xmrig | c7988d0523ff3c7998fb986818d96d8a454fcc742127fb8aa125926630021c84

Analysis

max time kernel
92s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 12:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
Size

1.4MB
MD5

63c33e41ba1a15f562ed52dd6ebee7e0
SHA1

5277e8bdb2b0dc0f70d5034c54b0bc7f3586f20e
SHA256

c7988d0523ff3c7998fb986818d96d8a454fcc742127fb8aa125926630021c84
SHA512

ca9c9f41f035379e0c1b4c93f475550b0985f0aaeb8f3c1bb90d3982383dfc653074b938652576a993300533eeda97a8697f4db7961d3a181a7f430967e189d4
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDil2wE:Lz071uv4BPMkFfdg6Nsg

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/1092-350-0x00007FF7076B0000-0x00007FF707AA2000-memory.dmp	xmrig
behavioral2/memory/1148-381-0x00007FF75E150000-0x00007FF75E542000-memory.dmp	xmrig
behavioral2/memory/4136-458-0x00007FF6B41B0000-0x00007FF6B45A2000-memory.dmp	xmrig
behavioral2/memory/4504-464-0x00007FF69FDD0000-0x00007FF6A01C2000-memory.dmp	xmrig
behavioral2/memory/2940-469-0x00007FF645580000-0x00007FF645972000-memory.dmp	xmrig
behavioral2/memory/1164-472-0x00007FF7468B0000-0x00007FF746CA2000-memory.dmp	xmrig
behavioral2/memory/1140-471-0x00007FF60C320000-0x00007FF60C712000-memory.dmp	xmrig
behavioral2/memory/2392-468-0x00007FF719F30000-0x00007FF71A322000-memory.dmp	xmrig
behavioral2/memory/4400-467-0x00007FF611830000-0x00007FF611C22000-memory.dmp	xmrig
behavioral2/memory/4188-466-0x00007FF697580000-0x00007FF697972000-memory.dmp	xmrig
behavioral2/memory/3664-465-0x00007FF6457E0000-0x00007FF645BD2000-memory.dmp	xmrig
behavioral2/memory/1972-463-0x00007FF6E7400000-0x00007FF6E77F2000-memory.dmp	xmrig
behavioral2/memory/3984-462-0x00007FF7B24D0000-0x00007FF7B28C2000-memory.dmp	xmrig
behavioral2/memory/4028-461-0x00007FF7953D0000-0x00007FF7957C2000-memory.dmp	xmrig
behavioral2/memory/1236-460-0x00007FF76DBB0000-0x00007FF76DFA2000-memory.dmp	xmrig
behavioral2/memory/4932-459-0x00007FF768A90000-0x00007FF768E82000-memory.dmp	xmrig
behavioral2/memory/4592-457-0x00007FF6B7FB0000-0x00007FF6B83A2000-memory.dmp	xmrig
behavioral2/memory/4480-456-0x00007FF774B60000-0x00007FF774F52000-memory.dmp	xmrig
behavioral2/memory/852-315-0x00007FF73AAC0000-0x00007FF73AEB2000-memory.dmp	xmrig
behavioral2/memory/1424-249-0x00007FF6723C0000-0x00007FF6727B2000-memory.dmp	xmrig
behavioral2/memory/740-200-0x00007FF62BB20000-0x00007FF62BF12000-memory.dmp	xmrig
behavioral2/memory/1268-170-0x00007FF662B00000-0x00007FF662EF2000-memory.dmp	xmrig
behavioral2/memory/4376-117-0x00007FF747380000-0x00007FF747772000-memory.dmp	xmrig
behavioral2/memory/1732-90-0x00007FF611DD0000-0x00007FF6121C2000-memory.dmp	xmrig
behavioral2/memory/4376-2545-0x00007FF747380000-0x00007FF747772000-memory.dmp	xmrig
behavioral2/memory/1268-2547-0x00007FF662B00000-0x00007FF662EF2000-memory.dmp	xmrig
behavioral2/memory/3984-2567-0x00007FF7B24D0000-0x00007FF7B28C2000-memory.dmp	xmrig
behavioral2/memory/4028-2566-0x00007FF7953D0000-0x00007FF7957C2000-memory.dmp	xmrig
behavioral2/memory/4480-2573-0x00007FF774B60000-0x00007FF774F52000-memory.dmp	xmrig
behavioral2/memory/1236-2575-0x00007FF76DBB0000-0x00007FF76DFA2000-memory.dmp	xmrig
behavioral2/memory/4592-2571-0x00007FF6B7FB0000-0x00007FF6B83A2000-memory.dmp	xmrig
behavioral2/memory/1148-2570-0x00007FF75E150000-0x00007FF75E542000-memory.dmp	xmrig
behavioral2/memory/4504-2564-0x00007FF69FDD0000-0x00007FF6A01C2000-memory.dmp	xmrig
behavioral2/memory/1732-2562-0x00007FF611DD0000-0x00007FF6121C2000-memory.dmp	xmrig
behavioral2/memory/4932-2559-0x00007FF768A90000-0x00007FF768E82000-memory.dmp	xmrig
behavioral2/memory/740-2556-0x00007FF62BB20000-0x00007FF62BF12000-memory.dmp	xmrig
behavioral2/memory/1424-2552-0x00007FF6723C0000-0x00007FF6727B2000-memory.dmp	xmrig
behavioral2/memory/4136-2558-0x00007FF6B41B0000-0x00007FF6B45A2000-memory.dmp	xmrig
behavioral2/memory/852-2551-0x00007FF73AAC0000-0x00007FF73AEB2000-memory.dmp	xmrig
behavioral2/memory/1092-2553-0x00007FF7076B0000-0x00007FF707AA2000-memory.dmp	xmrig
behavioral2/memory/1972-2583-0x00007FF6E7400000-0x00007FF6E77F2000-memory.dmp	xmrig
behavioral2/memory/3664-2623-0x00007FF6457E0000-0x00007FF645BD2000-memory.dmp	xmrig
behavioral2/memory/4400-2616-0x00007FF611830000-0x00007FF611C22000-memory.dmp	xmrig
behavioral2/memory/2392-2589-0x00007FF719F30000-0x00007FF71A322000-memory.dmp	xmrig
behavioral2/memory/1164-2612-0x00007FF7468B0000-0x00007FF746CA2000-memory.dmp	xmrig
behavioral2/memory/1140-2585-0x00007FF60C320000-0x00007FF60C712000-memory.dmp	xmrig
behavioral2/memory/2940-2582-0x00007FF645580000-0x00007FF645972000-memory.dmp	xmrig
behavioral2/memory/4188-2581-0x00007FF697580000-0x00007FF697972000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1368	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1732	zpCfyFK.exe
4376	qMvcjyy.exe
1268	RIvEqfU.exe
740	cRTPWRm.exe
1424	GjrmpoO.exe
852	giHRMTw.exe
1092	WOcCrQn.exe
1148	rnUlPHJ.exe
4480	uuyowmO.exe
4592	EffwndO.exe
4136	axvrhRQ.exe
4932	rwDEFjk.exe
1236	mxVmWEU.exe
4028	FVAFOEh.exe
3984	GHcpusY.exe
1972	AMtTcso.exe
4504	LWavtaC.exe
3664	vVkRSIQ.exe
4188	tneanLZ.exe
1140	fkbMRzr.exe
4400	QYSPVry.exe
1164	ObxZvIz.exe
2392	fniCUmB.exe
2940	scrpnFj.exe
112	AtiTPAt.exe
3568	DBbRsll.exe
1664	uIxdRDl.exe
2468	iEGLErm.exe
4916	pIQxyTq.exe
1348	QLZyJZv.exe
4940	SxhkTSW.exe
1676	vEOjobH.exe
2928	Cczkkym.exe
4356	Wumpqkj.exe
1412	IPQNhyP.exe
4788	HdlOOeO.exe
4172	uzaIlyJ.exe
512	MJReuzC.exe
2748	hTZLghT.exe
1624	vxJicVQ.exe
1440	PSBwljz.exe
2600	IaAXvie.exe
4128	TBjSzww.exe
1492	rhseTXm.exe
4472	KABNvex.exe
4024	cQynLXs.exe
1172	dtRzCiG.exe
3548	LBWyKRh.exe
744	kdkDGLP.exe
1596	HWgQtSu.exe
4860	fhmkvTN.exe
2636	jOxjElE.exe
2136	VJbgmGv.exe
2132	SMaWhCl.exe
4532	HuRuDGH.exe
944	lZbgnVs.exe
4488	YaRaQhw.exe
3976	AYdKOIt.exe
1228	QiDMxMn.exe
3516	LMtAbEa.exe
4428	FlHmLaN.exe
1484	tVWmTnU.exe
3236	cbuCisp.exe
2192	ODArrDR.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/920-0-0x00007FF60D510000-0x00007FF60D902000-memory.dmp	upx
behavioral2/files/0x0007000000023496-23.dat	upx
behavioral2/files/0x0007000000023494-36.dat	upx
behavioral2/files/0x000700000002349e-60.dat	upx
behavioral2/files/0x0007000000023498-29.dat	upx
behavioral2/files/0x0007000000023497-26.dat	upx
behavioral2/files/0x0007000000023499-45.dat	upx
behavioral2/files/0x0007000000023495-22.dat	upx
behavioral2/files/0x0007000000023493-19.dat	upx
behavioral2/files/0x000800000002348f-8.dat	upx
behavioral2/files/0x00070000000234a1-69.dat	upx
behavioral2/files/0x00070000000234a2-120.dat	upx
behavioral2/files/0x00070000000234b2-176.dat	upx
behavioral2/memory/1092-350-0x00007FF7076B0000-0x00007FF707AA2000-memory.dmp	upx
behavioral2/memory/1148-381-0x00007FF75E150000-0x00007FF75E542000-memory.dmp	upx
behavioral2/memory/4136-458-0x00007FF6B41B0000-0x00007FF6B45A2000-memory.dmp	upx
behavioral2/memory/4504-464-0x00007FF69FDD0000-0x00007FF6A01C2000-memory.dmp	upx
behavioral2/memory/2940-469-0x00007FF645580000-0x00007FF645972000-memory.dmp	upx
behavioral2/memory/1164-472-0x00007FF7468B0000-0x00007FF746CA2000-memory.dmp	upx
behavioral2/memory/1140-471-0x00007FF60C320000-0x00007FF60C712000-memory.dmp	upx
behavioral2/memory/2392-468-0x00007FF719F30000-0x00007FF71A322000-memory.dmp	upx
behavioral2/memory/4400-467-0x00007FF611830000-0x00007FF611C22000-memory.dmp	upx
behavioral2/memory/4188-466-0x00007FF697580000-0x00007FF697972000-memory.dmp	upx
behavioral2/memory/3664-465-0x00007FF6457E0000-0x00007FF645BD2000-memory.dmp	upx
behavioral2/memory/1972-463-0x00007FF6E7400000-0x00007FF6E77F2000-memory.dmp	upx
behavioral2/memory/3984-462-0x00007FF7B24D0000-0x00007FF7B28C2000-memory.dmp	upx
behavioral2/memory/4028-461-0x00007FF7953D0000-0x00007FF7957C2000-memory.dmp	upx
behavioral2/memory/1236-460-0x00007FF76DBB0000-0x00007FF76DFA2000-memory.dmp	upx
behavioral2/memory/4932-459-0x00007FF768A90000-0x00007FF768E82000-memory.dmp	upx
behavioral2/memory/4592-457-0x00007FF6B7FB0000-0x00007FF6B83A2000-memory.dmp	upx
behavioral2/memory/4480-456-0x00007FF774B60000-0x00007FF774F52000-memory.dmp	upx
behavioral2/memory/852-315-0x00007FF73AAC0000-0x00007FF73AEB2000-memory.dmp	upx
behavioral2/memory/1424-249-0x00007FF6723C0000-0x00007FF6727B2000-memory.dmp	upx
behavioral2/memory/740-200-0x00007FF62BB20000-0x00007FF62BF12000-memory.dmp	upx
behavioral2/files/0x00070000000234bb-191.dat	upx
behavioral2/files/0x00070000000234ba-190.dat	upx
behavioral2/files/0x00070000000234b9-189.dat	upx
behavioral2/files/0x00070000000234b8-188.dat	upx
behavioral2/files/0x00070000000234aa-186.dat	upx
behavioral2/files/0x00070000000234b7-185.dat	upx
behavioral2/files/0x00070000000234b6-184.dat	upx
behavioral2/files/0x00070000000234b5-183.dat	upx
behavioral2/files/0x00080000000234a5-182.dat	upx
behavioral2/files/0x000700000002349a-180.dat	upx
behavioral2/files/0x00070000000234b4-178.dat	upx
behavioral2/files/0x00070000000234b3-177.dat	upx
behavioral2/files/0x00070000000234b1-175.dat	upx
behavioral2/files/0x0008000000023490-174.dat	upx
behavioral2/files/0x00070000000234b0-173.dat	upx
behavioral2/files/0x00070000000234af-166.dat	upx
behavioral2/files/0x00070000000234ae-165.dat	upx
behavioral2/files/0x00070000000234ad-164.dat	upx
behavioral2/files/0x00070000000234ac-163.dat	upx
behavioral2/files/0x00070000000234a7-155.dat	upx
behavioral2/files/0x00070000000234ab-153.dat	upx
behavioral2/files/0x000700000002349b-141.dat	upx
behavioral2/files/0x000700000002349c-138.dat	upx
behavioral2/files/0x00070000000234a9-119.dat	upx
behavioral2/memory/1268-170-0x00007FF662B00000-0x00007FF662EF2000-memory.dmp	upx
behavioral2/files/0x00070000000234a8-113.dat	upx
behavioral2/files/0x000700000002349f-100.dat	upx
behavioral2/memory/4376-117-0x00007FF747380000-0x00007FF747772000-memory.dmp	upx
behavioral2/memory/1732-90-0x00007FF611DD0000-0x00007FF6121C2000-memory.dmp	upx
behavioral2/files/0x00070000000234a3-84.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wBUNfUC.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\PCwGiZB.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\FZbHxZu.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\yDWJpfg.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\Skdwqyj.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\jshXQFt.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\BFKKEZm.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\xjSOFST.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\JKSbVbp.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\fHmLLvk.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\qkoxjdE.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\rTgMzPG.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\XHxOkIO.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\UHfGyjC.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\mKndgPR.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\XVBeSEn.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\wHsvwJd.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\zvhOQim.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\vxACPGd.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\IlzgYEu.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\zpCfyFK.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\cBaIdej.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\pKhBFHr.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\IRBmVud.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\kfkofYq.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\CItbMgW.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\BqpuCwC.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\FthxlqG.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\TNcTEVt.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\VpMjLFK.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\ODArrDR.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\NSKNDKE.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\fVIUtpH.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\fLtUOVn.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\psQrtdh.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\GWWhEll.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\ErjkxMo.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\kHLgGTU.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\pwFNEJY.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\cYkEtay.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\bghEuQI.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\YMbMyao.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\vyTqkuy.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\PcMutcp.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\OHfkWqk.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\PhKwFWj.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\WygeTlY.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\xxRTRcm.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\gwHYHWW.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\uvgrVPW.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\GNUIcmh.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\jOviLnj.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\eOdIYds.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\SHVxXIq.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\GYGLCBU.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\kDNrLxR.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\mtprfVk.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\gdmlasl.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\KduGyAU.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\RjBaHmm.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\JBQdpKC.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\OUEhLKu.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\QfxVHbP.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
