xmrig | 5cefae8496ca71f45af7f36f6e641aeb3973ac24408559d6bb60449d6373beab

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 21:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
Size

1.6MB
MD5

3fe8705d37a980d8cea6a696b4cf0970
SHA1

907f69cd2d170cf367409a2c8a3ed108a174d1eb
SHA256

5cefae8496ca71f45af7f36f6e641aeb3973ac24408559d6bb60449d6373beab
SHA512

c557dfb0792ee516ba29ae02957cf8f01e80dcc8d237f86a8b2cd5bcec5649bda81874a3acfe0886e83d805e31da50c23e98d3a20f2bb8f1f0082306b5f30f43
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEX:Lz071uv4BPMkyW10/w16BvZXBCurmO

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/436-640-0x00007FF67A6C0000-0x00007FF67AAB2000-memory.dmp	xmrig
behavioral2/memory/4420-689-0x00007FF7A6B80000-0x00007FF7A6F72000-memory.dmp	xmrig
behavioral2/memory/3776-694-0x00007FF6E8E60000-0x00007FF6E9252000-memory.dmp	xmrig
behavioral2/memory/4228-697-0x00007FF787CC0000-0x00007FF7880B2000-memory.dmp	xmrig
behavioral2/memory/4760-700-0x00007FF6C7410000-0x00007FF6C7802000-memory.dmp	xmrig
behavioral2/memory/1432-699-0x00007FF69AD30000-0x00007FF69B122000-memory.dmp	xmrig
behavioral2/memory/860-698-0x00007FF6ACCC0000-0x00007FF6AD0B2000-memory.dmp	xmrig
behavioral2/memory/1044-696-0x00007FF724720000-0x00007FF724B12000-memory.dmp	xmrig
behavioral2/memory/4704-695-0x00007FF6C7960000-0x00007FF6C7D52000-memory.dmp	xmrig
behavioral2/memory/2336-693-0x00007FF7750B0000-0x00007FF7754A2000-memory.dmp	xmrig
behavioral2/memory/4592-692-0x00007FF77E470000-0x00007FF77E862000-memory.dmp	xmrig
behavioral2/memory/2536-691-0x00007FF7E4400000-0x00007FF7E47F2000-memory.dmp	xmrig
behavioral2/memory/4256-690-0x00007FF7A88D0000-0x00007FF7A8CC2000-memory.dmp	xmrig
behavioral2/memory/2356-688-0x00007FF715BC0000-0x00007FF715FB2000-memory.dmp	xmrig
behavioral2/memory/1456-687-0x00007FF795700000-0x00007FF795AF2000-memory.dmp	xmrig
behavioral2/memory/4180-685-0x00007FF633670000-0x00007FF633A62000-memory.dmp	xmrig
behavioral2/memory/4964-636-0x00007FF6BED90000-0x00007FF6BF182000-memory.dmp	xmrig
behavioral2/memory/4512-473-0x00007FF6AA520000-0x00007FF6AA912000-memory.dmp	xmrig
behavioral2/memory/2968-362-0x00007FF66BF30000-0x00007FF66C322000-memory.dmp	xmrig
behavioral2/memory/1040-302-0x00007FF6A5E80000-0x00007FF6A6272000-memory.dmp	xmrig
behavioral2/memory/1608-235-0x00007FF7B3700000-0x00007FF7B3AF2000-memory.dmp	xmrig
behavioral2/memory/1316-176-0x00007FF664B90000-0x00007FF664F82000-memory.dmp	xmrig
behavioral2/memory/4360-173-0x00007FF68C760000-0x00007FF68CB52000-memory.dmp	xmrig
behavioral2/memory/1948-56-0x00007FF6ED380000-0x00007FF6ED772000-memory.dmp	xmrig
behavioral2/memory/860-3607-0x00007FF6ACCC0000-0x00007FF6AD0B2000-memory.dmp	xmrig
behavioral2/memory/4360-3610-0x00007FF68C760000-0x00007FF68CB52000-memory.dmp	xmrig
behavioral2/memory/1948-3611-0x00007FF6ED380000-0x00007FF6ED772000-memory.dmp	xmrig
behavioral2/memory/1040-3613-0x00007FF6A5E80000-0x00007FF6A6272000-memory.dmp	xmrig
behavioral2/memory/2968-3616-0x00007FF66BF30000-0x00007FF66C322000-memory.dmp	xmrig
behavioral2/memory/1316-3617-0x00007FF664B90000-0x00007FF664F82000-memory.dmp	xmrig
behavioral2/memory/1608-3619-0x00007FF7B3700000-0x00007FF7B3AF2000-memory.dmp	xmrig
behavioral2/memory/1432-3621-0x00007FF69AD30000-0x00007FF69B122000-memory.dmp	xmrig
behavioral2/memory/4512-3625-0x00007FF6AA520000-0x00007FF6AA912000-memory.dmp	xmrig
behavioral2/memory/436-3623-0x00007FF67A6C0000-0x00007FF67AAB2000-memory.dmp	xmrig
behavioral2/memory/4256-3627-0x00007FF7A88D0000-0x00007FF7A8CC2000-memory.dmp	xmrig
behavioral2/memory/4760-3631-0x00007FF6C7410000-0x00007FF6C7802000-memory.dmp	xmrig
behavioral2/memory/4964-3629-0x00007FF6BED90000-0x00007FF6BF182000-memory.dmp	xmrig
behavioral2/memory/4420-3633-0x00007FF7A6B80000-0x00007FF7A6F72000-memory.dmp	xmrig
behavioral2/memory/4592-3635-0x00007FF77E470000-0x00007FF77E862000-memory.dmp	xmrig
behavioral2/memory/2356-3637-0x00007FF715BC0000-0x00007FF715FB2000-memory.dmp	xmrig
behavioral2/memory/4228-3639-0x00007FF787CC0000-0x00007FF7880B2000-memory.dmp	xmrig
behavioral2/memory/4180-3645-0x00007FF633670000-0x00007FF633A62000-memory.dmp	xmrig
behavioral2/memory/2336-3643-0x00007FF7750B0000-0x00007FF7754A2000-memory.dmp	xmrig
behavioral2/memory/1456-3647-0x00007FF795700000-0x00007FF795AF2000-memory.dmp	xmrig
behavioral2/memory/4704-3649-0x00007FF6C7960000-0x00007FF6C7D52000-memory.dmp	xmrig
behavioral2/memory/3776-3656-0x00007FF6E8E60000-0x00007FF6E9252000-memory.dmp	xmrig
behavioral2/memory/2536-3666-0x00007FF7E4400000-0x00007FF7E47F2000-memory.dmp	xmrig
behavioral2/memory/1044-3660-0x00007FF724720000-0x00007FF724B12000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4708	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
860	NdphFcf.exe
1948	xgAvRQE.exe
4360	WdQXNNQ.exe
1316	uwkwFEY.exe
1608	SwXdctl.exe
1040	aKqSdGD.exe
2968	DNSvnae.exe
4512	BDBNIWF.exe
4964	kFfuBHD.exe
436	LtzHhPv.exe
1432	tHrKygf.exe
4760	xZEjcYb.exe
4180	wZsZhpK.exe
1456	zKMqbwL.exe
2356	qyjwxLN.exe
4420	EHSYwaK.exe
4256	bVWjLTA.exe
2536	NJQGeKj.exe
4592	eyLWvnO.exe
2336	BOkFzyq.exe
3776	dluysCY.exe
4704	VbdFhHk.exe
1044	bsLmRio.exe
4228	dGEVtPI.exe
1600	NfVsmYE.exe
3420	nwqCazX.exe
4468	BkimbLS.exe
4120	xwSXYDt.exe
864	ZIvfKVq.exe
1084	ckAoCpL.exe
384	TRWESFt.exe
5112	TIcCpKc.exe
1940	pEfCnzK.exe
2068	CFrfDZH.exe
744	GZIgJrq.exe
4352	phHoCBY.exe
440	mZDbyLF.exe
1552	QwiKWSz.exe
1792	XgAhpJn.exe
3868	qeXwFzl.exe
2200	OjRxwcf.exe
1696	KLmAQvq.exe
3180	YaRMNtA.exe
4904	dfzFIQM.exe
2140	WzOdFoc.exe
1008	JqAsXei.exe
888	eYrQPXU.exe
2836	dNpVUin.exe
868	eHmkYhX.exe
2188	mkTTbFV.exe
976	qqoKFVO.exe
2580	oJdiTsx.exe
4800	QZpkuye.exe
3192	GvWHJUy.exe
4216	pvKirCx.exe
4068	ndQFuTh.exe
2388	oATAIWU.exe
4012	QBTBxsE.exe
4428	JLVZwNK.exe
4292	GmhYvxT.exe
4124	YAbdSwZ.exe
332	JQvzgXC.exe
4552	Vzdyzfm.exe
1748	cqkUinN.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4880-0-0x00007FF7EE400000-0x00007FF7EE7F2000-memory.dmp	upx
behavioral2/files/0x0006000000023298-6.dat	upx
behavioral2/files/0x0007000000023421-8.dat	upx
behavioral2/files/0x000800000002341d-15.dat	upx
behavioral2/files/0x0007000000023423-22.dat	upx
behavioral2/files/0x0007000000023426-47.dat	upx
behavioral2/files/0x000700000002342d-80.dat	upx
behavioral2/files/0x0007000000023441-163.dat	upx
behavioral2/memory/436-640-0x00007FF67A6C0000-0x00007FF67AAB2000-memory.dmp	upx
behavioral2/memory/4420-689-0x00007FF7A6B80000-0x00007FF7A6F72000-memory.dmp	upx
behavioral2/memory/3776-694-0x00007FF6E8E60000-0x00007FF6E9252000-memory.dmp	upx
behavioral2/memory/4228-697-0x00007FF787CC0000-0x00007FF7880B2000-memory.dmp	upx
behavioral2/memory/4760-700-0x00007FF6C7410000-0x00007FF6C7802000-memory.dmp	upx
behavioral2/memory/1432-699-0x00007FF69AD30000-0x00007FF69B122000-memory.dmp	upx
behavioral2/memory/860-698-0x00007FF6ACCC0000-0x00007FF6AD0B2000-memory.dmp	upx
behavioral2/memory/1044-696-0x00007FF724720000-0x00007FF724B12000-memory.dmp	upx
behavioral2/memory/4704-695-0x00007FF6C7960000-0x00007FF6C7D52000-memory.dmp	upx
behavioral2/memory/2336-693-0x00007FF7750B0000-0x00007FF7754A2000-memory.dmp	upx
behavioral2/memory/4592-692-0x00007FF77E470000-0x00007FF77E862000-memory.dmp	upx
behavioral2/memory/2536-691-0x00007FF7E4400000-0x00007FF7E47F2000-memory.dmp	upx
behavioral2/memory/4256-690-0x00007FF7A88D0000-0x00007FF7A8CC2000-memory.dmp	upx
behavioral2/memory/2356-688-0x00007FF715BC0000-0x00007FF715FB2000-memory.dmp	upx
behavioral2/memory/1456-687-0x00007FF795700000-0x00007FF795AF2000-memory.dmp	upx
behavioral2/memory/4180-685-0x00007FF633670000-0x00007FF633A62000-memory.dmp	upx
behavioral2/memory/4964-636-0x00007FF6BED90000-0x00007FF6BF182000-memory.dmp	upx
behavioral2/memory/4512-473-0x00007FF6AA520000-0x00007FF6AA912000-memory.dmp	upx
behavioral2/memory/2968-362-0x00007FF66BF30000-0x00007FF66C322000-memory.dmp	upx
behavioral2/memory/1040-302-0x00007FF6A5E80000-0x00007FF6A6272000-memory.dmp	upx
behavioral2/memory/1608-235-0x00007FF7B3700000-0x00007FF7B3AF2000-memory.dmp	upx
behavioral2/files/0x0007000000023440-209.dat	upx
behavioral2/files/0x000700000002343e-194.dat	upx
behavioral2/files/0x0007000000023447-191.dat	upx
behavioral2/files/0x000700000002343d-183.dat	upx
behavioral2/files/0x0007000000023446-181.dat	upx
behavioral2/files/0x0007000000023430-177.dat	upx
behavioral2/memory/1316-176-0x00007FF664B90000-0x00007FF664F82000-memory.dmp	upx
behavioral2/memory/4360-173-0x00007FF68C760000-0x00007FF68CB52000-memory.dmp	upx
behavioral2/files/0x0007000000023445-172.dat	upx
behavioral2/files/0x0007000000023444-171.dat	upx
behavioral2/files/0x000700000002343a-169.dat	upx
behavioral2/files/0x0008000000023438-168.dat	upx
behavioral2/files/0x0007000000023434-165.dat	upx
behavioral2/files/0x0007000000023442-164.dat	upx
behavioral2/files/0x000700000002342c-156.dat	upx
behavioral2/files/0x0007000000023433-203.dat	upx
behavioral2/files/0x000700000002343f-155.dat	upx
behavioral2/files/0x0007000000023432-187.dat	upx
behavioral2/files/0x0007000000023431-147.dat	upx
behavioral2/files/0x000700000002343c-146.dat	upx
behavioral2/files/0x000700000002342a-135.dat	upx
behavioral2/files/0x0007000000023439-132.dat	upx
behavioral2/files/0x0007000000023435-129.dat	upx
behavioral2/files/0x0007000000023443-167.dat	upx
behavioral2/files/0x0007000000023436-166.dat	upx
behavioral2/files/0x000700000002342e-159.dat	upx
behavioral2/files/0x000700000002342b-120.dat	upx
behavioral2/files/0x0007000000023427-107.dat	upx
behavioral2/files/0x000700000002343b-145.dat	upx
behavioral2/files/0x000700000002342f-104.dat	upx
behavioral2/files/0x0007000000023428-70.dat	upx
behavioral2/files/0x0007000000023429-63.dat	upx
behavioral2/memory/1948-56-0x00007FF6ED380000-0x00007FF6ED772000-memory.dmp	upx
behavioral2/files/0x0007000000023425-34.dat	upx
behavioral2/files/0x0007000000023424-31.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CQmztVp.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\zdtsKQX.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\GVMsPxw.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\IRRUBQx.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\TwMrIKK.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\WuBjOLD.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\sOgIQuF.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\PtpMQnp.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\TwHUGdT.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\JySsreT.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\UDwrsGd.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\cxlSnnG.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\LxvrQLb.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\pmyJYdn.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\cLokJhK.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\IyVcBFL.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\OAEhXLv.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\zRSXfoL.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\WuvfMSs.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\eSJRtOv.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\uzSgnpX.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\TofyMSK.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\kQomjPW.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\WzSFhpP.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\KetzrMx.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\HmXKAyw.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\MkeWUaW.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\BJCCGTq.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\QMLBbUK.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\NdphFcf.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\fkugriU.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\TZziTgO.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\EHSYwaK.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\IAKJuRH.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\YaZsnXH.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\mekkrxg.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\RNufWFO.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\jDhtwBM.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\oYxXvwl.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\eZSVNAW.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\LSyEGhu.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\msOzWpi.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\vYHIDtT.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\HMshZBM.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\XccdBRm.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\iFzAXHJ.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\aDyzAjB.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\oTmJGyl.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\eqPusgU.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\dtvTVsL.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\kkyiXMy.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\FFcYjmk.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\buUMpUB.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\OnNrfyl.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\MLDGpEO.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\vQyNYQt.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\YdKTllQ.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\XyHgQSH.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\OhAjUOO.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\VsDqpmg.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\vrCiNMI.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\fvVTXnj.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\OooZdIe.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
