xmrig | 41f2d59470d3bc6cc42ab12e58444554b00e450db4180f6a29cfcc2cecf94129

Analysis

max time kernel
121s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
Size

1.3MB
MD5

431a817a43658d7123aab89b6febea90
SHA1

a1ba7c1d1442d803f79e2f34814f910bb3a457d4
SHA256

41f2d59470d3bc6cc42ab12e58444554b00e450db4180f6a29cfcc2cecf94129
SHA512

f3d9dd356773ff775c534e38de00a6763d68e5eeb99c2d3837190bd71417bb5267a4ed18a7d804b790cc406152fe02fc1605f0d4112e9cc2df267476fa2edea4
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWLs2Yuzff9TS:Lz071uv4BPMkyW10/wKe6Ww5WdTS

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/4008-317-0x00007FF674C60000-0x00007FF675052000-memory.dmp	xmrig
behavioral2/memory/1556-330-0x00007FF7DA620000-0x00007FF7DAA12000-memory.dmp	xmrig
behavioral2/memory/1692-335-0x00007FF7081B0000-0x00007FF7085A2000-memory.dmp	xmrig
behavioral2/memory/1348-341-0x00007FF7BFC90000-0x00007FF7C0082000-memory.dmp	xmrig
behavioral2/memory/4416-403-0x00007FF6EFCD0000-0x00007FF6F00C2000-memory.dmp	xmrig
behavioral2/memory/3624-452-0x00007FF7317D0000-0x00007FF731BC2000-memory.dmp	xmrig
behavioral2/memory/740-456-0x00007FF72ED60000-0x00007FF72F152000-memory.dmp	xmrig
behavioral2/memory/2104-455-0x00007FF6D74F0000-0x00007FF6D78E2000-memory.dmp	xmrig
behavioral2/memory/4716-344-0x00007FF696930000-0x00007FF696D22000-memory.dmp	xmrig
behavioral2/memory/4548-343-0x00007FF6323D0000-0x00007FF6327C2000-memory.dmp	xmrig
behavioral2/memory/2348-342-0x00007FF741400000-0x00007FF7417F2000-memory.dmp	xmrig
behavioral2/memory/1872-340-0x00007FF6E1740000-0x00007FF6E1B32000-memory.dmp	xmrig
behavioral2/memory/4588-339-0x00007FF6DC530000-0x00007FF6DC922000-memory.dmp	xmrig
behavioral2/memory/1152-338-0x00007FF79D370000-0x00007FF79D762000-memory.dmp	xmrig
behavioral2/memory/1136-337-0x00007FF755EF0000-0x00007FF7562E2000-memory.dmp	xmrig
behavioral2/memory/2892-336-0x00007FF6DE5D0000-0x00007FF6DE9C2000-memory.dmp	xmrig
behavioral2/memory/1648-334-0x00007FF685700000-0x00007FF685AF2000-memory.dmp	xmrig
behavioral2/memory/2696-333-0x00007FF6E0610000-0x00007FF6E0A02000-memory.dmp	xmrig
behavioral2/memory/372-332-0x00007FF672A40000-0x00007FF672E32000-memory.dmp	xmrig
behavioral2/memory/2188-331-0x00007FF607650000-0x00007FF607A42000-memory.dmp	xmrig
behavioral2/memory/3804-71-0x00007FF6CF920000-0x00007FF6CFD12000-memory.dmp	xmrig
behavioral2/memory/4876-17-0x00007FF7652D0000-0x00007FF7656C2000-memory.dmp	xmrig
behavioral2/memory/4876-2971-0x00007FF7652D0000-0x00007FF7656C2000-memory.dmp	xmrig
behavioral2/memory/3804-2973-0x00007FF6CF920000-0x00007FF6CFD12000-memory.dmp	xmrig
behavioral2/memory/668-2975-0x00007FF63F420000-0x00007FF63F812000-memory.dmp	xmrig
behavioral2/memory/4716-2977-0x00007FF696930000-0x00007FF696D22000-memory.dmp	xmrig
behavioral2/memory/4416-2979-0x00007FF6EFCD0000-0x00007FF6F00C2000-memory.dmp	xmrig
behavioral2/memory/2188-2995-0x00007FF607650000-0x00007FF607A42000-memory.dmp	xmrig
behavioral2/memory/4008-2994-0x00007FF674C60000-0x00007FF675052000-memory.dmp	xmrig
behavioral2/memory/372-2997-0x00007FF672A40000-0x00007FF672E32000-memory.dmp	xmrig
behavioral2/memory/2892-3001-0x00007FF6DE5D0000-0x00007FF6DE9C2000-memory.dmp	xmrig
behavioral2/memory/1872-3005-0x00007FF6E1740000-0x00007FF6E1B32000-memory.dmp	xmrig
behavioral2/memory/1348-3009-0x00007FF7BFC90000-0x00007FF7C0082000-memory.dmp	xmrig
behavioral2/memory/740-3012-0x00007FF72ED60000-0x00007FF72F152000-memory.dmp	xmrig
behavioral2/memory/4548-3007-0x00007FF6323D0000-0x00007FF6327C2000-memory.dmp	xmrig
behavioral2/memory/1136-3003-0x00007FF755EF0000-0x00007FF7562E2000-memory.dmp	xmrig
behavioral2/memory/1152-2999-0x00007FF79D370000-0x00007FF79D762000-memory.dmp	xmrig
behavioral2/memory/3624-2990-0x00007FF7317D0000-0x00007FF731BC2000-memory.dmp	xmrig
behavioral2/memory/2696-2987-0x00007FF6E0610000-0x00007FF6E0A02000-memory.dmp	xmrig
behavioral2/memory/1648-2984-0x00007FF685700000-0x00007FF685AF2000-memory.dmp	xmrig
behavioral2/memory/1692-2982-0x00007FF7081B0000-0x00007FF7085A2000-memory.dmp	xmrig
behavioral2/memory/1556-2992-0x00007FF7DA620000-0x00007FF7DAA12000-memory.dmp	xmrig
behavioral2/memory/2104-2986-0x00007FF6D74F0000-0x00007FF6D78E2000-memory.dmp	xmrig
behavioral2/memory/2348-3050-0x00007FF741400000-0x00007FF7417F2000-memory.dmp	xmrig
behavioral2/memory/4588-3063-0x00007FF6DC530000-0x00007FF6DC922000-memory.dmp	xmrig
behavioral2/memory/3076-3064-0x00007FF6AED90000-0x00007FF6AF182000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3848	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4876	Jarjyot.exe
4716	jAeeAdk.exe
668	QdCzjLk.exe
3804	iusoihH.exe
4416	dwccSwD.exe
3076	CCXLpnu.exe
4008	NJTqeFP.exe
3624	lbDuEPy.exe
1556	CeJiHBn.exe
2188	KyMIcJG.exe
372	EaMOgnz.exe
2696	MtwfMnr.exe
1648	fWPbKhE.exe
1692	vcqouFx.exe
2104	rswmGTd.exe
2892	epDZoPI.exe
1136	RmFQgiM.exe
1152	cZnlaLG.exe
4588	UmLhxtZ.exe
1872	NnJiRnK.exe
1348	JQpQoqD.exe
740	wCKIqnj.exe
2348	jFmEcZA.exe
4548	fIjVJpV.exe
3480	MrBASEH.exe
4564	mjXehCT.exe
4704	pgcfZPl.exe
1340	dAFjGUn.exe
3008	SIDlUfC.exe
1528	fwfnfSl.exe
2384	jwMRFEp.exe
2092	RQOZiaU.exe
3476	KojtlgL.exe
1164	NLfdKqO.exe
1372	TXcKeXC.exe
32	uCkPgFH.exe
4284	TdoZycT.exe
4960	jnEtKtG.exe
408	DSVQLZU.exe
4532	XZYpgPy.exe
2232	FMIZdGo.exe
2984	RrqsVrV.exe
5048	SyOltkE.exe
3852	DooAeUL.exe
4476	kdmGbfO.exe
3036	UBshjuV.exe
5080	nICzvIx.exe
1148	mmTfPrB.exe
4444	dGzEUIX.exe
4452	TSiWsbe.exe
3924	thOdiuk.exe
3400	jqqWtSl.exe
2948	fLQqBAd.exe
772	aLAuGQo.exe
1788	Lhcluzp.exe
3916	yEiWznK.exe
3468	PQLOptE.exe
5032	zrzRiQq.exe
3540	ZnjKBAs.exe
4732	CfwBweg.exe
3828	GnuFeaD.exe
1724	QiNhJPE.exe
3920	WTyoPGA.exe
3496	LaAjrBE.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3032-0-0x00007FF75A160000-0x00007FF75A552000-memory.dmp	upx
behavioral2/files/0x0007000000023414-8.dat	upx
behavioral2/files/0x0007000000023416-25.dat	upx
behavioral2/files/0x0007000000023418-54.dat	upx
behavioral2/files/0x000700000002341e-56.dat	upx
behavioral2/files/0x0007000000023422-81.dat	upx
behavioral2/files/0x0007000000023431-144.dat	upx
behavioral2/files/0x000700000002342f-187.dat	upx
behavioral2/memory/4008-317-0x00007FF674C60000-0x00007FF675052000-memory.dmp	upx
behavioral2/memory/1556-330-0x00007FF7DA620000-0x00007FF7DAA12000-memory.dmp	upx
behavioral2/memory/1692-335-0x00007FF7081B0000-0x00007FF7085A2000-memory.dmp	upx
behavioral2/memory/1348-341-0x00007FF7BFC90000-0x00007FF7C0082000-memory.dmp	upx
behavioral2/memory/4416-403-0x00007FF6EFCD0000-0x00007FF6F00C2000-memory.dmp	upx
behavioral2/memory/3624-452-0x00007FF7317D0000-0x00007FF731BC2000-memory.dmp	upx
behavioral2/memory/740-456-0x00007FF72ED60000-0x00007FF72F152000-memory.dmp	upx
behavioral2/memory/2104-455-0x00007FF6D74F0000-0x00007FF6D78E2000-memory.dmp	upx
behavioral2/memory/4716-344-0x00007FF696930000-0x00007FF696D22000-memory.dmp	upx
behavioral2/memory/4548-343-0x00007FF6323D0000-0x00007FF6327C2000-memory.dmp	upx
behavioral2/memory/2348-342-0x00007FF741400000-0x00007FF7417F2000-memory.dmp	upx
behavioral2/memory/1872-340-0x00007FF6E1740000-0x00007FF6E1B32000-memory.dmp	upx
behavioral2/memory/4588-339-0x00007FF6DC530000-0x00007FF6DC922000-memory.dmp	upx
behavioral2/memory/1152-338-0x00007FF79D370000-0x00007FF79D762000-memory.dmp	upx
behavioral2/memory/1136-337-0x00007FF755EF0000-0x00007FF7562E2000-memory.dmp	upx
behavioral2/memory/2892-336-0x00007FF6DE5D0000-0x00007FF6DE9C2000-memory.dmp	upx
behavioral2/memory/1648-334-0x00007FF685700000-0x00007FF685AF2000-memory.dmp	upx
behavioral2/memory/2696-333-0x00007FF6E0610000-0x00007FF6E0A02000-memory.dmp	upx
behavioral2/memory/372-332-0x00007FF672A40000-0x00007FF672E32000-memory.dmp	upx
behavioral2/memory/2188-331-0x00007FF607650000-0x00007FF607A42000-memory.dmp	upx
behavioral2/files/0x0007000000023436-182.dat	upx
behavioral2/files/0x0007000000023435-181.dat	upx