File created	C:\Windows\System\PLmKvzQ.exe	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1368	powershell.exe
1368	powershell.exe
1368	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeLockMemoryPrivilege	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 1368	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	83
PID 920 wrote to memory of 1368	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	83
PID 920 wrote to memory of 1732	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	84
PID 920 wrote to memory of 1732	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	84
PID 920 wrote to memory of 4376	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	85
PID 920 wrote to memory of 4376	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	85
PID 920 wrote to memory of 1268	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	86
PID 920 wrote to memory of 1268	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	86
PID 920 wrote to memory of 740	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	87
PID 920 wrote to memory of 740	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	87
PID 920 wrote to memory of 1424	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	88
PID 920 wrote to memory of 1424	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	88
PID 920 wrote to memory of 852	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	89
PID 920 wrote to memory of 852	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	89
PID 920 wrote to memory of 1092	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	90
PID 920 wrote to memory of 1092	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	90
PID 920 wrote to memory of 1148	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	91
PID 920 wrote to memory of 1148	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	91
PID 920 wrote to memory of 1972	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	92
PID 920 wrote to memory of 1972	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	92
PID 920 wrote to memory of 4188	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	93
PID 920 wrote to memory of 4188	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	93
PID 920 wrote to memory of 3664	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	94
PID 920 wrote to memory of 3664	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	94
PID 920 wrote to memory of 4504	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	95
PID 920 wrote to memory of 4504	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	95
PID 920 wrote to memory of 4480	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	96
PID 920 wrote to memory of 4480	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	96
PID 920 wrote to memory of 4592	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	97
PID 920 wrote to memory of 4592	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	97
PID 920 wrote to memory of 4136	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	98
PID 920 wrote to memory of 4136	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	98
PID 920 wrote to memory of 4932	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	99
PID 920 wrote to memory of 4932	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	99
PID 920 wrote to memory of 1236	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	100
PID 920 wrote to memory of 1236	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	100
PID 920 wrote to memory of 4028	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	101
PID 920 wrote to memory of 4028	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	101
PID 920 wrote to memory of 3984	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	102
PID 920 wrote to memory of 3984	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	102
PID 920 wrote to memory of 1140	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	103
PID 920 wrote to memory of 1140	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	103
PID 920 wrote to memory of 4400	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	104
PID 920 wrote to memory of 4400	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	104
PID 920 wrote to memory of 1164	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	105
PID 920 wrote to memory of 1164	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	105
PID 920 wrote to memory of 2392	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	106
PID 920 wrote to memory of 2392	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	106
PID 920 wrote to memory of 2940	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	107
PID 920 wrote to memory of 2940	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	107
PID 920 wrote to memory of 112	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	108
PID 920 wrote to memory of 112	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	108
PID 920 wrote to memory of 3568	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	109
PID 920 wrote to memory of 3568	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	109
PID 920 wrote to memory of 1664	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	110
PID 920 wrote to memory of 1664	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	110
PID 920 wrote to memory of 2468	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	111
PID 920 wrote to memory of 2468	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	111
PID 920 wrote to memory of 4916	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	112
PID 920 wrote to memory of 4916	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	112
PID 920 wrote to memory of 1348	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	113
PID 920 wrote to memory of 1348	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	113
PID 920 wrote to memory of 4940	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	114
PID 920 wrote to memory of 4940	920	63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\63c33e41ba1a15f562ed52dd6ebee7e0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1368
- C:\Windows\System\zpCfyFK.exe
  C:\Windows\System\zpCfyFK.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\qMvcjyy.exe
  C:\Windows\System\qMvcjyy.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\RIvEqfU.exe
  C:\Windows\System\RIvEqfU.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\cRTPWRm.exe
  C:\Windows\System\cRTPWRm.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\GjrmpoO.exe
  C:\Windows\System\GjrmpoO.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\giHRMTw.exe
  C:\Windows\System\giHRMTw.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\WOcCrQn.exe
  C:\Windows\System\WOcCrQn.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\rnUlPHJ.exe
  C:\Windows\System\rnUlPHJ.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\AMtTcso.exe
  C:\Windows\System\AMtTcso.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\tneanLZ.exe
  C:\Windows\System\tneanLZ.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\vVkRSIQ.exe
  C:\Windows\System\vVkRSIQ.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\LWavtaC.exe
  C:\Windows\System\LWavtaC.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\uuyowmO.exe
  C:\Windows\System\uuyowmO.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\EffwndO.exe
  C:\Windows\System\EffwndO.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\axvrhRQ.exe
  C:\Windows\System\axvrhRQ.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\rwDEFjk.exe
  C:\Windows\System\rwDEFjk.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\mxVmWEU.exe
  C:\Windows\System\mxVmWEU.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\FVAFOEh.exe
  C:\Windows\System\FVAFOEh.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\GHcpusY.exe
  C:\Windows\System\GHcpusY.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\fkbMRzr.exe
  C:\Windows\System\fkbMRzr.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\QYSPVry.exe
  C:\Windows\System\QYSPVry.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\ObxZvIz.exe
  C:\Windows\System\ObxZvIz.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\fniCUmB.exe
  C:\Windows\System\fniCUmB.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\scrpnFj.exe
  C:\Windows\System\scrpnFj.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\AtiTPAt.exe
  C:\Windows\System\AtiTPAt.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\DBbRsll.exe
  C:\Windows\System\DBbRsll.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\uIxdRDl.exe
  C:\Windows\System\uIxdRDl.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\iEGLErm.exe
  C:\Windows\System\iEGLErm.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\pIQxyTq.exe
  C:\Windows\System\pIQxyTq.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\QLZyJZv.exe
  C:\Windows\System\QLZyJZv.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\SxhkTSW.exe
  C:\Windows\System\SxhkTSW.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\vEOjobH.exe
  C:\Windows\System\vEOjobH.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\Cczkkym.exe
  C:\Windows\System\Cczkkym.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\Wumpqkj.exe
  C:\Windows\System\Wumpqkj.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\IPQNhyP.exe
  C:\Windows\System\IPQNhyP.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\HdlOOeO.exe
  C:\Windows\System\HdlOOeO.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\uzaIlyJ.exe
  C:\Windows\System\uzaIlyJ.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\MJReuzC.exe
  C:\Windows\System\MJReuzC.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\hTZLghT.exe
  C:\Windows\System\hTZLghT.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\vxJicVQ.exe
  C:\Windows\System\vxJicVQ.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\PSBwljz.exe
  C:\Windows\System\PSBwljz.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\IaAXvie.exe
  C:\Windows\System\IaAXvie.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\TBjSzww.exe
  C:\Windows\System\TBjSzww.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\cQynLXs.exe
  C:\Windows\System\cQynLXs.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\rhseTXm.exe
  C:\Windows\System\rhseTXm.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\KABNvex.exe
  C:\Windows\System\KABNvex.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\wHsvwJd.exe
  C:\Windows\System\wHsvwJd.exe
  2⤵
  PID:4784
- C:\Windows\System\hzTHpLt.exe
  C:\Windows\System\hzTHpLt.exe
  2⤵
  PID:2140
- C:\Windows\System\dtRzCiG.exe
  C:\Windows\System\dtRzCiG.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\LBWyKRh.exe
  C:\Windows\System\LBWyKRh.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\kdkDGLP.exe
  C:\Windows\System\kdkDGLP.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\HWgQtSu.exe
  C:\Windows\System\HWgQtSu.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\fhmkvTN.exe
  C:\Windows\System\fhmkvTN.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\jOxjElE.exe
  C:\Windows\System\jOxjElE.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\VJbgmGv.exe