File created	C:\Windows\System\jDxRsUH.exe	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
Token: SeDebugPrivilege	4708	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 4708	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	84
PID 4880 wrote to memory of 4708	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	84
PID 4880 wrote to memory of 860	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	85
PID 4880 wrote to memory of 860	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	85
PID 4880 wrote to memory of 1948	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	86
PID 4880 wrote to memory of 1948	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	86
PID 4880 wrote to memory of 4360	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	87
PID 4880 wrote to memory of 4360	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	87
PID 4880 wrote to memory of 1316	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	88
PID 4880 wrote to memory of 1316	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	88
PID 4880 wrote to memory of 1608	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	89
PID 4880 wrote to memory of 1608	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	89
PID 4880 wrote to memory of 1040	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	90
PID 4880 wrote to memory of 1040	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	90
PID 4880 wrote to memory of 2968	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	91
PID 4880 wrote to memory of 2968	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	91
PID 4880 wrote to memory of 4512	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	92
PID 4880 wrote to memory of 4512	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	92
PID 4880 wrote to memory of 4964	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	93
PID 4880 wrote to memory of 4964	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	93
PID 4880 wrote to memory of 436	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	94
PID 4880 wrote to memory of 436	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	94
PID 4880 wrote to memory of 1432	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	95
PID 4880 wrote to memory of 1432	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	95
PID 4880 wrote to memory of 4420	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	96
PID 4880 wrote to memory of 4420	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	96
PID 4880 wrote to memory of 4760	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	97
PID 4880 wrote to memory of 4760	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	97
PID 4880 wrote to memory of 4180	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	98
PID 4880 wrote to memory of 4180	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	98
PID 4880 wrote to memory of 1456	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	99
PID 4880 wrote to memory of 1456	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	99
PID 4880 wrote to memory of 2356	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	100
PID 4880 wrote to memory of 2356	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	100
PID 4880 wrote to memory of 4256	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	101
PID 4880 wrote to memory of 4256	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	101
PID 4880 wrote to memory of 2536	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	102
PID 4880 wrote to memory of 2536	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	102
PID 4880 wrote to memory of 4592	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	103
PID 4880 wrote to memory of 4592	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	103
PID 4880 wrote to memory of 2336	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	104
PID 4880 wrote to memory of 2336	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	104
PID 4880 wrote to memory of 3776	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	105
PID 4880 wrote to memory of 3776	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	105
PID 4880 wrote to memory of 5112	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	106
PID 4880 wrote to memory of 5112	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	106
PID 4880 wrote to memory of 4704	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	107
PID 4880 wrote to memory of 4704	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	107
PID 4880 wrote to memory of 1940	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	108
PID 4880 wrote to memory of 1940	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	108
PID 4880 wrote to memory of 1044	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	109
PID 4880 wrote to memory of 1044	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	109
PID 4880 wrote to memory of 4228	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	110
PID 4880 wrote to memory of 4228	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	110
PID 4880 wrote to memory of 1600	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	111
PID 4880 wrote to memory of 1600	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	111
PID 4880 wrote to memory of 3420	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	112
PID 4880 wrote to memory of 3420	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	112
PID 4880 wrote to memory of 4468	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	113
PID 4880 wrote to memory of 4468	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	113
PID 4880 wrote to memory of 4120	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	114
PID 4880 wrote to memory of 4120	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	114
PID 4880 wrote to memory of 864	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	115
PID 4880 wrote to memory of 864	4880	3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3fe8705d37a980d8cea6a696b4cf0970_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\System\NdphFcf.exe
  C:\Windows\System\NdphFcf.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\xgAvRQE.exe
  C:\Windows\System\xgAvRQE.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\WdQXNNQ.exe
  C:\Windows\System\WdQXNNQ.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\uwkwFEY.exe
  C:\Windows\System\uwkwFEY.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\SwXdctl.exe
  C:\Windows\System\SwXdctl.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\aKqSdGD.exe
  C:\Windows\System\aKqSdGD.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\DNSvnae.exe
  C:\Windows\System\DNSvnae.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\BDBNIWF.exe
  C:\Windows\System\BDBNIWF.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\kFfuBHD.exe
  C:\Windows\System\kFfuBHD.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\LtzHhPv.exe
  C:\Windows\System\LtzHhPv.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\tHrKygf.exe
  C:\Windows\System\tHrKygf.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\EHSYwaK.exe
  C:\Windows\System\EHSYwaK.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\xZEjcYb.exe
  C:\Windows\System\xZEjcYb.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\wZsZhpK.exe
  C:\Windows\System\wZsZhpK.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\zKMqbwL.exe
  C:\Windows\System\zKMqbwL.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\qyjwxLN.exe
  C:\Windows\System\qyjwxLN.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\bVWjLTA.exe
  C:\Windows\System\bVWjLTA.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\NJQGeKj.exe
  C:\Windows\System\NJQGeKj.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\eyLWvnO.exe
  C:\Windows\System\eyLWvnO.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\BOkFzyq.exe
  C:\Windows\System\BOkFzyq.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\dluysCY.exe
  C:\Windows\System\dluysCY.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\TIcCpKc.exe
  C:\Windows\System\TIcCpKc.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\VbdFhHk.exe
  C:\Windows\System\VbdFhHk.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\pEfCnzK.exe
  C:\Windows\System\pEfCnzK.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\bsLmRio.exe
  C:\Windows\System\bsLmRio.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\dGEVtPI.exe
  C:\Windows\System\dGEVtPI.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\NfVsmYE.exe
  C:\Windows\System\NfVsmYE.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\nwqCazX.exe
  C:\Windows\System\nwqCazX.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\BkimbLS.exe
  C:\Windows\System\BkimbLS.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\xwSXYDt.exe
  C:\Windows\System\xwSXYDt.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\ZIvfKVq.exe
  C:\Windows\System\ZIvfKVq.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\qeXwFzl.exe
  C:\Windows\System\qeXwFzl.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\ckAoCpL.exe
  C:\Windows\System\ckAoCpL.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\TRWESFt.exe
  C:\Windows\System\TRWESFt.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\CFrfDZH.exe
  C:\Windows\System\CFrfDZH.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\GZIgJrq.exe
  C:\Windows\System\GZIgJrq.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\phHoCBY.exe
  C:\Windows\System\phHoCBY.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\mZDbyLF.exe
  C:\Windows\System\mZDbyLF.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\QwiKWSz.exe
  C:\Windows\System\QwiKWSz.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\XgAhpJn.exe
  C:\Windows\System\XgAhpJn.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\qqoKFVO.exe
  C:\Windows\System\qqoKFVO.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\OjRxwcf.exe
  C:\Windows\System\OjRxwcf.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\KLmAQvq.exe
  C:\Windows\System\KLmAQvq.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\YaRMNtA.exe
  C:\Windows\System\YaRMNtA.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\dfzFIQM.exe
  C:\Windows\System\dfzFIQM.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\WzOdFoc.exe
  C:\Windows\System\WzOdFoc.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\JqAsXei.exe
  C:\Windows\System\JqAsXei.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\eYrQPXU.exe
  C:\Windows\System\eYrQPXU.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\dNpVUin.exe
  C:\Windows\System\dNpVUin.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\eHmkYhX.exe
  C:\Windows\System\eHmkYhX.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\mkTTbFV.exe
  C:\Windows\System\mkTTbFV.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\oJdiTsx.exe
  C:\Windows\System\oJdiTsx.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\QZpkuye.exe
  C:\Windows\System\QZpkuye.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\ahhyKEi.exe
  C:\Windows\System\ahhyKEi.exe
  2⤵
  PID:3544
- C:\Windows\System\pXWOMPC.exe
  C:\Windows\System\pXWOMPC.exe
  2⤵
  PID:1772
- C:\Windows\System\GvWHJUy.exe
  C:\Windows\System\GvWHJUy.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\pvKirCx.exe
  C:\Windows\System\pvKirCx.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\ndQFuTh.exe
  C:\Windows\System\ndQFuTh.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\oATAIWU.exe
  C:\Windows\System\oATAIWU.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\QBTBxsE.exe
  C:\Windows\System\QBTBxsE.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\JLVZwNK.exe
  C:\Windows\System\JLVZwNK.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\GmhYvxT.exe
  C:\Windows\System\GmhYvxT.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\YAbdSwZ.exe
  C:\Windows\System\YAbdSwZ.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\JQvzgXC.exe
  C:\Windows\System\JQvzgXC.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\Vzdyzfm.exe
