNl.exe
  2⤵
  PID:12828
- C:\Windows\System\AClIYRe.exe
  C:\Windows\System\AClIYRe.exe
  2⤵
  PID:12868
- C:\Windows\System\MGlSERV.exe
  C:\Windows\System\MGlSERV.exe
  2⤵
  PID:12892
- C:\Windows\System\HSmxVnH.exe
  C:\Windows\System\HSmxVnH.exe
  2⤵
  PID:12920
- C:\Windows\System\jKFNiHw.exe
  C:\Windows\System\jKFNiHw.exe
  2⤵
  PID:12960
- C:\Windows\System\LslKVRA.exe
  C:\Windows\System\LslKVRA.exe
  2⤵
  PID:12984
- C:\Windows\System\pwQIEpt.exe
  C:\Windows\System\pwQIEpt.exe
  2⤵
  PID:13004
- C:\Windows\System\QsocZXV.exe
  C:\Windows\System\QsocZXV.exe
  2⤵
  PID:13024
- C:\Windows\System\FIovpWA.exe
  C:\Windows\System\FIovpWA.exe
  2⤵
  PID:13052
- C:\Windows\System\VLVFcjb.exe
  C:\Windows\System\VLVFcjb.exe
  2⤵
  PID:13076
- C:\Windows\System\xcpziXe.exe
  C:\Windows\System\xcpziXe.exe
  2⤵
  PID:13100
- C:\Windows\System\hsMpGeR.exe
  C:\Windows\System\hsMpGeR.exe
  2⤵
  PID:13128
- C:\Windows\System\CrNFkYb.exe
  C:\Windows\System\CrNFkYb.exe
  2⤵
  PID:13148
- C:\Windows\System\rnTNKQp.exe
  C:\Windows\System\rnTNKQp.exe
  2⤵
  PID:13180
- C:\Windows\System\iWOrRmD.exe
  C:\Windows\System\iWOrRmD.exe
  2⤵
  PID:13200
- C:\Windows\System\ttghlro.exe
  C:\Windows\System\ttghlro.exe
  2⤵
  PID:13224
- C:\Windows\System\wNUywNx.exe
  C:\Windows\System\wNUywNx.exe
  2⤵
  PID:13264
- C:\Windows\System\CMsYMxV.exe
  C:\Windows\System\CMsYMxV.exe
  2⤵
  PID:13292
- C:\Windows\System\IrrLbKB.exe
  C:\Windows\System\IrrLbKB.exe
  2⤵
  PID:4960
- C:\Windows\System\IQKpDqL.exe
  C:\Windows\System\IQKpDqL.exe
  2⤵
  PID:5044
- C:\Windows\System\jtwlNOf.exe
  C:\Windows\System\jtwlNOf.exe
  2⤵
  PID:12360
- C:\Windows\System\dneKPvV.exe
  C:\Windows\System\dneKPvV.exe
  2⤵
  PID:12468
- C:\Windows\System\MSAgWny.exe
  C:\Windows\System\MSAgWny.exe
  2⤵
  PID:12552
- C:\Windows\System\jMPRVKs.exe
  C:\Windows\System\jMPRVKs.exe
  2⤵
  PID:12600
- C:\Windows\System\HOQRgaK.exe
  C:\Windows\System\HOQRgaK.exe
  2⤵
  PID:12656
- C:\Windows\System\MxCSjJK.exe
  C:\Windows\System\MxCSjJK.exe
  2⤵
  PID:12624
- C:\Windows\System\hcTtDoF.exe
  C:\Windows\System\hcTtDoF.exe
  2⤵
  PID:12712
- C:\Windows\System\TASPSwu.exe
  C:\Windows\System\TASPSwu.exe
  2⤵
  PID:832
- C:\Windows\System\NbgRAPS.exe
  C:\Windows\System\NbgRAPS.exe
  2⤵
  PID:12904
- C:\Windows\System\BTPpjXI.exe
  C:\Windows\System\BTPpjXI.exe
  2⤵
  PID:8108
- C:\Windows\System\obydotL.exe
  C:\Windows\System\obydotL.exe
  2⤵
  PID:12932
- C:\Windows\System\wjTUifF.exe
  C:\Windows\System\wjTUifF.exe
  2⤵
  PID:2856
- C:\Windows\System\XAWWmsY.exe
  C:\Windows\System\XAWWmsY.exe
  2⤵
  PID:13040
- C:\Windows\System\lisLxfm.exe
  C:\Windows\System\lisLxfm.exe
  2⤵
  PID:13016
- C:\Windows\System\yosTgCy.exe
  C:\Windows\System\yosTgCy.exe
  2⤵
  PID:1980
- C:\Windows\System\nyLZUmc.exe
  C:\Windows\System\nyLZUmc.exe
  2⤵
  PID:3912
- C:\Windows\System\tpguMTU.exe
  C:\Windows\System\tpguMTU.exe
  2⤵
  PID:3984
- C:\Windows\System\kXNLQuU.exe
  C:\Windows\System\kXNLQuU.exe
  2⤵
  PID:13160
- C:\Windows\System\mSmkBOr.exe
  C:\Windows\System\mSmkBOr.exe
  2⤵
  PID:13176
- C:\Windows\System\rbezOKw.exe
  C:\Windows\System\rbezOKw.exe
  2⤵
  PID:6992
- C:\Windows\System\nRaewpp.exe
  C:\Windows\System\nRaewpp.exe
  2⤵
  PID:13280
- C:\Windows\System\WOUykMJ.exe
  C:\Windows\System\WOUykMJ.exe
  2⤵
  PID:12340
- C:\Windows\System\BIZejMo.exe
  C:\Windows\System\BIZejMo.exe
  2⤵
  PID:12524
- C:\Windows\System\gAoYoUv.exe
  C:\Windows\System\gAoYoUv.exe
  2⤵
  PID:5436
- C:\Windows\System\uFPPCcO.exe
  C:\Windows\System\uFPPCcO.exe
  2⤵
  PID:5452
- C:\Windows\System\MtxwPLG.exe
  C:\Windows\System\MtxwPLG.exe
  2⤵
  PID:5380
- C:\Windows\System\fVleXws.exe
  C:\Windows\System\fVleXws.exe
  2⤵
  PID:7984
- C:\Windows\System\OsYQbfs.exe
  C:\Windows\System\OsYQbfs.exe
  2⤵
  PID:8064
- C:\Windows\System\BjCUaJk.exe
  C:\Windows\System\BjCUaJk.exe
  2⤵
  PID:5620
- C:\Windows\System\xnOQDtp.exe
  C:\Windows\System\xnOQDtp.exe
  2⤵
  PID:5704
- C:\Windows\System\pRnryaV.exe
  C:\Windows\System\pRnryaV.exe
  2⤵
  PID:8344
- C:\Windows\System\oNywqxJ.exe
  C:\Windows\System\oNywqxJ.exe
  2⤵
  PID:5432
- C:\Windows\System\zSJclbx.exe
  C:\Windows\System\zSJclbx.exe
  2⤵
  PID:5828
- C:\Windows\System\KmguWIJ.exe
  C:\Windows\System\KmguWIJ.exe
  2⤵
  PID:8504
- C:\Windows\System\qusbJdk.exe
  C:\Windows\System\qusbJdk.exe
  2⤵
  PID:628
- C:\Windows\System\MYNMhBR.exe
  C:\Windows\System\MYNMhBR.exe
  2⤵
  PID:1916
- C:\Windows\System\AHnnVFj.exe
  C:\Windows\System\AHnnVFj.exe
  2⤵
  PID:5204
- C:\Windows\System\fZcdmyw.exe
  C:\Windows\System\fZcdmyw.exe
  2⤵
  PID:9080
- C:\Windows\System\zGQpCNt.exe
  C:\Windows\System\zGQpCNt.exe
  2⤵
  PID:12880
- C:\Windows\System\wyfRXPv.exe
  C:\Windows\System\wyfRXPv.exe
  2⤵
  PID:1700
- C:\Windows\System\VoDCrdR.exe
  C:\Windows\System\VoDCrdR.exe
  2⤵
  PID:9260
- C:\Windows\System\cxYLrsf.exe
  C:\Windows\System\cxYLrsf.exe
  2⤵
  PID:9320
- C:\Windows\System\JjFberi.exe
  C:\Windows\System\JjFberi.exe
  2⤵
  PID:13064
- C:\Windows\System\PdLSSKD.exe
  C:\Windows\System\PdLSSKD.exe
  2⤵
  PID:13140
- C:\Windows\System\PNrVXDT.exe
  C:\Windows\System\PNrVXDT.exe
  2⤵
  PID:9524
- C:\Windows\System\TnziCgX.exe
  C:\Windows\System\TnziCgX.exe
  2⤵
  PID:9600
- C:\Windows\System\ZdnsOBo.exe
  C:\Windows\System\ZdnsOBo.exe
  2⤵
  PID:12888
- C:\Windows\System\TmXhArk.exe
  C:\Windows\System\TmXhArk.exe
  2⤵
  PID:5212
- C:\Windows\System\sriwfzB.exe
  C:\Windows\System\sriwfzB.exe
  2⤵
  PID:9856
- C:\Windows\System\JQDtugf.exe
  C:\Windows\System\JQDtugf.exe
  2⤵
  PID:12804
- C:\Windows\System\VoSKuQg.exe
  C:\Windows\System\VoSKuQg.exe
  2⤵
  PID:7412
- C:\Windows\System\gZBfmbo.exe
  C:\Windows\System\gZBfmbo.exe
  2⤵
  PID:5648
- C:\Windows\System\DwcOkFk.exe
  C:\Windows\System\DwcOkFk.exe
  2⤵
  PID:5700
- C:\Windows\System\DmTpxge.exe
  C:\Windows\System\DmTpxge.exe
  2⤵
  PID:5228
- C:\Windows\System\opZRYVy.exe
  C:\Windows\System\opZRYVy.exe
  2⤵
  PID:12824
- C:\Windows\System\odMiDxB.exe
  C:\Windows\System\odMiDxB.exe
  2⤵
  PID:9344
- C:\Windows\System\gSNkiOX.exe
  C:\Windows\System\gSNkiOX.exe
  2⤵
  PID:9496
- C:\Windows\System\UssSTBJ.exe
  C:\Windows\System\UssSTBJ.exe
  2⤵
  PID:9304
- C:\Windows\System\zGeBbuD.exe
  C:\Windows\System\zGeBbuD.exe
  2⤵
  PID:6456
- C:\Windows\System\pbNaDCN.exe
  C:\Windows\System\pbNaDCN.exe
  2⤵
  PID:6504
- C:\Windows\System\iEucTvd.exe
  C:\Windows\System\iEucTvd.exe
  2⤵
  PID:6808
- C:\Windows\System\QhZCyDt.exe
  C:\Windows\System\QhZCyDt.exe
  2⤵
  PID:10020
- C:\Windows\System\EoAqlej.exe
  C:\Windows\System\EoAqlej.exe
  2⤵
  PID:10188
- C:\Windows\System\GRiEnNN.exe
  C:\Windows\System\GRiEnNN.exe