  C:\Windows\System\VJbgmGv.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\SMaWhCl.exe
  C:\Windows\System\SMaWhCl.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\HuRuDGH.exe
  C:\Windows\System\HuRuDGH.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\cYkEtay.exe
  C:\Windows\System\cYkEtay.exe
  2⤵
  PID:4244
- C:\Windows\System\lZbgnVs.exe
  C:\Windows\System\lZbgnVs.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\YaRaQhw.exe
  C:\Windows\System\YaRaQhw.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\AYdKOIt.exe
  C:\Windows\System\AYdKOIt.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\QiDMxMn.exe
  C:\Windows\System\QiDMxMn.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\LMtAbEa.exe
  C:\Windows\System\LMtAbEa.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\FlHmLaN.exe
  C:\Windows\System\FlHmLaN.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\tVWmTnU.exe
  C:\Windows\System\tVWmTnU.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\iATjPYb.exe
  C:\Windows\System\iATjPYb.exe
  2⤵
  PID:2256
- C:\Windows\System\cbuCisp.exe
  C:\Windows\System\cbuCisp.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\ODArrDR.exe
  C:\Windows\System\ODArrDR.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\dZDCyqm.exe
  C:\Windows\System\dZDCyqm.exe
  2⤵
  PID:3952
- C:\Windows\System\lxgmKfL.exe
  C:\Windows\System\lxgmKfL.exe
  2⤵
  PID:3576
- C:\Windows\System\hRCutKN.exe
  C:\Windows\System\hRCutKN.exe
  2⤵
  PID:3720
- C:\Windows\System\qCGStZZ.exe
  C:\Windows\System\qCGStZZ.exe
  2⤵
  PID:1452
- C:\Windows\System\wWoMFLc.exe
  C:\Windows\System\wWoMFLc.exe
  2⤵
  PID:5064
- C:\Windows\System\NgplCiI.exe
  C:\Windows\System\NgplCiI.exe
  2⤵
  PID:1488
- C:\Windows\System\XFvjVmx.exe
  C:\Windows\System\XFvjVmx.exe
  2⤵
  PID:1836
- C:\Windows\System\NgigUcU.exe
  C:\Windows\System\NgigUcU.exe
  2⤵
  PID:1856
- C:\Windows\System\NQFQTwF.exe
  C:\Windows\System\NQFQTwF.exe
  2⤵
  PID:5044
- C:\Windows\System\uARiZwz.exe
  C:\Windows\System\uARiZwz.exe
  2⤵
  PID:384
- C:\Windows\System\kBwiFJn.exe
  C:\Windows\System\kBwiFJn.exe
  2⤵
  PID:1460
- C:\Windows\System\asfMIgC.exe
  C:\Windows\System\asfMIgC.exe
  2⤵
  PID:1984
- C:\Windows\System\mslhNDB.exe
  C:\Windows\System\mslhNDB.exe
  2⤵
  PID:2840
- C:\Windows\System\DLwmdix.exe
  C:\Windows\System\DLwmdix.exe
  2⤵
  PID:5136
- C:\Windows\System\VKxrHjT.exe
  C:\Windows\System\VKxrHjT.exe
  2⤵
  PID:5156
- C:\Windows\System\OAhxDFi.exe
  C:\Windows\System\OAhxDFi.exe
  2⤵
  PID:5176
- C:\Windows\System\VfFcMER.exe
  C:\Windows\System\VfFcMER.exe
  2⤵
  PID:5196
- C:\Windows\System\lhNpbVB.exe
  C:\Windows\System\lhNpbVB.exe
  2⤵
  PID:5216
- C:\Windows\System\BiQSRGA.exe
  C:\Windows\System\BiQSRGA.exe
  2⤵
  PID:5236
- C:\Windows\System\xMAoMLf.exe
  C:\Windows\System\xMAoMLf.exe
  2⤵
  PID:5256
- C:\Windows\System\OAQrroG.exe
  C:\Windows\System\OAQrroG.exe
  2⤵
  PID:5276
- C:\Windows\System\dMCDSaC.exe
  C:\Windows\System\dMCDSaC.exe
  2⤵
  PID:5300
- C:\Windows\System\uShiYab.exe
  C:\Windows\System\uShiYab.exe
  2⤵
  PID:5320
- C:\Windows\System\nujoKEx.exe
  C:\Windows\System\nujoKEx.exe
  2⤵
  PID:5336
- C:\Windows\System\HKeOJWd.exe
  C:\Windows\System\HKeOJWd.exe
  2⤵
  PID:5364
- C:\Windows\System\wRTwlng.exe
  C:\Windows\System\wRTwlng.exe
  2⤵
  PID:5380
- C:\Windows\System\OdmXxEA.exe
  C:\Windows\System\OdmXxEA.exe
  2⤵
  PID:5396
- C:\Windows\System\bdRgdHx.exe
  C:\Windows\System\bdRgdHx.exe
  2⤵
  PID:5412
- C:\Windows\System\lnHznok.exe
  C:\Windows\System\lnHznok.exe
  2⤵
  PID:5432
- C:\Windows\System\UHfGyjC.exe
  C:\Windows\System\UHfGyjC.exe
  2⤵
  PID:5452
- C:\Windows\System\pYYhBMG.exe
  C:\Windows\System\pYYhBMG.exe
  2⤵
  PID:5564
- C:\Windows\System\jImKuxJ.exe
  C:\Windows\System\jImKuxJ.exe
  2⤵
  PID:5588
- C:\Windows\System\tcFcXwN.exe
  C:\Windows\System\tcFcXwN.exe
  2⤵
  PID:5608
- C:\Windows\System\rgVQTzd.exe
  C:\Windows\System\rgVQTzd.exe
  2⤵
  PID:5628
- C:\Windows\System\wIIiGCQ.exe
  C:\Windows\System\wIIiGCQ.exe
  2⤵
  PID:5648
- C:\Windows\System\UJottBi.exe
  C:\Windows\System\UJottBi.exe
  2⤵
  PID:5668
- C:\Windows\System\aSRnCQN.exe
  C:\Windows\System\aSRnCQN.exe
  2⤵
  PID:5684
- C:\Windows\System\EChGfOa.exe
  C:\Windows\System\EChGfOa.exe
  2⤵
  PID:5704
- C:\Windows\System\nYZskGR.exe
  C:\Windows\System\nYZskGR.exe
  2⤵
  PID:5720
- C:\Windows\System\KUwPCFF.exe
  C:\Windows\System\KUwPCFF.exe
  2⤵
  PID:5740
- C:\Windows\System\pzAHSIj.exe
  C:\Windows\System\pzAHSIj.exe
  2⤵
  PID:5760
- C:\Windows\System\ojhBIIg.exe
  C:\Windows\System\ojhBIIg.exe
  2⤵
  PID:5784
- C:\Windows\System\gjNbaXV.exe
  C:\Windows\System\gjNbaXV.exe
  2⤵
  PID:5800
- C:\Windows\System\EvCOqtb.exe
  C:\Windows\System\EvCOqtb.exe
  2⤵
  PID:5824
- C:\Windows\System\ZfYufHw.exe
  C:\Windows\System\ZfYufHw.exe
  2⤵
  PID:5844
- C:\Windows\System\XUyMcoz.exe
  C:\Windows\System\XUyMcoz.exe
  2⤵
  PID:5868
- C:\Windows\System\KduGyAU.exe
  C:\Windows\System\KduGyAU.exe
  2⤵
  PID:5888
- C:\Windows\System\rCauhtH.exe
  C:\Windows\System\rCauhtH.exe
  2⤵
  PID:5904
- C:\Windows\System\EDzRboU.exe
  C:\Windows\System\EDzRboU.exe
  2⤵
  PID:5924
- C:\Windows\System\zsZcbfb.exe
  C:\Windows\System\zsZcbfb.exe
  2⤵
  PID:6076
- C:\Windows\System\SqzvXhk.exe
  C:\Windows\System\SqzvXhk.exe
  2⤵
  PID:6096
- C:\Windows\System\ClJmFiz.exe
  C:\Windows\System\ClJmFiz.exe
  2⤵
  PID:6124
- C:\Windows\System\RjBaHmm.exe
  C:\Windows\System\RjBaHmm.exe
  2⤵
  PID:6140
- C:\Windows\System\zTaCELb.exe
  C:\Windows\System\zTaCELb.exe
  2⤵
  PID:3600
- C:\Windows\System\tiaxPkK.exe
  C:\Windows\System\tiaxPkK.exe
  2⤵
  PID:3988
- C:\Windows\System\EBMeuJt.exe
  C:\Windows\System\EBMeuJt.exe
  2⤵
  PID:3256
- C:\Windows\System\pMExDYi.exe
  C:\Windows\System\pMExDYi.exe
  2⤵
  PID:4648
- C:\Windows\System\UBnpOxe.exe
  C:\Windows\System\UBnpOxe.exe
  2⤵
  PID:1048
- C:\Windows\System\pbFgIPN.exe
  C:\Windows\System\pbFgIPN.exe
  2⤵
  PID:5424
- C:\Windows\System\JBQdpKC.exe
  C:\Windows\System\JBQdpKC.exe
  2⤵
  PID:3244
- C:\Windows\System\BUujgLr.exe
  C:\Windows\System\BUujgLr.exe
  2⤵
  PID:1400
- C:\Windows\System\WLVtGCk.exe
  C:\Windows\System\WLVtGCk.exe
  2⤵
  PID:3684
- C:\Windows\System\YlkMtsC.exe
  C:\Windows\System\YlkMtsC.exe
  2⤵
  PID:4636
- C:\Windows\System\cKBwqcE.exe
  C:\Windows\System\cKBwqcE.exe
  2⤵
  PID:4416
- C:\Windows\System\JGMihce.exe
  C:\Windows\System\JGMihce.exe
  2⤵
  PID:2460
- C:\Windows\System\OUYgikf.exe
  C:\Windows\System\OUYgikf.exe
  2⤵
  PID:772
- C:\Windows\System\jATzQpw.exe
  C:\Windows\System\jATzQpw.exe
  2⤵
  PID:3016
- C:\Windows\System\CiuayjV.exe
  C:\Windows\System\CiuayjV.exe
  2⤵
  PID:748
- C:\Windows\System\idiFSvW.exe
  C:\Windows\System\idiFSvW.exe
  2⤵
  PID:4556
- C:\Windows\System\pzFkrdn.exe
  C:\Windows\System\pzFkrdn.exe
  2⤵
  PID:3776
- C:\Windows\System\kfkofYq.exe
  C:\Windows\System\kfkofYq.exe
  2⤵
  PID:5852
- C:\Windows\System\KNbuwlk.exe
  C:\Windows\System\KNbuwlk.exe
  2⤵
  PID:2956
- C:\Windows\System\ejFndyc.exe
  C:\Windows\System\ejFndyc.exe
  2⤵
  PID:6160
- C:\Windows\System\HRLMjdE.exe
  C:\Windows\System\HRLMjdE.exe
  2⤵
  PID:6184
- C:\Windows\System\aqCDGzr.exe
  C:\Windows\System\aqCDGzr.exe
  2⤵
  PID:6204
- C:\Windows\System\hHdSuFI.exe
  C:\Windows\System\hHdSuFI.exe
  2⤵
  PID:6228
- C:\Windows\System\IKMQplf.exe
  C:\Windows\System\IKMQplf.exe
  2⤵
  PID:6248
- C:\Windows\System\SHVxXIq.exe
  C:\Windows\System\SHVxXIq.exe
  2⤵
  PID:6268
- C:\Windows\System\VjvkuOZ.exe
  C:\Windows\System\VjvkuOZ.exe
  2⤵
  PID:6288
- C:\Windows\System\nonkuhD.exe
  C:\Windows\System\nonkuhD.exe
  2⤵
  PID:6668
- C:\Windows\System\KMZUZho.exe
  C:\Windows\System\KMZUZho.exe
  2⤵
  PID:6684
- C:\Windows\System\vTwOFsh.exe
  C:\Windows\System\vTwOFsh.exe
  2⤵
  PID:6700
- C:\Windows\System\FhlwcBM.exe
  C:\Windows\System\FhlwcBM.exe
  2⤵
  PID:6928
- C:\Windows\System\jmPmrpe.exe
  C:\Windows\System\jmPmrpe.exe
  2⤵
  PID:6944
- C:\Windows\System\LCDFvPw.exe
  C:\Windows\System\LCDFvPw.exe
  2⤵
  PID:6964
- C:\Windows\System\FmPZXSq.exe
  C:\Windows\System\FmPZXSq.exe
  2⤵
  PID:6984
- C:\Windows\System\qPmyOJt.exe
  C:\Windows\System\qPmyOJt.exe
  2⤵
  PID:7004
- C:\Windows\System\igPLlnt.exe
  C:\Windows\System\igPLlnt.exe
  2⤵
  PID:7020
- C:\Windows\System\lDOfxkk.exe
  C:\Windows\System\lDOfxkk.exe
  2⤵
  PID:7040
- C:\Windows\System\oucjDne.exe
  C:\Windows\System\oucjDne.exe
  2⤵
  PID:7060
- C:\Windows\System\lcmzADP.exe
  C:\Windows\System\lcmzADP.exe
  2⤵
  PID:7076
- C:\Windows\System\PpxTxzV.exe
  C:\Windows\System\PpxTxzV.exe
  2⤵
  PID:7096
- C:\Windows\System\fbzMrVU.exe
  C:\Windows\System\fbzMrVU.exe
  2⤵
  PID:7112
- C:\Windows\System\iXOZVvw.exe
  C:\Windows\System\iXOZVvw.exe
  2⤵
  PID:7128
- C:\Windows\System\nPOMDXI.exe
  C:\Windows\System\nPOMDXI.exe
  2⤵
  PID:7148
- C:\Windows\System\uvqULjy.exe
  C:\Windows\System\uvqULjy.exe
  2⤵
  PID:7164
- C:\Windows\System\ezdzEaZ.exe
  C:\Windows\System\ezdzEaZ.exe
  2⤵
  PID:5700
- C:\Windows\System\tjtuFqL.exe
  C:\Windows\System\tjtuFqL.exe
  2⤵
  PID:5664
- C:\Windows\System\ptbmOkO.exe
  C:\Windows\System\ptbmOkO.exe
  2⤵
  PID:5620
- C:\Windows\System\uvsyBZU.exe
  C:\Windows\System\uvsyBZU.exe
  2⤵
  PID:5572
- C:\Windows\System\vrRfILK.exe
  C:\Windows\System\vrRfILK.exe
  2⤵
  PID:5504
- C:\Windows\System\gwAEWBt.exe
  C:\Windows\System\gwAEWBt.exe
  2⤵
  PID:5248
- C:\Windows\System\gRFBnkV.exe
  C:\Windows\System\gRFBnkV.exe
  2⤵
  PID:5144
- C:\Windows\System\eornygM.exe
  C:\Windows\System\eornygM.exe
  2⤵
  PID:4672
- C:\Windows\System\ArJTLcs.exe
  C:\Windows\System\ArJTLcs.exe
  2⤵
  PID:2752
- C:\Windows\System\AmoWjMc.exe
  C:\Windows\System\AmoWjMc.exe
  2⤵
  PID:1160
- C:\Windows\System\qkiQVui.exe
  C:\Windows\System\qkiQVui.exe
  2⤵
  PID:6092
- C:\Windows\System\nwXwZGp.exe
  C:\Windows\System\nwXwZGp.exe
  2⤵
  PID:2500
- C:\Windows\System\tePXxFb.exe
  C:\Windows\System\tePXxFb.exe
  2⤵
  PID:1616
- C:\Windows\System\kBIiRwl.exe
  C:\Windows\System\kBIiRwl.exe
  2⤵
  PID:6156
- C:\Windows\System\gkxZRFI.exe
  C:\Windows\System\gkxZRFI.exe
  2⤵
  PID:6264
- C:\Windows\System\yasNyjF.exe
  C:\Windows\System\yasNyjF.exe
  2⤵
  PID:3760
- C:\Windows\System\eiGNmOT.exe
  C:\Windows\System\eiGNmOT.exe
  2⤵
  PID:2040
- C:\Windows\System\eacKiYY.exe
  C:\Windows\System\eacKiYY.exe
  2⤵
  PID:2380
- C:\Windows\System\WnZXGaL.exe
  C:\Windows\System\WnZXGaL.exe
  2⤵
  PID:2208
- C:\Windows\System\uAkeXaN.exe
  C:\Windows\System\uAkeXaN.exe
  2⤵
  PID:6152
- C:\Windows\System\JvdKYgD.exe
  C:\Windows\System\JvdKYgD.exe
  2⤵
  PID:6256
- C:\Windows\System\LchHfzf.exe
  C:\Windows\System\LchHfzf.exe
  2⤵
  PID:6940
- C:\Windows\System\JZmtGLo.exe
  C:\Windows\System\JZmtGLo.exe
  2⤵
  PID:7072
- C:\Windows\System\qBaTVbE.exe
  C:\Windows\System\qBaTVbE.exe
  2⤵
  PID:7144
- C:\Windows\System\BaBXTxP.exe
  C:\Windows\System\BaBXTxP.exe
  2⤵
  PID:6692
- C:\Windows\System\PsnaYcD.exe
  C:\Windows\System\PsnaYcD.exe
  2⤵
  PID:7032
- C:\Windows\System\ujRAlAV.exe
  C:\Windows\System\ujRAlAV.exe
  2⤵
  PID:6112
- C:\Windows\System\FTrsmaT.exe
  C:\Windows\System\FTrsmaT.exe
  2⤵
  PID:6300
- C:\Windows\System\IAOwWcH.exe
  C:\Windows\System\IAOwWcH.exe
  2⤵
  PID:7192
- C:\Windows\System\HHgygfo.exe
  C:\Windows\System\HHgygfo.exe
  2⤵
  PID:7208
- C:\Windows\System\whWgaVm.exe
  C:\Windows\System\whWgaVm.exe
  2⤵
  PID:7236
- C:\Windows\System\ApFulXO.exe
  C:\Windows\System\ApFulXO.exe
  2⤵
  PID:7256
- C:\Windows\System\OUEhLKu.exe
  C:\Windows\System\OUEhLKu.exe
  2⤵
  PID:7272
- C:\Windows\System\gDQjlUt.exe
  C:\Windows\System\gDQjlUt.exe
  2⤵
  PID:7288
- C:\Windows\System\jXsGgHl.exe
  C:\Windows\System\jXsGgHl.exe
  2⤵
  PID:7316
- C:\Windows\System\CdLWdlw.exe
  C:\Windows\System\CdLWdlw.exe
  2⤵
  PID:7332
- C:\Windows\System\egoYUNV.exe
  C:\Windows\System\egoYUNV.exe
  2⤵
  PID:7356
- C:\Windows\System\yozyPdO.exe
  C:\Windows\System\yozyPdO.exe
  2⤵
  PID:7376
- C:\Windows\System\hfzVMGS.exe
  C:\Windows\System\hfzVMGS.exe
  2⤵
  PID:7396
- C:\Windows\System\lvPBsYx.exe
  C:\Windows\System\lvPBsYx.exe
  2⤵
  PID:7420
- C:\Windows\System\TorJWpD.exe
  C:\Windows\System\TorJWpD.exe
  2⤵
  PID:7444
- C:\Windows\System\iOcwxxk.exe
  C:\Windows\System\iOcwxxk.exe
  2⤵
  PID:7460
- C:\Windows\System\mKndgPR.exe
  C:\Windows\System\mKndgPR.exe
  2⤵
  PID:7484
- C:\Windows\System\MTgIHuK.exe
  C:\Windows\System\MTgIHuK.exe
  2⤵
  PID:7500