  C:\Windows\System\Vzdyzfm.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\cqkUinN.exe
  C:\Windows\System\cqkUinN.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\SATtcls.exe
  C:\Windows\System\SATtcls.exe
  2⤵
  PID:3444
- C:\Windows\System\SCCotuo.exe
  C:\Windows\System\SCCotuo.exe
  2⤵
  PID:1128
- C:\Windows\System\sxOlNVt.exe
  C:\Windows\System\sxOlNVt.exe
  2⤵
  PID:4588
- C:\Windows\System\wPpjXcl.exe
  C:\Windows\System\wPpjXcl.exe
  2⤵
  PID:1372
- C:\Windows\System\WSSXZBM.exe
  C:\Windows\System\WSSXZBM.exe
  2⤵
  PID:2372
- C:\Windows\System\TsZvvem.exe
  C:\Windows\System\TsZvvem.exe
  2⤵
  PID:4472
- C:\Windows\System\KQzfuMu.exe
  C:\Windows\System\KQzfuMu.exe
  2⤵
  PID:3784
- C:\Windows\System\DtAXuUv.exe
  C:\Windows\System\DtAXuUv.exe
  2⤵
  PID:1640
- C:\Windows\System\mhhosuH.exe
  C:\Windows\System\mhhosuH.exe
  2⤵
  PID:736
- C:\Windows\System\FjtGxHi.exe
  C:\Windows\System\FjtGxHi.exe
  2⤵
  PID:5000
- C:\Windows\System\QJunLOx.exe
  C:\Windows\System\QJunLOx.exe
  2⤵
  PID:3808
- C:\Windows\System\nenBlXn.exe
  C:\Windows\System\nenBlXn.exe
  2⤵
  PID:4556
- C:\Windows\System\RrXMZHA.exe
  C:\Windows\System\RrXMZHA.exe
  2⤵
  PID:3940
- C:\Windows\System\zcUgRpb.exe
  C:\Windows\System\zcUgRpb.exe
  2⤵
  PID:2436
- C:\Windows\System\uTsQqfA.exe
  C:\Windows\System\uTsQqfA.exe
  2⤵
  PID:4476
- C:\Windows\System\NUxHTDT.exe
  C:\Windows\System\NUxHTDT.exe
  2⤵
  PID:4412
- C:\Windows\System\ZohycyB.exe
  C:\Windows\System\ZohycyB.exe
  2⤵
  PID:1944
- C:\Windows\System\uGPjdHC.exe
  C:\Windows\System\uGPjdHC.exe
  2⤵
  PID:4460
- C:\Windows\System\UqJpcfr.exe
  C:\Windows\System\UqJpcfr.exe
  2⤵
  PID:972
- C:\Windows\System\sSKuxEb.exe
  C:\Windows\System\sSKuxEb.exe
  2⤵
  PID:5128
- C:\Windows\System\oGpRtUQ.exe
  C:\Windows\System\oGpRtUQ.exe
  2⤵
  PID:5148
- C:\Windows\System\ryhjFVq.exe
  C:\Windows\System\ryhjFVq.exe
  2⤵
  PID:5172
- C:\Windows\System\EczIcpa.exe
  C:\Windows\System\EczIcpa.exe
  2⤵
  PID:5196
- C:\Windows\System\wsjuGKs.exe
  C:\Windows\System\wsjuGKs.exe
  2⤵
  PID:5216
- C:\Windows\System\IXGcZmp.exe
  C:\Windows\System\IXGcZmp.exe
  2⤵
  PID:5232
- C:\Windows\System\nCsxlyy.exe
  C:\Windows\System\nCsxlyy.exe
  2⤵
  PID:5252
- C:\Windows\System\WMmelmT.exe
  C:\Windows\System\WMmelmT.exe
  2⤵
  PID:5272
- C:\Windows\System\LnVfGfk.exe
  C:\Windows\System\LnVfGfk.exe
  2⤵
  PID:5288
- C:\Windows\System\txdBCgI.exe
  C:\Windows\System\txdBCgI.exe
  2⤵
  PID:5312
- C:\Windows\System\zcVjsCF.exe
  C:\Windows\System\zcVjsCF.exe
  2⤵
  PID:5328
- C:\Windows\System\TRryhEW.exe
  C:\Windows\System\TRryhEW.exe
  2⤵
  PID:5352
- C:\Windows\System\prLjQKr.exe
  C:\Windows\System\prLjQKr.exe
  2⤵
  PID:5368
- C:\Windows\System\uIXHAGB.exe
  C:\Windows\System\uIXHAGB.exe
  2⤵
  PID:5392
- C:\Windows\System\FiWStlm.exe
  C:\Windows\System\FiWStlm.exe
  2⤵
  PID:5420
- C:\Windows\System\HRhoJAv.exe
  C:\Windows\System\HRhoJAv.exe
  2⤵
  PID:5440
- C:\Windows\System\slhllFY.exe
  C:\Windows\System\slhllFY.exe
  2⤵
  PID:5456
- C:\Windows\System\ADHBrTQ.exe
  C:\Windows\System\ADHBrTQ.exe
  2⤵
  PID:5476
- C:\Windows\System\FlZFxmh.exe
  C:\Windows\System\FlZFxmh.exe
  2⤵
  PID:5492
- C:\Windows\System\cWmPQbc.exe
  C:\Windows\System\cWmPQbc.exe
  2⤵
  PID:5564
- C:\Windows\System\dYEljUf.exe
  C:\Windows\System\dYEljUf.exe
  2⤵
  PID:5588
- C:\Windows\System\tSUPOFV.exe
  C:\Windows\System\tSUPOFV.exe
  2⤵
  PID:5612
- C:\Windows\System\mLFqVcv.exe
  C:\Windows\System\mLFqVcv.exe
  2⤵
  PID:5628
- C:\Windows\System\cOqvgjk.exe
  C:\Windows\System\cOqvgjk.exe
  2⤵
  PID:5648
- C:\Windows\System\mFuIPIw.exe
  C:\Windows\System\mFuIPIw.exe
  2⤵
  PID:5664
- C:\Windows\System\aReEOVH.exe
  C:\Windows\System\aReEOVH.exe
  2⤵
  PID:5688
- C:\Windows\System\NonAmgO.exe
  C:\Windows\System\NonAmgO.exe
  2⤵
  PID:5712
- C:\Windows\System\TCyvDWQ.exe
  C:\Windows\System\TCyvDWQ.exe
  2⤵
  PID:5732
- C:\Windows\System\heUUlbo.exe
  C:\Windows\System\heUUlbo.exe
  2⤵
  PID:5748
- C:\Windows\System\xayFGRZ.exe
  C:\Windows\System\xayFGRZ.exe
  2⤵
  PID:5768
- C:\Windows\System\vgoNmBB.exe
  C:\Windows\System\vgoNmBB.exe
  2⤵
  PID:5792
- C:\Windows\System\xFXjtNE.exe
  C:\Windows\System\xFXjtNE.exe
  2⤵
  PID:5816
- C:\Windows\System\SdOjWvO.exe
  C:\Windows\System\SdOjWvO.exe
  2⤵
  PID:5832
- C:\Windows\System\pPHdniJ.exe
  C:\Windows\System\pPHdniJ.exe
  2⤵
  PID:5864
- C:\Windows\System\ZNgvIHt.exe
  C:\Windows\System\ZNgvIHt.exe
  2⤵
  PID:5880
- C:\Windows\System\fMkXoaK.exe
  C:\Windows\System\fMkXoaK.exe
  2⤵
  PID:5908
- C:\Windows\System\MZNaiFy.exe
  C:\Windows\System\MZNaiFy.exe
  2⤵
  PID:5924
- C:\Windows\System\RyGXCCF.exe
  C:\Windows\System\RyGXCCF.exe
  2⤵
  PID:5944
- C:\Windows\System\ZjjDvdx.exe
  C:\Windows\System\ZjjDvdx.exe
  2⤵
  PID:5968
- C:\Windows\System\OnNrfyl.exe
  C:\Windows\System\OnNrfyl.exe
  2⤵
  PID:5984
- C:\Windows\System\BiywDXx.exe
  C:\Windows\System\BiywDXx.exe
  2⤵
  PID:6008
- C:\Windows\System\QwUQaMD.exe
  C:\Windows\System\QwUQaMD.exe
  2⤵
  PID:6024
- C:\Windows\System\MLDGpEO.exe
  C:\Windows\System\MLDGpEO.exe
  2⤵
  PID:6048
- C:\Windows\System\LKHpCua.exe
  C:\Windows\System\LKHpCua.exe
  2⤵
  PID:6064
- C:\Windows\System\awZektk.exe
  C:\Windows\System\awZektk.exe
  2⤵
  PID:6092
- C:\Windows\System\CjffCDo.exe
  C:\Windows\System\CjffCDo.exe
  2⤵
  PID:6116
- C:\Windows\System\wFHCVEF.exe
  C:\Windows\System\wFHCVEF.exe
  2⤵
  PID:6140
- C:\Windows\System\MrjycHg.exe
  C:\Windows\System\MrjycHg.exe
  2⤵
  PID:1732
- C:\Windows\System\xDLWiCM.exe
  C:\Windows\System\xDLWiCM.exe
  2⤵
  PID:4744
- C:\Windows\System\TiRBPIP.exe
  C:\Windows\System\TiRBPIP.exe
  2⤵
  PID:396
- C:\Windows\System\sxvpAlu.exe
  C:\Windows\System\sxvpAlu.exe
  2⤵
  PID:3576
- C:\Windows\System\RcbPqAH.exe
  C:\Windows\System\RcbPqAH.exe
  2⤵
  PID:2224
- C:\Windows\System\wYqbsHi.exe
  C:\Windows\System\wYqbsHi.exe
  2⤵
  PID:1368
- C:\Windows\System\EHNnFDi.exe
  C:\Windows\System\EHNnFDi.exe
  2⤵
  PID:3508
- C:\Windows\System\zRSXfoL.exe
  C:\Windows\System\zRSXfoL.exe
  2⤵
  PID:2744
- C:\Windows\System\MkeWUaW.exe
  C:\Windows\System\MkeWUaW.exe
  2⤵
  PID:6156
- C:\Windows\System\YtJzFlW.exe
  C:\Windows\System\YtJzFlW.exe
  2⤵
  PID:6180
- C:\Windows\System\pttEolJ.exe
  C:\Windows\System\pttEolJ.exe
  2⤵
  PID:6196
- C:\Windows\System\RNbczoo.exe
  C:\Windows\System\RNbczoo.exe
  2⤵
  PID:6220
- C:\Windows\System\DvVneHi.exe
  C:\Windows\System\DvVneHi.exe
  2⤵
  PID:6244
- C:\Windows\System\ULIBdii.exe
  C:\Windows\System\ULIBdii.exe
  2⤵
  PID:6260
- C:\Windows\System\cxlSnnG.exe
  C:\Windows\System\cxlSnnG.exe
  2⤵
  PID:6292
- C:\Windows\System\MkgXUQm.exe
  C:\Windows\System\MkgXUQm.exe
  2⤵
  PID:6308
- C:\Windows\System\LIWZdFx.exe
  C:\Windows\System\LIWZdFx.exe
  2⤵
  PID:6324
- C:\Windows\System\rODBsbL.exe
  C:\Windows\System\rODBsbL.exe
  2⤵
  PID:6348
- C:\Windows\System\pzzkqRK.exe
  C:\Windows\System\pzzkqRK.exe
  2⤵
  PID:6368
- C:\Windows\System\CMbOSxC.exe
  C:\Windows\System\CMbOSxC.exe
  2⤵
  PID:6392
- C:\Windows\System\PGKobat.exe
  C:\Windows\System\PGKobat.exe
  2⤵
  PID:6412
- C:\Windows\System\TZToYPU.exe
  C:\Windows\System\TZToYPU.exe
  2⤵
  PID:6436
- C:\Windows\System\IacjacU.exe
  C:\Windows\System\IacjacU.exe
  2⤵
  PID:6452
- C:\Windows\System\pBlidVh.exe
  C:\Windows\System\pBlidVh.exe
  2⤵
  PID:6472
- C:\Windows\System\LQjqevs.exe
  C:\Windows\System\LQjqevs.exe
  2⤵
  PID:6488
- C:\Windows\System\wzrTsiN.exe
  C:\Windows\System\wzrTsiN.exe
  2⤵
  PID:6504
- C:\Windows\System\oHKZGLD.exe
  C:\Windows\System\oHKZGLD.exe
  2⤵
  PID:6524
- C:\Windows\System\AdpDgpd.exe
  C:\Windows\System\AdpDgpd.exe
  2⤵
  PID:6540
- C:\Windows\System\ZHpbzvT.exe
  C:\Windows\System\ZHpbzvT.exe
  2⤵
  PID:6564
- C:\Windows\System\klwbXYk.exe
  C:\Windows\System\klwbXYk.exe
  2⤵
  PID:6580
- C:\Windows\System\aSHHGcz.exe
  C:\Windows\System\aSHHGcz.exe
  2⤵
  PID:6604
- C:\Windows\System\eQedYHA.exe
  C:\Windows\System\eQedYHA.exe
  2⤵
  PID:6620
- C:\Windows\System\kgwZbpC.exe
  C:\Windows\System\kgwZbpC.exe
  2⤵
  PID:6644
- C:\Windows\System\IjbtbWj.exe
  C:\Windows\System\IjbtbWj.exe
  2⤵
  PID:6664
- C:\Windows\System\jnjmLoO.exe
  C:\Windows\System\jnjmLoO.exe
  2⤵
  PID:6680
- C:\Windows\System\umTGDSf.exe
  C:\Windows\System\umTGDSf.exe
  2⤵
  PID:6708
- C:\Windows\System\QzzGaJv.exe
  C:\Windows\System\QzzGaJv.exe
  2⤵
  PID:6724
- C:\Windows\System\EpQKseh.exe
  C:\Windows\System\EpQKseh.exe
  2⤵
  PID:6752
- C:\Windows\System\ZiSKZkw.exe
  C:\Windows\System\ZiSKZkw.exe
  2⤵
  PID:6784
- C:\Windows\System\FlsOsCi.exe
  C:\Windows\System\FlsOsCi.exe
  2⤵
  PID:6804
- C:\Windows\System\cBWZuoD.exe
  C:\Windows\System\cBWZuoD.exe
  2⤵
  PID:6824
- C:\Windows\System\QRqqljN.exe
  C:\Windows\System\QRqqljN.exe
  2⤵
  PID:6848
- C:\Windows\System\FOsJFXO.exe
  C:\Windows\System\FOsJFXO.exe
  2⤵
  PID:6876
- C:\Windows\System\ljxNzmf.exe
  C:\Windows\System\ljxNzmf.exe
  2⤵
  PID:6892
- C:\Windows\System\alfbjNq.exe
  C:\Windows\System\alfbjNq.exe
  2⤵
  PID:6916
- C:\Windows\System\Ndbctvh.exe
  C:\Windows\System\Ndbctvh.exe
  2⤵
  PID:6936
- C:\Windows\System\ULasKvI.exe
  C:\Windows\System\ULasKvI.exe
  2⤵
  PID:6956
- C:\Windows\System\FhNaBaC.exe
  C:\Windows\System\FhNaBaC.exe
  2⤵
  PID:6976
- C:\Windows\System\bErHFSm.exe
  C:\Windows\System\bErHFSm.exe
  2⤵
  PID:7004
- C:\Windows\System\cgXTpJn.exe
  C:\Windows\System\cgXTpJn.exe
  2⤵
  PID:7020
- C:\Windows\System\HMXftdR.exe
  C:\Windows\System\HMXftdR.exe
  2⤵
  PID:7056
- C:\Windows\System\PHHYOPq.exe
  C:\Windows\System\PHHYOPq.exe
  2⤵
  PID:7072
- C:\Windows\System\HqdvBWP.exe
  C:\Windows\System\HqdvBWP.exe
  2⤵
  PID:7096
- C:\Windows\System\tIQwoxV.exe
  C:\Windows\System\tIQwoxV.exe
  2⤵
  PID:7112
- C:\Windows\System\zfnPiIg.exe
  C:\Windows\System\zfnPiIg.exe
  2⤵
  PID:7144
- C:\Windows\System\QLeAgKr.exe
  C:\Windows\System\QLeAgKr.exe
  2⤵
  PID:7160
- C:\Windows\System\jPLlJsQ.exe
  C:\Windows\System\jPLlJsQ.exe
  2⤵
  PID:4432
- C:\Windows\System\LbNLjdQ.exe
  C:\Windows\System\LbNLjdQ.exe
  2⤵
  PID:4288
- C:\Windows\System\BmtBaPX.exe
  C:\Windows\System\BmtBaPX.exe
  2⤵
  PID:3876
- C:\Windows\System\gKVulam.exe
  C:\Windows\System\gKVulam.exe
  2⤵
  PID:5228
- C:\Windows\System\Qnljtgg.exe
  C:\Windows\System\Qnljtgg.exe
  2⤵
  PID:5760
- C:\Windows\System\VyUQpQL.exe
  C:\Windows\System\VyUQpQL.exe
  2⤵
  PID:5824
- C:\Windows\System\KRIKpuP.exe
  C:\Windows\System\KRIKpuP.exe
  2⤵
  PID:5888
- C:\Windows\System\gHjXUer.exe
  C:\Windows\System\gHjXUer.exe
  2⤵
  PID:4816
- C:\Windows\System\zUdvZmi.exe
  C:\Windows\System\zUdvZmi.exe
  2⤵
  PID:1176
- C:\Windows\System\szYvdns.exe
  C:\Windows\System\szYvdns.exe
  2⤵
  PID:3240
- C:\Windows\System\iybNefk.exe
  C:\Windows\System\iybNefk.exe
  2⤵
  PID:5468
- C:\Windows\System\eFpEzdp.exe
  C:\Windows\System\eFpEzdp.exe
  2⤵
  PID:3468
- C:\Windows\System\GylVnzh.exe
  C:\Windows\System\GylVnzh.exe
  2⤵
  PID:7172
- C:\Windows\System\ljBoozM.exe
  C:\Windows\System\ljBoozM.exe
  2⤵
  PID:7196
- C:\Windows\System\mECuQBE.exe
  C:\Windows\System\mECuQBE.exe
  2⤵
  PID:7212
- C:\Windows\System\UkbuhYp.exe
  C:\Windows\System\UkbuhYp.exe
  2⤵
  PID:7236
- C:\Windows\System\oijzLfu.exe
  C:\Windows\System\oijzLfu.exe
  2⤵
  PID:7264
- C:\Windows\System\aurRlSl.exe
  C:\Windows\System\aurRlSl.exe
  2⤵
  PID:7280
- C:\Windows\System\UFefXbE.exe
  C:\Windows\System\UFefXbE.exe
  2⤵
  PID:7300
- C:\Windows\System\ueUpbRN.exe
  C:\Windows\System\ueUpbRN.exe
  2⤵
  PID:7316
- C:\Windows\System\uQREKCc.exe
  C:\Windows\System\uQREKCc.exe
  2⤵
  PID:7340
- C:\Windows\System\wZszdCh.exe
  C:\Windows\System\wZszdCh.exe
  2⤵
  PID:7364
- C:\Windows\System\rnFnNaj.exe
  C:\Windows\System\rnFnNaj.exe
  2⤵
  PID:7380
- C:\Windows\System\FjNGrJk.exe
  C:\Windows\System\FjNGrJk.exe
  2⤵
  PID:7456
- C:\Windows\System\XccdBRm.exe
  C:\Windows\System\XccdBRm.exe
  2⤵
  PID:7476
- C:\Windows\System\tXTGkZF.exe
  C:\Windows\System\tXTGkZF.exe
  2⤵
  PID:7500
- C:\Windows\System\DxtVuKV.exe
  C:\Windows\System\DxtVuKV.exe
  2⤵
  PID:7516
- C:\Windows\System\dJvdgmJ.exe
  C:\Windows\System\dJvdgmJ.exe
  2⤵
  PID:7540
- C:\Windows\System\odNrCgd.exe
  C:\Windows\System\odNrCgd.exe
  2⤵
  PID:7560
- C:\Windows\System\WKIeRmf.exe
  C:\Windows\System\WKIeRmf.exe
  2⤵
  PID:7580
- C:\Windows\System\kVoMetv.exe
  C:\Windows\System\kVoMetv.exe
  2⤵
  PID:7596
- C:\Windows\System\hKCOxvy.exe
  C:\Windows\System\hKCOxvy.exe
  2⤵
  PID:7616
- C:\Windows\System\AUVWAWY.exe
  C:\Windows\System\AUVWAWY.exe
  2⤵
  PID:7632
- C:\Windows\System\CpoEyCX.exe
  C:\Windows\System\CpoEyCX.exe
  2⤵
  PID:7656
- C:\Windows\System\tTCwyeb.exe
  C:\Windows\System\tTCwyeb.exe
  2⤵
  PID:7672
- C:\Windows\System\yGdnHfE.exe
  C:\Windows\System\yGdnHfE.exe
  2⤵
  PID:7692
- C:\Windows\System\krGiaVZ.exe
  C:\Windows\System\krGiaVZ.exe
  2⤵
  PID:7708
- C:\Windows\System\KXLYNQY.exe