  2⤵
  PID:9828
- C:\Windows\System\mFhmgMx.exe
  C:\Windows\System\mFhmgMx.exe
  2⤵
  PID:5572
- C:\Windows\System\tQWgLGu.exe
  C:\Windows\System\tQWgLGu.exe
  2⤵
  PID:12632
- C:\Windows\System\mAHfKTP.exe
  C:\Windows\System\mAHfKTP.exe
  2⤵
  PID:9360
- C:\Windows\System\JiaPlFR.exe
  C:\Windows\System\JiaPlFR.exe
  2⤵
  PID:9416
- C:\Windows\System\QsWmbrg.exe
  C:\Windows\System\QsWmbrg.exe
  2⤵
  PID:9572
- C:\Windows\System\tHjYHgc.exe
  C:\Windows\System\tHjYHgc.exe
  2⤵
  PID:12912
- C:\Windows\System\anVfDJT.exe
  C:\Windows\System\anVfDJT.exe
  2⤵
  PID:6476
- C:\Windows\System\wDrUCIz.exe
  C:\Windows\System\wDrUCIz.exe
  2⤵
  PID:6492
- C:\Windows\System\lzdjVwM.exe
  C:\Windows\System\lzdjVwM.exe
  2⤵
  PID:6180
- C:\Windows\System\XZJxrSl.exe
  C:\Windows\System\XZJxrSl.exe
  2⤵
  PID:9708
- C:\Windows\System\WczTsEM.exe
  C:\Windows\System\WczTsEM.exe
  2⤵
  PID:7968
- C:\Windows\System\HSrwgDl.exe
  C:\Windows\System\HSrwgDl.exe
  2⤵
  PID:4640
- C:\Windows\System\YTbzqhL.exe
  C:\Windows\System\YTbzqhL.exe
  2⤵
  PID:6464
- C:\Windows\System\CVOpBOA.exe
  C:\Windows\System\CVOpBOA.exe
  2⤵
  PID:6524
- C:\Windows\System\LERzFQt.exe
  C:\Windows\System\LERzFQt.exe
  2⤵
  PID:5304
- C:\Windows\System\fuuiAiJ.exe
  C:\Windows\System\fuuiAiJ.exe
  2⤵
  PID:13324
- C:\Windows\System\nnTCHNG.exe
  C:\Windows\System\nnTCHNG.exe
  2⤵
  PID:13396
- C:\Windows\System\lXwPBLB.exe
  C:\Windows\System\lXwPBLB.exe
  2⤵
  PID:13436
- C:\Windows\System\TNMOpFX.exe
  C:\Windows\System\TNMOpFX.exe
  2⤵
  PID:13464
- C:\Windows\System\agResDy.exe
  C:\Windows\System\agResDy.exe
  2⤵
  PID:13484
- C:\Windows\System\QtEbfaQ.exe
  C:\Windows\System\QtEbfaQ.exe
  2⤵
  PID:13516
- C:\Windows\System\Itpzizg.exe
  C:\Windows\System\Itpzizg.exe
  2⤵
  PID:13548
- C:\Windows\System\bdDEJuO.exe
  C:\Windows\System\bdDEJuO.exe
  2⤵
  PID:13564
- C:\Windows\System\EjcTAvT.exe
  C:\Windows\System\EjcTAvT.exe
  2⤵
  PID:13588
- C:\Windows\System\iTIOgiM.exe
  C:\Windows\System\iTIOgiM.exe
  2⤵
  PID:13620
- C:\Windows\System\ygBwuur.exe
  C:\Windows\System\ygBwuur.exe
  2⤵
  PID:13680
- C:\Windows\System\oKIheQD.exe
  C:\Windows\System\oKIheQD.exe
  2⤵
  PID:13704
- C:\Windows\System\ybgqiBZ.exe
  C:\Windows\System\ybgqiBZ.exe
  2⤵
  PID:13720
- C:\Windows\System\ZgUxsGE.exe
  C:\Windows\System\ZgUxsGE.exe
  2⤵
  PID:13740
- C:\Windows\System\yCDtgXT.exe
  C:\Windows\System\yCDtgXT.exe
  2⤵
  PID:13764
- C:\Windows\System\dPaLHcY.exe
  C:\Windows\System\dPaLHcY.exe
  2⤵
  PID:13788
- C:\Windows\System\lPExLdL.exe
  C:\Windows\System\lPExLdL.exe
  2⤵
  PID:13816
- C:\Windows\System\bkCnyAo.exe
  C:\Windows\System\bkCnyAo.exe
  2⤵
  PID:13852
- C:\Windows\System\BCNVrvE.exe
  C:\Windows\System\BCNVrvE.exe
  2⤵
  PID:13896
- C:\Windows\System\mTfGsxq.exe
  C:\Windows\System\mTfGsxq.exe
  2⤵
  PID:13916
- C:\Windows\System\dCaiFRM.exe
  C:\Windows\System\dCaiFRM.exe
  2⤵
  PID:13956
- C:\Windows\System\IecBorV.exe
  C:\Windows\System\IecBorV.exe
  2⤵
  PID:13984
- C:\Windows\System\wkLIDXS.exe
  C:\Windows\System\wkLIDXS.exe
  2⤵
  PID:14000
- C:\Windows\System\zMbuuTN.exe
  C:\Windows\System\zMbuuTN.exe
  2⤵
  PID:14020
- C:\Windows\System\yoNdiPK.exe
  C:\Windows\System\yoNdiPK.exe
  2⤵
  PID:14044
- C:\Windows\System\wnOwvfl.exe
  C:\Windows\System\wnOwvfl.exe
  2⤵
  PID:14108
- C:\Windows\System\DghMkmo.exe
  C:\Windows\System\DghMkmo.exe
  2⤵
  PID:14124
- C:\Windows\System\CuApXcJ.exe
  C:\Windows\System\CuApXcJ.exe
  2⤵
  PID:14140
- C:\Windows\System\PWrUCFb.exe
  C:\Windows\System\PWrUCFb.exe
  2⤵
  PID:14168
- C:\Windows\System\avgwBzg.exe
  C:\Windows\System\avgwBzg.exe
  2⤵
  PID:14192
- C:\Windows\System\ugFwxvC.exe
  C:\Windows\System\ugFwxvC.exe
  2⤵
  PID:14220
- C:\Windows\System\bPfrgBT.exe
  C:\Windows\System\bPfrgBT.exe
  2⤵
  PID:14244
- C:\Windows\System\PSAKVJs.exe
  C:\Windows\System\PSAKVJs.exe
  2⤵
  PID:14268
- C:\Windows\System\mmBKkoD.exe
  C:\Windows\System\mmBKkoD.exe
  2⤵
  PID:14312
- C:\Windows\System\ULDoECD.exe
  C:\Windows\System\ULDoECD.exe
  2⤵
  PID:6972
- C:\Windows\System\RJwblrd.exe
  C:\Windows\System\RJwblrd.exe
  2⤵
  PID:6944
- C:\Windows\System\FOOPvoI.exe
  C:\Windows\System\FOOPvoI.exe
  2⤵
  PID:7916
- C:\Windows\System\oUtcwMG.exe
  C:\Windows\System\oUtcwMG.exe
  2⤵
  PID:13368
- C:\Windows\System\tRLoUAB.exe
  C:\Windows\System\tRLoUAB.exe
  2⤵
  PID:6468
- C:\Windows\System\lCAESAi.exe
  C:\Windows\System\lCAESAi.exe
  2⤵
  PID:13428
- C:\Windows\System\GztQrIH.exe
  C:\Windows\System\GztQrIH.exe
  2⤵
  PID:13480
- C:\Windows\System\DEgeYFH.exe
  C:\Windows\System\DEgeYFH.exe
  2⤵
  PID:6996
- C:\Windows\System\SZsYILC.exe
  C:\Windows\System\SZsYILC.exe
  2⤵
  PID:7180
- C:\Windows\System\MEfloUl.exe
  C:\Windows\System\MEfloUl.exe
  2⤵
  PID:7204
- C:\Windows\System\WYNqZLr.exe
  C:\Windows\System\WYNqZLr.exe
  2⤵
  PID:7260
- C:\Windows\System\zDNAUkP.exe
  C:\Windows\System\zDNAUkP.exe
  2⤵
  PID:7336
- C:\Windows\System\PKvRGcE.exe
  C:\Windows\System\PKvRGcE.exe
  2⤵
  PID:13544
- C:\Windows\System\hfDwTjC.exe
  C:\Windows\System\hfDwTjC.exe
  2⤵
  PID:13732
- C:\Windows\System\vrneVDC.exe
  C:\Windows\System\vrneVDC.exe
  2⤵
  PID:10648
- C:\Windows\System\OQULfMx.exe
  C:\Windows\System\OQULfMx.exe
  2⤵
  PID:13808
- C:\Windows\System\OQsHPDI.exe
  C:\Windows\System\OQsHPDI.exe
  2⤵
  PID:10732
- C:\Windows\System\vwjYPbG.exe
  C:\Windows\System\vwjYPbG.exe
  2⤵
  PID:13828
- C:\Windows\System\tgEpRZr.exe
  C:\Windows\System\tgEpRZr.exe
  2⤵
  PID:13908
- C:\Windows\System\gUVaeTt.exe
  C:\Windows\System\gUVaeTt.exe
  2⤵
  PID:13968
- C:\Windows\System\hihoaWV.exe
  C:\Windows\System\hihoaWV.exe
  2⤵
  PID:14036
- C:\Windows\System\usuQUsR.exe
  C:\Windows\System\usuQUsR.exe
  2⤵
  PID:14080
- C:\Windows\System\wABvEkb.exe
  C:\Windows\System\wABvEkb.exe
  2⤵
  PID:14160
- C:\Windows\System\TGChpaa.exe
  C:\Windows\System\TGChpaa.exe
  2⤵
  PID:14184
- C:\Windows\System\jeptdLj.exe
  C:\Windows\System\jeptdLj.exe
  2⤵
  PID:14264
- C:\Windows\System\brQzOyj.exe
  C:\Windows\System\brQzOyj.exe
  2⤵
  PID:10164
- C:\Windows\System\bpGxBXm.exe
  C:\Windows\System\bpGxBXm.exe
  2⤵
  PID:13456
- C:\Windows\System\VTxqjdZ.exe
  C:\Windows\System\VTxqjdZ.exe
  2⤵
  PID:13512
- C:\Windows\System\atpFjQp.exe
  C:\Windows\System\atpFjQp.exe
  2⤵
  PID:6400
- C:\Windows\System\OARzNoR.exe
  C:\Windows\System\OARzNoR.exe
  2⤵
  PID:11200
- C:\Windows\System\LXddqqo.exe
  C:\Windows\System\LXddqqo.exe
  2⤵
  PID:7912
- C:\Windows\System\mohTSRt.exe
  C:\Windows\System\mohTSRt.exe
  2⤵
  PID:13676
- C:\Windows\System\rSiSuQL.exe
  C:\Windows\System\rSiSuQL.exe
  2⤵
  PID:8176
- C:\Windows\System\RQCeHzu.exe
  C:\Windows\System\RQCeHzu.exe