behavioral2/files/0x0008000000023410-180.dat	upx
behavioral2/files/0x0007000000023428-177.dat	upx
behavioral2/files/0x0007000000023434-173.dat	upx
behavioral2/files/0x000700000002342b-171.dat	upx
behavioral2/files/0x0007000000023426-169.dat	upx
behavioral2/files/0x0007000000023420-164.dat	upx
behavioral2/files/0x000700000002342a-161.dat	upx
behavioral2/files/0x0007000000023429-156.dat	upx
behavioral2/files/0x0007000000023433-152.dat	upx
behavioral2/files/0x0007000000023424-150.dat	upx
behavioral2/files/0x0007000000023430-143.dat	upx
behavioral2/files/0x000700000002342e-136.dat	upx
behavioral2/files/0x000700000002342d-132.dat	upx
behavioral2/files/0x000700000002342c-129.dat	upx
behavioral2/files/0x0007000000023427-128.dat	upx
behavioral2/files/0x0007000000023423-154.dat	upx
behavioral2/files/0x0007000000023432-149.dat	upx
behavioral2/files/0x000700000002341f-120.dat	upx
behavioral2/files/0x0007000000023421-102.dat	upx
behavioral2/memory/3076-101-0x00007FF6AED90000-0x00007FF6AF182000-memory.dmp	upx
behavioral2/files/0x000700000002341b-93.dat	upx
behavioral2/files/0x0007000000023417-89.dat	upx
behavioral2/files/0x0007000000023425-88.dat	upx
behavioral2/files/0x0007000000023419-82.dat	upx
behavioral2/files/0x000700000002341d-107.dat	upx
behavioral2/files/0x000700000002341c-72.dat	upx
behavioral2/memory/3804-71-0x00007FF6CF920000-0x00007FF6CFD12000-memory.dmp	upx
behavioral2/files/0x000700000002341a-70.dat	upx
behavioral2/files/0x0007000000023413-43.dat	upx
behavioral2/memory/668-42-0x00007FF63F420000-0x00007FF63F812000-memory.dmp	upx
behavioral2/files/0x0007000000023415-32.dat	upx
behavioral2/memory/4876-17-0x00007FF7652D0000-0x00007FF7656C2000-memory.dmp	upx
behavioral2/files/0x000600000002328f-6.dat	upx
behavioral2/memory/4876-2971-0x00007FF7652D0000-0x00007FF7656C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zOSrSWB.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\mMhkWcN.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\JGQWVbE.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\QDdwbvh.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\CIMJVcT.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\efrjbyY.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\IMsjhre.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\FMIZdGo.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\xmZpOiH.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\NCYEoCl.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\habNNRd.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\iVaHfMr.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\scirmnf.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\HztHqqW.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\fWPbKhE.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\TclVLxV.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\JZOMPtn.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\npStaXu.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\MbKlMMn.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\MlYsDZz.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\mDCmbIp.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\fkWVCwh.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\aoVbjnI.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\YWCQNuY.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\xEGxSSV.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\PLYiyRE.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\UkTuZvM.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\DyEEQAk.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\yIcuWaE.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\zeZmxLX.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\DmIxoNT.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\vktaXOw.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\EnrmLOs.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\QQmkztA.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\WWfOzYd.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\IBFRxOC.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\grPgUHr.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\ztFnYGU.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\vQmJKMC.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\IGZjgSF.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\HVTldaZ.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\PhSTerl.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\uLuGIFk.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\lzPkDPD.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\cpnlMze.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\QaXvziS.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\kHITaYS.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\BAdQmeJ.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\yNMsllh.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\yIvynGi.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\kwXHJVQ.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\jfFuzzA.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\IbILUJI.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\HGyuMZY.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\jBDWnKQ.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\zrzRiQq.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\KTFcVhQ.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\vhAAbVl.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\KQVnGRJ.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\HmbBoKF.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\LdPgaQv.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\xaLloet.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\mntXWPR.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
File created	C:\Windows\System\RWBxjtt.exe	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe
3848	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
Token: SeDebugPrivilege	3848	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3848	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	85
PID 3032 wrote to memory of 3848	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	85
PID 3032 wrote to memory of 4876	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	86
PID 3032 wrote to memory of 4876	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	86
PID 3032 wrote to memory of 668	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	87
PID 3032 wrote to memory of 668	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	87
PID 3032 wrote to memory of 4716	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	88
PID 3032 wrote to memory of 4716	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	88
PID 3032 wrote to memory of 3804	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	89
PID 3032 wrote to memory of 3804	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	89
PID 3032 wrote to memory of 4416	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	90
PID 3032 wrote to memory of 4416	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	90
PID 3032 wrote to memory of 3076	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	91
PID 3032 wrote to memory of 3076	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	91
PID 3032 wrote to memory of 372	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	92
PID 3032 wrote to memory of 372	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	92
PID 3032 wrote to memory of 4008	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	93
PID 3032 wrote to memory of 4008	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	93
PID 3032 wrote to memory of 3624	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	94
PID 3032 wrote to memory of 3624	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	94