  C:\Windows\System\KXLYNQY.exe
  2⤵
  PID:7728
- C:\Windows\System\yZlYjwL.exe
  C:\Windows\System\yZlYjwL.exe
  2⤵
  PID:7760
- C:\Windows\System\ZYywIpr.exe
  C:\Windows\System\ZYywIpr.exe
  2⤵
  PID:7780
- C:\Windows\System\FOcXXTE.exe
  C:\Windows\System\FOcXXTE.exe
  2⤵
  PID:7800
- C:\Windows\System\arQgyrQ.exe
  C:\Windows\System\arQgyrQ.exe
  2⤵
  PID:7820
- C:\Windows\System\TcjiMtt.exe
  C:\Windows\System\TcjiMtt.exe
  2⤵
  PID:7844
- C:\Windows\System\EuVbfzA.exe
  C:\Windows\System\EuVbfzA.exe
  2⤵
  PID:7860
- C:\Windows\System\fevARWH.exe
  C:\Windows\System\fevARWH.exe
  2⤵
  PID:7884
- C:\Windows\System\DCyzElf.exe
  C:\Windows\System\DCyzElf.exe
  2⤵
  PID:7900
- C:\Windows\System\JJSlXxe.exe
  C:\Windows\System\JJSlXxe.exe
  2⤵
  PID:7924
- C:\Windows\System\TOGEohz.exe
  C:\Windows\System\TOGEohz.exe
  2⤵
  PID:7944
- C:\Windows\System\govomGB.exe
  C:\Windows\System\govomGB.exe
  2⤵
  PID:7984
- C:\Windows\System\MntzHSz.exe
  C:\Windows\System\MntzHSz.exe
  2⤵
  PID:8008
- C:\Windows\System\qpoufdh.exe
  C:\Windows\System\qpoufdh.exe
  2⤵
  PID:8028
- C:\Windows\System\MCkuqOS.exe
  C:\Windows\System\MCkuqOS.exe
  2⤵
  PID:8060
- C:\Windows\System\VNrGLJt.exe
  C:\Windows\System\VNrGLJt.exe
  2⤵
  PID:4212
- C:\Windows\System\BwjcKEx.exe
  C:\Windows\System\BwjcKEx.exe
  2⤵
  PID:2596
- C:\Windows\System\TcfoYWD.exe
  C:\Windows\System\TcfoYWD.exe
  2⤵
  PID:5124
- C:\Windows\System\AXhLMWw.exe
  C:\Windows\System\AXhLMWw.exe
  2⤵
  PID:5156
- C:\Windows\System\QKPUkRi.exe
  C:\Windows\System\QKPUkRi.exe
  2⤵
  PID:5192
- C:\Windows\System\RUeSFnJ.exe
  C:\Windows\System\RUeSFnJ.exe
  2⤵
  PID:5260
- C:\Windows\System\DfSHofq.exe
  C:\Windows\System\DfSHofq.exe
  2⤵
  PID:6532
- C:\Windows\System\eQHFSGW.exe
  C:\Windows\System\eQHFSGW.exe
  2⤵
  PID:6588
- C:\Windows\System\hWJdSNt.exe
  C:\Windows\System\hWJdSNt.exe
  2⤵
  PID:5284
- C:\Windows\System\SyXqsbY.exe
  C:\Windows\System\SyXqsbY.exe
  2⤵
  PID:5360
- C:\Windows\System\hgtMRrO.exe
  C:\Windows\System\hgtMRrO.exe
  2⤵
  PID:6688
- C:\Windows\System\ZtcvemW.exe
  C:\Windows\System\ZtcvemW.exe
  2⤵
  PID:5872
- C:\Windows\System\keVcQjW.exe
  C:\Windows\System\keVcQjW.exe
  2⤵
  PID:6020
- C:\Windows\System\WKkwXOM.exe
  C:\Windows\System\WKkwXOM.exe
  2⤵
  PID:6800
- C:\Windows\System\tVcpqBb.exe
  C:\Windows\System\tVcpqBb.exe
  2⤵
  PID:6832
- C:\Windows\System\PxUCinw.exe
  C:\Windows\System\PxUCinw.exe
  2⤵
  PID:5012
- C:\Windows\System\LSFEYeK.exe
  C:\Windows\System\LSFEYeK.exe
  2⤵
  PID:6992
- C:\Windows\System\orvfMIQ.exe
  C:\Windows\System\orvfMIQ.exe
  2⤵
  PID:7248
- C:\Windows\System\yLeKTvi.exe
  C:\Windows\System\yLeKTvi.exe
  2⤵
  PID:5596
- C:\Windows\System\LxvrQLb.exe
  C:\Windows\System\LxvrQLb.exe
  2⤵
  PID:5624
- C:\Windows\System\aYotwvv.exe
  C:\Windows\System\aYotwvv.exe
  2⤵
  PID:5704
- C:\Windows\System\tqFDgAx.exe
  C:\Windows\System\tqFDgAx.exe
  2⤵
  PID:5756
- C:\Windows\System\QdYBFtx.exe
  C:\Windows\System\QdYBFtx.exe
  2⤵
  PID:6556
- C:\Windows\System\gdAXcTP.exe
  C:\Windows\System\gdAXcTP.exe
  2⤵
  PID:6716
- C:\Windows\System\SWTmVzD.exe
  C:\Windows\System\SWTmVzD.exe
  2⤵
  PID:5940
- C:\Windows\System\aqEuTJy.exe
  C:\Windows\System\aqEuTJy.exe
  2⤵
  PID:6816
- C:\Windows\System\PNFORxl.exe
  C:\Windows\System\PNFORxl.exe
  2⤵
  PID:6084
- C:\Windows\System\LyDECkt.exe
  C:\Windows\System\LyDECkt.exe
  2⤵
  PID:2452
- C:\Windows\System\sRgAECa.exe
  C:\Windows\System\sRgAECa.exe
  2⤵
  PID:2112
- C:\Windows\System\IAjstHu.exe
  C:\Windows\System\IAjstHu.exe
  2⤵
  PID:6164
- C:\Windows\System\oWGpSEo.exe
  C:\Windows\System\oWGpSEo.exe
  2⤵
  PID:6204
- C:\Windows\System\YfRzFUg.exe
  C:\Windows\System\YfRzFUg.exe
  2⤵
  PID:6212
- C:\Windows\System\HXdNGpI.exe
  C:\Windows\System\HXdNGpI.exe
  2⤵
  PID:6276
- C:\Windows\System\skJekMW.exe
  C:\Windows\System\skJekMW.exe
  2⤵
  PID:6332
- C:\Windows\System\OYbRIuH.exe
  C:\Windows\System\OYbRIuH.exe
  2⤵
  PID:6360
- C:\Windows\System\bkdUapz.exe
  C:\Windows\System\bkdUapz.exe
  2⤵
  PID:6388
- C:\Windows\System\OBEGqaa.exe
  C:\Windows\System\OBEGqaa.exe
  2⤵
  PID:6444
- C:\Windows\System\cOyGkSb.exe
  C:\Windows\System\cOyGkSb.exe
  2⤵
  PID:6600
- C:\Windows\System\gRGZXqY.exe
  C:\Windows\System\gRGZXqY.exe
  2⤵
  PID:6632
- C:\Windows\System\HCPEBOr.exe
  C:\Windows\System\HCPEBOr.exe
  2⤵
  PID:6884
- C:\Windows\System\veyddxe.exe
  C:\Windows\System\veyddxe.exe
  2⤵
  PID:6932
- C:\Windows\System\hmWlEXe.exe
  C:\Windows\System\hmWlEXe.exe
  2⤵
  PID:6996
- C:\Windows\System\UEENTLd.exe
  C:\Windows\System\UEENTLd.exe
  2⤵
  PID:7080
- C:\Windows\System\XlxIJJb.exe
  C:\Windows\System\XlxIJJb.exe
  2⤵
  PID:5264
- C:\Windows\System\FDYchzI.exe
  C:\Windows\System\FDYchzI.exe
  2⤵
  PID:7180
- C:\Windows\System\HllhIoV.exe
  C:\Windows\System\HllhIoV.exe
  2⤵
  PID:7416
- C:\Windows\System\wlRtixY.exe
  C:\Windows\System\wlRtixY.exe
  2⤵
  PID:7740
- C:\Windows\System\vXLIcWm.exe
  C:\Windows\System\vXLIcWm.exe
  2⤵
  PID:7908
- C:\Windows\System\GIeYZHQ.exe
  C:\Windows\System\GIeYZHQ.exe
  2⤵
  PID:3084
- C:\Windows\System\lMLRJlb.exe
  C:\Windows\System\lMLRJlb.exe
  2⤵
  PID:5964
- C:\Windows\System\aaYSKaj.exe
  C:\Windows\System\aaYSKaj.exe
  2⤵
  PID:7292
- C:\Windows\System\eSJRtOv.exe
  C:\Windows\System\eSJRtOv.exe
  2⤵
  PID:7568
- C:\Windows\System\aNydSPR.exe
  C:\Windows\System\aNydSPR.exe
  2⤵
  PID:7648
- C:\Windows\System\OooZdIe.exe
  C:\Windows\System\OooZdIe.exe
  2⤵
  PID:7688
- C:\Windows\System\BAiJxVl.exe
  C:\Windows\System\BAiJxVl.exe
  2⤵
  PID:7836
- C:\Windows\System\OmBMSFn.exe
  C:\Windows\System\OmBMSFn.exe
  2⤵
  PID:8208
- C:\Windows\System\YSWQlnJ.exe
  C:\Windows\System\YSWQlnJ.exe
  2⤵
  PID:8232
- C:\Windows\System\uKUNFic.exe
  C:\Windows\System\uKUNFic.exe
  2⤵
  PID:8252
- C:\Windows\System\djzVXQn.exe
  C:\Windows\System\djzVXQn.exe
  2⤵
  PID:8272
- C:\Windows\System\LgoJcOF.exe
  C:\Windows\System\LgoJcOF.exe
  2⤵
  PID:8292
- C:\Windows\System\cCqLxmm.exe
  C:\Windows\System\cCqLxmm.exe
  2⤵
  PID:8312
- C:\Windows\System\iCMultC.exe
  C:\Windows\System\iCMultC.exe
  2⤵
  PID:8332
- C:\Windows\System\JdAZfWZ.exe
  C:\Windows\System\JdAZfWZ.exe
  2⤵
  PID:8352
- C:\Windows\System\clzIcQF.exe
  C:\Windows\System\clzIcQF.exe
  2⤵
  PID:8368
- C:\Windows\System\JvaAeLp.exe
  C:\Windows\System\JvaAeLp.exe
  2⤵
  PID:8392
- C:\Windows\System\tuYiefM.exe
  C:\Windows\System\tuYiefM.exe
  2⤵
  PID:8412
- C:\Windows\System\DFFcNHI.exe
  C:\Windows\System\DFFcNHI.exe
  2⤵
  PID:8432
- C:\Windows\System\ObxVraX.exe
  C:\Windows\System\ObxVraX.exe
  2⤵
  PID:8448
- C:\Windows\System\hslFcde.exe
  C:\Windows\System\hslFcde.exe
  2⤵
  PID:8472
- C:\Windows\System\sJxHRIg.exe
  C:\Windows\System\sJxHRIg.exe
  2⤵
  PID:8492
- C:\Windows\System\QEsffNE.exe
  C:\Windows\System\QEsffNE.exe
  2⤵
  PID:8512
- C:\Windows\System\FlELnGq.exe
  C:\Windows\System\FlELnGq.exe
  2⤵
  PID:8536
- C:\Windows\System\xMEbrkt.exe
  C:\Windows\System\xMEbrkt.exe
  2⤵
  PID:8560
- C:\Windows\System\bFgRiCx.exe
  C:\Windows\System\bFgRiCx.exe
  2⤵
  PID:8576
- C:\Windows\System\TpgFpME.exe
  C:\Windows\System\TpgFpME.exe
  2⤵
  PID:8668
- C:\Windows\System\YNdRYtG.exe
  C:\Windows\System\YNdRYtG.exe
  2⤵
  PID:8684
- C:\Windows\System\plpMuFO.exe
  C:\Windows\System\plpMuFO.exe
  2⤵
  PID:8700
- C:\Windows\System\kbSgEOa.exe
  C:\Windows\System\kbSgEOa.exe
  2⤵
  PID:8720
- C:\Windows\System\fpnoqsh.exe
  C:\Windows\System\fpnoqsh.exe
  2⤵
  PID:8740
- C:\Windows\System\zwMoKdS.exe
  C:\Windows\System\zwMoKdS.exe
  2⤵
  PID:8768
- C:\Windows\System\TeZzWoG.exe
  C:\Windows\System\TeZzWoG.exe
  2⤵
  PID:8788
- C:\Windows\System\nMcOpiV.exe
  C:\Windows\System\nMcOpiV.exe
  2⤵
  PID:8808
- C:\Windows\System\ypqyPdP.exe
  C:\Windows\System\ypqyPdP.exe
  2⤵
  PID:8828
- C:\Windows\System\bKJKlsb.exe
  C:\Windows\System\bKJKlsb.exe
  2⤵
  PID:8852
- C:\Windows\System\mkUTxaE.exe
  C:\Windows\System\mkUTxaE.exe
  2⤵
  PID:8872
- C:\Windows\System\weUCHoT.exe
  C:\Windows\System\weUCHoT.exe
  2⤵
  PID:8892
- C:\Windows\System\zxkvATg.exe
  C:\Windows\System\zxkvATg.exe
  2⤵
  PID:8916
- C:\Windows\System\WtxjEqg.exe
  C:\Windows\System\WtxjEqg.exe
  2⤵
  PID:8932
- C:\Windows\System\crcaSpX.exe
  C:\Windows\System\crcaSpX.exe
  2⤵
  PID:8956
- C:\Windows\System\rUOwPtq.exe
  C:\Windows\System\rUOwPtq.exe
  2⤵
  PID:8980
- C:\Windows\System\OhAjUOO.exe
  C:\Windows\System\OhAjUOO.exe
  2⤵
  PID:9000
- C:\Windows\System\vQyNYQt.exe
  C:\Windows\System\vQyNYQt.exe
  2⤵
  PID:9016
- C:\Windows\System\VSjizDI.exe
  C:\Windows\System\VSjizDI.exe
  2⤵
  PID:9036
- C:\Windows\System\XQDTWAU.exe
  C:\Windows\System\XQDTWAU.exe
  2⤵
  PID:9056
- C:\Windows\System\SpCWBNx.exe
  C:\Windows\System\SpCWBNx.exe
  2⤵
  PID:9080
- C:\Windows\System\FTLqCta.exe
  C:\Windows\System\FTLqCta.exe
  2⤵
  PID:9100
- C:\Windows\System\aMrvdch.exe
  C:\Windows\System\aMrvdch.exe
  2⤵
  PID:9116
- C:\Windows\System\HKrmMsP.exe
  C:\Windows\System\HKrmMsP.exe
  2⤵
  PID:9140
- C:\Windows\System\lIWfikK.exe
  C:\Windows\System\lIWfikK.exe
  2⤵
  PID:9164
- C:\Windows\System\cLokJhK.exe
  C:\Windows\System\cLokJhK.exe
  2⤵
  PID:9184
- C:\Windows\System\qJYYeht.exe
  C:\Windows\System\qJYYeht.exe
  2⤵
  PID:9204
- C:\Windows\System\Sqsswkn.exe
  C:\Windows\System\Sqsswkn.exe
  2⤵
  PID:3516
- C:\Windows\System\rrScAWF.exe
  C:\Windows\System\rrScAWF.exe
  2⤵
  PID:6188
- C:\Windows\System\qflMcyk.exe
  C:\Windows\System\qflMcyk.exe
  2⤵
  PID:7640
- C:\Windows\System\QpnicCY.exe
  C:\Windows\System\QpnicCY.exe
  2⤵
  PID:7756
- C:\Windows\System\IyVcBFL.exe
  C:\Windows\System\IyVcBFL.exe
  2⤵
  PID:6628
- C:\Windows\System\EiSSfDb.exe
  C:\Windows\System\EiSSfDb.exe
  2⤵
  PID:7856
- C:\Windows\System\QpYtBfa.exe
  C:\Windows\System\QpYtBfa.exe
  2⤵
  PID:7876
- C:\Windows\System\yeYVMdW.exe
  C:\Windows\System\yeYVMdW.exe
  2⤵
  PID:7896
- C:\Windows\System\heAwiTC.exe
  C:\Windows\System\heAwiTC.exe
  2⤵
  PID:7276
- C:\Windows\System\lpvFaDa.exe
  C:\Windows\System\lpvFaDa.exe
  2⤵
  PID:8204
- C:\Windows\System\hvBJTDc.exe
  C:\Windows\System\hvBJTDc.exe
  2⤵
  PID:7972
- C:\Windows\System\mvxgAds.exe
  C:\Windows\System\mvxgAds.exe
  2⤵
  PID:8304
- C:\Windows\System\AMRrQoG.exe
  C:\Windows\System\AMRrQoG.exe
  2⤵
  PID:8408
- C:\Windows\System\rMwJrxK.exe
  C:\Windows\System\rMwJrxK.exe
  2⤵
  PID:8528
- C:\Windows\System\aVLZlDQ.exe
  C:\Windows\System\aVLZlDQ.exe
  2⤵
  PID:9220
- C:\Windows\System\MTMsWAl.exe
  C:\Windows\System\MTMsWAl.exe
  2⤵
  PID:9244
- C:\Windows\System\gbHywkp.exe
  C:\Windows\System\gbHywkp.exe
  2⤵
  PID:9264
- C:\Windows\System\yZfOmdu.exe
  C:\Windows\System\yZfOmdu.exe
  2⤵
  PID:9280
- C:\Windows\System\MyyDWqq.exe
  C:\Windows\System\MyyDWqq.exe
  2⤵
  PID:9300
- C:\Windows\System\DIRAwsX.exe
  C:\Windows\System\DIRAwsX.exe
  2⤵
  PID:9316
- C:\Windows\System\FCQgBto.exe
  C:\Windows\System\FCQgBto.exe
  2⤵
  PID:9336
- C:\Windows\System\NWVOdsm.exe
  C:\Windows\System\NWVOdsm.exe
  2⤵
  PID:9352
- C:\Windows\System\VwYxQkk.exe
  C:\Windows\System\VwYxQkk.exe
  2⤵
  PID:9372
- C:\Windows\System\NTJrFgu.exe
  C:\Windows\System\NTJrFgu.exe
  2⤵
  PID:9396
- C:\Windows\System\Ozpjroa.exe
  C:\Windows\System\Ozpjroa.exe
  2⤵
  PID:9416
- C:\Windows\System\rPXLCXT.exe
  C:\Windows\System\rPXLCXT.exe
  2⤵
  PID:9436
- C:\Windows\System\gXIbPvr.exe
  C:\Windows\System\gXIbPvr.exe
  2⤵
  PID:9460
- C:\Windows\System\DeQMbKf.exe
  C:\Windows\System\DeQMbKf.exe
  2⤵
  PID:9480
- C:\Windows\System\IPTwffu.exe
  C:\Windows\System\IPTwffu.exe
  2⤵
  PID:9504
- C:\Windows\System\alkIHKB.exe
  C:\Windows\System\alkIHKB.exe
  2⤵
  PID:9524
- C:\Windows\System\yBYjaGU.exe
  C:\Windows\System\yBYjaGU.exe
  2⤵
  PID:9544
- C:\Windows\System\jmQTHLg.exe
  C:\Windows\System\jmQTHLg.exe
  2⤵
  PID:9568
- C:\Windows\System\UQXmJpo.exe
  C:\Windows\System\UQXmJpo.exe
  2⤵
  PID:9588
- C:\Windows\System\FimFezU.exe
  C:\Windows\System\FimFezU.exe
  2⤵
  PID:9612
- C:\Windows\System\ktylnHF.exe
  C:\Windows\System\ktylnHF.exe
  2⤵
  PID:9632
- C:\Windows\System\sfiCxzm.exe
  C:\Windows\System\sfiCxzm.exe
  2⤵
  PID:9656
- C:\Windows\System\seeFerW.exe
  C:\Windows\System\seeFerW.exe
  2⤵
  PID:9672
- C:\Windows\System\VZUnIHF.exe
  C:\Windows\System\VZUnIHF.exe
  2⤵
  PID:9716
- C:\Windows\System\iSqGedP.exe
  C:\Windows\System\iSqGedP.exe
  2⤵
  PID:9740
- C:\Windows\System\GwRgOfm.exe
  C:\Windows\System\GwRgOfm.exe
  2⤵
  PID:9764
- C:\Windows\System\UBPuQPQ.exe
  C:\Windows\System\UBPuQPQ.exe
  2⤵
  PID:9780
- C:\Windows\System\bXcCeaQ.exe
  C:\Windows\System\bXcCeaQ.exe
  2⤵
  PID:9804
- C:\Windows\System\reGVAkT.exe
  C:\Windows\System\reGVAkT.exe
  2⤵
  PID:9824
- C:\Windows\System\KQUhKlu.exe
  C:\Windows\System\KQUhKlu.exe
  2⤵
  PID:9840
- C:\Windows\System\pxemkeF.exe
  C:\Windows\System\pxemkeF.exe
  2⤵
  PID:9860
- C:\Windows\System\zeyvuVv.exe