  2⤵
  PID:7596
- C:\Windows\System\ywTZBck.exe
  C:\Windows\System\ywTZBck.exe
  2⤵
  PID:7976
- C:\Windows\System\hpfqkqJ.exe
  C:\Windows\System\hpfqkqJ.exe
  2⤵
  PID:8012
- C:\Windows\System\WGLvacB.exe
  C:\Windows\System\WGLvacB.exe
  2⤵
  PID:7560
- C:\Windows\System\fJnrmep.exe
  C:\Windows\System\fJnrmep.exe
  2⤵
  PID:7672
- C:\Windows\System\IYBoSNH.exe
  C:\Windows\System\IYBoSNH.exe
  2⤵
  PID:4432
- C:\Windows\System\gJdBNCv.exe
  C:\Windows\System\gJdBNCv.exe
  2⤵
  PID:8224
- C:\Windows\System\ZroAoPk.exe
  C:\Windows\System\ZroAoPk.exe
  2⤵
  PID:8352
- C:\Windows\System\JQbygsV.exe
  C:\Windows\System\JQbygsV.exe
  2⤵
  PID:8516
- C:\Windows\System\otUZmwX.exe
  C:\Windows\System\otUZmwX.exe
  2⤵
  PID:8728
- C:\Windows\System\EavVAPI.exe
  C:\Windows\System\EavVAPI.exe
  2⤵
  PID:8776
- C:\Windows\System\CmtTzgj.exe
  C:\Windows\System\CmtTzgj.exe
  2⤵
  PID:8892
- C:\Windows\System\vgtUnwK.exe
  C:\Windows\System\vgtUnwK.exe
  2⤵
  PID:9024
- C:\Windows\System\eZgvaFT.exe
  C:\Windows\System\eZgvaFT.exe
  2⤵
  PID:10812
- C:\Windows\System\kJlSKiI.exe
  C:\Windows\System\kJlSKiI.exe
  2⤵
  PID:13848
- C:\Windows\System\ZWEbqMI.exe
  C:\Windows\System\ZWEbqMI.exe
  2⤵
  PID:9128
- C:\Windows\System\RJaewYm.exe
  C:\Windows\System\RJaewYm.exe
  2⤵
  PID:14012
- C:\Windows\System\vXtcBeJ.exe
  C:\Windows\System\vXtcBeJ.exe
  2⤵
  PID:14136
- C:\Windows\System\zGdNxdJ.exe
  C:\Windows\System\zGdNxdJ.exe
  2⤵
  PID:9136
- C:\Windows\System\UTblyGi.exe
  C:\Windows\System\UTblyGi.exe
  2⤵
  PID:14288
- C:\Windows\System\tJxYbqm.exe
  C:\Windows\System\tJxYbqm.exe
  2⤵
  PID:7732
- C:\Windows\System\UPjzKOv.exe
  C:\Windows\System\UPjzKOv.exe
  2⤵
  PID:6616
- C:\Windows\System\QuUpLyO.exe
  C:\Windows\System\QuUpLyO.exe
  2⤵
  PID:7868
- C:\Windows\System\cOZasVu.exe
  C:\Windows\System\cOZasVu.exe
  2⤵
  PID:8668
- C:\Windows\System\kNEmZYE.exe
  C:\Windows\System\kNEmZYE.exe
  2⤵
  PID:8000
- C:\Windows\System\QOZeJgY.exe
  C:\Windows\System\QOZeJgY.exe
  2⤵
  PID:4024
- C:\Windows\System\dxSGpjz.exe
  C:\Windows\System\dxSGpjz.exe
  2⤵
  PID:8028
- C:\Windows\System\cyNDSkg.exe
  C:\Windows\System\cyNDSkg.exe
  2⤵
  PID:8072
- C:\Windows\System\ajeVCnz.exe
  C:\Windows\System\ajeVCnz.exe
  2⤵
  PID:8300
- C:\Windows\System\fUJOHeL.exe
  C:\Windows\System\fUJOHeL.exe
  2⤵
  PID:11152
- C:\Windows\System\fNKlxzK.exe
  C:\Windows\System\fNKlxzK.exe
  2⤵
  PID:8772
- C:\Windows\System\lqLTEgz.exe
  C:\Windows\System\lqLTEgz.exe
  2⤵
  PID:8916
- C:\Windows\System\kbLWBtx.exe
  C:\Windows\System\kbLWBtx.exe
  2⤵
  PID:8156
- C:\Windows\System\sKxyIaQ.exe
  C:\Windows\System\sKxyIaQ.exe
  2⤵
  PID:13944
- C:\Windows\System\ZxycihK.exe
  C:\Windows\System\ZxycihK.exe
  2⤵
  PID:9052
- C:\Windows\System\GunhgDG.exe
  C:\Windows\System\GunhgDG.exe
  2⤵
  PID:14032
- C:\Windows\System\QyJbHYT.exe
  C:\Windows\System\QyJbHYT.exe
  2⤵
  PID:9196
- C:\Windows\System\cSWIXyv.exe
  C:\Windows\System\cSWIXyv.exe
  2⤵
  PID:14260
- C:\Windows\System\DmOtJBo.exe
  C:\Windows\System\DmOtJBo.exe
  2⤵
  PID:13420
- C:\Windows\System\uRmCYOj.exe
  C:\Windows\System\uRmCYOj.exe
  2⤵
  PID:11188
- C:\Windows\System\IDJYCRC.exe
  C:\Windows\System\IDJYCRC.exe
  2⤵
  PID:9356
- C:\Windows\System\RkgKGIl.exe
  C:\Windows\System\RkgKGIl.exe
  2⤵
  PID:7964
- C:\Windows\System\EUAXLYk.exe
  C:\Windows\System\EUAXLYk.exe
  2⤵
  PID:7616
- C:\Windows\System\glpnDVh.exe
  C:\Windows\System\glpnDVh.exe
  2⤵
  PID:8912
- C:\Windows\System\YSUzNRJ.exe
  C:\Windows\System\YSUzNRJ.exe
  2⤵
  PID:9612
- C:\Windows\System\HCVhJYN.exe
  C:\Windows\System\HCVhJYN.exe
  2⤵
  PID:9648
- C:\Windows\System\AbqgBoB.exe
  C:\Windows\System\AbqgBoB.exe
  2⤵
  PID:9744
- C:\Windows\System\xTdpDsW.exe
  C:\Windows\System\xTdpDsW.exe
  2⤵
  PID:8296
- C:\Windows\System\AQPkSOP.exe
  C:\Windows\System\AQPkSOP.exe
  2⤵
  PID:10468
- C:\Windows\System\eQhPNuZ.exe
  C:\Windows\System\eQhPNuZ.exe
  2⤵
  PID:7872
- C:\Windows\System\jUUjYyI.exe
  C:\Windows\System\jUUjYyI.exe
  2⤵
  PID:13692
- C:\Windows\System\ZyrqNjV.exe
  C:\Windows\System\ZyrqNjV.exe
  2⤵
  PID:10000
- C:\Windows\System\nlRyQfg.exe
  C:\Windows\System\nlRyQfg.exe
  2⤵
  PID:4420
- C:\Windows\System\jJPUrzh.exe
  C:\Windows\System\jJPUrzh.exe
  2⤵
  PID:10156
- C:\Windows\System\WsZuBRy.exe
  C:\Windows\System\WsZuBRy.exe
  2⤵
  PID:13092
- C:\Windows\System\pWItIAi.exe
  C:\Windows\System\pWItIAi.exe
  2⤵
  PID:10228
- C:\Windows\System\wfqtFUp.exe
  C:\Windows\System\wfqtFUp.exe
  2⤵
  PID:9280
- C:\Windows\System\puPxehP.exe
  C:\Windows\System\puPxehP.exe
  2⤵
  PID:8096
- C:\Windows\System\OgDiiwR.exe
  C:\Windows\System\OgDiiwR.exe
  2⤵
  PID:9436
- C:\Windows\System\OaMQXpk.exe
  C:\Windows\System\OaMQXpk.exe
  2⤵
  PID:9704
- C:\Windows\System\PqjQFQF.exe
  C:\Windows\System\PqjQFQF.exe
  2⤵
  PID:9808
- C:\Windows\System\jVNqRxa.exe
  C:\Windows\System\jVNqRxa.exe
  2⤵
  PID:9176
- C:\Windows\System\rtucMSQ.exe
  C:\Windows\System\rtucMSQ.exe
  2⤵
  PID:9928
- C:\Windows\System\SketzbB.exe
  C:\Windows\System\SketzbB.exe
  2⤵
  PID:10044
- C:\Windows\System\uZBAWgT.exe
  C:\Windows\System\uZBAWgT.exe
  2⤵
  PID:560
- C:\Windows\System\wzXgRDi.exe
  C:\Windows\System\wzXgRDi.exe
  2⤵
  PID:10176
- C:\Windows\System\yTajjRl.exe
  C:\Windows\System\yTajjRl.exe
  2⤵
  PID:9312
- C:\Windows\System\frVFXNW.exe
  C:\Windows\System\frVFXNW.exe
  2⤵
  PID:9812
- C:\Windows\System\kJmKfHE.exe
  C:\Windows\System\kJmKfHE.exe
  2⤵
  PID:9188
- C:\Windows\System\cqDAqHZ.exe
  C:\Windows\System\cqDAqHZ.exe
  2⤵
  PID:10108
- C:\Windows\System\ISggqGv.exe
  C:\Windows\System\ISggqGv.exe
  2⤵
  PID:9232
- C:\Windows\System\uVdMLod.exe
  C:\Windows\System\uVdMLod.exe
  2⤵
  PID:5460
- C:\Windows\System\BHfWyHl.exe
  C:\Windows\System\BHfWyHl.exe
  2⤵
  PID:9888
- C:\Windows\System\oraTYcp.exe
  C:\Windows\System\oraTYcp.exe
  2⤵
  PID:10488
- C:\Windows\System\HOGylbi.exe
  C:\Windows\System\HOGylbi.exe
  2⤵
  PID:9872
- C:\Windows\System\KTLcvgy.exe
  C:\Windows\System\KTLcvgy.exe
  2⤵
  PID:9668
- C:\Windows\System\zMuciJu.exe
  C:\Windows\System\zMuciJu.exe
  2⤵
  PID:10048
- C:\Windows\System\SxUEzgJ.exe
  C:\Windows\System\SxUEzgJ.exe
  2⤵
  PID:10540
- C:\Windows\System\OtylnBE.exe
  C:\Windows\System\OtylnBE.exe
  2⤵
  PID:10268
- C:\Windows\System\PFCBmSV.exe
  C:\Windows\System\PFCBmSV.exe
  2⤵
  PID:14356
- C:\Windows\System\kcPRyDh.exe
  C:\Windows\System\kcPRyDh.exe
  2⤵
  PID:14372
- C:\Windows\System\gfzmxMl.exe
  C:\Windows\System\gfzmxMl.exe
  2⤵
  PID:14396
- C:\Windows\System\bfDDHeE.exe
  C:\Windows\System\bfDDHeE.exe
  2⤵
  PID:14412
- C:\Windows\System\wsAcftB.exe
  C:\Windows\System\wsAcftB.exe
  2⤵