- C:\Windows\System\glOZRUX.exe
  C:\Windows\System\glOZRUX.exe
  2⤵
  PID:7556
- C:\Windows\System\BKYoAGy.exe
  C:\Windows\System\BKYoAGy.exe
  2⤵
  PID:7572
- C:\Windows\System\dHXFUwz.exe
  C:\Windows\System\dHXFUwz.exe
  2⤵
  PID:7588
- C:\Windows\System\DEgztrO.exe
  C:\Windows\System\DEgztrO.exe
  2⤵
  PID:7616
- C:\Windows\System\grusJaW.exe
  C:\Windows\System\grusJaW.exe
  2⤵
  PID:7636
- C:\Windows\System\ElHRria.exe
  C:\Windows\System\ElHRria.exe
  2⤵
  PID:7652
- C:\Windows\System\YUtGelB.exe
  C:\Windows\System\YUtGelB.exe
  2⤵
  PID:7668
- C:\Windows\System\uvgrVPW.exe
  C:\Windows\System\uvgrVPW.exe
  2⤵
  PID:7684
- C:\Windows\System\ihQRwID.exe
  C:\Windows\System\ihQRwID.exe
  2⤵
  PID:7700
- C:\Windows\System\pFplTfV.exe
  C:\Windows\System\pFplTfV.exe
  2⤵
  PID:7720
- C:\Windows\System\jhRlmse.exe
  C:\Windows\System\jhRlmse.exe
  2⤵
  PID:7740
- C:\Windows\System\EpfqAZP.exe
  C:\Windows\System\EpfqAZP.exe
  2⤵
  PID:7760
- C:\Windows\System\lmIeMne.exe
  C:\Windows\System\lmIeMne.exe
  2⤵
  PID:7780
- C:\Windows\System\aPKnpBW.exe
  C:\Windows\System\aPKnpBW.exe
  2⤵
  PID:7796
- C:\Windows\System\TYecUhJ.exe
  C:\Windows\System\TYecUhJ.exe
  2⤵
  PID:7824
- C:\Windows\System\IuaJEwG.exe
  C:\Windows\System\IuaJEwG.exe
  2⤵
  PID:7848
- C:\Windows\System\fKfyDgN.exe
  C:\Windows\System\fKfyDgN.exe
  2⤵
  PID:7864
- C:\Windows\System\WUWYSTG.exe
  C:\Windows\System\WUWYSTG.exe
  2⤵
  PID:7880
- C:\Windows\System\ekpCvGS.exe
  C:\Windows\System\ekpCvGS.exe
  2⤵
  PID:7904
- C:\Windows\System\TiezwrM.exe
  C:\Windows\System\TiezwrM.exe
  2⤵
  PID:7924
- C:\Windows\System\ndfirds.exe
  C:\Windows\System\ndfirds.exe
  2⤵
  PID:7948
- C:\Windows\System\RCJaXzx.exe
  C:\Windows\System\RCJaXzx.exe
  2⤵
  PID:7976
- C:\Windows\System\NbpPGhe.exe
  C:\Windows\System\NbpPGhe.exe
  2⤵
  PID:7992
- C:\Windows\System\FqDzgpx.exe
  C:\Windows\System\FqDzgpx.exe
  2⤵
  PID:8012
- C:\Windows\System\ngxsihw.exe
  C:\Windows\System\ngxsihw.exe
  2⤵
  PID:8032
- C:\Windows\System\SltaDtj.exe
  C:\Windows\System\SltaDtj.exe
  2⤵
  PID:8060
- C:\Windows\System\uMKpCCB.exe
  C:\Windows\System\uMKpCCB.exe
  2⤵
  PID:8076
- C:\Windows\System\UbVNGqk.exe
  C:\Windows\System\UbVNGqk.exe
  2⤵
  PID:8100
- C:\Windows\System\zCIzrlJ.exe
  C:\Windows\System\zCIzrlJ.exe
  2⤵
  PID:8120
- C:\Windows\System\aebpafO.exe
  C:\Windows\System\aebpafO.exe
  2⤵
  PID:6620
- C:\Windows\System\UkPOhDs.exe
  C:\Windows\System\UkPOhDs.exe
  2⤵
  PID:6636
- C:\Windows\System\PsdZLbD.exe
  C:\Windows\System\PsdZLbD.exe
  2⤵
  PID:6652
- C:\Windows\System\bMlgcKw.exe
  C:\Windows\System\bMlgcKw.exe
  2⤵
  PID:6756
- C:\Windows\System\JEcCBAL.exe
  C:\Windows\System\JEcCBAL.exe
  2⤵
  PID:6792
- C:\Windows\System\GYGLCBU.exe
  C:\Windows\System\GYGLCBU.exe
  2⤵
  PID:6840
- C:\Windows\System\fShFDmA.exe
  C:\Windows\System\fShFDmA.exe
  2⤵
  PID:6888
- C:\Windows\System\oMilvnd.exe
  C:\Windows\System\oMilvnd.exe
  2⤵
  PID:6924
- C:\Windows\System\AkzRPqy.exe
  C:\Windows\System\AkzRPqy.exe
  2⤵
  PID:6980
- C:\Windows\System\oAQUZNv.exe
  C:\Windows\System\oAQUZNv.exe
  2⤵
  PID:5072
- C:\Windows\System\nCiVQCG.exe
  C:\Windows\System\nCiVQCG.exe
  2⤵
  PID:7216
- C:\Windows\System\rgNEhsh.exe
  C:\Windows\System\rgNEhsh.exe
  2⤵
  PID:7328
- C:\Windows\System\njePgYy.exe
  C:\Windows\System\njePgYy.exe
  2⤵
  PID:7392
- C:\Windows\System\mDgcomZ.exe
  C:\Windows\System\mDgcomZ.exe
  2⤵
  PID:7456
- C:\Windows\System\zdgFJId.exe
  C:\Windows\System\zdgFJId.exe
  2⤵
  PID:5756
- C:\Windows\System\XCTAeqP.exe
  C:\Windows\System\XCTAeqP.exe
  2⤵
  PID:5712
- C:\Windows\System\owyAedi.exe
  C:\Windows\System\owyAedi.exe
  2⤵
  PID:5640
- C:\Windows\System\gWJuvnX.exe
  C:\Windows\System\gWJuvnX.exe
  2⤵
  PID:5580
- C:\Windows\System\WgLKmfr.exe
  C:\Windows\System\WgLKmfr.exe
  2⤵
  PID:5316
- C:\Windows\System\yLNnphy.exe
  C:\Windows\System\yLNnphy.exe
  2⤵
  PID:4760
- C:\Windows\System\ZeuTFFj.exe
  C:\Windows\System\ZeuTFFj.exe
  2⤵
  PID:4352
- C:\Windows\System\pLnEiyV.exe
  C:\Windows\System\pLnEiyV.exe
  2⤵
  PID:7404
- C:\Windows\System\bJpmcUJ.exe
  C:\Windows\System\bJpmcUJ.exe
  2⤵
  PID:8044
- C:\Windows\System\TNcTEVt.exe
  C:\Windows\System\TNcTEVt.exe
  2⤵
  PID:8136
- C:\Windows\System\WfwbSuw.exe
  C:\Windows\System\WfwbSuw.exe
  2⤵
  PID:8200
- C:\Windows\System\KzgFgHc.exe
  C:\Windows\System\KzgFgHc.exe
  2⤵
  PID:8228
- C:\Windows\System\LayUCXT.exe
  C:\Windows\System\LayUCXT.exe
  2⤵
  PID:8248
- C:\Windows\System\VHtgnym.exe
  C:\Windows\System\VHtgnym.exe
  2⤵
  PID:8268
- C:\Windows\System\DvTPylE.exe
  C:\Windows\System\DvTPylE.exe
  2⤵
  PID:8288
- C:\Windows\System\PFnVQMG.exe
  C:\Windows\System\PFnVQMG.exe
  2⤵
  PID:8304
- C:\Windows\System\TJnJlYc.exe
  C:\Windows\System\TJnJlYc.exe
  2⤵
  PID:8328
- C:\Windows\System\tMPONYl.exe
  C:\Windows\System\tMPONYl.exe
  2⤵
  PID:8352
- C:\Windows\System\QMRFBeB.exe
  C:\Windows\System\QMRFBeB.exe
  2⤵
  PID:8372
- C:\Windows\System\sLPQGSs.exe
  C:\Windows\System\sLPQGSs.exe
  2⤵
  PID:8392
- C:\Windows\System\NSVtyAn.exe
  C:\Windows\System\NSVtyAn.exe
  2⤵
  PID:8408
- C:\Windows\System\UYMPaGV.exe
  C:\Windows\System\UYMPaGV.exe
  2⤵
  PID:8432
- C:\Windows\System\gytvvsN.exe
  C:\Windows\System\gytvvsN.exe
  2⤵
  PID:8448
- C:\Windows\System\mwpocvx.exe
  C:\Windows\System\mwpocvx.exe
  2⤵
  PID:8476
- C:\Windows\System\BodUUDL.exe
  C:\Windows\System\BodUUDL.exe
  2⤵
  PID:8548
- C:\Windows\System\GYKrbco.exe
  C:\Windows\System\GYKrbco.exe
  2⤵
  PID:8568
- C:\Windows\System\bDmpuJZ.exe
  C:\Windows\System\bDmpuJZ.exe
  2⤵
  PID:8584
- C:\Windows\System\iQOSeTV.exe
  C:\Windows\System\iQOSeTV.exe
  2⤵
  PID:8608
- C:\Windows\System\NNmzBBB.exe
  C:\Windows\System\NNmzBBB.exe
  2⤵
  PID:8628
- C:\Windows\System\EIGhOXU.exe
  C:\Windows\System\EIGhOXU.exe
  2⤵
  PID:8648
- C:\Windows\System\FXZhZbh.exe
  C:\Windows\System\FXZhZbh.exe
  2⤵
  PID:8668
- C:\Windows\System\YWqsNoH.exe
  C:\Windows\System\YWqsNoH.exe
  2⤵
  PID:8684
- C:\Windows\System\obXvgYi.exe
  C:\Windows\System\obXvgYi.exe
  2⤵
  PID:8704
- C:\Windows\System\YfXJKOY.exe
  C:\Windows\System\YfXJKOY.exe
  2⤵
  PID:8724
- C:\Windows\System\XJfkjdn.exe
  C:\Windows\System\XJfkjdn.exe
  2⤵
  PID:8744
- C:\Windows\System\LbBqAtr.exe
  C:\Windows\System\LbBqAtr.exe
  2⤵
  PID:8764
- C:\Windows\System\pBCvZIW.exe
  C:\Windows\System\pBCvZIW.exe
  2⤵
  PID:8784
- C:\Windows\System\ieydQhh.exe
  C:\Windows\System\ieydQhh.exe
  2⤵
  PID:8812
- C:\Windows\System\CEgyCDs.exe
  C:\Windows\System\CEgyCDs.exe
  2⤵
  PID:8832
- C:\Windows\System\xvaXWNU.exe
  C:\Windows\System\xvaXWNU.exe
  2⤵
  PID:8852
- C:\Windows\System\TJCrKFY.exe
  C:\Windows\System\TJCrKFY.exe
  2⤵
  PID:8872
- C:\Windows\System\kQbXZDz.exe
  C:\Windows\System\kQbXZDz.exe
  2⤵
  PID:8888
- C:\Windows\System\XppXCya.exe
  C:\Windows\System\XppXCya.exe
  2⤵
  PID:8908
- C:\Windows\System\noUNiAI.exe
  C:\Windows\System\noUNiAI.exe
  2⤵
  PID:8928
- C:\Windows\System\YweUxay.exe
  C:\Windows\System\YweUxay.exe
  2⤵
  PID:8948
- C:\Windows\System\tRgfBlf.exe
  C:\Windows\System\tRgfBlf.exe
  2⤵
  PID:8968
- C:\Windows\System\HjXuLtO.exe
  C:\Windows\System\HjXuLtO.exe
  2⤵
  PID:8992
- C:\Windows\System\hdNwysF.exe
  C:\Windows\System\hdNwysF.exe
  2⤵
  PID:9008
- C:\Windows\System\RjOHQqF.exe
  C:\Windows\System\RjOHQqF.exe
  2⤵
  PID:9040
- C:\Windows\System\TGRFFmt.exe
  C:\Windows\System\TGRFFmt.exe
  2⤵
  PID:9056
- C:\Windows\System\sdOAiTm.exe
  C:\Windows\System\sdOAiTm.exe
  2⤵
  PID:9076
- C:\Windows\System\chblVvc.exe
  C:\Windows\System\chblVvc.exe
  2⤵
  PID:9116
- C:\Windows\System\UOReEZA.exe
  C:\Windows\System\UOReEZA.exe
  2⤵
  PID:9144
- C:\Windows\System\njfGPwb.exe
  C:\Windows\System\njfGPwb.exe
  2⤵
  PID:9160
- C:\Windows\System\rCNqoMR.exe
  C:\Windows\System\rCNqoMR.exe
  2⤵
  PID:9188
- C:\Windows\System\mnIMGyf.exe
  C:\Windows\System\mnIMGyf.exe
  2⤵
  PID:9208
- C:\Windows\System\juSqpXK.exe
  C:\Windows\System\juSqpXK.exe
  2⤵
  PID:1988
- C:\Windows\System\vlQPWJj.exe
  C:\Windows\System\vlQPWJj.exe
  2⤵
  PID:6224
- C:\Windows\System\QfxFwvZ.exe
  C:\Windows\System\QfxFwvZ.exe
  2⤵
  PID:1996
- C:\Windows\System\JKSbVbp.exe
  C:\Windows\System\JKSbVbp.exe
  2⤵
  PID:4852
- C:\Windows\System\cVhnUPH.exe
  C:\Windows\System\cVhnUPH.exe
  2⤵
  PID:5932
- C:\Windows\System\QNobXGx.exe
  C:\Windows\System\QNobXGx.exe
  2⤵
  PID:7012
- C:\Windows\System\kDNrLxR.exe
  C:\Windows\System\kDNrLxR.exe
  2⤵
  PID:7160
- C:\Windows\System\YWPSxZZ.exe
  C:\Windows\System\YWPSxZZ.exe
  2⤵
  PID:7016
- C:\Windows\System\DpFAxCD.exe
  C:\Windows\System\DpFAxCD.exe
  2⤵
  PID:2176
- C:\Windows\System\NYflXnb.exe
  C:\Windows\System\NYflXnb.exe
  2⤵
  PID:2952
- C:\Windows\System\kTgwtUy.exe
  C:\Windows\System\kTgwtUy.exe
  2⤵
  PID:7296
- C:\Windows\System\iKcweEy.exe
  C:\Windows\System\iKcweEy.exe
  2⤵
  PID:6864
- C:\Windows\System\YupXADT.exe
  C:\Windows\System\YupXADT.exe
  2⤵
  PID:7496
- C:\Windows\System\uPoaJTy.exe
  C:\Windows\System\uPoaJTy.exe
  2⤵
  PID:5332
- C:\Windows\System\zvgSkvH.exe
  C:\Windows\System\zvgSkvH.exe
  2⤵
  PID:8216
- C:\Windows\System\OrQSUDV.exe
  C:\Windows\System\OrQSUDV.exe
  2⤵
  PID:8284
- C:\Windows\System\cUlWQfp.exe
  C:\Windows\System\cUlWQfp.exe
  2⤵
  PID:8384
- C:\Windows\System\NDPYTML.exe
  C:\Windows\System\NDPYTML.exe
  2⤵
  PID:8420
- C:\Windows\System\CiYhTSN.exe
  C:\Windows\System\CiYhTSN.exe
  2⤵
  PID:1208
- C:\Windows\System\cisipNl.exe
  C:\Windows\System\cisipNl.exe
  2⤵
  PID:7568
- C:\Windows\System\kpXSLdq.exe
  C:\Windows\System\kpXSLdq.exe
  2⤵
  PID:7608
- C:\Windows\System\HijVGZA.exe
  C:\Windows\System\HijVGZA.exe
  2⤵
  PID:7632
- C:\Windows\System\VpMjLFK.exe
  C:\Windows\System\VpMjLFK.exe
  2⤵
  PID:7680
- C:\Windows\System\aVFzqyF.exe
  C:\Windows\System\aVFzqyF.exe
  2⤵
  PID:7716
- C:\Windows\System\fHmLLvk.exe
  C:\Windows\System\fHmLLvk.exe
  2⤵
  PID:7812
- C:\Windows\System\baoynnv.exe
  C:\Windows\System\baoynnv.exe
  2⤵
  PID:7792
- C:\Windows\System\RqueBWz.exe
  C:\Windows\System\RqueBWz.exe
  2⤵
  PID:7768
- C:\Windows\System\OsDwMeB.exe
  C:\Windows\System\OsDwMeB.exe
  2⤵
  PID:6712
- C:\Windows\System\VTUQAJE.exe
  C:\Windows\System\VTUQAJE.exe
  2⤵
  PID:2420
- C:\Windows\System\ZHmGTpd.exe
  C:\Windows\System\ZHmGTpd.exe
  2⤵
  PID:9228
- C:\Windows\System\FEXENqJ.exe
  C:\Windows\System\FEXENqJ.exe
  2⤵
  PID:9248
- C:\Windows\System\EcYKPPi.exe
  C:\Windows\System\EcYKPPi.exe
  2⤵
  PID:9268
- C:\Windows\System\GpyVRGB.exe
  C:\Windows\System\GpyVRGB.exe
  2⤵
  PID:9288
- C:\Windows\System\dfDtgml.exe
  C:\Windows\System\dfDtgml.exe
  2⤵
  PID:9304
- C:\Windows\System\ICkNZLG.exe
  C:\Windows\System\ICkNZLG.exe
  2⤵
  PID:9324
- C:\Windows\System\OHdfqUR.exe
  C:\Windows\System\OHdfqUR.exe
  2⤵
  PID:9348
- C:\Windows\System\UaKDhPD.exe
  C:\Windows\System\UaKDhPD.exe
  2⤵
  PID:9364
- C:\Windows\System\worCxZX.exe
  C:\Windows\System\worCxZX.exe
  2⤵
  PID:9392
- C:\Windows\System\KzCAeMU.exe
  C:\Windows\System\KzCAeMU.exe
  2⤵
  PID:9408
- C:\Windows\System\uFEZTHL.exe
  C:\Windows\System\uFEZTHL.exe
  2⤵
  PID:9432
- C:\Windows\System\cBaIdej.exe
  C:\Windows\System\cBaIdej.exe
  2⤵
  PID:9452
- C:\Windows\System\FTcfTJi.exe
  C:\Windows\System\FTcfTJi.exe
  2⤵
  PID:9476
- C:\Windows\System\GjXKKbu.exe
  C:\Windows\System\GjXKKbu.exe
  2⤵
  PID:9496
- C:\Windows\System\aDdFVHA.exe
  C:\Windows\System\aDdFVHA.exe
  2⤵
  PID:9516
- C:\Windows\System\fDzDwFi.exe
  C:\Windows\System\fDzDwFi.exe
  2⤵
  PID:9532
- C:\Windows\System\PCwGiZB.exe
  C:\Windows\System\PCwGiZB.exe
  2⤵
  PID:9560
- C:\Windows\System\CmTPkfd.exe
  C:\Windows\System\CmTPkfd.exe
  2⤵
  PID:9580
- C:\Windows\System\NoZLgYR.exe
  C:\Windows\System\NoZLgYR.exe
  2⤵
  PID:9596
- C:\Windows\System\OseEAdB.exe
  C:\Windows\System\OseEAdB.exe
  2⤵
  PID:9612
- C:\Windows\System\HiEUKep.exe
  C:\Windows\System\HiEUKep.exe
  2⤵
  PID:9628
- C:\Windows\System\xlApFLb.exe
  C:\Windows\System\xlApFLb.exe
  2⤵
  PID:9648
- C:\Windows\System\IuBczlX.exe
  C:\Windows\System\IuBczlX.exe
  2⤵
  PID:9672
- C:\Windows\System\QQArNeT.exe
  C:\Windows\System\QQArNeT.exe
  2⤵
  PID:9692
- C:\Windows\System\WSnnRCZ.exe
  C:\Windows\System\WSnnRCZ.exe
  2⤵
  PID:9708
- C:\Windows\System\eYbuWVX.exe
  C:\Windows\System\eYbuWVX.exe
  2⤵
  PID:9732
- C:\Windows\System\gsieWHY.exe
  C:\Windows\System\gsieWHY.exe
  2⤵
  PID:9752
- C:\Windows\System\JszLWMl.exe
