xmrig | d34582dfc919680fcf8c1d1322634310a4e26aa60a6db30e6c2e585daf1e0867

Analysis

max time kernel
121s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 15:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
Size

1.3MB
MD5

0d6c5749fe5bf78bebcf714b57369390
SHA1

5ad67f825bb76118abd69618d466c2dbbec00dfe
SHA256

d34582dfc919680fcf8c1d1322634310a4e26aa60a6db30e6c2e585daf1e0867
SHA512

2f812abc061e637729bc28b36910f98db2d770687fb27e0ce08a4c057b4bb2ab25d2c63fce13016abf348f71f250217cfa57605344e0d8f9702a949c8c116758
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7SIslzdD:Lz071uv4BPMkyW10/w16BvZ+I8RD

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/1320-255-0x00007FF63E470000-0x00007FF63E862000-memory.dmp	xmrig
behavioral2/memory/4004-261-0x00007FF750D90000-0x00007FF751182000-memory.dmp	xmrig
behavioral2/memory/2104-338-0x00007FF6181E0000-0x00007FF6185D2000-memory.dmp	xmrig
behavioral2/memory/4104-341-0x00007FF796B90000-0x00007FF796F82000-memory.dmp	xmrig
behavioral2/memory/3492-415-0x00007FF637820000-0x00007FF637C12000-memory.dmp	xmrig
behavioral2/memory/1664-423-0x00007FF7580F0000-0x00007FF7584E2000-memory.dmp	xmrig
behavioral2/memory/880-436-0x00007FF71B070000-0x00007FF71B462000-memory.dmp	xmrig
behavioral2/memory/2012-445-0x00007FF706610000-0x00007FF706A02000-memory.dmp	xmrig
behavioral2/memory/2876-444-0x00007FF719130000-0x00007FF719522000-memory.dmp	xmrig
behavioral2/memory/5020-443-0x00007FF71B560000-0x00007FF71B952000-memory.dmp	xmrig
behavioral2/memory/3288-442-0x00007FF633110000-0x00007FF633502000-memory.dmp	xmrig
behavioral2/memory/2488-441-0x00007FF6EC7F0000-0x00007FF6ECBE2000-memory.dmp	xmrig
behavioral2/memory/2780-440-0x00007FF678710000-0x00007FF678B02000-memory.dmp	xmrig
behavioral2/memory/2412-439-0x00007FF6E7B60000-0x00007FF6E7F52000-memory.dmp	xmrig
behavioral2/memory/3152-438-0x00007FF755270000-0x00007FF755662000-memory.dmp	xmrig
behavioral2/memory/2812-437-0x00007FF766E40000-0x00007FF767232000-memory.dmp	xmrig
behavioral2/memory/392-431-0x00007FF68FAC0000-0x00007FF68FEB2000-memory.dmp	xmrig
behavioral2/memory/3228-421-0x00007FF7D2760000-0x00007FF7D2B52000-memory.dmp	xmrig
behavioral2/memory/1368-420-0x00007FF62FD70000-0x00007FF630162000-memory.dmp	xmrig
behavioral2/memory/3484-340-0x00007FF70C960000-0x00007FF70CD52000-memory.dmp	xmrig
behavioral2/memory/1836-330-0x00007FF75FF90000-0x00007FF760382000-memory.dmp	xmrig
behavioral2/memory/5020-3813-0x00007FF71B560000-0x00007FF71B952000-memory.dmp	xmrig
behavioral2/memory/3224-3815-0x00007FF633570000-0x00007FF633962000-memory.dmp	xmrig
behavioral2/memory/1016-3817-0x00007FF7682B0000-0x00007FF7686A2000-memory.dmp	xmrig
behavioral2/memory/3088-3819-0x00007FF63A310000-0x00007FF63A702000-memory.dmp	xmrig
behavioral2/memory/4004-3823-0x00007FF750D90000-0x00007FF751182000-memory.dmp	xmrig
behavioral2/memory/2104-3825-0x00007FF6181E0000-0x00007FF6185D2000-memory.dmp	xmrig
behavioral2/memory/2012-3822-0x00007FF706610000-0x00007FF706A02000-memory.dmp	xmrig
behavioral2/memory/2488-3928-0x00007FF6EC7F0000-0x00007FF6ECBE2000-memory.dmp	xmrig
behavioral2/memory/3152-3947-0x00007FF755270000-0x00007FF755662000-memory.dmp	xmrig
behavioral2/memory/392-3932-0x00007FF68FAC0000-0x00007FF68FEB2000-memory.dmp	xmrig
behavioral2/memory/3288-3893-0x00007FF633110000-0x00007FF633502000-memory.dmp	xmrig
behavioral2/memory/2780-3926-0x00007FF678710000-0x00007FF678B02000-memory.dmp	xmrig
behavioral2/memory/2412-3919-0x00007FF6E7B60000-0x00007FF6E7F52000-memory.dmp	xmrig
behavioral2/memory/3492-3870-0x00007FF637820000-0x00007FF637C12000-memory.dmp	xmrig
behavioral2/memory/1664-3866-0x00007FF7580F0000-0x00007FF7584E2000-memory.dmp	xmrig
behavioral2/memory/880-3864-0x00007FF71B070000-0x00007FF71B462000-memory.dmp	xmrig
behavioral2/memory/1368-3859-0x00007FF62FD70000-0x00007FF630162000-memory.dmp	xmrig
behavioral2/memory/2812-3858-0x00007FF766E40000-0x00007FF767232000-memory.dmp	xmrig
behavioral2/memory/3228-3853-0x00007FF7D2760000-0x00007FF7D2B52000-memory.dmp	xmrig
behavioral2/memory/4104-3850-0x00007FF796B90000-0x00007FF796F82000-memory.dmp	xmrig
behavioral2/memory/1836-3868-0x00007FF75FF90000-0x00007FF760382000-memory.dmp	xmrig
behavioral2/memory/2876-3862-0x00007FF719130000-0x00007FF719522000-memory.dmp	xmrig
behavioral2/memory/1320-3856-0x00007FF63E470000-0x00007FF63E862000-memory.dmp	xmrig
behavioral2/memory/3484-3849-0x00007FF70C960000-0x00007FF70CD52000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4012	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3224	tXGCgKE.exe
1016	BIKMJkS.exe
3088	WceBYfR.exe
5020	WRoOMNd.exe
1320	ymuVxeU.exe
4004	neVdnMw.exe
2876	VJiUbUl.exe
2012	kIJmxLp.exe
1836	MZaPzrM.exe
2104	WkSlnEb.exe
3484	jNZoNKC.exe
4104	yDSoOdk.exe
3492	MPLkJvi.exe
1368	hOxvytw.exe
3228	IAJHUHK.exe
1664	UMQLTKg.exe
392	nrszXWq.exe
880	TbemplI.exe
2812	rOaWRxk.exe
3152	hksiJAo.exe
2412	aICdOUI.exe
2780	XkmyFwb.exe
2488	uDITNdX.exe
3288	subnRCi.exe
2368	FXYHIxB.exe
384	sizJyqh.exe
3512	kALawlS.exe
4404	xgIYkfZ.exe
536	ltFVyxx.exe
1612	brGeavp.exe
4932	BfzyffX.exe
5048	yczmnmT.exe
4444	CLypqqv.exe
3144	YPTBupQ.exe
1728	VYZSjlz.exe
464	iYkJurX.exe
1032	MUUuMzA.exe
2908	QLIllsM.exe
1788	aeRWQhM.exe
756	OQcDyQy.exe
2360	TVayqMV.exe
3556	nzTHEAB.exe
2224	edDufJk.exe
3404	tsGIGvb.exe
3964	woeJiax.exe
3260	qhlqLKI.exe
3572	nGnWNxG.exe
3056	SopfZwZ.exe
4596	YFWblXD.exe
4948	aZsGsrF.exe
548	IvaCfSR.exe
436	SjNwXQy.exe
556	fDUeAKS.exe
552	fQOCYGd.exe
2152	bSlmQnJ.exe
1408	EZjIufB.exe
4332	gJYMbMj.exe
5088	ARGzffH.exe
4356	FOkYLBU.exe
208	HvfbKpo.exe
4124	VxSmlGR.exe
2192	djMqOYE.exe
3880	wmGdIbO.exe
2400	dCzlpgq.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1420-0-0x00007FF656370000-0x00007FF656762000-memory.dmp	upx
behavioral2/files/0x000700000002341c-7.dat	upx
behavioral2/memory/3224-18-0x00007FF633570000-0x00007FF633962000-memory.dmp	upx
behavioral2/files/0x000700000002341b-10.dat	upx
behavioral2/files/0x000b00000002340e-6.dat	upx
behavioral2/files/0x000700000002341d-25.dat	upx
behavioral2/memory/3088-47-0x00007FF63A310000-0x00007FF63A702000-memory.dmp	upx
behavioral2/memory/1016-21-0x00007FF7682B0000-0x00007FF7686A2000-memory.dmp	upx
behavioral2/files/0x000700000002341f-34.dat	upx
behavioral2/files/0x000700000002341e-29.dat	upx
behavioral2/files/0x0007000000023429-72.dat	upx
behavioral2/files/0x0007000000023422-71.dat	upx
behavioral2/files/0x0007000000023428-68.dat	upx
behavioral2/files/0x0007000000023427-65.dat	upx
behavioral2/files/0x0007000000023426-64.dat	upx
behavioral2/files/0x000700000002342d-89.dat	upx
behavioral2/files/0x0007000000023420-63.dat	upx
behavioral2/files/0x0007000000023425-62.dat	upx
behavioral2/files/0x000700000002342b-82.dat	upx
behavioral2/files/0x0007000000023424-53.dat	upx
behavioral2/files/0x0007000000023423-77.dat	upx
behavioral2/files/0x0007000000023421-42.dat	upx
behavioral2/memory/1320-255-0x00007FF63E470000-0x00007FF63E862000-memory.dmp	upx
behavioral2/memory/4004-261-0x00007FF750D90000-0x00007FF751182000-memory.dmp	upx
behavioral2/memory/2104-338-0x00007FF6181E0000-0x00007FF6185D2000-memory.dmp	upx
behavioral2/memory/4104-341-0x00007FF796B90000-0x00007FF796F82000-memory.dmp	upx
behavioral2/memory/3492-415-0x00007FF637820000-0x00007FF637C12000-memory.dmp	upx
behavioral2/memory/1664-423-0x00007FF7580F0000-0x00007FF7584E2000-memory.dmp	upx
behavioral2/memory/880-436-0x00007FF71B070000-0x00007FF71B462000-memory.dmp	upx
behavioral2/memory/2012-445-0x00007FF706610000-0x00007FF706A02000-memory.dmp	upx
behavioral2/memory/2876-444-0x00007FF719130000-0x00007FF719522000-memory.dmp	upx
behavioral2/memory/5020-443-0x00007FF71B560000-0x00007FF71B952000-memory.dmp	upx
behavioral2/memory/3288-442-0x00007FF633110000-0x00007FF633502000-memory.dmp	upx
behavioral2/memory/2488-441-0x00007FF6EC7F0000-0x00007FF6ECBE2000-memory.dmp	upx
behavioral2/memory/2780-440-0x00007FF678710000-0x00007FF678B02000-memory.dmp	upx
behavioral2/memory/2412-439-0x00007FF6E7B60000-0x00007FF6E7F52000-memory.dmp	upx
behavioral2/memory/3152-438-0x00007FF755270000-0x00007FF755662000-memory.dmp	upx
behavioral2/memory/2812-437-0x00007FF766E40000-0x00007FF767232000-memory.dmp	upx
behavioral2/memory/392-431-0x00007FF68FAC0000-0x00007FF68FEB2000-memory.dmp	upx
behavioral2/memory/3228-421-0x00007FF7D2760000-0x00007FF7D2B52000-memory.dmp	upx
behavioral2/memory/1368-420-0x00007FF62FD70000-0x00007FF630162000-memory.dmp	upx
behavioral2/memory/3484-340-0x00007FF70C960000-0x00007FF70CD52000-memory.dmp	upx
behavioral2/memory/1836-330-0x00007FF75FF90000-0x00007FF760382000-memory.dmp	upx
behavioral2/files/0x0007000000023432-172.dat	upx
behavioral2/files/0x000700000002342f-166.dat	upx
behavioral2/files/0x000700000002342e-165.dat	upx
behavioral2/files/0x0007000000023437-161.dat	upx
behavioral2/files/0x0007000000023436-160.dat	upx
behavioral2/files/0x000700000002343b-152.dat	upx
behavioral2/files/0x000700000002343d-151.dat	upx
behavioral2/files/0x000700000002343c-150.dat	upx
behavioral2/files/0x000700000002343e-148.dat	upx
behavioral2/files/0x000700000002342c-144.dat	upx
behavioral2/files/0x000700000002343a-142.dat	upx
behavioral2/files/0x0007000000023431-140.dat	upx
behavioral2/files/0x0007000000023439-139.dat	upx
behavioral2/files/0x0007000000023438-135.dat	upx
behavioral2/files/0x0007000000023435-132.dat	upx
behavioral2/files/0x0007000000023434-111.dat	upx
behavioral2/files/0x0007000000023433-110.dat	upx
behavioral2/files/0x000700000002342a-103.dat	upx
behavioral2/files/0x0007000000023430-101.dat	upx
behavioral2/memory/5020-3813-0x00007FF71B560000-0x00007FF71B952000-memory.dmp	upx
behavioral2/memory/3224-3815-0x00007FF633570000-0x00007FF633962000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SIgbLbX.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\tUKpWLC.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\vzkvxjo.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\LpMPJtF.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\BcjcyPt.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\dOGSVEB.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\SZPbmDD.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\DKIRivR.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\tTYllqc.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\lpsHwfM.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\vIUoBGm.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\TDvXNrQ.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\iKJJZin.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\DQwLeKG.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\EnQmzih.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\koCZjmi.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\tkBmQVq.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\ShgruUK.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\sofECWK.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\DJsGYOz.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\izXjyCh.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\iohliNe.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\PYNWGIi.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\NJvmeiH.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\EiCfvDU.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\GggttbM.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\EGxlobo.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\iyTMyNT.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\vOTJYZE.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\IAJHUHK.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\vjICBmq.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\DghNieW.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\tAIjivq.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\TFVLscH.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\ayqJCbZ.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\YudCeWn.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\InxjxHx.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\GUSqkhQ.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\jQrFSdu.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\iEWWFMD.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\zucnwqo.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\pZVjPPk.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\YRsGNOg.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\CBHcOmv.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\deVOQTJ.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\xFNhdTG.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\TLHldFs.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\UxITaTG.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\ZXVoigP.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\rPikJTt.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\VMoMnXB.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\nVybupJ.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\LOXPhaq.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\LKgaMHi.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\puoogwY.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\kEOzhEp.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\DdSYNYW.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\BmfmkWN.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\zACYKAO.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\LCyJNXq.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\ZZCQwGg.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\tuaTepR.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\LGcDZxZ.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
File created	C:\Windows\System\UDTHtZx.exe	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe
4012	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeLockMemoryPrivilege	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 4012	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	84