  PID:14436
- C:\Windows\System\VRGeKSX.exe
  C:\Windows\System\VRGeKSX.exe
  2⤵
  PID:14468
- C:\Windows\System\ifObMJi.exe
  C:\Windows\System\ifObMJi.exe
  2⤵
  PID:14492
- C:\Windows\System\SbFnbKU.exe
  C:\Windows\System\SbFnbKU.exe
  2⤵
  PID:14596
- C:\Windows\System\OoXxcJp.exe
  C:\Windows\System\OoXxcJp.exe
  2⤵
  PID:14612
- C:\Windows\System\VpohFiF.exe
  C:\Windows\System\VpohFiF.exe
  2⤵
  PID:14628
- C:\Windows\System\nFKhswC.exe
  C:\Windows\System\nFKhswC.exe
  2⤵
  PID:14668
- C:\Windows\System\YpEWfNY.exe
  C:\Windows\System\YpEWfNY.exe
  2⤵
  PID:14696
- C:\Windows\System\FmEMZxV.exe
  C:\Windows\System\FmEMZxV.exe
  2⤵
  PID:14724
- C:\Windows\System\zjossGU.exe
  C:\Windows\System\zjossGU.exe
  2⤵
  PID:14740
- C:\Windows\System\uvfhTaY.exe
  C:\Windows\System\uvfhTaY.exe
  2⤵
  PID:14768
- C:\Windows\System\Ifaptqa.exe
  C:\Windows\System\Ifaptqa.exe
  2⤵
  PID:14804
- C:\Windows\System\nfIrNvD.exe
  C:\Windows\System\nfIrNvD.exe
  2⤵
  PID:14832
- C:\Windows\System\GjKTXyg.exe
  C:\Windows\System\GjKTXyg.exe
  2⤵
  PID:14852
- C:\Windows\System\cZnpdJJ.exe
  C:\Windows\System\cZnpdJJ.exe
  2⤵
  PID:14872
- C:\Windows\System\ZcUeyeO.exe
  C:\Windows\System\ZcUeyeO.exe
  2⤵
  PID:14896
- C:\Windows\System\XEjAall.exe
  C:\Windows\System\XEjAall.exe
  2⤵
  PID:14944
- C:\Windows\System\QlSOfFE.exe
  C:\Windows\System\QlSOfFE.exe
  2⤵
  PID:14972
- C:\Windows\System\lyIDSLP.exe
  C:\Windows\System\lyIDSLP.exe
  2⤵
  PID:15004
- C:\Windows\System\mGCsNmO.exe
  C:\Windows\System\mGCsNmO.exe
  2⤵
  PID:15032
- C:\Windows\System\ANbgwuR.exe
  C:\Windows\System\ANbgwuR.exe
  2⤵
  PID:15072
- C:\Windows\System\UWHNxKW.exe
  C:\Windows\System\UWHNxKW.exe
  2⤵
  PID:15092
- C:\Windows\System\FTRTSPf.exe
  C:\Windows\System\FTRTSPf.exe
  2⤵
  PID:15120
- C:\Windows\System\cWjDzvX.exe
  C:\Windows\System\cWjDzvX.exe
  2⤵
  PID:15148
- C:\Windows\System\yRMPyke.exe
  C:\Windows\System\yRMPyke.exe
  2⤵
  PID:15176
- C:\Windows\System\lHBpbEZ.exe
  C:\Windows\System\lHBpbEZ.exe
  2⤵
  PID:15196
- C:\Windows\System\TqDTboP.exe
  C:\Windows\System\TqDTboP.exe
  2⤵
  PID:15232
- C:\Windows\System\vsPxLGd.exe
  C:\Windows\System\vsPxLGd.exe
  2⤵
  PID:15248
- C:\Windows\System\yeIvWzB.exe
  C:\Windows\System\yeIvWzB.exe
  2⤵
  PID:15268
- C:\Windows\System\xiDdHzg.exe
  C:\Windows\System\xiDdHzg.exe
  2⤵
  PID:15300
- C:\Windows\System\NsoJAdQ.exe
  C:\Windows\System\NsoJAdQ.exe
  2⤵
  PID:15336
- C:\Windows\System\COsqrde.exe
  C:\Windows\System\COsqrde.exe
  2⤵
  PID:7376
- C:\Windows\System\lotXDzj.exe
  C:\Windows\System\lotXDzj.exe
  2⤵
  PID:10712
- C:\Windows\System\hNfADAY.exe
  C:\Windows\System\hNfADAY.exe
  2⤵
  PID:14388
- C:\Windows\System\TLeLclu.exe
  C:\Windows\System\TLeLclu.exe
  2⤵
  PID:14480
- C:\Windows\System\bJjwxKW.exe
  C:\Windows\System\bJjwxKW.exe
  2⤵
  PID:10792
- C:\Windows\System\sFJZGCt.exe
  C:\Windows\System\sFJZGCt.exe
  2⤵
  PID:14456
- C:\Windows\System\JQtZWYh.exe
  C:\Windows\System\JQtZWYh.exe
  2⤵
  PID:14424
- C:\Windows\System\BffyyQl.exe
  C:\Windows\System\BffyyQl.exe
  2⤵
  PID:10884
- C:\Windows\System\SfiJOOE.exe
  C:\Windows\System\SfiJOOE.exe
  2⤵
  PID:14540
- C:\Windows\System\tYQAwZm.exe
  C:\Windows\System\tYQAwZm.exe
  2⤵
  PID:14560
- C:\Windows\System\RUkRcuG.exe
  C:\Windows\System\RUkRcuG.exe
  2⤵
  PID:11080
- C:\Windows\System\aYlKuXC.exe
  C:\Windows\System\aYlKuXC.exe
  2⤵
  PID:14624
- C:\Windows\System\uICKqbM.exe
  C:\Windows\System\uICKqbM.exe
  2⤵
  PID:2900
- C:\Windows\System\XBJMbXg.exe
  C:\Windows\System\XBJMbXg.exe
  2⤵
  PID:14756
- C:\Windows\System\GHBwbRr.exe
  C:\Windows\System\GHBwbRr.exe
  2⤵
  PID:14796
- C:\Windows\System\HSWkmqZ.exe
  C:\Windows\System\HSWkmqZ.exe
  2⤵
  PID:14892
- C:\Windows\System\ybqqvvk.exe
  C:\Windows\System\ybqqvvk.exe
  2⤵
  PID:14968
- C:\Windows\System\ryQliJo.exe
  C:\Windows\System\ryQliJo.exe
  2⤵
  PID:14956
- C:\Windows\System\nMYhkxD.exe
  C:\Windows\System\nMYhkxD.exe
  2⤵
  PID:10400
- C:\Windows\System\TctiPjh.exe
  C:\Windows\System\TctiPjh.exe
  2⤵
  PID:7488
- C:\Windows\System\Zutnzsn.exe
  C:\Windows\System\Zutnzsn.exe
  2⤵
  PID:15088
- C:\Windows\System\xeSopDD.exe
  C:\Windows\System\xeSopDD.exe
  2⤵
  PID:15144
- C:\Windows\System\hcckXCE.exe
  C:\Windows\System\hcckXCE.exe
  2⤵
  PID:15168
- C:\Windows\System\FXiaTVA.exe
  C:\Windows\System\FXiaTVA.exe
  2⤵
  PID:15276
- C:\Windows\System\tuemceD.exe
  C:\Windows\System\tuemceD.exe
  2⤵
  PID:15328
- C:\Windows\System\ZmTTxjo.exe
  C:\Windows\System\ZmTTxjo.exe
  2⤵
  PID:13208
- C:\Windows\System\hvhRaau.exe
  C:\Windows\System\hvhRaau.exe
  2⤵
  PID:14348
- C:\Windows\System\qVITlpm.exe
  C:\Windows\System\qVITlpm.exe
  2⤵
  PID:564
- C:\Windows\System\SQigWqB.exe
  C:\Windows\System\SQigWqB.exe
  2⤵
  PID:10848
- C:\Windows\System\yHXodxe.exe
  C:\Windows\System\yHXodxe.exe
  2⤵
  PID:10936
- C:\Windows\System\SsktpAT.exe
  C:\Windows\System\SsktpAT.exe
  2⤵
  PID:14608
- C:\Windows\System\JfoRcXf.exe
  C:\Windows\System\JfoRcXf.exe
  2⤵
  PID:14780
- C:\Windows\System\iyNobWB.exe
  C:\Windows\System\iyNobWB.exe
  2⤵
  PID:11732
- C:\Windows\System\wahmdmD.exe
  C:\Windows\System\wahmdmD.exe
  2⤵
  PID:14984
- C:\Windows\System\nFRgefd.exe
  C:\Windows\System\nFRgefd.exe
  2⤵
  PID:15020
- C:\Windows\System\bcRRcyx.exe
  C:\Windows\System\bcRRcyx.exe
  2⤵
  PID:15140
- C:\Windows\System\ykkNnPC.exe
  C:\Windows\System\ykkNnPC.exe
  2⤵
  PID:15264
- C:\Windows\System\ykfrISF.exe
  C:\Windows\System\ykfrISF.exe
  2⤵
  PID:14380
- C:\Windows\System\mHwbTst.exe
  C:\Windows\System\mHwbTst.exe
  2⤵
  PID:3620
- C:\Windows\System\codQmtk.exe
  C:\Windows\System\codQmtk.exe
  2⤵
  PID:11172
- C:\Windows\System\WaDMSHZ.exe
  C:\Windows\System\WaDMSHZ.exe
  2⤵
  PID:14716
- C:\Windows\System\fzpLBpw.exe
  C:\Windows\System\fzpLBpw.exe
  2⤵
  PID:10060
- C:\Windows\System\KLMXdCp.exe
  C:\Windows\System\KLMXdCp.exe
  2⤵
  PID:10052
- C:\Windows\System\ZLGtFWI.exe
  C:\Windows\System\ZLGtFWI.exe
  2⤵
  PID:11344
- C:\Windows\System\cQpoIiy.exe
  C:\Windows\System\cQpoIiy.exe
  2⤵
  PID:15224
- C:\Windows\System\DYpKlfo.exe
  C:\Windows\System\DYpKlfo.exe
  2⤵
  PID:10420
- C:\Windows\System\ljGrDSF.exe
  C:\Windows\System\ljGrDSF.exe
  2⤵
  PID:15220
- C:\Windows\System\DzDtlGP.exe
  C:\Windows\System\DzDtlGP.exe
  2⤵
  PID:15372
- C:\Windows\System\RouWTSw.exe
  C:\Windows\System\RouWTSw.exe
  2⤵
  PID:15400
- C:\Windows\System\kbkEizT.exe
  C:\Windows\System\kbkEizT.exe
  2⤵
  PID:15416
- C:\Windows\System\esMRckO.exe
  C:\Windows\System\esMRckO.exe
  2⤵
  PID:15432
- C:\Windows\System\yoyMKbN.exe
  C:\Windows\System\yoyMKbN.exe
  2⤵
  PID:15468
- C:\Windows\System\WmdbiUp.exe