PID 3032 wrote to memory of 1556	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	95
PID 3032 wrote to memory of 1556	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	95
PID 3032 wrote to memory of 2188	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	96
PID 3032 wrote to memory of 2188	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	96
PID 3032 wrote to memory of 2696	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	97
PID 3032 wrote to memory of 2696	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	97
PID 3032 wrote to memory of 1648	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	98
PID 3032 wrote to memory of 1648	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	98
PID 3032 wrote to memory of 1692	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	99
PID 3032 wrote to memory of 1692	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	99
PID 3032 wrote to memory of 1872	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	100
PID 3032 wrote to memory of 1872	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	100
PID 3032 wrote to memory of 2104	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	101
PID 3032 wrote to memory of 2104	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	101
PID 3032 wrote to memory of 2892	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	102
PID 3032 wrote to memory of 2892	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	102
PID 3032 wrote to memory of 1136	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	103
PID 3032 wrote to memory of 1136	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	103
PID 3032 wrote to memory of 1152	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	104
PID 3032 wrote to memory of 1152	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	104
PID 3032 wrote to memory of 4588	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	105
PID 3032 wrote to memory of 4588	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	105
PID 3032 wrote to memory of 1348	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	106
PID 3032 wrote to memory of 1348	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	106
PID 3032 wrote to memory of 4564	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	107
PID 3032 wrote to memory of 4564	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	107
PID 3032 wrote to memory of 740	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	108
PID 3032 wrote to memory of 740	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	108
PID 3032 wrote to memory of 2348	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	109
PID 3032 wrote to memory of 2348	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	109
PID 3032 wrote to memory of 1164	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	110
PID 3032 wrote to memory of 1164	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	110
PID 3032 wrote to memory of 4548	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	111
PID 3032 wrote to memory of 4548	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	111
PID 3032 wrote to memory of 3480	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	112
PID 3032 wrote to memory of 3480	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	112
PID 3032 wrote to memory of 4704	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	113
PID 3032 wrote to memory of 4704	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	113
PID 3032 wrote to memory of 1340	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	114
PID 3032 wrote to memory of 1340	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	114
PID 3032 wrote to memory of 3008	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	115
PID 3032 wrote to memory of 3008	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	115
PID 3032 wrote to memory of 1528	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	116
PID 3032 wrote to memory of 1528	3032	431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\431a817a43658d7123aab89b6febea90_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3848
- C:\Windows\System\Jarjyot.exe
  C:\Windows\System\Jarjyot.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\QdCzjLk.exe
  C:\Windows\System\QdCzjLk.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\jAeeAdk.exe
  C:\Windows\System\jAeeAdk.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\iusoihH.exe
  C:\Windows\System\iusoihH.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\dwccSwD.exe
  C:\Windows\System\dwccSwD.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\CCXLpnu.exe
  C:\Windows\System\CCXLpnu.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\EaMOgnz.exe
  C:\Windows\System\EaMOgnz.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\NJTqeFP.exe
  C:\Windows\System\NJTqeFP.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\lbDuEPy.exe
  C:\Windows\System\lbDuEPy.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\CeJiHBn.exe
  C:\Windows\System\CeJiHBn.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\KyMIcJG.exe
  C:\Windows\System\KyMIcJG.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\MtwfMnr.exe
  C:\Windows\System\MtwfMnr.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\fWPbKhE.exe
  C:\Windows\System\fWPbKhE.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\vcqouFx.exe
  C:\Windows\System\vcqouFx.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\NnJiRnK.exe
  C:\Windows\System\NnJiRnK.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\rswmGTd.exe
  C:\Windows\System\rswmGTd.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\epDZoPI.exe
  C:\Windows\System\epDZoPI.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\RmFQgiM.exe
  C:\Windows\System\RmFQgiM.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\cZnlaLG.exe
  C:\Windows\System\cZnlaLG.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\UmLhxtZ.exe
  C:\Windows\System\UmLhxtZ.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\JQpQoqD.exe
  C:\Windows\System\JQpQoqD.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\mjXehCT.exe
  C:\Windows\System\mjXehCT.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\wCKIqnj.exe
  C:\Windows\System\wCKIqnj.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\jFmEcZA.exe
  C:\Windows\System\jFmEcZA.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\NLfdKqO.exe
  C:\Windows\System\NLfdKqO.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\fIjVJpV.exe
  C:\Windows\System\fIjVJpV.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\MrBASEH.exe
  C:\Windows\System\MrBASEH.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\pgcfZPl.exe
  C:\Windows\System\pgcfZPl.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\dAFjGUn.exe
  C:\Windows\System\dAFjGUn.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\SIDlUfC.exe
  C:\Windows\System\SIDlUfC.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\fwfnfSl.exe
  C:\Windows\System\fwfnfSl.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\jwMRFEp.exe
  C:\Windows\System\jwMRFEp.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\RQOZiaU.exe
  C:\Windows\System\RQOZiaU.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\KojtlgL.exe
  C:\Windows\System\KojtlgL.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\TXcKeXC.exe
  C:\Windows\System\TXcKeXC.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\uCkPgFH.exe
  C:\Windows\System\uCkPgFH.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\TdoZycT.exe
  C:\Windows\System\TdoZycT.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\jnEtKtG.exe
  C:\Windows\System\jnEtKtG.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\DSVQLZU.exe
  C:\Windows\System\DSVQLZU.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\XZYpgPy.exe