PID 1420 wrote to memory of 4012	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	84
PID 1420 wrote to memory of 3224	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	85
PID 1420 wrote to memory of 3224	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	85
PID 1420 wrote to memory of 1016	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	86
PID 1420 wrote to memory of 1016	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	86
PID 1420 wrote to memory of 3088	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	87
PID 1420 wrote to memory of 3088	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	87
PID 1420 wrote to memory of 5020	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	88
PID 1420 wrote to memory of 5020	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	88
PID 1420 wrote to memory of 1320	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	89
PID 1420 wrote to memory of 1320	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	89
PID 1420 wrote to memory of 4004	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	90
PID 1420 wrote to memory of 4004	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	90
PID 1420 wrote to memory of 3484	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	91
PID 1420 wrote to memory of 3484	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	91
PID 1420 wrote to memory of 2876	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	92
PID 1420 wrote to memory of 2876	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	92
PID 1420 wrote to memory of 2012	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	93
PID 1420 wrote to memory of 2012	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	93
PID 1420 wrote to memory of 1664	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	94
PID 1420 wrote to memory of 1664	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	94
PID 1420 wrote to memory of 1836	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	95
PID 1420 wrote to memory of 1836	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	95
PID 1420 wrote to memory of 2104	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	96
PID 1420 wrote to memory of 2104	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	96
PID 1420 wrote to memory of 4104	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	97
PID 1420 wrote to memory of 4104	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	97
PID 1420 wrote to memory of 3492	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	98
PID 1420 wrote to memory of 3492	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	98
PID 1420 wrote to memory of 1368	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	99
PID 1420 wrote to memory of 1368	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	99
PID 1420 wrote to memory of 3228	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	100
PID 1420 wrote to memory of 3228	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	100
PID 1420 wrote to memory of 2488	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	101
PID 1420 wrote to memory of 2488	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	101
PID 1420 wrote to memory of 392	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	102
PID 1420 wrote to memory of 392	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	102
PID 1420 wrote to memory of 880	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	103
PID 1420 wrote to memory of 880	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	103
PID 1420 wrote to memory of 2812	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	104
PID 1420 wrote to memory of 2812	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	104
PID 1420 wrote to memory of 3152	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	105
PID 1420 wrote to memory of 3152	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	105
PID 1420 wrote to memory of 2412	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	106
PID 1420 wrote to memory of 2412	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	106
PID 1420 wrote to memory of 2780	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	107
PID 1420 wrote to memory of 2780	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	107
PID 1420 wrote to memory of 4932	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	108
PID 1420 wrote to memory of 4932	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	108
PID 1420 wrote to memory of 3288	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	109
PID 1420 wrote to memory of 3288	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	109
PID 1420 wrote to memory of 2368	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	110
PID 1420 wrote to memory of 2368	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	110
PID 1420 wrote to memory of 384	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	111
PID 1420 wrote to memory of 384	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	111
PID 1420 wrote to memory of 3512	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	112
PID 1420 wrote to memory of 3512	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	112
PID 1420 wrote to memory of 4404	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	113
PID 1420 wrote to memory of 4404	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	113
PID 1420 wrote to memory of 1032	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	114
PID 1420 wrote to memory of 1032	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	114
PID 1420 wrote to memory of 536	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	115
PID 1420 wrote to memory of 536	1420	0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0d6c5749fe5bf78bebcf714b57369390_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Windows\System\tXGCgKE.exe
  C:\Windows\System\tXGCgKE.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\BIKMJkS.exe
  C:\Windows\System\BIKMJkS.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\WceBYfR.exe
  C:\Windows\System\WceBYfR.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\WRoOMNd.exe
  C:\Windows\System\WRoOMNd.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\ymuVxeU.exe
  C:\Windows\System\ymuVxeU.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\neVdnMw.exe
  C:\Windows\System\neVdnMw.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\jNZoNKC.exe
  C:\Windows\System\jNZoNKC.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\VJiUbUl.exe
  C:\Windows\System\VJiUbUl.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\kIJmxLp.exe
  C:\Windows\System\kIJmxLp.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\UMQLTKg.exe
  C:\Windows\System\UMQLTKg.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\MZaPzrM.exe
  C:\Windows\System\MZaPzrM.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\WkSlnEb.exe
  C:\Windows\System\WkSlnEb.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\yDSoOdk.exe
  C:\Windows\System\yDSoOdk.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\MPLkJvi.exe
  C:\Windows\System\MPLkJvi.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\hOxvytw.exe
  C:\Windows\System\hOxvytw.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\IAJHUHK.exe
  C:\Windows\System\IAJHUHK.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\uDITNdX.exe
  C:\Windows\System\uDITNdX.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\nrszXWq.exe
  C:\Windows\System\nrszXWq.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\TbemplI.exe
  C:\Windows\System\TbemplI.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\rOaWRxk.exe
  C:\Windows\System\rOaWRxk.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\hksiJAo.exe
  C:\Windows\System\hksiJAo.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\aICdOUI.exe
  C:\Windows\System\aICdOUI.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\XkmyFwb.exe
  C:\Windows\System\XkmyFwb.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\BfzyffX.exe
  C:\Windows\System\BfzyffX.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\subnRCi.exe
  C:\Windows\System\subnRCi.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\FXYHIxB.exe
  C:\Windows\System\FXYHIxB.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\sizJyqh.exe
  C:\Windows\System\sizJyqh.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\kALawlS.exe
  C:\Windows\System\kALawlS.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\xgIYkfZ.exe
  C:\Windows\System\xgIYkfZ.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\MUUuMzA.exe
  C:\Windows\System\MUUuMzA.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\ltFVyxx.exe
  C:\Windows\System\ltFVyxx.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\brGeavp.exe
  C:\Windows\System\brGeavp.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\yczmnmT.exe
  C:\Windows\System\yczmnmT.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\CLypqqv.exe
  C:\Windows\System\CLypqqv.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\YPTBupQ.exe
  C:\Windows\System\YPTBupQ.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\VYZSjlz.exe
  C:\Windows\System\VYZSjlz.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\iYkJurX.exe
  C:\Windows\System\iYkJurX.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\QLIllsM.exe
  C:\Windows\System\QLIllsM.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\nGnWNxG.exe
  C:\Windows\System\nGnWNxG.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\aeRWQhM.exe
  C:\Windows\System\aeRWQhM.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\OQcDyQy.exe
  C:\Windows\System\OQcDyQy.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\TVayqMV.exe
  C:\Windows\System\TVayqMV.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\fDUeAKS.exe
  C:\Windows\System\fDUeAKS.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\fQOCYGd.exe
  C:\Windows\System\fQOCYGd.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\nzTHEAB.exe
  C:\Windows\System\nzTHEAB.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\edDufJk.exe
  C:\Windows\System\edDufJk.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\tsGIGvb.exe
  C:\Windows\System\tsGIGvb.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\woeJiax.exe
  C:\Windows\System\woeJiax.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\qhlqLKI.exe
  C:\Windows\System\qhlqLKI.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\SopfZwZ.exe
  C:\Windows\System\SopfZwZ.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\YFWblXD.exe
  C:\Windows\System\YFWblXD.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\aZsGsrF.exe
  C:\Windows\System\aZsGsrF.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\IvaCfSR.exe
  C:\Windows\System\IvaCfSR.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\SjNwXQy.exe
  C:\Windows\System\SjNwXQy.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\bSlmQnJ.exe
  C:\Windows\System\bSlmQnJ.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\EZjIufB.exe
  C:\Windows\System\EZjIufB.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\gJYMbMj.exe
  C:\Windows\System\gJYMbMj.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\ARGzffH.exe
  C:\Windows\System\ARGzffH.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\FOkYLBU.exe
  C:\Windows\System\FOkYLBU.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\HvfbKpo.exe
  C:\Windows\System\HvfbKpo.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\VxSmlGR.exe
  C:\Windows\System\VxSmlGR.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\djMqOYE.exe
  C:\Windows\System\djMqOYE.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\wmGdIbO.exe
  C:\Windows\System\wmGdIbO.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\dCzlpgq.exe
  C:\Windows\System\dCzlpgq.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\XmPaFIe.exe
  C:\Windows\System\XmPaFIe.exe
  2⤵
  PID:2356
- C:\Windows\System\VaulmgS.exe
  C:\Windows\System\VaulmgS.exe
  2⤵
  PID:1352
- C:\Windows\System\IyQBLeV.exe
  C:\Windows\System\IyQBLeV.exe
  2⤵
  PID:2576
- C:\Windows\System\cNXGfwV.exe
  C:\Windows\System\cNXGfwV.exe
  2⤵
  PID:4288
- C:\Windows\System\QLZPiCD.exe
  C:\Windows\System\QLZPiCD.exe
  2⤵
  PID:4952
- C:\Windows\System\ApIUKqg.exe
  C:\Windows\System\ApIUKqg.exe
  2⤵
  PID:3552
- C:\Windows\System\JsSmrJV.exe
  C:\Windows\System\JsSmrJV.exe
  2⤵
  PID:4892
- C:\Windows\System\zQaykvL.exe
  C:\Windows\System\zQaykvL.exe
  2⤵
  PID:5132
- C:\Windows\System\JLZJRon.exe
  C:\Windows\System\JLZJRon.exe
  2⤵
  PID:5152
- C:\Windows\System\LpRHOzd.exe
  C:\Windows\System\LpRHOzd.exe
  2⤵
  PID:5184
- C:\Windows\System\wfcEgwO.exe
  C:\Windows\System\wfcEgwO.exe
  2⤵
  PID:5200
- C:\Windows\System\Tioiqez.exe
  C:\Windows\System\Tioiqez.exe
  2⤵
  PID:5216
- C:\Windows\System\FmcujXU.exe
  C:\Windows\System\FmcujXU.exe
  2⤵
  PID:5232
- C:\Windows\System\ERZxdfq.exe
  C:\Windows\System\ERZxdfq.exe
  2⤵
  PID:5248
- C:\Windows\System\xDOieBQ.exe
  C:\Windows\System\xDOieBQ.exe
  2⤵
  PID:5264
- C:\Windows\System\ngTMZGP.exe
  C:\Windows\System\ngTMZGP.exe
  2⤵
  PID:5280
- C:\Windows\System\QAvnVTT.exe
  C:\Windows\System\QAvnVTT.exe
  2⤵
  PID:5296
- C:\Windows\System\JhRtZSh.exe
  C:\Windows\System\JhRtZSh.exe
  2⤵
  PID:5312
- C:\Windows\System\xzfWnGq.exe
  C:\Windows\System\xzfWnGq.exe
  2⤵
  PID:5328
- C:\Windows\System\vkmwaqX.exe
  C:\Windows\System\vkmwaqX.exe
  2⤵
  PID:5352
- C:\Windows\System\tXSASoC.exe
  C:\Windows\System\tXSASoC.exe
  2⤵
  PID:5372
- C:\Windows\System\kiUsISt.exe
  C:\Windows\System\kiUsISt.exe
  2⤵
  PID:5388
- C:\Windows\System\bXKSfMD.exe
  C:\Windows\System\bXKSfMD.exe
  2⤵
  PID:5404