  C:\Windows\System\JszLWMl.exe
  2⤵
  PID:9768
- C:\Windows\System\gZDHbTQ.exe
  C:\Windows\System\gZDHbTQ.exe
  2⤵
  PID:9808
- C:\Windows\System\odosees.exe
  C:\Windows\System\odosees.exe
  2⤵
  PID:9832
- C:\Windows\System\GqPWeUO.exe
  C:\Windows\System\GqPWeUO.exe
  2⤵
  PID:9852
- C:\Windows\System\NSKNDKE.exe
  C:\Windows\System\NSKNDKE.exe
  2⤵
  PID:9876
- C:\Windows\System\KSZaPpD.exe
  C:\Windows\System\KSZaPpD.exe
  2⤵
  PID:9892
- C:\Windows\System\CpUVdQy.exe
  C:\Windows\System\CpUVdQy.exe
  2⤵
  PID:9912
- C:\Windows\System\dsJUccO.exe
  C:\Windows\System\dsJUccO.exe
  2⤵
  PID:9936
- C:\Windows\System\JbOhszo.exe
  C:\Windows\System\JbOhszo.exe
  2⤵
  PID:9956
- C:\Windows\System\GbUwgHU.exe
  C:\Windows\System\GbUwgHU.exe
  2⤵
  PID:9972
- C:\Windows\System\fVHyJKr.exe
  C:\Windows\System\fVHyJKr.exe
  2⤵
  PID:9988
- C:\Windows\System\xvsChGt.exe
  C:\Windows\System\xvsChGt.exe
  2⤵
  PID:10008
- C:\Windows\System\uXyYDjj.exe
  C:\Windows\System\uXyYDjj.exe
  2⤵
  PID:10028
- C:\Windows\System\sjDPqCP.exe
  C:\Windows\System\sjDPqCP.exe
  2⤵
  PID:10048
- C:\Windows\System\FiFNRyo.exe
  C:\Windows\System\FiFNRyo.exe
  2⤵
  PID:10064
- C:\Windows\System\yQsTsRB.exe
  C:\Windows\System\yQsTsRB.exe
  2⤵
  PID:10088
- C:\Windows\System\OxuAybL.exe
  C:\Windows\System\OxuAybL.exe
  2⤵
  PID:10108
- C:\Windows\System\wERMXAy.exe
  C:\Windows\System\wERMXAy.exe
  2⤵
  PID:10128
- C:\Windows\System\HLbhwZQ.exe
  C:\Windows\System\HLbhwZQ.exe
  2⤵
  PID:10148
- C:\Windows\System\iKngFXH.exe
  C:\Windows\System\iKngFXH.exe
  2⤵
  PID:10168
- C:\Windows\System\ivtDBwL.exe
  C:\Windows\System\ivtDBwL.exe
  2⤵
  PID:10188
- C:\Windows\System\dDHPJzb.exe
  C:\Windows\System\dDHPJzb.exe
  2⤵
  PID:10208
- C:\Windows\System\KixFWuu.exe
  C:\Windows\System\KixFWuu.exe
  2⤵
  PID:10228
- C:\Windows\System\EawESMw.exe
  C:\Windows\System\EawESMw.exe
  2⤵
  PID:6976
- C:\Windows\System\cXsspcM.exe
  C:\Windows\System\cXsspcM.exe
  2⤵
  PID:7964
- C:\Windows\System\coLYFGy.exe
  C:\Windows\System\coLYFGy.exe
  2⤵
  PID:8004
- C:\Windows\System\oZTLlpQ.exe
  C:\Windows\System\oZTLlpQ.exe
  2⤵
  PID:8904
- C:\Windows\System\YOUviRz.exe
  C:\Windows\System\YOUviRz.exe
  2⤵
  PID:8936
- C:\Windows\System\iCVXCgQ.exe
  C:\Windows\System\iCVXCgQ.exe
  2⤵
  PID:8960
- C:\Windows\System\EdjrqRw.exe
  C:\Windows\System\EdjrqRw.exe
  2⤵
  PID:9152
- C:\Windows\System\AwTindk.exe
  C:\Windows\System\AwTindk.exe
  2⤵
  PID:9204
- C:\Windows\System\OPlFuRB.exe
  C:\Windows\System\OPlFuRB.exe
  2⤵
  PID:6200
- C:\Windows\System\vNhNpAX.exe
  C:\Windows\System\vNhNpAX.exe
  2⤵
  PID:8324
- C:\Windows\System\SBMpIeZ.exe
  C:\Windows\System\SBMpIeZ.exe
  2⤵
  PID:8364
- C:\Windows\System\kHutJoj.exe
  C:\Windows\System\kHutJoj.exe
  2⤵
  PID:6616
- C:\Windows\System\WsrRUBr.exe
  C:\Windows\System\WsrRUBr.exe
  2⤵
  PID:8536
- C:\Windows\System\XmwzNXV.exe
  C:\Windows\System\XmwzNXV.exe
  2⤵
  PID:8580
- C:\Windows\System\GKEiKPa.exe
  C:\Windows\System\GKEiKPa.exe
  2⤵
  PID:10252
- C:\Windows\System\Spawxgv.exe
  C:\Windows\System\Spawxgv.exe
  2⤵
  PID:10272
- C:\Windows\System\WydEduv.exe
  C:\Windows\System\WydEduv.exe
  2⤵
  PID:10296
- C:\Windows\System\ypmIqSM.exe
  C:\Windows\System\ypmIqSM.exe
  2⤵
  PID:10320
- C:\Windows\System\BsNuIPD.exe
  C:\Windows\System\BsNuIPD.exe
  2⤵
  PID:10344
- C:\Windows\System\BouLZDo.exe
  C:\Windows\System\BouLZDo.exe
  2⤵
  PID:10360
- C:\Windows\System\VvFBiKI.exe
  C:\Windows\System\VvFBiKI.exe
  2⤵
  PID:10388
- C:\Windows\System\psshuyG.exe
  C:\Windows\System\psshuyG.exe
  2⤵
  PID:10412
- C:\Windows\System\zbEdMYI.exe
  C:\Windows\System\zbEdMYI.exe
  2⤵
  PID:10428
- C:\Windows\System\EtyGlFy.exe
  C:\Windows\System\EtyGlFy.exe
  2⤵
  PID:10448
- C:\Windows\System\wVkKfHH.exe
  C:\Windows\System\wVkKfHH.exe
  2⤵
  PID:10468
- C:\Windows\System\NoFfOte.exe
  C:\Windows\System\NoFfOte.exe
  2⤵
  PID:10484
- C:\Windows\System\eMPQqIX.exe
  C:\Windows\System\eMPQqIX.exe
  2⤵
  PID:10508
- C:\Windows\System\csDBGzX.exe
  C:\Windows\System\csDBGzX.exe
  2⤵
  PID:10528
- C:\Windows\System\bDvdSPl.exe
  C:\Windows\System\bDvdSPl.exe
  2⤵
  PID:10548
- C:\Windows\System\aqxDvpF.exe
  C:\Windows\System\aqxDvpF.exe
  2⤵
  PID:10568
- C:\Windows\System\bCXbcaw.exe
  C:\Windows\System\bCXbcaw.exe
  2⤵
  PID:10588
- C:\Windows\System\zCYzVDC.exe
  C:\Windows\System\zCYzVDC.exe
  2⤵
  PID:10604
- C:\Windows\System\BIdKJTd.exe
  C:\Windows\System\BIdKJTd.exe
  2⤵
  PID:10628
- C:\Windows\System\vQxOXvs.exe
  C:\Windows\System\vQxOXvs.exe
  2⤵
  PID:10648
- C:\Windows\System\pSTcRhc.exe
  C:\Windows\System\pSTcRhc.exe
  2⤵
  PID:10664
- C:\Windows\System\VYPohzP.exe
  C:\Windows\System\VYPohzP.exe
  2⤵
  PID:10684
- C:\Windows\System\ErjkxMo.exe
  C:\Windows\System\ErjkxMo.exe
  2⤵
  PID:10704
- C:\Windows\System\QizZPWb.exe
  C:\Windows\System\QizZPWb.exe
  2⤵
  PID:10724
- C:\Windows\System\CIeLxiH.exe
  C:\Windows\System\CIeLxiH.exe
  2⤵
  PID:10744
- C:\Windows\System\cqBxvZN.exe
  C:\Windows\System\cqBxvZN.exe
  2⤵
  PID:10764
- C:\Windows\System\gyUsMZX.exe
  C:\Windows\System\gyUsMZX.exe
  2⤵
  PID:10780
- C:\Windows\System\UsgUIwm.exe
  C:\Windows\System\UsgUIwm.exe
  2⤵
  PID:10796
- C:\Windows\System\xajomMk.exe
  C:\Windows\System\xajomMk.exe
  2⤵
  PID:10812
- C:\Windows\System\ilyCPzb.exe
  C:\Windows\System\ilyCPzb.exe
  2⤵
  PID:10836
- C:\Windows\System\vvbYoMF.exe
  C:\Windows\System\vvbYoMF.exe
  2⤵
  PID:10852
- C:\Windows\System\bMtcBop.exe
  C:\Windows\System\bMtcBop.exe
  2⤵
  PID:10872
- C:\Windows\System\gJOOLsB.exe
  C:\Windows\System\gJOOLsB.exe
  2⤵
  PID:10892
- C:\Windows\System\NvFzdMO.exe
  C:\Windows\System\NvFzdMO.exe
  2⤵
  PID:10912
- C:\Windows\System\KDWDtZh.exe
  C:\Windows\System\KDWDtZh.exe
  2⤵
  PID:10928
- C:\Windows\System\iTGwjxl.exe
  C:\Windows\System\iTGwjxl.exe
  2⤵
  PID:10952
- C:\Windows\System\ezhpREJ.exe
  C:\Windows\System\ezhpREJ.exe
  2⤵
  PID:10976
- C:\Windows\System\hEVAXaG.exe
  C:\Windows\System\hEVAXaG.exe
  2⤵
  PID:10992
- C:\Windows\System\blVTmgy.exe
  C:\Windows\System\blVTmgy.exe
  2⤵
  PID:11016
- C:\Windows\System\hmlEEvv.exe
  C:\Windows\System\hmlEEvv.exe
  2⤵
  PID:11032
- C:\Windows\System\KYdQVJC.exe
  C:\Windows\System\KYdQVJC.exe
  2⤵
  PID:11052
- C:\Windows\System\LEvzCfa.exe
  C:\Windows\System\LEvzCfa.exe
  2⤵
  PID:11076
- C:\Windows\System\BsHntEZ.exe
  C:\Windows\System\BsHntEZ.exe
  2⤵
  PID:11096
- C:\Windows\System\zdflgxk.exe
  C:\Windows\System\zdflgxk.exe
  2⤵
  PID:11112
- C:\Windows\System\PKYbxZW.exe
  C:\Windows\System\PKYbxZW.exe
  2⤵
  PID:11136
- C:\Windows\System\gTkTItP.exe
  C:\Windows\System\gTkTItP.exe
  2⤵
  PID:11160
- C:\Windows\System\xCVdZce.exe
  C:\Windows\System\xCVdZce.exe
  2⤵
  PID:11180
- C:\Windows\System\FZbHxZu.exe
  C:\Windows\System\FZbHxZu.exe
  2⤵
  PID:11200
- C:\Windows\System\DPJtJNr.exe
  C:\Windows\System\DPJtJNr.exe
  2⤵
  PID:11216
- C:\Windows\System\ZbGyWAg.exe
  C:\Windows\System\ZbGyWAg.exe
  2⤵
  PID:11236
- C:\Windows\System\HShFFSq.exe
  C:\Windows\System\HShFFSq.exe
  2⤵
  PID:11252
- C:\Windows\System\fPnanHM.exe
  C:\Windows\System\fPnanHM.exe
  2⤵
  PID:7664
- C:\Windows\System\nXdTJlr.exe
  C:\Windows\System\nXdTJlr.exe
  2⤵
  PID:7728
- C:\Windows\System\mtprfVk.exe
  C:\Windows\System\mtprfVk.exe
  2⤵
  PID:7776
- C:\Windows\System\PqDSMnS.exe
  C:\Windows\System\PqDSMnS.exe
  2⤵
  PID:9256
- C:\Windows\System\BdpXMGW.exe
  C:\Windows\System\BdpXMGW.exe
  2⤵
  PID:9296
- C:\Windows\System\zFkvXkC.exe
  C:\Windows\System\zFkvXkC.exe
  2⤵
  PID:9320
- C:\Windows\System\jafRiFF.exe
  C:\Windows\System\jafRiFF.exe
  2⤵
  PID:8792
- C:\Windows\System\ysKeGET.exe
  C:\Windows\System\ysKeGET.exe
  2⤵
  PID:8860
- C:\Windows\System\IXMBnMX.exe
  C:\Windows\System\IXMBnMX.exe
  2⤵
  PID:8884
- C:\Windows\System\VHccnVW.exe
  C:\Windows\System\VHccnVW.exe
  2⤵
  PID:9588
- C:\Windows\System\SZKeifd.exe
  C:\Windows\System\SZKeifd.exe
  2⤵
  PID:8984
- C:\Windows\System\cdjfbmf.exe
  C:\Windows\System\cdjfbmf.exe
  2⤵
  PID:5680
- C:\Windows\System\toOdwxV.exe
  C:\Windows\System\toOdwxV.exe
  2⤵
  PID:6136
- C:\Windows\System\FZhPoTw.exe
  C:\Windows\System\FZhPoTw.exe
  2⤵
  PID:8024
- C:\Windows\System\HYoswyG.exe
  C:\Windows\System\HYoswyG.exe
  2⤵
  PID:8196
- C:\Windows\System\ZGghhtT.exe
  C:\Windows\System\ZGghhtT.exe
  2⤵
  PID:9156
- C:\Windows\System\wOKAXNy.exe
  C:\Windows\System\wOKAXNy.exe
  2⤵
  PID:11276
- C:\Windows\System\FcdGyFn.exe
  C:\Windows\System\FcdGyFn.exe
  2⤵
  PID:11292
- C:\Windows\System\IjkmpxI.exe
  C:\Windows\System\IjkmpxI.exe
  2⤵
  PID:11312
- C:\Windows\System\brMUsHU.exe
  C:\Windows\System\brMUsHU.exe
  2⤵
  PID:11332
- C:\Windows\System\ilrXTAP.exe
  C:\Windows\System\ilrXTAP.exe
  2⤵
  PID:11348
- C:\Windows\System\xWAAvFS.exe
  C:\Windows\System\xWAAvFS.exe
  2⤵
  PID:11364
- C:\Windows\System\nGuzkaQ.exe
  C:\Windows\System\nGuzkaQ.exe
  2⤵
  PID:11380
- C:\Windows\System\zwimCmP.exe
  C:\Windows\System\zwimCmP.exe
  2⤵
  PID:11400
- C:\Windows\System\yGULMTq.exe
  C:\Windows\System\yGULMTq.exe
  2⤵
  PID:11416
- C:\Windows\System\gXzVczQ.exe
  C:\Windows\System\gXzVczQ.exe
  2⤵
  PID:11436
- C:\Windows\System\oirhGmd.exe
  C:\Windows\System\oirhGmd.exe
  2⤵
  PID:11456
- C:\Windows\System\wfOXMCN.exe
  C:\Windows\System\wfOXMCN.exe
  2⤵
  PID:11476
- C:\Windows\System\hstGnSs.exe
  C:\Windows\System\hstGnSs.exe
  2⤵
  PID:11496
- C:\Windows\System\aixdrNw.exe
  C:\Windows\System\aixdrNw.exe
  2⤵
  PID:11516
- C:\Windows\System\FRvXxse.exe
  C:\Windows\System\FRvXxse.exe
  2⤵
  PID:11532
- C:\Windows\System\CRjxgDm.exe
  C:\Windows\System\CRjxgDm.exe
  2⤵
  PID:11556
- C:\Windows\System\fgQFXfF.exe
  C:\Windows\System\fgQFXfF.exe
  2⤵
  PID:11572
- C:\Windows\System\ZQoXrwt.exe
  C:\Windows\System\ZQoXrwt.exe
  2⤵
  PID:11592
- C:\Windows\System\bghEuQI.exe
  C:\Windows\System\bghEuQI.exe
  2⤵
  PID:11608
- C:\Windows\System\mhEFHue.exe
  C:\Windows\System\mhEFHue.exe
  2⤵
  PID:11624
- C:\Windows\System\FDrvUPW.exe
  C:\Windows\System\FDrvUPW.exe
  2⤵
  PID:11644
- C:\Windows\System\phUpeAo.exe
  C:\Windows\System\phUpeAo.exe
  2⤵
  PID:11668
- C:\Windows\System\AHUWvVK.exe
  C:\Windows\System\AHUWvVK.exe
  2⤵
  PID:11684
- C:\Windows\System\EJkpEkm.exe
  C:\Windows\System\EJkpEkm.exe
  2⤵
  PID:11740
- C:\Windows\System\RAZXDbR.exe
  C:\Windows\System\RAZXDbR.exe
  2⤵
  PID:11756
- C:\Windows\System\fVIUtpH.exe
  C:\Windows\System\fVIUtpH.exe
  2⤵
  PID:11772
- C:\Windows\System\rxYEESL.exe
  C:\Windows\System\rxYEESL.exe
  2⤵
  PID:11796
- C:\Windows\System\fAOKyaO.exe
  C:\Windows\System\fAOKyaO.exe
  2⤵
  PID:11812
- C:\Windows\System\RNmpuOB.exe
  C:\Windows\System\RNmpuOB.exe
  2⤵
  PID:11832
- C:\Windows\System\lAHspdg.exe
  C:\Windows\System\lAHspdg.exe
  2⤵
  PID:11852
- C:\Windows\System\dDHofRf.exe
  C:\Windows\System\dDHofRf.exe
  2⤵
  PID:11880
- C:\Windows\System\PoCRpKH.exe
  C:\Windows\System\PoCRpKH.exe
  2⤵
  PID:11912
- C:\Windows\System\eMqpvQv.exe
  C:\Windows\System\eMqpvQv.exe
  2⤵
  PID:11932
- C:\Windows\System\beIopiq.exe
  C:\Windows\System\beIopiq.exe
  2⤵
  PID:11952
- C:\Windows\System\ReGIuFy.exe
  C:\Windows\System\ReGIuFy.exe
  2⤵
  PID:11972
- C:\Windows\System\YjqYrgp.exe
  C:\Windows\System\YjqYrgp.exe
  2⤵
  PID:11988
- C:\Windows\System\IQFPPIP.exe
  C:\Windows\System\IQFPPIP.exe
  2⤵
  PID:12008
- C:\Windows\System\LtzKFpz.exe
  C:\Windows\System\LtzKFpz.exe
  2⤵
  PID:12028
- C:\Windows\System\qrbzqAI.exe
  C:\Windows\System\qrbzqAI.exe
  2⤵
  PID:12048
- C:\Windows\System\ESDuOcx.exe
  C:\Windows\System\ESDuOcx.exe
  2⤵
  PID:12064
- C:\Windows\System\mWoEuin.exe
  C:\Windows\System\mWoEuin.exe
  2⤵
  PID:12088
- C:\Windows\System\vHlNKeY.exe
  C:\Windows\System\vHlNKeY.exe
  2⤵
  PID:12108
- C:\Windows\System\gPqVteo.exe
  C:\Windows\System\gPqVteo.exe
  2⤵
  PID:12128
- C:\Windows\System\Lmsjhvy.exe
  C:\Windows\System\Lmsjhvy.exe
  2⤵
  PID:12148
- C:\Windows\System\tCyFzel.exe
  C:\Windows\System\tCyFzel.exe
  2⤵
  PID:12172
- C:\Windows\System\DbjAnez.exe
  C:\Windows\System\DbjAnez.exe
  2⤵
  PID:12196
- C:\Windows\System\FzWfdua.exe
  C:\Windows\System\FzWfdua.exe
  2⤵
  PID:12216
- C:\Windows\System\qtoJYrQ.exe
  C:\Windows\System\qtoJYrQ.exe
  2⤵
  PID:12236
- C:\Windows\System\UeKGdcZ.exe
  C:\Windows\System\UeKGdcZ.exe
  2⤵
  PID:12256
- C:\Windows\System\zkseVIZ.exe
  C:\Windows\System\zkseVIZ.exe
  2⤵
  PID:12280
- C:\Windows\System\mhnAqrm.exe
