xmrig | c2db86a430b2f7b807d91d654a661d5b4f60a74c6b745654934fe350ba4dd73e

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
Size

1.5MB
MD5

405d8f5f6ca96498f678d25c1e2c2c30
SHA1

abb2fddb43c233b6d4fce2ee6cc7fd5bc61371dc
SHA256

c2db86a430b2f7b807d91d654a661d5b4f60a74c6b745654934fe350ba4dd73e
SHA512

08de438c14da1efee38535b1037d9e83978c2d12a7f5032e58bab011858801b37ea36a52ca35882719e3323e9e82ad7ae75c5e5182043a3d2a386d41c385df88
SSDEEP

24576:zv3/fTLF671TilQFG4P5PmK/lzapbU4w2DyA7lO1eANsT4kwu04a/z:Lz071uv4BPm6lgVJUwAdz

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/2568-494-0x00007FF776F10000-0x00007FF777302000-memory.dmp	xmrig
behavioral2/memory/3428-602-0x00007FF6327B0000-0x00007FF632BA2000-memory.dmp	xmrig
behavioral2/memory/1632-607-0x00007FF700980000-0x00007FF700D72000-memory.dmp	xmrig
behavioral2/memory/2536-614-0x00007FF6AD410000-0x00007FF6AD802000-memory.dmp	xmrig
behavioral2/memory/5100-615-0x00007FF6593C0000-0x00007FF6597B2000-memory.dmp	xmrig
behavioral2/memory/3936-613-0x00007FF7F6C10000-0x00007FF7F7002000-memory.dmp	xmrig
behavioral2/memory/4520-612-0x00007FF79E8D0000-0x00007FF79ECC2000-memory.dmp	xmrig
behavioral2/memory/4496-611-0x00007FF75FB10000-0x00007FF75FF02000-memory.dmp	xmrig
behavioral2/memory/4912-610-0x00007FF6112F0000-0x00007FF6116E2000-memory.dmp	xmrig
behavioral2/memory/4876-609-0x00007FF78F360000-0x00007FF78F752000-memory.dmp	xmrig
behavioral2/memory/4584-608-0x00007FF74A830000-0x00007FF74AC22000-memory.dmp	xmrig
behavioral2/memory/3992-606-0x00007FF7C45C0000-0x00007FF7C49B2000-memory.dmp	xmrig
behavioral2/memory/2804-605-0x00007FF7C8A90000-0x00007FF7C8E82000-memory.dmp	xmrig
behavioral2/memory/2288-604-0x00007FF690C40000-0x00007FF691032000-memory.dmp	xmrig
behavioral2/memory/1880-603-0x00007FF70C240000-0x00007FF70C632000-memory.dmp	xmrig
behavioral2/memory/2884-314-0x00007FF7291B0000-0x00007FF7295A2000-memory.dmp	xmrig
behavioral2/memory/1336-279-0x00007FF7D7FD0000-0x00007FF7D83C2000-memory.dmp	xmrig
behavioral2/memory/2572-253-0x00007FF773830000-0x00007FF773C22000-memory.dmp	xmrig
behavioral2/memory/4216-158-0x00007FF618270000-0x00007FF618662000-memory.dmp	xmrig
behavioral2/memory/4032-4012-0x00007FF7CD230000-0x00007FF7CD622000-memory.dmp	xmrig
behavioral2/memory/612-4014-0x00007FF78CD00000-0x00007FF78D0F2000-memory.dmp	xmrig
behavioral2/memory/4216-4018-0x00007FF618270000-0x00007FF618662000-memory.dmp	xmrig
behavioral2/memory/2572-4020-0x00007FF773830000-0x00007FF773C22000-memory.dmp	xmrig
behavioral2/memory/1336-4022-0x00007FF7D7FD0000-0x00007FF7D83C2000-memory.dmp	xmrig
behavioral2/memory/4520-4017-0x00007FF79E8D0000-0x00007FF79ECC2000-memory.dmp	xmrig
behavioral2/memory/3936-4036-0x00007FF7F6C10000-0x00007FF7F7002000-memory.dmp	xmrig
behavioral2/memory/3992-4038-0x00007FF7C45C0000-0x00007FF7C49B2000-memory.dmp	xmrig
behavioral2/memory/3700-4040-0x00007FF72C620000-0x00007FF72CA12000-memory.dmp	xmrig
behavioral2/memory/2884-4035-0x00007FF7291B0000-0x00007FF7295A2000-memory.dmp	xmrig
behavioral2/memory/2568-4033-0x00007FF776F10000-0x00007FF777302000-memory.dmp	xmrig
behavioral2/memory/3332-4029-0x00007FF7E4730000-0x00007FF7E4B22000-memory.dmp	xmrig
behavioral2/memory/1696-4027-0x00007FF7F3E20000-0x00007FF7F4212000-memory.dmp	xmrig
behavioral2/memory/3428-4031-0x00007FF6327B0000-0x00007FF632BA2000-memory.dmp	xmrig
behavioral2/memory/2288-4025-0x00007FF690C40000-0x00007FF691032000-memory.dmp	xmrig
behavioral2/memory/4584-4069-0x00007FF74A830000-0x00007FF74AC22000-memory.dmp	xmrig
behavioral2/memory/4496-4068-0x00007FF75FB10000-0x00007FF75FF02000-memory.dmp	xmrig
behavioral2/memory/4912-4065-0x00007FF6112F0000-0x00007FF6116E2000-memory.dmp	xmrig
behavioral2/memory/1632-4063-0x00007FF700980000-0x00007FF700D72000-memory.dmp	xmrig
behavioral2/memory/2804-4062-0x00007FF7C8A90000-0x00007FF7C8E82000-memory.dmp	xmrig
behavioral2/memory/4876-4047-0x00007FF78F360000-0x00007FF78F752000-memory.dmp	xmrig
behavioral2/memory/2536-4054-0x00007FF6AD410000-0x00007FF6AD802000-memory.dmp	xmrig
behavioral2/memory/5100-4049-0x00007FF6593C0000-0x00007FF6597B2000-memory.dmp	xmrig
behavioral2/memory/1880-4042-0x00007FF70C240000-0x00007FF70C632000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2560 powershell.exe

pid	process
2560	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

HxwFCJE.exeqhxSFjk.exeXjggNPj.exeuAbUvuM.exeeXCFrBU.exehHNNUxE.exeJPFROMP.exeGmRQdAS.exeLKJoEeu.exeysyXaqK.exeeHJbeBJ.exeylZCWIU.exeCuoNSZm.exeMWtSsuV.exeWPYblGJ.exeZAAfbOM.exeiFFlmId.exeKzXVDms.exenNNmAEj.exerToUIEq.exerooxNUw.exeTOsDEKX.exeBDMStOA.exegTZnISP.exeyTankfn.exefoaDUdk.exeIiRJNnU.exeGdsfAhs.exenDYeCVj.exeTOZaoRl.exeCBXhaNP.exepBsaDdS.exeNXHUdAQ.exeWVxuxQw.exeudTVtvu.exeBtsHHhC.exeSYLlYUn.exepXuDZRi.exeBhfOLLA.exehppeLVy.exeqaDsOVQ.exeFfRxYwG.exexDEkwXU.exeNQgVXfT.execpEVgYL.exezlECkED.exeoYHEqJs.exepKVhRbg.exesxyEtQU.exeEmPUHCS.exehNkzxFj.exegjKqhCP.exeGiVDWFD.execdbDEUo.exeBrswvxV.exeTDHJczr.exevQBxddI.exeyoHsdsr.exeJciHLXc.exeATqXkGz.exegqSKcQG.exekXikqVB.exeVXYRgYd.exeinKcSEW.exe

pid	process
612	HxwFCJE.exe
4032	qhxSFjk.exe
4520	XjggNPj.exe
3332	uAbUvuM.exe
3700	eXCFrBU.exe
1696	hHNNUxE.exe
4216	JPFROMP.exe
2572	GmRQdAS.exe
1336	LKJoEeu.exe
3936	ysyXaqK.exe
2884	eHJbeBJ.exe
2568	ylZCWIU.exe
3428	CuoNSZm.exe
1880	MWtSsuV.exe
2288	WPYblGJ.exe
2804	ZAAfbOM.exe
2536	iFFlmId.exe
3992	KzXVDms.exe
1632	nNNmAEj.exe
5100	rToUIEq.exe
4584	rooxNUw.exe
4876	TOsDEKX.exe
4912	BDMStOA.exe
4496	gTZnISP.exe
3784	yTankfn.exe
1548	foaDUdk.exe
812	IiRJNnU.exe
2532	GdsfAhs.exe
4980	nDYeCVj.exe
3172	TOZaoRl.exe
1900	CBXhaNP.exe
1196	pBsaDdS.exe
2768	NXHUdAQ.exe
4332	WVxuxQw.exe
1236	udTVtvu.exe
1908	BtsHHhC.exe
1520	SYLlYUn.exe
1244	pXuDZRi.exe
3376	BhfOLLA.exe
2244	hppeLVy.exe
1212	qaDsOVQ.exe
1840	FfRxYwG.exe
1044	xDEkwXU.exe
1136	NQgVXfT.exe
2336	cpEVgYL.exe
688	zlECkED.exe
4252	oYHEqJs.exe
4120	pKVhRbg.exe
3064	sxyEtQU.exe
4784	EmPUHCS.exe
3564	hNkzxFj.exe
2544	gjKqhCP.exe
4976	GiVDWFD.exe
3716	cdbDEUo.exe
3676	BrswvxV.exe
2340	TDHJczr.exe
324	vQBxddI.exe
4964	yoHsdsr.exe
4616	JciHLXc.exe
2760	ATqXkGz.exe
3760	gqSKcQG.exe
3496	kXikqVB.exe
4320	VXYRgYd.exe
3996	inKcSEW.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4664-0-0x00007FF6249B0000-0x00007FF624DA2000-memory.dmp	upx
C:\Windows\System\HxwFCJE.exe	upx
C:\Windows\System\XjggNPj.exe	upx
C:\Windows\System\GmRQdAS.exe	upx
C:\Windows\System\iFFlmId.exe	upx
C:\Windows\System\gTZnISP.exe	upx
C:\Windows\System\BhfOLLA.exe	upx
behavioral2/memory/2568-494-0x00007FF776F10000-0x00007FF777302000-memory.dmp	upx
behavioral2/memory/3428-602-0x00007FF6327B0000-0x00007FF632BA2000-memory.dmp	upx
behavioral2/memory/1632-607-0x00007FF700980000-0x00007FF700D72000-memory.dmp	upx
behavioral2/memory/2536-614-0x00007FF6AD410000-0x00007FF6AD802000-memory.dmp	upx
behavioral2/memory/5100-615-0x00007FF6593C0000-0x00007FF6597B2000-memory.dmp	upx
behavioral2/memory/3936-613-0x00007FF7F6C10000-0x00007FF7F7002000-memory.dmp	upx
behavioral2/memory/4520-612-0x00007FF79E8D0000-0x00007FF79ECC2000-memory.dmp	upx
behavioral2/memory/4496-611-0x00007FF75FB10000-0x00007FF75FF02000-memory.dmp	upx
behavioral2/memory/4912-610-0x00007FF6112F0000-0x00007FF6116E2000-memory.dmp	upx
behavioral2/memory/4876-609-0x00007FF78F360000-0x00007FF78F752000-memory.dmp	upx
behavioral2/memory/4584-608-0x00007FF74A830000-0x00007FF74AC22000-memory.dmp	upx
behavioral2/memory/3992-606-0x00007FF7C45C0000-0x00007FF7C49B2000-memory.dmp	upx
behavioral2/memory/2804-605-0x00007FF7C8A90000-0x00007FF7C8E82000-memory.dmp	upx
behavioral2/memory/2288-604-0x00007FF690C40000-0x00007FF691032000-memory.dmp	upx
behavioral2/memory/1880-603-0x00007FF70C240000-0x00007FF70C632000-memory.dmp	upx
behavioral2/memory/2884-314-0x00007FF7291B0000-0x00007FF7295A2000-memory.dmp	upx
behavioral2/memory/1336-279-0x00007FF7D7FD0000-0x00007FF7D83C2000-memory.dmp	upx
behavioral2/memory/2572-253-0x00007FF773830000-0x00007FF773C22000-memory.dmp	upx
C:\Windows\System\NQgVXfT.exe	upx
C:\Windows\System\FfRxYwG.exe	upx
C:\Windows\System\qaDsOVQ.exe	upx
C:\Windows\System\hppeLVy.exe	upx
C:\Windows\System\pXuDZRi.exe	upx
C:\Windows\System\SYLlYUn.exe	upx
C:\Windows\System\BtsHHhC.exe	upx
C:\Windows\System\udTVtvu.exe	upx
C:\Windows\System\WVxuxQw.exe	upx
C:\Windows\System\NXHUdAQ.exe	upx
C:\Windows\System\pBsaDdS.exe	upx
C:\Windows\System\CBXhaNP.exe	upx
C:\Windows\System\rToUIEq.exe	upx
behavioral2/memory/4216-158-0x00007FF618270000-0x00007FF618662000-memory.dmp	upx
C:\Windows\System\TOZaoRl.exe	upx
C:\Windows\System\nDYeCVj.exe	upx
C:\Windows\System\nNNmAEj.exe	upx
C:\Windows\System\IiRJNnU.exe	upx
C:\Windows\System\xDEkwXU.exe	upx
C:\Windows\System\KzXVDms.exe	upx
C:\Windows\System\ZAAfbOM.exe	upx
C:\Windows\System\WPYblGJ.exe	upx
C:\Windows\System\foaDUdk.exe	upx
C:\Windows\System\yTankfn.exe	upx
C:\Windows\System\MWtSsuV.exe	upx
C:\Windows\System\rooxNUw.exe	upx
C:\Windows\System\eXCFrBU.exe	upx
C:\Windows\System\CuoNSZm.exe	upx
C:\Windows\System\ylZCWIU.exe	upx
C:\Windows\System\eHJbeBJ.exe	upx
C:\Windows\System\ysyXaqK.exe	upx
behavioral2/memory/1696-101-0x00007FF7F3E20000-0x00007FF7F4212000-memory.dmp	upx
behavioral2/memory/3700-98-0x00007FF72C620000-0x00007FF72CA12000-memory.dmp	upx
C:\Windows\System\GdsfAhs.exe	upx
C:\Windows\System\BDMStOA.exe	upx
C:\Windows\System\LKJoEeu.exe	upx
C:\Windows\System\TOsDEKX.exe	upx
C:\Windows\System\JPFROMP.exe	upx
C:\Windows\System\hHNNUxE.exe	upx

Drops file in Windows directory 64 IoCs

Processes:

405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\System\CVvcUxY.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\EMadgVT.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\PeAXgrM.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\YIMnSoq.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\lLlgJLr.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\ZvcPUPj.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\MNVePVc.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\KRnuqes.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\GvaDaDM.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\jRBkBtT.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\CaAkkIP.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\qQbpaGz.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\RbqSpXK.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\JqzpmCY.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\uhVuHJE.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\YLJKkrh.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\UCztsly.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\BziYkeh.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\PTUYMtB.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\NiwnChk.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\WTzGdtb.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\lYXWfZp.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\SJuQFGL.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\nKIVpmy.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\HnrkNlF.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\fglNGaM.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\LMvYgnv.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\jNQOBhn.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\NLdHPkH.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\fnGUQCw.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\nBHDnkf.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\zycCmNb.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\cLQObCe.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\MtabpPX.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\uxEgWzg.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\kDGRwPk.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\XoHvYRu.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\buXUvsC.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\FDrLiEj.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\MTHqviu.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\dosuiLp.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\oJRCLeJ.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\oGvjnlK.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\MYQFINo.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\eMPczbf.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\WFzXlUD.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\KXfuKSm.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\juKRkhm.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\GVWxKVx.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\kQmkCqB.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\OBWAFIE.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\MqLViKR.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\nuCeimB.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\WgtMUvp.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\dtPeKnw.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\SrOUDhD.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\PVaBdwF.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\SCpLPlV.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\TIRqPwT.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\ADVluTy.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\kwvBEXe.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\KVvwttY.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\KmpMrDV.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
File created	C:\Windows\System\UxaZhUu.exe	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exe

pid process

2560 powershell.exe
2560 powershell.exe
2560 powershell.exe
2560 powershell.exe

pid	process
2560	powershell.exe
2560	powershell.exe
2560	powershell.exe
2560	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeLockMemoryPrivilege	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe

description	pid	process	target process
PID 4664 wrote to memory of 2560	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	powershell.exe
PID 4664 wrote to memory of 2560	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	powershell.exe
PID 4664 wrote to memory of 612	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	HxwFCJE.exe
PID 4664 wrote to memory of 612	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	HxwFCJE.exe
PID 4664 wrote to memory of 4032	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	qhxSFjk.exe
PID 4664 wrote to memory of 4032	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	qhxSFjk.exe
PID 4664 wrote to memory of 4520	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	XjggNPj.exe
PID 4664 wrote to memory of 4520	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	XjggNPj.exe
PID 4664 wrote to memory of 3332	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	uAbUvuM.exe
PID 4664 wrote to memory of 3332	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	uAbUvuM.exe
PID 4664 wrote to memory of 3700	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	eXCFrBU.exe
PID 4664 wrote to memory of 3700	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	eXCFrBU.exe
PID 4664 wrote to memory of 1696	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	hHNNUxE.exe
PID 4664 wrote to memory of 1696	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	hHNNUxE.exe
PID 4664 wrote to memory of 4216	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	JPFROMP.exe
PID 4664 wrote to memory of 4216	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	JPFROMP.exe
PID 4664 wrote to memory of 2572	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	GmRQdAS.exe
PID 4664 wrote to memory of 2572	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	GmRQdAS.exe
PID 4664 wrote to memory of 1336	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	LKJoEeu.exe
PID 4664 wrote to memory of 1336	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	LKJoEeu.exe
PID 4664 wrote to memory of 3936	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	ysyXaqK.exe
PID 4664 wrote to memory of 3936	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	ysyXaqK.exe
PID 4664 wrote to memory of 2884	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	eHJbeBJ.exe
PID 4664 wrote to memory of 2884	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	eHJbeBJ.exe
PID 4664 wrote to memory of 2568	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	ylZCWIU.exe
PID 4664 wrote to memory of 2568	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	ylZCWIU.exe
PID 4664 wrote to memory of 3428	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	CuoNSZm.exe
PID 4664 wrote to memory of 3428	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	CuoNSZm.exe
PID 4664 wrote to memory of 1880	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	MWtSsuV.exe
PID 4664 wrote to memory of 1880	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	MWtSsuV.exe
PID 4664 wrote to memory of 2288	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	WPYblGJ.exe
PID 4664 wrote to memory of 2288	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	WPYblGJ.exe
PID 4664 wrote to memory of 2804	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	ZAAfbOM.exe
PID 4664 wrote to memory of 2804	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	ZAAfbOM.exe
PID 4664 wrote to memory of 2536	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	iFFlmId.exe
PID 4664 wrote to memory of 2536	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	iFFlmId.exe
PID 4664 wrote to memory of 3992	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	KzXVDms.exe
PID 4664 wrote to memory of 3992	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	KzXVDms.exe
PID 4664 wrote to memory of 2532	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	GdsfAhs.exe
PID 4664 wrote to memory of 2532	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	GdsfAhs.exe
PID 4664 wrote to memory of 1632	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	nNNmAEj.exe
PID 4664 wrote to memory of 1632	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	nNNmAEj.exe
PID 4664 wrote to memory of 5100	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	rToUIEq.exe
PID 4664 wrote to memory of 5100	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	rToUIEq.exe
PID 4664 wrote to memory of 4584	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	rooxNUw.exe
PID 4664 wrote to memory of 4584	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	rooxNUw.exe
PID 4664 wrote to memory of 4876	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	TOsDEKX.exe
PID 4664 wrote to memory of 4876	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	TOsDEKX.exe
PID 4664 wrote to memory of 4912	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	BDMStOA.exe
PID 4664 wrote to memory of 4912	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	BDMStOA.exe
PID 4664 wrote to memory of 4496	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	gTZnISP.exe
PID 4664 wrote to memory of 4496	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	gTZnISP.exe
PID 4664 wrote to memory of 3784	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	yTankfn.exe
PID 4664 wrote to memory of 3784	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	yTankfn.exe
PID 4664 wrote to memory of 1548	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	foaDUdk.exe
PID 4664 wrote to memory of 1548	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	foaDUdk.exe
PID 4664 wrote to memory of 1840	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	FfRxYwG.exe
PID 4664 wrote to memory of 1840	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	FfRxYwG.exe
PID 4664 wrote to memory of 812	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	IiRJNnU.exe
PID 4664 wrote to memory of 812	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	IiRJNnU.exe
PID 4664 wrote to memory of 4980	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	nDYeCVj.exe
PID 4664 wrote to memory of 4980	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	nDYeCVj.exe
PID 4664 wrote to memory of 3172	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	TOZaoRl.exe
PID 4664 wrote to memory of 3172	4664	405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe	TOZaoRl.exe