- C:\Windows\System\KmfxVzJ.exe
  C:\Windows\System\KmfxVzJ.exe
  2⤵
  PID:5428
- C:\Windows\System\OxKQJfL.exe
  C:\Windows\System\OxKQJfL.exe
  2⤵
  PID:5448
- C:\Windows\System\Udztyfm.exe
  C:\Windows\System\Udztyfm.exe
  2⤵
  PID:5464
- C:\Windows\System\YxnwhQP.exe
  C:\Windows\System\YxnwhQP.exe
  2⤵
  PID:5484
- C:\Windows\System\zCxImIs.exe
  C:\Windows\System\zCxImIs.exe
  2⤵
  PID:5500
- C:\Windows\System\onKPrBo.exe
  C:\Windows\System\onKPrBo.exe
  2⤵
  PID:5524
- C:\Windows\System\xWlMwbq.exe
  C:\Windows\System\xWlMwbq.exe
  2⤵
  PID:5540
- C:\Windows\System\CJktkcP.exe
  C:\Windows\System\CJktkcP.exe
  2⤵
  PID:5780
- C:\Windows\System\AanXTCZ.exe
  C:\Windows\System\AanXTCZ.exe
  2⤵
  PID:5800
- C:\Windows\System\CvHlYBh.exe
  C:\Windows\System\CvHlYBh.exe
  2⤵
  PID:5824
- C:\Windows\System\Rraibpr.exe
  C:\Windows\System\Rraibpr.exe
  2⤵
  PID:5844
- C:\Windows\System\NXxhFua.exe
  C:\Windows\System\NXxhFua.exe
  2⤵
  PID:5876
- C:\Windows\System\ORHFeBn.exe
  C:\Windows\System\ORHFeBn.exe
  2⤵
  PID:5892
- C:\Windows\System\qchVFnZ.exe
  C:\Windows\System\qchVFnZ.exe
  2⤵
  PID:5908
- C:\Windows\System\EiCfvDU.exe
  C:\Windows\System\EiCfvDU.exe
  2⤵
  PID:5924
- C:\Windows\System\mXsUhTi.exe
  C:\Windows\System\mXsUhTi.exe
  2⤵
  PID:5948
- C:\Windows\System\oWhIyaP.exe
  C:\Windows\System\oWhIyaP.exe
  2⤵
  PID:5964
- C:\Windows\System\MdVnIAe.exe
  C:\Windows\System\MdVnIAe.exe
  2⤵
  PID:5988
- C:\Windows\System\zVoQnGd.exe
  C:\Windows\System\zVoQnGd.exe
  2⤵
  PID:6008
- C:\Windows\System\xVEFzTX.exe
  C:\Windows\System\xVEFzTX.exe
  2⤵
  PID:6028
- C:\Windows\System\lJdfkUj.exe
  C:\Windows\System\lJdfkUj.exe
  2⤵
  PID:6052
- C:\Windows\System\CoFJXkF.exe
  C:\Windows\System\CoFJXkF.exe
  2⤵
  PID:6068
- C:\Windows\System\TVVYeRt.exe
  C:\Windows\System\TVVYeRt.exe
  2⤵
  PID:6092
- C:\Windows\System\gGiFJUg.exe
  C:\Windows\System\gGiFJUg.exe
  2⤵
  PID:6108
- C:\Windows\System\hodEJuN.exe
  C:\Windows\System\hodEJuN.exe
  2⤵
  PID:6132
- C:\Windows\System\XbYBnZD.exe
  C:\Windows\System\XbYBnZD.exe
  2⤵
  PID:1040
- C:\Windows\System\MzCFHmd.exe
  C:\Windows\System\MzCFHmd.exe
  2⤵
  PID:4612
- C:\Windows\System\uaTODOK.exe
  C:\Windows\System\uaTODOK.exe
  2⤵
  PID:924
- C:\Windows\System\lCjnItY.exe
  C:\Windows\System\lCjnItY.exe
  2⤵
  PID:4316
- C:\Windows\System\hufTamS.exe
  C:\Windows\System\hufTamS.exe
  2⤵
  PID:4788
- C:\Windows\System\aBaiUwv.exe
  C:\Windows\System\aBaiUwv.exe
  2⤵
  PID:644
- C:\Windows\System\MTWOsyn.exe
  C:\Windows\System\MTWOsyn.exe
  2⤵
  PID:4036
- C:\Windows\System\ZBcXgFk.exe
  C:\Windows\System\ZBcXgFk.exe
  2⤵
  PID:4112
- C:\Windows\System\ziNBNJe.exe
  C:\Windows\System\ziNBNJe.exe
  2⤵
  PID:5672
- C:\Windows\System\UmqPjto.exe
  C:\Windows\System\UmqPjto.exe
  2⤵
  PID:5716
- C:\Windows\System\iUmpQLa.exe
  C:\Windows\System\iUmpQLa.exe
  2⤵
  PID:5748
- C:\Windows\System\uINGOrE.exe
  C:\Windows\System\uINGOrE.exe
  2⤵
  PID:2420
- C:\Windows\System\DSdhcqd.exe
  C:\Windows\System\DSdhcqd.exe
  2⤵
  PID:5812
- C:\Windows\System\DPOhUkD.exe
  C:\Windows\System\DPOhUkD.exe
  2⤵
  PID:5840
- C:\Windows\System\nfZbqsM.exe
  C:\Windows\System\nfZbqsM.exe
  2⤵
  PID:5884
- C:\Windows\System\jpDzcSV.exe
  C:\Windows\System\jpDzcSV.exe
  2⤵
  PID:5916
- C:\Windows\System\hRiDWJl.exe
  C:\Windows\System\hRiDWJl.exe
  2⤵
  PID:5944
- C:\Windows\System\XTGKgRL.exe
  C:\Windows\System\XTGKgRL.exe
  2⤵
  PID:5980
- C:\Windows\System\cXSCLRM.exe
  C:\Windows\System\cXSCLRM.exe
  2⤵
  PID:6004
- C:\Windows\System\LuZoyFl.exe
  C:\Windows\System\LuZoyFl.exe
  2⤵
  PID:6060
- C:\Windows\System\FmwesPl.exe
  C:\Windows\System\FmwesPl.exe
  2⤵
  PID:6116
- C:\Windows\System\aECBHzM.exe
  C:\Windows\System\aECBHzM.exe
  2⤵
  PID:1488
- C:\Windows\System\JbIRELj.exe
  C:\Windows\System\JbIRELj.exe
  2⤵
  PID:640
- C:\Windows\System\xRqsGPQ.exe
  C:\Windows\System\xRqsGPQ.exe
  2⤵
  PID:1864
- C:\Windows\System\vyvppna.exe
  C:\Windows\System\vyvppna.exe
  2⤵
  PID:4856
- C:\Windows\System\VJFnGEg.exe
  C:\Windows\System\VJFnGEg.exe
  2⤵
  PID:5128
- C:\Windows\System\zkuNxFC.exe
  C:\Windows\System\zkuNxFC.exe
  2⤵
  PID:5224
- C:\Windows\System\OsbEPPz.exe
  C:\Windows\System\OsbEPPz.exe
  2⤵
  PID:5272
- C:\Windows\System\cBZoaZF.exe
  C:\Windows\System\cBZoaZF.exe
  2⤵
  PID:6152
- C:\Windows\System\pkNgdey.exe
  C:\Windows\System\pkNgdey.exe
  2⤵
  PID:6168
- C:\Windows\System\vUZKUIN.exe
  C:\Windows\System\vUZKUIN.exe
  2⤵
  PID:6184
- C:\Windows\System\ZzxVHWi.exe
  C:\Windows\System\ZzxVHWi.exe
  2⤵
  PID:6200
- C:\Windows\System\bTlhBni.exe
  C:\Windows\System\bTlhBni.exe
  2⤵
  PID:6216
- C:\Windows\System\jCePsLm.exe
  C:\Windows\System\jCePsLm.exe
  2⤵
  PID:6232
- C:\Windows\System\jehZqor.exe
  C:\Windows\System\jehZqor.exe
  2⤵
  PID:6248
- C:\Windows\System\YhoYdoX.exe
  C:\Windows\System\YhoYdoX.exe
  2⤵
  PID:6264
- C:\Windows\System\wppuMQK.exe
  C:\Windows\System\wppuMQK.exe
  2⤵
  PID:6280
- C:\Windows\System\yokhcyz.exe
  C:\Windows\System\yokhcyz.exe
  2⤵
  PID:6296
- C:\Windows\System\gqQvYXk.exe
  C:\Windows\System\gqQvYXk.exe
  2⤵
  PID:6312
- C:\Windows\System\aiAEMLV.exe
  C:\Windows\System\aiAEMLV.exe
  2⤵
  PID:6328
- C:\Windows\System\GgIptbX.exe
  C:\Windows\System\GgIptbX.exe
  2⤵
  PID:6344
- C:\Windows\System\uxdnAGO.exe
  C:\Windows\System\uxdnAGO.exe
  2⤵
  PID:6380
- C:\Windows\System\TDvXNrQ.exe
  C:\Windows\System\TDvXNrQ.exe
  2⤵
  PID:6400
- C:\Windows\System\iBsHMGa.exe
  C:\Windows\System\iBsHMGa.exe
  2⤵
  PID:6416
- C:\Windows\System\ZtVyrjl.exe
  C:\Windows\System\ZtVyrjl.exe
  2⤵
  PID:6436
- C:\Windows\System\nFggECI.exe
  C:\Windows\System\nFggECI.exe
  2⤵
  PID:6456
- C:\Windows\System\oaiSmKx.exe
  C:\Windows\System\oaiSmKx.exe
  2⤵
  PID:6472
- C:\Windows\System\ooVjFRn.exe
  C:\Windows\System\ooVjFRn.exe
  2⤵
  PID:6492
- C:\Windows\System\PSdJtXo.exe
  C:\Windows\System\PSdJtXo.exe
  2⤵
  PID:6512
- C:\Windows\System\riqGNAu.exe
  C:\Windows\System\riqGNAu.exe
  2⤵
  PID:6704
- C:\Windows\System\VNDmprq.exe
  C:\Windows\System\VNDmprq.exe
  2⤵
  PID:6728
- C:\Windows\System\LqQSwsb.exe
  C:\Windows\System\LqQSwsb.exe
  2⤵
  PID:6748
- C:\Windows\System\EiKxRhS.exe
  C:\Windows\System\EiKxRhS.exe
  2⤵
  PID:6772
- C:\Windows\System\EhvrYqJ.exe
  C:\Windows\System\EhvrYqJ.exe
  2⤵
  PID:6792
- C:\Windows\System\KMsBUdn.exe
  C:\Windows\System\KMsBUdn.exe
  2⤵
  PID:6808
- C:\Windows\System\tZVeEoV.exe
  C:\Windows\System\tZVeEoV.exe
  2⤵
  PID:6832
- C:\Windows\System\XfIgJvn.exe
  C:\Windows\System\XfIgJvn.exe
  2⤵
  PID:6856
- C:\Windows\System\uUvKWrT.exe
  C:\Windows\System\uUvKWrT.exe
  2⤵
  PID:6876
- C:\Windows\System\aBAovBy.exe
  C:\Windows\System\aBAovBy.exe
  2⤵
  PID:6896
- C:\Windows\System\oRuOnpJ.exe
  C:\Windows\System\oRuOnpJ.exe
  2⤵
  PID:6916
- C:\Windows\System\MwaLahk.exe
  C:\Windows\System\MwaLahk.exe
  2⤵
  PID:6936
- C:\Windows\System\gqywzrP.exe
  C:\Windows\System\gqywzrP.exe
  2⤵
  PID:6956
- C:\Windows\System\cIYlfgl.exe
  C:\Windows\System\cIYlfgl.exe
  2⤵
  PID:6972
- C:\Windows\System\ULhuhLP.exe
  C:\Windows\System\ULhuhLP.exe
  2⤵
  PID:6996
- C:\Windows\System\YudCeWn.exe
  C:\Windows\System\YudCeWn.exe
  2⤵
  PID:7012
- C:\Windows\System\xVMCPJH.exe
  C:\Windows\System\xVMCPJH.exe
  2⤵
  PID:7036
- C:\Windows\System\rOYpPOs.exe
  C:\Windows\System\rOYpPOs.exe
  2⤵
  PID:7056
- C:\Windows\System\cxMGLVH.exe
  C:\Windows\System\cxMGLVH.exe
  2⤵
  PID:7076
- C:\Windows\System\FfgjvSd.exe
  C:\Windows\System\FfgjvSd.exe
  2⤵
  PID:7100
- C:\Windows\System\TIhCYed.exe
  C:\Windows\System\TIhCYed.exe
  2⤵
  PID:7116
- C:\Windows\System\FdJgPEK.exe
  C:\Windows\System\FdJgPEK.exe
  2⤵
  PID:7132
- C:\Windows\System\lTJZwjN.exe
  C:\Windows\System\lTJZwjN.exe
  2⤵
  PID:7156
- C:\Windows\System\nIEUSEc.exe
  C:\Windows\System\nIEUSEc.exe
  2⤵
  PID:5660
- C:\Windows\System\UCTaogG.exe
  C:\Windows\System\UCTaogG.exe
  2⤵
  PID:7176
- C:\Windows\System\bNoyvmB.exe
  C:\Windows\System\bNoyvmB.exe
  2⤵
  PID:7192
- C:\Windows\System\CdRGIQI.exe
  C:\Windows\System\CdRGIQI.exe
  2⤵
  PID:7208
- C:\Windows\System\oRrsFaj.exe
  C:\Windows\System\oRrsFaj.exe
  2⤵
  PID:7224
- C:\Windows\System\GYmupDH.exe
  C:\Windows\System\GYmupDH.exe
  2⤵
  PID:7248
- C:\Windows\System\AkRjTXu.exe
  C:\Windows\System\AkRjTXu.exe
  2⤵
  PID:7264
- C:\Windows\System\pqampmi.exe
  C:\Windows\System\pqampmi.exe
  2⤵
  PID:7292
- C:\Windows\System\NhLuhEP.exe
  C:\Windows\System\NhLuhEP.exe
  2⤵
  PID:7308
- C:\Windows\System\RjTGKyT.exe
  C:\Windows\System\RjTGKyT.exe
  2⤵
  PID:7332
- C:\Windows\System\QesRENh.exe
  C:\Windows\System\QesRENh.exe
  2⤵
  PID:7352
- C:\Windows\System\LvQDwJG.exe
  C:\Windows\System\LvQDwJG.exe
  2⤵
  PID:7372
- C:\Windows\System\RQnsnRB.exe
  C:\Windows\System\RQnsnRB.exe
  2⤵
  PID:7388
- C:\Windows\System\pwqDQHR.exe
  C:\Windows\System\pwqDQHR.exe
  2⤵
  PID:7412
- C:\Windows\System\uHcDxQG.exe
  C:\Windows\System\uHcDxQG.exe
  2⤵
  PID:7432
- C:\Windows\System\NJaulXa.exe
  C:\Windows\System\NJaulXa.exe
  2⤵
  PID:7452
- C:\Windows\System\XmTDoxI.exe
  C:\Windows\System\XmTDoxI.exe
  2⤵
  PID:7472
- C:\Windows\System\STqmDrN.exe
  C:\Windows\System\STqmDrN.exe
  2⤵
  PID:7488
- C:\Windows\System\FIQyQPM.exe
  C:\Windows\System\FIQyQPM.exe
  2⤵
  PID:7512
- C:\Windows\System\dctPkLD.exe
  C:\Windows\System\dctPkLD.exe
  2⤵
  PID:7528
- C:\Windows\System\qineuYt.exe
  C:\Windows\System\qineuYt.exe
  2⤵
  PID:7560
- C:\Windows\System\DHyoIji.exe
  C:\Windows\System\DHyoIji.exe
  2⤵
  PID:7580
- C:\Windows\System\SjvdKpC.exe
  C:\Windows\System\SjvdKpC.exe
  2⤵
  PID:7680
- C:\Windows\System\CNitSnY.exe
  C:\Windows\System\CNitSnY.exe
  2⤵
  PID:7704
- C:\Windows\System\qJwoLiN.exe
  C:\Windows\System\qJwoLiN.exe
  2⤵
  PID:7732
- C:\Windows\System\oVUEUVB.exe
  C:\Windows\System\oVUEUVB.exe
  2⤵
  PID:7748
- C:\Windows\System\rbuIeqh.exe
  C:\Windows\System\rbuIeqh.exe
  2⤵
  PID:7772
- C:\Windows\System\WoMOcOG.exe
  C:\Windows\System\WoMOcOG.exe
  2⤵
  PID:7792
- C:\Windows\System\Gxswndo.exe
  C:\Windows\System\Gxswndo.exe
  2⤵
  PID:7812
- C:\Windows\System\ZnykPSo.exe
  C:\Windows\System\ZnykPSo.exe
  2⤵
  PID:7832
- C:\Windows\System\SfUtFEd.exe
  C:\Windows\System\SfUtFEd.exe
  2⤵
  PID:7856
- C:\Windows\System\RyRncTX.exe
  C:\Windows\System\RyRncTX.exe
  2⤵
  PID:7872
- C:\Windows\System\rRMcYCk.exe
  C:\Windows\System\rRMcYCk.exe
  2⤵
  PID:7896
- C:\Windows\System\bEIobJE.exe
  C:\Windows\System\bEIobJE.exe
  2⤵
  PID:7916
- C:\Windows\System\xrzWqia.exe
  C:\Windows\System\xrzWqia.exe
  2⤵
  PID:7940
- C:\Windows\System\zwZZYjI.exe
  C:\Windows\System\zwZZYjI.exe
  2⤵
  PID:7956
- C:\Windows\System\aasQYjN.exe
  C:\Windows\System\aasQYjN.exe
  2⤵
  PID:7984
- C:\Windows\System\PYNWGIi.exe
  C:\Windows\System\PYNWGIi.exe
  2⤵
  PID:8000
- C:\Windows\System\vsikyXz.exe
  C:\Windows\System\vsikyXz.exe
  2⤵
  PID:8020
- C:\Windows\System\rRHbMdn.exe
  C:\Windows\System\rRHbMdn.exe
  2⤵
  PID:8040
- C:\Windows\System\ROiPEMa.exe
  C:\Windows\System\ROiPEMa.exe
  2⤵
  PID:8056
- C:\Windows\System\lznGknO.exe
  C:\Windows\System\lznGknO.exe
  2⤵
  PID:8084
- C:\Windows\System\AGdRLKM.exe
  C:\Windows\System\AGdRLKM.exe
  2⤵
  PID:8100
- C:\Windows\System\efWYGRk.exe
  C:\Windows\System\efWYGRk.exe
  2⤵
  PID:8120
- C:\Windows\System\mrbFPbt.exe
  C:\Windows\System\mrbFPbt.exe
  2⤵
  PID:8136
- C:\Windows\System\GtCMJLd.exe
  C:\Windows\System\GtCMJLd.exe
  2⤵
  PID:8156
- C:\Windows\System\gjNPnVY.exe
  C:\Windows\System\gjNPnVY.exe
  2⤵
  PID:8176
- C:\Windows\System\peNbADQ.exe
  C:\Windows\System\peNbADQ.exe
  2⤵
  PID:6224
- C:\Windows\System\LNhvZor.exe
  C:\Windows\System\LNhvZor.exe
  2⤵
  PID:3160
- C:\Windows\System\NCuPRCL.exe
  C:\Windows\System\NCuPRCL.exe
  2⤵
  PID:5932
- C:\Windows\System\OsEiwkj.exe
  C:\Windows\System\OsEiwkj.exe
  2⤵
  PID:5996
- C:\Windows\System\IPhzFgP.exe
  C:\Windows\System\IPhzFgP.exe
  2⤵
  PID:6076
- C:\Windows\System\aycMayl.exe
  C:\Windows\System\aycMayl.exe
  2⤵
  PID:3600
- C:\Windows\System\PshBzLJ.exe
  C:\Windows\System\PshBzLJ.exe
  2⤵
  PID:1364
- C:\Windows\System\BuFWNmu.exe
  C:\Windows\System\BuFWNmu.exe
  2⤵
  PID:5192
- C:\Windows\System\nEZMbEc.exe
  C:\Windows\System\nEZMbEc.exe
  2⤵
  PID:5256
- C:\Windows\System\KpfYwTe.exe
  C:\Windows\System\KpfYwTe.exe
  2⤵
  PID:6164
- C:\Windows\System\umBfzpf.exe
  C:\Windows\System\umBfzpf.exe
  2⤵
  PID:7004
- C:\Windows\System\rIhwYOn.exe
  C:\Windows\System\rIhwYOn.exe
  2⤵
  PID:7140
- C:\Windows\System\xfrWFvn.exe
  C:\Windows\System\xfrWFvn.exe
  2⤵
  PID:7184
- C:\Windows\System\NHRORnu.exe
  C:\Windows\System\NHRORnu.exe
  2⤵
  PID:7408
- C:\Windows\System\hTbnfqG.exe
  C:\Windows\System\hTbnfqG.exe
  2⤵
  PID:7484
- C:\Windows\System\kbKbRYR.exe
  C:\Windows\System\kbKbRYR.exe
  2⤵
  PID:7524
- C:\Windows\System\YQuAJyM.exe
  C:\Windows\System\YQuAJyM.exe
  2⤵
  PID:6212
- C:\Windows\System\JWUMuKP.exe
  C:\Windows\System\JWUMuKP.exe
  2⤵
  PID:6244
- C:\Windows\System\ikkBqov.exe
  C:\Windows\System\ikkBqov.exe
  2⤵
  PID:6276
- C:\Windows\System\zUSaKWL.exe
  C:\Windows\System\zUSaKWL.exe
  2⤵
  PID:6320
- C:\Windows\System\gaIIqQU.exe
  C:\Windows\System\gaIIqQU.exe
  2⤵
  PID:6352
- C:\Windows\System\UTGCGcr.exe
  C:\Windows\System\UTGCGcr.exe
  2⤵
  PID:6424
- C:\Windows\System\uCkQxEP.exe
  C:\Windows\System\uCkQxEP.exe
  2⤵
  PID:6464
- C:\Windows\System\xyMprSU.exe
  C:\Windows\System\xyMprSU.exe
  2⤵
  PID:6488
- C:\Windows\System\VqukrWV.exe
  C:\Windows\System\VqukrWV.exe
  2⤵
  PID:6592
- C:\Windows\System\JZeTISd.exe
  C:\Windows\System\JZeTISd.exe
  2⤵
  PID:6928
- C:\Windows\System\mZbeGcZ.exe
  C:\Windows\System\mZbeGcZ.exe
  2⤵
  PID:7364
- C:\Windows\System\rsCRGdo.exe
  C:\Windows\System\rsCRGdo.exe