  C:\Windows\System\mhnAqrm.exe
  2⤵
  PID:8300
- C:\Windows\System\oqeKnAI.exe
  C:\Windows\System\oqeKnAI.exe
  2⤵
  PID:5404
- C:\Windows\System\lTGucZQ.exe
  C:\Windows\System\lTGucZQ.exe
  2⤵
  PID:10160
- C:\Windows\System\EQkrEZF.exe
  C:\Windows\System\EQkrEZF.exe
  2⤵
  PID:2252
- C:\Windows\System\fGViXRK.exe
  C:\Windows\System\fGViXRK.exe
  2⤵
  PID:8752
- C:\Windows\System\ymwHQOW.exe
  C:\Windows\System\ymwHQOW.exe
  2⤵
  PID:6748
- C:\Windows\System\xmiJbJo.exe
  C:\Windows\System\xmiJbJo.exe
  2⤵
  PID:8040
- C:\Windows\System\RzfNUkK.exe
  C:\Windows\System\RzfNUkK.exe
  2⤵
  PID:7492
- C:\Windows\System\GnZfUBd.exe
  C:\Windows\System\GnZfUBd.exe
  2⤵
  PID:368
- C:\Windows\System\hrKWEgh.exe
  C:\Windows\System\hrKWEgh.exe
  2⤵
  PID:8348
- C:\Windows\System\AHVbqbU.exe
  C:\Windows\System\AHVbqbU.exe
  2⤵
  PID:10336
- C:\Windows\System\LAaOQdE.exe
  C:\Windows\System\LAaOQdE.exe
  2⤵
  PID:1964
- C:\Windows\System\VFTCGxc.exe
  C:\Windows\System\VFTCGxc.exe
  2⤵
  PID:10560
- C:\Windows\System\wMwQYVr.exe
  C:\Windows\System\wMwQYVr.exe
  2⤵
  PID:10644
- C:\Windows\System\NuulCuJ.exe
  C:\Windows\System\NuulCuJ.exe
  2⤵
  PID:10712
- C:\Windows\System\ixLBrLc.exe
  C:\Windows\System\ixLBrLc.exe
  2⤵
  PID:10740
- C:\Windows\System\xaxSyFJ.exe
  C:\Windows\System\xaxSyFJ.exe
  2⤵
  PID:10824
- C:\Windows\System\bqjwFWe.exe
  C:\Windows\System\bqjwFWe.exe
  2⤵
  PID:12300
- C:\Windows\System\LIYghXV.exe
  C:\Windows\System\LIYghXV.exe
  2⤵
  PID:12328
- C:\Windows\System\JOApwRu.exe
  C:\Windows\System\JOApwRu.exe
  2⤵
  PID:12344
- C:\Windows\System\CItbMgW.exe
  C:\Windows\System\CItbMgW.exe
  2⤵
  PID:12364
- C:\Windows\System\XuZlwmi.exe
  C:\Windows\System\XuZlwmi.exe
  2⤵
  PID:12384
- C:\Windows\System\JUCMibE.exe
  C:\Windows\System\JUCMibE.exe
  2⤵
  PID:12404
- C:\Windows\System\GNUIcmh.exe
  C:\Windows\System\GNUIcmh.exe
  2⤵
  PID:12424
- C:\Windows\System\zMeHzWF.exe
  C:\Windows\System\zMeHzWF.exe
  2⤵
  PID:12444
- C:\Windows\System\iPEhTWq.exe
  C:\Windows\System\iPEhTWq.exe
  2⤵
  PID:12464
- C:\Windows\System\NcXgvjH.exe
  C:\Windows\System\NcXgvjH.exe
  2⤵
  PID:12484
- C:\Windows\System\AvyRvrW.exe
  C:\Windows\System\AvyRvrW.exe
  2⤵
  PID:12504
- C:\Windows\System\fBrhLYy.exe
  C:\Windows\System\fBrhLYy.exe
  2⤵
  PID:12528
- C:\Windows\System\sFjahKK.exe
  C:\Windows\System\sFjahKK.exe
  2⤵
  PID:12548
- C:\Windows\System\yDKxrKf.exe
  C:\Windows\System\yDKxrKf.exe
  2⤵
  PID:12568
- C:\Windows\System\dQGlrbr.exe
  C:\Windows\System\dQGlrbr.exe
  2⤵
  PID:12588
- C:\Windows\System\hgDejUT.exe
  C:\Windows\System\hgDejUT.exe
  2⤵
  PID:12604
- C:\Windows\System\fLtUOVn.exe
  C:\Windows\System\fLtUOVn.exe
  2⤵
  PID:12624
- C:\Windows\System\PlSDMkG.exe
  C:\Windows\System\PlSDMkG.exe
  2⤵
  PID:12644
- C:\Windows\System\mHKwbwW.exe
  C:\Windows\System\mHKwbwW.exe
  2⤵
  PID:12660
- C:\Windows\System\cyNXhhH.exe
  C:\Windows\System\cyNXhhH.exe
  2⤵
  PID:12684
- C:\Windows\System\ZHWUkzo.exe
  C:\Windows\System\ZHWUkzo.exe
  2⤵
  PID:12708
- C:\Windows\System\ctdyfLR.exe
  C:\Windows\System\ctdyfLR.exe
  2⤵
  PID:12724
- C:\Windows\System\lWXjiiN.exe
  C:\Windows\System\lWXjiiN.exe
  2⤵
  PID:12748
- C:\Windows\System\TdBYSDl.exe
  C:\Windows\System\TdBYSDl.exe
  2⤵
  PID:12788
- C:\Windows\System\idJahKl.exe
  C:\Windows\System\idJahKl.exe
  2⤵
  PID:12808
- C:\Windows\System\gTwexgI.exe
  C:\Windows\System\gTwexgI.exe
  2⤵
  PID:12832
- C:\Windows\System\sooPekx.exe
  C:\Windows\System\sooPekx.exe
  2⤵
  PID:12864
- C:\Windows\System\dFTkUhu.exe
  C:\Windows\System\dFTkUhu.exe
  2⤵
  PID:12896
- C:\Windows\System\dDrLjEl.exe
  C:\Windows\System\dDrLjEl.exe
  2⤵
  PID:12924
- C:\Windows\System\kNhyveL.exe
  C:\Windows\System\kNhyveL.exe
  2⤵
  PID:12940
- C:\Windows\System\MeBnXAa.exe
  C:\Windows\System\MeBnXAa.exe
  2⤵
  PID:12964
- C:\Windows\System\QhzVefM.exe
  C:\Windows\System\QhzVefM.exe
  2⤵
  PID:12988
- C:\Windows\System\jdjTiOK.exe
  C:\Windows\System\jdjTiOK.exe
  2⤵
  PID:13008
- C:\Windows\System\EQyCVxG.exe
  C:\Windows\System\EQyCVxG.exe
  2⤵
  PID:13032
- C:\Windows\System\fTddCIV.exe
  C:\Windows\System\fTddCIV.exe
  2⤵
  PID:13068
- C:\Windows\System\ZosXMRG.exe
  C:\Windows\System\ZosXMRG.exe
  2⤵
  PID:13232
- C:\Windows\System\oeBJFIo.exe
  C:\Windows\System\oeBJFIo.exe
  2⤵
  PID:13248
- C:\Windows\System\Atzfgrb.exe
  C:\Windows\System\Atzfgrb.exe
  2⤵
  PID:11700
- C:\Windows\System\uIHbssl.exe
  C:\Windows\System\uIHbssl.exe
  2⤵
  PID:11732
- C:\Windows\System\inpwyDr.exe
  C:\Windows\System\inpwyDr.exe
  2⤵
  PID:11784
- C:\Windows\System\fGsEvuC.exe
  C:\Windows\System\fGsEvuC.exe
  2⤵
  PID:11828
- C:\Windows\System\aNaYuwC.exe
  C:\Windows\System\aNaYuwC.exe
  2⤵
  PID:11900
- C:\Windows\System\GmZxjtw.exe
  C:\Windows\System\GmZxjtw.exe
  2⤵
  PID:12072
- C:\Windows\System\oajsPdm.exe
  C:\Windows\System\oajsPdm.exe
  2⤵
  PID:12100
- C:\Windows\System\MXtyfsv.exe
  C:\Windows\System\MXtyfsv.exe
  2⤵
  PID:12144
- C:\Windows\System\sOCfsZk.exe
  C:\Windows\System\sOCfsZk.exe
  2⤵
  PID:12212
- C:\Windows\System\GQPgbjJ.exe
  C:\Windows\System\GQPgbjJ.exe
  2⤵
  PID:6132
- C:\Windows\System\awVhnra.exe
  C:\Windows\System\awVhnra.exe
  2⤵
  PID:6676
- C:\Windows\System\KqiiHkU.exe
  C:\Windows\System\KqiiHkU.exe
  2⤵
  PID:8508
- C:\Windows\System\wTzZxfR.exe
  C:\Windows\System\wTzZxfR.exe
  2⤵
  PID:10756
- C:\Windows\System\MLKrBGr.exe
  C:\Windows\System\MLKrBGr.exe
  2⤵
  PID:9792
- C:\Windows\System\NeGiIWu.exe
  C:\Windows\System\NeGiIWu.exe
  2⤵
  PID:10400
- C:\Windows\System\MMTHeTy.exe
  C:\Windows\System\MMTHeTy.exe
  2⤵
  PID:6772
- C:\Windows\System\jroQBXu.exe
  C:\Windows\System\jroQBXu.exe
  2⤵
  PID:8736
- C:\Windows\System\ZlYfEnp.exe
  C:\Windows\System\ZlYfEnp.exe
  2⤵
  PID:12732
- C:\Windows\System\IUKfzjN.exe
  C:\Windows\System\IUKfzjN.exe
  2⤵
  PID:12776
- C:\Windows\System\BDiiJfq.exe
  C:\Windows\System\BDiiJfq.exe
  2⤵
  PID:12824
- C:\Windows\System\GqouqjV.exe
  C:\Windows\System\GqouqjV.exe
  2⤵
  PID:13220
- C:\Windows\System\SDjWKCv.exe
  C:\Windows\System\SDjWKCv.exe
  2⤵
  PID:13260
- C:\Windows\System\WZomVeK.exe
  C:\Windows\System\WZomVeK.exe
  2⤵
  PID:8976
- C:\Windows\System\mybgLON.exe
  C:\Windows\System\mybgLON.exe
  2⤵
  PID:5056
- C:\Windows\System\bGnDnFu.exe
  C:\Windows\System\bGnDnFu.exe
  2⤵
  PID:11848
- C:\Windows\System\pMTWBzj.exe
  C:\Windows\System\pMTWBzj.exe
  2⤵
  PID:12640
- C:\Windows\System\DQyUMIq.exe
  C:\Windows\System\DQyUMIq.exe
  2⤵
  PID:2552
- C:\Windows\System\iEBKyYQ.exe
  C:\Windows\System\iEBKyYQ.exe
  2⤵
  PID:9888
- C:\Windows\System\dvKLzyl.exe
  C:\Windows\System\dvKLzyl.exe
  2⤵
  PID:3892
- C:\Windows\System\XcdqZiN.exe
  C:\Windows\System\XcdqZiN.exe
  2⤵
  PID:2728
- C:\Windows\System\xPaGvgo.exe
  C:\Windows\System\xPaGvgo.exe
  2⤵
  PID:12140
- C:\Windows\System\cCHehXP.exe
  C:\Windows\System\cCHehXP.exe
  2⤵
  PID:12264
- C:\Windows\System\vGmHzkq.exe
  C:\Windows\System\vGmHzkq.exe
  2⤵
  PID:1244
- C:\Windows\System\ufGItHu.exe
  C:\Windows\System\ufGItHu.exe
  2⤵
  PID:3856
- C:\Windows\System\WcrYGtw.exe
  C:\Windows\System\WcrYGtw.exe
  2⤵
  PID:9384
- C:\Windows\System\MjNwYZH.exe
  C:\Windows\System\MjNwYZH.exe
  2⤵
  PID:10948
- C:\Windows\System\GLbPgrl.exe
  C:\Windows\System\GLbPgrl.exe
  2⤵
  PID:9740
- C:\Windows\System\jpUzzXZ.exe
  C:\Windows\System\jpUzzXZ.exe
  2⤵
  PID:636
- C:\Windows\System\ndIZevD.exe
  C:\Windows\System\ndIZevD.exe
  2⤵
  PID:11376
- C:\Windows\System\EViCPcI.exe
  C:\Windows\System\EViCPcI.exe
  2⤵
  PID:11640
- C:\Windows\System\tfzMLps.exe
  C:\Windows\System\tfzMLps.exe
  2⤵
  PID:12692
- C:\Windows\System\MWAtKxo.exe
  C:\Windows\System\MWAtKxo.exe
  2⤵
  PID:9088
- C:\Windows\System\ZAVHjVQ.exe
  C:\Windows\System\ZAVHjVQ.exe
  2⤵
  PID:13304
- C:\Windows\System\TvXtVAM.exe
  C:\Windows\System\TvXtVAM.exe
  2⤵
  PID:10864
- C:\Windows\System\hReCVlP.exe
  C:\Windows\System\hReCVlP.exe
  2⤵
  PID:7532
- C:\Windows\System\kZUEYSR.exe
  C:\Windows\System\kZUEYSR.exe
  2⤵
  PID:1176
- C:\Windows\System\ySpXwZp.exe
  C:\Windows\System\ySpXwZp.exe
  2⤵
  PID:5028
- C:\Windows\System\IhcjsUj.exe
  C:\Windows\System\IhcjsUj.exe
  2⤵
  PID:12632
- C:\Windows\System\fQzDuMg.exe
  C:\Windows\System\fQzDuMg.exe
  2⤵
  PID:9472
- C:\Windows\System\YhREMjW.exe
  C:\Windows\System\YhREMjW.exe
  2⤵
  PID:1608
- C:\Windows\System\zVteURL.exe
  C:\Windows\System\zVteURL.exe
  2⤵
  PID:12180
- C:\Windows\System\ROdZoYZ.exe
  C:\Windows\System\ROdZoYZ.exe
  2⤵
  PID:10144
- C:\Windows\System\KbqssuM.exe
  C:\Windows\System\KbqssuM.exe
  2⤵
  PID:9784
- C:\Windows\System\LetaxCJ.exe
  C:\Windows\System\LetaxCJ.exe
  2⤵
  PID:2000
- C:\Windows\System\ImXbVIY.exe
  C:\Windows\System\ImXbVIY.exe
  2⤵
  PID:12676
- C:\Windows\System\odJGond.exe
  C:\Windows\System\odJGond.exe
  2⤵
  PID:444
- C:\Windows\System\taErjvb.exe
  C:\Windows\System\taErjvb.exe
  2⤵
  PID:10960
- C:\Windows\System\addqGPt.exe
  C:\Windows\System\addqGPt.exe
  2⤵
  PID:11028
- C:\Windows\System\OLMWTzR.exe
  C:\Windows\System\OLMWTzR.exe
  2⤵
  PID:11152
- C:\Windows\System\kFPQXlJ.exe
  C:\Windows\System\kFPQXlJ.exe
  2⤵
  PID:8644
- C:\Windows\System\acSTtxs.exe
  C:\Windows\System\acSTtxs.exe
  2⤵
  PID:13136
- C:\Windows\System\Gkllrav.exe
  C:\Windows\System\Gkllrav.exe
  2⤵
  PID:11512
- C:\Windows\System\QdmZjXo.exe
  C:\Windows\System\QdmZjXo.exe
  2⤵
  PID:12360
- C:\Windows\System\fdMqovZ.exe
  C:\Windows\System\fdMqovZ.exe
  2⤵
  PID:2028
- C:\Windows\System\BoGoKZX.exe
  C:\Windows\System\BoGoKZX.exe
  2⤵
  PID:11804
- C:\Windows\System\GBHhzwW.exe
  C:\Windows\System\GBHhzwW.exe
  2⤵
  PID:9716
- C:\Windows\System\OEgxqox.exe
  C:\Windows\System\OEgxqox.exe
  2⤵
  PID:12784
- C:\Windows\System\fhnNqjG.exe
  C:\Windows\System\fhnNqjG.exe
  2⤵
  PID:10696
- C:\Windows\System\dBqfMuh.exe
  C:\Windows\System\dBqfMuh.exe
  2⤵
  PID:1448
- C:\Windows\System\nrSwLdU.exe
  C:\Windows\System\nrSwLdU.exe
  2⤵
  PID:11408
- C:\Windows\System\VzSRweT.exe
  C:\Windows\System\VzSRweT.exe
  2⤵
  PID:9360
- C:\Windows\System\qlesCSh.exe
  C:\Windows\System\qlesCSh.exe
  2⤵
  PID:11300
- C:\Windows\System\SDGDQkD.exe
  C:\Windows\System\SDGDQkD.exe
  2⤵
  PID:12716
- C:\Windows\System\ipDzHpK.exe
  C:\Windows\System\ipDzHpK.exe
  2⤵
  PID:11508
- C:\Windows\System\cnJYpQc.exe
  C:\Windows\System\cnJYpQc.exe
  2⤵
  PID:2516
- C:\Windows\System\xxRTRcm.exe
  C:\Windows\System\xxRTRcm.exe
  2⤵
  PID:7876
- C:\Windows\System\QfxVHbP.exe
  C:\Windows\System\QfxVHbP.exe
  2⤵
  PID:5440
- C:\Windows\System\WqCSbKN.exe
  C:\Windows\System\WqCSbKN.exe
  2⤵
  PID:6416
- C:\Windows\System\XbUOfLG.exe
  C:\Windows\System\XbUOfLG.exe
  2⤵
  PID:6428
- C:\Windows\System\tJMCdNj.exe
  C:\Windows\System\tJMCdNj.exe
  2⤵
  PID:6032
- C:\Windows\System\HXGpMqP.exe
  C:\Windows\System\HXGpMqP.exe
  2⤵
  PID:4692
- C:\Windows\System\jOviLnj.exe
  C:\Windows\System\jOviLnj.exe
  2⤵
  PID:10020
- C:\Windows\System\ZrNqEoo.exe
  C:\Windows\System\ZrNqEoo.exe
  2⤵
  PID:9508
- C:\Windows\System\owHTmii.exe
  C:\Windows\System\owHTmii.exe
  2⤵
  PID:13256
- C:\Windows\System\aaGpgGI.exe
  C:\Windows\System\aaGpgGI.exe
  2⤵
  PID:11008
- C:\Windows\System\kIBDobl.exe
  C:\Windows\System\kIBDobl.exe
  2⤵
  PID:936
- C:\Windows\System\dSfinve.exe
  C:\Windows\System\dSfinve.exe
  2⤵
  PID:2916
- C:\Windows\System\LPvQWLu.exe
  C:\Windows\System\LPvQWLu.exe
  2⤵
  PID:13228
- C:\Windows\System\ONQudAR.exe
  C:\Windows\System\ONQudAR.exe
  2⤵
  PID:13356
- C:\Windows\System\JOemvUx.exe
  C:\Windows\System\JOemvUx.exe
  2⤵
  PID:13680
- C:\Windows\System\kLgPijz.exe
  C:\Windows\System\kLgPijz.exe
  2⤵
  PID:13696
- C:\Windows\System\brVchrL.exe
  C:\Windows\System\brVchrL.exe
  2⤵
  PID:13724
- C:\Windows\System\TaZRBnZ.exe
  C:\Windows\System\TaZRBnZ.exe
  2⤵
  PID:13744
- C:\Windows\System\mqavmqS.exe
  C:\Windows\System\mqavmqS.exe
  2⤵
  PID:13760
- C:\Windows\System\BFKKEZm.exe
  C:\Windows\System\BFKKEZm.exe
  2⤵
  PID:13776
- C:\Windows\System\QRpAnqG.exe
  C:\Windows\System\QRpAnqG.exe
  2⤵
  PID:13796
- C:\Windows\System\XInorFj.exe
  C:\Windows\System\XInorFj.exe
  2⤵
  PID:13816
- C:\Windows\System\djevfzz.exe
  C:\Windows\System\djevfzz.exe
  2⤵
  PID:13832
- C:\Windows\System\hPfhRix.exe
  C:\Windows\System\hPfhRix.exe
  2⤵
  PID:14024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n3iucbcq.thd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AMtTcso.exe