C:\Users\Admin\AppData\Local\Temp\405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\405d8f5f6ca96498f678d25c1e2c2c30_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\System\HxwFCJE.exe
  C:\Windows\System\HxwFCJE.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\qhxSFjk.exe
  C:\Windows\System\qhxSFjk.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\XjggNPj.exe
  C:\Windows\System\XjggNPj.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\uAbUvuM.exe
  C:\Windows\System\uAbUvuM.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\eXCFrBU.exe
  C:\Windows\System\eXCFrBU.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\hHNNUxE.exe
  C:\Windows\System\hHNNUxE.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\JPFROMP.exe
  C:\Windows\System\JPFROMP.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\GmRQdAS.exe
  C:\Windows\System\GmRQdAS.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\LKJoEeu.exe
  C:\Windows\System\LKJoEeu.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\ysyXaqK.exe
  C:\Windows\System\ysyXaqK.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\eHJbeBJ.exe
  C:\Windows\System\eHJbeBJ.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\ylZCWIU.exe
  C:\Windows\System\ylZCWIU.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\CuoNSZm.exe
  C:\Windows\System\CuoNSZm.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\MWtSsuV.exe
  C:\Windows\System\MWtSsuV.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\WPYblGJ.exe
  C:\Windows\System\WPYblGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\ZAAfbOM.exe
  C:\Windows\System\ZAAfbOM.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\iFFlmId.exe
  C:\Windows\System\iFFlmId.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\KzXVDms.exe
  C:\Windows\System\KzXVDms.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\GdsfAhs.exe
  C:\Windows\System\GdsfAhs.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\nNNmAEj.exe
  C:\Windows\System\nNNmAEj.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\rToUIEq.exe
  C:\Windows\System\rToUIEq.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\rooxNUw.exe
  C:\Windows\System\rooxNUw.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\TOsDEKX.exe
  C:\Windows\System\TOsDEKX.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\BDMStOA.exe
  C:\Windows\System\BDMStOA.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\gTZnISP.exe
  C:\Windows\System\gTZnISP.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\yTankfn.exe
  C:\Windows\System\yTankfn.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\foaDUdk.exe
  C:\Windows\System\foaDUdk.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\FfRxYwG.exe
  C:\Windows\System\FfRxYwG.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\IiRJNnU.exe
  C:\Windows\System\IiRJNnU.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\nDYeCVj.exe
  C:\Windows\System\nDYeCVj.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\TOZaoRl.exe
  C:\Windows\System\TOZaoRl.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\CBXhaNP.exe
  C:\Windows\System\CBXhaNP.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\pBsaDdS.exe
  C:\Windows\System\pBsaDdS.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\NXHUdAQ.exe
  C:\Windows\System\NXHUdAQ.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\WVxuxQw.exe
  C:\Windows\System\WVxuxQw.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\udTVtvu.exe
  C:\Windows\System\udTVtvu.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\BtsHHhC.exe
  C:\Windows\System\BtsHHhC.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\SYLlYUn.exe
  C:\Windows\System\SYLlYUn.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\pXuDZRi.exe
  C:\Windows\System\pXuDZRi.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\BhfOLLA.exe
  C:\Windows\System\BhfOLLA.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\hppeLVy.exe
  C:\Windows\System\hppeLVy.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\qaDsOVQ.exe
  C:\Windows\System\qaDsOVQ.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\xDEkwXU.exe
  C:\Windows\System\xDEkwXU.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\NQgVXfT.exe
  C:\Windows\System\NQgVXfT.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\cpEVgYL.exe
  C:\Windows\System\cpEVgYL.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\zlECkED.exe
  C:\Windows\System\zlECkED.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\oYHEqJs.exe
  C:\Windows\System\oYHEqJs.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\pKVhRbg.exe
  C:\Windows\System\pKVhRbg.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\sxyEtQU.exe
  C:\Windows\System\sxyEtQU.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\EmPUHCS.exe
  C:\Windows\System\EmPUHCS.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\hNkzxFj.exe
  C:\Windows\System\hNkzxFj.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\gjKqhCP.exe
  C:\Windows\System\gjKqhCP.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\GiVDWFD.exe
  C:\Windows\System\GiVDWFD.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\cdbDEUo.exe
  C:\Windows\System\cdbDEUo.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\BrswvxV.exe
  C:\Windows\System\BrswvxV.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\TDHJczr.exe
  C:\Windows\System\TDHJczr.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\vQBxddI.exe
  C:\Windows\System\vQBxddI.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\yoHsdsr.exe
  C:\Windows\System\yoHsdsr.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\JciHLXc.exe
  C:\Windows\System\JciHLXc.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\ATqXkGz.exe
  C:\Windows\System\ATqXkGz.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\gqSKcQG.exe
  C:\Windows\System\gqSKcQG.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\kXikqVB.exe
  C:\Windows\System\kXikqVB.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\VXYRgYd.exe
  C:\Windows\System\VXYRgYd.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\inKcSEW.exe
  C:\Windows\System\inKcSEW.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\cCKIGjD.exe
  C:\Windows\System\cCKIGjD.exe
  2⤵
  PID:4556
- C:\Windows\System\SQoOKwr.exe
  C:\Windows\System\SQoOKwr.exe
  2⤵
  PID:1180
- C:\Windows\System\LqiTfOM.exe
  C:\Windows\System\LqiTfOM.exe
  2⤵
  PID:2576
- C:\Windows\System\redihqr.exe
  C:\Windows\System\redihqr.exe
  2⤵
  PID:264
- C:\Windows\System\QiHQHxw.exe
  C:\Windows\System\QiHQHxw.exe
  2⤵
  PID:1524
- C:\Windows\System\UuMByHt.exe
  C:\Windows\System\UuMByHt.exe
  2⤵
  PID:4732
- C:\Windows\System\NIpRMpz.exe
  C:\Windows\System\NIpRMpz.exe
  2⤵
  PID:4700
- C:\Windows\System\xlitian.exe
  C:\Windows\System\xlitian.exe
  2⤵
  PID:3520
- C:\Windows\System\iSEJElt.exe
  C:\Windows\System\iSEJElt.exe
  2⤵
  PID:2692
- C:\Windows\System\CPfZhHS.exe
  C:\Windows\System\CPfZhHS.exe
  2⤵
  PID:3180
- C:\Windows\System\cJFLLRw.exe
  C:\Windows\System\cJFLLRw.exe
  2⤵
  PID:4416
- C:\Windows\System\vGsHVPQ.exe
  C:\Windows\System\vGsHVPQ.exe
  2⤵
  PID:1804
- C:\Windows\System\ULXFZML.exe
  C:\Windows\System\ULXFZML.exe
  2⤵
  PID:3816
- C:\Windows\System\ouzfVeC.exe
  C:\Windows\System\ouzfVeC.exe
  2⤵
  PID:3160
- C:\Windows\System\SMbEcdf.exe
  C:\Windows\System\SMbEcdf.exe
  2⤵
  PID:1444
- C:\Windows\System\vhlsOyh.exe
  C:\Windows\System\vhlsOyh.exe
  2⤵
  PID:2628
- C:\Windows\System\VYzeUuQ.exe
  C:\Windows\System\VYzeUuQ.exe
  2⤵
  PID:3684
- C:\Windows\System\huHxPlo.exe
  C:\Windows\System\huHxPlo.exe
  2⤵
  PID:3548
- C:\Windows\System\TmElPxr.exe
  C:\Windows\System\TmElPxr.exe
  2⤵
  PID:5128
- C:\Windows\System\JnkJOSD.exe
  C:\Windows\System\JnkJOSD.exe
  2⤵
  PID:5152
- C:\Windows\System\vVdiTZJ.exe
  C:\Windows\System\vVdiTZJ.exe
  2⤵
  PID:5176
- C:\Windows\System\QkaXCuR.exe
  C:\Windows\System\QkaXCuR.exe
  2⤵
  PID:5196
- C:\Windows\System\iesntgv.exe
  C:\Windows\System\iesntgv.exe
  2⤵
  PID:5212
- C:\Windows\System\GKRcdKd.exe
  C:\Windows\System\GKRcdKd.exe
  2⤵
  PID:5296
- C:\Windows\System\qRPfbBA.exe
  C:\Windows\System\qRPfbBA.exe
  2⤵
  PID:5316
- C:\Windows\System\WvvnrFV.exe
  C:\Windows\System\WvvnrFV.exe
  2⤵
  PID:5336
- C:\Windows\System\ZbDoaEt.exe
  C:\Windows\System\ZbDoaEt.exe
  2⤵
  PID:5356
- C:\Windows\System\ZKdsLMg.exe
  C:\Windows\System\ZKdsLMg.exe
  2⤵
  PID:5376
- C:\Windows\System\JfEJzce.exe
  C:\Windows\System\JfEJzce.exe
  2⤵
  PID:5400
- C:\Windows\System\miCCnbJ.exe
  C:\Windows\System\miCCnbJ.exe
  2⤵
  PID:5420
- C:\Windows\System\dFOpmvP.exe
  C:\Windows\System\dFOpmvP.exe
  2⤵
  PID:5440
- C:\Windows\System\iozavHg.exe
  C:\Windows\System\iozavHg.exe
  2⤵
  PID:5460
- C:\Windows\System\AMjGOdX.exe
  C:\Windows\System\AMjGOdX.exe
  2⤵
  PID:5480
- C:\Windows\System\QJJnKMC.exe
  C:\Windows\System\QJJnKMC.exe
  2⤵
  PID:5500
- C:\Windows\System\yedQHav.exe
  C:\Windows\System\yedQHav.exe
  2⤵
  PID:5516
- C:\Windows\System\aUJFasC.exe
  C:\Windows\System\aUJFasC.exe
  2⤵
  PID:5540
- C:\Windows\System\YMdztBv.exe
  C:\Windows\System\YMdztBv.exe
  2⤵
  PID:5560
- C:\Windows\System\HwvCNsu.exe
  C:\Windows\System\HwvCNsu.exe
  2⤵
  PID:5612
- C:\Windows\System\FTdLHWa.exe
  C:\Windows\System\FTdLHWa.exe
  2⤵
  PID:5636
- C:\Windows\System\gOKegAP.exe
  C:\Windows\System\gOKegAP.exe
  2⤵
  PID:5656
- C:\Windows\System\BISekkN.exe
  C:\Windows\System\BISekkN.exe
  2⤵
  PID:5676
- C:\Windows\System\IhTCkYx.exe
  C:\Windows\System\IhTCkYx.exe
  2⤵
  PID:5692
- C:\Windows\System\IxsxYQr.exe
  C:\Windows\System\IxsxYQr.exe
  2⤵
  PID:5716
- C:\Windows\System\qfuNbSH.exe
  C:\Windows\System\qfuNbSH.exe
  2⤵
  PID:5732
- C:\Windows\System\OBhIgyb.exe
  C:\Windows\System\OBhIgyb.exe
  2⤵
  PID:5752
- C:\Windows\System\fAdjmcg.exe
  C:\Windows\System\fAdjmcg.exe
  2⤵
  PID:5768
- C:\Windows\System\ufbXtGU.exe
  C:\Windows\System\ufbXtGU.exe
  2⤵
  PID:5788
- C:\Windows\System\dnVnaQu.exe
  C:\Windows\System\dnVnaQu.exe
  2⤵
  PID:5808
- C:\Windows\System\mJsqqhZ.exe
  C:\Windows\System\mJsqqhZ.exe
  2⤵
  PID:5828
- C:\Windows\System\SgsrYEU.exe
  C:\Windows\System\SgsrYEU.exe
  2⤵
  PID:5852
- C:\Windows\System\VAFLMcV.exe
  C:\Windows\System\VAFLMcV.exe
  2⤵
  PID:5872
- C:\Windows\System\gSuGSyR.exe
  C:\Windows\System\gSuGSyR.exe
  2⤵
  PID:5896
- C:\Windows\System\PoBiPwz.exe
  C:\Windows\System\PoBiPwz.exe
  2⤵
  PID:5912
- C:\Windows\System\TuCyEUH.exe
  C:\Windows\System\TuCyEUH.exe
  2⤵
  PID:5936
- C:\Windows\System\BSYferN.exe
  C:\Windows\System\BSYferN.exe
  2⤵
  PID:5952
- C:\Windows\System\kkllAuK.exe
  C:\Windows\System\kkllAuK.exe
  2⤵
  PID:5976
- C:\Windows\System\hCDYpcp.exe
  C:\Windows\System\hCDYpcp.exe
  2⤵
  PID:5992
- C:\Windows\System\fUdQuSx.exe
  C:\Windows\System\fUdQuSx.exe
  2⤵
  PID:6016
- C:\Windows\System\gLblnvt.exe
  C:\Windows\System\gLblnvt.exe
  2⤵
  PID:6032
- C:\Windows\System\QmwHgyo.exe
  C:\Windows\System\QmwHgyo.exe
  2⤵
  PID:6056
- C:\Windows\System\BGPhrcH.exe
  C:\Windows\System\BGPhrcH.exe
  2⤵
  PID:6072
- C:\Windows\System\IkcswGz.exe
  C:\Windows\System\IkcswGz.exe
  2⤵
  PID:6096
- C:\Windows\System\WzPVNxp.exe
  C:\Windows\System\WzPVNxp.exe
  2⤵
  PID:6116
- C:\Windows\System\fzxJNWg.exe
  C:\Windows\System\fzxJNWg.exe
  2⤵
  PID:6132
- C:\Windows\System\FGaxgqS.exe
  C:\Windows\System\FGaxgqS.exe
  2⤵
  PID:4956
- C:\Windows\System\JMYvAeQ.exe
  C:\Windows\System\JMYvAeQ.exe
  2⤵
  PID:1084
- C:\Windows\System\uRTvVoe.exe
  C:\Windows\System\uRTvVoe.exe
  2⤵
  PID:928
- C:\Windows\System\GTQgYux.exe
  C:\Windows\System\GTQgYux.exe
  2⤵
  PID:1004
- C:\Windows\System\UFlRcKp.exe
  C:\Windows\System\UFlRcKp.exe
  2⤵
  PID:3472
- C:\Windows\System\MOYgOYS.exe
  C:\Windows\System\MOYgOYS.exe
  2⤵
  PID:3248
- C:\Windows\System\xGnJPGS.exe
  C:\Windows\System\xGnJPGS.exe
  2⤵
  PID:3192
- C:\Windows\System\GoqcnCB.exe
  C:\Windows\System\GoqcnCB.exe
  2⤵
  PID:4016
- C:\Windows\System\ZcQZybJ.exe
  C:\Windows\System\ZcQZybJ.exe
  2⤵
  PID:2188
- C:\Windows\System\xCDsxPE.exe
  C:\Windows\System\xCDsxPE.exe
  2⤵
  PID:2856
- C:\Windows\System\ZQJZxPx.exe
  C:\Windows\System\ZQJZxPx.exe
  2⤵
  PID:3988
- C:\Windows\System\BgBXKWN.exe
  C:\Windows\System\BgBXKWN.exe
  2⤵
  PID:4112
- C:\Windows\System\dpmGteS.exe
  C:\Windows\System\dpmGteS.exe
  2⤵
  PID:1048
- C:\Windows\System\NQDIVzO.exe
  C:\Windows\System\NQDIVzO.exe
  2⤵
  PID:3288
- C:\Windows\System\KsfVOwp.exe
  C:\Windows\System\KsfVOwp.exe
  2⤵
  PID:5472
- C:\Windows\System\RNCCNAw.exe
  C:\Windows\System\RNCCNAw.exe
  2⤵
  PID:6168
- C:\Windows\System\dJqFMBO.exe
  C:\Windows\System\dJqFMBO.exe
  2⤵
  PID:6188
- C:\Windows\System\LKOfoXR.exe
  C:\Windows\System\LKOfoXR.exe
  2⤵
  PID:6204
- C:\Windows\System\PXzfGbg.exe
  C:\Windows\System\PXzfGbg.exe
  2⤵
  PID:6228
- C:\Windows\System\zrFLqjv.exe
  C:\Windows\System\zrFLqjv.exe
  2⤵
  PID:6248
- C:\Windows\System\hfdCmMa.exe
  C:\Windows\System\hfdCmMa.exe
  2⤵
  PID:6272
- C:\Windows\System\eKmwhHd.exe
  C:\Windows\System\eKmwhHd.exe
  2⤵
  PID:6288
- C:\Windows\System\inCdlSg.exe
  C:\Windows\System\inCdlSg.exe
  2⤵
  PID:6312
- C:\Windows\System\WJtvBIH.exe
  C:\Windows\System\WJtvBIH.exe
  2⤵
  PID:6332
- C:\Windows\System\IGEWgNA.exe
  C:\Windows\System\IGEWgNA.exe
  2⤵
  PID:6352
- C:\Windows\System\okMLvsE.exe
  C:\Windows\System\okMLvsE.exe
  2⤵
  PID:6372
- C:\Windows\System\tfrnEWa.exe
  C:\Windows\System\tfrnEWa.exe
  2⤵
  PID:6396
- C:\Windows\System\aXLbokp.exe
  C:\Windows\System\aXLbokp.exe
  2⤵
  PID:6428
- C:\Windows\System\gJayWgV.exe
  C:\Windows\System\gJayWgV.exe
  2⤵
  PID:6448
- C:\Windows\System\uquJyIC.exe
  C:\Windows\System\uquJyIC.exe
  2⤵
  PID:6464
- C:\Windows\System\DmObGSB.exe
  C:\Windows\System\DmObGSB.exe
  2⤵
  PID:6484
- C:\Windows\System\xnerwTe.exe
  C:\Windows\System\xnerwTe.exe
  2⤵
  PID:6500
- C:\Windows\System\csnVzOo.exe
  C:\Windows\System\csnVzOo.exe
  2⤵
  PID:6524
- C:\Windows\System\eWmrkSi.exe
  C:\Windows\System\eWmrkSi.exe
  2⤵
  PID:6540
- C:\Windows\System\sjAqVHA.exe
  C:\Windows\System\sjAqVHA.exe
  2⤵
  PID:6564
- C:\Windows\System\mWRMlWi.exe
  C:\Windows\System\mWRMlWi.exe
  2⤵
  PID:6580
- C:\Windows\System\BXqgFMi.exe
  C:\Windows\System\BXqgFMi.exe
  2⤵
  PID:6608
- C:\Windows\System\JxYXJjV.exe
  C:\Windows\System\JxYXJjV.exe
  2⤵
  PID:6624
- C:\Windows\System\qliyUjx.exe
  C:\Windows\System\qliyUjx.exe
  2⤵
  PID:6644
- C:\Windows\System\UDYzSDk.exe
  C:\Windows\System\UDYzSDk.exe
  2⤵
  PID:6660
- C:\Windows\System\oJRCLeJ.exe
  C:\Windows\System\oJRCLeJ.exe
  2⤵
  PID:6684
- C:\Windows\System\sQLWCZo.exe
  C:\Windows\System\sQLWCZo.exe
  2⤵
  PID:6700
- C:\Windows\System\iMUzszM.exe
  C:\Windows\System\iMUzszM.exe
  2⤵
  PID:6724
- C:\Windows\System\slCJaZj.exe
  C:\Windows\System\slCJaZj.exe
  2⤵
  PID:6748