  2⤵
  PID:6628
- C:\Windows\System\IRiUZjy.exe
  C:\Windows\System\IRiUZjy.exe
  2⤵
  PID:6660
- C:\Windows\System\wgihjjr.exe
  C:\Windows\System\wgihjjr.exe
  2⤵
  PID:6716
- C:\Windows\System\GdsXLlq.exe
  C:\Windows\System\GdsXLlq.exe
  2⤵
  PID:6784
- C:\Windows\System\YYTKZvJ.exe
  C:\Windows\System\YYTKZvJ.exe
  2⤵
  PID:6816
- C:\Windows\System\VXuDZcL.exe
  C:\Windows\System\VXuDZcL.exe
  2⤵
  PID:6852
- C:\Windows\System\szKrmOr.exe
  C:\Windows\System\szKrmOr.exe
  2⤵
  PID:6932
- C:\Windows\System\bMfJhVM.exe
  C:\Windows\System\bMfJhVM.exe
  2⤵
  PID:6988
- C:\Windows\System\LuuikyA.exe
  C:\Windows\System\LuuikyA.exe
  2⤵
  PID:7048
- C:\Windows\System\efxZnqz.exe
  C:\Windows\System\efxZnqz.exe
  2⤵
  PID:7200
- C:\Windows\System\jFNnHUz.exe
  C:\Windows\System\jFNnHUz.exe
  2⤵
  PID:7232
- C:\Windows\System\SvSmhHa.exe
  C:\Windows\System\SvSmhHa.exe
  2⤵
  PID:7280
- C:\Windows\System\quuMDts.exe
  C:\Windows\System\quuMDts.exe
  2⤵
  PID:7320
- C:\Windows\System\TOYZCYr.exe
  C:\Windows\System\TOYZCYr.exe
  2⤵
  PID:7384
- C:\Windows\System\TtOBRgB.exe
  C:\Windows\System\TtOBRgB.exe
  2⤵
  PID:7428
- C:\Windows\System\cjhBxfe.exe
  C:\Windows\System\cjhBxfe.exe
  2⤵
  PID:7548
- C:\Windows\System\zbjWMgC.exe
  C:\Windows\System\zbjWMgC.exe
  2⤵
  PID:7636
- C:\Windows\System\KbGFuqV.exe
  C:\Windows\System\KbGFuqV.exe
  2⤵
  PID:8208
- C:\Windows\System\LsDpvGk.exe
  C:\Windows\System\LsDpvGk.exe
  2⤵
  PID:8232
- C:\Windows\System\GjPoOgy.exe
  C:\Windows\System\GjPoOgy.exe
  2⤵
  PID:8252
- C:\Windows\System\RzGmQMq.exe
  C:\Windows\System\RzGmQMq.exe
  2⤵
  PID:8268
- C:\Windows\System\sImhOMn.exe
  C:\Windows\System\sImhOMn.exe
  2⤵
  PID:8292
- C:\Windows\System\dBSVtjJ.exe
  C:\Windows\System\dBSVtjJ.exe
  2⤵
  PID:8308
- C:\Windows\System\vOTJYZE.exe
  C:\Windows\System\vOTJYZE.exe
  2⤵
  PID:8332
- C:\Windows\System\PabEEmD.exe
  C:\Windows\System\PabEEmD.exe
  2⤵
  PID:8348
- C:\Windows\System\JUpzbee.exe
  C:\Windows\System\JUpzbee.exe
  2⤵
  PID:8372
- C:\Windows\System\GBqKvGm.exe
  C:\Windows\System\GBqKvGm.exe
  2⤵
  PID:8392
- C:\Windows\System\LAQdANI.exe
  C:\Windows\System\LAQdANI.exe
  2⤵
  PID:8412
- C:\Windows\System\DKIRivR.exe
  C:\Windows\System\DKIRivR.exe
  2⤵
  PID:8436
- C:\Windows\System\VMdjdlt.exe
  C:\Windows\System\VMdjdlt.exe
  2⤵
  PID:8452
- C:\Windows\System\FjcOWvF.exe
  C:\Windows\System\FjcOWvF.exe
  2⤵
  PID:8476
- C:\Windows\System\KSguUEJ.exe
  C:\Windows\System\KSguUEJ.exe
  2⤵
  PID:8500
- C:\Windows\System\XVXsdAE.exe
  C:\Windows\System\XVXsdAE.exe
  2⤵
  PID:8516
- C:\Windows\System\OSXTKUg.exe
  C:\Windows\System\OSXTKUg.exe
  2⤵
  PID:8544
- C:\Windows\System\LzcImVW.exe
  C:\Windows\System\LzcImVW.exe
  2⤵
  PID:8564
- C:\Windows\System\ROjSMCO.exe
  C:\Windows\System\ROjSMCO.exe
  2⤵
  PID:8584
- C:\Windows\System\uydbwDh.exe
  C:\Windows\System\uydbwDh.exe
  2⤵
  PID:8604
- C:\Windows\System\hppIEKu.exe
  C:\Windows\System\hppIEKu.exe
  2⤵
  PID:8628
- C:\Windows\System\kERLVAg.exe
  C:\Windows\System\kERLVAg.exe
  2⤵
  PID:8648
- C:\Windows\System\PShouZV.exe
  C:\Windows\System\PShouZV.exe
  2⤵
  PID:8664
- C:\Windows\System\FpUMfnq.exe
  C:\Windows\System\FpUMfnq.exe
  2⤵
  PID:8688
- C:\Windows\System\xRWZKZB.exe
  C:\Windows\System\xRWZKZB.exe
  2⤵
  PID:8708
- C:\Windows\System\uzetQcD.exe
  C:\Windows\System\uzetQcD.exe
  2⤵
  PID:8728
- C:\Windows\System\uKuLLGb.exe
  C:\Windows\System\uKuLLGb.exe
  2⤵
  PID:8756
- C:\Windows\System\bmnIVzD.exe
  C:\Windows\System\bmnIVzD.exe
  2⤵
  PID:8772
- C:\Windows\System\lwFuKRG.exe
  C:\Windows\System\lwFuKRG.exe
  2⤵
  PID:8792
- C:\Windows\System\ypscBuW.exe
  C:\Windows\System\ypscBuW.exe
  2⤵
  PID:8816
- C:\Windows\System\hNvINNC.exe
  C:\Windows\System\hNvINNC.exe
  2⤵
  PID:8840
- C:\Windows\System\WRPqiHl.exe
  C:\Windows\System\WRPqiHl.exe
  2⤵
  PID:8876
- C:\Windows\System\zHsluZq.exe
  C:\Windows\System\zHsluZq.exe
  2⤵
  PID:8900
- C:\Windows\System\kFChwBu.exe
  C:\Windows\System\kFChwBu.exe
  2⤵
  PID:8916
- C:\Windows\System\wfeSteE.exe
  C:\Windows\System\wfeSteE.exe
  2⤵
  PID:8944
- C:\Windows\System\AOpgqAI.exe
  C:\Windows\System\AOpgqAI.exe
  2⤵
  PID:8960
- C:\Windows\System\ajjhHVl.exe
  C:\Windows\System\ajjhHVl.exe
  2⤵
  PID:8988
- C:\Windows\System\HOPBhaW.exe
  C:\Windows\System\HOPBhaW.exe
  2⤵
  PID:9004
- C:\Windows\System\YBtYNgO.exe
  C:\Windows\System\YBtYNgO.exe
  2⤵
  PID:9028
- C:\Windows\System\dLYeXiG.exe
  C:\Windows\System\dLYeXiG.exe
  2⤵
  PID:9048
- C:\Windows\System\uVpjPvp.exe
  C:\Windows\System\uVpjPvp.exe
  2⤵
  PID:9068
- C:\Windows\System\jIBctCu.exe
  C:\Windows\System\jIBctCu.exe
  2⤵
  PID:9088
- C:\Windows\System\rYZAEsT.exe
  C:\Windows\System\rYZAEsT.exe
  2⤵
  PID:9108
- C:\Windows\System\UESQjWz.exe
  C:\Windows\System\UESQjWz.exe
  2⤵
  PID:9132
- C:\Windows\System\tUKpWLC.exe
  C:\Windows\System\tUKpWLC.exe
  2⤵
  PID:9160
- C:\Windows\System\DmglKfU.exe
  C:\Windows\System\DmglKfU.exe
  2⤵
  PID:9180
- C:\Windows\System\nmsmbKV.exe
  C:\Windows\System\nmsmbKV.exe
  2⤵
  PID:9196
- C:\Windows\System\lNBsBSO.exe
  C:\Windows\System\lNBsBSO.exe
  2⤵
  PID:7676
- C:\Windows\System\SExaZYW.exe
  C:\Windows\System\SExaZYW.exe
  2⤵
  PID:7756
- C:\Windows\System\XIJakOT.exe
  C:\Windows\System\XIJakOT.exe
  2⤵
  PID:7868
- C:\Windows\System\XeUhSyr.exe
  C:\Windows\System\XeUhSyr.exe
  2⤵
  PID:7936
- C:\Windows\System\fBruEFs.exe
  C:\Windows\System\fBruEFs.exe
  2⤵
  PID:8008
- C:\Windows\System\gAukKOZ.exe
  C:\Windows\System\gAukKOZ.exe
  2⤵
  PID:8116
- C:\Windows\System\BoGQrFK.exe
  C:\Windows\System\BoGQrFK.exe
  2⤵
  PID:7720
- C:\Windows\System\Sgbohty.exe
  C:\Windows\System\Sgbohty.exe
  2⤵
  PID:7972
- C:\Windows\System\vjICBmq.exe
  C:\Windows\System\vjICBmq.exe
  2⤵
  PID:7864
- C:\Windows\System\PEccqzz.exe
  C:\Windows\System\PEccqzz.exe
  2⤵
  PID:7780
- C:\Windows\System\TvLEFgH.exe
  C:\Windows\System\TvLEFgH.exe
  2⤵
  PID:6336
- C:\Windows\System\zYwxaFS.exe
  C:\Windows\System\zYwxaFS.exe
  2⤵
  PID:6340
- C:\Windows\System\vVMqbDV.exe
  C:\Windows\System\vVMqbDV.exe
  2⤵
  PID:5764
- C:\Windows\System\yNqMDCF.exe
  C:\Windows\System\yNqMDCF.exe
  2⤵
  PID:6448
- C:\Windows\System\SxygRQM.exe
  C:\Windows\System\SxygRQM.exe
  2⤵
  PID:6024
- C:\Windows\System\GgvxHRO.exe
  C:\Windows\System\GgvxHRO.exe
  2⤵
  PID:6884
- C:\Windows\System\uhJEODF.exe
  C:\Windows\System\uhJEODF.exe
  2⤵
  PID:868
- C:\Windows\System\iPuyHkJ.exe
  C:\Windows\System\iPuyHkJ.exe
  2⤵
  PID:4708
- C:\Windows\System\TiiKRMv.exe
  C:\Windows\System\TiiKRMv.exe
  2⤵
  PID:9224
- C:\Windows\System\YfxSvkg.exe
  C:\Windows\System\YfxSvkg.exe
  2⤵
  PID:9248
- C:\Windows\System\OZuEHPj.exe
  C:\Windows\System\OZuEHPj.exe
  2⤵
  PID:9272
- C:\Windows\System\VtEmUiZ.exe
  C:\Windows\System\VtEmUiZ.exe
  2⤵
  PID:9296
- C:\Windows\System\AfuQmXK.exe
  C:\Windows\System\AfuQmXK.exe
  2⤵
  PID:9320
- C:\Windows\System\Caeqqli.exe
  C:\Windows\System\Caeqqli.exe
  2⤵
  PID:9336
- C:\Windows\System\bPbNrSe.exe
  C:\Windows\System\bPbNrSe.exe
  2⤵
  PID:9360
- C:\Windows\System\QAXvKbg.exe
  C:\Windows\System\QAXvKbg.exe
  2⤵
  PID:9376
- C:\Windows\System\cvNMmvi.exe
  C:\Windows\System\cvNMmvi.exe
  2⤵
  PID:9400
- C:\Windows\System\pZuyxQS.exe
  C:\Windows\System\pZuyxQS.exe
  2⤵
  PID:9416
- C:\Windows\System\QxgCJpA.exe
  C:\Windows\System\QxgCJpA.exe
  2⤵
  PID:9440
- C:\Windows\System\CyXOWbh.exe
  C:\Windows\System\CyXOWbh.exe
  2⤵
  PID:9460
- C:\Windows\System\BkZfERH.exe
  C:\Windows\System\BkZfERH.exe
  2⤵
  PID:9484
- C:\Windows\System\BxkJqgm.exe
  C:\Windows\System\BxkJqgm.exe
  2⤵
  PID:9508
- C:\Windows\System\cLSDBUG.exe
  C:\Windows\System\cLSDBUG.exe
  2⤵
  PID:9524
- C:\Windows\System\eRCkGHF.exe
  C:\Windows\System\eRCkGHF.exe
  2⤵
  PID:9544
- C:\Windows\System\nudvBkd.exe
  C:\Windows\System\nudvBkd.exe
  2⤵
  PID:9568
- C:\Windows\System\lkevuAL.exe
  C:\Windows\System\lkevuAL.exe
  2⤵
  PID:9592
- C:\Windows\System\WFmswIO.exe
  C:\Windows\System\WFmswIO.exe
  2⤵
  PID:9612
- C:\Windows\System\DghNieW.exe
  C:\Windows\System\DghNieW.exe
  2⤵
  PID:9636
- C:\Windows\System\fcONwGJ.exe
  C:\Windows\System\fcONwGJ.exe
  2⤵
  PID:9660
- C:\Windows\System\wtntcZO.exe
  C:\Windows\System\wtntcZO.exe
  2⤵
  PID:9680
- C:\Windows\System\LpgWiuU.exe
  C:\Windows\System\LpgWiuU.exe
  2⤵
  PID:9704
- C:\Windows\System\TUZZTaI.exe
  C:\Windows\System\TUZZTaI.exe
  2⤵
  PID:9724
- C:\Windows\System\OHUKHXk.exe
  C:\Windows\System\OHUKHXk.exe
  2⤵
  PID:9744
- C:\Windows\System\HptsVEZ.exe
  C:\Windows\System\HptsVEZ.exe
  2⤵
  PID:9764
- C:\Windows\System\LVENtTp.exe
  C:\Windows\System\LVENtTp.exe
  2⤵
  PID:9784
- C:\Windows\System\SSlLpbn.exe
  C:\Windows\System\SSlLpbn.exe
  2⤵
  PID:9816
- C:\Windows\System\XuvhqDp.exe
  C:\Windows\System\XuvhqDp.exe
  2⤵
  PID:9832
- C:\Windows\System\UbRsgqe.exe
  C:\Windows\System\UbRsgqe.exe
  2⤵
  PID:9852
- C:\Windows\System\FpostNF.exe
  C:\Windows\System\FpostNF.exe
  2⤵
  PID:9872
- C:\Windows\System\enHgbty.exe
  C:\Windows\System\enHgbty.exe
  2⤵
  PID:9888
- C:\Windows\System\ZbLkMPz.exe
  C:\Windows\System\ZbLkMPz.exe
  2⤵
  PID:9912
- C:\Windows\System\tAIjivq.exe
  C:\Windows\System\tAIjivq.exe
  2⤵
  PID:9932
- C:\Windows\System\QeyjSlX.exe
  C:\Windows\System\QeyjSlX.exe
  2⤵
  PID:9952
- C:\Windows\System\LBUXCmo.exe
  C:\Windows\System\LBUXCmo.exe
  2⤵
  PID:9976
- C:\Windows\System\nBohwJZ.exe
  C:\Windows\System\nBohwJZ.exe
  2⤵
  PID:9992
- C:\Windows\System\cIeLFpj.exe
  C:\Windows\System\cIeLFpj.exe
  2⤵
  PID:10104
- C:\Windows\System\DnXeZzg.exe
  C:\Windows\System\DnXeZzg.exe
  2⤵
  PID:10120
- C:\Windows\System\uLTkMwl.exe
  C:\Windows\System\uLTkMwl.exe
  2⤵
  PID:10148
- C:\Windows\System\CDkqRdq.exe
  C:\Windows\System\CDkqRdq.exe
  2⤵
  PID:10168
- C:\Windows\System\tPoueuX.exe
  C:\Windows\System\tPoueuX.exe
  2⤵
  PID:10184
- C:\Windows\System\UrpkZWV.exe
  C:\Windows\System\UrpkZWV.exe
  2⤵
  PID:10204
- C:\Windows\System\ktyWuMF.exe
  C:\Windows\System\ktyWuMF.exe
  2⤵
  PID:10228
- C:\Windows\System\SAfxbuj.exe
  C:\Windows\System\SAfxbuj.exe
  2⤵
  PID:5240
- C:\Windows\System\iKJJZin.exe
  C:\Windows\System\iKJJZin.exe
  2⤵
  PID:7124
- C:\Windows\System\ywfPtkB.exe
  C:\Windows\System\ywfPtkB.exe
  2⤵
  PID:4408
- C:\Windows\System\WfXGFkn.exe
  C:\Windows\System\WfXGFkn.exe
  2⤵
  PID:7480
- C:\Windows\System\gZUPixR.exe
  C:\Windows\System\gZUPixR.exe
  2⤵
  PID:6192
- C:\Windows\System\GwKEQBE.exe
  C:\Windows\System\GwKEQBE.exe
  2⤵
  PID:8300
- C:\Windows\System\DPmICJT.exe
  C:\Windows\System\DPmICJT.exe
  2⤵
  PID:8460
- C:\Windows\System\SwjklcW.exe
  C:\Windows\System\SwjklcW.exe
  2⤵
  PID:8496
- C:\Windows\System\wiBGDHR.exe
  C:\Windows\System\wiBGDHR.exe
  2⤵
  PID:8656
- C:\Windows\System\ECdyBVp.exe
  C:\Windows\System\ECdyBVp.exe
  2⤵
  PID:8700
- C:\Windows\System\nGrlDmf.exe
  C:\Windows\System\nGrlDmf.exe
  2⤵
  PID:2180
- C:\Windows\System\mpYEArb.exe
  C:\Windows\System\mpYEArb.exe
  2⤵
  PID:8912
- C:\Windows\System\KIVgwpR.exe
  C:\Windows\System\KIVgwpR.exe
  2⤵
  PID:8996
- C:\Windows\System\AlsmzSm.exe
  C:\Windows\System\AlsmzSm.exe
  2⤵
  PID:6480
- C:\Windows\System\VqEhOkq.exe
  C:\Windows\System\VqEhOkq.exe
  2⤵
  PID:6692
- C:\Windows\System\ZjYftpx.exe
  C:\Windows\System\ZjYftpx.exe
  2⤵
  PID:3180
- C:\Windows\System\lmcQNvo.exe
  C:\Windows\System\lmcQNvo.exe
  2⤵
  PID:10248
- C:\Windows\System\dzBZHtv.exe
  C:\Windows\System\dzBZHtv.exe
  2⤵
  PID:10268
- C:\Windows\System\zqWqSbi.exe
  C:\Windows\System\zqWqSbi.exe
  2⤵
  PID:10284
- C:\Windows\System\YXMMfyY.exe
  C:\Windows\System\YXMMfyY.exe
  2⤵
  PID:10352
- C:\Windows\System\KDKHkPf.exe
  C:\Windows\System\KDKHkPf.exe
  2⤵
  PID:10368
- C:\Windows\System\PYGmsfK.exe
  C:\Windows\System\PYGmsfK.exe
  2⤵
  PID:10384
- C:\Windows\System\LHsbJcg.exe
  C:\Windows\System\LHsbJcg.exe
  2⤵
  PID:10400
- C:\Windows\System\mEZTAka.exe
  C:\Windows\System\mEZTAka.exe
  2⤵
  PID:10416
- C:\Windows\System\IpQsapT.exe
  C:\Windows\System\IpQsapT.exe
  2⤵
  PID:10432
- C:\Windows\System\QNpWEPa.exe
  C:\Windows\System\QNpWEPa.exe
  2⤵
  PID:10448
- C:\Windows\System\Kfffosy.exe
  C:\Windows\System\Kfffosy.exe
  2⤵
  PID:10472
- C:\Windows\System\QuDVUMf.exe
  C:\Windows\System\QuDVUMf.exe
  2⤵
  PID:10488
- C:\Windows\System\qjQtbwD.exe
  C:\Windows\System\qjQtbwD.exe
  2⤵
  PID:10504
- C:\Windows\System\QmWNhmk.exe
  C:\Windows\System\QmWNhmk.exe
  2⤵
  PID:10520
- C:\Windows\System\fUfybFa.exe
  C:\Windows\System\fUfybFa.exe
  2⤵
  PID:10536
- C:\Windows\System\aSxFJcX.exe
  C:\Windows\System\aSxFJcX.exe
  2⤵
  PID:10552
- C:\Windows\System\fGPecie.exe
  C:\Windows\System\fGPecie.exe
  2⤵
  PID:10568
- C:\Windows\System\UFFEVeV.exe
  C:\Windows\System\UFFEVeV.exe
  2⤵
  PID:10588
- C:\Windows\System\JgtSWMe.exe
  C:\Windows\System\JgtSWMe.exe
  2⤵
  PID:10608
- C:\Windows\System\kEOzhEp.exe
  C:\Windows\System\kEOzhEp.exe
  2⤵
  PID:10632
- C:\Windows\System\CTemiYq.exe
  C:\Windows\System\CTemiYq.exe
  2⤵
  PID:10656
- C:\Windows\System\emLFIdk.exe
  C:\Windows\System\emLFIdk.exe
  2⤵
  PID:10684
- C:\Windows\System\vCCPYUH.exe
  C:\Windows\System\vCCPYUH.exe
  2⤵
  PID:10712
- C:\Windows\System\sBqdpjn.exe
  C:\Windows\System\sBqdpjn.exe
  2⤵
  PID:10732
- C:\Windows\System\mwycJrq.exe
  C:\Windows\System\mwycJrq.exe
  2⤵
  PID:10752
- C:\Windows\System\IPjVzZU.exe
  C:\Windows\System\IPjVzZU.exe
  2⤵
  PID:10772
- C:\Windows\System\oQwLXLD.exe
  C:\Windows\System\oQwLXLD.exe
  2⤵
  PID:10792
- C:\Windows\System\DjPSuBi.exe
  C:\Windows\System\DjPSuBi.exe
  2⤵
  PID:10812
- C:\Windows\System\NNCmiqU.exe
  C:\Windows\System\NNCmiqU.exe
  2⤵
  PID:10836
- C:\Windows\System\JAiKjMs.exe
  C:\Windows\System\JAiKjMs.exe
  2⤵