  C:\Windows\System\XZYpgPy.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\FMIZdGo.exe
  C:\Windows\System\FMIZdGo.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\RrqsVrV.exe
  C:\Windows\System\RrqsVrV.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\SyOltkE.exe
  C:\Windows\System\SyOltkE.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\DooAeUL.exe
  C:\Windows\System\DooAeUL.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\kdmGbfO.exe
  C:\Windows\System\kdmGbfO.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\UBshjuV.exe
  C:\Windows\System\UBshjuV.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\nICzvIx.exe
  C:\Windows\System\nICzvIx.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\mmTfPrB.exe
  C:\Windows\System\mmTfPrB.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\dGzEUIX.exe
  C:\Windows\System\dGzEUIX.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\TSiWsbe.exe
  C:\Windows\System\TSiWsbe.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\thOdiuk.exe
  C:\Windows\System\thOdiuk.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\jqqWtSl.exe
  C:\Windows\System\jqqWtSl.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\fLQqBAd.exe
  C:\Windows\System\fLQqBAd.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\aLAuGQo.exe
  C:\Windows\System\aLAuGQo.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\Lhcluzp.exe
  C:\Windows\System\Lhcluzp.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\yEiWznK.exe
  C:\Windows\System\yEiWznK.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\PQLOptE.exe
  C:\Windows\System\PQLOptE.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\AlqfXUt.exe
  C:\Windows\System\AlqfXUt.exe
  2⤵
  PID:1820
- C:\Windows\System\zrzRiQq.exe
  C:\Windows\System\zrzRiQq.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\ZnjKBAs.exe
  C:\Windows\System\ZnjKBAs.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\CfwBweg.exe
  C:\Windows\System\CfwBweg.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\GnuFeaD.exe
  C:\Windows\System\GnuFeaD.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\QiNhJPE.exe
  C:\Windows\System\QiNhJPE.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\WTyoPGA.exe
  C:\Windows\System\WTyoPGA.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\LaAjrBE.exe
  C:\Windows\System\LaAjrBE.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\tQcGXai.exe
  C:\Windows\System\tQcGXai.exe
  2⤵
  PID:4320
- C:\Windows\System\NqYFUSH.exe
  C:\Windows\System\NqYFUSH.exe
  2⤵
  PID:4308
- C:\Windows\System\UmcNDqE.exe
  C:\Windows\System\UmcNDqE.exe
  2⤵
  PID:1236
- C:\Windows\System\eXzNFRp.exe
  C:\Windows\System\eXzNFRp.exe
  2⤵
  PID:2916
- C:\Windows\System\DEHDcrf.exe
  C:\Windows\System\DEHDcrf.exe
  2⤵
  PID:5124
- C:\Windows\System\dGYseTO.exe
  C:\Windows\System\dGYseTO.exe
  2⤵
  PID:5140
- C:\Windows\System\ZrwFzIf.exe
  C:\Windows\System\ZrwFzIf.exe
  2⤵
  PID:5156
- C:\Windows\System\QjtlErB.exe
  C:\Windows\System\QjtlErB.exe
  2⤵
  PID:5172
- C:\Windows\System\ypELPYJ.exe
  C:\Windows\System\ypELPYJ.exe
  2⤵
  PID:5188
- C:\Windows\System\qqJFDTN.exe
  C:\Windows\System\qqJFDTN.exe
  2⤵
  PID:5204
- C:\Windows\System\bKFssRL.exe
  C:\Windows\System\bKFssRL.exe
  2⤵
  PID:5220
- C:\Windows\System\yRyZMXo.exe
  C:\Windows\System\yRyZMXo.exe
  2⤵
  PID:5236
- C:\Windows\System\YoKyLUL.exe
  C:\Windows\System\YoKyLUL.exe
  2⤵
  PID:5252
- C:\Windows\System\hEttEgg.exe
  C:\Windows\System\hEttEgg.exe
  2⤵
  PID:5272
- C:\Windows\System\zGbaJpK.exe
  C:\Windows\System\zGbaJpK.exe
  2⤵
  PID:5288
- C:\Windows\System\IaIevNd.exe
  C:\Windows\System\IaIevNd.exe
  2⤵
  PID:5304
- C:\Windows\System\IQyxZDX.exe
  C:\Windows\System\IQyxZDX.exe
  2⤵
  PID:5324
- C:\Windows\System\pgoTrcs.exe
  C:\Windows\System\pgoTrcs.exe
  2⤵
  PID:5384
- C:\Windows\System\PdOwPmp.exe
  C:\Windows\System\PdOwPmp.exe
  2⤵
  PID:5404
- C:\Windows\System\TclVLxV.exe
  C:\Windows\System\TclVLxV.exe
  2⤵
  PID:5424
- C:\Windows\System\XJWDWwv.exe
  C:\Windows\System\XJWDWwv.exe
  2⤵
  PID:5444
- C:\Windows\System\mJmgcdN.exe
  C:\Windows\System\mJmgcdN.exe
  2⤵
  PID:5464
- C:\Windows\System\BJtxKKs.exe
  C:\Windows\System\BJtxKKs.exe
  2⤵
  PID:5484
- C:\Windows\System\GxKeYFR.exe
  C:\Windows\System\GxKeYFR.exe
  2⤵
  PID:5620
- C:\Windows\System\SaFEvrl.exe
  C:\Windows\System\SaFEvrl.exe
  2⤵
  PID:5636
- C:\Windows\System\bqWsDun.exe
  C:\Windows\System\bqWsDun.exe
  2⤵
  PID:5664
- C:\Windows\System\RvWeoIN.exe
  C:\Windows\System\RvWeoIN.exe
  2⤵
  PID:5792
- C:\Windows\System\CVaiIYg.exe
  C:\Windows\System\CVaiIYg.exe
  2⤵
  PID:5808
- C:\Windows\System\siXMsJv.exe
  C:\Windows\System\siXMsJv.exe
  2⤵
  PID:5828
- C:\Windows\System\fvyLcBh.exe
  C:\Windows\System\fvyLcBh.exe
  2⤵
  PID:5844
- C:\Windows\System\cCwyHwq.exe
  C:\Windows\System\cCwyHwq.exe
  2⤵
  PID:5860
- C:\Windows\System\MdYQkYJ.exe
  C:\Windows\System\MdYQkYJ.exe
  2⤵
  PID:5876
- C:\Windows\System\ZpfAReF.exe
  C:\Windows\System\ZpfAReF.exe
  2⤵
  PID:5892
- C:\Windows\System\PvEJFCs.exe
  C:\Windows\System\PvEJFCs.exe
  2⤵
  PID:5908
- C:\Windows\System\lyOHYkW.exe
  C:\Windows\System\lyOHYkW.exe
  2⤵
  PID:5924
- C:\Windows\System\pgfMOKO.exe
  C:\Windows\System\pgfMOKO.exe
  2⤵
  PID:5940
- C:\Windows\System\VxQNrTm.exe
  C:\Windows\System\VxQNrTm.exe
  2⤵
  PID:5956
- C:\Windows\System\DZtrVoY.exe
  C:\Windows\System\DZtrVoY.exe
  2⤵
  PID:5972
- C:\Windows\System\VhvMIkx.exe
  C:\Windows\System\VhvMIkx.exe
  2⤵
  PID:5988
- C:\Windows\System\XuyZQWB.exe
  C:\Windows\System\XuyZQWB.exe
  2⤵
  PID:6004
- C:\Windows\System\ZCJfifJ.exe
  C:\Windows\System\ZCJfifJ.exe
  2⤵
  PID:6020
- C:\Windows\System\eNQZxmR.exe
  C:\Windows\System\eNQZxmR.exe
  2⤵
  PID:6036
- C:\Windows\System\ZUxzKGg.exe
  C:\Windows\System\ZUxzKGg.exe
  2⤵
  PID:6052
- C:\Windows\System\FSntozi.exe
  C:\Windows\System\FSntozi.exe
  2⤵
  PID:6068
- C:\Windows\System\doUQYlv.exe
  C:\Windows\System\doUQYlv.exe
  2⤵
  PID:6092
- C:\Windows\System\ovkVFDt.exe
  C:\Windows\System\ovkVFDt.exe
  2⤵
  PID:6108
- C:\Windows\System\SzeOHCQ.exe
  C:\Windows\System\SzeOHCQ.exe
  2⤵
  PID:6128
- C:\Windows\System\gkVsBVq.exe
  C:\Windows\System\gkVsBVq.exe
  2⤵
  PID:1440
- C:\Windows\System\MAxXwPB.exe
  C:\Windows\System\MAxXwPB.exe
  2⤵
  PID:3752
- C:\Windows\System\ZpWEPqN.exe
  C:\Windows\System\ZpWEPqN.exe
  2⤵
  PID:4344
- C:\Windows\System\UuGFwFA.exe
  C:\Windows\System\UuGFwFA.exe
  2⤵
  PID:3656
- C:\Windows\System\BjlFBvB.exe
  C:\Windows\System\BjlFBvB.exe
  2⤵
  PID:1656
- C:\Windows\System\cfMqNEq.exe
  C:\Windows\System\cfMqNEq.exe
  2⤵
  PID:4544
- C:\Windows\System\HOVmUtD.exe
  C:\Windows\System\HOVmUtD.exe
  2⤵
  PID:5336
- C:\Windows\System\GeIrkjm.exe
  C:\Windows\System\GeIrkjm.exe
  2⤵
  PID:5296
- C:\Windows\System\KFuQssv.exe
  C:\Windows\System\KFuQssv.exe
  2⤵
  PID:5260
- C:\Windows\System\jPlUGjX.exe
  C:\Windows\System\jPlUGjX.exe
  2⤵
  PID:5228
- C:\Windows\System\RqcHgiN.exe
  C:\Windows\System\RqcHgiN.exe
  2⤵
  PID:5196
- C:\Windows\System\MRlLUtk.exe
  C:\Windows\System\MRlLUtk.exe
  2⤵
  PID:5136
- C:\Windows\System\habNNRd.exe
  C:\Windows\System\habNNRd.exe
  2⤵
  PID:1088
- C:\Windows\System\IsSOuQE.exe
  C:\Windows\System\IsSOuQE.exe
  2⤵
  PID:5392
- C:\Windows\System\VqmssUP.exe
  C:\Windows\System\VqmssUP.exe
  2⤵
  PID:5432
- C:\Windows\System\TZjfWuu.exe
  C:\Windows\System\TZjfWuu.exe
  2⤵
  PID:5476
- C:\Windows\System\zEwJbVM.exe
  C:\Windows\System\zEwJbVM.exe
  2⤵
  PID:5572
- C:\Windows\System\GnjjWPb.exe
  C:\Windows\System\GnjjWPb.exe
  2⤵
  PID:5672
- C:\Windows\System\Cguttkq.exe
  C:\Windows\System\Cguttkq.exe
  2⤵
  PID:5652
- C:\Windows\System\EnfcdeJ.exe