- C:\Windows\System\ecxrMyR.exe
  C:\Windows\System\ecxrMyR.exe
  2⤵
  PID:6768
- C:\Windows\System\UVkvndk.exe
  C:\Windows\System\UVkvndk.exe
  2⤵
  PID:6792
- C:\Windows\System\BDwtyPM.exe
  C:\Windows\System\BDwtyPM.exe
  2⤵
  PID:6808
- C:\Windows\System\DTmerPC.exe
  C:\Windows\System\DTmerPC.exe
  2⤵
  PID:6832
- C:\Windows\System\EoQXqCh.exe
  C:\Windows\System\EoQXqCh.exe
  2⤵
  PID:6848
- C:\Windows\System\fVZXBNI.exe
  C:\Windows\System\fVZXBNI.exe
  2⤵
  PID:6872
- C:\Windows\System\ATuEQdU.exe
  C:\Windows\System\ATuEQdU.exe
  2⤵
  PID:6928
- C:\Windows\System\pTEqWmL.exe
  C:\Windows\System\pTEqWmL.exe
  2⤵
  PID:6948
- C:\Windows\System\SbhmIIN.exe
  C:\Windows\System\SbhmIIN.exe
  2⤵
  PID:6968
- C:\Windows\System\PVWQCfl.exe
  C:\Windows\System\PVWQCfl.exe
  2⤵
  PID:6988
- C:\Windows\System\xiQpyKx.exe
  C:\Windows\System\xiQpyKx.exe
  2⤵
  PID:7012
- C:\Windows\System\jtzLBgc.exe
  C:\Windows\System\jtzLBgc.exe
  2⤵
  PID:7036
- C:\Windows\System\IyCvEvp.exe
  C:\Windows\System\IyCvEvp.exe
  2⤵
  PID:7060
- C:\Windows\System\mppBNHV.exe
  C:\Windows\System\mppBNHV.exe
  2⤵
  PID:7084
- C:\Windows\System\VaXlcqc.exe
  C:\Windows\System\VaXlcqc.exe
  2⤵
  PID:7108
- C:\Windows\System\teZhvXx.exe
  C:\Windows\System\teZhvXx.exe
  2⤵
  PID:7136
- C:\Windows\System\MtvwKrt.exe
  C:\Windows\System\MtvwKrt.exe
  2⤵
  PID:7164
- C:\Windows\System\AQXPRIc.exe
  C:\Windows\System\AQXPRIc.exe
  2⤵
  PID:5532
- C:\Windows\System\ydbBdWE.exe
  C:\Windows\System\ydbBdWE.exe
  2⤵
  PID:4344
- C:\Windows\System\PqIDZnO.exe
  C:\Windows\System\PqIDZnO.exe
  2⤵
  PID:3612
- C:\Windows\System\MrXaYZl.exe
  C:\Windows\System\MrXaYZl.exe
  2⤵
  PID:528
- C:\Windows\System\WvjJafn.exe
  C:\Windows\System\WvjJafn.exe
  2⤵
  PID:5016
- C:\Windows\System\kwEEMwt.exe
  C:\Windows\System\kwEEMwt.exe
  2⤵
  PID:2588
- C:\Windows\System\ceBdPaq.exe
  C:\Windows\System\ceBdPaq.exe
  2⤵
  PID:5040
- C:\Windows\System\HMmCWSR.exe
  C:\Windows\System\HMmCWSR.exe
  2⤵
  PID:4336
- C:\Windows\System\MBiGOiD.exe
  C:\Windows\System\MBiGOiD.exe
  2⤵
  PID:3728
- C:\Windows\System\yUWjGnZ.exe
  C:\Windows\System\yUWjGnZ.exe
  2⤵
  PID:4464
- C:\Windows\System\uDKAdYR.exe
  C:\Windows\System\uDKAdYR.exe
  2⤵
  PID:5164
- C:\Windows\System\aIWhvVY.exe
  C:\Windows\System\aIWhvVY.exe
  2⤵
  PID:5816
- C:\Windows\System\aqTceRo.exe
  C:\Windows\System\aqTceRo.exe
  2⤵
  PID:5868
- C:\Windows\System\sGYzsDr.exe
  C:\Windows\System\sGYzsDr.exe
  2⤵
  PID:5972
- C:\Windows\System\HdgDDpc.exe
  C:\Windows\System\HdgDDpc.exe
  2⤵
  PID:6088
- C:\Windows\System\ViIYxFP.exe
  C:\Windows\System\ViIYxFP.exe
  2⤵
  PID:4552
- C:\Windows\System\CsUzjnW.exe
  C:\Windows\System\CsUzjnW.exe
  2⤵
  PID:2552
- C:\Windows\System\jVVYWPn.exe
  C:\Windows\System\jVVYWPn.exe
  2⤵
  PID:3908
- C:\Windows\System\gZadApU.exe
  C:\Windows\System\gZadApU.exe
  2⤵
  PID:1160
- C:\Windows\System\WUXHkHZ.exe
  C:\Windows\System\WUXHkHZ.exe
  2⤵
  PID:5556
- C:\Windows\System\jhZpNeg.exe
  C:\Windows\System\jhZpNeg.exe
  2⤵
  PID:404
- C:\Windows\System\NcCWeLd.exe
  C:\Windows\System\NcCWeLd.exe
  2⤵
  PID:6308
- C:\Windows\System\eSzfBdP.exe
  C:\Windows\System\eSzfBdP.exe
  2⤵
  PID:6408
- C:\Windows\System\SiNnaqB.exe
  C:\Windows\System\SiNnaqB.exe
  2⤵
  PID:7180
- C:\Windows\System\oGvjnlK.exe
  C:\Windows\System\oGvjnlK.exe
  2⤵
  PID:7204
- C:\Windows\System\KfqLndb.exe
  C:\Windows\System\KfqLndb.exe
  2⤵
  PID:7220
- C:\Windows\System\RhkfaJM.exe
  C:\Windows\System\RhkfaJM.exe
  2⤵
  PID:7364
- C:\Windows\System\oFWsRYI.exe
  C:\Windows\System\oFWsRYI.exe
  2⤵
  PID:7380
- C:\Windows\System\FotRYmx.exe
  C:\Windows\System\FotRYmx.exe
  2⤵
  PID:7400
- C:\Windows\System\MGsrHNK.exe
  C:\Windows\System\MGsrHNK.exe
  2⤵
  PID:7416
- C:\Windows\System\zCKNMxy.exe
  C:\Windows\System\zCKNMxy.exe
  2⤵
  PID:7432
- C:\Windows\System\LCgUWum.exe
  C:\Windows\System\LCgUWum.exe
  2⤵
  PID:7448
- C:\Windows\System\GZMkwxH.exe
  C:\Windows\System\GZMkwxH.exe
  2⤵
  PID:7464
- C:\Windows\System\yZbgeBv.exe
  C:\Windows\System\yZbgeBv.exe
  2⤵
  PID:7480
- C:\Windows\System\Ojlyyox.exe
  C:\Windows\System\Ojlyyox.exe
  2⤵
  PID:7496
- C:\Windows\System\wHtrjTk.exe
  C:\Windows\System\wHtrjTk.exe
  2⤵
  PID:7512
- C:\Windows\System\HAHUKeH.exe
  C:\Windows\System\HAHUKeH.exe
  2⤵
  PID:7528
- C:\Windows\System\NgbWJaO.exe
  C:\Windows\System\NgbWJaO.exe
  2⤵
  PID:7544
- C:\Windows\System\gODvDwe.exe
  C:\Windows\System\gODvDwe.exe
  2⤵
  PID:7560
- C:\Windows\System\mDbzwhu.exe
  C:\Windows\System\mDbzwhu.exe
  2⤵
  PID:7576
- C:\Windows\System\opaKYLj.exe
  C:\Windows\System\opaKYLj.exe
  2⤵
  PID:7592
- C:\Windows\System\TNYYcJz.exe
  C:\Windows\System\TNYYcJz.exe
  2⤵
  PID:7608
- C:\Windows\System\kIpCUIn.exe
  C:\Windows\System\kIpCUIn.exe
  2⤵
  PID:7624
- C:\Windows\System\FsCBNtM.exe
  C:\Windows\System\FsCBNtM.exe
  2⤵
  PID:7640
- C:\Windows\System\XDGrlYo.exe
  C:\Windows\System\XDGrlYo.exe
  2⤵
  PID:7656
- C:\Windows\System\nSHKNQz.exe
  C:\Windows\System\nSHKNQz.exe
  2⤵
  PID:7944
- C:\Windows\System\ipQMEob.exe
  C:\Windows\System\ipQMEob.exe
  2⤵
  PID:7960
- C:\Windows\System\xAVkZZc.exe
  C:\Windows\System\xAVkZZc.exe
  2⤵
  PID:7984
- C:\Windows\System\BMQCPhk.exe
  C:\Windows\System\BMQCPhk.exe
  2⤵
  PID:8000
- C:\Windows\System\UeWeysv.exe
  C:\Windows\System\UeWeysv.exe
  2⤵
  PID:8016
- C:\Windows\System\goqppVr.exe
  C:\Windows\System\goqppVr.exe
  2⤵
  PID:8032
- C:\Windows\System\CcufJWh.exe
  C:\Windows\System\CcufJWh.exe
  2⤵
  PID:8048
- C:\Windows\System\arWRWLG.exe
  C:\Windows\System\arWRWLG.exe
  2⤵
  PID:8064
- C:\Windows\System\OWzihAx.exe
  C:\Windows\System\OWzihAx.exe
  2⤵
  PID:8080
- C:\Windows\System\anzcAyQ.exe
  C:\Windows\System\anzcAyQ.exe
  2⤵
  PID:8096
- C:\Windows\System\opVgKGV.exe
  C:\Windows\System\opVgKGV.exe
  2⤵
  PID:8112
- C:\Windows\System\kSUKALL.exe
  C:\Windows\System\kSUKALL.exe
  2⤵
  PID:8128
- C:\Windows\System\FhHCasl.exe
  C:\Windows\System\FhHCasl.exe
  2⤵
  PID:8144
- C:\Windows\System\JTFKaDb.exe
  C:\Windows\System\JTFKaDb.exe
  2⤵
  PID:8168
- C:\Windows\System\vPTterl.exe
  C:\Windows\System\vPTterl.exe
  2⤵
  PID:8184
- C:\Windows\System\JBirwVP.exe
  C:\Windows\System\JBirwVP.exe
  2⤵
  PID:5284
- C:\Windows\System\WCkZhnM.exe
  C:\Windows\System\WCkZhnM.exe
  2⤵
  PID:5388
- C:\Windows\System\PozXgjK.exe
  C:\Windows\System\PozXgjK.exe
  2⤵
  PID:5448
- C:\Windows\System\FRThKsl.exe
  C:\Windows\System\FRThKsl.exe
  2⤵
  PID:5328
- C:\Windows\System\opXBghJ.exe
  C:\Windows\System\opXBghJ.exe
  2⤵
  PID:4768
- C:\Windows\System\cRBnIfw.exe
  C:\Windows\System\cRBnIfw.exe
  2⤵
  PID:6324
- C:\Windows\System\GmjaBOb.exe
  C:\Windows\System\GmjaBOb.exe
  2⤵
  PID:5648
- C:\Windows\System\mzaKMLv.exe
  C:\Windows\System\mzaKMLv.exe
  2⤵
  PID:5688
- C:\Windows\System\GvJpJjj.exe
  C:\Windows\System\GvJpJjj.exe
  2⤵
  PID:5728
- C:\Windows\System\InxbIBe.exe
  C:\Windows\System\InxbIBe.exe
  2⤵
  PID:5880
- C:\Windows\System\InfBcOg.exe
  C:\Windows\System\InfBcOg.exe
  2⤵
  PID:6124
- C:\Windows\System\VruBcMV.exe
  C:\Windows\System\VruBcMV.exe
  2⤵
  PID:3168
- C:\Windows\System\xtZDfYD.exe
  C:\Windows\System\xtZDfYD.exe
  2⤵
  PID:4996
- C:\Windows\System\cHTljgg.exe
  C:\Windows\System\cHTljgg.exe
  2⤵
  PID:2256
- C:\Windows\System\BuiRnoO.exe
  C:\Windows\System\BuiRnoO.exe
  2⤵
  PID:6184
- C:\Windows\System\CqZzikj.exe
  C:\Windows\System\CqZzikj.exe
  2⤵
  PID:6220
- C:\Windows\System\GxmirJJ.exe
  C:\Windows\System\GxmirJJ.exe
  2⤵
  PID:6364
- C:\Windows\System\GNjTAdO.exe
  C:\Windows\System\GNjTAdO.exe
  2⤵
  PID:6412
- C:\Windows\System\qURVFBw.exe
  C:\Windows\System\qURVFBw.exe
  2⤵
  PID:6512
- C:\Windows\System\rYOfWet.exe
  C:\Windows\System\rYOfWet.exe
  2⤵
  PID:6976
- C:\Windows\System\XujOQQy.exe
  C:\Windows\System\XujOQQy.exe
  2⤵
  PID:6536
- C:\Windows\System\lBwCRes.exe
  C:\Windows\System\lBwCRes.exe
  2⤵
  PID:6720
- C:\Windows\System\OGFCZLy.exe
  C:\Windows\System\OGFCZLy.exe
  2⤵
  PID:6840
- C:\Windows\System\zulNyiX.exe
  C:\Windows\System\zulNyiX.exe
  2⤵
  PID:7028
- C:\Windows\System\VtQNbQR.exe
  C:\Windows\System\VtQNbQR.exe
  2⤵
  PID:7124
- C:\Windows\System\SCpLPlV.exe
  C:\Windows\System\SCpLPlV.exe
  2⤵
  PID:4212
- C:\Windows\System\iKnPXTK.exe
  C:\Windows\System\iKnPXTK.exe
  2⤵
  PID:4944
- C:\Windows\System\hEsdOJx.exe
  C:\Windows\System\hEsdOJx.exe
  2⤵
  PID:2260
- C:\Windows\System\jlqCcDK.exe
  C:\Windows\System\jlqCcDK.exe
  2⤵
  PID:1472
- C:\Windows\System\vNjLfXb.exe
  C:\Windows\System\vNjLfXb.exe
  2⤵
  PID:5136
- C:\Windows\System\HAIsont.exe
  C:\Windows\System\HAIsont.exe
  2⤵
  PID:5844
- C:\Windows\System\sOChwks.exe
  C:\Windows\System\sOChwks.exe
  2⤵
  PID:5984
- C:\Windows\System\RMxodBT.exe
  C:\Windows\System\RMxodBT.exe
  2⤵
  PID:6048
- C:\Windows\System\GWHUiPL.exe
  C:\Windows\System\GWHUiPL.exe
  2⤵
  PID:1704
- C:\Windows\System\ZYXSGZi.exe
  C:\Windows\System\ZYXSGZi.exe
  2⤵
  PID:5548
- C:\Windows\System\kQmkCqB.exe
  C:\Windows\System\kQmkCqB.exe
  2⤵
  PID:6284
- C:\Windows\System\XqfVpHc.exe
  C:\Windows\System\XqfVpHc.exe
  2⤵
  PID:7176
- C:\Windows\System\OKaoHMM.exe
  C:\Windows\System\OKaoHMM.exe
  2⤵
  PID:8204
- C:\Windows\System\OaPxFpH.exe
  C:\Windows\System\OaPxFpH.exe
  2⤵
  PID:8220
- C:\Windows\System\SwlBqzo.exe
  C:\Windows\System\SwlBqzo.exe
  2⤵
  PID:8240
- C:\Windows\System\mpXalgW.exe
  C:\Windows\System\mpXalgW.exe
  2⤵
  PID:8260
- C:\Windows\System\hpGHhLK.exe
  C:\Windows\System\hpGHhLK.exe
  2⤵
  PID:8280
- C:\Windows\System\NIitvGl.exe
  C:\Windows\System\NIitvGl.exe
  2⤵
  PID:8300
- C:\Windows\System\FmDiFMj.exe
  C:\Windows\System\FmDiFMj.exe
  2⤵
  PID:8320
- C:\Windows\System\zvbxNrp.exe
  C:\Windows\System\zvbxNrp.exe
  2⤵
  PID:8336
- C:\Windows\System\BAbmqya.exe
  C:\Windows\System\BAbmqya.exe
  2⤵
  PID:8360
- C:\Windows\System\WlLtrDP.exe
  C:\Windows\System\WlLtrDP.exe
  2⤵
  PID:8376
- C:\Windows\System\OyInOTC.exe
  C:\Windows\System\OyInOTC.exe
  2⤵
  PID:8396
- C:\Windows\System\IvVBwlC.exe
  C:\Windows\System\IvVBwlC.exe
  2⤵
  PID:8412
- C:\Windows\System\CVCKjHo.exe
  C:\Windows\System\CVCKjHo.exe
  2⤵
  PID:8428
- C:\Windows\System\SvzuUve.exe
  C:\Windows\System\SvzuUve.exe
  2⤵
  PID:8448
- C:\Windows\System\nXRCmtd.exe
  C:\Windows\System\nXRCmtd.exe
  2⤵
  PID:8468
- C:\Windows\System\QyNkhuA.exe
  C:\Windows\System\QyNkhuA.exe
  2⤵
  PID:8484
- C:\Windows\System\QLiWpRy.exe
  C:\Windows\System\QLiWpRy.exe
  2⤵
  PID:8504
- C:\Windows\System\cglSEkB.exe
  C:\Windows\System\cglSEkB.exe
  2⤵
  PID:8524
- C:\Windows\System\OSFmizR.exe
  C:\Windows\System\OSFmizR.exe
  2⤵
  PID:8540
- C:\Windows\System\csKDZYR.exe
  C:\Windows\System\csKDZYR.exe
  2⤵
  PID:8560
- C:\Windows\System\qWMdGBf.exe
  C:\Windows\System\qWMdGBf.exe
  2⤵
  PID:8580
- C:\Windows\System\ogTBual.exe
  C:\Windows\System\ogTBual.exe
  2⤵
  PID:8600
- C:\Windows\System\VDgCZHy.exe
  C:\Windows\System\VDgCZHy.exe
  2⤵
  PID:8620
- C:\Windows\System\uiQerfR.exe
  C:\Windows\System\uiQerfR.exe
  2⤵
  PID:8640
- C:\Windows\System\WCHCYWI.exe
  C:\Windows\System\WCHCYWI.exe
  2⤵
  PID:8660
- C:\Windows\System\WgiWwdI.exe
  C:\Windows\System\WgiWwdI.exe
  2⤵
  PID:8680
- C:\Windows\System\ErSpeTp.exe
  C:\Windows\System\ErSpeTp.exe
  2⤵
  PID:8704
- C:\Windows\System\yZSqLeG.exe
  C:\Windows\System\yZSqLeG.exe
  2⤵
  PID:8996
- C:\Windows\System\RybPrqm.exe
  C:\Windows\System\RybPrqm.exe
  2⤵
  PID:9012
- C:\Windows\System\hVybnXC.exe
  C:\Windows\System\hVybnXC.exe
  2⤵
  PID:9028
- C:\Windows\System\isGDuHv.exe
  C:\Windows\System\isGDuHv.exe
  2⤵
  PID:9044
- C:\Windows\System\yFFKabB.exe
  C:\Windows\System\yFFKabB.exe
  2⤵
  PID:9060
- C:\Windows\System\ichNlsz.exe
  C:\Windows\System\ichNlsz.exe
  2⤵
  PID:9076
- C:\Windows\System\LhaTOrt.exe
  C:\Windows\System\LhaTOrt.exe
  2⤵
  PID:9092
- C:\Windows\System\qhnddGo.exe
  C:\Windows\System\qhnddGo.exe
  2⤵
  PID:9108
- C:\Windows\System\EbcGsYl.exe
  C:\Windows\System\EbcGsYl.exe
  2⤵
  PID:9124
- C:\Windows\System\LONqEll.exe
  C:\Windows\System\LONqEll.exe
  2⤵
  PID:9144
- C:\Windows\System\MavlQeR.exe
  C:\Windows\System\MavlQeR.exe
  2⤵
  PID:9164
- C:\Windows\System\VjyJDcI.exe
  C:\Windows\System\VjyJDcI.exe
  2⤵
  PID:9188
- C:\Windows\System\HsKAoZW.exe
  C:\Windows\System\HsKAoZW.exe
  2⤵
  PID:9212
- C:\Windows\System\KAlCPSS.exe
  C:\Windows\System\KAlCPSS.exe
  2⤵
  PID:9232
- C:\Windows\System\aqJLHSW.exe
  C:\Windows\System\aqJLHSW.exe
  2⤵
  PID:9248
- C:\Windows\System\cXaZAnN.exe
  C:\Windows\System\cXaZAnN.exe
  2⤵
  PID:9264
- C:\Windows\System\JhdoBUb.exe
  C:\Windows\System\JhdoBUb.exe
  2⤵
  PID:9288
- C:\Windows\System\fnGUQCw.exe
  C:\Windows\System\fnGUQCw.exe
  2⤵
  PID:9308
- C:\Windows\System\JhTOjAb.exe
  C:\Windows\System\JhTOjAb.exe
  2⤵
  PID:9348
- C:\Windows\System\IqLbcSB.exe
  C:\Windows\System\IqLbcSB.exe
  2⤵
  PID:9380
- C:\Windows\System\WLfEAwB.exe
  C:\Windows\System\WLfEAwB.exe
  2⤵
  PID:9400
- C:\Windows\System\zftoLFh.exe
  C:\Windows\System\zftoLFh.exe
  2⤵
  PID:9432
- C:\Windows\System\HvBTycN.exe
  C:\Windows\System\HvBTycN.exe
  2⤵
  PID:9468
- C:\Windows\System\QRNhCJg.exe
  C:\Windows\System\QRNhCJg.exe
  2⤵
  PID:9524
- C:\Windows\System\KNmSCwv.exe
  C:\Windows\System\KNmSCwv.exe
  2⤵
  PID:9584
- C:\Windows\System\yjbBshK.exe
  C:\Windows\System\yjbBshK.exe
  2⤵
  PID:9652
- C:\Windows\System\KdcuwGR.exe
  C:\Windows\System\KdcuwGR.exe
  2⤵
  PID:9672
- C:\Windows\System\nODkDbH.exe
  C:\Windows\System\nODkDbH.exe
  2⤵
  PID:9692
- C:\Windows\System\PNWFTZx.exe
  C:\Windows\System\PNWFTZx.exe
  2⤵
  PID:9712
- C:\Windows\System\QEunHqW.exe
  C:\Windows\System\QEunHqW.exe
  2⤵
  PID:9732
- C:\Windows\System\jvraGoB.exe
  C:\Windows\System\jvraGoB.exe
  2⤵
  PID:9748
- C:\Windows\System\ElzFlvH.exe
  C:\Windows\System\ElzFlvH.exe
  2⤵
  PID:9768
- C:\Windows\System\LpVXfTU.exe
  C:\Windows\System\LpVXfTU.exe
  2⤵
  PID:9784
- C:\Windows\System\KFPKjzq.exe
  C:\Windows\System\KFPKjzq.exe
  2⤵
  PID:9804
- C:\Windows\System\QwhiPqa.exe
  C:\Windows\System\QwhiPqa.exe
  2⤵
  PID:9820
- C:\Windows\System\buXUvsC.exe
  C:\Windows\System\buXUvsC.exe
  2⤵
  PID:9848
- C:\Windows\System\ZQEqYhg.exe
  C:\Windows\System\ZQEqYhg.exe
  2⤵
  PID:9868
- C:\Windows\System\DyOHcYk.exe
  C:\Windows\System\DyOHcYk.exe
  2⤵
  PID:9884
- C:\Windows\System\NiuqIvi.exe
  C:\Windows\System\NiuqIvi.exe
  2⤵
  PID:9908
- C:\Windows\System\DXaFPEY.exe
  C:\Windows\System\DXaFPEY.exe
  2⤵
  PID:9924
- C:\Windows\System\YDjBVhb.exe
  C:\Windows\System\YDjBVhb.exe
  2⤵
  PID:9940
- C:\Windows\System\znkdlCA.exe
  C:\Windows\System\znkdlCA.exe
  2⤵
  PID:9960
- C:\Windows\System\YwzdeBb.exe
  C:\Windows\System\YwzdeBb.exe
  2⤵
  PID:9976
- C:\Windows\System\DtHWCVX.exe
  C:\Windows\System\DtHWCVX.exe
  2⤵
  PID:9992
- C:\Windows\System\HGwfhnz.exe