  PID:10852
- C:\Windows\System\ICnrUpW.exe
  C:\Windows\System\ICnrUpW.exe
  2⤵
  PID:10876
- C:\Windows\System\qrBgeOW.exe
  C:\Windows\System\qrBgeOW.exe
  2⤵
  PID:10896
- C:\Windows\System\wLBoBIN.exe
  C:\Windows\System\wLBoBIN.exe
  2⤵
  PID:10916
- C:\Windows\System\ZMLgIkN.exe
  C:\Windows\System\ZMLgIkN.exe
  2⤵
  PID:10948
- C:\Windows\System\qjGJpHv.exe
  C:\Windows\System\qjGJpHv.exe
  2⤵
  PID:10964
- C:\Windows\System\bAxVuDF.exe
  C:\Windows\System\bAxVuDF.exe
  2⤵
  PID:11092
- C:\Windows\System\GOJrNWX.exe
  C:\Windows\System\GOJrNWX.exe
  2⤵
  PID:11108
- C:\Windows\System\KRwiGIs.exe
  C:\Windows\System\KRwiGIs.exe
  2⤵
  PID:11124
- C:\Windows\System\urhsOia.exe
  C:\Windows\System\urhsOia.exe
  2⤵
  PID:11140
- C:\Windows\System\LqCIaqZ.exe
  C:\Windows\System\LqCIaqZ.exe
  2⤵
  PID:11156
- C:\Windows\System\nWvyZbE.exe
  C:\Windows\System\nWvyZbE.exe
  2⤵
  PID:11172
- C:\Windows\System\oGbdXmK.exe
  C:\Windows\System\oGbdXmK.exe
  2⤵
  PID:11188
- C:\Windows\System\wPdpAhA.exe
  C:\Windows\System\wPdpAhA.exe
  2⤵
  PID:11212
- C:\Windows\System\WXsrTDB.exe
  C:\Windows\System\WXsrTDB.exe
  2⤵
  PID:11228
- C:\Windows\System\LdvDucJ.exe
  C:\Windows\System\LdvDucJ.exe
  2⤵
  PID:11248
- C:\Windows\System\MbgmQjA.exe
  C:\Windows\System\MbgmQjA.exe
  2⤵
  PID:8152
- C:\Windows\System\RviHiok.exe
  C:\Windows\System\RviHiok.exe
  2⤵
  PID:6800
- C:\Windows\System\mpWXjKr.exe
  C:\Windows\System\mpWXjKr.exe
  2⤵
  PID:8404
- C:\Windows\System\aKNKDoq.exe
  C:\Windows\System\aKNKDoq.exe
  2⤵
  PID:9760
- C:\Windows\System\YYinwdX.exe
  C:\Windows\System\YYinwdX.exe
  2⤵
  PID:9752
- C:\Windows\System\iCiJqiW.exe
  C:\Windows\System\iCiJqiW.exe
  2⤵
  PID:8672
- C:\Windows\System\aXXEHWg.exe
  C:\Windows\System\aXXEHWg.exe
  2⤵
  PID:8768
- C:\Windows\System\lCjnadp.exe
  C:\Windows\System\lCjnadp.exe
  2⤵
  PID:8800
- C:\Windows\System\leqFBsR.exe
  C:\Windows\System\leqFBsR.exe
  2⤵
  PID:9868
- C:\Windows\System\oZDsLca.exe
  C:\Windows\System\oZDsLca.exe
  2⤵
  PID:404
- C:\Windows\System\bqjAQrF.exe
  C:\Windows\System\bqjAQrF.exe
  2⤵
  PID:6412
- C:\Windows\System\IJZPebY.exe
  C:\Windows\System\IJZPebY.exe
  2⤵
  PID:6584
- C:\Windows\System\avCYjVv.exe
  C:\Windows\System\avCYjVv.exe
  2⤵
  PID:9040
- C:\Windows\System\qAJwied.exe
  C:\Windows\System\qAJwied.exe
  2⤵
  PID:9084
- C:\Windows\System\mTiGhJs.exe
  C:\Windows\System\mTiGhJs.exe
  2⤵
  PID:9188
- C:\Windows\System\lIvEJKx.exe
  C:\Windows\System\lIvEJKx.exe
  2⤵
  PID:11120
- C:\Windows\System\rrXVWeW.exe
  C:\Windows\System\rrXVWeW.exe
  2⤵
  PID:11180
- C:\Windows\System\EzGypAo.exe
  C:\Windows\System\EzGypAo.exe
  2⤵
  PID:8644
- C:\Windows\System\GLfaJoD.exe
  C:\Windows\System\GLfaJoD.exe
  2⤵
  PID:9024
- C:\Windows\System\RToGwJg.exe
  C:\Windows\System\RToGwJg.exe
  2⤵
  PID:11272
- C:\Windows\System\uNztnNH.exe
  C:\Windows\System\uNztnNH.exe
  2⤵
  PID:11296
- C:\Windows\System\AFMLuUN.exe
  C:\Windows\System\AFMLuUN.exe
  2⤵
  PID:11312
- C:\Windows\System\TsZcqis.exe
  C:\Windows\System\TsZcqis.exe
  2⤵
  PID:11332
- C:\Windows\System\lqlDfeO.exe
  C:\Windows\System\lqlDfeO.exe
  2⤵
  PID:11356
- C:\Windows\System\zmlbIxc.exe
  C:\Windows\System\zmlbIxc.exe
  2⤵
  PID:11372
- C:\Windows\System\iGJUJbF.exe
  C:\Windows\System\iGJUJbF.exe
  2⤵
  PID:11388
- C:\Windows\System\uSbQpXo.exe
  C:\Windows\System\uSbQpXo.exe
  2⤵
  PID:11408
- C:\Windows\System\lMQChLs.exe
  C:\Windows\System\lMQChLs.exe
  2⤵
  PID:11424
- C:\Windows\System\JKsCUco.exe
  C:\Windows\System\JKsCUco.exe
  2⤵
  PID:11440
- C:\Windows\System\VaUYVah.exe
  C:\Windows\System\VaUYVah.exe
  2⤵
  PID:11456
- C:\Windows\System\FrtRVrJ.exe
  C:\Windows\System\FrtRVrJ.exe
  2⤵
  PID:11472
- C:\Windows\System\sDQispX.exe
  C:\Windows\System\sDQispX.exe
  2⤵
  PID:11488
- C:\Windows\System\LkfZMCa.exe
  C:\Windows\System\LkfZMCa.exe
  2⤵
  PID:11508
- C:\Windows\System\uYjPANZ.exe
  C:\Windows\System\uYjPANZ.exe
  2⤵
  PID:11528
- C:\Windows\System\ihrwQHk.exe
  C:\Windows\System\ihrwQHk.exe
  2⤵
  PID:11548
- C:\Windows\System\xJEWApl.exe
  C:\Windows\System\xJEWApl.exe
  2⤵
  PID:11568
- C:\Windows\System\atuvNQX.exe
  C:\Windows\System\atuvNQX.exe
  2⤵
  PID:11588
- C:\Windows\System\VbbAkYt.exe
  C:\Windows\System\VbbAkYt.exe
  2⤵
  PID:11608
- C:\Windows\System\wkdQbvC.exe
  C:\Windows\System\wkdQbvC.exe
  2⤵
  PID:11636
- C:\Windows\System\RaEIstN.exe
  C:\Windows\System\RaEIstN.exe
  2⤵
  PID:11660
- C:\Windows\System\shyQBVN.exe
  C:\Windows\System\shyQBVN.exe
  2⤵
  PID:11676
- C:\Windows\System\QWUcPSl.exe
  C:\Windows\System\QWUcPSl.exe
  2⤵
  PID:11704
- C:\Windows\System\lEmhZoD.exe
  C:\Windows\System\lEmhZoD.exe
  2⤵
  PID:11752
- C:\Windows\System\yZPmKnf.exe
  C:\Windows\System\yZPmKnf.exe
  2⤵
  PID:11768
- C:\Windows\System\jrKhfyJ.exe
  C:\Windows\System\jrKhfyJ.exe
  2⤵
  PID:11784
- C:\Windows\System\xxpMRMZ.exe
  C:\Windows\System\xxpMRMZ.exe
  2⤵
  PID:11800
- C:\Windows\System\DvmlpnB.exe
  C:\Windows\System\DvmlpnB.exe
  2⤵
  PID:11816
- C:\Windows\System\iVIurid.exe
  C:\Windows\System\iVIurid.exe
  2⤵
  PID:11836
- C:\Windows\System\ZQtNArK.exe
  C:\Windows\System\ZQtNArK.exe
  2⤵
  PID:11852
- C:\Windows\System\lDISZyw.exe
  C:\Windows\System\lDISZyw.exe
  2⤵
  PID:11868
- C:\Windows\System\dfNMMmr.exe
  C:\Windows\System\dfNMMmr.exe
  2⤵
  PID:11896
- C:\Windows\System\zMApnyl.exe
  C:\Windows\System\zMApnyl.exe
  2⤵
  PID:11916
- C:\Windows\System\uDFgtOq.exe
  C:\Windows\System\uDFgtOq.exe
  2⤵
  PID:11932
- C:\Windows\System\ysguKKr.exe
  C:\Windows\System\ysguKKr.exe
  2⤵
  PID:11956
- C:\Windows\System\cJochhd.exe
  C:\Windows\System\cJochhd.exe
  2⤵
  PID:11972
- C:\Windows\System\qRmlnal.exe
  C:\Windows\System\qRmlnal.exe
  2⤵
  PID:11996
- C:\Windows\System\pHZqWba.exe
  C:\Windows\System\pHZqWba.exe
  2⤵
  PID:12020
- C:\Windows\System\aonmEdS.exe
  C:\Windows\System\aonmEdS.exe
  2⤵
  PID:12044
- C:\Windows\System\eRIlYAh.exe
  C:\Windows\System\eRIlYAh.exe
  2⤵
  PID:12068
- C:\Windows\System\ZXVoigP.exe
  C:\Windows\System\ZXVoigP.exe
  2⤵
  PID:12084
- C:\Windows\System\bnIetov.exe
  C:\Windows\System\bnIetov.exe
  2⤵
  PID:12108
- C:\Windows\System\ktEAwje.exe
  C:\Windows\System\ktEAwje.exe
  2⤵
  PID:12132
- C:\Windows\System\MjLzJyi.exe
  C:\Windows\System\MjLzJyi.exe
  2⤵
  PID:12152
- C:\Windows\System\QZaUMYa.exe
  C:\Windows\System\QZaUMYa.exe
  2⤵
  PID:12176
- C:\Windows\System\ZjbHUnc.exe
  C:\Windows\System\ZjbHUnc.exe
  2⤵
  PID:12196
- C:\Windows\System\LfWvfIi.exe
  C:\Windows\System\LfWvfIi.exe
  2⤵
  PID:12212
- C:\Windows\System\Lnrjhle.exe
  C:\Windows\System\Lnrjhle.exe
  2⤵
  PID:12236
- C:\Windows\System\cdlNXEV.exe
  C:\Windows\System\cdlNXEV.exe
  2⤵
  PID:12268
- C:\Windows\System\GBfOJqV.exe
  C:\Windows\System\GBfOJqV.exe
  2⤵
  PID:6260
- C:\Windows\System\lPpfdlC.exe
  C:\Windows\System\lPpfdlC.exe
  2⤵
  PID:7996
- C:\Windows\System\gQtjBPN.exe
  C:\Windows\System\gQtjBPN.exe
  2⤵
  PID:7888
- C:\Windows\System\RtHTuuH.exe
  C:\Windows\System\RtHTuuH.exe
  2⤵
  PID:8184
- C:\Windows\System\ShgruUK.exe
  C:\Windows\System\ShgruUK.exe
  2⤵
  PID:6968
- C:\Windows\System\rxKqjuO.exe
  C:\Windows\System\rxKqjuO.exe
  2⤵
  PID:9220
- C:\Windows\System\PbwQdiG.exe
  C:\Windows\System\PbwQdiG.exe
  2⤵
  PID:9268
- C:\Windows\System\ZoERFnU.exe
  C:\Windows\System\ZoERFnU.exe
  2⤵
  PID:9332
- C:\Windows\System\DmPeJHX.exe
  C:\Windows\System\DmPeJHX.exe
  2⤵
  PID:9356
- C:\Windows\System\spszDIW.exe
  C:\Windows\System\spszDIW.exe
  2⤵
  PID:9412
- C:\Windows\System\zVLKdmx.exe
  C:\Windows\System\zVLKdmx.exe
  2⤵
  PID:9468
- C:\Windows\System\emBYqEb.exe
  C:\Windows\System\emBYqEb.exe
  2⤵
  PID:9500
- C:\Windows\System\HdfpcUf.exe
  C:\Windows\System\HdfpcUf.exe
  2⤵
  PID:9552
- C:\Windows\System\YoOsSWq.exe
  C:\Windows\System\YoOsSWq.exe
  2⤵
  PID:9604
- C:\Windows\System\TOZsVEX.exe
  C:\Windows\System\TOZsVEX.exe
  2⤵
  PID:9652
- C:\Windows\System\DxDdCtQ.exe
  C:\Windows\System\DxDdCtQ.exe
  2⤵
  PID:9716
- C:\Windows\System\eJVkptV.exe
  C:\Windows\System\eJVkptV.exe
  2⤵
  PID:6872
- C:\Windows\System\sQOsQBa.exe
  C:\Windows\System\sQOsQBa.exe
  2⤵
  PID:12296
- C:\Windows\System\HiHCYkw.exe
  C:\Windows\System\HiHCYkw.exe
  2⤵
  PID:12316
- C:\Windows\System\LLQDYqb.exe
  C:\Windows\System\LLQDYqb.exe
  2⤵
  PID:12336
- C:\Windows\System\EYieLNn.exe
  C:\Windows\System\EYieLNn.exe
  2⤵
  PID:12356
- C:\Windows\System\eBDzeWD.exe
  C:\Windows\System\eBDzeWD.exe
  2⤵
  PID:12392
- C:\Windows\System\VPsZTvJ.exe
  C:\Windows\System\VPsZTvJ.exe
  2⤵
  PID:12428
- C:\Windows\System\LHupYCN.exe
  C:\Windows\System\LHupYCN.exe
  2⤵
  PID:12448
- C:\Windows\System\qKTplXg.exe
  C:\Windows\System\qKTplXg.exe
  2⤵
  PID:12464
- C:\Windows\System\XnFoEYP.exe
  C:\Windows\System\XnFoEYP.exe
  2⤵
  PID:12480
- C:\Windows\System\HWJuBwc.exe
  C:\Windows\System\HWJuBwc.exe
  2⤵
  PID:12500
- C:\Windows\System\YQTrPTV.exe
  C:\Windows\System\YQTrPTV.exe
  2⤵
  PID:12516
- C:\Windows\System\InbrmZJ.exe
  C:\Windows\System\InbrmZJ.exe
  2⤵
  PID:12532
- C:\Windows\System\DBaOUvU.exe
  C:\Windows\System\DBaOUvU.exe
  2⤵
  PID:12552
- C:\Windows\System\oPGGdGW.exe
  C:\Windows\System\oPGGdGW.exe
  2⤵
  PID:12572
- C:\Windows\System\dwTErTY.exe
  C:\Windows\System\dwTErTY.exe
  2⤵
  PID:12588
- C:\Windows\System\fPvdNju.exe
  C:\Windows\System\fPvdNju.exe
  2⤵
  PID:12604
- C:\Windows\System\kleGHmG.exe
  C:\Windows\System\kleGHmG.exe
  2⤵
  PID:12620
- C:\Windows\System\MRbOcFD.exe
  C:\Windows\System\MRbOcFD.exe
  2⤵
  PID:12648
- C:\Windows\System\ONtBfez.exe
  C:\Windows\System\ONtBfez.exe
  2⤵
  PID:12688
- C:\Windows\System\wAoaEbH.exe
  C:\Windows\System\wAoaEbH.exe
  2⤵
  PID:12716
- C:\Windows\System\IEoWRXq.exe
  C:\Windows\System\IEoWRXq.exe
  2⤵
  PID:12748
- C:\Windows\System\xnfAbGu.exe
  C:\Windows\System\xnfAbGu.exe
  2⤵
  PID:12772
- C:\Windows\System\kXfESSN.exe
  C:\Windows\System\kXfESSN.exe
  2⤵
  PID:12788
- C:\Windows\System\NBJMBDA.exe
  C:\Windows\System\NBJMBDA.exe
  2⤵
  PID:12828
- C:\Windows\System\gBiJclU.exe
  C:\Windows\System\gBiJclU.exe
  2⤵
  PID:12852
- C:\Windows\System\tEAlDzv.exe
  C:\Windows\System\tEAlDzv.exe
  2⤵
  PID:12880
- C:\Windows\System\IxSGBKs.exe
  C:\Windows\System\IxSGBKs.exe
  2⤵
  PID:12896
- C:\Windows\System\xNjSwBN.exe
  C:\Windows\System\xNjSwBN.exe
  2⤵
  PID:12912
- C:\Windows\System\QdnjKix.exe
  C:\Windows\System\QdnjKix.exe
  2⤵
  PID:12928
- C:\Windows\System\gtidzGi.exe
  C:\Windows\System\gtidzGi.exe
  2⤵
  PID:12944
- C:\Windows\System\PTxvRct.exe
  C:\Windows\System\PTxvRct.exe
  2⤵
  PID:12964
- C:\Windows\System\eUjPfRB.exe
  C:\Windows\System\eUjPfRB.exe
  2⤵
  PID:12988
- C:\Windows\System\SACjMRh.exe
  C:\Windows\System\SACjMRh.exe
  2⤵
  PID:13016
- C:\Windows\System\zfmlLQV.exe
  C:\Windows\System\zfmlLQV.exe
  2⤵
  PID:13036
- C:\Windows\System\OaMKnqd.exe
  C:\Windows\System\OaMKnqd.exe
  2⤵
  PID:13052
- C:\Windows\System\IBRLIJp.exe
  C:\Windows\System\IBRLIJp.exe
  2⤵
  PID:13076
- C:\Windows\System\ihrRuyd.exe
  C:\Windows\System\ihrRuyd.exe
  2⤵
  PID:13092
- C:\Windows\System\hzNRKGz.exe
  C:\Windows\System\hzNRKGz.exe
  2⤵
  PID:13112
- C:\Windows\System\sdIFerX.exe
  C:\Windows\System\sdIFerX.exe
  2⤵
  PID:13128
- C:\Windows\System\lvxQVnb.exe
  C:\Windows\System\lvxQVnb.exe
  2⤵
  PID:13144
- C:\Windows\System\YNKKlJW.exe
  C:\Windows\System\YNKKlJW.exe
  2⤵
  PID:13160
- C:\Windows\System\zAEtPLP.exe
  C:\Windows\System\zAEtPLP.exe
  2⤵
  PID:13180
- C:\Windows\System\oMqoYkR.exe
  C:\Windows\System\oMqoYkR.exe
  2⤵
  PID:13196
- C:\Windows\System\mgYVgNp.exe
  C:\Windows\System\mgYVgNp.exe
  2⤵
  PID:13212
- C:\Windows\System\CYTAzEF.exe
  C:\Windows\System\CYTAzEF.exe
  2⤵
  PID:13228
- C:\Windows\System\zUjnVUY.exe
  C:\Windows\System\zUjnVUY.exe
  2⤵
  PID:13244
- C:\Windows\System\uZTeVrs.exe
  C:\Windows\System\uZTeVrs.exe
  2⤵
  PID:13268
- C:\Windows\System\IaopZZA.exe
  C:\Windows\System\IaopZZA.exe
  2⤵
  PID:13292
- C:\Windows\System\vttcNzC.exe
  C:\Windows\System\vttcNzC.exe
  2⤵
  PID:10496
- C:\Windows\System\tlwtxxR.exe
  C:\Windows\System\tlwtxxR.exe
  2⤵
  PID:6524
- C:\Windows\System\VhObPGX.exe
  C:\Windows\System\VhObPGX.exe
  2⤵
  PID:12580
- C:\Windows\System\uAbwNfO.exe
  C:\Windows\System\uAbwNfO.exe
  2⤵
  PID:10696
- C:\Windows\System\wcTCkiN.exe
  C:\Windows\System\wcTCkiN.exe
  2⤵
  PID:10940
- C:\Windows\System\IrgDvrD.exe
  C:\Windows\System\IrgDvrD.exe
  2⤵
  PID:9580
- C:\Windows\System\QOpDQpw.exe
  C:\Windows\System\QOpDQpw.exe
  2⤵
  PID:12364
- C:\Windows\System\otQUstZ.exe
  C:\Windows\System\otQUstZ.exe
  2⤵
  PID:7400
- C:\Windows\System\YWNcwIc.exe
  C:\Windows\System\YWNcwIc.exe
  2⤵
  PID:12508
- C:\Windows\System\PhOfayz.exe
  C:\Windows\System\PhOfayz.exe
  2⤵
  PID:8860
- C:\Windows\System\dgLfxtm.exe
  C:\Windows\System\dgLfxtm.exe
  2⤵
  PID:9104
- C:\Windows\System\SaIGZHL.exe
  C:\Windows\System\SaIGZHL.exe
  2⤵
  PID:11308
- C:\Windows\System\KMMJNDn.exe
  C:\Windows\System\KMMJNDn.exe
  2⤵
  PID:11536
- C:\Windows\System\BUahgAQ.exe
  C:\Windows\System\BUahgAQ.exe
  2⤵
  PID:11684
- C:\Windows\System\ZmfDAMp.exe
  C:\Windows\System\ZmfDAMp.exe
  2⤵
  PID:3588
- C:\Windows\System\Unfsemr.exe
  C:\Windows\System\Unfsemr.exe
  2⤵
  PID:11808
- C:\Windows\System\yWQqrXF.exe
  C:\Windows\System\yWQqrXF.exe
  2⤵
  PID:11848
- C:\Windows\System\GOqbyKc.exe
  C:\Windows\System\GOqbyKc.exe
  2⤵
  PID:1704
- C:\Windows\System\SNsSbtk.exe
  C:\Windows\System\SNsSbtk.exe
  2⤵
  PID:10236
- C:\Windows\System\BHBMofM.exe
  C:\Windows\System\BHBMofM.exe
  2⤵
  PID:12032
- C:\Windows\System\hnPRfPN.exe
  C:\Windows\System\hnPRfPN.exe
  2⤵
  PID:7128
- C:\Windows\System\OCUegcj.exe
  C:\Windows\System\OCUegcj.exe
  2⤵