  C:\Windows\System\WmdbiUp.exe
  2⤵
  PID:15492
- C:\Windows\System\bjOXQvk.exe
  C:\Windows\System\bjOXQvk.exe
  2⤵
  PID:15516
- C:\Windows\System\Hjqnfmg.exe
  C:\Windows\System\Hjqnfmg.exe
  2⤵
  PID:15552
- C:\Windows\System\oJtYOaj.exe
  C:\Windows\System\oJtYOaj.exe
  2⤵
  PID:15584
- C:\Windows\System\UxAWoiN.exe
  C:\Windows\System\UxAWoiN.exe
  2⤵
  PID:15620
- C:\Windows\System\rugVDLA.exe
  C:\Windows\System\rugVDLA.exe
  2⤵
  PID:15660
- C:\Windows\System\XsTIkQp.exe
  C:\Windows\System\XsTIkQp.exe
  2⤵
  PID:15688
- C:\Windows\System\XvOjaDn.exe
  C:\Windows\System\XvOjaDn.exe
  2⤵
  PID:15716
- C:\Windows\System\AxrfJVf.exe
  C:\Windows\System\AxrfJVf.exe
  2⤵
  PID:15732
- C:\Windows\System\QfKChSY.exe
  C:\Windows\System\QfKChSY.exe
  2⤵
  PID:15768
- C:\Windows\System\dsoddYi.exe
  C:\Windows\System\dsoddYi.exe
  2⤵
  PID:15796
- C:\Windows\System\JHuwbko.exe
  C:\Windows\System\JHuwbko.exe
  2⤵
  PID:15828
- C:\Windows\System\RppgHWv.exe
  C:\Windows\System\RppgHWv.exe
  2⤵
  PID:15864
- C:\Windows\System\MOdpGCc.exe
  C:\Windows\System\MOdpGCc.exe
  2⤵
  PID:15884
- C:\Windows\System\hIISfVM.exe
  C:\Windows\System\hIISfVM.exe
  2⤵
  PID:15928
- C:\Windows\System\STuxTCK.exe
  C:\Windows\System\STuxTCK.exe
  2⤵
  PID:15956
- C:\Windows\System\NpoCMIa.exe
  C:\Windows\System\NpoCMIa.exe
  2⤵
  PID:15984
- C:\Windows\System\YzVpLyZ.exe
  C:\Windows\System\YzVpLyZ.exe
  2⤵
  PID:16012
- C:\Windows\System\uuwjxnE.exe
  C:\Windows\System\uuwjxnE.exe
  2⤵
  PID:16044
- C:\Windows\System\bjeTjYf.exe
  C:\Windows\System\bjeTjYf.exe
  2⤵
  PID:16060
- C:\Windows\System\TyxvsHS.exe
  C:\Windows\System\TyxvsHS.exe
  2⤵
  PID:16088
- C:\Windows\System\gPByUUC.exe
  C:\Windows\System\gPByUUC.exe
  2⤵
  PID:16120
- C:\Windows\System\Ykcqncw.exe
  C:\Windows\System\Ykcqncw.exe
  2⤵
  PID:16148
- C:\Windows\System\cxmHwgJ.exe
  C:\Windows\System\cxmHwgJ.exe
  2⤵
  PID:16172
- C:\Windows\System\ueEXYXk.exe
  C:\Windows\System\ueEXYXk.exe
  2⤵
  PID:16200
- C:\Windows\System\yhXkXIE.exe
  C:\Windows\System\yhXkXIE.exe
  2⤵
  PID:16220
- C:\Windows\System\OmqemZW.exe
  C:\Windows\System\OmqemZW.exe
  2⤵
  PID:16256
- C:\Windows\System\wTsHavh.exe
  C:\Windows\System\wTsHavh.exe
  2⤵
  PID:16296
- C:\Windows\System\WvbvdhN.exe
  C:\Windows\System\WvbvdhN.exe
  2⤵
  PID:16324
- C:\Windows\System\UFMnTMi.exe
  C:\Windows\System\UFMnTMi.exe
  2⤵
  PID:16352
- C:\Windows\System\rJAUIco.exe
  C:\Windows\System\rJAUIco.exe
  2⤵
  PID:16380
- C:\Windows\System\GIEuWrd.exe
  C:\Windows\System\GIEuWrd.exe
  2⤵
  PID:15412
- C:\Windows\System\AdROXPo.exe
  C:\Windows\System\AdROXPo.exe
  2⤵
  PID:15392
- C:\Windows\System\dtIgyfe.exe
  C:\Windows\System\dtIgyfe.exe
  2⤵
  PID:15456
- C:\Windows\System\INtXNjG.exe
  C:\Windows\System\INtXNjG.exe
  2⤵
  PID:15504
- C:\Windows\System\gLOZpnw.exe
  C:\Windows\System\gLOZpnw.exe
  2⤵
  PID:15564
- C:\Windows\System\fMjzMMy.exe
  C:\Windows\System\fMjzMMy.exe
  2⤵
  PID:15672
- C:\Windows\System\oNbgkxs.exe
  C:\Windows\System\oNbgkxs.exe
  2⤵
  PID:15708
- C:\Windows\System\EmjqcZj.exe
  C:\Windows\System\EmjqcZj.exe
  2⤵
  PID:15808
- C:\Windows\System\mrNAhyS.exe
  C:\Windows\System\mrNAhyS.exe
  2⤵
  PID:15860
- C:\Windows\System\cDdwWzi.exe
  C:\Windows\System\cDdwWzi.exe
  2⤵
  PID:15904
- C:\Windows\System\vUuGYSb.exe
  C:\Windows\System\vUuGYSb.exe
  2⤵
  PID:16036
- C:\Windows\System\ImBICEj.exe
  C:\Windows\System\ImBICEj.exe
  2⤵
  PID:16072
- C:\Windows\System\lJnrGTR.exe
  C:\Windows\System\lJnrGTR.exe
  2⤵
  PID:16128
- C:\Windows\System\dRwXsRp.exe
  C:\Windows\System\dRwXsRp.exe
  2⤵
  PID:11712
- C:\Windows\System\jNqpBjn.exe
  C:\Windows\System\jNqpBjn.exe
  2⤵
  PID:11656
- C:\Windows\System\ebLCdCs.exe
  C:\Windows\System\ebLCdCs.exe
  2⤵
  PID:16232
- C:\Windows\System\wetuBXG.exe
  C:\Windows\System\wetuBXG.exe
  2⤵
  PID:16284
- C:\Windows\System\XMmzKNp.exe
  C:\Windows\System\XMmzKNp.exe
  2⤵
  PID:2848
- C:\Windows\System\YMHlYsZ.exe
  C:\Windows\System\YMHlYsZ.exe
  2⤵
  PID:10864
- C:\Windows\System\mqGqHpL.exe
  C:\Windows\System\mqGqHpL.exe
  2⤵
  PID:15428
- C:\Windows\System\apTHkAT.exe
  C:\Windows\System\apTHkAT.exe
  2⤵
  PID:2520
- C:\Windows\System\IbDonUU.exe
  C:\Windows\System\IbDonUU.exe
  2⤵
  PID:15540
- C:\Windows\System\XteNnEy.exe
  C:\Windows\System\XteNnEy.exe
  2⤵
  PID:760
- C:\Windows\System\PtzxWXn.exe
  C:\Windows\System\PtzxWXn.exe
  2⤵
  PID:964
- C:\Windows\System\gEpXcZu.exe
  C:\Windows\System\gEpXcZu.exe
  2⤵
  PID:15780
- C:\Windows\System\JUCfEwa.exe
  C:\Windows\System\JUCfEwa.exe
  2⤵
  PID:2376
- C:\Windows\System\wkYWIta.exe
  C:\Windows\System\wkYWIta.exe
  2⤵
  PID:15948
- C:\Windows\System\rNXwMVR.exe
  C:\Windows\System\rNXwMVR.exe
  2⤵
  PID:10260
- C:\Windows\System\GouYozZ.exe
  C:\Windows\System\GouYozZ.exe
  2⤵
  PID:2360
- C:\Windows\System\AAdIyxQ.exe
  C:\Windows\System\AAdIyxQ.exe
  2⤵
  PID:11308
- C:\Windows\System\YbSQnLE.exe
  C:\Windows\System\YbSQnLE.exe
  2⤵
  PID:11480
- C:\Windows\System\pByYokd.exe
  C:\Windows\System\pByYokd.exe
  2⤵
  PID:11488
- C:\Windows\System\LmKDQPR.exe
  C:\Windows\System\LmKDQPR.exe
  2⤵
  PID:11580
- C:\Windows\System\DYaiqQw.exe
  C:\Windows\System\DYaiqQw.exe
  2⤵
  PID:11648
- C:\Windows\System\QVcxLiz.exe
  C:\Windows\System\QVcxLiz.exe
  2⤵
  PID:11860
- C:\Windows\System\zJhcKNx.exe
  C:\Windows\System\zJhcKNx.exe
  2⤵
  PID:12356
- C:\Windows\System\rqYlKTb.exe
  C:\Windows\System\rqYlKTb.exe
  2⤵
  PID:16164
- C:\Windows\System\wWBioza.exe
  C:\Windows\System\wWBioza.exe
  2⤵
  PID:2044
- C:\Windows\System\cIAdRwO.exe
  C:\Windows\System\cIAdRwO.exe
  2⤵
  PID:16288
- C:\Windows\System\fIVfsGG.exe
  C:\Windows\System\fIVfsGG.exe
  2⤵
  PID:16336
- C:\Windows\System\SBGpaSj.exe
  C:\Windows\System\SBGpaSj.exe
  2⤵
  PID:12036
- C:\Windows\System\ithIuwQ.exe
  C:\Windows\System\ithIuwQ.exe
  2⤵
  PID:12820
- C:\Windows\System\EQrEQTg.exe
  C:\Windows\System\EQrEQTg.exe
  2⤵
  PID:15424
- C:\Windows\System\lEWrZMs.exe
  C:\Windows\System\lEWrZMs.exe
  2⤵
  PID:6860
- C:\Windows\System\LxbnWNx.exe
  C:\Windows\System\LxbnWNx.exe
  2⤵
  PID:684
- C:\Windows\System\gpCUyPC.exe
  C:\Windows\System\gpCUyPC.exe
  2⤵
  PID:8184
- C:\Windows\System\vpRinVQ.exe
  C:\Windows\System\vpRinVQ.exe
  2⤵
  PID:15848
- C:\Windows\System\nKfAJcx.exe
  C:\Windows\System\nKfAJcx.exe
  2⤵
  PID:12272
- C:\Windows\System\cgmoPSA.exe
  C:\Windows\System\cgmoPSA.exe
  2⤵
  PID:8548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:10496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_5g4bwskj.u14.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5g4bwskj.u14.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BitSNeC.exe