  C:\Windows\System\zeyvuVv.exe
  2⤵
  PID:9876
- C:\Windows\System\CQmztVp.exe
  C:\Windows\System\CQmztVp.exe
  2⤵
  PID:9900
- C:\Windows\System\tcpKoOf.exe
  C:\Windows\System\tcpKoOf.exe
  2⤵
  PID:9920
- C:\Windows\System\ZjTgCEP.exe
  C:\Windows\System\ZjTgCEP.exe
  2⤵
  PID:9936
- C:\Windows\System\ZbjXrZk.exe
  C:\Windows\System\ZbjXrZk.exe
  2⤵
  PID:9956
- C:\Windows\System\wQOwxLZ.exe
  C:\Windows\System\wQOwxLZ.exe
  2⤵
  PID:9976
- C:\Windows\System\gaIxPII.exe
  C:\Windows\System\gaIxPII.exe
  2⤵
  PID:9996
- C:\Windows\System\kugHKiu.exe
  C:\Windows\System\kugHKiu.exe
  2⤵
  PID:10020
- C:\Windows\System\stYkxth.exe
  C:\Windows\System\stYkxth.exe
  2⤵
  PID:10036
- C:\Windows\System\elYoerH.exe
  C:\Windows\System\elYoerH.exe
  2⤵
  PID:10060
- C:\Windows\System\lYzYRtW.exe
  C:\Windows\System\lYzYRtW.exe
  2⤵
  PID:10084
- C:\Windows\System\sCCUeEK.exe
  C:\Windows\System\sCCUeEK.exe
  2⤵
  PID:10108
- C:\Windows\System\XiYBUGz.exe
  C:\Windows\System\XiYBUGz.exe
  2⤵
  PID:10124
- C:\Windows\System\nvHhoWY.exe
  C:\Windows\System\nvHhoWY.exe
  2⤵
  PID:10148
- C:\Windows\System\YGxFCaH.exe
  C:\Windows\System\YGxFCaH.exe
  2⤵
  PID:10172
- C:\Windows\System\gXmizlf.exe
  C:\Windows\System\gXmizlf.exe
  2⤵
  PID:10188
- C:\Windows\System\Btpexfw.exe
  C:\Windows\System\Btpexfw.exe
  2⤵
  PID:10212
- C:\Windows\System\ngzaRVH.exe
  C:\Windows\System\ngzaRVH.exe
  2⤵
  PID:10232
- C:\Windows\System\VhVeEmk.exe
  C:\Windows\System\VhVeEmk.exe
  2⤵
  PID:4384
- C:\Windows\System\igipMJg.exe
  C:\Windows\System\igipMJg.exe
  2⤵
  PID:6572
- C:\Windows\System\gGJdhVX.exe
  C:\Windows\System\gGJdhVX.exe
  2⤵
  PID:7068
- C:\Windows\System\dzcZhNM.exe
  C:\Windows\System\dzcZhNM.exe
  2⤵
  PID:5656
- C:\Windows\System\EZjNsqf.exe
  C:\Windows\System\EZjNsqf.exe
  2⤵
  PID:5740
- C:\Windows\System\XSGQhYT.exe
  C:\Windows\System\XSGQhYT.exe
  2⤵
  PID:4344
- C:\Windows\System\AMgBcoL.exe
  C:\Windows\System\AMgBcoL.exe
  2⤵
  PID:7296
- C:\Windows\System\mDmdRgS.exe
  C:\Windows\System\mDmdRgS.exe
  2⤵
  PID:7308
- C:\Windows\System\YghwFgf.exe
  C:\Windows\System\YghwFgf.exe
  2⤵
  PID:5092
- C:\Windows\System\CpnypNv.exe
  C:\Windows\System\CpnypNv.exe
  2⤵
  PID:7372
- C:\Windows\System\oKEkKIS.exe
  C:\Windows\System\oKEkKIS.exe
  2⤵
  PID:7468
- C:\Windows\System\DLJAYlM.exe
  C:\Windows\System\DLJAYlM.exe
  2⤵
  PID:7532
- C:\Windows\System\AYAHDqZ.exe
  C:\Windows\System\AYAHDqZ.exe
  2⤵
  PID:8692
- C:\Windows\System\DlXRAZL.exe
  C:\Windows\System\DlXRAZL.exe
  2⤵
  PID:3176
- C:\Windows\System\LhBIuaQ.exe
  C:\Windows\System\LhBIuaQ.exe
  2⤵
  PID:8784
- C:\Windows\System\jiEnRbG.exe
  C:\Windows\System\jiEnRbG.exe
  2⤵
  PID:6316
- C:\Windows\System\xgsHwPU.exe
  C:\Windows\System\xgsHwPU.exe
  2⤵
  PID:6420
- C:\Windows\System\ATpMDAV.exe
  C:\Windows\System\ATpMDAV.exe
  2⤵
  PID:7840
- C:\Windows\System\sDseHgR.exe
  C:\Windows\System\sDseHgR.exe
  2⤵
  PID:5224
- C:\Windows\System\etQqJHo.exe
  C:\Windows\System\etQqJHo.exe
  2⤵
  PID:10260
- C:\Windows\System\PEaBvwf.exe
  C:\Windows\System\PEaBvwf.exe
  2⤵
  PID:10276
- C:\Windows\System\keBvTlP.exe
  C:\Windows\System\keBvTlP.exe
  2⤵
  PID:10292
- C:\Windows\System\hTAsCuG.exe
  C:\Windows\System\hTAsCuG.exe
  2⤵
  PID:10308
- C:\Windows\System\JtYEIZs.exe
  C:\Windows\System\JtYEIZs.exe
  2⤵
  PID:10324
- C:\Windows\System\RNecjbR.exe
  C:\Windows\System\RNecjbR.exe
  2⤵
  PID:10340
- C:\Windows\System\tpJYWeM.exe
  C:\Windows\System\tpJYWeM.exe
  2⤵
  PID:10356
- C:\Windows\System\vaJLhrO.exe
  C:\Windows\System\vaJLhrO.exe
  2⤵
  PID:10376
- C:\Windows\System\AtWGNEY.exe
  C:\Windows\System\AtWGNEY.exe
  2⤵
  PID:10392
- C:\Windows\System\oYxXvwl.exe
  C:\Windows\System\oYxXvwl.exe
  2⤵
  PID:10416
- C:\Windows\System\hFDWbJc.exe
  C:\Windows\System\hFDWbJc.exe
  2⤵
  PID:10444
- C:\Windows\System\iVtJEqV.exe
  C:\Windows\System\iVtJEqV.exe
  2⤵
  PID:10468
- C:\Windows\System\UIRjCdR.exe
  C:\Windows\System\UIRjCdR.exe
  2⤵
  PID:10492
- C:\Windows\System\MAopUXC.exe
  C:\Windows\System\MAopUXC.exe
  2⤵
  PID:10512
- C:\Windows\System\DpoFWuh.exe
  C:\Windows\System\DpoFWuh.exe
  2⤵
  PID:10532
- C:\Windows\System\fCntBow.exe
  C:\Windows\System\fCntBow.exe
  2⤵
  PID:10548
- C:\Windows\System\bZWwurL.exe
  C:\Windows\System\bZWwurL.exe
  2⤵
  PID:10576
- C:\Windows\System\IoIJudw.exe
  C:\Windows\System\IoIJudw.exe
  2⤵
  PID:10596
- C:\Windows\System\poJqJxS.exe
  C:\Windows\System\poJqJxS.exe
  2⤵
  PID:10616
- C:\Windows\System\vAyWgbN.exe
  C:\Windows\System\vAyWgbN.exe
  2⤵
  PID:10636
- C:\Windows\System\JkNdAoC.exe
  C:\Windows\System\JkNdAoC.exe
  2⤵
  PID:10660
- C:\Windows\System\kuHVAwt.exe
  C:\Windows\System\kuHVAwt.exe
  2⤵
  PID:10680
- C:\Windows\System\VNDjIak.exe
  C:\Windows\System\VNDjIak.exe
  2⤵
  PID:10708
- C:\Windows\System\uDRemnw.exe
  C:\Windows\System\uDRemnw.exe
  2⤵
  PID:10724
- C:\Windows\System\CsMowVP.exe
  C:\Windows\System\CsMowVP.exe
  2⤵
  PID:10748
- C:\Windows\System\rTSxRCM.exe
  C:\Windows\System\rTSxRCM.exe
  2⤵
  PID:10764
- C:\Windows\System\dRdbSAU.exe
  C:\Windows\System\dRdbSAU.exe
  2⤵
  PID:10788
- C:\Windows\System\bPoEmnf.exe
  C:\Windows\System\bPoEmnf.exe
  2⤵
  PID:10808
- C:\Windows\System\OrTWJBk.exe
  C:\Windows\System\OrTWJBk.exe
  2⤵
  PID:10828
- C:\Windows\System\BUnqSAm.exe
  C:\Windows\System\BUnqSAm.exe
  2⤵
  PID:10848
- C:\Windows\System\FCFYdgP.exe
  C:\Windows\System\FCFYdgP.exe
  2⤵
  PID:10872
- C:\Windows\System\FKmyiOp.exe
  C:\Windows\System\FKmyiOp.exe
  2⤵
  PID:10896
- C:\Windows\System\eDFlVmg.exe
  C:\Windows\System\eDFlVmg.exe
  2⤵
  PID:10916
- C:\Windows\System\aWrKVqW.exe
  C:\Windows\System\aWrKVqW.exe
  2⤵
  PID:10936
- C:\Windows\System\GTfvrlY.exe
  C:\Windows\System\GTfvrlY.exe
  2⤵
  PID:10956
- C:\Windows\System\WhmpYSg.exe
  C:\Windows\System\WhmpYSg.exe
  2⤵
  PID:10984
- C:\Windows\System\EXFhlWh.exe
  C:\Windows\System\EXFhlWh.exe
  2⤵
  PID:11008
- C:\Windows\System\tNgTgRD.exe
  C:\Windows\System\tNgTgRD.exe
  2⤵
  PID:11032
- C:\Windows\System\nxcbrIO.exe
  C:\Windows\System\nxcbrIO.exe
  2⤵
  PID:11056
- C:\Windows\System\mYuSoDL.exe
  C:\Windows\System\mYuSoDL.exe
  2⤵
  PID:11080
- C:\Windows\System\lDnERqF.exe
  C:\Windows\System\lDnERqF.exe
  2⤵
  PID:11100
- C:\Windows\System\byKpeIq.exe
  C:\Windows\System\byKpeIq.exe
  2⤵
  PID:11124
- C:\Windows\System\skSHAQS.exe
  C:\Windows\System\skSHAQS.exe
  2⤵
  PID:11144
- C:\Windows\System\oQayrEq.exe
  C:\Windows\System\oQayrEq.exe
  2⤵
  PID:11164
- C:\Windows\System\BOMwkIO.exe
  C:\Windows\System\BOMwkIO.exe
  2⤵
  PID:11188
- C:\Windows\System\lwodoEd.exe
  C:\Windows\System\lwodoEd.exe
  2⤵
  PID:11212
- C:\Windows\System\cgyZhlN.exe
  C:\Windows\System\cgyZhlN.exe
  2⤵
  PID:11228
- C:\Windows\System\sDzlSsP.exe
  C:\Windows\System\sDzlSsP.exe
  2⤵
  PID:11252
- C:\Windows\System\lngrgpI.exe
  C:\Windows\System\lngrgpI.exe
  2⤵
  PID:8952
- C:\Windows\System\RTGqDWc.exe
  C:\Windows\System\RTGqDWc.exe
  2⤵
  PID:9008
- C:\Windows\System\eNLxaGX.exe
  C:\Windows\System\eNLxaGX.exe
  2⤵
  PID:7244
- C:\Windows\System\QaUrkjW.exe
  C:\Windows\System\QaUrkjW.exe
  2⤵
  PID:8224
- C:\Windows\System\TiXctND.exe
  C:\Windows\System\TiXctND.exe
  2⤵
  PID:9108
- C:\Windows\System\BuYXkOU.exe
  C:\Windows\System\BuYXkOU.exe
  2⤵
  PID:8364
- C:\Windows\System\duxajnp.exe
  C:\Windows\System\duxajnp.exe
  2⤵
  PID:8568
- C:\Windows\System\RcQOrmT.exe
  C:\Windows\System\RcQOrmT.exe
  2⤵
  PID:7892
- C:\Windows\System\ZjaqLhM.exe
  C:\Windows\System\ZjaqLhM.exe
  2⤵
  PID:9252
- C:\Windows\System\wSCZWeD.exe
  C:\Windows\System\wSCZWeD.exe
  2⤵
  PID:9520
- C:\Windows\System\uRncGXk.exe
  C:\Windows\System\uRncGXk.exe
  2⤵
  PID:9576
- C:\Windows\System\AuDUIcx.exe
  C:\Windows\System\AuDUIcx.exe
  2⤵
  PID:2244
- C:\Windows\System\nYEQeDW.exe
  C:\Windows\System\nYEQeDW.exe
  2⤵
  PID:6484
- C:\Windows\System\rKVThEy.exe
  C:\Windows\System\rKVThEy.exe
  2⤵
  PID:11280
- C:\Windows\System\TRuqTvC.exe
  C:\Windows\System\TRuqTvC.exe
  2⤵
  PID:11300
- C:\Windows\System\ZzIMons.exe
  C:\Windows\System\ZzIMons.exe
  2⤵
  PID:11316
- C:\Windows\System\wDUtlrl.exe
  C:\Windows\System\wDUtlrl.exe
  2⤵
  PID:11336
- C:\Windows\System\LVXOLYn.exe
  C:\Windows\System\LVXOLYn.exe
  2⤵
  PID:11356
- C:\Windows\System\QdjXHSK.exe
  C:\Windows\System\QdjXHSK.exe
  2⤵
  PID:11380
- C:\Windows\System\epkScJM.exe
  C:\Windows\System\epkScJM.exe
  2⤵
  PID:11396
- C:\Windows\System\HEHVoOi.exe
  C:\Windows\System\HEHVoOi.exe
  2⤵
  PID:11412
- C:\Windows\System\OxPxITP.exe
  C:\Windows\System\OxPxITP.exe
  2⤵
  PID:11428
- C:\Windows\System\JNxDZbm.exe
  C:\Windows\System\JNxDZbm.exe
  2⤵
  PID:11444
- C:\Windows\System\wnKeQAi.exe
  C:\Windows\System\wnKeQAi.exe
  2⤵
  PID:11472
- C:\Windows\System\UaGSUaB.exe
  C:\Windows\System\UaGSUaB.exe
  2⤵
  PID:11488
- C:\Windows\System\SuqgPhl.exe
  C:\Windows\System\SuqgPhl.exe
  2⤵
  PID:11508
- C:\Windows\System\VifFNZI.exe
  C:\Windows\System\VifFNZI.exe
  2⤵
  PID:11528
- C:\Windows\System\RlmPXkf.exe
  C:\Windows\System\RlmPXkf.exe
  2⤵
  PID:11548
- C:\Windows\System\wVWlZkg.exe
  C:\Windows\System\wVWlZkg.exe
  2⤵
  PID:11568
- C:\Windows\System\KptEXAz.exe
  C:\Windows\System\KptEXAz.exe
  2⤵
  PID:11588
- C:\Windows\System\ggMSSyc.exe
  C:\Windows\System\ggMSSyc.exe
  2⤵
  PID:11616
- C:\Windows\System\ngWoMpO.exe
  C:\Windows\System\ngWoMpO.exe
  2⤵
  PID:11640
- C:\Windows\System\etiUmnz.exe
  C:\Windows\System\etiUmnz.exe
  2⤵
  PID:11664
- C:\Windows\System\TvgicXn.exe
  C:\Windows\System\TvgicXn.exe
  2⤵
  PID:11696
- C:\Windows\System\XVxndVt.exe
  C:\Windows\System\XVxndVt.exe
  2⤵
  PID:11716
- C:\Windows\System\CwgpDBM.exe
  C:\Windows\System\CwgpDBM.exe
  2⤵
  PID:11736
- C:\Windows\System\PpYGLTd.exe
  C:\Windows\System\PpYGLTd.exe
  2⤵
  PID:11760
- C:\Windows\System\pwWSQCb.exe
  C:\Windows\System\pwWSQCb.exe
  2⤵
  PID:11776
- C:\Windows\System\FWrXZKR.exe
  C:\Windows\System\FWrXZKR.exe
  2⤵
  PID:11800
- C:\Windows\System\etxkrUR.exe
  C:\Windows\System\etxkrUR.exe
  2⤵
  PID:11828
- C:\Windows\System\jNfHDUC.exe
  C:\Windows\System\jNfHDUC.exe
  2⤵
  PID:11844
- C:\Windows\System\KVvgEDb.exe
  C:\Windows\System\KVvgEDb.exe
  2⤵
  PID:11872
- C:\Windows\System\clNBtTb.exe
  C:\Windows\System\clNBtTb.exe
  2⤵
  PID:11888
- C:\Windows\System\AQHWwix.exe
  C:\Windows\System\AQHWwix.exe
  2⤵
  PID:11912
- C:\Windows\System\VtPhids.exe
  C:\Windows\System\VtPhids.exe
  2⤵
  PID:11936
- C:\Windows\System\pfiCmwE.exe
  C:\Windows\System\pfiCmwE.exe
  2⤵
  PID:11956
- C:\Windows\System\qnSaVLZ.exe
  C:\Windows\System\qnSaVLZ.exe
  2⤵
  PID:11980
- C:\Windows\System\aLvkpzb.exe
  C:\Windows\System\aLvkpzb.exe
  2⤵
  PID:11996
- C:\Windows\System\kChHTOf.exe
  C:\Windows\System\kChHTOf.exe
  2⤵
  PID:12020
- C:\Windows\System\qUCNCEy.exe
  C:\Windows\System\qUCNCEy.exe
  2⤵
  PID:12044
- C:\Windows\System\rIgryhe.exe
  C:\Windows\System\rIgryhe.exe
  2⤵
  PID:12072
- C:\Windows\System\sUNQlou.exe
  C:\Windows\System\sUNQlou.exe
  2⤵
  PID:12088
- C:\Windows\System\HDxuTVd.exe
  C:\Windows\System\HDxuTVd.exe
  2⤵
  PID:12112
- C:\Windows\System\uSfbyen.exe
  C:\Windows\System\uSfbyen.exe
  2⤵
  PID:12132
- C:\Windows\System\VyNCzLs.exe
  C:\Windows\System\VyNCzLs.exe
  2⤵
  PID:12152
- C:\Windows\System\fkDzbXv.exe
  C:\Windows\System\fkDzbXv.exe
  2⤵
  PID:12176
- C:\Windows\System\fOlQTPZ.exe
  C:\Windows\System\fOlQTPZ.exe
  2⤵
  PID:12192
- C:\Windows\System\lASwCZi.exe
  C:\Windows\System\lASwCZi.exe
  2⤵
  PID:12220
- C:\Windows\System\cxLVrIU.exe
  C:\Windows\System\cxLVrIU.exe
  2⤵
  PID:12240
- C:\Windows\System\gUBqzTq.exe
  C:\Windows\System\gUBqzTq.exe
  2⤵
  PID:12260
- C:\Windows\System\oJRYIjJ.exe
  C:\Windows\System\oJRYIjJ.exe
  2⤵
  PID:12284
- C:\Windows\System\hXEkygC.exe
  C:\Windows\System\hXEkygC.exe
  2⤵
  PID:5840
- C:\Windows\System\YdKTllQ.exe
  C:\Windows\System\YdKTllQ.exe
  2⤵
  PID:6732
- C:\Windows\System\JtBrzrL.exe
  C:\Windows\System\JtBrzrL.exe
  2⤵
  PID:6768
- C:\Windows\System\EatZKGW.exe
  C:\Windows\System\EatZKGW.exe
  2⤵
  PID:6128
- C:\Windows\System\BSIHfeh.exe
  C:\Windows\System\BSIHfeh.exe
  2⤵
  PID:5572
- C:\Windows\System\aAySCZB.exe
  C:\Windows\System\aAySCZB.exe
  2⤵
  PID:5696
- C:\Windows\System\hDhPGsN.exe
  C:\Windows\System\hDhPGsN.exe
  2⤵
  PID:6460
- C:\Windows\System\uzPlJtp.exe
  C:\Windows\System\uzPlJtp.exe
  2⤵
  PID:9932
- C:\Windows\System\LsrXRlo.exe
  C:\Windows\System\LsrXRlo.exe
  2⤵
  PID:9984
- C:\Windows\System\WMdxWQE.exe
  C:\Windows\System\WMdxWQE.exe
  2⤵
  PID:10044
- C:\Windows\System\ABcurTA.exe
  C:\Windows\System\ABcurTA.exe
  2⤵
  PID:10092
- C:\Windows\System\jmImArW.exe
  C:\Windows\System\jmImArW.exe
  2⤵
  PID:10144
- C:\Windows\System\iuqOibj.exe
  C:\Windows\System\iuqOibj.exe
  2⤵
  PID:10208
- C:\Windows\System\hIncbbY.exe
  C:\Windows\System\hIncbbY.exe
  2⤵
  PID:8748