  PID:12092
- C:\Windows\System\JsJqsOc.exe
  C:\Windows\System\JsJqsOc.exe
  2⤵
  PID:12140
- C:\Windows\System\dDVtOVY.exe
  C:\Windows\System\dDVtOVY.exe
  2⤵
  PID:4040
- C:\Windows\System\OgCOFkL.exe
  C:\Windows\System\OgCOFkL.exe
  2⤵
  PID:11104
- C:\Windows\System\yYaPdFJ.exe
  C:\Windows\System\yYaPdFJ.exe
  2⤵
  PID:12456
- C:\Windows\System\ZfSsGiG.exe
  C:\Windows\System\ZfSsGiG.exe
  2⤵
  PID:12512
- C:\Windows\System\hfSojzW.exe
  C:\Windows\System\hfSojzW.exe
  2⤵
  PID:4776
- C:\Windows\System\LgOlOuG.exe
  C:\Windows\System\LgOlOuG.exe
  2⤵
  PID:12936
- C:\Windows\System\knnXmtn.exe
  C:\Windows\System\knnXmtn.exe
  2⤵
  PID:12724
- C:\Windows\System\xrkosnF.exe
  C:\Windows\System\xrkosnF.exe
  2⤵
  PID:12876
- C:\Windows\System\iySLrSv.exe
  C:\Windows\System\iySLrSv.exe
  2⤵
  PID:6196
- C:\Windows\System\fhIFWnx.exe
  C:\Windows\System\fhIFWnx.exe
  2⤵
  PID:10216
- C:\Windows\System\eEwxfSA.exe
  C:\Windows\System\eEwxfSA.exe
  2⤵
  PID:10156
- C:\Windows\System\FDeftfr.exe
  C:\Windows\System\FDeftfr.exe
  2⤵
  PID:10116
- C:\Windows\System\hobWqNT.exe
  C:\Windows\System\hobWqNT.exe
  2⤵
  PID:10020
- C:\Windows\System\BVMAjjN.exe
  C:\Windows\System\BVMAjjN.exe
  2⤵
  PID:10648
- C:\Windows\System\jFtpItq.exe
  C:\Windows\System\jFtpItq.exe
  2⤵
  PID:13152
- C:\Windows\System\VWBIdty.exe
  C:\Windows\System\VWBIdty.exe
  2⤵
  PID:12920
- C:\Windows\System\SsQDrqM.exe
  C:\Windows\System\SsQDrqM.exe
  2⤵
  PID:324
- C:\Windows\System\iyziPdB.exe
  C:\Windows\System\iyziPdB.exe
  2⤵
  PID:11352
- C:\Windows\System\vOpQsEF.exe
  C:\Windows\System\vOpQsEF.exe
  2⤵
  PID:11452
- C:\Windows\System\pdTPXct.exe
  C:\Windows\System\pdTPXct.exe
  2⤵
  PID:8784
- C:\Windows\System\gbPdqNo.exe
  C:\Windows\System\gbPdqNo.exe
  2⤵
  PID:9152
- C:\Windows\System\uMxFfdL.exe
  C:\Windows\System\uMxFfdL.exe
  2⤵
  PID:8036
- C:\Windows\System\FrCIQbn.exe
  C:\Windows\System\FrCIQbn.exe
  2⤵
  PID:7828
- C:\Windows\System\RrqxIOI.exe
  C:\Windows\System\RrqxIOI.exe
  2⤵
  PID:10244
- C:\Windows\System\SXZhcsG.exe
  C:\Windows\System\SXZhcsG.exe
  2⤵
  PID:1660
- C:\Windows\System\QorcOLW.exe
  C:\Windows\System\QorcOLW.exe
  2⤵
  PID:10444
- C:\Windows\System\GehJtbX.exe
  C:\Windows\System\GehJtbX.exe
  2⤵
  PID:4488
- C:\Windows\System\zipMecj.exe
  C:\Windows\System\zipMecj.exe
  2⤵
  PID:576
- C:\Windows\System\FTSXbQh.exe
  C:\Windows\System\FTSXbQh.exe
  2⤵
  PID:3096
- C:\Windows\System\PGqFaGw.exe
  C:\Windows\System\PGqFaGw.exe
  2⤵
  PID:964
- C:\Windows\System\wsJbhbM.exe
  C:\Windows\System\wsJbhbM.exe
  2⤵
  PID:10260
- C:\Windows\System\qghdlEJ.exe
  C:\Windows\System\qghdlEJ.exe
  2⤵
  PID:11280
- C:\Windows\System\uIKpOtl.exe
  C:\Windows\System\uIKpOtl.exe
  2⤵
  PID:11084
- C:\Windows\System\wEYUQcL.exe
  C:\Windows\System\wEYUQcL.exe
  2⤵
  PID:11116
- C:\Windows\System\HwazWZN.exe
  C:\Windows\System\HwazWZN.exe
  2⤵
  PID:12004
- C:\Windows\System\XkPecUO.exe
  C:\Windows\System\XkPecUO.exe
  2⤵
  PID:12164
- C:\Windows\System\KxYeDqM.exe
  C:\Windows\System\KxYeDqM.exe
  2⤵
  PID:12192
- C:\Windows\System\EcivdNg.exe
  C:\Windows\System\EcivdNg.exe
  2⤵
  PID:12244
- C:\Windows\System\gKJPXNi.exe
  C:\Windows\System\gKJPXNi.exe
  2⤵
  PID:7992
- C:\Windows\System\yZrBNFa.exe
  C:\Windows\System\yZrBNFa.exe
  2⤵
  PID:10888
- C:\Windows\System\GrwjSip.exe
  C:\Windows\System\GrwjSip.exe
  2⤵
  PID:11604
- C:\Windows\System\HpzvaKc.exe
  C:\Windows\System\HpzvaKc.exe
  2⤵
  PID:8908
- C:\Windows\System\rYPMslf.exe
  C:\Windows\System\rYPMslf.exe
  2⤵
  PID:9740
- C:\Windows\System\myVdCjv.exe
  C:\Windows\System\myVdCjv.exe
  2⤵
  PID:13280
- C:\Windows\System\yDwEhWM.exe
  C:\Windows\System\yDwEhWM.exe
  2⤵
  PID:4256
- C:\Windows\System\QpPsDIy.exe
  C:\Windows\System\QpPsDIy.exe
  2⤵
  PID:11236
- C:\Windows\System\WjMuFYU.exe
  C:\Windows\System\WjMuFYU.exe
  2⤵
  PID:13064
- C:\Windows\System\LpMPJtF.exe
  C:\Windows\System\LpMPJtF.exe
  2⤵
  PID:9920
- C:\Windows\System\oupttCW.exe
  C:\Windows\System\oupttCW.exe
  2⤵
  PID:10780
- C:\Windows\System\upwFWBC.exe
  C:\Windows\System\upwFWBC.exe
  2⤵
  PID:11584
- C:\Windows\System\lOkOnSa.exe
  C:\Windows\System\lOkOnSa.exe
  2⤵
  PID:13172
- C:\Windows\System\FYYIPzs.exe
  C:\Windows\System\FYYIPzs.exe
  2⤵
  PID:4292
- C:\Windows\System\iUUggnf.exe
  C:\Windows\System\iUUggnf.exe
  2⤵
  PID:12952
- C:\Windows\System\ofACaUY.exe
  C:\Windows\System\ofACaUY.exe
  2⤵
  PID:11828
- C:\Windows\System\jWrGGKR.exe
  C:\Windows\System\jWrGGKR.exe
  2⤵
  PID:7496
- C:\Windows\System\dWGEgUz.exe
  C:\Windows\System\dWGEgUz.exe
  2⤵
  PID:11864
- C:\Windows\System\mASOPXq.exe
  C:\Windows\System\mASOPXq.exe
  2⤵
  PID:11928
- C:\Windows\System\SMDkyhQ.exe
  C:\Windows\System\SMDkyhQ.exe
  2⤵
  PID:12040
- C:\Windows\System\EnQmzih.exe
  C:\Windows\System\EnQmzih.exe
  2⤵
  PID:6432
- C:\Windows\System\GJufcbT.exe
  C:\Windows\System\GJufcbT.exe
  2⤵
  PID:13104
- C:\Windows\System\dkRiNrt.exe
  C:\Windows\System\dkRiNrt.exe
  2⤵
  PID:12256
- C:\Windows\System\LKSmvyU.exe
  C:\Windows\System\LKSmvyU.exe
  2⤵
  PID:12352
- C:\Windows\System\BYIiQET.exe
  C:\Windows\System\BYIiQET.exe
  2⤵
  PID:13324
- C:\Windows\System\oYJwahc.exe
  C:\Windows\System\oYJwahc.exe
  2⤵
  PID:13344
- C:\Windows\System\QjrCzhp.exe
  C:\Windows\System\QjrCzhp.exe
  2⤵
  PID:13376
- C:\Windows\System\NoLDRjN.exe
  C:\Windows\System\NoLDRjN.exe
  2⤵
  PID:13416
- C:\Windows\System\puoogwY.exe
  C:\Windows\System\puoogwY.exe
  2⤵
  PID:13440
- C:\Windows\System\myCsTqe.exe
  C:\Windows\System\myCsTqe.exe
  2⤵
  PID:13460
- C:\Windows\System\NcveCpn.exe
  C:\Windows\System\NcveCpn.exe
  2⤵
  PID:13492
- C:\Windows\System\AtDDSpy.exe
  C:\Windows\System\AtDDSpy.exe
  2⤵
  PID:13508
- C:\Windows\System\ZvJmoUD.exe
  C:\Windows\System\ZvJmoUD.exe
  2⤵
  PID:13532
- C:\Windows\System\pSxFUNs.exe
  C:\Windows\System\pSxFUNs.exe
  2⤵
  PID:13552
- C:\Windows\System\MPEJgLi.exe
  C:\Windows\System\MPEJgLi.exe
  2⤵
  PID:13568
- C:\Windows\System\ymzHesK.exe
  C:\Windows\System\ymzHesK.exe
  2⤵
  PID:13588
- C:\Windows\System\cUcsThv.exe
  C:\Windows\System\cUcsThv.exe
  2⤵
  PID:13796
- C:\Windows\System\WNsaEzU.exe
  C:\Windows\System\WNsaEzU.exe
  2⤵
  PID:13940
- C:\Windows\System\yUsEOOA.exe
  C:\Windows\System\yUsEOOA.exe
  2⤵
  PID:13956
- C:\Windows\System\DvJooKZ.exe
  C:\Windows\System\DvJooKZ.exe
  2⤵
  PID:13980
- C:\Windows\System\ohHrfAg.exe
  C:\Windows\System\ohHrfAg.exe
  2⤵
  PID:14072
- C:\Windows\System\haaAoRv.exe
  C:\Windows\System\haaAoRv.exe
  2⤵
  PID:13124
- C:\Windows\System\aXHSEiU.exe
  C:\Windows\System\aXHSEiU.exe
  2⤵
  PID:1944
- C:\Windows\System\isXgqwc.exe
  C:\Windows\System\isXgqwc.exe
  2⤵
  PID:12600
- C:\Windows\System\FNhndfB.exe
  C:\Windows\System\FNhndfB.exe
  2⤵
  PID:9988
- C:\Windows\System\SKKjFWK.exe
  C:\Windows\System\SKKjFWK.exe
  2⤵
  PID:14252
- C:\Windows\System\pzNrkwY.exe
  C:\Windows\System\pzNrkwY.exe
  2⤵
  PID:13384
- C:\Windows\System\YwLLWCF.exe
  C:\Windows\System\YwLLWCF.exe
  2⤵
  PID:13792
- C:\Windows\System\uzUmfmS.exe
  C:\Windows\System\uzUmfmS.exe
  2⤵
  PID:13772
- C:\Windows\System\QOpJTFE.exe
  C:\Windows\System\QOpJTFE.exe
  2⤵
  PID:13740
- C:\Windows\System\sofECWK.exe
  C:\Windows\System\sofECWK.exe
  2⤵
  PID:13704
- C:\Windows\System\RTPaGRC.exe
  C:\Windows\System\RTPaGRC.exe
  2⤵
  PID:13660
- C:\Windows\System\vNsvHpy.exe
  C:\Windows\System\vNsvHpy.exe
  2⤵
  PID:13636
- C:\Windows\System\iIQxfiY.exe
  C:\Windows\System\iIQxfiY.exe
  2⤵
  PID:13596
- C:\Windows\System\ZDBUglM.exe
  C:\Windows\System\ZDBUglM.exe
  2⤵
  PID:13548
- C:\Windows\System\DJsGYOz.exe
  C:\Windows\System\DJsGYOz.exe
  2⤵
  PID:13516
- C:\Windows\System\nAoDEGW.exe
  C:\Windows\System\nAoDEGW.exe
  2⤵
  PID:11396
- C:\Windows\System\WqTynLE.exe
  C:\Windows\System\WqTynLE.exe
  2⤵
  PID:13892
- C:\Windows\System\tWDYOSo.exe
  C:\Windows\System\tWDYOSo.exe
  2⤵
  PID:14256
- C:\Windows\System\PXchVvw.exe
  C:\Windows\System\PXchVvw.exe
  2⤵
  PID:14008
- C:\Windows\System\EBlExdw.exe
  C:\Windows\System\EBlExdw.exe
  2⤵
  PID:14020
- C:\Windows\System\OWTgyPo.exe
  C:\Windows\System\OWTgyPo.exe
  2⤵
  PID:14036
- C:\Windows\System\rMvvXIh.exe
  C:\Windows\System\rMvvXIh.exe
  2⤵
  PID:14100
- C:\Windows\System\QuSqsqt.exe
  C:\Windows\System\QuSqsqt.exe
  2⤵
  PID:14124
- C:\Windows\System\CpDQZTu.exe
  C:\Windows\System\CpDQZTu.exe
  2⤵
  PID:14148
- C:\Windows\System\iHFYqEF.exe
  C:\Windows\System\iHFYqEF.exe
  2⤵
  PID:14180
- C:\Windows\System\YTGbRkl.exe
  C:\Windows\System\YTGbRkl.exe
  2⤵
  PID:14292
- C:\Windows\System\rJzkxfI.exe
  C:\Windows\System\rJzkxfI.exe
  2⤵
  PID:14232
- C:\Windows\System\JIOfEfv.exe
  C:\Windows\System\JIOfEfv.exe
  2⤵
  PID:14324
- C:\Windows\System\vrVbRxp.exe
  C:\Windows\System\vrVbRxp.exe
  2⤵
  PID:1284
- C:\Windows\System\jHGwzcB.exe
  C:\Windows\System\jHGwzcB.exe
  2⤵
  PID:8892
- C:\Windows\System\rzNCOwp.exe
  C:\Windows\System\rzNCOwp.exe
  2⤵
  PID:11224
- C:\Windows\System\oKigWGp.exe
  C:\Windows\System\oKigWGp.exe
  2⤵
  PID:13700
- C:\Windows\System\OmSRuzz.exe
  C:\Windows\System\OmSRuzz.exe
  2⤵
  PID:2912
- C:\Windows\System\CyQWQfE.exe
  C:\Windows\System\CyQWQfE.exe
  2⤵
  PID:10960
- C:\Windows\System\FLsJdAX.exe
  C:\Windows\System\FLsJdAX.exe
  2⤵
  PID:12344
- C:\Windows\System\Gpqsmdi.exe
  C:\Windows\System\Gpqsmdi.exe
  2⤵
  PID:12492
- C:\Windows\System\jKjaSQB.exe
  C:\Windows\System\jKjaSQB.exe
  2⤵
  PID:11844
- C:\Windows\System\koCZjmi.exe
  C:\Windows\System\koCZjmi.exe
  2⤵
  PID:12284
- C:\Windows\System\CJfyPCj.exe
  C:\Windows\System\CJfyPCj.exe
  2⤵
  PID:11580
- C:\Windows\System\SDyVYfc.exe
  C:\Windows\System\SDyVYfc.exe
  2⤵
  PID:11196
- C:\Windows\System\TpMlTvr.exe
  C:\Windows\System\TpMlTvr.exe
  2⤵
  PID:10644
- C:\Windows\System\JEyLnJC.exe
  C:\Windows\System\JEyLnJC.exe
  2⤵
  PID:13524
- C:\Windows\System\cqXizys.exe
  C:\Windows\System\cqXizys.exe
  2⤵
  PID:11624
- C:\Windows\System\MuAUenU.exe
  C:\Windows\System\MuAUenU.exe
  2⤵
  PID:8240
- C:\Windows\System\pvnERRo.exe
  C:\Windows\System\pvnERRo.exe
  2⤵
  PID:12280
- C:\Windows\System\AydpXTa.exe
  C:\Windows\System\AydpXTa.exe
  2⤵
  PID:5084
- C:\Windows\System\YdPflqT.exe
  C:\Windows\System\YdPflqT.exe
  2⤵
  PID:13784
- C:\Windows\System\ZzTAHyR.exe
  C:\Windows\System\ZzTAHyR.exe
  2⤵
  PID:11760
- C:\Windows\System\NzBuvUh.exe
  C:\Windows\System\NzBuvUh.exe
  2⤵
  PID:13684
- C:\Windows\System\uaKWvNZ.exe
  C:\Windows\System\uaKWvNZ.exe
  2⤵
  PID:13628
- C:\Windows\System\mMJCzyy.exe
  C:\Windows\System\mMJCzyy.exe
  2⤵
  PID:12844
- C:\Windows\System\LkdhiJD.exe
  C:\Windows\System\LkdhiJD.exe
  2⤵
  PID:13904
- C:\Windows\System\IctCGyu.exe
  C:\Windows\System\IctCGyu.exe
  2⤵
  PID:7348
- C:\Windows\System\rrYsYHP.exe
  C:\Windows\System\rrYsYHP.exe
  2⤵
  PID:13928
- C:\Windows\System\TujCyjv.exe
  C:\Windows\System\TujCyjv.exe
  2⤵
  PID:13120
- C:\Windows\System\syAiShl.exe
  C:\Windows\System\syAiShl.exe
  2⤵
  PID:11416
- C:\Windows\System\IhllOaO.exe
  C:\Windows\System\IhllOaO.exe
  2⤵
  PID:13976
- C:\Windows\System\RRLIVEf.exe
  C:\Windows\System\RRLIVEf.exe
  2⤵
  PID:5496
- C:\Windows\System\WDNVFem.exe
  C:\Windows\System\WDNVFem.exe
  2⤵
  PID:13136
- C:\Windows\System\uyZFnIZ.exe
  C:\Windows\System\uyZFnIZ.exe
  2⤵
  PID:13432
- C:\Windows\System\HfXBEIJ.exe
  C:\Windows\System\HfXBEIJ.exe
  2⤵
  PID:13716
- C:\Windows\System\FlMwmAp.exe
  C:\Windows\System\FlMwmAp.exe
  2⤵
  PID:13804
- C:\Windows\System\HuUYjJm.exe
  C:\Windows\System\HuUYjJm.exe
  2⤵
  PID:12712
- C:\Windows\System\DUgTvSo.exe
  C:\Windows\System\DUgTvSo.exe
  2⤵
  PID:13896
- C:\Windows\System\XsoDbHS.exe
  C:\Windows\System\XsoDbHS.exe
  2⤵
  PID:12060
- C:\Windows\System\iBVShoY.exe
  C:\Windows\System\iBVShoY.exe
  2⤵
  PID:13968
- C:\Windows\System\rGRvVov.exe
  C:\Windows\System\rGRvVov.exe
  2⤵
  PID:4472
- C:\Windows\System\eHvmhwE.exe
  C:\Windows\System\eHvmhwE.exe
  2⤵
  PID:13612
- C:\Windows\System\XMrSbMd.exe
  C:\Windows\System\XMrSbMd.exe
  2⤵
  PID:11884
- C:\Windows\System\BcjcyPt.exe
  C:\Windows\System\BcjcyPt.exe
  2⤵
  PID:9436
- C:\Windows\System\VTgfmcI.exe
  C:\Windows\System\VTgfmcI.exe
  2⤵
  PID:5532
- C:\Windows\System\BKlaMqA.exe
  C:\Windows\System\BKlaMqA.exe
  2⤵
  PID:10844
- C:\Windows\System\ipukUYW.exe
  C:\Windows\System\ipukUYW.exe
  2⤵
  PID:12700
- C:\Windows\System\ASPdHuB.exe
  C:\Windows\System\ASPdHuB.exe
  2⤵
  PID:4032
- C:\Windows\System\mbVoUsS.exe
  C:\Windows\System\mbVoUsS.exe
  2⤵
  PID:904
- C:\Windows\System\APAUsVY.exe
  C:\Windows\System\APAUsVY.exe
  2⤵
  PID:14088
- C:\Windows\System\NdhlFul.exe
  C:\Windows\System\NdhlFul.exe
  2⤵
  PID:13364
- C:\Windows\System\kdszorq.exe
  C:\Windows\System\kdszorq.exe
  2⤵
  PID:10364
- C:\Windows\System\ToAoAAc.exe
  C:\Windows\System\ToAoAAc.exe
  2⤵
  PID:11992
- C:\Windows\System\zSzCBMZ.exe
  C:\Windows\System\zSzCBMZ.exe
  2⤵
  PID:5536
- C:\Windows\System\gZmCmuA.exe
  C:\Windows\System\gZmCmuA.exe
  2⤵
  PID:3480
- C:\Windows\System\mpNRwHP.exe
  C:\Windows\System\mpNRwHP.exe
  2⤵
  PID:8740
- C:\Windows\System\bkwqKnZ.exe
  C:\Windows\System\bkwqKnZ.exe
  2⤵
  PID:5516
- C:\Windows\System\lntpCBI.exe
  C:\Windows\System\lntpCBI.exe
  2⤵
  PID:13744
- C:\Windows\System\WZteKgj.exe
  C:\Windows\System\WZteKgj.exe
  2⤵
  PID:452
- C:\Windows\System\cgDzJxU.exe
  C:\Windows\System\cgDzJxU.exe
  2⤵
  PID:804
- C:\Windows\System\PfKKfsN.exe
  C:\Windows\System\PfKKfsN.exe
  2⤵
  PID:3916
- C:\Windows\System\gyHXtGE.exe
  C:\Windows\System\gyHXtGE.exe
  2⤵
  PID:9924
- C:\Windows\System\hXpjONu.exe
  C:\Windows\System\hXpjONu.exe
  2⤵
  PID:5112
- C:\Windows\System\yJYsfCV.exe
  C:\Windows\System\yJYsfCV.exe
  2⤵
  PID:4808