Path C:\Windows\System\BitSNeC.exe
Size 2.6MB
SHA256 9264facc00bbbad93e3f1d3985092c80c7d004dd32cd4f728bd5cc1c3145a2b9
MD5 6c7cd0d4964774f38bd5e858e7804017
SHA1 479cb217bb2b7a684779936dfc7465fc3c4d22a7
SHA512 5d97c28f3abb2d5e0d04c798300adf6cb87ad245763434d83c6e7a1d9ae4b729e758b6da4dc8b9e3386926d3307cac166501108e45fed423612b724cc9079cf4
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R22:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rc
MD5 SHA1 SHA512 SSDEEP

Submit Download

EtZganU.exe

Path C:\Windows\System\EtZganU.exe
Size 2.6MB
SHA256 5c84eaa9113611573128bb8d9f3f3ab2da561d63e9d1b3acb106ee99a378fb0e
MD5 06d74aa1e34e7cc0d40e89f33404f8c8
SHA1 d7a0af93b4a8c26e4459bce358ecfb066ee27db0
SHA512 12254d17d05fd748559d6c75144323db01517edfdea0bed07c8d2259a0edfba2b07470015fc565f3c951977df9d745799eb9e46c3cf4d7af52b3c5d1550f13b3
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R21:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

FftVdhR.exe

Path C:\Windows\System\FftVdhR.exe
Size 2.6MB
SHA256 5e52a645a724f7a81ad6d0b5346b1c99cb7eea2f94c56120eab3841709af80e2
MD5 ee04aac72ee6402978014add883679d2
SHA1 12d5bc03508636d45d7a7c9a8ec81466a07d60c4
SHA512 caabb7a2cdf4006373911dd3f7a034dc620d459e4933852265c4c6ce77bdb9bec5380252f8dcd5223d7cae3dcfe11d46785a1aaf24f3635535feb3eef35455ce
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2c:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

GVIRENo.exe

Path C:\Windows\System\GVIRENo.exe
Size 2.6MB
SHA256 5c4926ccbbd0da8427893ff4bf2f7e24e2492caae1a5edea4c6b55f0c2bdaf1d
MD5 00a4be10b1eeaee6448ca138dc12cc97
SHA1 9294ab0c4a00f7b4812c22b701da47c332f3d354
SHA512 1164adf26bbecd8709dc16ded4757e46d1ab4b5ffd70865848c0c45b0eb046c6844028664174069b4604cd18a53a0ceb29abc279b6d38014d01cb530b567caea
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2t:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

GZQbYCq.exe

Path C:\Windows\System\GZQbYCq.exe
Size 2.6MB
SHA256 4cee9dcd55b2e06487c286c1bb93721fb2f92ef3889c29d1c5bbd283ecb26ae2
MD5 0b833e4a2a566f638788b11ce6a2102a
SHA1 4132e3b95a0bc1dc0885b4583d39ac9cb12df9d7
SHA512 76008c5166044f92743dcb9785100ebec11ae2c876137fb546d7e7f69ce15113741b11857a44b5ddab9b93b5eac2331468a4c918f4718b07c3df4629589c4de4
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2+:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RE
MD5 SHA1 SHA512 SSDEEP

Submit Download

HMmDdvU.exe

Path C:\Windows\System\HMmDdvU.exe
Size 2.6MB
SHA256 b2d04a1f932bfb45cd56a7f0f959eb4f1f5fe5d91acd45f84de938059b79a440
MD5 9b5dd07209fe2f4a2871e3b38e58e0c0
SHA1 13c22fbfd442c0cda763b9d510d27836554fb38f
SHA512 00aa59c571b5358d173587a5a968ed78a7636c4b990728fc54c8b40f637686f3367d15b06b3b1aa49b858bb8f3400957033b573dcdc0387186fab55d9c401622
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2B:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

IWjfNAU.exe

Path C:\Windows\System\IWjfNAU.exe
Size 2.6MB
SHA256 df2fb0fc8e817765027b9dc542d2477387aa3646bc27ec658f880ce9933c0881
MD5 9a1cdd89f809f7e67e9e6ccf8ef492a8
SHA1 9531d2d898d1de7d6eb0a6f2a893b5955c7fbf6c
SHA512 d477756bf82dadebb2ae920a2917b7b8b8ead3d7b90885ef998b0bcd45b04ee987c1a241548656dbd0a3e570ac9f883c3f26bbe59cfef5f5daf004ff45b2d333
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2X:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

IXbxYzp.exe

Path C:\Windows\System\IXbxYzp.exe
Size 2.6MB
SHA256 1d63fc2e45c3594a059e137b0cb88990c8d018fdb99ce4295cf62b1228828238
MD5 6d21ec707d8ffd4eccba15402e8229ca
SHA1 8594c215c9f3d54fc754bc0aafb686663aed0cc2
SHA512 bb0e5c1180c72e0d318cb03e3f7df77d5a47912a3a49655e5b12d297b3c1e9d7b99ce28f5a3b240f1830dd6c3d27321f1c6dda5605ec56d10066ebfe8f7cdebc
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2p:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

KSfxEAh.exe

Path C:\Windows\System\KSfxEAh.exe
Size 2.6MB
SHA256 bd0d94b87ffd48d7f7776056462874d06ae45a9615ef6d85db00ca2f2f237767
MD5 c830774ed5cb8150357a12e9ad92891f
SHA1 38d75b78c80f26d0940986a98cba0446d6887eca
SHA512 5dfd0e443a3f8ed4fffbc9d5ef2a500abf3385926943d54011da18ff9e54ba25109b897c824aba917a831ba636809764eb2af586b3b8504d9bfacc785c291411
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R27:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

OznXhFM.exe

Path C:\Windows\System\OznXhFM.exe
Size 2.6MB
SHA256 da0718a4cc7e80fdc5d4d3f43bf05ebef370634a7c69e280bce187f471337610
MD5 fd24e0a2c93b7ccb8018658c006d118f
SHA1 fff9e91a4db6aa7c52f01de5a6bd51827257d196
SHA512 81cab32a9b790c974e1246175c2a3e5cbf3ab3b8d729da6c20fa193f921ad116ef3afd45a1e4e3a543a2ceea914ec91dc4661a5f3feae5e1bef96e0c1878b5ed
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2X:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