- C:\Windows\System\EifwjAN.exe
  C:\Windows\System\EifwjAN.exe
  2⤵
  PID:6176
- C:\Windows\System\dgnomjG.exe
  C:\Windows\System\dgnomjG.exe
  2⤵
  PID:7188
- C:\Windows\System\dqvzgnX.exe
  C:\Windows\System\dqvzgnX.exe
  2⤵
  PID:7488
- C:\Windows\System\fVfWuOo.exe
  C:\Windows\System\fVfWuOo.exe
  2⤵
  PID:12308
- C:\Windows\System\QBflhyh.exe
  C:\Windows\System\QBflhyh.exe
  2⤵
  PID:12332
- C:\Windows\System\PSceEsa.exe
  C:\Windows\System\PSceEsa.exe
  2⤵
  PID:12360
- C:\Windows\System\cAvIuYV.exe
  C:\Windows\System\cAvIuYV.exe
  2⤵
  PID:12376
- C:\Windows\System\jMivZKL.exe
  C:\Windows\System\jMivZKL.exe
  2⤵
  PID:12408
- C:\Windows\System\uapIFed.exe
  C:\Windows\System\uapIFed.exe
  2⤵
  PID:12424
- C:\Windows\System\bAlVNeA.exe
  C:\Windows\System\bAlVNeA.exe
  2⤵
  PID:12440
- C:\Windows\System\SOuvTWp.exe
  C:\Windows\System\SOuvTWp.exe
  2⤵
  PID:12456
- C:\Windows\System\gHnUrBq.exe
  C:\Windows\System\gHnUrBq.exe
  2⤵
  PID:12472
- C:\Windows\System\AWLIMzz.exe
  C:\Windows\System\AWLIMzz.exe
  2⤵
  PID:12488
- C:\Windows\System\QvWjeqM.exe
  C:\Windows\System\QvWjeqM.exe
  2⤵
  PID:12504
- C:\Windows\System\TrVIrXu.exe
  C:\Windows\System\TrVIrXu.exe
  2⤵
  PID:12520
- C:\Windows\System\xeRdpGI.exe
  C:\Windows\System\xeRdpGI.exe
  2⤵
  PID:12744
- C:\Windows\System\VoJmEoB.exe
  C:\Windows\System\VoJmEoB.exe
  2⤵
  PID:12768
- C:\Windows\System\HLWPRnk.exe
  C:\Windows\System\HLWPRnk.exe
  2⤵
  PID:12788
- C:\Windows\System\USHYpiT.exe
  C:\Windows\System\USHYpiT.exe
  2⤵
  PID:12812
- C:\Windows\System\DorOaqT.exe
  C:\Windows\System\DorOaqT.exe
  2⤵
  PID:12836
- C:\Windows\System\lvJuPCt.exe
  C:\Windows\System\lvJuPCt.exe
  2⤵
  PID:12856
- C:\Windows\System\mYIRkuM.exe
  C:\Windows\System\mYIRkuM.exe
  2⤵
  PID:12880
- C:\Windows\System\zjIVxkT.exe
  C:\Windows\System\zjIVxkT.exe
  2⤵
  PID:12900
- C:\Windows\System\QCSowHT.exe
  C:\Windows\System\QCSowHT.exe
  2⤵
  PID:12920
- C:\Windows\System\cDExgAW.exe
  C:\Windows\System\cDExgAW.exe
  2⤵
  PID:12944
- C:\Windows\System\jnODxNq.exe
  C:\Windows\System\jnODxNq.exe
  2⤵
  PID:12968
- C:\Windows\System\rJOweOJ.exe
  C:\Windows\System\rJOweOJ.exe
  2⤵
  PID:12988
- C:\Windows\System\AplxCtj.exe
  C:\Windows\System\AplxCtj.exe
  2⤵
  PID:13012
- C:\Windows\System\wUcevBr.exe
  C:\Windows\System\wUcevBr.exe
  2⤵
  PID:13032
- C:\Windows\System\nSkvDhg.exe
  C:\Windows\System\nSkvDhg.exe
  2⤵
  PID:13052
- C:\Windows\System\QjXaYXz.exe
  C:\Windows\System\QjXaYXz.exe
  2⤵
  PID:13080
- C:\Windows\System\HgGWfgM.exe
  C:\Windows\System\HgGWfgM.exe
  2⤵
  PID:13100
- C:\Windows\System\lQbBdzr.exe
  C:\Windows\System\lQbBdzr.exe
  2⤵
  PID:13128
- C:\Windows\System\qsyOLwR.exe
  C:\Windows\System\qsyOLwR.exe
  2⤵
  PID:13144
- C:\Windows\System\FJrjjdd.exe
  C:\Windows\System\FJrjjdd.exe
  2⤵
  PID:13168
- C:\Windows\System\ymqAEOE.exe
  C:\Windows\System\ymqAEOE.exe
  2⤵
  PID:13192
- C:\Windows\System\qSQgwbW.exe
  C:\Windows\System\qSQgwbW.exe
  2⤵
  PID:13216
- C:\Windows\System\nYqhuEl.exe
  C:\Windows\System\nYqhuEl.exe
  2⤵
  PID:13240
- C:\Windows\System\gIbvUZi.exe
  C:\Windows\System\gIbvUZi.exe
  2⤵
  PID:13264
- C:\Windows\System\ewKlhLj.exe
  C:\Windows\System\ewKlhLj.exe
  2⤵
  PID:8652
- C:\Windows\System\VgVchJz.exe
  C:\Windows\System\VgVchJz.exe
  2⤵
  PID:9944
- C:\Windows\System\MRXdndk.exe
  C:\Windows\System\MRXdndk.exe
  2⤵
  PID:7452
- C:\Windows\System\WmSafbO.exe
  C:\Windows\System\WmSafbO.exe
  2⤵
  PID:10068
- C:\Windows\System\Jkcxgwc.exe
  C:\Windows\System\Jkcxgwc.exe
  2⤵
  PID:5608
- C:\Windows\System\sHrUInz.exe
  C:\Windows\System\sHrUInz.exe
  2⤵
  PID:12276
- C:\Windows\System\GkRMLAf.exe
  C:\Windows\System\GkRMLAf.exe
  2⤵
  PID:12184
- C:\Windows\System\mOQdoOt.exe
  C:\Windows\System\mOQdoOt.exe
  2⤵
  PID:12052
- C:\Windows\System\BRCSUgF.exe
  C:\Windows\System\BRCSUgF.exe
  2⤵
  PID:11900
- C:\Windows\System\fXykYje.exe
  C:\Windows\System\fXykYje.exe
  2⤵
  PID:11748
- C:\Windows\System\hbqkPsI.exe
  C:\Windows\System\hbqkPsI.exe
  2⤵
  PID:11632
- C:\Windows\System\TcFzRvm.exe
  C:\Windows\System\TcFzRvm.exe
  2⤵
  PID:11496
- C:\Windows\System\drvSgbD.exe
  C:\Windows\System\drvSgbD.exe
  2⤵
  PID:11420
- C:\Windows\System\zbYlBhh.exe
  C:\Windows\System\zbYlBhh.exe
  2⤵
  PID:11288
- C:\Windows\System\yfohEKx.exe
  C:\Windows\System\yfohEKx.exe
  2⤵
  PID:9260
- C:\Windows\System\eMgnEVn.exe
  C:\Windows\System\eMgnEVn.exe
  2⤵
  PID:8288
- C:\Windows\System\tlljXEq.exe
  C:\Windows\System\tlljXEq.exe
  2⤵
  PID:700
- C:\Windows\System\AmljhmR.exe
  C:\Windows\System\AmljhmR.exe
  2⤵
  PID:12340
- C:\Windows\System\ZPdHgoy.exe
  C:\Windows\System\ZPdHgoy.exe
  2⤵
  PID:12576
- C:\Windows\System\LtXdgFP.exe
  C:\Windows\System\LtXdgFP.exe
  2⤵
  PID:11796
- C:\Windows\System\qcALYxq.exe
  C:\Windows\System\qcALYxq.exe
  2⤵
  PID:12016
- C:\Windows\System\VDxZOkj.exe
  C:\Windows\System\VDxZOkj.exe
  2⤵
  PID:12124
- C:\Windows\System\fMrsjTw.exe
  C:\Windows\System\fMrsjTw.exe
  2⤵
  PID:6672
- C:\Windows\System\mGULDRm.exe
  C:\Windows\System\mGULDRm.exe
  2⤵
  PID:5744
- C:\Windows\System\egpFwrG.exe
  C:\Windows\System\egpFwrG.exe
  2⤵
  PID:10080
- C:\Windows\System\ZiiurJn.exe
  C:\Windows\System\ZiiurJn.exe
  2⤵
  PID:13092
- C:\Windows\System\jDLqSgR.exe
  C:\Windows\System\jDLqSgR.exe
  2⤵
  PID:8764
- C:\Windows\System\TUvaEdh.exe
  C:\Windows\System\TUvaEdh.exe
  2⤵
  PID:6384
- C:\Windows\System\AVyWrJR.exe
  C:\Windows\System\AVyWrJR.exe
  2⤵
  PID:12452
- C:\Windows\System\cIJDSSn.exe
  C:\Windows\System\cIJDSSn.exe
  2⤵
  PID:12824
- C:\Windows\System\ubNIvfR.exe
  C:\Windows\System\ubNIvfR.exe
  2⤵
  PID:9888
- C:\Windows\System\WnxyisK.exe
  C:\Windows\System\WnxyisK.exe
  2⤵
  PID:5876
- C:\Windows\System\CXlUSnP.exe
  C:\Windows\System\CXlUSnP.exe
  2⤵
  PID:4844
- C:\Windows\System\rLoQmJj.exe
  C:\Windows\System\rLoQmJj.exe
  2⤵
  PID:13116
- C:\Windows\System\JBnCQBs.exe
  C:\Windows\System\JBnCQBs.exe
  2⤵
  PID:7792
- C:\Windows\System\MBQVvCb.exe
  C:\Windows\System\MBQVvCb.exe
  2⤵
  PID:10476
- C:\Windows\System\VYasroL.exe
  C:\Windows\System\VYasroL.exe
  2⤵
  PID:11584
- C:\Windows\System\oaATiBb.exe
  C:\Windows\System\oaATiBb.exe
  2⤵
  PID:9928
- C:\Windows\System\JBHIedY.exe
  C:\Windows\System\JBHIedY.exe
  2⤵
  PID:7108
- C:\Windows\System\zCiuTFs.exe
  C:\Windows\System\zCiuTFs.exe
  2⤵
  PID:8780
- C:\Windows\System\cbNcYzU.exe
  C:\Windows\System\cbNcYzU.exe
  2⤵
  PID:12928
- C:\Windows\System\iniaZtV.exe
  C:\Windows\System\iniaZtV.exe
  2⤵
  PID:13008
- C:\Windows\System\Iaagjsk.exe
  C:\Windows\System\Iaagjsk.exe
  2⤵
  PID:10676
- C:\Windows\System\tkMtbHc.exe
  C:\Windows\System\tkMtbHc.exe
  2⤵
  PID:10772
- C:\Windows\System\XqNVcAO.exe
  C:\Windows\System\XqNVcAO.exe
  2⤵
  PID:9312
- C:\Windows\System\wvhfGtY.exe
  C:\Windows\System\wvhfGtY.exe
  2⤵
  PID:9492
- C:\Windows\System\KlzNuar.exe
  C:\Windows\System\KlzNuar.exe
  2⤵
  PID:13044
- C:\Windows\System\yPpiJdG.exe
  C:\Windows\System\yPpiJdG.exe
  2⤵
  PID:1984
- C:\Windows\System\DpjKXCS.exe
  C:\Windows\System\DpjKXCS.exe
  2⤵
  PID:8868
- C:\Windows\System\aiiKJrX.exe
  C:\Windows\System\aiiKJrX.exe
  2⤵
  PID:10860
- C:\Windows\System\OuLEkhb.exe
  C:\Windows\System\OuLEkhb.exe
  2⤵
  PID:10180
- C:\Windows\System\tGzkviF.exe
  C:\Windows\System\tGzkviF.exe
  2⤵
  PID:5500
- C:\Windows\System\tuLeAKg.exe
  C:\Windows\System\tuLeAKg.exe
  2⤵
  PID:3632
- C:\Windows\System\piEJbrT.exe
  C:\Windows\System\piEJbrT.exe
  2⤵
  PID:12368
- C:\Windows\System\dFreLmq.exe
  C:\Windows\System\dFreLmq.exe
  2⤵
  PID:6656
- C:\Windows\System\RhgzqkB.exe
  C:\Windows\System\RhgzqkB.exe
  2⤵
  PID:11988
- C:\Windows\System\bvsbGGg.exe
  C:\Windows\System\bvsbGGg.exe
  2⤵
  PID:11580
- C:\Windows\System\hVInKRP.exe
  C:\Windows\System\hVInKRP.exe
  2⤵
  PID:10300
- C:\Windows\System\PmNMCRR.exe
  C:\Windows\System\PmNMCRR.exe
  2⤵
  PID:13088
- C:\Windows\System\mglCLCN.exe
  C:\Windows\System\mglCLCN.exe
  2⤵
  PID:3528
- C:\Windows\System\COsFIDa.exe
  C:\Windows\System\COsFIDa.exe
  2⤵
  PID:11784
- C:\Windows\System\GEYDYkO.exe
  C:\Windows\System\GEYDYkO.exe
  2⤵
  PID:8508
- C:\Windows\System\ePVOXRM.exe
  C:\Windows\System\ePVOXRM.exe
  2⤵
  PID:8988
- C:\Windows\System\zKyIOnr.exe
  C:\Windows\System\zKyIOnr.exe
  2⤵
  PID:9680
- C:\Windows\System\xBaDhFt.exe
  C:\Windows\System\xBaDhFt.exe
  2⤵
  PID:12620
- C:\Windows\System\clAfxQP.exe
  C:\Windows\System\clAfxQP.exe
  2⤵
  PID:13364
- C:\Windows\System\puFvqaL.exe
  C:\Windows\System\puFvqaL.exe
  2⤵
  PID:13464
- C:\Windows\System\LlGJLpQ.exe
  C:\Windows\System\LlGJLpQ.exe
  2⤵
  PID:13492
- C:\Windows\System\uPfqbqy.exe
  C:\Windows\System\uPfqbqy.exe
  2⤵
  PID:13512
- C:\Windows\System\AxyVHFZ.exe
  C:\Windows\System\AxyVHFZ.exe
  2⤵
  PID:13536
- C:\Windows\System\EzloVOd.exe
  C:\Windows\System\EzloVOd.exe
  2⤵
  PID:13576
- C:\Windows\System\RhauxEg.exe
  C:\Windows\System\RhauxEg.exe
  2⤵
  PID:13604
- C:\Windows\System\TazVhJz.exe
  C:\Windows\System\TazVhJz.exe
  2⤵
  PID:13624
- C:\Windows\System\yATbCCv.exe
  C:\Windows\System\yATbCCv.exe
  2⤵
  PID:13652
- C:\Windows\System\uJwsVUf.exe
  C:\Windows\System\uJwsVUf.exe
  2⤵
  PID:13688
- C:\Windows\System\BUXKEza.exe
  C:\Windows\System\BUXKEza.exe
  2⤵
  PID:13720
- C:\Windows\System\XACnPrm.exe
  C:\Windows\System\XACnPrm.exe
  2⤵
  PID:13740
- C:\Windows\System\xYsNKnn.exe
  C:\Windows\System\xYsNKnn.exe
  2⤵
  PID:13844
- C:\Windows\System\aDyzAjB.exe
  C:\Windows\System\aDyzAjB.exe
  2⤵
  PID:13932
- C:\Windows\System\kouqukD.exe
  C:\Windows\System\kouqukD.exe
  2⤵
  PID:13964
- C:\Windows\System\cAztlcN.exe
  C:\Windows\System\cAztlcN.exe
  2⤵
  PID:13980
- C:\Windows\System\QIpJPeG.exe
  C:\Windows\System\QIpJPeG.exe
  2⤵
  PID:14060
- C:\Windows\System\jcSRgWv.exe
  C:\Windows\System\jcSRgWv.exe
  2⤵
  PID:14080
- C:\Windows\System\qqFFZkj.exe
  C:\Windows\System\qqFFZkj.exe
  2⤵
  PID:14104
- C:\Windows\System\mocvwEa.exe
  C:\Windows\System\mocvwEa.exe
  2⤵
  PID:14248
- C:\Windows\System\nscipwk.exe
  C:\Windows\System\nscipwk.exe
  2⤵
  PID:14272
- C:\Windows\System\UPRCSKR.exe
  C:\Windows\System\UPRCSKR.exe
  2⤵
  PID:1684
- C:\Windows\System\LvkNlLU.exe
  C:\Windows\System\LvkNlLU.exe
  2⤵
  PID:13544
- C:\Windows\System\cZnSwZT.exe
  C:\Windows\System\cZnSwZT.exe
  2⤵
  PID:14132
- C:\Windows\System\xFyGVjG.exe
  C:\Windows\System\xFyGVjG.exe
  2⤵
  PID:14048
- C:\Windows\System\brrNKKt.exe
  C:\Windows\System\brrNKKt.exe
  2⤵
  PID:12104
- C:\Windows\System\yCWOfqx.exe
  C:\Windows\System\yCWOfqx.exe
  2⤵
  PID:14120
- C:\Windows\System\ODkpkwm.exe
  C:\Windows\System\ODkpkwm.exe
  2⤵
  PID:1344
- C:\Windows\System\FEDfuDM.exe
  C:\Windows\System\FEDfuDM.exe
  2⤵
  PID:14328
- C:\Windows\System\aNRaAKz.exe
  C:\Windows\System\aNRaAKz.exe
  2⤵
  PID:12604
- C:\Windows\System\nHfpoUm.exe
  C:\Windows\System\nHfpoUm.exe
  2⤵
  PID:8324
- C:\Windows\System\mySlEGB.exe
  C:\Windows\System\mySlEGB.exe
  2⤵
  PID:11656
- C:\Windows\System\poxzTQi.exe
  C:\Windows\System\poxzTQi.exe
  2⤵
  PID:4528
- C:\Windows\System\lZTSHQE.exe
  C:\Windows\System\lZTSHQE.exe
  2⤵
  PID:4324
- C:\Windows\System\YUnBlGC.exe
  C:\Windows\System\YUnBlGC.exe
  2⤵
  PID:10556
- C:\Windows\System\pYSAYzV.exe
  C:\Windows\System\pYSAYzV.exe
  2⤵
  PID:10184
- C:\Windows\System\kBvLvCQ.exe
  C:\Windows\System\kBvLvCQ.exe
  2⤵
  PID:13396
- C:\Windows\System\McdpOVS.exe
  C:\Windows\System\McdpOVS.exe
  2⤵
  PID:2276
- C:\Windows\System\xiwlZgg.exe
  C:\Windows\System\xiwlZgg.exe
  2⤵
  PID:13732
- C:\Windows\System\FpBaAFF.exe
  C:\Windows\System\FpBaAFF.exe
  2⤵
  PID:13780
- C:\Windows\System\gSadLQE.exe
  C:\Windows\System\gSadLQE.exe
  2⤵
  PID:13832
- C:\Windows\System\tlirNhi.exe
  C:\Windows\System\tlirNhi.exe
  2⤵
  PID:13684
- C:\Windows\System\hqvIoGh.exe
  C:\Windows\System\hqvIoGh.exe
  2⤵
  PID:13592
- C:\Windows\System\PaSOSer.exe
  C:\Windows\System\PaSOSer.exe
  2⤵
  PID:13908
- C:\Windows\System\dKomuUy.exe
  C:\Windows\System\dKomuUy.exe
  2⤵
  PID:13700
- C:\Windows\System\ZjdTNnm.exe
  C:\Windows\System\ZjdTNnm.exe
  2⤵
  PID:13840
- C:\Windows\System\jxNeHYe.exe
  C:\Windows\System\jxNeHYe.exe
  2⤵
  PID:14284
- C:\Windows\System\qmnCJgg.exe
  C:\Windows\System\qmnCJgg.exe
  2⤵
  PID:14188
- C:\Windows\System\aEycqVx.exe
  C:\Windows\System\aEycqVx.exe
  2⤵
  PID:14312
- C:\Windows\System\vscrMfE.exe
  C:\Windows\System\vscrMfE.exe
  2⤵
  PID:13712
- C:\Windows\System\sZGjQag.exe
  C:\Windows\System\sZGjQag.exe
  2⤵
  PID:3264
- C:\Windows\System\sjlrfQp.exe
  C:\Windows\System\sjlrfQp.exe
  2⤵
  PID:13344
- C:\Windows\System\nVuOhiL.exe
  C:\Windows\System\nVuOhiL.exe
  2⤵
  PID:13504
- C:\Windows\System\ENCMyrd.exe
  C:\Windows\System\ENCMyrd.exe
  2⤵
  PID:7644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kmld2msz.1jq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BDBNIWF.exe