  C:\Windows\System\HGwfhnz.exe
  2⤵
  PID:10008
- C:\Windows\System\EQlavnY.exe
  C:\Windows\System\EQlavnY.exe
  2⤵
  PID:10028
- C:\Windows\System\iXkmyUp.exe
  C:\Windows\System\iXkmyUp.exe
  2⤵
  PID:10048
- C:\Windows\System\LBYAZmg.exe
  C:\Windows\System\LBYAZmg.exe
  2⤵
  PID:10068
- C:\Windows\System\UyQQoJV.exe
  C:\Windows\System\UyQQoJV.exe
  2⤵
  PID:10088
- C:\Windows\System\cgEIppa.exe
  C:\Windows\System\cgEIppa.exe
  2⤵
  PID:10108
- C:\Windows\System\NTEfubJ.exe
  C:\Windows\System\NTEfubJ.exe
  2⤵
  PID:10132
- C:\Windows\System\bDsgwUM.exe
  C:\Windows\System\bDsgwUM.exe
  2⤵
  PID:10152
- C:\Windows\System\WhViKPr.exe
  C:\Windows\System\WhViKPr.exe
  2⤵
  PID:10208
- C:\Windows\System\BeMNGax.exe
  C:\Windows\System\BeMNGax.exe
  2⤵
  PID:10224
- C:\Windows\System\SZAwXWu.exe
  C:\Windows\System\SZAwXWu.exe
  2⤵
  PID:5920
- C:\Windows\System\inOAKYN.exe
  C:\Windows\System\inOAKYN.exe
  2⤵
  PID:6456
- C:\Windows\System\EGmTPXy.exe
  C:\Windows\System\EGmTPXy.exe
  2⤵
  PID:1340
- C:\Windows\System\ZBUiDNr.exe
  C:\Windows\System\ZBUiDNr.exe
  2⤵
  PID:6012
- C:\Windows\System\fUOGNye.exe
  C:\Windows\System\fUOGNye.exe
  2⤵
  PID:7212
- C:\Windows\System\QiLmoJg.exe
  C:\Windows\System\QiLmoJg.exe
  2⤵
  PID:8232
- C:\Windows\System\MndSGjX.exe
  C:\Windows\System\MndSGjX.exe
  2⤵
  PID:8328
- C:\Windows\System\wBdNElL.exe
  C:\Windows\System\wBdNElL.exe
  2⤵
  PID:8356
- C:\Windows\System\tyXzHAu.exe
  C:\Windows\System\tyXzHAu.exe
  2⤵
  PID:8440
- C:\Windows\System\cpqJlSY.exe
  C:\Windows\System\cpqJlSY.exe
  2⤵
  PID:8520
- C:\Windows\System\lCivAhT.exe
  C:\Windows\System\lCivAhT.exe
  2⤵
  PID:8652
- C:\Windows\System\yRSNRbe.exe
  C:\Windows\System\yRSNRbe.exe
  2⤵
  PID:1372
- C:\Windows\System\YIMnSoq.exe
  C:\Windows\System\YIMnSoq.exe
  2⤵
  PID:9680
- C:\Windows\System\ZMFWIwW.exe
  C:\Windows\System\ZMFWIwW.exe
  2⤵
  PID:9724
- C:\Windows\System\YTZGOdF.exe
  C:\Windows\System\YTZGOdF.exe
  2⤵
  PID:3128
- C:\Windows\System\pMmucyN.exe
  C:\Windows\System\pMmucyN.exe
  2⤵
  PID:9780
- C:\Windows\System\flUoXbB.exe
  C:\Windows\System\flUoXbB.exe
  2⤵
  PID:1064
- C:\Windows\System\udVridW.exe
  C:\Windows\System\udVridW.exe
  2⤵
  PID:9856
- C:\Windows\System\aKKokXo.exe
  C:\Windows\System\aKKokXo.exe
  2⤵
  PID:10260
- C:\Windows\System\FWdTNTu.exe
  C:\Windows\System\FWdTNTu.exe
  2⤵
  PID:10276
- C:\Windows\System\tTZXqut.exe
  C:\Windows\System\tTZXqut.exe
  2⤵
  PID:10292
- C:\Windows\System\gmeuSiE.exe
  C:\Windows\System\gmeuSiE.exe
  2⤵
  PID:10316
- C:\Windows\System\BpBTXIW.exe
  C:\Windows\System\BpBTXIW.exe
  2⤵
  PID:10332
- C:\Windows\System\lIKWZXg.exe
  C:\Windows\System\lIKWZXg.exe
  2⤵
  PID:10352
- C:\Windows\System\eFMOqmq.exe
  C:\Windows\System\eFMOqmq.exe
  2⤵
  PID:10372
- C:\Windows\System\yRZJQdD.exe
  C:\Windows\System\yRZJQdD.exe
  2⤵
  PID:10392
- C:\Windows\System\eYowzwQ.exe
  C:\Windows\System\eYowzwQ.exe
  2⤵
  PID:10412
- C:\Windows\System\WSQWcAi.exe
  C:\Windows\System\WSQWcAi.exe
  2⤵
  PID:10432
- C:\Windows\System\lFCrLoi.exe
  C:\Windows\System\lFCrLoi.exe
  2⤵
  PID:10452
- C:\Windows\System\cHgNmrb.exe
  C:\Windows\System\cHgNmrb.exe
  2⤵
  PID:10476
- C:\Windows\System\FxBRaxo.exe
  C:\Windows\System\FxBRaxo.exe
  2⤵
  PID:10492
- C:\Windows\System\WPgJUMZ.exe
  C:\Windows\System\WPgJUMZ.exe
  2⤵
  PID:10512
- C:\Windows\System\XAAuHSG.exe
  C:\Windows\System\XAAuHSG.exe
  2⤵
  PID:10532
- C:\Windows\System\TLSlNwK.exe
  C:\Windows\System\TLSlNwK.exe
  2⤵
  PID:10556
- C:\Windows\System\qRAcFav.exe
  C:\Windows\System\qRAcFav.exe
  2⤵
  PID:10572
- C:\Windows\System\AMRQegx.exe
  C:\Windows\System\AMRQegx.exe
  2⤵
  PID:10588
- C:\Windows\System\rCTAvsf.exe
  C:\Windows\System\rCTAvsf.exe
  2⤵
  PID:10608
- C:\Windows\System\gxuYNym.exe
  C:\Windows\System\gxuYNym.exe
  2⤵
  PID:10632
- C:\Windows\System\DnUudbB.exe
  C:\Windows\System\DnUudbB.exe
  2⤵
  PID:10648
- C:\Windows\System\eSjGFoE.exe
  C:\Windows\System\eSjGFoE.exe
  2⤵
  PID:10672
- C:\Windows\System\RbqSpXK.exe
  C:\Windows\System\RbqSpXK.exe
  2⤵
  PID:10692
- C:\Windows\System\hGClpbu.exe
  C:\Windows\System\hGClpbu.exe
  2⤵
  PID:10720
- C:\Windows\System\MdEcZrB.exe
  C:\Windows\System\MdEcZrB.exe
  2⤵
  PID:10736
- C:\Windows\System\ZVCFzxy.exe
  C:\Windows\System\ZVCFzxy.exe
  2⤵
  PID:10752
- C:\Windows\System\LuZJvyy.exe
  C:\Windows\System\LuZJvyy.exe
  2⤵
  PID:10780
- C:\Windows\System\WzIOkQb.exe
  C:\Windows\System\WzIOkQb.exe
  2⤵
  PID:10796
- C:\Windows\System\vFvSqDI.exe
  C:\Windows\System\vFvSqDI.exe
  2⤵
  PID:10820
- C:\Windows\System\ITACrfZ.exe
  C:\Windows\System\ITACrfZ.exe
  2⤵
  PID:10848
- C:\Windows\System\eaAQzTi.exe
  C:\Windows\System\eaAQzTi.exe
  2⤵
  PID:10864
- C:\Windows\System\mUtVTGf.exe
  C:\Windows\System\mUtVTGf.exe
  2⤵
  PID:10880
- C:\Windows\System\xhnJFvB.exe
  C:\Windows\System\xhnJFvB.exe
  2⤵
  PID:10916
- C:\Windows\System\QYWQSbb.exe
  C:\Windows\System\QYWQSbb.exe
  2⤵
  PID:10932
- C:\Windows\System\zrypULm.exe
  C:\Windows\System\zrypULm.exe
  2⤵
  PID:10956
- C:\Windows\System\nlfYMcs.exe
  C:\Windows\System\nlfYMcs.exe
  2⤵
  PID:10988
- C:\Windows\System\skocPPI.exe
  C:\Windows\System\skocPPI.exe
  2⤵
  PID:11004
- C:\Windows\System\fHsuvNV.exe
  C:\Windows\System\fHsuvNV.exe
  2⤵
  PID:11028
- C:\Windows\System\ORIgifB.exe
  C:\Windows\System\ORIgifB.exe
  2⤵
  PID:11052
- C:\Windows\System\CjdsfRi.exe
  C:\Windows\System\CjdsfRi.exe
  2⤵
  PID:11068
- C:\Windows\System\DmzUReb.exe
  C:\Windows\System\DmzUReb.exe
  2⤵
  PID:11092
- C:\Windows\System\VqSegIK.exe
  C:\Windows\System\VqSegIK.exe
  2⤵
  PID:11112
- C:\Windows\System\yyizczk.exe
  C:\Windows\System\yyizczk.exe
  2⤵
  PID:11132
- C:\Windows\System\effobdl.exe
  C:\Windows\System\effobdl.exe
  2⤵
  PID:11156
- C:\Windows\System\CTOPpsy.exe
  C:\Windows\System\CTOPpsy.exe
  2⤵
  PID:11172
- C:\Windows\System\aLvjdjL.exe
  C:\Windows\System\aLvjdjL.exe
  2⤵
  PID:11196
- C:\Windows\System\rmbsbuo.exe
  C:\Windows\System\rmbsbuo.exe
  2⤵
  PID:11224
- C:\Windows\System\eWUtQlI.exe
  C:\Windows\System\eWUtQlI.exe
  2⤵
  PID:11240
- C:\Windows\System\IUmfbcp.exe
  C:\Windows\System\IUmfbcp.exe
  2⤵
  PID:8348
- C:\Windows\System\PdArqft.exe
  C:\Windows\System\PdArqft.exe
  2⤵
  PID:8552
- C:\Windows\System\uKaCkfe.exe
  C:\Windows\System\uKaCkfe.exe
  2⤵
  PID:10044
- C:\Windows\System\WsxXMGB.exe
  C:\Windows\System\WsxXMGB.exe
  2⤵
  PID:7360
- C:\Windows\System\muUxffE.exe
  C:\Windows\System\muUxffE.exe
  2⤵
  PID:7408
- C:\Windows\System\bWgQUUi.exe
  C:\Windows\System\bWgQUUi.exe
  2⤵
  PID:11272
- C:\Windows\System\bjrRSea.exe
  C:\Windows\System\bjrRSea.exe
  2⤵
  PID:11292
- C:\Windows\System\uaIYLeW.exe
  C:\Windows\System\uaIYLeW.exe
  2⤵
  PID:11316
- C:\Windows\System\EzpwMWm.exe
  C:\Windows\System\EzpwMWm.exe
  2⤵
  PID:11336
- C:\Windows\System\vdJVheb.exe
  C:\Windows\System\vdJVheb.exe
  2⤵
  PID:11356
- C:\Windows\System\QhWOjEa.exe
  C:\Windows\System\QhWOjEa.exe
  2⤵
  PID:11372
- C:\Windows\System\KUkDhXf.exe
  C:\Windows\System\KUkDhXf.exe
  2⤵
  PID:11388
- C:\Windows\System\uXiuSvl.exe
  C:\Windows\System\uXiuSvl.exe
  2⤵
  PID:11404
- C:\Windows\System\QXBCDnX.exe
  C:\Windows\System\QXBCDnX.exe
  2⤵
  PID:11420
- C:\Windows\System\ZVFyVsG.exe
  C:\Windows\System\ZVFyVsG.exe
  2⤵
  PID:11436
- C:\Windows\System\LsgEFtf.exe
  C:\Windows\System\LsgEFtf.exe
  2⤵
  PID:11452
- C:\Windows\System\lubCVNR.exe
  C:\Windows\System\lubCVNR.exe
  2⤵
  PID:11476
- C:\Windows\System\dOBUOLY.exe
  C:\Windows\System\dOBUOLY.exe
  2⤵
  PID:11492
- C:\Windows\System\GrVhXPB.exe
  C:\Windows\System\GrVhXPB.exe
  2⤵
  PID:11516
- C:\Windows\System\uaGgbyC.exe
  C:\Windows\System\uaGgbyC.exe
  2⤵
  PID:11652
- C:\Windows\System\MYJipih.exe
  C:\Windows\System\MYJipih.exe
  2⤵
  PID:11672
- C:\Windows\System\ZNHFWJB.exe
  C:\Windows\System\ZNHFWJB.exe
  2⤵
  PID:11688
- C:\Windows\System\RJeDLQZ.exe
  C:\Windows\System\RJeDLQZ.exe
  2⤵
  PID:11704
- C:\Windows\System\oWRdQwJ.exe
  C:\Windows\System\oWRdQwJ.exe
  2⤵
  PID:11720
- C:\Windows\System\ewuZuGW.exe
  C:\Windows\System\ewuZuGW.exe
  2⤵
  PID:11736
- C:\Windows\System\gtetiJH.exe
  C:\Windows\System\gtetiJH.exe
  2⤵
  PID:11752
- C:\Windows\System\SGUipTM.exe
  C:\Windows\System\SGUipTM.exe
  2⤵
  PID:11768
- C:\Windows\System\CxNfBLu.exe
  C:\Windows\System\CxNfBLu.exe
  2⤵
  PID:11784
- C:\Windows\System\MSReLWT.exe
  C:\Windows\System\MSReLWT.exe
  2⤵
  PID:11800
- C:\Windows\System\FhsgvEh.exe
  C:\Windows\System\FhsgvEh.exe
  2⤵
  PID:11820
- C:\Windows\System\ZAqSOfF.exe
  C:\Windows\System\ZAqSOfF.exe
  2⤵
  PID:11840
- C:\Windows\System\pLecDwj.exe
  C:\Windows\System\pLecDwj.exe
  2⤵
  PID:11856
- C:\Windows\System\BFNcJyw.exe
  C:\Windows\System\BFNcJyw.exe
  2⤵
  PID:11876
- C:\Windows\System\NGLwplG.exe
  C:\Windows\System\NGLwplG.exe
  2⤵
  PID:11920
- C:\Windows\System\AJQyAXZ.exe
  C:\Windows\System\AJQyAXZ.exe
  2⤵
  PID:11940
- C:\Windows\System\TIRqPwT.exe
  C:\Windows\System\TIRqPwT.exe
  2⤵
  PID:11960
- C:\Windows\System\socOBFw.exe
  C:\Windows\System\socOBFw.exe
  2⤵
  PID:11984
- C:\Windows\System\xKFMtfD.exe
  C:\Windows\System\xKFMtfD.exe
  2⤵
  PID:12000
- C:\Windows\System\WzYTBPl.exe
  C:\Windows\System\WzYTBPl.exe
  2⤵
  PID:12028
- C:\Windows\System\jFvvMrh.exe
  C:\Windows\System\jFvvMrh.exe
  2⤵
  PID:12048
- C:\Windows\System\ICvDthJ.exe
  C:\Windows\System\ICvDthJ.exe
  2⤵
  PID:12068
- C:\Windows\System\LlppJxg.exe
  C:\Windows\System\LlppJxg.exe
  2⤵
  PID:12092
- C:\Windows\System\zFXgtHd.exe
  C:\Windows\System\zFXgtHd.exe
  2⤵
  PID:12108
- C:\Windows\System\GNNByaL.exe
  C:\Windows\System\GNNByaL.exe
  2⤵
  PID:12132
- C:\Windows\System\ZYzVupU.exe
  C:\Windows\System\ZYzVupU.exe
  2⤵
  PID:12152
- C:\Windows\System\RHQLsux.exe
  C:\Windows\System\RHQLsux.exe
  2⤵
  PID:12172
- C:\Windows\System\SWxHUdY.exe
  C:\Windows\System\SWxHUdY.exe
  2⤵
  PID:12192
- C:\Windows\System\dMqDtbe.exe
  C:\Windows\System\dMqDtbe.exe
  2⤵
  PID:12208
- C:\Windows\System\EjSDSUZ.exe
  C:\Windows\System\EjSDSUZ.exe
  2⤵
  PID:12228
- C:\Windows\System\YevwQKs.exe
  C:\Windows\System\YevwQKs.exe
  2⤵
  PID:12248
- C:\Windows\System\bTSsEWs.exe
  C:\Windows\System\bTSsEWs.exe
  2⤵
  PID:12264
- C:\Windows\System\mhuTCBu.exe
  C:\Windows\System\mhuTCBu.exe
  2⤵
  PID:12284
- C:\Windows\System\FVRgQzx.exe
  C:\Windows\System\FVRgQzx.exe
  2⤵
  PID:7456
- C:\Windows\System\XPQVZDC.exe
  C:\Windows\System\XPQVZDC.exe
  2⤵
  PID:5536
- C:\Windows\System\oucXPle.exe
  C:\Windows\System\oucXPle.exe
  2⤵
  PID:2928
- C:\Windows\System\VPAoHoo.exe
  C:\Windows\System\VPAoHoo.exe
  2⤵
  PID:5524
- C:\Windows\System\UeRaKqt.exe
  C:\Windows\System\UeRaKqt.exe
  2⤵
  PID:6960
- C:\Windows\System\oBMykKX.exe
  C:\Windows\System\oBMykKX.exe
  2⤵
  PID:6828
- C:\Windows\System\faKKTmK.exe
  C:\Windows\System\faKKTmK.exe
  2⤵
  PID:6740
- C:\Windows\System\wDpxmXf.exe
  C:\Windows\System\wDpxmXf.exe
  2⤵
  PID:6588
- C:\Windows\System\SGEGkRY.exe
  C:\Windows\System\SGEGkRY.exe
  2⤵
  PID:6052
- C:\Windows\System\silhkVl.exe
  C:\Windows\System\silhkVl.exe
  2⤵
  PID:6280
- C:\Windows\System\WfVgHQz.exe
  C:\Windows\System\WfVgHQz.exe
  2⤵
  PID:6892
- C:\Windows\System\gWsKlLK.exe
  C:\Windows\System\gWsKlLK.exe
  2⤵
  PID:6592
- C:\Windows\System\NeRFHjx.exe
  C:\Windows\System\NeRFHjx.exe
  2⤵
  PID:5468
- C:\Windows\System\DZbBpGs.exe
  C:\Windows\System\DZbBpGs.exe
  2⤵
  PID:2208
- C:\Windows\System\OyjQBzq.exe
  C:\Windows\System\OyjQBzq.exe
  2⤵
  PID:5712
- C:\Windows\System\PzclxZn.exe
  C:\Windows\System\PzclxZn.exe
  2⤵
  PID:5628
- C:\Windows\System\aYlXjEg.exe
  C:\Windows\System\aYlXjEg.exe
  2⤵
  PID:5884
- C:\Windows\System\mBVNWio.exe
  C:\Windows\System\mBVNWio.exe
  2⤵
  PID:5412
- C:\Windows\System\gpLkKmD.exe
  C:\Windows\System\gpLkKmD.exe
  2⤵
  PID:5332
- C:\Windows\System\QIjiXWx.exe
  C:\Windows\System\QIjiXWx.exe
  2⤵
  PID:8176
- C:\Windows\System\ZoEXytK.exe
  C:\Windows\System\ZoEXytK.exe
  2⤵
  PID:8120
- C:\Windows\System\ZRwiQPh.exe
  C:\Windows\System\ZRwiQPh.exe
  2⤵
  PID:8072
- C:\Windows\System\gcXYaNh.exe
  C:\Windows\System\gcXYaNh.exe
  2⤵
  PID:8040
- C:\Windows\System\SMPsgpB.exe
  C:\Windows\System\SMPsgpB.exe
  2⤵
  PID:8008
- C:\Windows\System\lNdkrhV.exe
  C:\Windows\System\lNdkrhV.exe
  2⤵
  PID:7968
- C:\Windows\System\MjllUFN.exe
  C:\Windows\System\MjllUFN.exe
  2⤵
  PID:7932
- C:\Windows\System\SBDGAvx.exe
  C:\Windows\System\SBDGAvx.exe
  2⤵
  PID:7904
- C:\Windows\System\kgOUjkP.exe
  C:\Windows\System\kgOUjkP.exe
  2⤵
  PID:7880
- C:\Windows\System\YzcDaYI.exe
  C:\Windows\System\YzcDaYI.exe
  2⤵
  PID:7648
- C:\Windows\System\cZATEWo.exe
  C:\Windows\System\cZATEWo.exe
  2⤵
  PID:7604
- C:\Windows\System\cwhRTfR.exe
  C:\Windows\System\cwhRTfR.exe
  2⤵
  PID:7568
- C:\Windows\System\myNXblh.exe
  C:\Windows\System\myNXblh.exe
  2⤵
  PID:7524
- C:\Windows\System\rRfnBIr.exe
  C:\Windows\System\rRfnBIr.exe
  2⤵
  PID:7488
- C:\Windows\System\xpHgRzu.exe
  C:\Windows\System\xpHgRzu.exe
  2⤵
  PID:1904
- C:\Windows\System\etgkUZt.exe
  C:\Windows\System\etgkUZt.exe
  2⤵
  PID:9896
- C:\Windows\System\fVbUxrK.exe
  C:\Windows\System\fVbUxrK.exe
  2⤵
  PID:8292
- C:\Windows\System\EcMLOXt.exe
  C:\Windows\System\EcMLOXt.exe
  2⤵
  PID:8388
- C:\Windows\System\JgHBoIN.exe
  C:\Windows\System\JgHBoIN.exe
  2⤵
  PID:8368
- C:\Windows\System\PeexybC.exe
  C:\Windows\System\PeexybC.exe
  2⤵
  PID:8464
- C:\Windows\System\PbZXpZj.exe
  C:\Windows\System\PbZXpZj.exe
  2⤵
  PID:8532
- C:\Windows\System\VgvZnHR.exe
  C:\Windows\System\VgvZnHR.exe
  2⤵
  PID:8636
- C:\Windows\System\hVqXQnB.exe
  C:\Windows\System\hVqXQnB.exe
  2⤵
  PID:8648
- C:\Windows\System\eyInouS.exe
  C:\Windows\System\eyInouS.exe
  2⤵
  PID:10096
- C:\Windows\System\RZHCTbr.exe
  C:\Windows\System\RZHCTbr.exe
  2⤵
  PID:10540
- C:\Windows\System\OBWAFIE.exe
  C:\Windows\System\OBWAFIE.exe
  2⤵
  PID:10124
- C:\Windows\System\pAEVgXU.exe
  C:\Windows\System\pAEVgXU.exe
  2⤵
  PID:10728
- C:\Windows\System\PWyKRZb.exe
  C:\Windows\System\PWyKRZb.exe
  2⤵
  PID:10252
- C:\Windows\System\tzPsici.exe
  C:\Windows\System\tzPsici.exe
  2⤵
  PID:10424
- C:\Windows\System\yfBOgLW.exe
  C:\Windows\System\yfBOgLW.exe
  2⤵
  PID:10524
- C:\Windows\System\lZFZoal.exe
  C:\Windows\System\lZFZoal.exe
  2⤵
  PID:10640
- C:\Windows\System\OfqkhWd.exe
  C:\Windows\System\OfqkhWd.exe
  2⤵
  PID:10812
- C:\Windows\System\VbFVunP.exe
  C:\Windows\System\VbFVunP.exe
  2⤵
  PID:10896
- C:\Windows\System\WrWCoZe.exe
  C:\Windows\System\WrWCoZe.exe
  2⤵
  PID:11084
- C:\Windows\System\nBHDnkf.exe
  C:\Windows\System\nBHDnkf.exe
  2⤵
  PID:11164
- C:\Windows\System\zoipqUU.exe
  C:\Windows\System\zoipqUU.exe
  2⤵
  PID:11248
- C:\Windows\System\WgVFRPo.exe
  C:\Windows\System\WgVFRPo.exe
  2⤵
  PID:8568