Filesize
1.4MB

MD5
52716caf5908cf59e0ba0e151674ac33

SHA1
cca0f8f17d0016e142bd82f2b549d3b5e679329d

SHA256
bbeef81e10462eaa960ce10aa5b18468daa45ddc381f40d10f3fac682613d193

SHA512
34ed279f8361bb2b705efd31b845168201e971aa4dca61864888ba811196577de1d4ad5f40c45dafbcc49991bc73595517ede2ca3bfa3d580d0e238ddcc3de2e

Download Submit
C:\Windows\System\AtiTPAt.exe

Filesize
1.4MB

MD5
8078093aea92e433d18370d1e38d7b1a

SHA1
84f996609deccfdaffe55cb886ae6741723844b6

SHA256
56c2be253316ca70c0cf848b033712932d126c18ec5c234bcf63ad362cc9a7cf

SHA512
1ddb8f4e607fe670f49458feeafae179e430c18fc9c5b17064b958cc5a4c982174d3577e244d53f208ef1e3e5bfd8bb12525ac61a5d30fb188a5a52da86c69cd

Download Submit
C:\Windows\System\Cczkkym.exe

Filesize
1.4MB

MD5
d35fef39cbe8110b057b324692e1ca89

SHA1
703ffef4c9f51ef185529573f1666a12f5f72aa3

SHA256
5fc492bbb67e48cc99e7ba50918c585a31d43fb639cface42b21eadf37ba0d4a

SHA512
a22677eb6638e876ea1fa4299f76d650899d46fa9a1f6fa2ae5d05043cce728f70eb9db3dd3a28e8d6ee18131512e8a6016b503d243bf3f7acc294b72cc87ad5

Download Submit
C:\Windows\System\DBbRsll.exe

Filesize
1.4MB

MD5
75d171ebce1f94a5e05b06eb618e5092

SHA1
cb04a013c4076585d22b7be09e8a9e4c3b88d036

SHA256
afd58b7ac6748e6ca26279a4dc1920625f79f40db366839de4c2d66cac3caa5e

SHA512
13c9ac2cbe290c7e7e43e391fbfd260b180a925b284087fb2674195cab26bcffe12a3e47ffb01f582d17c86580f3cf8f0601f38819b811515eca1ea4ef505202

Download Submit
C:\Windows\System\EffwndO.exe

Filesize
1.4MB

MD5
bcea4dd2536c715854f62599eda33c23

SHA1
2339eadc9fc2dcf6e381f70db4d4ad7f454f0601

SHA256
6fa87958545d4c7f3034c204a3af7950d818e696fe5fb43d1dea75d100dfa030

SHA512
ef962277bbc9296960acf4c61420a818449cdd3dad86e48ae5414ee3585e8a9e2244a8b2cd0887df9fad13e8896a5d7551ca500f7f4b729c3cabd82c77e764f6

Download Submit
C:\Windows\System\FVAFOEh.exe

Filesize
1.4MB

MD5
07f29ecbaf11d6302b6a1f56d3ac9ae1

SHA1
45cd6f4d7ced9799e0907dd92be1fbbb8d436ad4

SHA256
81cfc0286954a8cfc3089216f0f6a45b836b10db5316e15040cf31e82e2040a8

SHA512
c9154b52ba63f520de19f5528baf7a12e75b4b9eb319271b4af20fa7cfd943ba032a4ea3ad9f0bb918fdef3cfcb1e5d274e73cf75fdf1b6119408d14670fd473

Download Submit
C:\Windows\System\GHcpusY.exe

Filesize
1.4MB

MD5
918df59fab66682e70437567e47a7637

SHA1
ebbda8f93f66c66e7503af78b4f14e36d99c45ac

SHA256
d7ab61e647cea281e953736e28994eb57054a8a2af4ba2f80314b0f79a00710d

SHA512
18382a80c08f2de08798166ebfd1ae3d6b4ec8a797cecb78357649c37674d35555c2a4dd042470ecf96433ebe02f079d1504a0df7d133ca2563cfbad4976ed8b

Download Submit
C:\Windows\System\GjrmpoO.exe

Filesize
1.4MB

MD5
33a19694fe5f9495289f3cfe351bd23f

SHA1
0e7ec9906e40eabd5f85fea6585545ea809eb8f0

SHA256
858d6d2117a2c9913ecc9387f642e34b596b73df4a88e63e3fdcd7447421fcce

SHA512
ba447c1613189e636a377965844fe891370e8113c02a8600027d49377d88430d262052ca59a76c493799e48c56fdf02770b62a5b544b6389e2eb9a68caa6aa6a

Download Submit
C:\Windows\System\HdlOOeO.exe

Filesize
1.4MB

MD5
611bcbf2c58fc363b5981d6de927f833

SHA1
4ce2828a03c17445a51f3b2dba960d63e9916f1c

SHA256
8c25106bf92aafa65085bdd1540f3a449439e551a8074772c40302edfd2e3316

SHA512
edf5841fec085f7e3d8118a5a95dc6496f07cd7e4473f86207d4a713498a80c814a579cee984cf44e3c2dceeead240d051c2776a9c34613a49f301fa6c0edd10

Download Submit
C:\Windows\System\IPQNhyP.exe

Filesize
1.4MB

MD5
8844fcb3a367efef7aa22178c5abe77d

SHA1
c9e1ae18aa0341df3d3fff67c42f497870cb942a

SHA256
fdae158180655d43e2fe5bc32727bc39c0ced4d73d5b5f464e565413c065b599

SHA512
7a3cf6a0614ff926435728078a3a49591e6b2697bae5877d140f18774a4f8d94bb0b5282223b072f6e314d99d65993f9bd97ffe7b5a5bef64c35b30746f4aff2

Download Submit
C:\Windows\System\IaAXvie.exe

Filesize
1.4MB

MD5
d6eb6330fd4f0f3d48ef9f41b9427947

SHA1
07e4be976830e2cb164f3d428e75455dc2f2b568

SHA256
7b1b23a9e678b56e7dfee068f1f426d8f6353c2abc093c91cc1e9d4aae7e6d6e

SHA512
0da59404a5334f660c1aec028793f6703a69311fab4284450bb2b108ed69393f000f25415e00a2892f0e21aa4f02cf538cc577320c10ac41ab1a75b13f54cbb4

Download Submit
C:\Windows\System\LWavtaC.exe

Filesize
1.4MB

MD5
73eedae6ed29ffd1eb77a1a726a61be9

SHA1
fe7696907833df46d4a23a15980e54a38c10a7f4

SHA256
e8b63d5518432b5ef6e00c356aa3bf7224d42ad1280686a16f08129882a410c6

SHA512
c24527f8b8eddc54c9acca347a1db175e2fffff04b66b0b2cd9f03d3c7f0414ec30b2c2c3e5f547154385f7fb1ae620e639517f8ea81ac2a3a80400063f21459

Download Submit
C:\Windows\System\MJReuzC.exe

Filesize
1.4MB

MD5
5f44436abf27e7df047a9105f2007423

SHA1
fcdcffef73984dba32b3df9d15f57181b5f79136

SHA256
efba27a33fc76aecfe40072b12e1016eba1c08c9b4ab6a263426d0d9288ab029

SHA512
bb2d6af7ed7fda54c36338a0a908143c53303bbbd225c488ef1bd4532b150d28e8532306baa2d4967b9e8f9d70c01b2f7c9d4b02aa531792d492235fb42b5cec

Download Submit
C:\Windows\System\ObxZvIz.exe

Filesize
1.4MB

MD5
f02daea35961d55f9460d29482c2aa2a

SHA1
fe37f23401e5bfde7ce88a0eea86e042bdd0d53e

SHA256
cf5707c3e3c4bc6c7916658864a08982f631d0df6978ac6b0715adcdb1015913

SHA512
b14acc61e73a9ac5b86283b2749721cd94f8ae740554ec530a732960bdd7c0406d67ead83156b35b7223dea55469e1489d2e9d5bc8df5d70a9a902895a279e3c

Download Submit
C:\Windows\System\PSBwljz.exe

Filesize
1.4MB

MD5
cf9eab7b440ba3751ba5ab846d22d36e

SHA1
228fca9fe7e0f9e512fbc9d80bff3fbfa262ef56

SHA256
fb71716e9da38f86b8060487f89800ed0ddfe9c923e7198ffb21087e4bb74687

SHA512
b1bd61bc594b50f712e4f83b4556d276d943b0ec41768a0ebd2b5c5de97ad283b58f48bf31b594e308b0ef23dd57af570b01733b323a32fd922198b242e96224

Download Submit
C:\Windows\System\QLZyJZv.exe

Filesize
1.4MB

MD5
2f81828a9316bde746651ee61e82ae95

SHA1
459328be19e622802d37a66fe121da4d1f72ee79

SHA256
78d1807b44a1b8dc425538921f1cf1e458f549a2ad4927c1597c366d1f96f88e

SHA512
c18d7ecf0f863336fa9e8d1db8f9c9841bddc8a140b43e2b4f2b34dbdb0df9bc2be4d6e757389024e1f15b4a4b6d12725349645b8059a321349d4c98924ed55c

Download Submit
C:\Windows\System\QYSPVry.exe

Filesize
1.4MB

MD5
1743a4ce35475f1c048b58fff4f777b3

SHA1
5b639506dd7839d250f62a6bad80c9107e13adbb

SHA256
f20802f697485f2bb601269c17f74780a6c858a16f5ab59be8c430644c53b824

SHA512
f97a58a77f02eabbd696fb0ab2cc69d33523bd74f65cba56d47b6f228c36d4dff5fde755f1ada7754ddf9ed11049fb0f59525d08b2daa9c432d73677cc47f071

Download Submit
C:\Windows\System\RIvEqfU.exe

Filesize
1.4MB

MD5
c58dc248f1b8d3179ce24a27be35ad16

SHA1
94988f9d3088b11b6441e12c305666816d896027

SHA256
6b028e901850aca753d48bca7e8ada972a00749ad040febfae8e2a093364a51c

SHA512
7d8e05a835a391a728ce144bebd7a8d3830edf8240bea64c97fab810030248f68a03f4f4775db40bbbe06319877a5b3fcda233a2ca9bf25cd4ec5ff26c4cb77b

Download Submit
C:\Windows\System\SxhkTSW.exe

Filesize
1.2MB

MD5
fd56f81791f410e85bc7173bcd4f4154

SHA1
e465aa5055d829c004c48cace9e0fea745d72850

SHA256
273a7e29f0e62266d465c870e9ba9d76d7566c99a2eb3c11a77b737eeb83fafe

SHA512
513d1daf2f8d12e0cc16d58ddf8dee36e12537dad0d45d8ab9b199f68ca9d07ca5f1e49f43414c23ad20f4e73693d58d3770056b0c07a83f757189102bd64e7f

Download Submit
C:\Windows\System\WOcCrQn.exe

Filesize
1.4MB

MD5
7dda5b8d8b62a9186cee430d9cf95da8

SHA1
bcf56bc88a66a340c253c7262197273615297118

SHA256
6af9322cc4cc29a34616ee08adf7a8544f3aaa70ae233eda95b5eb3b06d01a20

SHA512
db037d886cbedb350fa407ac13af50d4577717f377b3542d4c3aa244f120f4dc018193ee8867412407a41d0a630e698ae0369953962696bc157fbc8ef990578d

Download Submit
C:\Windows\System\Wumpqkj.exe

Filesize
1.4MB

MD5
8a40437ab9eda4ce239e56923f9fdc15

SHA1
71c7e78197be144589dc7d8c34edf41a89731655

SHA256
32540844d3446f88cc0dfe72aacc9951316a4b6be88ae6701e2e55154c481da5

SHA512
b37544b294b271cce68dfae1c1d82b0106c4b5242f8d0d38b4796f5bbb8bff6b412301d309f8261414ab99a5990d23a7ceaf9349d97e2639929eeb81b8ff0436

Download Submit
C:\Windows\System\axvrhRQ.exe

Filesize
1.4MB

MD5
c72af3ec1880d04f68cab6c524294eb2

SHA1
8432cc4a18d14c9fb6a1b1fd7da0fdc54e1d9261

SHA256
9877be51b0ef07ee396b99e2c576e1e2ffbf20f60a7584fd689dd8b327325c2f

SHA512
0564bf95347b99749c97832e116f4102150993a933fa16d4f6f3d61ea2cd92551f2869a802bc6c888abbe3ebd8178b2d41b8a82036eeec3e1ea22b803aeaeb6f

Download Submit
C:\Windows\System\cRTPWRm.exe

Filesize
1.4MB

MD5
c6066d2f156704dde1cd9f3ed7755d9b

SHA1
afd3da1b592b1d537815ee8ded5cf815f9532f6c

SHA256
c086f01e67ca9692be3d0f59fb9ce61af4da5c3bcce955298d8530c1dee3a15c

SHA512
24a101038323b598aed68a0afaf1596f3f3591dcd7aef43763243146dd0296f59fe0f0e088a61646d7566c562dd317957d694464c3a508af7e233cb18b62a303

Download Submit
C:\Windows\System\fkbMRzr.exe

Filesize
1.4MB

MD5
70be7e7b6e491654832c6be9ee63b63d

SHA1
c92c52c255473695188a66c3ce5280a613d1295b

SHA256
cbbda030988572ab63fcdf5f438a62d991c51c879b82e813ec587512e74e9a95

SHA512
3d0a4db66579d9538841067366ea283232c64ced0f1ee1c26a657a5e837a30739479884692a9aa23b17c59970274a3a1f7169ff801a85ae72e891d1b19855abc

Download Submit
C:\Windows\System\fniCUmB.exe

Filesize
1.4MB

MD5
831c575771bcf206ac0688c6ec4ea69f

SHA1
f13a93db01c46b428734cdbb0dc56c41b65252ea

SHA256
aa480f91cb9951da59ae3ecb8fce1635a185f01c0c0bcec89a683229ddfd4533

SHA512
20357d336141fee807765b7fbc0df2cb637e59b04bd3461d35c14035238209abf4332b6cfe24e90e37bcc14eef891c68acbacc8013cd9e421c48798dcacac512