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:13480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y4sa3nsh.cdd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BIKMJkS.exe

Filesize
1.3MB

MD5
a3bcd0b2f885eadfec706a673a2c3cbf

SHA1
1349673734ee112d3170fdb58709eafbe1f01595

SHA256
1c49d338e11a03be9d4faa7cadc8982b8a8900e8da16762a7fca8e0ce22f4144

SHA512
a66b6f6b61649490a7e1481a88b43aad017c8445628085af0597e33ee93710716bcd9bae8492f6733be2c61a5e17166a2d10b49673cb4ea38389be1803b30dff

Download Submit
C:\Windows\System\BfzyffX.exe

Filesize
1.3MB

MD5
a8dd0de96dd3a589746a99b2618d57f5

SHA1
9967b87ca545ad28615afb0546e6293fab7c919b

SHA256
2e51bdd3c9fa9c055d61195dcedd910c9b8a6fd5d7240e69d2f2f491a49a0ba1

SHA512
76a88767902322622c5a67eb065de430b0e2814ce08201c3ed720b0119258f859aceb27aaa8de7492dcc4db87f35121a08724ebcf51e45537fa4a2835b998e05

Download Submit
C:\Windows\System\CLypqqv.exe

Filesize
1.3MB

MD5
9b4bac789ead64284d5d98c0d662f007

SHA1
6fd3c9cb76b70c2680928be7fda09bb5d008db30

SHA256
fc90579eda1d88133ccd48aaecfb9fb17315411fbdce86720e0066412017bed5

SHA512
53f17bec58d844faec09321969dde2fa54644dd8dffdbd6224ec48cc9b44c0d2e69405d5bce653e0418374aa316c45299cab13695addc1140986da928771f309

Download Submit
C:\Windows\System\FXYHIxB.exe

Filesize
1.3MB

MD5
159dddef182c06d081b58ac3b00e0724

SHA1
76c29a5bc20d89a178129541e04ddc2d0c318cf2

SHA256
632b655563d02205469035e513bb953af78c52bfb125430ec09a2d4b3acdd3e2

SHA512
328ddcec19e8d9b0c4943a3c993906d29cc4350e7db17966238c34e678d66c505e944d2efaa4bdfd60b90102e65ddee18c5cad1e1164ba85e21ec4fbf3ea0a9a

Download Submit
C:\Windows\System\IAJHUHK.exe

Filesize
1.3MB

MD5
717e040d5ec165a5d4dc61dcbbf9dfc5

SHA1
03562de707123f42531dd2e0f4802d9ffd7541e9

SHA256
ef349628a7a5223321f75af8dd966ec657938acf13589d4f19c05bf0cee5408c

SHA512
8412a8bf2154e4714af9d40818c1e1844ed697613327f2eb061d659224615b02004251b44b6522859aa175a08539b00475841d0ad57c7e316b6e0843a25386d8

Download Submit
C:\Windows\System\MPLkJvi.exe

Filesize
1.3MB

MD5
5b64cb7a190f3efc1575af6071ac49f3

SHA1
3287300a473a5f4d6f0c495cce1750a652b84a14

SHA256
227abc09e373a20e4906620fe0b0cc4d18467dd31dbd35c5d63105fdaf0d544e

SHA512
db498297edbe44f3abcb289769d1cf1c324d7fc9ba97752c5b4989f85f90ceb8bd616977f557b6a756229963b1fceeefced1f79c8e890b1d064fb79bf12ef6ca

Download Submit
C:\Windows\System\MUUuMzA.exe

Filesize
1.3MB

MD5
70b927d02ad5ff79dca4e8c0a30e9f53

SHA1
a1ab521074911ef79bec52700ab47b67005a2192

SHA256
942cb43cacd1d736b07902a3cdbbc2b7ed3eb0f09787228de1be20ee58c464b8

SHA512
5c2e07c6caf396ca31c91048cf1866e091e2e5e1a0bd223404fc507f51fa1e99d22e3b953415b1d998de3b0bf4f785ebb18643122573d72f4ef10a5a5c003965

Download Submit
C:\Windows\System\MZaPzrM.exe

Filesize
1.3MB

MD5
843a18b66cc743fe82eedb8efb045978

SHA1
90154e96c3212dfc5da65b2c4cc3bebab75755f3

SHA256
65cb1bff0b38f6ac9812b7900a9ab7f1cef04b19ba60a28346cc705d5c19a704

SHA512
d174679b20552b32c063660005586ddbcf009026bbab6d98650d48f1482a0e4fc3546428e588ebc5e540544f6d17e7cc096bc3aead40a4b063dd209309c2d712

Download Submit
C:\Windows\System\TbemplI.exe

Filesize
1.3MB

MD5
55d850f1908700f4e90f9f62e9d7a167

SHA1
eb94ca6fa302cf9d6c5b86e8946467eebd774bb1

SHA256
41d93295e676f72237a875fa91490433127d33384b71028e9a6e6e6adc4b3a58

SHA512
e38f6b56634dc2c3d05682d93347499c044eca3db97a4019f116163ae9f28851dbaa3566973256f32c3133cb237d94137f6872d60ea3d1827e183265c2a40a2d

Download Submit
C:\Windows\System\UMQLTKg.exe

Filesize
1.3MB

MD5
549cfaf91438d307039ae09989e9e558

SHA1
8f519364146aa7e02768340d94559a7288c02f2d

SHA256
dae7d6d45741999855caf71c935e700ee9dd28580f0d3f2718ce2ddad91a470a

SHA512
f1707e599f77b770c4df51170284f0db30030acbd931db8b1d8f0be1e4f5713b2d3e8fa1d69e75f7203a4b7651caad5515d78b131fded26bc9cd9c743917bdeb

Download Submit
C:\Windows\System\VJiUbUl.exe

Filesize
1.3MB

MD5
cf92645fd85ed8ff33bc34d2203ee152

SHA1
7bb2305d0293898457fab25e1c4a3957ef93a88f

SHA256
e8fb4d235c8e65f750e64855e5c364513a9130b97f0940445ca2c4aefe6f95c6

SHA512
bb9aa48b8fd01665fda371db89e51aab72ac63221a0e9dfc9a2980f5025cb5504d31f28f0aa41172b8e90cd43a2265ac842521bb8006902a410f5e00a60b3c67

Download Submit
C:\Windows\System\VYZSjlz.exe

Filesize
1.3MB

MD5
1370049e21fbaea762c9304ae0e5a3a4

SHA1
ef18c2ee367f95644ca97536b30119ad20276b2e

SHA256
f95d8907416b8abaa28ef0bab12033c3f05e68a78cf74ced61ec93b89636d7cd

SHA512
2dbfed5aa53022e93ea30f4b16b054b20d9741b07179dce2d952667f2517f5530b550ef49b04e49655e423cf500668d96480f4125a14b657672a4a327a0bf827

Download Submit
C:\Windows\System\WRoOMNd.exe

Filesize
1.3MB

MD5
e5ceb8798cfc1a4f8da4e0cf27c4de7b

SHA1
b1885e87ce757835d4de81427b3d5352d43d2ab9

SHA256
d9dc4dc532c86190077651ec4fe29424698fc51e0132ea38f6a927e32388cb10

SHA512
1e610400971c829576379b124bca60865d36c12ca95bbbda95b4a4e5dbe7c7eb3207443ae58928436814a8863efeef6f0a5e809ad0c76b6f5387be9ee6816eac

Download Submit
C:\Windows\System\WceBYfR.exe

Filesize
1.3MB

MD5
12423e45ca6769cff0714b55ff84cd76

SHA1
f34e16aec7fa87ec041808d2f4e52297fe8416e7

SHA256
52c81b933a08a6c9c84fdae26ea469d928efcb18e6926570be37184abce1bb89

SHA512
747f9563f93764bb124607a2ae709336294b15532dee2bc788773452ed3291d20eb17ccc7575db6950e35a40f7d788b3bb34eb963c1d7b4dfe00c2c11ec6e075

Download Submit
C:\Windows\System\WkSlnEb.exe

Filesize
1.3MB

MD5
786ef9253431c3fb952821593a6e8394

SHA1
dc7724c41f1919e181204c384666e3c901cd08f6

SHA256
58484ac6314898d61aeeb93bd88707726930e7d854c264d743adf1802a1a6ba9

SHA512
c6566088a4cbe80f9000a172bcc1b21076eb742eb92780b18d0e0b0fa25bfab805c3fad533ac74f9287e05c9b76bdca082aca9860e41c4c6f113fafbb5466699

Download Submit
C:\Windows\System\XkmyFwb.exe

Filesize
1.3MB

MD5
aa386e864705974f18167c8045d609d5

SHA1
5114ddf1868067c34547223757add2c14781e168

SHA256
c170dc17ed30e7ff541dc4d95ae0965ea674b17a84c09e3189ee9da04db330e2

SHA512
393d0faa80c1fe3d0d00f5845b595de7d6a3b55af8172085044ab22e1d6d24d1cab71086bbf9ea86a7b160da62a3f7e3d64573681c5a571ac14c97e23b1da146

Download Submit
C:\Windows\System\YPTBupQ.exe

Filesize
1.3MB

MD5
0590ad2bb0bccb1a472bbe458ec7779c

SHA1
8be9d8b9c44646a0c52ba09dfea1abd0a244b2d4

SHA256
1e89de09b0a1dbbd4c651030f5157cb77c376eded7d66f236b1a56507c2c4ba3

SHA512
6dd9b13d51e7b1bc338f66fdea27502e90f11710a988439f6a70d035cf68b58dc41339388ef600f9089d8a52462d782cba24dd353072877795eefb317a64af9b

Download Submit
C:\Windows\System\aICdOUI.exe

Filesize
1.3MB

MD5
d8bf27383f33a4dcd2e136cdfc5015d0

SHA1
acdc1408c683c9fb61ccd505928d9af0eb2703ac

SHA256
e8f0753f2a2ab2085d24e377fe90acff4790551784fc4d1a82b86c32a67981d2

SHA512
b5360336e87960bfa9bf9ac0159bfb255d533fb54355f68a668262b17e1b535b76d39d2f79216552f2b8430540db6c8ff5ed7bb401b2df54a5aa70fb02f5daaa