  C:\Windows\System\EnfcdeJ.exe
  2⤵
  PID:2268
- C:\Windows\System\LOEWubW.exe
  C:\Windows\System\LOEWubW.exe
  2⤵
  PID:6296
- C:\Windows\System\CDJKYAK.exe
  C:\Windows\System\CDJKYAK.exe
  2⤵
  PID:6316
- C:\Windows\System\obPJEWm.exe
  C:\Windows\System\obPJEWm.exe
  2⤵
  PID:6332
- C:\Windows\System\wpROaAh.exe
  C:\Windows\System\wpROaAh.exe
  2⤵
  PID:6356
- C:\Windows\System\SQHavrq.exe
  C:\Windows\System\SQHavrq.exe
  2⤵
  PID:6372
- C:\Windows\System\JUQNmVG.exe
  C:\Windows\System\JUQNmVG.exe
  2⤵
  PID:6404
- C:\Windows\System\WlYYISP.exe
  C:\Windows\System\WlYYISP.exe
  2⤵
  PID:6440
- C:\Windows\System\wUywgDd.exe
  C:\Windows\System\wUywgDd.exe
  2⤵
  PID:6492
- C:\Windows\System\QQmkztA.exe
  C:\Windows\System\QQmkztA.exe
  2⤵
  PID:6508
- C:\Windows\System\AVVfrPp.exe
  C:\Windows\System\AVVfrPp.exe
  2⤵
  PID:6528
- C:\Windows\System\nQLbQYu.exe
  C:\Windows\System\nQLbQYu.exe
  2⤵
  PID:6544
- C:\Windows\System\HzIDdVC.exe
  C:\Windows\System\HzIDdVC.exe
  2⤵
  PID:6560
- C:\Windows\System\YJshlbP.exe
  C:\Windows\System\YJshlbP.exe
  2⤵
  PID:6576
- C:\Windows\System\vELycrk.exe
  C:\Windows\System\vELycrk.exe
  2⤵
  PID:6592
- C:\Windows\System\rmPiHbJ.exe
  C:\Windows\System\rmPiHbJ.exe
  2⤵
  PID:6608
- C:\Windows\System\NiPGZaD.exe
  C:\Windows\System\NiPGZaD.exe
  2⤵
  PID:6624
- C:\Windows\System\BMHSEVC.exe
  C:\Windows\System\BMHSEVC.exe
  2⤵
  PID:6640
- C:\Windows\System\iuESDSQ.exe
  C:\Windows\System\iuESDSQ.exe
  2⤵
  PID:6656
- C:\Windows\System\tNHGBOo.exe
  C:\Windows\System\tNHGBOo.exe
  2⤵
  PID:6672
- C:\Windows\System\PpFmlZM.exe
  C:\Windows\System\PpFmlZM.exe
  2⤵
  PID:6688
- C:\Windows\System\AUgxnoO.exe
  C:\Windows\System\AUgxnoO.exe
  2⤵
  PID:6704
- C:\Windows\System\MXUzEXs.exe
  C:\Windows\System\MXUzEXs.exe
  2⤵
  PID:6720
- C:\Windows\System\mcEIlJj.exe
  C:\Windows\System\mcEIlJj.exe
  2⤵
  PID:6736
- C:\Windows\System\mkHgHdO.exe
  C:\Windows\System\mkHgHdO.exe
  2⤵
  PID:6756
- C:\Windows\System\uekyUpV.exe
  C:\Windows\System\uekyUpV.exe
  2⤵
  PID:6772
- C:\Windows\System\BqLbIPR.exe
  C:\Windows\System\BqLbIPR.exe
  2⤵
  PID:6788
- C:\Windows\System\pspdBMy.exe
  C:\Windows\System\pspdBMy.exe
  2⤵
  PID:6804
- C:\Windows\System\NAWbTJG.exe
  C:\Windows\System\NAWbTJG.exe
  2⤵
  PID:6820
- C:\Windows\System\BHumfyI.exe
  C:\Windows\System\BHumfyI.exe
  2⤵
  PID:6836
- C:\Windows\System\MixpHhh.exe
  C:\Windows\System\MixpHhh.exe
  2⤵
  PID:6852
- C:\Windows\System\aTFNFHa.exe
  C:\Windows\System\aTFNFHa.exe
  2⤵
  PID:6872
- C:\Windows\System\GQzdjSG.exe
  C:\Windows\System\GQzdjSG.exe
  2⤵
  PID:6888
- C:\Windows\System\GbxLlBh.exe
  C:\Windows\System\GbxLlBh.exe
  2⤵
  PID:6904
- C:\Windows\System\uRYTZBX.exe
  C:\Windows\System\uRYTZBX.exe
  2⤵
  PID:6920
- C:\Windows\System\VVkFEDE.exe
  C:\Windows\System\VVkFEDE.exe
  2⤵
  PID:6940
- C:\Windows\System\PojNuUj.exe
  C:\Windows\System\PojNuUj.exe
  2⤵
  PID:6956
- C:\Windows\System\AyjowWK.exe
  C:\Windows\System\AyjowWK.exe
  2⤵
  PID:6972
- C:\Windows\System\oMOXaRA.exe
  C:\Windows\System\oMOXaRA.exe
  2⤵
  PID:6988
- C:\Windows\System\hMYOrjg.exe
  C:\Windows\System\hMYOrjg.exe
  2⤵
  PID:7008
- C:\Windows\System\RtxgKwb.exe
  C:\Windows\System\RtxgKwb.exe
  2⤵
  PID:7032
- C:\Windows\System\deWoTle.exe
  C:\Windows\System\deWoTle.exe
  2⤵
  PID:7084
- C:\Windows\System\AcyTxcW.exe
  C:\Windows\System\AcyTxcW.exe
  2⤵
  PID:7104
- C:\Windows\System\HzoWiVP.exe
  C:\Windows\System\HzoWiVP.exe
  2⤵
  PID:7124
- C:\Windows\System\OcDhQGF.exe
  C:\Windows\System\OcDhQGF.exe
  2⤵
  PID:7144
- C:\Windows\System\YsXLlJL.exe
  C:\Windows\System\YsXLlJL.exe
  2⤵
  PID:7160
- C:\Windows\System\xDlkKpG.exe
  C:\Windows\System\xDlkKpG.exe
  2⤵
  PID:5784
- C:\Windows\System\cFDXWLa.exe
  C:\Windows\System\cFDXWLa.exe
  2⤵
  PID:5816
- C:\Windows\System\nYoaonZ.exe
  C:\Windows\System\nYoaonZ.exe
  2⤵
  PID:5868
- C:\Windows\System\YbbVjAj.exe
  C:\Windows\System\YbbVjAj.exe
  2⤵
  PID:5904
- C:\Windows\System\gEcVUcq.exe
  C:\Windows\System\gEcVUcq.exe
  2⤵
  PID:5948
- C:\Windows\System\SJcqVOv.exe
  C:\Windows\System\SJcqVOv.exe
  2⤵
  PID:5980
- C:\Windows\System\lEPVawF.exe
  C:\Windows\System\lEPVawF.exe
  2⤵
  PID:6016
- C:\Windows\System\YjsdmPo.exe
  C:\Windows\System\YjsdmPo.exe
  2⤵
  PID:6048
- C:\Windows\System\CMkagwn.exe
  C:\Windows\System\CMkagwn.exe
  2⤵
  PID:6100
- C:\Windows\System\sYyGHKa.exe
  C:\Windows\System\sYyGHKa.exe
  2⤵
  PID:6124
- C:\Windows\System\UUKaLSK.exe
  C:\Windows\System\UUKaLSK.exe
  2⤵
  PID:5016
- C:\Windows\System\TBsFdhC.exe
  C:\Windows\System\TBsFdhC.exe
  2⤵
  PID:4072
- C:\Windows\System\zjxeOaX.exe
  C:\Windows\System\zjxeOaX.exe
  2⤵
  PID:2812
- C:\Windows\System\EjeyPcS.exe
  C:\Windows\System\EjeyPcS.exe
  2⤵
  PID:5356
- C:\Windows\System\cTJqPUE.exe
  C:\Windows\System\cTJqPUE.exe
  2⤵
  PID:5280
- C:\Windows\System\mfXiUxF.exe
  C:\Windows\System\mfXiUxF.exe
  2⤵
  PID:5200
- C:\Windows\System\LSUnvpX.exe
  C:\Windows\System\LSUnvpX.exe
  2⤵
  PID:1800
- C:\Windows\System\smVVVAb.exe
  C:\Windows\System\smVVVAb.exe
  2⤵
  PID:5416
- C:\Windows\System\mOmyvHE.exe
  C:\Windows\System\mOmyvHE.exe
  2⤵
  PID:5516
- C:\Windows\System\FABvOLL.exe
  C:\Windows\System\FABvOLL.exe
  2⤵
  PID:5632
- C:\Windows\System\MverXbW.exe
  C:\Windows\System\MverXbW.exe
  2⤵
  PID:6364
- C:\Windows\System\pfewnkz.exe
  C:\Windows\System\pfewnkz.exe
  2⤵
  PID:7172
- C:\Windows\System\AfEmbGr.exe
  C:\Windows\System\AfEmbGr.exe
  2⤵
  PID:7192
- C:\Windows\System\iiYnHKQ.exe
  C:\Windows\System\iiYnHKQ.exe
  2⤵
  PID:7212
- C:\Windows\System\pCpHjDm.exe
  C:\Windows\System\pCpHjDm.exe
  2⤵
  PID:7228
- C:\Windows\System\BoMzzLA.exe
  C:\Windows\System\BoMzzLA.exe
  2⤵
  PID:7252
- C:\Windows\System\Xwtmwxc.exe
  C:\Windows\System\Xwtmwxc.exe
  2⤵
  PID:7272
- C:\Windows\System\DuHsBqv.exe
  C:\Windows\System\DuHsBqv.exe
  2⤵
  PID:7292
- C:\Windows\System\XgzXUWB.exe
  C:\Windows\System\XgzXUWB.exe
  2⤵
  PID:7308
- C:\Windows\System\osizzZK.exe
  C:\Windows\System\osizzZK.exe
  2⤵
  PID:7328
- C:\Windows\System\kgdhAWl.exe
  C:\Windows\System\kgdhAWl.exe
  2⤵
  PID:7416
- C:\Windows\System\CVjXEla.exe
  C:\Windows\System\CVjXEla.exe
  2⤵
  PID:7432
- C:\Windows\System\qRSkWHN.exe
  C:\Windows\System\qRSkWHN.exe
  2⤵
  PID:7448
- C:\Windows\System\djXyunN.exe
  C:\Windows\System\djXyunN.exe
  2⤵
  PID:7464
- C:\Windows\System\ZEvvuby.exe
  C:\Windows\System\ZEvvuby.exe
  2⤵
  PID:7484
- C:\Windows\System\UjScbCq.exe
  C:\Windows\System\UjScbCq.exe
  2⤵
  PID:7504
- C:\Windows\System\vQBsQEq.exe
  C:\Windows\System\vQBsQEq.exe
  2⤵
  PID:7520
- C:\Windows\System\byCnbwE.exe
  C:\Windows\System\byCnbwE.exe
  2⤵
  PID:7536
- C:\Windows\System\ZomoDZK.exe
  C:\Windows\System\ZomoDZK.exe
  2⤵
  PID:7560
- C:\Windows\System\hBuPqSz.exe
  C:\Windows\System\hBuPqSz.exe
  2⤵
  PID:7584
- C:\Windows\System\bwFsqhi.exe
  C:\Windows\System\bwFsqhi.exe
  2⤵
  PID:7604
- C:\Windows\System\VSDaupa.exe
  C:\Windows\System\VSDaupa.exe
  2⤵
  PID:7620
- C:\Windows\System\eSwICNE.exe
  C:\Windows\System\eSwICNE.exe
  2⤵
  PID:7648
- C:\Windows\System\zLLbDcE.exe
  C:\Windows\System\zLLbDcE.exe
  2⤵
  PID:7664
- C:\Windows\System\DQeAMYM.exe
  C:\Windows\System\DQeAMYM.exe
  2⤵
  PID:7684
- C:\Windows\System\heTynuY.exe
  C:\Windows\System\heTynuY.exe
  2⤵
  PID:7700
- C:\Windows\System\rSMEFkY.exe
  C:\Windows\System\rSMEFkY.exe
  2⤵
  PID:7720
- C:\Windows\System\JzeWqYM.exe
  C:\Windows\System\JzeWqYM.exe
  2⤵
  PID:7748
- C:\Windows\System\PyMmfnV.exe
  C:\Windows\System\PyMmfnV.exe
  2⤵
  PID:7764
- C:\Windows\System\menykaT.exe
  C:\Windows\System\menykaT.exe
  2⤵
  PID:7780
- C:\Windows\System\RcXWLIP.exe
  C:\Windows\System\RcXWLIP.exe
  2⤵
  PID:7804
- C:\Windows\System\LNvXFen.exe