Download Submit
C:\Windows\System\giHRMTw.exe

Filesize
1.4MB

MD5
fe5707766f1849ca222996222784041b

SHA1
eeb04d494c607d635b5c49a1a9fe03be78d34a5f

SHA256
1f0db4f91e70144e04a8bc60a885d26ebc7a24ed32b4e06b8e84101b9559201f

SHA512
c90f48a974969c11e4c0f40766dd957119cd2a3f91d940aab6a6ed8b0774b2a672786bae5a2f95767a0aff2c8ddb064ba958daa75ff117e3295aaa288e5387c3

Download Submit
C:\Windows\System\hTZLghT.exe

Filesize
1.4MB

MD5
80097c8a160b2b1f15824e5b4ee70e90

SHA1
795b95d885dc048a32daad3b710d36059d1d5b3f

SHA256
74a04259ade0c8bb45711f95817ba89fe02444f24df917095e14cd7c5fe870d2

SHA512
fae5cd6effe5b7a61f35966584159bb91ae16d599a9690748c8193f06e6b7bb44373ec4c9bdc0377ed245bfa1a7f22ee3dd18a83923f4059a61ea8afbb15b907

Download Submit
C:\Windows\System\iEGLErm.exe

Filesize
1.4MB

MD5
2539e751187606ac41e44556af9c137c

SHA1
7848e6ecc7623606da031cca9a337f7191a8d037

SHA256
0df6f6b266ad3710e90dc80b3bad4d0c91a06c40e8f7ac04089b765df60385f1

SHA512
59fb30109b9608c34e376694b2f7bf8671454389279d424a75a4009962a356c31855257c25098aea2420b23a3ece103f1c728d6a2cbfaadd55b6f7f171e1fd16

Download Submit
C:\Windows\System\mxVmWEU.exe

Filesize
1.4MB

MD5
bd198c6f11aa5addcd1e0579f485bc5a

SHA1
f4fb4a0828f314bc7d6451ab1c4c47fc88caf7c3

SHA256
3e943632ad86cc0290ffeb3337146e1d643f094c89845822cfdf7b729a99fa7e

SHA512
ec267129c20916ad9dd9aa4b6ca4ab5aebd984694b644e7c50b9a65a7ce375082df3e690e7aace9d11979024f7c55fbf6b3d32f4756384b70f1aa4994575d995

Download Submit
C:\Windows\System\pIQxyTq.exe

Filesize
1.4MB

MD5
3656015f589f9954eb589d088a883ffc

SHA1
24f34a699d61a74baeeaec9e191cdd16bf0d45e6

SHA256
ca42f567fe16cb8daa8115784bacabca13c1ab58723a39e769ec052d0cc88606

SHA512
0fdf04b6f61be185af08dce7f813ca64e6674925927fe9cea50191080c22fd83cd0d39222f7c6dbf96e26a8858af123e2633188279dea15c7aa5bd7b9b6d0b0c

Download Submit
C:\Windows\System\qMvcjyy.exe

Filesize
1.4MB

MD5
d5c7411ecc54af179bc8965178c82751

SHA1
e1130230864cc3af9d4dbad9c70c447c7fe189a7

SHA256
ae6ef29c62bcc8d2bf84f64e315f14c52b392dd3f817f8cd0b5f8db59f39eea9

SHA512
966e772c3b8e5047ac1bb91fc24c49589d4c02c592e36bde9a9772183d1003921333dae781d535b4cfcfae90783ea22b5815beb9104586741a60957ea679a6cb

Download Submit
C:\Windows\System\rnUlPHJ.exe

Filesize
1.4MB

MD5
8c591ae1e178240d545ee6d6dd71a57f

SHA1
f8d4ce3f9c6bc5f56e2316a96f71557585462a71

SHA256
07f253ce84e1898c30a1c62fa65b65fa89d60efe2e7345b57c54ecce818d57f1

SHA512
1eec1d3ddce142323c1dfd5b61f326fecd59c0ca56153ed16e339962a396a46cebc3f43042d1024c161e7dc6e822b8f0357ef6ae227ef24522942347e1f9feac

Download Submit
C:\Windows\System\rwDEFjk.exe

Filesize
1.4MB

MD5
0b1ade0074c4972bb7bab213c9365347

SHA1
5b608e56d32a18470f2eccb3d581c83889d07e6d

SHA256
46896384edbc398a7339999c8fb780756c51e580e039f1e293aec146b37ea0fe

SHA512
07b1377c78790501187bd05b04f6298e34b1b2fc9a103277f4ca294d12483bdf8bdecb194e76cef3cb2976036b5d30f706b627a8af111d4200e44f52476c103e

Download Submit
C:\Windows\System\scrpnFj.exe

Filesize
1.4MB

MD5
b9dca218346df37273f9b6920c8b95c3

SHA1
b09219a4f67cc127b09b0a28cecb5dcf8a173007

SHA256
4ddf672a359e8956b925c9acc9ced7e9bc0391c1871cfde91e703815d56c3ba0

SHA512
94babd7124ab8072e6276fa7287086cb8f786ec41c6f6914725823d6023c73f5547a35d6805baefcb1efded3e51298523c56a7f4cb6b972ea5d32135195c2090

Download Submit
C:\Windows\System\tneanLZ.exe

Filesize
1.4MB

MD5
2a5c5d3bfe5902807ed07fa703a918e2

SHA1
6e1526878e5b018cec4b4bd32dd568f700dc3cf4

SHA256
5dc76ceca4d4c2d49dfb363eb6600c24466120f3bcbc855252bd70bb3302003c

SHA512
561cee03e2ca08593783b1173e8ee0d20413e5940dcb3a69246a841d8d8b0cb685f24e44575437e6bfb14a074cae73c37d5e47930cbe33431f7b6deb993b1f36

Download Submit
C:\Windows\System\uIxdRDl.exe

Filesize
1.4MB

MD5
c8ba869ecca37c19e371dcaf56c72d3c

SHA1
b281462708e013bb2e191afe74e42ff9329304ab

SHA256
6a87defd3fde6ee2d5e73bfb1c2bbe8d771375ead39ec133f074df30ac60996f

SHA512
d79f8faf31f6885990ba15bfa4624ca00dcb416d40403b9efdba2eab3485416d10913ace40abc3a14a20d1c85f6958da6ba3011031d626b6731d7cf354a70b8e

Download Submit
C:\Windows\System\uuyowmO.exe

Filesize
1.4MB

MD5
c357cc833972bca5311171fa52c5273d

SHA1
ee9be7c98c5715ed130eb0c0d841c21fcb84506a

SHA256
d796370b431913b87b8e13366b3fe3050f781fdac9dbd6ae5d7b764b0d3247f2

SHA512
09c1bb0e7c48c2285e9db62a53f38e875a587dfbdcd008dc5f14be22aa5981e7723e2e442f4106ebe580195dd96337f43e21def6c286705de9d37d648418ad2a

Download Submit
C:\Windows\System\uzaIlyJ.exe

Filesize
1.4MB

MD5
35b6660faf5816eda93d71e6556c3d31

SHA1
4ec466cb9882ff774ae9581ddf5dd831bde372a3

SHA256
fb38338ecdc076a4fbb8eb4cdada2dede76477ef3c88fd7a3865f1c20e6ad3af

SHA512
3fb265953deef1dee0f6e41098b6c84562ca58f6920c2906c26fd13498bc7f0267a4d646e26c3739a9eeea8e167739db0b6c807982823173c4d66c3967f7713c

Download Submit
C:\Windows\System\vEOjobH.exe

Filesize
1.4MB

MD5
6998d9a7fd7265902f99e76a4c79a78c

SHA1
21eeaf72d57e18fc2e8ff475f0cd73e43e1dbd9c

SHA256
360407ada7c901217d00afca4307c2d6922d10339f08c0ac27a04a1adf405add

SHA512
d5efe51d56093785d9898dbedd16f42fa28c5c2dab96b40196a7e5475f784ef9328afac0407181eebec355735f1d9d2dad823852e00e2c423552803430114aa1

Download Submit
C:\Windows\System\vVkRSIQ.exe

Filesize
1.4MB

MD5
0b30c03e4367bf4ebf4684897585ae5f

SHA1
3706983e401e651e319b133785bb6ca6e82fb755

SHA256
7cae5a7998e724b7e95e885c8da5d21b11cbfc8d93b62fd54b1a714e55c47324

SHA512
8f5d542598d3cf62193968252068d60786bb2d4f8d099704afb729fbf6fdccd7742975a1f8a78d827d73bdb5db0f926a538fe5c32ca517b17246d667022f66fb

Download Submit
C:\Windows\System\vxJicVQ.exe

Filesize
1.4MB

MD5
f15da2314deacc9ca4f6e70544364b5c

SHA1
91ab09977323ce81e5b89a4d5fb1e168fcc9c849

SHA256
5ea92f0f1ae0e3c0de802cf53af880a3228333495b23426295e215e20bf5d8fe

SHA512
cf4c7178223d4b7e974de5d112d4933b7792a9a0451191f14235f963c13c01f5ffaed5c3ba13883cb575f86cbb65f9dfcdaf0d83b6ddab32c69d84df49c83b03

Download Submit
C:\Windows\System\yrSZCxl.exe

Filesize
8B

MD5
8df5d7cea6f17e33b828ee09a4f8c91e

SHA1
6aaff1a3a288a0aba2a3023d517e314fe986f730

SHA256
cebffee933f857324d8ea2bd5fb8dad33034c7e30f8e9b644e83274baeadc1d6

SHA512
aee4f16c452925a2700f8c6c545adb516dd855069c67839327087aebe75765ec2637a168ea26305bfaf7ca090b0abc3820134331985dd395f3751e82867cb7ea

Download Submit
C:\Windows\System\zpCfyFK.exe

Filesize
1.4MB

MD5
e4275ca9b2ad4eba8ec6295f8a9881a3

SHA1
19a10b14870e6544b3a264c767ff179127a5809d

SHA256
af88427d719e8e975bf6315cf721b5df638ffc265b4c0c88fab5742de4f12fdd

SHA512
464dc73e12373bc329634c051a21d5fdeedd5b3e6a0a002265902411875a8e111286503a91d948cc04fbac1d0f276f8530889f662d36df60e64f04d6b492eb42

Download Submit
memory/740-2556-0x00007FF62BB20000-0x00007FF62BF12000-memory.dmp

Filesize
3.9MB

Download
memory/740-200-0x00007FF62BB20000-0x00007FF62BF12000-memory.dmp

Filesize
3.9MB

Download
memory/852-315-0x00007FF73AAC0000-0x00007FF73AEB2000-memory.dmp

Filesize
3.9MB

Download
memory/852-2551-0x00007FF73AAC0000-0x00007FF73AEB2000-memory.dmp

Filesize
3.9MB

Download
memory/920-1-0x000002A98C550000-0x000002A98C560000-memory.dmp

Filesize
64KB

Download
memory/920-0-0x00007FF60D510000-0x00007FF60D902000-memory.dmp

Filesize
3.9MB

Download
memory/1092-350-0x00007FF7076B0000-0x00007FF707AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1092-2553-0x00007FF7076B0000-0x00007FF707AA2000-memory.dmp

Filesize
3.9MB

Download
memory/1140-2585-0x00007FF60C320000-0x00007FF60C712000-memory.dmp

Filesize
3.9MB

Download
memory/1140-471-0x00007FF60C320000-0x00007FF60C712000-memory.dmp

Filesize
3.9MB

Download
memory/1148-2570-0x00007FF75E150000-0x00007FF75E542000-memory.dmp

Filesize
3.9MB

Download
memory/1148-381-0x00007FF75E150000-0x00007FF75E542000-memory.dmp

Filesize
3.9MB

Download
memory/1164-472-0x00007FF7468B0000-0x00007FF746CA2000-memory.dmp

Filesize
3.9MB

Download
memory/1164-2612-0x00007FF7468B0000-0x00007FF746CA2000-memory.dmp

Filesize
3.9MB

Download
memory/1236-2575-0x00007FF76DBB0000-0x00007FF76DFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1236-460-0x00007FF76DBB0000-0x00007FF76DFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1268-2547-0x00007FF662B00000-0x00007FF662EF2000-memory.dmp

Filesize
3.9MB

Download
memory/1268-170-0x00007FF662B00000-0x00007FF662EF2000-memory.dmp

Filesize
3.9MB

Download
memory/1368-470-0x00007FFAE99C0000-0x00007FFAEA481000-memory.dmp

Filesize
10.8MB

Download
memory/1368-66-0x00007FFAE99C0000-0x00007FFAEA481000-memory.dmp

Filesize
10.8MB

Download
memory/1368-3-0x00007FFAE99C3000-0x00007FFAE99C5000-memory.dmp

Filesize
8KB

Download
memory/1368-179-0x000002DC6B3B0000-0x000002DC6B3D2000-memory.dmp

Filesize
136KB

Download
memory/1368-2145-0x00007FFAE99C0000-0x00007FFAEA481000-memory.dmp

Filesize
10.8MB

Download
memory/1424-249-0x00007FF6723C0000-0x00007FF6727B2000-memory.dmp

Filesize
3.9MB

Download
memory/1424-2552-0x00007FF6723C0000-0x00007FF6727B2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-90-0x00007FF611DD0000-0x00007FF6121C2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-2562-0x00007FF611DD0000-0x00007FF6121C2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-463-0x00007FF6E7400000-0x00007FF6E77F2000-memory.dmp

Filesize
3.9MB

Download
memory/1972-2583-0x00007FF6E7400000-0x00007FF6E77F2000-memory.dmp

Filesize
3.9MB

Download
memory/2392-2589-0x00007FF719F30000-0x00007FF71A322000-memory.dmp

Filesize
3.9MB

Download
memory/2392-468-0x00007FF719F30000-0x00007FF71A322000-memory.dmp

Filesize
3.9MB

Download
memory/2940-469-0x00007FF645580000-0x00007FF645972000-memory.dmp

Filesize
3.9MB

Download
memory/2940-2582-0x00007FF645580000-0x00007FF645972000-memory.dmp

Filesize
3.9MB

Download
memory/3664-465-0x00007FF6457E0000-0x00007FF645BD2000-memory.dmp

Filesize
3.9MB

Download
memory/3664-2623-0x00007FF6457E0000-0x00007FF645BD2000-memory.dmp

Filesize
3.9MB

Download
memory/3984-2567-0x00007FF7B24D0000-0x00007FF7B28C2000-memory.dmp

Filesize
3.9MB

Download
memory/3984-462-0x00007FF7B24D0000-0x00007FF7B28C2000-memory.dmp

Filesize
3.9MB

Download
memory/4028-2566-0x00007FF7953D0000-0x00007FF7957C2000-memory.dmp

Filesize
3.9MB

Download
memory/4028-461-0x00007FF7953D0000-0x00007FF7957C2000-memory.dmp

Filesize
3.9MB

Download
memory/4136-458-0x00007FF6B41B0000-0x00007FF6B45A2000-memory.dmp

Filesize
3.9MB

Download
memory/4136-2558-0x00007FF6B41B0000-0x00007FF6B45A2000-memory.dmp

Filesize
3.9MB

Download
memory/4188-466-0x00007FF697580000-0x00007FF697972000-memory.dmp

Filesize
3.9MB

Download
memory/4188-2581-0x00007FF697580000-0x00007FF697972000-memory.dmp

Filesize
3.9MB

Download
memory/4376-117-0x00007FF747380000-0x00007FF747772000-memory.dmp

Filesize
3.9MB

Download
memory/4376-2545-0x00007FF747380000-0x00007FF747772000-memory.dmp

Filesize
3.9MB

Download
memory/4400-2616-0x00007FF611830000-0x00007FF611C22000-memory.dmp

Filesize
3.9MB

Download
memory/4400-467-0x00007FF611830000-0x00007FF611C22000-memory.dmp

Filesize
3.9MB

Download
memory/4480-2573-0x00007FF774B60000-0x00007FF774F52000-memory.dmp

Filesize
3.9MB

Download
memory/4480-456-0x00007FF774B60000-0x00007FF774F52000-memory.dmp

Filesize
3.9MB

Download
memory/4504-464-0x00007FF69FDD0000-0x00007FF6A01C2000-memory.dmp

Filesize
3.9MB

Download
memory/4504-2564-0x00007FF69FDD0000-0x00007FF6A01C2000-memory.dmp

Filesize
3.9MB

Download
memory/4592-2571-0x00007FF6B7FB0000-0x00007FF6B83A2000-memory.dmp

Filesize
3.9MB

Download
memory/4592-457-0x00007FF6B7FB0000-0x00007FF6B83A2000-memory.dmp

Filesize
3.9MB

Download
memory/4932-2559-0x00007FF768A90000-0x00007FF768E82000-memory.dmp

Filesize
3.9MB

Download
memory/4932-459-0x00007FF768A90000-0x00007FF768E82000-memory.dmp

Filesize
3.9MB

Download