Download Submit
C:\Windows\System\brGeavp.exe

Filesize
1.3MB

MD5
0d514801cc43f6fa7b8ecf3efeac018d

SHA1
32c829f8cd7266b310fa4fddc7c72c75ed1cda65

SHA256
91c1112a5f7ddc81e0ce837381228e714b891618c864f6d3babb52a1bdc059bb

SHA512
e82d2f649b1c6c4630434916ccfc5fc46c9f09c9bc63b3f8ddc0399ebf80986ab19033ad7cde40c2396cd0d0d346821ea4d35ff934078dbe6cf05d56875f96b1

Download Submit
C:\Windows\System\hOxvytw.exe

Filesize
1.3MB

MD5
9275c014afdff4e661d6c19465cb02ea

SHA1
913065e7340f6ec1b6da1fed7bbd6d8bf2dff092

SHA256
2f2faa2ab5d579194ce727cd50cc966e179b879618eb749cd9a0e3282f0f2c12

SHA512
b60b1936e8809e68972f3310bc0b29b034748afa2c61942caf7189ab6e743cc009c78e9a5625099c488167ea68aea5c980db3b75522a7006bba3cb1ca32b849d

Download Submit
C:\Windows\System\hksiJAo.exe

Filesize
1.3MB

MD5
79c8186f0dd47b62aea9261ab33cae5a

SHA1
6a10ac12c73e17117e937054b149464cf46b968b

SHA256
ef11ebddd039d5411617261c0a848f84079f562bec3913cd35132b476b9f3178

SHA512
2ba0d91a8f14e659d00e81bef3172aefe08f4dcfc7caacf0d7c32096736cddfe299929708d1c5e7a07f677d11a99cf5a7ac2e3a2e78c6d5bf98b54d0ef6b70ed

Download Submit
C:\Windows\System\iYkJurX.exe

Filesize
1.3MB

MD5
e3e97d2fc8a625a84886d813238df50b

SHA1
12517987466b4f4711cb9f2a2a3effa587caa994

SHA256
f1e5bc0fc9c14d49d286e96f58470854f08efbe7f738067a5cf046797b3d66c8

SHA512
8a3e2a989c3273c10869f1733cd8d16c541110771f8b6f9f08b21607950a036fcafd5c80d03ef1ad94b85f6cffcbcf58a8699d8662d3bf85c702c2ee9cdaa885

Download Submit
C:\Windows\System\jNZoNKC.exe

Filesize
1.3MB

MD5
714aed814ebdf1c6f7c465e14ec57936

SHA1
47c059d9e6485c90a4f0cffacc3bcaf8394a3959

SHA256
d8b04386e5c3d01e7d198b84f44c6a64e9f63ef01cc66b4b06181756ba2e8c43

SHA512
f9a3dd22b1aa7e8505962fb35bfac553602b9a6dbe80c65adb32ada49fb45f1eb646e976dd0ad66a0183a33c12a981cfe84a0571ef2c8bc7f4d2cca9a1d0cb54

Download Submit
C:\Windows\System\kALawlS.exe

Filesize
1.3MB

MD5
a3f61ce3bf4b064d4896b44b21a56ba9

SHA1
80c8f69c88f2eb9f803c4ae8b7dd223cd2ababf5

SHA256
afbcf538a39df139f9226d1252bd22dbd9f5f4104faa67599370732e6d9f1239

SHA512
6714a43de3872cbb105e1274452cb7bf534f0439fa96f679161e84b38139fb2a448c5afd14a592ecf753c7782d98043d0e7b1acb7d1a53a22bbe150e0fd25413

Download Submit
C:\Windows\System\kIJmxLp.exe

Filesize
1.3MB

MD5
696fc8f425a418f492cd56f8210a9e8a

SHA1
72f7d3eebb49d2e67e543b527e332cf158bbc03a

SHA256
a90fbff4e3f65a225a166d2d3b6cdb179a6235f06feb75cd5553ddfac37d2f85

SHA512
a5504c4497d1734b5c242cab1f87b52181b4266b1bfccb83dfb755759b204489dbd72bc06ad89d7c5cf1b4e55c747650be34ff823210b76c5200c803217943c9

Download Submit
C:\Windows\System\ltFVyxx.exe

Filesize
1.3MB

MD5
1a7a68f1a079f6f6e4c8601ab83c4ef8

SHA1
0c6db9846d3e9600f03e533458de83266c9cd0b2

SHA256
a6b35fd539568459a114443181ae3fc3ecd9fed88d3913e281e38faea11ba49d

SHA512
e8ec63711b358255910191a59c5aa7f7b78254c93a390e4a7e750dbf348ff49f19a09c02569be36ff628ee8a4a96df5da6467f5f5c487631ebd7a2f1195727a2

Download Submit
C:\Windows\System\neVdnMw.exe

Filesize
1.3MB

MD5
6c3e08a80e9d3e884fe5dad656beeb2b

SHA1
9a5eab131ec1dc1d4ff38bbddf2bb4eefc5a129c

SHA256
5856720972d174072287e5bb4d4d0510b185764d74406289eb2528a76c97574f

SHA512
e130a6c88af50747332e0aff64cc9293962674f5e47a2664cfcc1a7a4bb2433423d3df84c1ef4255a5f18550b0a2f930ecd5e75c99106e4c79587311db9c3af8

Download Submit
C:\Windows\System\nrszXWq.exe

Filesize
1.3MB

MD5
a0c7d9211c23a241ced4cf0d56ac5bf3

SHA1
fbae433f1e9f2b47b23502e2f0fc141583edcfc1

SHA256
5c509f767992517984535b0b463c6a218ee3a779307a3ed196c95278d7eb6216

SHA512
2a7809c6f08b484a9663b60ed06c0f5658b5ba9f0e46c7554bb8c83bb8bc869bf385a6ace3da97f599ea36b0a409db6410236e5e992614f4715c7e231a8d5a84

Download Submit
C:\Windows\System\rOaWRxk.exe

Filesize
1.3MB

MD5
ebd9b4f4642e20e1b17028f5cb3df213

SHA1
a5df2444f24709be9c35192f26f067e78e4e4f1f

SHA256
4d4fa4f503ef7d174bf7fb0136731e6f45254cf0b892d90ce81ff3ebf8f153e6

SHA512
6f1afc3594d19565b3412508befa93333abe0e34e44ef26730ce97d4590c2e2c82afcabed139c41a953c2f5e0395c13f75b556329fd6eae85837749592164f87

Download Submit
C:\Windows\System\sizJyqh.exe

Filesize
1.3MB

MD5
0adf4d4b827f2095a878f0252b1ea728

SHA1
1f4638dd911eab60f6eae63f3c5b344b6568104a

SHA256
d9be6afa05a8b4807b42c34435885c29428f108d294a489f7ac0ec9fd79eaf29

SHA512
5f12f6d8c801f8433c984b536677a9d58db00c3f2682595edd9deab27d28621d5bbcd91ee82cb1a7b59f8f6b569697b8a950a67d1bddffafb9c3db157c764f63

Download Submit
C:\Windows\System\subnRCi.exe

Filesize
1.3MB

MD5
19859e94a818f5b67a2e34994f3b54f8

SHA1
70a494c9e0ae0f75d73465a3fd122bcb7082120f

SHA256
7436f13deea4cfce93f70eb569a3fba4f3bcfd16a57471129a1f648c3715ad08

SHA512
3bb4753b66ebdbd9eb450af6332bc2432aec257a6754ea74fefd232b7905e7513b12c780e43ced927df4ce653db5cff817f67ea84efc0c851a26063729bfdc5a

Download Submit
C:\Windows\System\tXGCgKE.exe

Filesize
1.3MB

MD5
c902cab71464ef5e613067ea1a26a8b4

SHA1
8f018a29eb6517e9dde41bf03fddbb69a7a658fd

SHA256
798a6701c5780cdd242ef339bc5223d6e72f0756c9da18f3379376f7ea4129bb

SHA512
c8b9bb535d72ff6a6a9a11f3d23b3fd23da66cec02fdf071b0257df485d5a98363fbf82662b6a579965ac14a2451b38577aafa5577722dfc3643d3f821dbe9d5

Download Submit
C:\Windows\System\uDITNdX.exe

Filesize
1.3MB

MD5
7ec4b181548b4bb4fa17f2b0a1e786ca

SHA1
f9a43b884422a789213b5b9866b18944c67e7f84

SHA256
fcc4f3e56cdaf420185b40bae7d4a88c4497a892da9a61e905793ec87cf949b8

SHA512
06d69b6bc8f39f27a69be1342a2e7cecd476fce88200e9f1a1cef392208ebfedc7cfe6e2b142c679c8d03d65ba7061abb460124a16347178a3b1c09bd4026f1a

Download Submit
C:\Windows\System\xgIYkfZ.exe

Filesize
1.3MB

MD5
48c07605219b8f6de4fbd798cc054aad

SHA1
510cac93fe6ad272c30f622919142f5d20862308

SHA256
495a4e1e95ae24a179840eb133f95fcbab227ffec19cab4f33d24858d927cec8

SHA512
8ded85d1b67e21bb432233939ae823f1575d7bc6ed8a1f35a5196f17ba07f217aa099ef38624866a5a5e56fc8ecc5ebc2eb1941ae1a2590ec3fecb929e382955

Download Submit
C:\Windows\System\yDSoOdk.exe

Filesize
1.3MB

MD5
60951621b31969d8e0bab685c0742e30

SHA1
290e17c8612318f51455d8534910000a09c36db5

SHA256
6ab2667e0297fa13f1ce534930276490a65a6e54a28fd8a0c4a70aef0ea537fc

SHA512
3c799220bdcd8c45d71d454773a78e05473df09a29978a37cf74c495171148a053f0d9eb449be1ef8040e66fe3756e6b1d956d21ff4e85e4b30dafb3c372ee9f

Download Submit
C:\Windows\System\yczmnmT.exe

Filesize
1.3MB

MD5
723b17d27aa81d9cba98f7ebfc8cc6ea

SHA1
22f2fb2d5a7584a18d961ea79e7df5c053e8b083

SHA256
e285d7436dada6228a0eb8f0c98dc66245aebe790deaef3f88dc2fd81a0aa6f7

SHA512
4ea624da0b06dd49bd3464ecf0cd0a18e3e28284cd128832f3f1283578d2dddcc5d9e42f93e117e876c80cf8f9c6e3e28a194f5be0218292d01d9651e58a07cb

Download Submit
C:\Windows\System\ymuVxeU.exe

Filesize
1.3MB

MD5
8423e7c37d2c190bbeafa501e9853b69

SHA1
53af5d1efa680cba6a95b27962d7f6dc656ea864

SHA256
7436c57bf20373d06536e301a9fcc7587db6860e537dbb2d4090a64f9197cb46

SHA512
723e713e46d684c8fc9ab088b697b825194f9eb32b1a36ed09153f7010806bbfbe8aa263ee811c0e3a2d03797fae20535028ce2396457417bfb3b09a783a4796

Download Submit
C:\Windows\System\zxpzQAE.exe

Filesize
8B

MD5
dbf4b2bc48179622c6577370619233f8

SHA1
9f7e18ffe46e0a1e380d04af3bbfc6f315ce80a1

SHA256
1fbf1f9f7f7842891151713f30b367cffec488ea36dc866c7fa8cf719141342a

SHA512
15b91ffe21366637f32ece688a7f3e263afa8104af4020271de5ae532ecbc3198516e7a018548a1dd8ee525394a80425bf8c6bace328002d82a85c06b94f8920

Download Submit
memory/392-3932-0x00007FF68FAC0000-0x00007FF68FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/392-431-0x00007FF68FAC0000-0x00007FF68FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/880-3864-0x00007FF71B070000-0x00007FF71B462000-memory.dmp

Filesize
3.9MB

Download
memory/880-436-0x00007FF71B070000-0x00007FF71B462000-memory.dmp

Filesize
3.9MB

Download
memory/1016-3817-0x00007FF7682B0000-0x00007FF7686A2000-memory.dmp

Filesize
3.9MB

Download
memory/1016-21-0x00007FF7682B0000-0x00007FF7686A2000-memory.dmp

Filesize
3.9MB

Download
memory/1320-3856-0x00007FF63E470000-0x00007FF63E862000-memory.dmp

Filesize
3.9MB

Download
memory/1320-255-0x00007FF63E470000-0x00007FF63E862000-memory.dmp

Filesize
3.9MB

Download
memory/1368-420-0x00007FF62FD70000-0x00007FF630162000-memory.dmp

Filesize
3.9MB

Download
memory/1368-3859-0x00007FF62FD70000-0x00007FF630162000-memory.dmp

Filesize
3.9MB

Download
memory/1420-0-0x00007FF656370000-0x00007FF656762000-memory.dmp

Filesize
3.9MB

Download
memory/1420-1-0x000001E64BD30000-0x000001E64BD40000-memory.dmp

Filesize
64KB

Download
memory/1664-423-0x00007FF7580F0000-0x00007FF7584E2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-3866-0x00007FF7580F0000-0x00007FF7584E2000-memory.dmp

Filesize
3.9MB

Download
memory/1836-330-0x00007FF75FF90000-0x00007FF760382000-memory.dmp

Filesize
3.9MB

Download
memory/1836-3868-0x00007FF75FF90000-0x00007FF760382000-memory.dmp

Filesize
3.9MB

Download
memory/2012-445-0x00007FF706610000-0x00007FF706A02000-memory.dmp

Filesize
3.9MB

Download
memory/2012-3822-0x00007FF706610000-0x00007FF706A02000-memory.dmp

Filesize
3.9MB

Download
memory/2104-3825-0x00007FF6181E0000-0x00007FF6185D2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-338-0x00007FF6181E0000-0x00007FF6185D2000-memory.dmp

Filesize
3.9MB

Download
memory/2412-439-0x00007FF6E7B60000-0x00007FF6E7F52000-memory.dmp

Filesize
3.9MB

Download
memory/2412-3919-0x00007FF6E7B60000-0x00007FF6E7F52000-memory.dmp

Filesize
3.9MB

Download
memory/2488-3928-0x00007FF6EC7F0000-0x00007FF6ECBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2488-441-0x00007FF6EC7F0000-0x00007FF6ECBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-440-0x00007FF678710000-0x00007FF678B02000-memory.dmp

Filesize
3.9MB

Download
memory/2780-3926-0x00007FF678710000-0x00007FF678B02000-memory.dmp

Filesize
3.9MB

Download
memory/2812-437-0x00007FF766E40000-0x00007FF767232000-memory.dmp

Filesize
3.9MB

Download
memory/2812-3858-0x00007FF766E40000-0x00007FF767232000-memory.dmp

Filesize
3.9MB

Download
memory/2876-3862-0x00007FF719130000-0x00007FF719522000-memory.dmp

Filesize
3.9MB

Download
memory/2876-444-0x00007FF719130000-0x00007FF719522000-memory.dmp

Filesize
3.9MB

Download
memory/3088-47-0x00007FF63A310000-0x00007FF63A702000-memory.dmp

Filesize
3.9MB

Download
memory/3088-3819-0x00007FF63A310000-0x00007FF63A702000-memory.dmp

Filesize
3.9MB

Download
memory/3152-3947-0x00007FF755270000-0x00007FF755662000-memory.dmp

Filesize
3.9MB

Download
memory/3152-438-0x00007FF755270000-0x00007FF755662000-memory.dmp

Filesize
3.9MB

Download
memory/3224-3815-0x00007FF633570000-0x00007FF633962000-memory.dmp

Filesize
3.9MB

Download
memory/3224-18-0x00007FF633570000-0x00007FF633962000-memory.dmp

Filesize
3.9MB

Download
memory/3228-421-0x00007FF7D2760000-0x00007FF7D2B52000-memory.dmp

Filesize
3.9MB

Download
memory/3228-3853-0x00007FF7D2760000-0x00007FF7D2B52000-memory.dmp

Filesize
3.9MB

Download
memory/3288-3893-0x00007FF633110000-0x00007FF633502000-memory.dmp

Filesize
3.9MB

Download
memory/3288-442-0x00007FF633110000-0x00007FF633502000-memory.dmp

Filesize
3.9MB

Download
memory/3484-3849-0x00007FF70C960000-0x00007FF70CD52000-memory.dmp

Filesize
3.9MB

Download
memory/3484-340-0x00007FF70C960000-0x00007FF70CD52000-memory.dmp

Filesize
3.9MB

Download
memory/3492-415-0x00007FF637820000-0x00007FF637C12000-memory.dmp

Filesize
3.9MB

Download
memory/3492-3870-0x00007FF637820000-0x00007FF637C12000-memory.dmp

Filesize
3.9MB

Download
memory/4004-261-0x00007FF750D90000-0x00007FF751182000-memory.dmp

Filesize
3.9MB

Download
memory/4004-3823-0x00007FF750D90000-0x00007FF751182000-memory.dmp

Filesize
3.9MB

Download
memory/4012-242-0x00007FFF04090000-0x00007FFF04B51000-memory.dmp

Filesize
10.8MB

Download
memory/4012-237-0x0000011BD0D60000-0x0000011BD0D82000-memory.dmp

Filesize
136KB

Download
memory/4012-39-0x00007FFF04093000-0x00007FFF04095000-memory.dmp

Filesize
8KB

Download
memory/4012-157-0x00007FFF04090000-0x00007FFF04B51000-memory.dmp

Filesize
10.8MB

Download
memory/4104-341-0x00007FF796B90000-0x00007FF796F82000-memory.dmp

Filesize
3.9MB

Download
memory/4104-3850-0x00007FF796B90000-0x00007FF796F82000-memory.dmp

Filesize
3.9MB

Download
memory/5020-443-0x00007FF71B560000-0x00007FF71B952000-memory.dmp

Filesize
3.9MB

Download
memory/5020-3813-0x00007FF71B560000-0x00007FF71B952000-memory.dmp

Filesize
3.9MB

Download