  C:\Windows\System\LNvXFen.exe
  2⤵
  PID:7824
- C:\Windows\System\lWfoyPu.exe
  C:\Windows\System\lWfoyPu.exe
  2⤵
  PID:7848
- C:\Windows\System\dsSKrRm.exe
  C:\Windows\System\dsSKrRm.exe
  2⤵
  PID:7880
- C:\Windows\System\hQRmqsI.exe
  C:\Windows\System\hQRmqsI.exe
  2⤵
  PID:7896
- C:\Windows\System\nYYGItV.exe
  C:\Windows\System\nYYGItV.exe
  2⤵
  PID:7912
- C:\Windows\System\ESzMFki.exe
  C:\Windows\System\ESzMFki.exe
  2⤵
  PID:7928
- C:\Windows\System\BTknvtT.exe
  C:\Windows\System\BTknvtT.exe
  2⤵
  PID:7944
- C:\Windows\System\noQISpa.exe
  C:\Windows\System\noQISpa.exe
  2⤵
  PID:7960
- C:\Windows\System\izZEQkQ.exe
  C:\Windows\System\izZEQkQ.exe
  2⤵
  PID:7976
- C:\Windows\System\FSQTOWi.exe
  C:\Windows\System\FSQTOWi.exe
  2⤵
  PID:7992
- C:\Windows\System\JEUmvHZ.exe
  C:\Windows\System\JEUmvHZ.exe
  2⤵
  PID:8008
- C:\Windows\System\rNBtURe.exe
  C:\Windows\System\rNBtURe.exe
  2⤵
  PID:8024
- C:\Windows\System\QJjIicZ.exe
  C:\Windows\System\QJjIicZ.exe
  2⤵
  PID:8040
- C:\Windows\System\GtuTPxP.exe
  C:\Windows\System\GtuTPxP.exe
  2⤵
  PID:8056
- C:\Windows\System\wAFfzWe.exe
  C:\Windows\System\wAFfzWe.exe
  2⤵
  PID:8076
- C:\Windows\System\TPimMVq.exe
  C:\Windows\System\TPimMVq.exe
  2⤵
  PID:8092
- C:\Windows\System\uqblbeh.exe
  C:\Windows\System\uqblbeh.exe
  2⤵
  PID:8112
- C:\Windows\System\TfDOLHy.exe
  C:\Windows\System\TfDOLHy.exe
  2⤵
  PID:8132
- C:\Windows\System\XlbcnPc.exe
  C:\Windows\System\XlbcnPc.exe
  2⤵
  PID:8152
- C:\Windows\System\iVaHfMr.exe
  C:\Windows\System\iVaHfMr.exe
  2⤵
  PID:8172
- C:\Windows\System\frxYxNq.exe
  C:\Windows\System\frxYxNq.exe
  2⤵
  PID:6152
- C:\Windows\System\JltBzXP.exe
  C:\Windows\System\JltBzXP.exe
  2⤵
  PID:6436
- C:\Windows\System\bZmWlTG.exe
  C:\Windows\System\bZmWlTG.exe
  2⤵
  PID:4032
- C:\Windows\System\zOSrSWB.exe
  C:\Windows\System\zOSrSWB.exe
  2⤵
  PID:2728
- C:\Windows\System\WPymGXt.exe
  C:\Windows\System\WPymGXt.exe
  2⤵
  PID:7180
- C:\Windows\System\ZgoturW.exe
  C:\Windows\System\ZgoturW.exe
  2⤵
  PID:7244
- C:\Windows\System\ZCierkv.exe
  C:\Windows\System\ZCierkv.exe
  2⤵
  PID:7300
- C:\Windows\System\BhYOuYk.exe
  C:\Windows\System\BhYOuYk.exe
  2⤵
  PID:6232
- C:\Windows\System\qrNSJcP.exe
  C:\Windows\System\qrNSJcP.exe
  2⤵
  PID:6272
- C:\Windows\System\MQZxSBq.exe
  C:\Windows\System\MQZxSBq.exe
  2⤵
  PID:6312
- C:\Windows\System\VLaWKdk.exe
  C:\Windows\System\VLaWKdk.exe
  2⤵
  PID:6400
- C:\Windows\System\rnEWQXr.exe
  C:\Windows\System\rnEWQXr.exe
  2⤵
  PID:1112
- C:\Windows\System\KuQKnFe.exe
  C:\Windows\System\KuQKnFe.exe
  2⤵
  PID:7612
- C:\Windows\System\EyLkWnv.exe
  C:\Windows\System\EyLkWnv.exe
  2⤵
  PID:5604
- C:\Windows\System\cQDeKOl.exe
  C:\Windows\System\cQDeKOl.exe
  2⤵
  PID:7184
- C:\Windows\System\EgEQHyP.exe
  C:\Windows\System\EgEQHyP.exe
  2⤵
  PID:8204
- C:\Windows\System\UKHiTtj.exe
  C:\Windows\System\UKHiTtj.exe
  2⤵
  PID:8224
- C:\Windows\System\xMAaKfu.exe
  C:\Windows\System\xMAaKfu.exe
  2⤵
  PID:8240
- C:\Windows\System\NqZrRyU.exe
  C:\Windows\System\NqZrRyU.exe
  2⤵
  PID:8260
- C:\Windows\System\dOUcgSU.exe
  C:\Windows\System\dOUcgSU.exe
  2⤵
  PID:8276
- C:\Windows\System\mMhkWcN.exe
  C:\Windows\System\mMhkWcN.exe
  2⤵
  PID:8300
- C:\Windows\System\nNEplMa.exe
  C:\Windows\System\nNEplMa.exe
  2⤵
  PID:8316
- C:\Windows\System\rrPeLUI.exe
  C:\Windows\System\rrPeLUI.exe
  2⤵
  PID:8336
- C:\Windows\System\kwXHJVQ.exe
  C:\Windows\System\kwXHJVQ.exe
  2⤵
  PID:8352
- C:\Windows\System\eMRLfqT.exe
  C:\Windows\System\eMRLfqT.exe
  2⤵
  PID:8376
- C:\Windows\System\RJRXSiJ.exe
  C:\Windows\System\RJRXSiJ.exe
  2⤵
  PID:8396
- C:\Windows\System\uNLKqgo.exe
  C:\Windows\System\uNLKqgo.exe
  2⤵
  PID:8412
- C:\Windows\System\bYmGUXe.exe
  C:\Windows\System\bYmGUXe.exe
  2⤵
  PID:8444
- C:\Windows\System\iCOvMZl.exe
  C:\Windows\System\iCOvMZl.exe
  2⤵
  PID:8460
- C:\Windows\System\rQRRpCq.exe
  C:\Windows\System\rQRRpCq.exe
  2⤵
  PID:8488
- C:\Windows\System\CegChRi.exe
  C:\Windows\System\CegChRi.exe
  2⤵
  PID:8504
- C:\Windows\System\XXQnnHf.exe
  C:\Windows\System\XXQnnHf.exe
  2⤵
  PID:8580
- C:\Windows\System\rwbcJEd.exe
  C:\Windows\System\rwbcJEd.exe
  2⤵
  PID:8596
- C:\Windows\System\WxipXJj.exe
  C:\Windows\System\WxipXJj.exe
  2⤵
  PID:8620
- C:\Windows\System\AXTLVbM.exe
  C:\Windows\System\AXTLVbM.exe
  2⤵
  PID:8644
- C:\Windows\System\AGrHtFI.exe
  C:\Windows\System\AGrHtFI.exe
  2⤵
  PID:8664
- C:\Windows\System\QDkgTtP.exe
  C:\Windows\System\QDkgTtP.exe
  2⤵
  PID:8684
- C:\Windows\System\EjEEMOg.exe
  C:\Windows\System\EjEEMOg.exe
  2⤵
  PID:8700
- C:\Windows\System\XqESovU.exe
  C:\Windows\System\XqESovU.exe
  2⤵
  PID:8724
- C:\Windows\System\kfkfCQX.exe
  C:\Windows\System\kfkfCQX.exe
  2⤵
  PID:8748
- C:\Windows\System\msKelhA.exe
  C:\Windows\System\msKelhA.exe
  2⤵
  PID:8764
- C:\Windows\System\SuvsZVw.exe
  C:\Windows\System\SuvsZVw.exe
  2⤵
  PID:8788
- C:\Windows\System\WFmzNqs.exe
  C:\Windows\System\WFmzNqs.exe
  2⤵
  PID:8808
- C:\Windows\System\bSXenWV.exe
  C:\Windows\System\bSXenWV.exe
  2⤵
  PID:8828
- C:\Windows\System\tHGokIo.exe
  C:\Windows\System\tHGokIo.exe
  2⤵
  PID:8852
- C:\Windows\System\JyxXTYV.exe
  C:\Windows\System\JyxXTYV.exe
  2⤵
  PID:8868
- C:\Windows\System\gnXFhfl.exe
  C:\Windows\System\gnXFhfl.exe
  2⤵
  PID:8892
- C:\Windows\System\jvfUxjc.exe
  C:\Windows\System\jvfUxjc.exe
  2⤵
  PID:8920
- C:\Windows\System\hXnmQEc.exe
  C:\Windows\System\hXnmQEc.exe
  2⤵
  PID:8940
- C:\Windows\System\UTSplRf.exe
  C:\Windows\System\UTSplRf.exe
  2⤵
  PID:8956
- C:\Windows\System\pZeBRgh.exe
  C:\Windows\System\pZeBRgh.exe
  2⤵
  PID:8984
- C:\Windows\System\AAmyKyn.exe
  C:\Windows\System\AAmyKyn.exe
  2⤵
  PID:9000
- C:\Windows\System\vbqUDhW.exe
  C:\Windows\System\vbqUDhW.exe
  2⤵
  PID:9024
- C:\Windows\System\YKsDzEY.exe
  C:\Windows\System\YKsDzEY.exe
  2⤵
  PID:9048
- C:\Windows\System\FEWEBNN.exe
  C:\Windows\System\FEWEBNN.exe
  2⤵
  PID:9072
- C:\Windows\System\HpoamRS.exe
  C:\Windows\System\HpoamRS.exe
  2⤵
  PID:9092
- C:\Windows\System\xkvsEPE.exe
  C:\Windows\System\xkvsEPE.exe
  2⤵
  PID:9120
- C:\Windows\System\zDUemOq.exe
  C:\Windows\System\zDUemOq.exe
  2⤵
  PID:9136
- C:\Windows\System\wotvuCd.exe
  C:\Windows\System\wotvuCd.exe
  2⤵
  PID:9160
- C:\Windows\System\SUPswDp.exe
  C:\Windows\System\SUPswDp.exe
  2⤵
  PID:9176
- C:\Windows\System\hELNlWl.exe
  C:\Windows\System\hELNlWl.exe
  2⤵
  PID:9196
- C:\Windows\System\jfFuzzA.exe
  C:\Windows\System\jfFuzzA.exe
  2⤵
  PID:9212
- C:\Windows\System\BQxttci.exe
  C:\Windows\System\BQxttci.exe
  2⤵
  PID:6452
- C:\Windows\System\uKXOOMM.exe
  C:\Windows\System\uKXOOMM.exe
  2⤵
  PID:7856
- C:\Windows\System\VcmOcbt.exe
  C:\Windows\System\VcmOcbt.exe
  2⤵
  PID:6540
- C:\Windows\System\wxrcxnK.exe
  C:\Windows\System\wxrcxnK.exe
  2⤵
  PID:6588
- C:\Windows\System\qjjiVGe.exe
  C:\Windows\System\qjjiVGe.exe
  2⤵
  PID:6620
- C:\Windows\System\ogxzeyV.exe
  C:\Windows\System\ogxzeyV.exe
  2⤵
  PID:6664
- C:\Windows\System\hFtYyef.exe
  C:\Windows\System\hFtYyef.exe
  2⤵
  PID:6700
- C:\Windows\System\JupCugz.exe
  C:\Windows\System\JupCugz.exe
  2⤵
  PID:6744
- C:\Windows\System\oTwFHoh.exe
  C:\Windows\System\oTwFHoh.exe
  2⤵
  PID:6784
- C:\Windows\System\vSgbUds.exe
  C:\Windows\System\vSgbUds.exe
  2⤵
  PID:6832
- C:\Windows\System\ByuZmjP.exe
  C:\Windows\System\ByuZmjP.exe
  2⤵
  PID:6880
- C:\Windows\System\VpjDsTd.exe
  C:\Windows\System\VpjDsTd.exe
  2⤵
  PID:6928
- C:\Windows\System\XwfYyQL.exe
  C:\Windows\System\XwfYyQL.exe
  2⤵
  PID:6964
- C:\Windows\System\tdkCGeo.exe
  C:\Windows\System\tdkCGeo.exe
  2⤵
  PID:6996
- C:\Windows\System\AfItPYY.exe
  C:\Windows\System\AfItPYY.exe
  2⤵
  PID:7044
- C:\Windows\System\OGSSyGB.exe