- C:\Windows\System\ZGFLxDv.exe
  C:\Windows\System\ZGFLxDv.exe
  2⤵
  PID:8932
- C:\Windows\System\HZZgFCo.exe
  C:\Windows\System\HZZgFCo.exe
  2⤵
  PID:8988
- C:\Windows\System\kaCnhWk.exe
  C:\Windows\System\kaCnhWk.exe
  2⤵
  PID:9036
- C:\Windows\System\xpcFyYI.exe
  C:\Windows\System\xpcFyYI.exe
  2⤵
  PID:9084
- C:\Windows\System\CRNaAOa.exe
  C:\Windows\System\CRNaAOa.exe
  2⤵
  PID:9116
- C:\Windows\System\GkkpKLq.exe
  C:\Windows\System\GkkpKLq.exe
  2⤵
  PID:9184
- C:\Windows\System\naADDEB.exe
  C:\Windows\System\naADDEB.exe
  2⤵
  PID:9228
- C:\Windows\System\LdpqdxK.exe
  C:\Windows\System\LdpqdxK.exe
  2⤵
  PID:9280
- C:\Windows\System\TDQswEF.exe
  C:\Windows\System\TDQswEF.exe
  2⤵
  PID:9324
- C:\Windows\System\cibmGZf.exe
  C:\Windows\System\cibmGZf.exe
  2⤵
  PID:9368
- C:\Windows\System\wkMDQQZ.exe
  C:\Windows\System\wkMDQQZ.exe
  2⤵
  PID:9408
- C:\Windows\System\sRJamHV.exe
  C:\Windows\System\sRJamHV.exe
  2⤵
  PID:9448
- C:\Windows\System\IeKoITG.exe
  C:\Windows\System\IeKoITG.exe
  2⤵
  PID:9500
- C:\Windows\System\Kkhfcea.exe
  C:\Windows\System\Kkhfcea.exe
  2⤵
  PID:9640
- C:\Windows\System\ghAMGCI.exe
  C:\Windows\System\ghAMGCI.exe
  2⤵
  PID:9760
- C:\Windows\System\onkAqAi.exe
  C:\Windows\System\onkAqAi.exe
  2⤵
  PID:9800
- C:\Windows\System\SgUZcCG.exe
  C:\Windows\System\SgUZcCG.exe
  2⤵
  PID:9920
- C:\Windows\System\mLLJhfi.exe
  C:\Windows\System\mLLJhfi.exe
  2⤵
  PID:9956
- C:\Windows\System\cQHdEkl.exe
  C:\Windows\System\cQHdEkl.exe
  2⤵
  PID:10348
- C:\Windows\System\BZOxlYp.exe
  C:\Windows\System\BZOxlYp.exe
  2⤵
  PID:9968
- C:\Windows\System\ycEIQAn.exe
  C:\Windows\System\ycEIQAn.exe
  2⤵
  PID:10488
- C:\Windows\System\akaFskl.exe
  C:\Windows\System\akaFskl.exe
  2⤵
  PID:10584
- C:\Windows\System\WsyKUEl.exe
  C:\Windows\System\WsyKUEl.exe
  2⤵
  PID:11624
- C:\Windows\System\WupsyOu.exe
  C:\Windows\System\WupsyOu.exe
  2⤵
  PID:10792
- C:\Windows\System\ZYXohsB.exe
  C:\Windows\System\ZYXohsB.exe
  2⤵
  PID:1020
- C:\Windows\System\COcSutB.exe
  C:\Windows\System\COcSutB.exe
  2⤵
  PID:12300
- C:\Windows\System\nXnwaYO.exe
  C:\Windows\System\nXnwaYO.exe
  2⤵
  PID:12320
- C:\Windows\System\HZtoNjf.exe
  C:\Windows\System\HZtoNjf.exe
  2⤵
  PID:12344
- C:\Windows\System\MhODcmA.exe
  C:\Windows\System\MhODcmA.exe
  2⤵
  PID:12360
- C:\Windows\System\HZWotOO.exe
  C:\Windows\System\HZWotOO.exe
  2⤵
  PID:12380
- C:\Windows\System\dBlJUWj.exe
  C:\Windows\System\dBlJUWj.exe
  2⤵
  PID:12400
- C:\Windows\System\RURjvIh.exe
  C:\Windows\System\RURjvIh.exe
  2⤵
  PID:12420
- C:\Windows\System\FOyOAjQ.exe
  C:\Windows\System\FOyOAjQ.exe
  2⤵
  PID:12444
- C:\Windows\System\gCDMfWL.exe
  C:\Windows\System\gCDMfWL.exe
  2⤵
  PID:12464
- C:\Windows\System\SdoPPhO.exe
  C:\Windows\System\SdoPPhO.exe
  2⤵
  PID:12488
- C:\Windows\System\KqFjfDw.exe
  C:\Windows\System\KqFjfDw.exe
  2⤵
  PID:12508
- C:\Windows\System\FrRAkyU.exe
  C:\Windows\System\FrRAkyU.exe
  2⤵
  PID:12528
- C:\Windows\System\iFbrzGB.exe
  C:\Windows\System\iFbrzGB.exe
  2⤵
  PID:12552
- C:\Windows\System\HIoFtER.exe
  C:\Windows\System\HIoFtER.exe
  2⤵
  PID:12572
- C:\Windows\System\ZWccNxK.exe
  C:\Windows\System\ZWccNxK.exe
  2⤵
  PID:12596
- C:\Windows\System\zxTEIiy.exe
  C:\Windows\System\zxTEIiy.exe
  2⤵
  PID:12616
- C:\Windows\System\SLkxUlj.exe
  C:\Windows\System\SLkxUlj.exe
  2⤵
  PID:12640
- C:\Windows\System\udmfhIO.exe
  C:\Windows\System\udmfhIO.exe
  2⤵
  PID:12656
- C:\Windows\System\jSCWmvz.exe
  C:\Windows\System\jSCWmvz.exe
  2⤵
  PID:12680
- C:\Windows\System\CkBOqGn.exe
  C:\Windows\System\CkBOqGn.exe
  2⤵
  PID:12708
- C:\Windows\System\oLAmidt.exe
  C:\Windows\System\oLAmidt.exe
  2⤵
  PID:12728
- C:\Windows\System\NzPjWjM.exe
  C:\Windows\System\NzPjWjM.exe
  2⤵
  PID:12748
- C:\Windows\System\GmtAhpB.exe
  C:\Windows\System\GmtAhpB.exe
  2⤵
  PID:12768
- C:\Windows\System\apyTZUb.exe
  C:\Windows\System\apyTZUb.exe
  2⤵
  PID:12788
- C:\Windows\System\Ovdxtzs.exe
  C:\Windows\System\Ovdxtzs.exe
  2⤵
  PID:12812
- C:\Windows\System\hrWtMcQ.exe
  C:\Windows\System\hrWtMcQ.exe
  2⤵
  PID:12836
- C:\Windows\System\VNJPmWz.exe
  C:\Windows\System\VNJPmWz.exe
  2⤵
  PID:12856
- C:\Windows\System\ClDFLwQ.exe
  C:\Windows\System\ClDFLwQ.exe
  2⤵
  PID:12876
- C:\Windows\System\vChDMkE.exe
  C:\Windows\System\vChDMkE.exe
  2⤵
  PID:12900
- C:\Windows\System\BRSuMAw.exe
  C:\Windows\System\BRSuMAw.exe
  2⤵
  PID:12920
- C:\Windows\System\CSkMdKP.exe
  C:\Windows\System\CSkMdKP.exe
  2⤵
  PID:12940
- C:\Windows\System\gccQGuE.exe
  C:\Windows\System\gccQGuE.exe
  2⤵
  PID:12964
- C:\Windows\System\pxONKRW.exe
  C:\Windows\System\pxONKRW.exe
  2⤵
  PID:12988
- C:\Windows\System\hshpfbs.exe
  C:\Windows\System\hshpfbs.exe
  2⤵
  PID:10804
- C:\Windows\System\nLcDbfe.exe
  C:\Windows\System\nLcDbfe.exe
  2⤵
  PID:9700
- C:\Windows\System\ImOFfwI.exe
  C:\Windows\System\ImOFfwI.exe
  2⤵
  PID:9936
- C:\Windows\System\aCWbYuM.exe
  C:\Windows\System\aCWbYuM.exe
  2⤵
  PID:12808
- C:\Windows\System\YzLSOhF.exe
  C:\Windows\System\YzLSOhF.exe
  2⤵
  PID:12912
- C:\Windows\System\HqNxlWG.exe
  C:\Windows\System\HqNxlWG.exe
  2⤵
  PID:12948
- C:\Windows\System\IyiEZbv.exe
  C:\Windows\System\IyiEZbv.exe
  2⤵
  PID:11100
- C:\Windows\System\sYuGOoY.exe
  C:\Windows\System\sYuGOoY.exe
  2⤵
  PID:11124
- C:\Windows\System\IzwhQHo.exe
  C:\Windows\System\IzwhQHo.exe
  2⤵
  PID:7428
- C:\Windows\System\tVuAWkM.exe
  C:\Windows\System\tVuAWkM.exe
  2⤵
  PID:5368
- C:\Windows\System\wzqlYrJ.exe
  C:\Windows\System\wzqlYrJ.exe
  2⤵
  PID:11344
- C:\Windows\System\xMyOrmD.exe
  C:\Windows\System\xMyOrmD.exe
  2⤵
  PID:11744
- C:\Windows\System\EwUweqJ.exe
  C:\Windows\System\EwUweqJ.exe
  2⤵
  PID:11556
- C:\Windows\System\XCcECXY.exe
  C:\Windows\System\XCcECXY.exe
  2⤵
  PID:11544
- C:\Windows\System\ozPBaAd.exe
  C:\Windows\System\ozPBaAd.exe
  2⤵
  PID:11512
- C:\Windows\System\dtrfECk.exe
  C:\Windows\System\dtrfECk.exe
  2⤵
  PID:11484
- C:\Windows\System\MuqnUUJ.exe
  C:\Windows\System\MuqnUUJ.exe
  2⤵
  PID:7972
- C:\Windows\System\wEdeFxi.exe
  C:\Windows\System\wEdeFxi.exe
  2⤵
  PID:13264
- C:\Windows\System\Jpsgrct.exe
  C:\Windows\System\Jpsgrct.exe
  2⤵
  PID:9812
- C:\Windows\System\lkfWHeu.exe
  C:\Windows\System\lkfWHeu.exe
  2⤵
  PID:9072
- C:\Windows\System\NFigajR.exe
  C:\Windows\System\NFigajR.exe
  2⤵
  PID:10020
- C:\Windows\System\fFTBFJD.exe
  C:\Windows\System\fFTBFJD.exe
  2⤵
  PID:10716
- C:\Windows\System\vIfypTd.exe
  C:\Windows\System\vIfypTd.exe
  2⤵
  PID:10504
- C:\Windows\System\GsQEScG.exe
  C:\Windows\System\GsQEScG.exe
  2⤵
  PID:4936
- C:\Windows\System\dNnjmpj.exe
  C:\Windows\System\dNnjmpj.exe
  2⤵
  PID:12116
- C:\Windows\System\PkbtNij.exe
  C:\Windows\System\PkbtNij.exe
  2⤵
  PID:12624
- C:\Windows\System\HVHvWSm.exe
  C:\Windows\System\HVHvWSm.exe
  2⤵
  PID:12676
- C:\Windows\System\cQsexwo.exe
  C:\Windows\System\cQsexwo.exe
  2⤵
  PID:12740
- C:\Windows\System\gaEGIXb.exe
  C:\Windows\System\gaEGIXb.exe
  2⤵
  PID:12220
- C:\Windows\System\UGHtFnz.exe
  C:\Windows\System\UGHtFnz.exe
  2⤵
  PID:13032
- C:\Windows\System\dboHHGo.exe
  C:\Windows\System\dboHHGo.exe
  2⤵
  PID:10460
- C:\Windows\System\RhhwmmQ.exe
  C:\Windows\System\RhhwmmQ.exe
  2⤵
  PID:12204
- C:\Windows\System\zWXXHpu.exe
  C:\Windows\System\zWXXHpu.exe
  2⤵
  PID:5084
- C:\Windows\System\rlDJskU.exe
  C:\Windows\System\rlDJskU.exe
  2⤵
  PID:11596
- C:\Windows\System\OhcmeIu.exe
  C:\Windows\System\OhcmeIu.exe
  2⤵
  PID:11524
- C:\Windows\System\wqNllvJ.exe
  C:\Windows\System\wqNllvJ.exe
  2⤵
  PID:12056
- C:\Windows\System\iAuvEQg.exe
  C:\Windows\System\iAuvEQg.exe
  2⤵
  PID:12308
- C:\Windows\System\zoTSzkb.exe
  C:\Windows\System\zoTSzkb.exe
  2⤵
  PID:8228
- C:\Windows\System\BWJQjKh.exe
  C:\Windows\System\BWJQjKh.exe
  2⤵
  PID:10000
- C:\Windows\System\XQtErqE.exe
  C:\Windows\System\XQtErqE.exe
  2⤵
  PID:2492
- C:\Windows\System\ZTGbies.exe
  C:\Windows\System\ZTGbies.exe
  2⤵
  PID:9836
- C:\Windows\System\vbDtWbN.exe
  C:\Windows\System\vbDtWbN.exe
  2⤵
  PID:12184
- C:\Windows\System\fSSZKrb.exe
  C:\Windows\System\fSSZKrb.exe
  2⤵
  PID:13316
- C:\Windows\System\fwdLhMC.exe
  C:\Windows\System\fwdLhMC.exe
  2⤵
  PID:13336
- C:\Windows\System\ZrcTiMS.exe
  C:\Windows\System\ZrcTiMS.exe
  2⤵
  PID:13680
- C:\Windows\System\eMhArZJ.exe
  C:\Windows\System\eMhArZJ.exe
  2⤵
  PID:13708
- C:\Windows\System\CAGhFfc.exe
  C:\Windows\System\CAGhFfc.exe
  2⤵
  PID:13740
- C:\Windows\System\DwHEUdq.exe
  C:\Windows\System\DwHEUdq.exe
  2⤵
  PID:13760
- C:\Windows\System\AjDzBbb.exe
  C:\Windows\System\AjDzBbb.exe
  2⤵
  PID:13780
- C:\Windows\System\ScgiRbk.exe
  C:\Windows\System\ScgiRbk.exe
  2⤵
  PID:13800
- C:\Windows\System\BiYVOit.exe
  C:\Windows\System\BiYVOit.exe
  2⤵
  PID:13828
- C:\Windows\System\NgqSeCJ.exe
  C:\Windows\System\NgqSeCJ.exe
  2⤵
  PID:13844
- C:\Windows\System\SIgssgz.exe
  C:\Windows\System\SIgssgz.exe
  2⤵
  PID:13864
- C:\Windows\System\lkTPCvK.exe
  C:\Windows\System\lkTPCvK.exe
  2⤵
  PID:13880
- C:\Windows\System\DVQEPjU.exe
  C:\Windows\System\DVQEPjU.exe
  2⤵
  PID:13900
- C:\Windows\System\qjzpzik.exe
  C:\Windows\System\qjzpzik.exe
  2⤵
  PID:13992
- C:\Windows\System\ICwRdMc.exe
  C:\Windows\System\ICwRdMc.exe
  2⤵
  PID:14012
- C:\Windows\System\ltiwmHu.exe
  C:\Windows\System\ltiwmHu.exe
  2⤵
  PID:14032
- C:\Windows\System\wUowuam.exe
  C:\Windows\System\wUowuam.exe
  2⤵
  PID:14052
- C:\Windows\System\lyhhbDf.exe
  C:\Windows\System\lyhhbDf.exe
  2⤵
  PID:14180
- C:\Windows\System\ihpJJQO.exe
  C:\Windows\System\ihpJJQO.exe
  2⤵
  PID:14196
- C:\Windows\System\scIMQXp.exe
  C:\Windows\System\scIMQXp.exe
  2⤵
  PID:14224
- C:\Windows\System\aPCInSS.exe
  C:\Windows\System\aPCInSS.exe
  2⤵
  PID:14240
- C:\Windows\System\SrYONMM.exe
  C:\Windows\System\SrYONMM.exe
  2⤵
  PID:14264
- C:\Windows\System\klOLThC.exe
  C:\Windows\System\klOLThC.exe
  2⤵
  PID:14280
- C:\Windows\System\BziYkeh.exe
  C:\Windows\System\BziYkeh.exe
  2⤵
  PID:14308
- C:\Windows\System\bLvTpDP.exe
  C:\Windows\System\bLvTpDP.exe
  2⤵
  PID:864
- C:\Windows\System\jNBvShE.exe
  C:\Windows\System\jNBvShE.exe
  2⤵
  PID:464
- C:\Windows\System\pqzEEXb.exe
  C:\Windows\System\pqzEEXb.exe
  2⤵
  PID:7924
- C:\Windows\System\yoQNkGS.exe
  C:\Windows\System\yoQNkGS.exe
  2⤵
  PID:10604
- C:\Windows\System\qVoTNnt.exe
  C:\Windows\System\qVoTNnt.exe
  2⤵
  PID:12436
- C:\Windows\System\cGVypki.exe
  C:\Windows\System\cGVypki.exe
  2⤵
  PID:13016
- C:\Windows\System\VmASAWe.exe
  C:\Windows\System\VmASAWe.exe
  2⤵
  PID:10192
- C:\Windows\System\OBZSAoD.exe
  C:\Windows\System\OBZSAoD.exe
  2⤵
  PID:1184
- C:\Windows\System\YkzTMnu.exe
  C:\Windows\System\YkzTMnu.exe
  2⤵
  PID:13484
- C:\Windows\System\dinoPBd.exe
  C:\Windows\System\dinoPBd.exe
  2⤵
  PID:13464
- C:\Windows\System\deMPrRm.exe
  C:\Windows\System\deMPrRm.exe
  2⤵
  PID:13428
- C:\Windows\System\lxycUNk.exe
  C:\Windows\System\lxycUNk.exe
  2⤵
  PID:13396
- C:\Windows\System\OWTKoSS.exe
  C:\Windows\System\OWTKoSS.exe
  2⤵
  PID:13364
- C:\Windows\System\wSrqAEe.exe
  C:\Windows\System\wSrqAEe.exe
  2⤵
  PID:13704
- C:\Windows\System\tjfQqHl.exe
  C:\Windows\System\tjfQqHl.exe
  2⤵
  PID:13056
- C:\Windows\System\CMQbEWQ.exe
  C:\Windows\System\CMQbEWQ.exe
  2⤵
  PID:13956
- C:\Windows\System\dddIZCE.exe
  C:\Windows\System\dddIZCE.exe
  2⤵
  PID:14216
- C:\Windows\System\ErCBNBq.exe
  C:\Windows\System\ErCBNBq.exe
  2⤵
  PID:14324
- C:\Windows\System\lMMHYDv.exe
  C:\Windows\System\lMMHYDv.exe
  2⤵
  PID:14316
- C:\Windows\System\MzzUzNd.exe
  C:\Windows\System\MzzUzNd.exe
  2⤵
  PID:8456
- C:\Windows\System\oxpKYOZ.exe
  C:\Windows\System\oxpKYOZ.exe
  2⤵
  PID:6496
- C:\Windows\System\fXJxNxg.exe
  C:\Windows\System\fXJxNxg.exe
  2⤵
  PID:9300
- C:\Windows\System\fbFajSg.exe
  C:\Windows\System\fbFajSg.exe
  2⤵
  PID:7652
- C:\Windows\System\UTWRwfq.exe
  C:\Windows\System\UTWRwfq.exe
  2⤵
  PID:1204
- C:\Windows\System\IdlbpGh.exe
  C:\Windows\System\IdlbpGh.exe
  2⤵
  PID:5052
- C:\Windows\System\aIPFrBy.exe
  C:\Windows\System\aIPFrBy.exe
  2⤵
  PID:13060
- C:\Windows\System\wDeAtgL.exe
  C:\Windows\System\wDeAtgL.exe
  2⤵
  PID:11996
- C:\Windows\System\DvYNwYd.exe
  C:\Windows\System\DvYNwYd.exe
  2⤵
  PID:12016
- C:\Windows\System\VEKqUfa.exe
  C:\Windows\System\VEKqUfa.exe
  2⤵
  PID:4788
- C:\Windows\System\pktfwCJ.exe
  C:\Windows\System\pktfwCJ.exe
  2⤵
  PID:11912
- C:\Windows\System\WdbsXlK.exe
  C:\Windows\System\WdbsXlK.exe
  2⤵
  PID:12584
- C:\Windows\System\DLWibQY.exe
  C:\Windows\System\DLWibQY.exe
  2⤵
  PID:7584
- C:\Windows\System\NolrACV.exe
  C:\Windows\System\NolrACV.exe
  2⤵
  PID:9056
- C:\Windows\System\UUHkAmV.exe
  C:\Windows\System\UUHkAmV.exe
  2⤵
  PID:13964
- C:\Windows\System\uLvHnEn.exe
  C:\Windows\System\uLvHnEn.exe
  2⤵
  PID:13408
- C:\Windows\System\lvzfYAR.exe
  C:\Windows\System\lvzfYAR.exe
  2⤵
  PID:13520
- C:\Windows\System\wdaDHmK.exe
  C:\Windows\System\wdaDHmK.exe
  2⤵
  PID:13812
- C:\Windows\System\URHByyq.exe
  C:\Windows\System\URHByyq.exe
  2⤵
  PID:13944
- C:\Windows\System\BOjbPuH.exe
  C:\Windows\System\BOjbPuH.exe
  2⤵
  PID:13600
- C:\Windows\System\aoxpVIV.exe
  C:\Windows\System\aoxpVIV.exe
  2⤵
  PID:14276
- C:\Windows\System\RaACmPf.exe
  C:\Windows\System\RaACmPf.exe
  2⤵
  PID:13500
- C:\Windows\System\bIauEDp.exe
  C:\Windows\System\bIauEDp.exe
  2⤵
  PID:14024
- C:\Windows\System\CsEaqyS.exe
  C:\Windows\System\CsEaqyS.exe
  2⤵
  PID:14080
- C:\Windows\System\nYhYsLY.exe
  C:\Windows\System\nYhYsLY.exe
  2⤵
  PID:14092
- C:\Windows\System\AVGHDbF.exe
  C:\Windows\System\AVGHDbF.exe
  2⤵
  PID:2028
- C:\Windows\System\sRAmqYN.exe
  C:\Windows\System\sRAmqYN.exe
  2⤵
  PID:10236
- C:\Windows\System\FlWnsxz.exe
  C:\Windows\System\FlWnsxz.exe
  2⤵
  PID:7444
- C:\Windows\System\TlARoYG.exe
  C:\Windows\System\TlARoYG.exe
  2⤵
  PID:7348
- C:\Windows\System\musnzjm.exe
  C:\Windows\System\musnzjm.exe
  2⤵
  PID:9392
- C:\Windows\System\FOJDMcy.exe
  C:\Windows\System\FOJDMcy.exe
  2⤵
  PID:12864
- C:\Windows\System\pQiSQnV.exe
  C:\Windows\System\pQiSQnV.exe
  2⤵
  PID:13208
- C:\Windows\System\PsAQSIm.exe
  C:\Windows\System\PsAQSIm.exe
  2⤵
  PID:12440
- C:\Windows\System\fOtLkQq.exe
  C:\Windows\System\fOtLkQq.exe
  2⤵
  PID:13144
- C:\Windows\System\WlqgDhe.exe
  C:\Windows\System\WlqgDhe.exe
  2⤵
  PID:14188
- C:\Windows\System\ZWXlTNt.exe
  C:\Windows\System\ZWXlTNt.exe
  2⤵
  PID:5908
- C:\Windows\System\BJwKRDu.exe
  C:\Windows\System\BJwKRDu.exe
  2⤵
  PID:12724
- C:\Windows\System\rMwwdXY.exe
  C:\Windows\System\rMwwdXY.exe
  2⤵
  PID:12224
- C:\Windows\System\KMRcFav.exe
  C:\Windows\System\KMRcFav.exe
  2⤵
  PID:12704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wpfphypr.q2j.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BDMStOA.exe