Filesize
1.6MB

MD5
df0aabec287423809a18f7bb734b7818

SHA1
5865fe9d9682299561271702644fb82560bd2dfe

SHA256
794b881d34b9a55759682eba257e88365f7fbf053eb277837abf3085de081892

SHA512
69c4bf16986869b773785bd32815556341b1cc995def65dfdea098bdb450a8c5c9400f379454fd7ab9971833af6b0bb2d8f8bca089c2d285fd98dbe0faa5f97d

Download Submit
C:\Windows\System\BOkFzyq.exe

Filesize
1.6MB

MD5
2680ea0f7fc65197b239dcbb227f588f

SHA1
7818bcb4cdeee849ad9c1a9fe3b300b4c7e090bb

SHA256
530111ddfcca05f34f317158980065216116a77a9a507512cc7a33a90736e7c9

SHA512
59edc787df468ebb8b766dc8722dd7204691e24df140df0a25e9dd7639d8d0909c812ee390d866bfed53c54038572f7499d5c861099b1c4960fd84cf70521614

Download Submit
C:\Windows\System\BkimbLS.exe

Filesize
1.6MB

MD5
d00258f4e1f9a00cb36916f6965954ed

SHA1
78ea0f45edc8ecd56111aea6796242994318dc40

SHA256
435aa4c13e356371585ac08148d84f0b7b5bafe8b3d6818a221b19731c2b91b9

SHA512
ab33f4f1a0eea9dbcd831da7f3a8070a921b03f9f3ba4154830f6596d25d7bb26cc4614eea2185ad4f614c84a97f8e6f871aec856c171013143e316f42e3c15a

Download Submit
C:\Windows\System\CFrfDZH.exe

Filesize
1.6MB

MD5
85491600ac9996ed77625000f6243391

SHA1
5f5589f322c6cd3ff5da3bd843a65a71efdf8896

SHA256
d358a96633539ac47f7856825efd1adce7ea5350f9df7e33f605f88c20b20b50

SHA512
b1a66df700e711d0f6294b31792e0100db0fe0a97dc22e46e740b6a86a64fa2f3b29060fe87247b73af404d53d980039547a444b70f004ba6326981de888c9c2

Download Submit
C:\Windows\System\DNSvnae.exe

Filesize
1.6MB

MD5
e869d33607c32f7a0f970080a38945d0

SHA1
8dfcf9e09a28983a3dea1e429eea75d4349ec679

SHA256
5c2eea52cf5f4e627ebfa3b235f5a578d3f4d64160d2e9418f21599054d46d1e

SHA512
269a566c709c49a42d812bec01974cf49405cb83e679a7c828949beb543d90934247f02853fc10deafba831bd926743dcafd333475f366a4b530ba1a6a67100b

Download Submit
C:\Windows\System\EHSYwaK.exe

Filesize
1.6MB

MD5
3979b040e443eb8d2a9ef4aef2cbc4ab

SHA1
f5992f89b3619071063e6e82b4b3beead18615a4

SHA256
832dd91fccb4c8641813306785a8fecc0e6a4436013a40ba3486e54f2e3884c6

SHA512
6c9dcdd59e922ed2cf681a4942a235f3ad1fa248f8b7c567bc5f4360b32ea50bba7fc633efeceb87f32bf66eabcb880763456a30b7486a680aedb8ff92b5cd83

Download Submit
C:\Windows\System\GZIgJrq.exe

Filesize
1.6MB

MD5
d38df6c328977f30d123f2e6edaa6896

SHA1
dac519096b6404c31c7bbe7dba96023f2f98597c

SHA256
7ee8dc1d976e64a111b30951eb6037c4eb1d3511aeda6b93ef6448d6214c592f

SHA512
b99a047ca7a6a55fce66e4a3ede701cd85093ad7ca1d63d8d5a9a34cbbe4b000d882584a624656cccae22280c4465990d8de0d56ee3850c24902ff13f8040f25

Download Submit
C:\Windows\System\LtzHhPv.exe

Filesize
1.6MB

MD5
53be029d834816cef4a4b583c48379cf

SHA1
0f71b5efdd51580fadc401dab3347537d557a7ad

SHA256
d5eb55d6551b1ef291be0b2df9c333533e1ffda792ed2ecaab74b3dfb944a7e3

SHA512
94b4a1fa5b05e687431e1c79321421d79e4d449cf2ab7b7831e7c8e3ff70033fa81bed19d8262de5e9b0ff7955089bbf07c0589951f7e1e4c180ddeeb824ce1e

Download Submit
C:\Windows\System\NJQGeKj.exe

Filesize
1.6MB

MD5
c8c71a7f1e90f98f740c114323c8079f

SHA1
b2abcf7119ee1e052cb8f111281c71ac16998c03

SHA256
d11d1566354f57052d447833ad13979c2910f6ce3c1c93ae3647dd8ff2003295

SHA512
72b20672bef59af842d5a83a6fe572f7ebad9bedc31818817e5bb1ca59dd49e6753e3adebf4b9baaa935fa7061e991199854dd9447320fa0f46b175891128153

Download Submit
C:\Windows\System\NdphFcf.exe

Filesize
1.6MB

MD5
50ac3e37cc57c832e34c07044fd246cc

SHA1
fd62ddd3e7282d6b66299c9682c5d4dc29bf1166

SHA256
03ab8e5d24a1ee02e1db23c8d532eaa67f5e412e30c7f6783963b23e29a6187f

SHA512
65588d28c8dbec2b01b930ece6bddf420e073078365e19256c088a2c4d14102aeaf42fbf69454e8645eb763114a020983b6e77de8a71e19a6dd7d764a3ead4b9

Download Submit
C:\Windows\System\NfVsmYE.exe

Filesize
1.6MB

MD5
89b1f090019b9a7418cd835cdef8832b

SHA1
3a5f9fe77619a2cf1be4b71047d1ac907c9a14f1

SHA256
37f4175ebb3d120019a54a7119f95afaabfd64f0399afedd357229c44978e857

SHA512
3f144515cda8dbd0e9eecc21ac0c32947b19b61759fa9c6bc8209547c7cc86dd02f376b56416803243501bf6cacb2d356b4eec4924ff6687ebf4cd9e83bcc454

Download Submit
C:\Windows\System\QwiKWSz.exe

Filesize
1.6MB

MD5
6ab22ace00d5362415858f1301e575bb

SHA1
498b73e1dec3294fff890b75ae45b38b1136be05

SHA256
19ac58997d1d1e59b28faed0d3fe13adf22e6f94f78c09498678f5ea7dcb9422

SHA512
f58eb0e0a381a7c8fbca846986934ef3cd38c033b0f63173d849e55fd978e72e4d6abb065e34247cf78b1ea7e7de17e9590b81ed909e29e02a6aab3c1853b3af

Download Submit
C:\Windows\System\SwXdctl.exe

Filesize
1.6MB

MD5
693b4d2beff32bbd250698c638af1853

SHA1
86027e60080935425198d14acd76097e8c4844f3

SHA256
889f828778eb4eebc75606126aeae26bd77e8397b636940ba280144ee7abdb76

SHA512
f60ebf9560b865dc335f99bdf2c4254ac2185c867de1da04b7bc1bd736b0f37e0ebe049c13a8b5b37e22d718f698ae85c439ec303cb83d9b79a2f3cbdfaf1e09

Download Submit
C:\Windows\System\TIcCpKc.exe

Filesize
1.6MB

MD5
bf0a4cb6df6d76da6ed5b87bd56d3901

SHA1
9d05a3fe33d659ef7be4e05d7fcffc87abf8d83c

SHA256
521570395b564adc91dece18e06c8d7574c5bcbc6625aa6edd36e22e11d91078

SHA512
c7ff1f36843182cb216a51d42999a1468a4824ed3c49f26e83e0d48a8a757972ccf5a654be00fd31569c142fcfa498ab76f89e216ade37698f31c4512f957655

Download Submit
C:\Windows\System\TRWESFt.exe

Filesize
1.6MB

MD5
81a4671cfaee0130f133284bf960751c

SHA1
fc664a5a20d2597e6368dd5fe64168eb2df2531e

SHA256
8e24c060c3357df150ece380d511bd699b92ff09788a205baef0bfaf6bb14f21

SHA512
0edc8a20b03f9a9de76215a244875fa466184038f18b815273e3872d5bc41759a46a2f3938d4d0c0215c957104e05e61a197ddb20637c3d91e0a636f7e93d60d

Download Submit
C:\Windows\System\VbdFhHk.exe

Filesize
1.6MB

MD5
5ee0097ce29913fb6dab3c6e2ffe3e8b

SHA1
c6ca0016a0ff2720bba6fe96d5be729119e4fba6

SHA256
078e73b57e39f9ccde597f8356dae17fa57934bb10785df1a9a9226c168b5123

SHA512
2d9e670bfad0dff81eabc63e2374524b3875315aed1e6632ac5c6b3e19d7bcbe4b4d7162de2dabdb8dd1a082538868910e8313d58fdaeb64e3ba1bede026913e

Download Submit
C:\Windows\System\WdQXNNQ.exe

Filesize
1.6MB

MD5
fc2772ebce26219f6e3c82545070704f

SHA1
8e444e769ceb9b1e0148fb8343dad920dd9ad6a2

SHA256
c5415da1d4f9b96c179abf3472fa26aa6506ee258beff2c00073a25d8b25f91d

SHA512
339cb109121e1e0b45ea52fbed6414a6adf7b4729691f20bbd477957ddb2d50265ed3936235bd5451035b38ada337af15c7835922be1170fb79c86272cda834d

Download Submit
C:\Windows\System\XgAhpJn.exe

Filesize
1.6MB

MD5
0711b1be2df95e7267b0c541830c4486

SHA1
c7dee6353fc63131c13cc80133de2c16509321a2

SHA256
6ac1abe4fa1d8db0ce544ef4da3bf71ef9d61606d763e4f952e811f496bce1e4

SHA512
419c1e8848de0ddc3e69a70bf68daae540c6a185e3e227c81a08056705d71a59e6868a1d38338e2b1d58c09d47102c28b026683f06e4ae3414a94a2677cf6add

Download Submit
C:\Windows\System\ZIvfKVq.exe

Filesize
1.6MB

MD5
792e67741eaccd0ece33e1e979ba7917

SHA1
57dfec7bf23fcbdc7432ff986efda867da709996

SHA256
698fd962380fb78f0da3a83522070adc3489b551730f408ea562b772bfa5fdee

SHA512
408e94a95737ca55dd089168f9ffb5fa9dd01e7174a4e22a52805e966e64771af7ed37cd541d3008266c16bde41b0f9d22ecb94edc7b7f56f417062031d6d66a

Download Submit
C:\Windows\System\aKqSdGD.exe

Filesize
1.6MB

MD5
2e258b4be85b144dc6e82accf7f4216d

SHA1
15d416f54d85b30ead3e4c1b66eb487895f46b2e

SHA256
5bf8ef7962fe4b3c9b480199049011551760dab19ce4fc275e89756dddb3d8f8

SHA512
8564c207387dce7d15cd8393e4231ebb4022cdf6aa4f4d6034ca6294b21676381ff628043b098c9e5624bfc0b75db57216e13f09cba063fcbe4d5cb93bbed580

Download Submit
C:\Windows\System\bVWjLTA.exe

Filesize
1.6MB

MD5
e3881f34445c5d662981cfe184a7600e

SHA1
5c8d2806c72ce2b0f39fcb95b3ad04ad96e16a69

SHA256
e22fe977cb3c07f34e999c57baf414a42c6436dccdbe70d8f1a4c974568932b2

SHA512
30d868a31ea91c616014148b7c2337bac112168023df51e2a1eb16774ae8c1c338c261742874ed1f31927ec8cdb7aeb852ba6b3603ef7c7c98380b522557ac39

Download Submit
C:\Windows\System\bsLmRio.exe

Filesize
1.6MB

MD5
96b05444dcc042996f7a48e156576b7f

SHA1
269ef31554414e33215e7f45cd437143039ac09b

SHA256
0d166bc68cbe95e9b39d43acafe33ee811e6d912df7f95e09941dd0af9f6b309

SHA512
0cfcb9c39e8b66fda6a077c8bcacdbebd5ffdbd01b0df862511e5efd992b80869cccad0dbf80eb3f1098a9458931d4086ba183b27b6519d977bc8bc89d1b3572