  C:\Windows\System\OGSSyGB.exe
  2⤵
  PID:7112
- C:\Windows\System\BCUiFoY.exe
  C:\Windows\System\BCUiFoY.exe
  2⤵
  PID:808
- C:\Windows\System\llpKMnr.exe
  C:\Windows\System\llpKMnr.exe
  2⤵
  PID:5804
- C:\Windows\System\EESvjso.exe
  C:\Windows\System\EESvjso.exe
  2⤵
  PID:5884
- C:\Windows\System\hhXNAxI.exe
  C:\Windows\System\hhXNAxI.exe
  2⤵
  PID:5968
- C:\Windows\System\SEffETI.exe
  C:\Windows\System\SEffETI.exe
  2⤵
  PID:6044
- C:\Windows\System\ghKzobJ.exe
  C:\Windows\System\ghKzobJ.exe
  2⤵
  PID:6120
- C:\Windows\System\VSQlMAu.exe
  C:\Windows\System\VSQlMAu.exe
  2⤵
  PID:1364
- C:\Windows\System\BfsdnSI.exe
  C:\Windows\System\BfsdnSI.exe
  2⤵
  PID:8084
- C:\Windows\System\jbXUekq.exe
  C:\Windows\System\jbXUekq.exe
  2⤵
  PID:7444
- C:\Windows\System\wIXmQSV.exe
  C:\Windows\System\wIXmQSV.exe
  2⤵
  PID:7492
- C:\Windows\System\sHSKzDl.exe
  C:\Windows\System\sHSKzDl.exe
  2⤵
  PID:9228
- C:\Windows\System\RMGSzWp.exe
  C:\Windows\System\RMGSzWp.exe
  2⤵
  PID:9248
- C:\Windows\System\UxNWIgr.exe
  C:\Windows\System\UxNWIgr.exe
  2⤵
  PID:9272
- C:\Windows\System\PaVMSKH.exe
  C:\Windows\System\PaVMSKH.exe
  2⤵
  PID:9292
- C:\Windows\System\FoDWviX.exe
  C:\Windows\System\FoDWviX.exe
  2⤵
  PID:9312
- C:\Windows\System\kFtADzO.exe
  C:\Windows\System\kFtADzO.exe
  2⤵
  PID:9328
- C:\Windows\System\kHRojBd.exe
  C:\Windows\System\kHRojBd.exe
  2⤵
  PID:9356
- C:\Windows\System\JGQWVbE.exe
  C:\Windows\System\JGQWVbE.exe
  2⤵
  PID:9380
- C:\Windows\System\sASXgOp.exe
  C:\Windows\System\sASXgOp.exe
  2⤵
  PID:9400
- C:\Windows\System\ppVauuj.exe
  C:\Windows\System\ppVauuj.exe
  2⤵
  PID:9416
- C:\Windows\System\rIlmOfF.exe
  C:\Windows\System\rIlmOfF.exe
  2⤵
  PID:9440
- C:\Windows\System\MIigwRQ.exe
  C:\Windows\System\MIigwRQ.exe
  2⤵
  PID:9464
- C:\Windows\System\VuRyOjl.exe
  C:\Windows\System\VuRyOjl.exe
  2⤵
  PID:9484
- C:\Windows\System\LItukua.exe
  C:\Windows\System\LItukua.exe
  2⤵
  PID:9504
- C:\Windows\System\gEAkOVE.exe
  C:\Windows\System\gEAkOVE.exe
  2⤵
  PID:9524
- C:\Windows\System\WMJCIjY.exe
  C:\Windows\System\WMJCIjY.exe
  2⤵
  PID:9544
- C:\Windows\System\mQBvxei.exe
  C:\Windows\System\mQBvxei.exe
  2⤵
  PID:9568
- C:\Windows\System\JmYiCya.exe
  C:\Windows\System\JmYiCya.exe
  2⤵
  PID:9584
- C:\Windows\System\uEidobD.exe
  C:\Windows\System\uEidobD.exe
  2⤵
  PID:9608
- C:\Windows\System\WxdhTHE.exe
  C:\Windows\System\WxdhTHE.exe
  2⤵
  PID:9624
- C:\Windows\System\PwWpVEs.exe
  C:\Windows\System\PwWpVEs.exe
  2⤵
  PID:9648
- C:\Windows\System\kOCpZlO.exe
  C:\Windows\System\kOCpZlO.exe
  2⤵
  PID:9664
- C:\Windows\System\glDfENE.exe
  C:\Windows\System\glDfENE.exe
  2⤵
  PID:9692
- C:\Windows\System\pBLmVPk.exe
  C:\Windows\System\pBLmVPk.exe
  2⤵
  PID:9708
- C:\Windows\System\Yjepkud.exe
  C:\Windows\System\Yjepkud.exe
  2⤵
  PID:9732
- C:\Windows\System\sNeiPfL.exe
  C:\Windows\System\sNeiPfL.exe
  2⤵
  PID:9756
- C:\Windows\System\ufIYGRO.exe
  C:\Windows\System\ufIYGRO.exe
  2⤵
  PID:9776
- C:\Windows\System\CeYnCvU.exe
  C:\Windows\System\CeYnCvU.exe
  2⤵
  PID:9800
- C:\Windows\System\MaIdYcK.exe
  C:\Windows\System\MaIdYcK.exe
  2⤵
  PID:9816
- C:\Windows\System\OvwdAmj.exe
  C:\Windows\System\OvwdAmj.exe
  2⤵
  PID:9836
- C:\Windows\System\rYQBvKi.exe
  C:\Windows\System\rYQBvKi.exe
  2⤵
  PID:9852
- C:\Windows\System\whMXeOF.exe
  C:\Windows\System\whMXeOF.exe
  2⤵
  PID:9872
- C:\Windows\System\MJVCpec.exe
  C:\Windows\System\MJVCpec.exe
  2⤵
  PID:9888
- C:\Windows\System\NsLRTtB.exe
  C:\Windows\System\NsLRTtB.exe
  2⤵
  PID:9912
- C:\Windows\System\AaJAUwb.exe
  C:\Windows\System\AaJAUwb.exe
  2⤵
  PID:9932
- C:\Windows\System\zWTVMko.exe
  C:\Windows\System\zWTVMko.exe
  2⤵
  PID:9952
- C:\Windows\System\jDxHigl.exe
  C:\Windows\System\jDxHigl.exe
  2⤵
  PID:9976
- C:\Windows\System\NeOdyaD.exe
  C:\Windows\System\NeOdyaD.exe
  2⤵
  PID:10000
- C:\Windows\System\arOFnxN.exe
  C:\Windows\System\arOFnxN.exe
  2⤵
  PID:10024
- C:\Windows\System\GvxWDXc.exe
  C:\Windows\System\GvxWDXc.exe
  2⤵
  PID:10044
- C:\Windows\System\VTBDTMh.exe
  C:\Windows\System\VTBDTMh.exe
  2⤵
  PID:10060
- C:\Windows\System\HxzARlI.exe
  C:\Windows\System\HxzARlI.exe
  2⤵
  PID:10076
- C:\Windows\System\ZUJrPft.exe
  C:\Windows\System\ZUJrPft.exe
  2⤵
  PID:10092
- C:\Windows\System\PdDatmW.exe
  C:\Windows\System\PdDatmW.exe
  2⤵
  PID:10108
- C:\Windows\System\UbRSULx.exe
  C:\Windows\System\UbRSULx.exe
  2⤵
  PID:10224
- C:\Windows\System\PBCaSIR.exe
  C:\Windows\System\PBCaSIR.exe
  2⤵
  PID:3684
- C:\Windows\System\uNKiGbE.exe
  C:\Windows\System\uNKiGbE.exe
  2⤵
  PID:7576
- C:\Windows\System\omSQXIT.exe
  C:\Windows\System\omSQXIT.exe
  2⤵
  PID:7672
- C:\Windows\System\uSnusab.exe
  C:\Windows\System\uSnusab.exe
  2⤵
  PID:4552
- C:\Windows\System\PDfinSG.exe
  C:\Windows\System\PDfinSG.exe
  2⤵
  PID:8232
- C:\Windows\System\RpOmcUq.exe
  C:\Windows\System\RpOmcUq.exe
  2⤵
  PID:8296
- C:\Windows\System\SRYncCi.exe
  C:\Windows\System\SRYncCi.exe
  2⤵
  PID:8384
- C:\Windows\System\KJtQNNu.exe
  C:\Windows\System\KJtQNNu.exe
  2⤵
  PID:8424
- C:\Windows\System\KTFcVhQ.exe
  C:\Windows\System\KTFcVhQ.exe
  2⤵
  PID:8516
- C:\Windows\System\grwSkpl.exe
  C:\Windows\System\grwSkpl.exe
  2⤵
  PID:7348
- C:\Windows\System\xZIooem.exe
  C:\Windows\System\xZIooem.exe
  2⤵
  PID:7372
- C:\Windows\System\vUxTTbF.exe
  C:\Windows\System\vUxTTbF.exe
  2⤵
  PID:8124
- C:\Windows\System\hObBDEC.exe
  C:\Windows\System\hObBDEC.exe
  2⤵
  PID:9108
- C:\Windows\System\aGuQqNC.exe
  C:\Windows\System\aGuQqNC.exe
  2⤵
  PID:9168
- C:\Windows\System\OybGcfY.exe
  C:\Windows\System\OybGcfY.exe
  2⤵
  PID:9208
- C:\Windows\System\YrQOUxm.exe
  C:\Windows\System\YrQOUxm.exe
  2⤵
  PID:10256
- C:\Windows\System\SwMZUfT.exe
  C:\Windows\System\SwMZUfT.exe
  2⤵
  PID:10280
- C:\Windows\System\ydWUyTN.exe
  C:\Windows\System\ydWUyTN.exe
  2⤵
  PID:10300
- C:\Windows\System\RcEFhMq.exe
  C:\Windows\System\RcEFhMq.exe
  2⤵
  PID:10324
- C:\Windows\System\kNGciUT.exe
  C:\Windows\System\kNGciUT.exe
  2⤵
  PID:10340
- C:\Windows\System\AjoWTof.exe
  C:\Windows\System\AjoWTof.exe
  2⤵
  PID:10360
- C:\Windows\System\meQQhxs.exe
  C:\Windows\System\meQQhxs.exe
  2⤵
  PID:10380
- C:\Windows\System\RVTAQFV.exe
  C:\Windows\System\RVTAQFV.exe
  2⤵
  PID:10404
- C:\Windows\System\gPZZFwA.exe
  C:\Windows\System\gPZZFwA.exe
  2⤵
  PID:10428
- C:\Windows\System\vUHSYbM.exe
  C:\Windows\System\vUHSYbM.exe
  2⤵
  PID:10444
- C:\Windows\System\gmqZtus.exe
  C:\Windows\System\gmqZtus.exe
  2⤵
  PID:10464
- C:\Windows\System\EAgWFsQ.exe
  C:\Windows\System\EAgWFsQ.exe
  2⤵
  PID:10484
- C:\Windows\System\bWhlTfV.exe
  C:\Windows\System\bWhlTfV.exe
  2⤵
  PID:10528
- C:\Windows\System\oBlcDMr.exe
  C:\Windows\System\oBlcDMr.exe
  2⤵
  PID:10548
- C:\Windows\System\OVrxxpB.exe
  C:\Windows\System\OVrxxpB.exe
  2⤵
  PID:10568
- C:\Windows\System\WXQYIcC.exe
  C:\Windows\System\WXQYIcC.exe
  2⤵
  PID:10588
- C:\Windows\System\yqwZjLa.exe
  C:\Windows\System\yqwZjLa.exe
  2⤵
  PID:10612
- C:\Windows\System\AyFTcnI.exe
  C:\Windows\System\AyFTcnI.exe
  2⤵
  PID:10632
- C:\Windows\System\KnHhEqe.exe
  C:\Windows\System\KnHhEqe.exe
  2⤵
  PID:10652
- C:\Windows\System\zlzxJiw.exe
  C:\Windows\System\zlzxJiw.exe
  2⤵
  PID:10668
- C:\Windows\System\MkTMMCp.exe
  C:\Windows\System\MkTMMCp.exe
  2⤵
  PID:10696
- C:\Windows\System\dBHdwoH.exe
  C:\Windows\System\dBHdwoH.exe
  2⤵
  PID:10716
- C:\Windows\System\CnrDNvt.exe
  C:\Windows\System\CnrDNvt.exe
  2⤵
  PID:10736
- C:\Windows\System\wpGKXcx.exe
  C:\Windows\System\wpGKXcx.exe
  2⤵
  PID:10752
- C:\Windows\System\dtQHXGb.exe
  C:\Windows\System\dtQHXGb.exe
  2⤵
  PID:10776
- C:\Windows\System\JxDaOKY.exe
  C:\Windows\System\JxDaOKY.exe
  2⤵
  PID:10796