QYVwqnT.exe

Path C:\Windows\System\QYVwqnT.exe
Size 2.6MB
SHA256 ed5fba46a0ed1696541e532b3020171e599a08a14f368492dce04b2b1a5360aa
MD5 bd519944f93d78e7458dc1f000b656a4
SHA1 c2c07a5dfcacaaeca35d98c10a7494cb18c7bd55
SHA512 6a0e989b16ca0d4366de9a161846cea040c8280c501a28acae84b3f378da7fad0e5a073cab66987f8243b2ef5df0dfa7d6c8770663e5408d1e2cf3d39eb3bff7
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2t:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rz
MD5 SHA1 SHA512 SSDEEP

Submit Download

RbuWnPK.exe

Path C:\Windows\System\RbuWnPK.exe
Size 2.6MB
SHA256 f069e09974a540f4fa16c18bd1f63a301df1facc0c9ad45a8ee51f8eb825b979
MD5 246240514b69a3f0b309018e9f45c747
SHA1 7983f3d0b0e36ec3742d890ec007cde4a8ed3761
SHA512 9c8266d89d6f8ffeeed96daaed74c757cda8543aa23b1c16d97b0895d75882aa2e719bd59469e4925e04619de9c5c6aee56d85605c6bf75834f153802976488c
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2z:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

UUybcDI.exe

Path C:\Windows\System\UUybcDI.exe
Size 2.6MB
SHA256 e769bf80a8b2dcb0795bc60b0358671afb161f3859d26ffa3305498dd93abaa5
MD5 b19e85db088ff1cc609baebc0005002e
SHA1 21412f97d378bae3496f8ab9fa0789a5eeb386df
SHA512 50d4cb6d5cec0dc2803c3d841af7a49719617c73e91ca15dd7cfcee72e087286366c734347637e86e696b2958fe6afab5cc3cdad561c02de4384e0b3159356b2
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2C:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download

UyHYLVG.exe

Path C:\Windows\System\UyHYLVG.exe
Size 2.6MB
SHA256 da64fa8198ef6cb641b5401161a4666cb1087a882f17bc744dc090c1d6b32f54
MD5 f0469b6a78e0684a0c6880694b98b0c4
SHA1 ab3cdc6f3c098288c6b115f1cebe4a4db330b3f9
SHA512 fc0d114297fe87893f5820ab888cf86fb26705834153ef8797e87069f2476ea0e9a8d96ec7def9c5f46bd0972a0bf2127656e7dfbc09f20aa138b4476fafbddc
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2r:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSKmuUN.exe

Path C:\Windows\System\VSKmuUN.exe
Size 2.6MB
SHA256 01af1ad24c20bf903905f6f823effbf6e3058866b3d103ae8bbb757dfe4a437a
MD5 6302b32ccc57e4551e729f7eb71ba2b6
SHA1 631799d939d549900c33345ed4760033d2863617
SHA512 3f0de4e09f81a12bd420f969e14786d6b64e22241def2ae2753ef77875acd1aaab90f697bf0510982b785867f7f4ea6df4261d1ad8d24fe955cc47f411ea36bc
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2U:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R6
MD5 SHA1 SHA512 SSDEEP

Submit Download

WaEBVgR.exe

Path C:\Windows\System\WaEBVgR.exe
Size 2.6MB
SHA256 7144314805e7eab45998fa09fd4c3bbfb7d0f3bee7d2652b656b6cd2d0fcac68
MD5 14944576854220d83d81e1642f0aed89
SHA1 4cd1034345696e9ba07abcca2d584a2e758d7e99
SHA512 d6bc2b0521d62ed91da54d1ab74664d324bd8797d519d7a2294660e2be4718fd3dddd5f2ec087db31717526ed8e0fd49a5a436b8ac3175bf88b0f0a37f24c990
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2J:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RX
MD5 SHA1 SHA512 SSDEEP

Submit Download

XFcvMZL.exe

Path C:\Windows\System\XFcvMZL.exe
Size 2.6MB
SHA256 709a62a3ae4fdc1c219056fd840876f7992c08fd92f917bbdbee0d3be11d20ca
MD5 8a4b0494a6d6ccb2dcdea06707dc88d5
SHA1 6c00ef22944420588617c1fa1942c3efc4dc9ea6
SHA512 6559b551eeeb47ff6257d36bd092227c2c4516f4c3839b07ab9dbdc032b760f63ac5c3994bbad4f6209a30f6e4afa466aac8942d3a2510eb05e8773170c45e4a
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2H:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

XIDAdmf.exe

Path C:\Windows\System\XIDAdmf.exe
Size 2.6MB
SHA256 da612e2f975d95b2b827be0cbee5cd853fb6819461b7924a20732441615d10f7
MD5 8b28bb76618f351ad857d68840287f1d
SHA1 69c9be5fca368369e603e57350bb7a13c0b24c75
SHA512 5a27d49cee30191f3d0a3c9d5a898bd150fc46bc36c99544f59524fd705c57bb7f6d566467cbc7f07be2b6af8e7021263f0e142cae73e04aa16d46594a7f7daa
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2f:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZSLAtZa.exe

Path C:\Windows\System\ZSLAtZa.exe
Size 2.6MB
SHA256 61957def5d9d424700bed3eb6a3959b35d3470b745ddef8a2edb03b0a249a962
MD5 cb38f3495a5a173c8723c1b3b8f845d4
SHA1 e36b7beaf3e8ee7601e050caf6f854b01c64641c
SHA512 b9ade8022abb258d35722747d867e2d645a3297d0f5f9ff4824b550aa980005c88f1ae3ebfca018df705242f6d92e58ab4bc74f5b9142112f60232f4ac587e8f
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2o:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZdNilbk.exe

Path C:\Windows\System\ZdNilbk.exe
Size 2.6MB
SHA256 8a444914aa354329b9c1fbd8ec5231bf83c62bd1207884027bd7a5d11b68545b
MD5 f39e8f2a76c5dd96783e61f77a242347
SHA1 20881044112a78e33aca8728eda3f7ec1475c92b
SHA512 7d7c074d52928695fcec4c5c9e5da6f23a32e9fd4b2218ecb33ebd80bb68bb95c95b7104550a1196d0a7391fe02f30e33c7d3574264708a6ea32bc2422de52c9
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2m:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZgkkvQz.exe

Path C:\Windows\System\ZgkkvQz.exe
Size 2.6MB
SHA256 0032ff33d0798a540151e8d7fe308800e1eaa577cc7a8517f97b0539c3c228de
MD5 ef5170ab53359f24f5430ee4350912f6
SHA1 afc3e133054cb4b33256bbeee65620e81307ff51
SHA512 37e23d2ba871132e060123de890fe4756db67296a54b58d83fff5cd49c009dafca8d52a5df21e9b4501706888e9e432731299783f068dac785a9ab5c8c7ad8c3
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2Y:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

eNdteEa.exe

Path C:\Windows\System\eNdteEa.exe
Size 2.6MB
SHA256 cb2e0055902a1fc59c5079e5ac73432094204716f6c77a986dc2466ef7360c03
MD5 05807e2b08e56d08b706892f91450825
SHA1 1f1c1c74a5844d8bfffe012fd524c25a31ffbe95
SHA512 96c1f0e9565e99242b5a5dc7682b09bf7f5403a3048bae4e3bad4c466ebd9b749c72c259014b0f2fa6d1b4316f331c1b9677548c224832f568626bfb28bd92ff
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2/:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

gCflAKE.exe

Path C:\Windows\System\gCflAKE.exe
Size 2.6MB
SHA256 20f8768b64b43092566dd24826d3b5a90e2fdf2605c5818198cc543e2f71e3b5
MD5 1591e00e52e956cf8b8b84e8aead4736
SHA1 0a4848a297b4c7ba085ca5508c940b1e6277b1e3
SHA512 626bcc1dec753685a097e32eec980d7e066354c647da73c5d5978eb92086b8c21a3ed5a131c753f94ce15208e55bf3f0ae3ae5ce88ef29a492ae29c7aa84be99
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2s:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

kxQenBl.exe

Path C:\Windows\System\kxQenBl.exe
Size 2.6MB
SHA256 829b7a6a6247e7efdae0bf53d924d44c53d6cd2c47f9a64828028ba6282ee3f6
MD5 e8b98505fccf940089ff0d7e58351b2a
SHA1 18fd9cd82e2493bcbe4002c63961f51d8bd961bd
SHA512 b48f1597ebb1047c6ed7e8f81282e62e55afa2a1d2f3b79bcb13f84d448d3220b2542a06d0449e66c86d505a6e2b34565360525956a37fd202a0f18db4857fb8
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R24:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Re
MD5 SHA1 SHA512 SSDEEP

Submit Download

mIIlhaz.exe

Path C:\Windows\System\mIIlhaz.exe
Size 2.6MB
SHA256 b7b8dac6529fa6696a954c9f95b5f5785fb1af7c8668c519383fc28049012511
MD5 27772863f96435047e0cb523f6810152
SHA1 6d9df0fc90729ee2c9c66d7d7fc9ff8565f7fcc3
SHA512 5aecb9a95fe81b0aee1f1fda662e583dfb5dbcb1bd9fc45b81c803c9dfb5ce787cc16da67b498b7ae43513a95d60f36bc3b436256ca8917c31d51004ce64d770
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2a:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

nDFkujy.exe

Path C:\Windows\System\nDFkujy.exe
Size 2.6MB
SHA256 7c0189a815973264f7cb5384a9c93bbe0356862e547d5518edf0e83f16409bf4
MD5 344214be0defd64c8efff7873c3d5aaa
SHA1 2eb2c8cd33d292f2036c4d08074bd241d272e3be
SHA512 a44d4375849fe934bd3124bafecfc9e506db2c2d7ad8b19d2cf933950fd3c88387eb2f95f9ae2fe69cabfae9f9a90daddd37bce92ccd1aee4fe8e2967fb708a4
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R22:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RY
MD5 SHA1 SHA512 SSDEEP