Filesize
1.5MB

MD5
1277a2a2f3e51893abdd2dc4e806af31

SHA1
f389ab3ff1cad8b834a743b8bb5ad3aa1ed892ea

SHA256
d0715a52d291a02bf3d9dd3af73cde03abbb2eede9c5632c67ec519ada4fd5b2

SHA512
925c5a51929e8af73e5d7f1fcb27823220d476afef1d3a2f15de7c8ad9a1734501619bdfbc2edd2e962ac7bcc6adc0a12f8e0f70df6a92987dc487a309a93ed4

Download Submit
C:\Windows\System\BhfOLLA.exe

Filesize
1.5MB

MD5
1bb35fd5864a03218a0adf47d77305b1

SHA1
55d41bb1aea92ecfabbf94fe2355ca9e04568461

SHA256
1b0e4334a5cb318d60ead0042276d2f934e24b578d7df70a2379e8901214e59f

SHA512
01882aceccb960cecab27ecb3aa24f8f74a58664d841506053393efc2ba789b9f32b97806642ac86a98961caf5c83d6724f3eddb541f0221c2e5df449496253b

Download Submit
C:\Windows\System\BtsHHhC.exe

Filesize
1.5MB

MD5
d8e22f9d151c7defb665b2a3423448a8

SHA1
64cf0e4c7649a55679e32f9e3fd2280b3b9473c5

SHA256
0be31b2d4e7152e9f47578f62dc8ee52808b9f4564a640954fef832a4789edf8

SHA512
98e68eb7ea3c84ef30d75ec4ad8d86e75c6169bf40357d9c789b4f2302522a7faba0fd32b7aaf71302628fe90e5e9bdfbf2d6581f52d1a61be9bb53e27aa25c2

Download Submit
C:\Windows\System\CBXhaNP.exe

Filesize
1.5MB

MD5
88adf1d9f9dddc05ae0ba3c4c2b0951a

SHA1
cf41063e062ce01e040dac051b0cf3ad1e1c8fdc

SHA256
e1ae09d0187be185df0efa478020548123a656d5a4a80db30ae5c5628d126228

SHA512
4ca083c7588e854c7dcbd6e8a53a26f01c96e2222050a461cdab7be593b75bd34014066372a5b817dd3274de6a2daaa1b8ac3ff0538961d7490695643366ac10

Download Submit
C:\Windows\System\CuoNSZm.exe

Filesize
1.5MB

MD5
e59e646376eeb8bd87b1a220a35d99cf

SHA1
3c430314fd00a2c51b87fa5187ac634dc2b52ead

SHA256
006eaf7b207a2d0b21190b7375c08ffbbed7c1889575067422739cc1999522d2

SHA512
9a946f2586b4ed0f2c3deb29e8554a3958611fec7bde0d1af75cb93282861d0e498bb39dcaaa74eaa4c6625668ea0f583a5b1f0627304380eb1fa00d34011b5d

Download Submit
C:\Windows\System\FfRxYwG.exe

Filesize
1.5MB

MD5
4bfa7826c70ef9456a69cdca95f636f6

SHA1
a424ba1ab471f38e2fafbf700aff8302f8abcf21

SHA256
763388d6b5523af108d66c415304967cf0639197e55c6493a8d1f7e3b235b997

SHA512
4a10c8b4b86c135a2ef1c3fb5b2cdb9dd759c2a2cc77f257a559b01375bf65ed570d6889c99e95697f1e3c7b8bbfda3914bc277afe4dcd900e2e3be6c849e698

Download Submit
C:\Windows\System\GdsfAhs.exe

Filesize
1.5MB

MD5
d00dd470ffad75f72b45d54767748ec0

SHA1
6a9f03ce8406019e9964d66e5aff5edfccdbb5f7

SHA256
aed5b983587275e13ce6e0c41a158b27a0b1d1e1cc970958e753f3a7b09061b6

SHA512
badde5968a3e84a2b03aacc926b91fe730a19893bac2df6547069e9a7093523785dd5616606d7c5da4c7d1fb7b412e2c3d5bf6094e0487acbdcb0270b64ae033

Download Submit
C:\Windows\System\GmRQdAS.exe

Filesize
1.5MB

MD5
a86488f51c7afb0698954ff197663527

SHA1
2fc189086c651c78e0c89dd246989ebb93e56caf

SHA256
a200a562c3a38dbd848af20848edd3343fab07d2eecbd684522423b0f8b92286

SHA512
642f2320aa00b85e4b07b79fdfb62526fa61629ecf927a4de5c57b46f4b64c30e07ac1e2ff7acbcea083ae4fca5d971911e54e57ce9b30f8ad49ea620da71c86

Download Submit
C:\Windows\System\HxwFCJE.exe

Filesize
1.5MB

MD5
91a5aa530a32efad82ded01d9275e41d

SHA1
d061b14d07f060430ab70aa4c0893569bd57eaa4

SHA256
70fc129f113e76036b7c8cea9e5c38d7789e0bf21f76c119e0a72fe4bc18e585

SHA512
7db0f50ec953acb2a690ad7303ac527c2a05763b4f31e0930cb292bf542c258701c6cb19e0267686775fc83bfd9d457f0533c913c2a0713952cfab18e0c45511

Download Submit
C:\Windows\System\IiRJNnU.exe

Filesize
1.5MB

MD5
2a8ec3d2c74f23b4f2535da1091e1baf

SHA1
3b1481e973aae90800dd417fe7124ae104839620

SHA256
2cf3ad09bd63b6a7f8a5ece6770a178a0103347f8895892b01214cec850f25a1

SHA512
c63495145e5bf8614bc26783934f6d66d37112ed61ffaf45e7562df1a0631f525027bfde1d5dd97304871f5d4d2c6e08bcf91c3546aa4739dceacbec582a772a

Download Submit
C:\Windows\System\JPFROMP.exe

Filesize
1.5MB

MD5
510a21597d19ddc98c589cac3587ec52

SHA1
db9aa7be27dcbbbbc57f8849dec25462e1073d30

SHA256
b8039fb089190349f1f26c6b4e59b9544e031ea985142f38afabccbd5d33da09

SHA512
98ecd08c7e4dcf0a1645aaea7f3e57c2bc606501aaecf2fd0726123a1ad4a4e9e7c92a3399ae54652cb61248b7e90de558b8037cdbfe00469aa8267c5c06ab01

Download Submit
C:\Windows\System\KzXVDms.exe

Filesize
1.5MB

MD5
2b24cc2828255b2b29676e43aea73103

SHA1
411485826d67e4f383e4a156eb6b9b77601abf50

SHA256
18b5133e14c562151ccf60e8304a3f5f6c575b4113849124e8440b076fcac8a2

SHA512
e3738b720b8f5cda53bb0288d0011d71e3741d1bde09d776fb478e491c0ed118284b05eb4b586fdd404e7d3690db2efc88934e82a4fa6b5cd5bcd574a9300595

Download Submit
C:\Windows\System\LKJoEeu.exe

Filesize
1.5MB

MD5
a6bf3f47c2ef72bf060bcbd041927de9

SHA1
6d5f8225643f7df35c5d26eeb3b90c93d2ca27af

SHA256
7b8b88e26212cf2c42d153453baaa18d38e4f0a493c290939f2f0415342a0b60

SHA512
022b41d0fa60cc633806acc0b41ddc5875ee027bf9e19291302c274325bc88be38c771197eda36a9d27d488cb5c8cc829f6438f0f36a35c85ed0793c0bb8193b

Download Submit
C:\Windows\System\MWtSsuV.exe

Filesize
1.5MB

MD5
cb1158080ff02c9a2065fe02b64e1654

SHA1
7842d294d0a767257a76db50c0935bfc0868a4b6

SHA256
8ef309ba18b95ac54c2710485b4718c80e72769f7e0c18cd71d1e9802426d34d

SHA512
6a21bd8c81584cc28cd7e97cfa64a3103e58d1f7704b474640c2a5277693ea3cb84d60451cd68f72fe78863d9e2aaf22421404d4e47211947eb430e8f4c73356

Download Submit
C:\Windows\System\NQgVXfT.exe

Filesize
1.5MB

MD5
8699212fc14c8e1a04003ed8795da961

SHA1
124caab3643b734482c32f16036b91079bc89b66

SHA256
ba5b25cb9e023630db5db3da8e0526a7a9428bb4f044f15afc4e239e5f0f6f13

SHA512
6d917ed1ea19e08124ff05a65a093956e9bb57fb132b819e5e2201b1ca417e68fdd107b2091f8e9ed2828eeb004ec5bc2c81eb2fd15cedb2ffff3e480c5f6450

Download Submit
C:\Windows\System\NXHUdAQ.exe

Filesize
1.5MB

MD5
1115edd06ccca2563a8df75ff926c4fe

SHA1
475b11a61b2bb14bb2bf76adab64482dbd3850ac

SHA256
9cf8dcb9121a85aa8192466152974a74df8ed93d256f72e20fda9e7a37b8d2b0

SHA512
fadc1e8a91e352f9fa6bd9dbf555997d093418ac6045ada3f942c4cbc69b9dd68f6a8745a4b87081a79ee6aee5498c3497ae89a1604458c6a897c1576ed97762

Download Submit
C:\Windows\System\SYLlYUn.exe

Filesize
1.5MB

MD5
70c902dd9621ed5d7599bd3a12320f22

SHA1
013d0561bfe54fe0e0e15e3446023edfd472c2a6

SHA256
835ab661ad45ab71d52a5668e993bfab84073a2abec0a1dc0007104b6dbff50a

SHA512
ee5897e05b482e5b541310f31cba7d6414d294e44c6ab628c2e0f7f327b8105eb16c8975b8a64818bbf4688d14f512fa4f0d89d7d5a5e849733c6ae064a6921b

Download Submit
C:\Windows\System\TOZaoRl.exe

Filesize
1.5MB

MD5
6ae6e9d384b2fa4735ad6c96194809de

SHA1
1be3f7870da65de990d2911eccc3637e1e0dda90

SHA256
fd089084f1cf3a5eb834c164290458a7cf3c2663acade58a4eabf20c8e760835

SHA512
404b37ee47e32d4565beb147525c2e1da2c437ab76d9bd833b55d5d7deb2926aadd624ce1626c45e4ba0c2e3e717645260630f6f49c6820df17340dadb2e0873

Download Submit
C:\Windows\System\TOsDEKX.exe

Filesize
1.5MB

MD5
b07ff98c64e3fc05e68ab55627a48086

SHA1
bfa42c8e77f700e738ad80c76cdec628b7fe68dd

SHA256
838211b6ff13aba88b62f7194d40ec604a09a966d9a267a0a4b0c927110c71a8

SHA512
ea52c49f2ce21ddaa494380f05877b171603f3f555e62b841023964cfb7e6fbd5b3ebb8c0215e8e2dc1a960b66bc8ae20ae685ba5b7f7cccff271b6e299d560d

Download Submit
C:\Windows\System\WPYblGJ.exe

Filesize
1.5MB

MD5
9b0c349562e9af302f72b6820844738a

SHA1
3cb45ce0b8049206efb09088c6b307ce41f65609

SHA256
8384d546e7ad835e57a346d309fcb9a892e690b8dcbe3b2bc900fa7cb7463a89

SHA512
b3f0baccce6e0f9957cf879b85376559e3a32fb0318f441973154f43b848e6e38ee60f02b18f242084adc7e56a9ed8272a071863e5bf317aab5700c02a94cd47

Download Submit
C:\Windows\System\WVxuxQw.exe

Filesize
1.5MB

MD5
5fcc5a27eaaefcebb76b58b8ca288ebc

SHA1
f36edba6300e0ed2585e816bdbdb8c2a604c08c7

SHA256
903013ac98ea875f3518a437ce46cefbca2f43718b0c5ed473aadf6850403aa1

SHA512
0b86242c5a1a8163a26dfb63946f5d763711f02f74faef3311c1c9e9ddc7de02799663541ea416f7099336b1c9b1c9bc756efd56221db029e2ab1d14a22679ae

Download Submit
C:\Windows\System\XjggNPj.exe

Filesize
1.5MB

MD5
eb4357f16a2efb30b160e1d59fb8ec43

SHA1
f22879f3f2318bf69b1962a91da7236ae38f5cd6

SHA256
ffe374346aa15034dcdfd63e752aad182178dbc1755e402ef0c3cd76949083f3

SHA512
c0eab773adfeeccbb7be0c094ccb9ddb700ddd1be2689a901755e1bf08a25d607f76bfbec2a05728f8f98de9d401fb033ddaca7c1517599649eb23fabe893256

Download Submit
C:\Windows\System\ZAAfbOM.exe

Filesize
1.5MB

MD5
84f46edc5bbaa312758afe283e1489aa

SHA1
a59952434fbdf17986a87455d297777f59272b18

SHA256
2743d7db141da3c5268de00b33264f9b95b409e2f1c82f169b1343d138866bc7

SHA512
e17594adc59ac4d11f6404338d9cac60aae05524642485c8e0361dfe2ac47944b39376db7efc13624cd54477ba37fee311180d30f3d14f721acd4b5d1caa26ea

Download Submit
C:\Windows\System\eHJbeBJ.exe

Filesize
1.5MB

MD5
d3a912d4dccfce8890d7b597ee0a9d99

SHA1
06d53ad1216cc8b4fa79068d029da70321998ca8

SHA256
e40b3af2a99d2a11e4fa65d593b81541cb178144977e8b45f37d54d92d15c38e

SHA512
6c69de0db5df1d2feecf54523e5451b54c291aa6f36bcea709d1f2e19c6da2e7bceaaf17f94e256319431c7462a71e3ca0a1553025e9922a35e01ba77e2e4659