Download Submit
C:\Windows\System\ckAoCpL.exe

Filesize
1.6MB

MD5
bdde670116c346447746175707aabaf4

SHA1
457d64f094c2fa0d082f59de480e1f596bae1328

SHA256
fd83d2a5b06c7b2724ea9dc64c84e394ab8937c929f1fa6191d860468c4db151

SHA512
4ee22f28809bea30e38a1b6c2de95e3418d7ed93d1ed996e57cd6517fff0745830fde93fc0041c8337e0583d6d638127509e35f201b6f42a7d705a23a1d6ffc4

Download Submit
C:\Windows\System\dGEVtPI.exe

Filesize
1.6MB

MD5
d6154049b8b47679606e44845c0e9e84

SHA1
e96fd0009a098b2fdb48b2afd1095a4252ff9209

SHA256
99ed5ae920b0ba4297f4a975d37fc24e346f6c280d080b29e048b68da28f37c6

SHA512
2746de379065a384a5e8ad8ae5cd8783d63d9908de38aab3c4ac1f2effedce6ccbc17ee5b1de501f1e542d77ee08622f3a704babe18b9a8b350a6b2ec521afec

Download Submit
C:\Windows\System\dluysCY.exe

Filesize
1.6MB

MD5
9817fdba5d9d84851f0c779272e5e3a5

SHA1
d120963583b6509b6a33e4118faf1bf6c9360886

SHA256
e471dbaae1f60b3127646565d07a6aa9f94c7ceb16ff3fe35952d6c7b85a03ea

SHA512
da683357f3cbb79c0984ac42f6507d5fad95fb4fc7897cd788f5eb6174605c461afcb2b87d58c55b4e0cb29a589375eb940f6943ddda6ad6d6f63616857eb0b7

Download Submit
C:\Windows\System\eyLWvnO.exe

Filesize
1.6MB

MD5
3ec5650156454e69a5d506b5a96b3036

SHA1
69b2cdaa823bbf6eaf848a85d80afdfaa21fa829

SHA256
367702c95ad1e4ad6a97b478c431e54cca1614dbb0c8fb9cfb1f5b48b89c90bc

SHA512
6a07eb6b77774ea59ae00f50c00c0af75bd9a4bb5e12c3add912f9da6e4749b82ba988b5602ab01effd8f83ad5649295b92f167380e1f39522b0558ccb984635

Download Submit
C:\Windows\System\jxpugZD.exe

Filesize
8B

MD5
f249cce64f1edf5dc7bee5be6e2d5ad9

SHA1
0d569e38ec2ee4118bd367894784a63582261e47

SHA256
c376b4c1019dfb02d31ea3137efb150405ef95ba0305dcf5e026248ffc8d7cc2

SHA512
fdeb5b006eba899c911e624dadfb6c7b2eb030236757e187df8ba8d194a5a42df30b590d0fcf3f859b2532e60fc00c33154f75c1e6481913447ff2fa15b08be2

Download Submit
C:\Windows\System\kFfuBHD.exe

Filesize
1.6MB

MD5
ef35d7b8e615bc9ad84a2cafd2a4e953

SHA1
d19f1e628c2dd2f2798287bbbd900bfa6af0f868

SHA256
c4bbc27f93d9fc90aea830bded4542729e6295fbecac996566e3e9e5282d57ed

SHA512
2e223046070d1d3d179e532396e5cda935f0c93c374e89d352b57a31658b2c2c810868e4484a2192312038d830252b2c8eeaf9eedc21abe15cf0e3f2184e7b56

Download Submit
C:\Windows\System\mZDbyLF.exe

Filesize
1.6MB

MD5
cb575f323ef66c895b127b0ee405695f

SHA1
5708c69308859325447bef8c663a448a8e49c52b

SHA256
c8746d199a2287a0b2e0ce96473f257c455fb0e481e4c4e271f3f5b0bdd8e97d

SHA512
eec66e586a1fcd96c2eb3df59f5cf1f30572a173d7f71b1a800484a60eacd97f9979355264c2af89240c8233440cfdb78e2ce3e880da9820d71486ad742b19e1

Download Submit
C:\Windows\System\nwqCazX.exe

Filesize
1.6MB

MD5
1b6dea3e40d6dc24a179c31f53aaf78b

SHA1
2f34f1174b5bc5d37b3ca11b2f395ec1d840533d

SHA256
a9e3b7b0ea7405747934abd2419cafc034fd202801665f3c3ac09887107f74c5

SHA512
c7f6eb127c56159471dec6dc14c1218be08d6f35b9f3c1acc05d590515a7b91af222d81affe974b53db96bae39b2d17cd29c22374908b4c0e897c9b9fac48e54

Download Submit
C:\Windows\System\pEfCnzK.exe

Filesize
1.6MB

MD5
e8e589c746d78440b56c562f1f580aed

SHA1
a1240df8dee8d640035fa9b98776a0ac4b0761ee

SHA256
ad5c76a416e8ec4a3102faf8309e8ef2ff07ee4545e992c83d54d0426d6c4269

SHA512
468a0f2459da9179ceb41c0b972502fd514dee760a14b64e501713e579fc7b9fed912939e0086bef0bb1c2f7615fc6d94d9ddcf358f949f774d01062952626af

Download Submit
C:\Windows\System\phHoCBY.exe

Filesize
1.6MB

MD5
7358cc539b31e2413989301d5930c410

SHA1
e87afd67a79b16de08db2bf48189c4af4a2300c8

SHA256
06f67f36e49df692a8d157ee01edf74216f67f0f45e711c584bc4fb3435de02d

SHA512
83299dbe56a334ea881db534836b3ac8ee88d9ca685addd80fd4ff15d1e8475c5a0e3e2e91afedb15a6179b0d1f20857bc3422b7257d85624181953a9ad7c1d9

Download Submit
C:\Windows\System\qeXwFzl.exe

Filesize
1.6MB

MD5
3e6ab23e13daedb4b3f442d25a0bb2cf

SHA1
5c47af0dcc943d8b08d06427a43d7040043de519

SHA256
8175f92607baea0f63c115afa9882655a750e08e32b5c905b97e4dbb2144aa87

SHA512
d83dbb9782deecfed68cf344c17a983629ebaf3e9a9462ffb615ca828cd7d481a5730b306007d10337147d777c0be8f4158dab4f3d111e427a411d3eafc36b7c

Download Submit
C:\Windows\System\qyjwxLN.exe

Filesize
1.6MB

MD5
465ad9a3084cf9a11e9e858c2a67dd18

SHA1
2fcf89cda1fb8ffb5babd391a72d04df7035e9b0

SHA256
18551f1a517a6726ec86b88de61507590eb5546f577b84fc2e3e16d46bcdb4eb

SHA512
8ae9422de007c5b0df3c91d69903f1651f16397881c31143443953d41c1469530e08030f55866907d0a86192be0e97ee067e7e7fff985ef048565d69cfff656a

Download Submit
C:\Windows\System\tHrKygf.exe

Filesize
1.6MB

MD5
820ed28d9279f89ba2a3f892d50932df

SHA1
bea994b6f19abe8b5629e60194e11ae9473c323e

SHA256
6f3423d30ab8b18a4aaeb670fcfae85a8cec646b7a517bb3bd58141e00ac96fa

SHA512
4ed76bba48b80fc46709d1952f2a95c2005ba64a6a9e8813224d1c48870e338f53fb6b0a29cbcb3e2518032d019b14c309307469533c29d1a6612baca2d7681e

Download Submit
C:\Windows\System\uwkwFEY.exe

Filesize
1.6MB

MD5
89b7ca5ed1b0c2d1da8eef278b4b89f0

SHA1
5c0be510bbdb7850cbf229a7c6b79ec0b1004945

SHA256
92d7e21ddb888f77f419556fbbb473f52e87b8f4946d965f3b47b3ae4956b0bd

SHA512
2fa76ebd1907d5d9bd107eb38c0c786ff9674a078c99e091b2cce6fa180dc578eb79ec85bad5789b9593b66ecc50cea745c1eb51c95d81fa2a7ac9100a6831eb

Download Submit
C:\Windows\System\wZsZhpK.exe

Filesize
1.6MB

MD5
2075a81a8988b172564f2390ef5228d3

SHA1
8322ef8f8be93546a8769752045afaf8277d9c14

SHA256
15c049854f730c37078ff4734a564a883f534bd971f4d304a7ac48b8146cc730

SHA512
b58046952828807d4d679eed946ce954ef96971b0e862bd8fbaed1ba432c39a4f2d83936f0fa9f0caed5b475b34940c04a60f2cdd6a5142650ec042ccbbf9787

Download Submit
C:\Windows\System\xZEjcYb.exe

Filesize
1.6MB

MD5
6d328966004e02eb38d44d4cdf5fda78

SHA1
94117cf35d22dffd4afd95bbf13f876d3efed074

SHA256
2277714187301becb10809da9e3e481a61cec0ebe410d31f9b9e2661748f849e

SHA512
c9e567841fbdbd74754ec8a9d7b70a574816be6c61cf62af6bdeee7a3fc4a119ba29248691eb580130a9a4efa6608ef64e2ac7f833768e15f924c488590e98ab

Download Submit
C:\Windows\System\xgAvRQE.exe

Filesize
1.6MB

MD5
c87028337573a206e029b77744aeda8c

SHA1
a193d443bb723cf6ca954d5b06d22cb6cc603ed9

SHA256
ee291fd23b70aebb63a57ac2d172ff726e8016b545a1ce61498ae528c8eb3066

SHA512
218b633c9e1d5a92b000e067c21bc83a19759776895685266605e3b45285687fbe21e56189fffa8c40c790abd20778ad47a298b2f12d4311edf08db12edd6c7c

Download Submit
C:\Windows\System\xwSXYDt.exe

Filesize
1.6MB

MD5
b0abcd774c724bd10e47bb2259743a46

SHA1
3b487702208d741d546a228ff29e6dda513e483e

SHA256
7eb8d15e275a376206d934386310eba920f0d7e2a5c2c3948bfb56bd62118450

SHA512
4c19144bdb8552fe39e968f502813785d62b39cfdd51e28650a3c5c613afaac07330b8aaf4a7cdaa724cfe8f39a993133871b761e6097cbe2a0dd645cc284155

Download Submit
C:\Windows\System\zKMqbwL.exe

Filesize
1.6MB

MD5
f24c43960012935efcfb42a54acb702f

SHA1
e1d0d9d94770542b1a946c3c9f9eb7da44933b9d

SHA256
6a06fb17269809337d9c085987c232fb177cf4516b7b2c2195577a9a6763eafd

SHA512
9d95ca70ed9c10fef173e5f9b2687ad97653416291e14ff57d255abc8596aa8e7f4390409c79537f8278c3b6b0acb55c4c2655c90e8bf972cb67787058275937

Download Submit
memory/436-3623-0x00007FF67A6C0000-0x00007FF67AAB2000-memory.dmp

Filesize
3.9MB

Download
memory/436-640-0x00007FF67A6C0000-0x00007FF67AAB2000-memory.dmp

Filesize
3.9MB

Download
memory/860-3607-0x00007FF6ACCC0000-0x00007FF6AD0B2000-memory.dmp

Filesize
3.9MB

Download
memory/860-698-0x00007FF6ACCC0000-0x00007FF6AD0B2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-302-0x00007FF6A5E80000-0x00007FF6A6272000-memory.dmp

Filesize
3.9MB

Download
memory/1040-3613-0x00007FF6A5E80000-0x00007FF6A6272000-memory.dmp

Filesize
3.9MB

Download
memory/1044-3660-0x00007FF724720000-0x00007FF724B12000-memory.dmp

Filesize
3.9MB

Download
memory/1044-696-0x00007FF724720000-0x00007FF724B12000-memory.dmp

Filesize
3.9MB

Download
memory/1316-3617-0x00007FF664B90000-0x00007FF664F82000-memory.dmp

Filesize
3.9MB

Download
memory/1316-176-0x00007FF664B90000-0x00007FF664F82000-memory.dmp

Filesize
3.9MB

Download
memory/1432-3621-0x00007FF69AD30000-0x00007FF69B122000-memory.dmp

Filesize
3.9MB

Download
memory/1432-699-0x00007FF69AD30000-0x00007FF69B122000-memory.dmp

Filesize
3.9MB

Download
memory/1456-3647-0x00007FF795700000-0x00007FF795AF2000-memory.dmp

Filesize
3.9MB

Download
memory/1456-687-0x00007FF795700000-0x00007FF795AF2000-memory.dmp

Filesize
3.9MB

Download
memory/1608-235-0x00007FF7B3700000-0x00007FF7B3AF2000-memory.dmp

Filesize
3.9MB

Download
memory/1608-3619-0x00007FF7B3700000-0x00007FF7B3AF2000-memory.dmp

Filesize
3.9MB

Download
memory/1948-3611-0x00007FF6ED380000-0x00007FF6ED772000-memory.dmp

Filesize
3.9MB

Download
memory/1948-56-0x00007FF6ED380000-0x00007FF6ED772000-memory.dmp

Filesize
3.9MB

Download
memory/2336-693-0x00007FF7750B0000-0x00007FF7754A2000-memory.dmp

Filesize
3.9MB

Download
memory/2336-3643-0x00007FF7750B0000-0x00007FF7754A2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-3637-0x00007FF715BC0000-0x00007FF715FB2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-688-0x00007FF715BC0000-0x00007FF715FB2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-691-0x00007FF7E4400000-0x00007FF7E47F2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-3666-0x00007FF7E4400000-0x00007FF7E47F2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-3616-0x00007FF66BF30000-0x00007FF66C322000-memory.dmp

Filesize
3.9MB

Download
memory/2968-362-0x00007FF66BF30000-0x00007FF66C322000-memory.dmp

Filesize
3.9MB

Download
memory/3776-694-0x00007FF6E8E60000-0x00007FF6E9252000-memory.dmp

Filesize
3.9MB

Download
memory/3776-3656-0x00007FF6E8E60000-0x00007FF6E9252000-memory.dmp

Filesize
3.9MB

Download
memory/4180-685-0x00007FF633670000-0x00007FF633A62000-memory.dmp

Filesize
3.9MB

Download
memory/4180-3645-0x00007FF633670000-0x00007FF633A62000-memory.dmp

Filesize
3.9MB

Download
memory/4228-697-0x00007FF787CC0000-0x00007FF7880B2000-memory.dmp

Filesize
3.9MB

Download
memory/4228-3639-0x00007FF787CC0000-0x00007FF7880B2000-memory.dmp

Filesize
3.9MB

Download
memory/4256-3627-0x00007FF7A88D0000-0x00007FF7A8CC2000-memory.dmp

Filesize
3.9MB

Download
memory/4256-690-0x00007FF7A88D0000-0x00007FF7A8CC2000-memory.dmp

Filesize
3.9MB

Download
memory/4360-173-0x00007FF68C760000-0x00007FF68CB52000-memory.dmp

Filesize
3.9MB

Download
memory/4360-3610-0x00007FF68C760000-0x00007FF68CB52000-memory.dmp

Filesize
3.9MB

Download
memory/4420-3633-0x00007FF7A6B80000-0x00007FF7A6F72000-memory.dmp

Filesize
3.9MB

Download
memory/4420-689-0x00007FF7A6B80000-0x00007FF7A6F72000-memory.dmp

Filesize
3.9MB

Download
memory/4512-473-0x00007FF6AA520000-0x00007FF6AA912000-memory.dmp

Filesize
3.9MB

Download
memory/4512-3625-0x00007FF6AA520000-0x00007FF6AA912000-memory.dmp

Filesize
3.9MB

Download
memory/4592-692-0x00007FF77E470000-0x00007FF77E862000-memory.dmp

Filesize
3.9MB

Download
memory/4592-3635-0x00007FF77E470000-0x00007FF77E862000-memory.dmp

Filesize
3.9MB

Download
memory/4704-3649-0x00007FF6C7960000-0x00007FF6C7D52000-memory.dmp

Filesize
3.9MB

Download
memory/4704-695-0x00007FF6C7960000-0x00007FF6C7D52000-memory.dmp

Filesize
3.9MB

Download
memory/4708-140-0x00007FF9D9340000-0x00007FF9D9E01000-memory.dmp

Filesize
10.8MB

Download
memory/4708-1896-0x00007FF9D9340000-0x00007FF9D9E01000-memory.dmp

Filesize
10.8MB

Download
memory/4708-94-0x000002277BD20000-0x000002277BD42000-memory.dmp

Filesize
136KB

Download
memory/4708-50-0x00007FF9D9340000-0x00007FF9D9E01000-memory.dmp

Filesize
10.8MB

Download
memory/4708-4-0x00007FF9D9343000-0x00007FF9D9345000-memory.dmp

Filesize
8KB

Download
memory/4760-700-0x00007FF6C7410000-0x00007FF6C7802000-memory.dmp

Filesize
3.9MB

Download
memory/4760-3631-0x00007FF6C7410000-0x00007FF6C7802000-memory.dmp

Filesize
3.9MB

Download
memory/4880-1-0x0000013810E70000-0x0000013810E80000-memory.dmp

Filesize
64KB

Download
memory/4880-0-0x00007FF7EE400000-0x00007FF7EE7F2000-memory.dmp

Filesize
3.9MB

Download
memory/4964-3629-0x00007FF6BED90000-0x00007FF6BF182000-memory.dmp

Filesize
3.9MB

Download
memory/4964-636-0x00007FF6BED90000-0x00007FF6BF182000-memory.dmp

Filesize
3.9MB

Download