Submit Download

nZmAeDk.exe

Path C:\Windows\System\nZmAeDk.exe
Size 2.6MB
SHA256 6170cf3b18a3c3c2f647982aa2f5b46391c0304175e10be879931837ccced1ed
MD5 56469dc12c0ca3130b133e7c21ed002f
SHA1 948d4d7c86e296f81249a15a85c7e1a16a1bded6
SHA512 df053ef1cee86cdddf36a0df269f2e87794e7bd97e5e7ff3ab4eccc769fddcfa463b0152c07406357edcf909a06c20d8efa36e1afd33152889b496fb10c0e607
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R24:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2R+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pooGaHi.exe

Path C:\Windows\System\pooGaHi.exe
Size 2.6MB
SHA256 c51f7db03e89e1dc35bf94d929fb225c7edfa8ebcca0851a3070f49e188185dc
MD5 6dc511cd3db543bbe44607e308dec6b7
SHA1 7c3c385ce6bef0ede9dd7536cd1bbeedb5b532e8
SHA512 81e234c2d58d910e3b2168bf836d1c2c91fb290444efa46f4c353fd19f2e7b4253e7dd369825837a98549903116d22327a567e7398da83f2d4bb5cac0aa96e10
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2k:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rq
MD5 SHA1 SHA512 SSDEEP

Submit Download

qDmvaQj.exe

Path C:\Windows\System\qDmvaQj.exe
Size 2.6MB
SHA256 1ea10669134d35177e41085a192eff2604521deeb84d4d83197afe01ff2ea1fe
MD5 f367a0ba8e0c1ee57cbeb4f3f33a0e12
SHA1 c2bb45e197929a8523a6b18e0990036240fc4167
SHA512 7a8377efca74689a91373435c6ce85b9fc996a8cd71537bc3b81f8e704f4fb5f83d88a5a09b6dca743fc7ed9664e083099fb10fc65587aa5ae7d1834489a7473
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2I:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RW
MD5 SHA1 SHA512 SSDEEP

Submit Download

wfDvgkl.exe

Path C:\Windows\System\wfDvgkl.exe
Size 2.6MB
SHA256 35da78f421005e5e5095665401b4c811cb429bea13e8d48581d783175b1cf222
MD5 dd9f08e399d8ef99d5ebf28c2b93bb08
SHA1 b305437bb95af9eacf9d12366edd6050205f84d3
SHA512 ed826f65aa57947e8d3590321adc3b7806c945594e8a54d07a3ba3fb10961d26c2b242338cd8c7e7aa56d6c0749175f1ca8fc8292d7536391a12d7e41e24dad5
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2E:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2Rq
MD5 SHA1 SHA512 SSDEEP

Submit Download

xLJXFGT.exe

Path C:\Windows\System\xLJXFGT.exe
Size 2.6MB
SHA256 a7588af7f48e3217593f143d33024cd2ce0ba9d66d754c440670b9f712300a4c
MD5 75df2afcdfed94c4e9a50a5c40099f05
SHA1 a50a9a27833895a9e5f93ea3455ef946e40ef40a
SHA512 ec6e9595221c19aac397dc589a3bbc991c6fdaaa58c1ebb7ceb91bec88ec9676ee6c7135edfa6aad0a3ba04a350d04b35a50330a8627868f4697a8b330c623e2
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2e:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RY
MD5 SHA1 SHA512 SSDEEP

Submit Download

zMxMcSH.exe

Path C:\Windows\System\zMxMcSH.exe
Size 2.6MB
SHA256 43349ae62fcaf2b713e2cbf956b4b9d3482276481ed77543d81b5b4bcf8f02f4
MD5 dcb209755bc5d0c81fd0acff64f8d7ef
SHA1 e55d7ae6cdea6d35db62cc1a62cc6afb6bc9f6a6
SHA512 64d63e9fe8d9dbecb3cae571c9d55d6e564b64e7bd5f5eb95de39cf76092c222080cfc82be77e57d45061f603b8961a553a9214ba51fd5b64db8913674a02493
SSDEEP 49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/R2I:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/440-1402-0x00007FF63EC60000-0x00007FF63F056000-memory.dmp

Download

memory/440-20-0x00007FF63EC60000-0x00007FF63F056000-memory.dmp

Download

memory/692-72-0x00007FF747E30000-0x00007FF748226000-memory.dmp

Download

memory/692-1567-0x00007FF747E30000-0x00007FF748226000-memory.dmp

Download

memory/1184-1429-0x00007FF602290000-0x00007FF602686000-memory.dmp

Download

memory/1184-27-0x00007FF602290000-0x00007FF602686000-memory.dmp

Download

memory/1188-229-0x00007FF777A60000-0x00007FF777E56000-memory.dmp

Download

memory/1188-1624-0x00007FF777A60000-0x00007FF777E56000-memory.dmp

Download

memory/1484-1653-0x00007FF74F5D0000-0x00007FF74F9C6000-memory.dmp

Download

memory/1484-304-0x00007FF74F5D0000-0x00007FF74F9C6000-memory.dmp

Download

memory/1596-1621-0x00007FF627810000-0x00007FF627C06000-memory.dmp

Download

memory/1596-254-0x00007FF627810000-0x00007FF627C06000-memory.dmp

Download

memory/1984-1597-0x00007FF61F3E0000-0x00007FF61F7D6000-memory.dmp

Download

memory/1984-88-0x00007FF61F3E0000-0x00007FF61F7D6000-memory.dmp

Download

memory/2108-1654-0x00007FF707E20000-0x00007FF708216000-memory.dmp

Download

memory/2108-303-0x00007FF707E20000-0x00007FF708216000-memory.dmp

Download

memory/2164-1604-0x00007FF71D190000-0x00007FF71D586000-memory.dmp

Download

memory/2164-75-0x00007FF71D190000-0x00007FF71D586000-memory.dmp

Download

memory/2212-1666-0x00007FF6BBA50000-0x00007FF6BBE46000-memory.dmp

Download

memory/2212-348-0x00007FF6BBA50000-0x00007FF6BBE46000-memory.dmp

Download

memory/2236-21-0x00007FFE6DE90000-0x00007FFE6E951000-memory.dmp

Download

memory/2236-431-0x00007FFE6DE90000-0x00007FFE6E951000-memory.dmp

Download

memory/2236-83-0x00007FFE6DE93000-0x00007FFE6DE95000-memory.dmp

Download

memory/2236-82-0x00007FFE6DE90000-0x00007FFE6E951000-memory.dmp

Download

memory/2236-19-0x00007FFE6DE90000-0x00007FFE6E951000-memory.dmp

Download

memory/2236-188-0x000002175BBD0000-0x000002175C376000-memory.dmp

Download

memory/2236-3-0x00007FFE6DE93000-0x00007FFE6DE95000-memory.dmp

Download

memory/2236-4-0x0000021740BB0000-0x0000021740BD2000-memory.dmp

Download

memory/2236-402-0x00007FFE6DE90000-0x00007FFE6E951000-memory.dmp

Download

memory/2620-58-0x00007FF71E5E0000-0x00007FF71E9D6000-memory.dmp

Download

memory/2620-1562-0x00007FF71E5E0000-0x00007FF71E9D6000-memory.dmp

Download

memory/3104-1637-0x00007FF6F2FB0000-0x00007FF6F33A6000-memory.dmp

Download

memory/3104-269-0x00007FF6F2FB0000-0x00007FF6F33A6000-memory.dmp

Download

memory/3508-410-0x00007FF7AD800000-0x00007FF7ADBF6000-memory.dmp

Download

memory/3508-1635-0x00007FF7AD800000-0x00007FF7ADBF6000-memory.dmp

Download

memory/3624-1643-0x00007FF6048C0000-0x00007FF604CB6000-memory.dmp

Download

memory/3624-288-0x00007FF6048C0000-0x00007FF604CB6000-memory.dmp

Download

memory/3772-259-0x00007FF739F70000-0x00007FF73A366000-memory.dmp

Download

memory/3772-1628-0x00007FF739F70000-0x00007FF73A366000-memory.dmp

Download

memory/3936-333-0x00007FF666C00000-0x00007FF666FF6000-memory.dmp

Download

memory/3936-1650-0x00007FF666C00000-0x00007FF666FF6000-memory.dmp

Download

memory/4064-1663-0x00007FF78ACD0000-0x00007FF78B0C6000-memory.dmp

Download

memory/4064-381-0x00007FF78ACD0000-0x00007FF78B0C6000-memory.dmp

Download

memory/4072-315-0x00007FF76DF20000-0x00007FF76E316000-memory.dmp

Download

memory/4072-1647-0x00007FF76DF20000-0x00007FF76E316000-memory.dmp

Download

memory/4280-35-0x00007FF6BD7C0000-0x00007FF6BDBB6000-memory.dmp

Download

memory/4280-1474-0x00007FF6BD7C0000-0x00007FF6BDBB6000-memory.dmp

Download

memory/4408-280-0x00007FF6E80C0000-0x00007FF6E84B6000-memory.dmp

Download

memory/4408-1636-0x00007FF6E80C0000-0x00007FF6E84B6000-memory.dmp

Download

memory/4604-387-0x00007FF63A090000-0x00007FF63A486000-memory.dmp

Download

memory/4604-1669-0x00007FF63A090000-0x00007FF63A486000-memory.dmp

Download

memory/4696-1519-0x00007FF67A840000-0x00007FF67AC36000-memory.dmp

Download

memory/4696-45-0x00007FF67A840000-0x00007FF67AC36000-memory.dmp

Download

memory/4752-0-0x00007FF696E30000-0x00007FF697226000-memory.dmp

Download

memory/4752-59-0x00007FF696E30000-0x00007FF697226000-memory.dmp

Download

memory/4752-1-0x00000246CA7D0000-0x00000246CA7E0000-memory.dmp

Download

memory/4992-1500-0x00007FF615320000-0x00007FF615716000-memory.dmp

Download

memory/4992-40-0x00007FF615320000-0x00007FF615716000-memory.dmp

Download

memory/5112-391-0x00007FF69A4E0000-0x00007FF69A8D6000-memory.dmp

Download

memory/5112-1632-0x00007FF69A4E0000-0x00007FF69A8D6000-memory.dmp

Download