Download Submit
C:\Windows\System\eXCFrBU.exe

Filesize
1.5MB

MD5
a3e48c6f11073b44fdf0bb5a74d09d92

SHA1
74ec4f095137167c2cd460c294fe86c4b2dea8b3

SHA256
b1d30fc435adceb3d9b73211faf76b00bf64d0036c2ba2411b4cb93d682fbfc0

SHA512
a8e0edc78347a00009b1d9fb58b0c9200b58625b9f7ca00e5ce0e0994124819089d5c4a242979f84ebef4ff3e4547fb40dad8af90ef2f4fbdb7d57b491b882d4

Download Submit
C:\Windows\System\foaDUdk.exe

Filesize
1.5MB

MD5
d82b67d5dd013fbbcf9ca43bf5dddea7

SHA1
a7ccfaf3847fc8690149c4c0f02b007617e15b01

SHA256
f11caa2e05bfb30635d2a2655a5733c5978c657041442aa9ba467200b5413ad1

SHA512
e36f6ff8c5ef287746e04330788edc42febff8ffebec664217d21e9f88c4c3c9b67744eb6068a5e967b97ee2ccdfce5a2b16c4d2110c5d4a6fc9aebe0ef76529

Download Submit
C:\Windows\System\gTZnISP.exe

Filesize
1.5MB

MD5
c2b91341919f5fb3595f8b5d3be0db2b

SHA1
b2e535e389f525843a13c09a0560a8a803f639c2

SHA256
3d7463d8d156f9d9af92e2bea967f6aad78f5f81a316c630e8ce971d75d7c5c0

SHA512
c443d453814e1f41fcabd9af3d8462d2483d7a759eb127bb811f82cf0c3f4fca79cef1334db92fa605cd7db9edf504936c28bb5708c363e513813c24b637862b

Download Submit
C:\Windows\System\gUfbLEB.exe

Filesize
8B

MD5
ad0a600ae38696a8cc7e0f79411b2de6

SHA1
e87da271dcefadc951fbf5de19cf84d8eac21a84

SHA256
8b51c7a5f3eb99b3c4bcad7fefc2c88bfb65a6efdf82c5da3d059595d1d0e9e9

SHA512
8d7e2808f4dca3686017927cee741a76a04a23b60c921209487adb614bfe800ba56bdec391d20388143da8e914411c7e8c63572944ba9607a1d2a18c62d04b2f

Download Submit
C:\Windows\System\hHNNUxE.exe

Filesize
1.5MB

MD5
bf2592f4b5f4ba6ced2de83a30193b47

SHA1
d2346eb7bc4ed255a70c9242d29cbff40c37a680

SHA256
8700697144450e90e501fe69331a80b17f4279cbc686caa9498606d2860389cf

SHA512
655cc83305965602aca5adbd28cde2ce22ac9f30355d00321c478330da09858b591f9b81729b7ee275981f0a550dc7c3aa486e566ec83a28badd1492cdc95bf2

Download Submit
C:\Windows\System\hppeLVy.exe

Filesize
1.5MB

MD5
eca741b0ce9e54e77bb21f7995de957c

SHA1
ed01ebcc9e3456b2c81c693f4ad0d7e1abfe232e

SHA256
325f2bebeddbbeb8710ff7635906e7bd0f5f537243f190c3d184f8b5a9dcc2b0

SHA512
19527385467c07349b1d77fb1a9e832a5161fc8f0e2f95bd191cc23cc94c94bdaaa07e891d17233cbd784a92b5ba89a87151e19f80cf4d79db62667e591eb50e

Download Submit
C:\Windows\System\iFFlmId.exe

Filesize
1.5MB

MD5
c849fb67a6ecc502075970bfd8701808

SHA1
74acacd103fa09306103b53080db9f50fcc29f76

SHA256
806d49bd61a1475cf98dce706e59e7b881a5ea94b21988ae40d0f90af79a32ea

SHA512
02bc2a536dcaa2c30b23d430feb5bbb5ba89293f97cb0e1940e795eb293dd3ebfce96fe9e7d7ba4814a0e80218c10c38f9573ae8cf5e14309bee288f344a18ac

Download Submit
C:\Windows\System\nDYeCVj.exe

Filesize
1.5MB

MD5
d330d650e4f7785af932b5caa671bbd7

SHA1
5e562869927d97857681ac25ccbae786fab1516f

SHA256
52f2f82973e3cc49a2b99171238f71796093667eac7d5d9d4a0a2f96f6f265ff

SHA512
d490e2911793c9f6971e66a7d4bc6048c3df00d6573bec2c6499c35b9242b50be83ce8b1151568f4d16cbb25a666cca0e1a5290fa4ab692eaaa095987ec6f093

Download Submit
C:\Windows\System\nNNmAEj.exe

Filesize
1.5MB

MD5
6fe15de7c48ad24945590fc96aee8c65

SHA1
102c1a5e25f9b76cd0d15e2f2c572e9284c25e47

SHA256
1af61f7244a335affc939588ec337eb2182e4539b8abd073b606418cddc6894b

SHA512
844ad1066d44f4903988f393550de432cf68d3d02837578f8ad2c2c5bd0f9c56e07a94270cd5d4146da04f1398f97d4074de1bb175a13ef4abbc9100d6fed932

Download Submit
C:\Windows\System\pBsaDdS.exe

Filesize
1.5MB

MD5
3b4d0f53d184ba9fbda2f4d6220bafdb

SHA1
aa11ad7652ad96a4e40756bb683d05cda44ad1dc

SHA256
79b8f100bb14b29823c3801547fc083b87781430eb33679acd47be606e801fe8

SHA512
1652fb984ebb774d9ae99982f8621663e1a4e4f7790be96a2c1c2ffa86647fae7ae0dc849822fdd039108bf2f553f7b4cecce4ec97fa598bd1f63c27a69eb5f4

Download Submit
C:\Windows\System\pXuDZRi.exe

Filesize
1.5MB

MD5
dd3cdcea4f9f304c2429fbfba64e2e92

SHA1
3c66b85f7eb0a5ee0c63cfc267266de6f2fba1ef

SHA256
343c13f2f3dda9f020cddec674da42fd097bb7da41b5c846267e402783656162

SHA512
b6c7469e200ec7c2919268dbe34582a263b0584fa27b367927497bcfd7b17f8555afeb608fcaa7246124822a1d2cebf4894ec44d97e1f0285417376ea5ca9b53

Download Submit
C:\Windows\System\qaDsOVQ.exe

Filesize
1.5MB

MD5
bd90a6e33c83cfcebde1537ae2d73263

SHA1
1dbf1b202348e0bed012a6176bd9b17266c49253

SHA256
7e0a9939ea952b16edf34669bbc59b4cf68124f58dd4f4967f3229b6a7054e91

SHA512
76322bf5aae0c79732f60802999e190ac9b6cab971b00a3573dcca62f72551e98ebe2d594de88bc4531738ca6b500a3fe6e3a9bab0205aa189a19098f146629f

Download Submit
C:\Windows\System\qhxSFjk.exe

Filesize
1.5MB

MD5
7dfbf2547fffcb697545bfdbf2523d71

SHA1
a0480fc9ddd4f9349bb632f7f0eebfa46d07a4ed

SHA256
5429c7f4c64889fbf39e3406e7f175ff09dc5f7f6b469cd95ceb64ee854d7c6b

SHA512
98bb669c0a6f6ceddc17f04d624109fddfb523ce6dc76b916217820aa6ad4fd38ee38275af1b07b044b1e671b57ead50b2f4dd66097c124652e9c4cb6085c632

Download Submit
C:\Windows\System\rToUIEq.exe

Filesize
1.5MB

MD5
0b1e269178b7b7b09aed2882fc84ec32

SHA1
4f93e4693470620944f1fef4037e40e947973794

SHA256
7955c0a68dec1c5d65f84ff3fb60109c3571e7ab6195203b138b47ac9ec94dfe

SHA512
d554605af96797af866e57caa5fd171fd95edc6cf14579cbb1f445d3340df6c1eeecfd8c9c029641ede7cf3d7d13f1bf428cdaa97fa8bcbdd888c4bcbffaacd5

Download Submit
C:\Windows\System\rooxNUw.exe

Filesize
1.5MB

MD5
46781bb472fc71c07fd16d71430d931d

SHA1
e673d5e1dc63fbc613de179cd1dba4d02867cbc5

SHA256
f5c93b7f20ca9b74477f753e2a12fc195621a118abf5487d2459263dbdcb759c

SHA512
c5144f7a0fcbada8928243c906feaf93157f9f05c3afc906c659bc6469c9639944807779e4181bcabe5a7e2c3701d7f221b6829e5632ef93e7606ec89ef0194a

Download Submit
C:\Windows\System\uAbUvuM.exe

Filesize
1.5MB

MD5
463cc6fd9d20b6392b79634fd2e79baa

SHA1
e4a74bd6243813672a845e28c16fb1dd23893049

SHA256
6ca6ad7c0308b0556cd8a3e234fb6bc7b308172bf5395a2ef78dcd2d7c58c88b

SHA512
0f812c49af8fa99f80dc2adbd787438b434a8f7b34b94eda34712d2a199f80efa90a5902c53b26f1d372fb70a04f9ed506ea9cfaa1f88201784cda1578d19268

Download Submit
C:\Windows\System\udTVtvu.exe

Filesize
1.5MB

MD5
73ab5dceb57831940d29ed29b1ed7bf2

SHA1
fe483d92a3ae8f38aca65de0ad8055bd0f657866

SHA256
2bd67c9450881f19809c136da3a81d423d682e923aa829881bfcc908101c5df7

SHA512
63134d799a7ac4399e8d76605fb9d312a7704cc2dcbf4e343ddd97c29b65f67c22110277e268052a332395828fd4423435d1ce0b8bf0cadededd641ea4183b3a

Download Submit
C:\Windows\System\xDEkwXU.exe

Filesize
1.5MB

MD5
6900e031dc46578897d3ef9df0d6ad2a

SHA1
591d6b3720106176b38c0bf716b653312160a455

SHA256
6fb9831320c89395904ac83ae8d646dd1e3916c79942d203e8fdefc6de969542

SHA512
5ed5accd0b41dd84bc6c8c31b16e5f84a1d0991a811d41e719ab8e44c23235e7c0875b52c33d773abcce2fc20a3446751405d7e07861e83c6797a0278333360b

Download Submit
C:\Windows\System\yTankfn.exe

Filesize
1.5MB

MD5
bd4488049ee07f3df07402221903b72c

SHA1
2d862768080748d8867cb31d469ccfdba4d4e5c7

SHA256
cd0170c952dafda70c11e67125de093f911115eded71895ef89eda9623e2c51f

SHA512
09ceac2c2f34a067a9ce2677b941d08fec07a6d4892593d560d2d2cd77134d82a2f0da027985c9aba685a538f61bb7edd2cf1735f0807f56b7fd66ea516993d2

Download Submit
C:\Windows\System\ylZCWIU.exe

Filesize
1.5MB

MD5
c2db52ee2e0aa00cf950927a4487ff21

SHA1
0c5fc3223e28d15cb5cb4532313f38ad5fbbe499

SHA256
d9aa78850f3fa9a7167c209bc252b76238523d940947ca756c324bc0725dee38

SHA512
eff0817f7d98847ffeb380ad06b6576e02ba7d7d3af909f0e149f86f2026d1a40776443e299dcad74276276405dd0cb9ed54de74948fe64070ae6d938bd99698

Download Submit
C:\Windows\System\ysyXaqK.exe

Filesize
1.5MB

MD5
9765136551f1ed552cf0f0003e8fc43d

SHA1
d458aeb035f654aa2e0af822ecaa2a88ea8f9033

SHA256
e39f45f46b4f66dd737e2695a0b36662d9cbc26186beb1d4b047d0b0d50b9755

SHA512
2da3a318986ee99680b77e74e34365b58ad23f05ed3969d81868999f0c8a035bdef5df9517804028267c2dabd0e97f7004ce06eef93183c77d927b91ceb469dc

Download Submit
memory/612-4014-0x00007FF78CD00000-0x00007FF78D0F2000-memory.dmp

Filesize
3.9MB

Download
memory/612-21-0x00007FF78CD00000-0x00007FF78D0F2000-memory.dmp

Filesize
3.9MB

Download
memory/1336-4022-0x00007FF7D7FD0000-0x00007FF7D83C2000-memory.dmp

Filesize
3.9MB

Download
memory/1336-279-0x00007FF7D7FD0000-0x00007FF7D83C2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-607-0x00007FF700980000-0x00007FF700D72000-memory.dmp

Filesize
3.9MB

Download
memory/1632-4063-0x00007FF700980000-0x00007FF700D72000-memory.dmp

Filesize
3.9MB

Download
memory/1696-101-0x00007FF7F3E20000-0x00007FF7F4212000-memory.dmp

Filesize
3.9MB

Download
memory/1696-4027-0x00007FF7F3E20000-0x00007FF7F4212000-memory.dmp

Filesize
3.9MB

Download
memory/1880-603-0x00007FF70C240000-0x00007FF70C632000-memory.dmp

Filesize
3.9MB

Download
memory/1880-4042-0x00007FF70C240000-0x00007FF70C632000-memory.dmp

Filesize
3.9MB

Download
memory/2288-4025-0x00007FF690C40000-0x00007FF691032000-memory.dmp

Filesize
3.9MB

Download
memory/2288-604-0x00007FF690C40000-0x00007FF691032000-memory.dmp

Filesize
3.9MB

Download
memory/2536-4054-0x00007FF6AD410000-0x00007FF6AD802000-memory.dmp

Filesize
3.9MB

Download
memory/2536-614-0x00007FF6AD410000-0x00007FF6AD802000-memory.dmp

Filesize
3.9MB

Download
memory/2560-622-0x000001EA73C70000-0x000001EA73C92000-memory.dmp

Filesize
136KB

Download
memory/2560-48-0x00007FFDB7283000-0x00007FFDB7285000-memory.dmp

Filesize
8KB

Download
memory/2568-4033-0x00007FF776F10000-0x00007FF777302000-memory.dmp

Filesize
3.9MB

Download
memory/2568-494-0x00007FF776F10000-0x00007FF777302000-memory.dmp

Filesize
3.9MB

Download
memory/2572-4020-0x00007FF773830000-0x00007FF773C22000-memory.dmp

Filesize
3.9MB

Download
memory/2572-253-0x00007FF773830000-0x00007FF773C22000-memory.dmp

Filesize
3.9MB

Download
memory/2804-605-0x00007FF7C8A90000-0x00007FF7C8E82000-memory.dmp

Filesize
3.9MB

Download
memory/2804-4062-0x00007FF7C8A90000-0x00007FF7C8E82000-memory.dmp

Filesize
3.9MB

Download
memory/2884-4035-0x00007FF7291B0000-0x00007FF7295A2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-314-0x00007FF7291B0000-0x00007FF7295A2000-memory.dmp

Filesize
3.9MB

Download
memory/3332-61-0x00007FF7E4730000-0x00007FF7E4B22000-memory.dmp

Filesize
3.9MB

Download
memory/3332-4029-0x00007FF7E4730000-0x00007FF7E4B22000-memory.dmp

Filesize
3.9MB

Download
memory/3428-4031-0x00007FF6327B0000-0x00007FF632BA2000-memory.dmp

Filesize
3.9MB

Download
memory/3428-602-0x00007FF6327B0000-0x00007FF632BA2000-memory.dmp

Filesize
3.9MB

Download
memory/3700-98-0x00007FF72C620000-0x00007FF72CA12000-memory.dmp

Filesize
3.9MB

Download
memory/3700-4040-0x00007FF72C620000-0x00007FF72CA12000-memory.dmp

Filesize
3.9MB

Download
memory/3936-613-0x00007FF7F6C10000-0x00007FF7F7002000-memory.dmp

Filesize
3.9MB

Download
memory/3936-4036-0x00007FF7F6C10000-0x00007FF7F7002000-memory.dmp

Filesize
3.9MB

Download
memory/3992-606-0x00007FF7C45C0000-0x00007FF7C49B2000-memory.dmp

Filesize
3.9MB

Download
memory/3992-4038-0x00007FF7C45C0000-0x00007FF7C49B2000-memory.dmp

Filesize
3.9MB

Download
memory/4032-4012-0x00007FF7CD230000-0x00007FF7CD622000-memory.dmp

Filesize
3.9MB

Download
memory/4032-47-0x00007FF7CD230000-0x00007FF7CD622000-memory.dmp

Filesize
3.9MB

Download
memory/4216-4018-0x00007FF618270000-0x00007FF618662000-memory.dmp

Filesize
3.9MB

Download
memory/4216-158-0x00007FF618270000-0x00007FF618662000-memory.dmp

Filesize
3.9MB

Download
memory/4496-4068-0x00007FF75FB10000-0x00007FF75FF02000-memory.dmp

Filesize
3.9MB

Download
memory/4496-611-0x00007FF75FB10000-0x00007FF75FF02000-memory.dmp

Filesize
3.9MB

Download
memory/4520-612-0x00007FF79E8D0000-0x00007FF79ECC2000-memory.dmp

Filesize
3.9MB

Download
memory/4520-4017-0x00007FF79E8D0000-0x00007FF79ECC2000-memory.dmp

Filesize
3.9MB

Download
memory/4584-608-0x00007FF74A830000-0x00007FF74AC22000-memory.dmp

Filesize
3.9MB

Download
memory/4584-4069-0x00007FF74A830000-0x00007FF74AC22000-memory.dmp

Filesize
3.9MB

Download
memory/4664-0-0x00007FF6249B0000-0x00007FF624DA2000-memory.dmp

Filesize
3.9MB

Download
memory/4664-1-0x00000223C9090000-0x00000223C90A0000-memory.dmp

Filesize
64KB

Download
memory/4876-4047-0x00007FF78F360000-0x00007FF78F752000-memory.dmp

Filesize
3.9MB

Download
memory/4876-609-0x00007FF78F360000-0x00007FF78F752000-memory.dmp

Filesize
3.9MB

Download
memory/4912-4065-0x00007FF6112F0000-0x00007FF6116E2000-memory.dmp

Filesize
3.9MB

Download
memory/4912-610-0x00007FF6112F0000-0x00007FF6116E2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-615-0x00007FF6593C0000-0x00007FF6597B2000-memory.dmp

Filesize
3.9MB

Download
memory/5100-4049-0x00007FF6593C0000-0x00007FF6597B2000-memory.dmp

Filesize
3.9MB

Download