- C:\Windows\System\WMebEyN.exe
  C:\Windows\System\WMebEyN.exe
  2⤵
  PID:10816
- C:\Windows\System\MsYVEBe.exe
  C:\Windows\System\MsYVEBe.exe
  2⤵
  PID:10836
- C:\Windows\System\tBnGIND.exe
  C:\Windows\System\tBnGIND.exe
  2⤵
  PID:11128
- C:\Windows\System\cpnlMze.exe
  C:\Windows\System\cpnlMze.exe
  2⤵
  PID:11196
- C:\Windows\System\qFgPAIO.exe
  C:\Windows\System\qFgPAIO.exe
  2⤵
  PID:11216
- C:\Windows\System\TKsHenf.exe
  C:\Windows\System\TKsHenf.exe
  2⤵
  PID:11232
- C:\Windows\System\lBvPcUe.exe
  C:\Windows\System\lBvPcUe.exe
  2⤵
  PID:11260
- C:\Windows\System\tKXOafu.exe
  C:\Windows\System\tKXOafu.exe
  2⤵
  PID:7888
- C:\Windows\System\bbBIRPM.exe
  C:\Windows\System\bbBIRPM.exe
  2⤵
  PID:6780
- C:\Windows\System\AUVtQhX.exe
  C:\Windows\System\AUVtQhX.exe
  2⤵
  PID:6912
- C:\Windows\System\dbbjmgm.exe
  C:\Windows\System\dbbjmgm.exe
  2⤵
  PID:6984
- C:\Windows\System\mlYxSyr.exe
  C:\Windows\System\mlYxSyr.exe
  2⤵
  PID:5780
- C:\Windows\System\UAHafkQ.exe
  C:\Windows\System\UAHafkQ.exe
  2⤵
  PID:6084
- C:\Windows\System\SCHNQFN.exe
  C:\Windows\System\SCHNQFN.exe
  2⤵
  PID:5164
- C:\Windows\System\CIMZsbQ.exe
  C:\Windows\System\CIMZsbQ.exe
  2⤵
  PID:7472
- C:\Windows\System\ShimCQX.exe
  C:\Windows\System\ShimCQX.exe
  2⤵
  PID:9264
- C:\Windows\System\xdeHRpq.exe
  C:\Windows\System\xdeHRpq.exe
  2⤵
  PID:6388
- C:\Windows\System\DvYuyPf.exe
  C:\Windows\System\DvYuyPf.exe
  2⤵
  PID:6248
- C:\Windows\System\nEDiSqy.exe
  C:\Windows\System\nEDiSqy.exe
  2⤵
  PID:7616
- C:\Windows\System\OxrsXcp.exe
  C:\Windows\System\OxrsXcp.exe
  2⤵
  PID:7660
- C:\Windows\System\pMsETVj.exe
  C:\Windows\System\pMsETVj.exe
  2⤵
  PID:9540
- C:\Windows\System\IbILUJI.exe
  C:\Windows\System\IbILUJI.exe
  2⤵
  PID:9604
- C:\Windows\System\bgKJwSp.exe
  C:\Windows\System\bgKJwSp.exe
  2⤵
  PID:7732
- C:\Windows\System\rGFsvhI.exe
  C:\Windows\System\rGFsvhI.exe
  2⤵
  PID:8256
- C:\Windows\System\dtTjWed.exe
  C:\Windows\System\dtTjWed.exe
  2⤵
  PID:8364
- C:\Windows\System\mrMihhI.exe
  C:\Windows\System\mrMihhI.exe
  2⤵
  PID:8468
- C:\Windows\System\lDClBwJ.exe
  C:\Windows\System\lDClBwJ.exe
  2⤵
  PID:10088
- C:\Windows\System\IwUxpvL.exe
  C:\Windows\System\IwUxpvL.exe
  2⤵
  PID:7908
- C:\Windows\System\TROZUnQ.exe
  C:\Windows\System\TROZUnQ.exe
  2⤵
  PID:7924
- C:\Windows\System\YafQfgh.exe
  C:\Windows\System\YafQfgh.exe
  2⤵
  PID:7968
- C:\Windows\System\olLgVUn.exe
  C:\Windows\System\olLgVUn.exe
  2⤵
  PID:8004
- C:\Windows\System\ILbbdPF.exe
  C:\Windows\System\ILbbdPF.exe
  2⤵
  PID:8036
- C:\Windows\System\WkDrPye.exe
  C:\Windows\System\WkDrPye.exe
  2⤵
  PID:8100
- C:\Windows\System\CdrUZPY.exe
  C:\Windows\System\CdrUZPY.exe
  2⤵
  PID:8164
- C:\Windows\System\DBuSbhb.exe
  C:\Windows\System\DBuSbhb.exe
  2⤵
  PID:9064
- C:\Windows\System\ebdWthT.exe
  C:\Windows\System\ebdWthT.exe
  2⤵
  PID:7224
- C:\Windows\System\msiGJEU.exe
  C:\Windows\System\msiGJEU.exe
  2⤵
  PID:6616
- C:\Windows\System\lkXTdPr.exe
  C:\Windows\System\lkXTdPr.exe
  2⤵
  PID:6848
- C:\Windows\System\bweozMK.exe
  C:\Windows\System\bweozMK.exe
  2⤵
  PID:6948
- C:\Windows\System\kJyPaYk.exe
  C:\Windows\System\kJyPaYk.exe
  2⤵
  PID:9552
- C:\Windows\System\rMhbmeK.exe
  C:\Windows\System\rMhbmeK.exe
  2⤵
  PID:7152
- C:\Windows\System\iLhRMAh.exe
  C:\Windows\System\iLhRMAh.exe
  2⤵
  PID:4608
- C:\Windows\System\nktMlgT.exe
  C:\Windows\System\nktMlgT.exe
  2⤵
  PID:10688
- C:\Windows\System\IqHbhXc.exe
  C:\Windows\System\IqHbhXc.exe
  2⤵
  PID:10784
- C:\Windows\System\MSxeDXd.exe
  C:\Windows\System\MSxeDXd.exe
  2⤵
  PID:7260
- C:\Windows\System\NiEULsI.exe
  C:\Windows\System\NiEULsI.exe
  2⤵
  PID:10824
- C:\Windows\System\zwNCYsZ.exe
  C:\Windows\System\zwNCYsZ.exe
  2⤵
  PID:6256
- C:\Windows\System\lFpXSAW.exe
  C:\Windows\System\lFpXSAW.exe
  2⤵
  PID:9424
- C:\Windows\System\aWWZHGF.exe
  C:\Windows\System\aWWZHGF.exe
  2⤵
  PID:5456
- C:\Windows\System\yKmWXPu.exe
  C:\Windows\System\yKmWXPu.exe
  2⤵
  PID:7756
- C:\Windows\System\omvRmQv.exe
  C:\Windows\System\omvRmQv.exe
  2⤵
  PID:11272
- C:\Windows\System\sNaXixp.exe
  C:\Windows\System\sNaXixp.exe
  2⤵
  PID:11292
- C:\Windows\System\WBLFaIJ.exe
  C:\Windows\System\WBLFaIJ.exe
  2⤵
  PID:11308
- C:\Windows\System\aoVbjnI.exe
  C:\Windows\System\aoVbjnI.exe
  2⤵
  PID:11332
- C:\Windows\System\bZMYaAC.exe
  C:\Windows\System\bZMYaAC.exe
  2⤵
  PID:11352
- C:\Windows\System\bKUbNXU.exe
  C:\Windows\System\bKUbNXU.exe
  2⤵
  PID:11368
- C:\Windows\System\DLRsemJ.exe
  C:\Windows\System\DLRsemJ.exe
  2⤵
  PID:11388
- C:\Windows\System\FNCyfkI.exe
  C:\Windows\System\FNCyfkI.exe
  2⤵
  PID:11412
- C:\Windows\System\wbkvnDV.exe
  C:\Windows\System\wbkvnDV.exe
  2⤵
  PID:11436
- C:\Windows\System\lLqxtQT.exe
  C:\Windows\System\lLqxtQT.exe
  2⤵
  PID:11460
- C:\Windows\System\WdGeYkT.exe
  C:\Windows\System\WdGeYkT.exe
  2⤵
  PID:11476
- C:\Windows\System\vwPaXxy.exe
  C:\Windows\System\vwPaXxy.exe
  2⤵
  PID:11500
- C:\Windows\System\PiPZpqN.exe
  C:\Windows\System\PiPZpqN.exe
  2⤵
  PID:11520
- C:\Windows\System\FtGpImH.exe
  C:\Windows\System\FtGpImH.exe
  2⤵
  PID:11540
- C:\Windows\System\vktaXOw.exe
  C:\Windows\System\vktaXOw.exe
  2⤵
  PID:11560
- C:\Windows\System\udedQEo.exe
  C:\Windows\System\udedQEo.exe
  2⤵
  PID:11580
- C:\Windows\System\VJIKIua.exe
  C:\Windows\System\VJIKIua.exe
  2⤵
  PID:11600
- C:\Windows\System\dStQCdI.exe
  C:\Windows\System\dStQCdI.exe
  2⤵
  PID:11620
- C:\Windows\System\uyhPpJF.exe
  C:\Windows\System\uyhPpJF.exe
  2⤵
  PID:11636
- C:\Windows\System\ynsNrnD.exe
  C:\Windows\System\ynsNrnD.exe
  2⤵
  PID:11660
- C:\Windows\System\WIbtxGt.exe
  C:\Windows\System\WIbtxGt.exe
  2⤵
  PID:8760
- C:\Windows\System\DepRPgD.exe
  C:\Windows\System\DepRPgD.exe
  2⤵
  PID:8804
- C:\Windows\System\tXlfPTr.exe
  C:\Windows\System\tXlfPTr.exe
  2⤵
  PID:8836
- C:\Windows\System\xHwXsSo.exe
  C:\Windows\System\xHwXsSo.exe
  2⤵
  PID:8900
- C:\Windows\System\xfUPoSY.exe
  C:\Windows\System\xfUPoSY.exe
  2⤵
  PID:8860
- C:\Windows\System\oWtqzAQ.exe
  C:\Windows\System\oWtqzAQ.exe
  2⤵
  PID:9060
- C:\Windows\System\YWCQNuY.exe
  C:\Windows\System\YWCQNuY.exe
  2⤵
  PID:9192
- C:\Windows\System\IkpkkmX.exe
  C:\Windows\System\IkpkkmX.exe
  2⤵
  PID:5852
- C:\Windows\System\VuwklIy.exe
  C:\Windows\System\VuwklIy.exe
  2⤵
  PID:5840
- C:\Windows\System\dHpyWuF.exe
  C:\Windows\System\dHpyWuF.exe
  2⤵
  PID:9224
- C:\Windows\System\qENjLcL.exe
  C:\Windows\System\qENjLcL.exe
  2⤵
  PID:9580
- C:\Windows\System\DetDjBh.exe
  C:\Windows\System\DetDjBh.exe
  2⤵
  PID:10072
- C:\Windows\System\zyNEJGN.exe
  C:\Windows\System\zyNEJGN.exe
  2⤵
  PID:10480
- C:\Windows\System\xYkVLNV.exe
  C:\Windows\System\xYkVLNV.exe
  2⤵
  PID:11340
- C:\Windows\System\EgkfZlg.exe
  C:\Windows\System\EgkfZlg.exe
  2⤵
  PID:3340
- C:\Windows\System\nSJXsrT.exe
  C:\Windows\System\nSJXsrT.exe
  2⤵
  PID:11000
- C:\Windows\System\GkNFeCB.exe
  C:\Windows\System\GkNFeCB.exe
  2⤵
  PID:10168
- C:\Windows\System\ZNwJrsQ.exe
  C:\Windows\System\ZNwJrsQ.exe
  2⤵
  PID:10220
- C:\Windows\System\bajxmUK.exe
  C:\Windows\System\bajxmUK.exe
  2⤵
  PID:7640
- C:\Windows\System\EnkFYLh.exe
  C:\Windows\System\EnkFYLh.exe
  2⤵
  PID:448
- C:\Windows\System\mXBYvmb.exe
  C:\Windows\System\mXBYvmb.exe
  2⤵
  PID:9344
- C:\Windows\System\KItZEmf.exe
  C:\Windows\System\KItZEmf.exe
  2⤵
  PID:9720
- C:\Windows\System\CJDoPmR.exe
  C:\Windows\System\CJDoPmR.exe
  2⤵
  PID:9828
- C:\Windows\System\NhJHJnB.exe
  C:\Windows\System\NhJHJnB.exe
  2⤵
  PID:9924
- C:\Windows\System\eKKNrMf.exe
  C:\Windows\System\eKKNrMf.exe
  2⤵
  PID:11164
- C:\Windows\System\YvImVxa.exe
  C:\Windows\System\YvImVxa.exe
  2⤵
  PID:10116
- C:\Windows\System\WMFImfJ.exe
  C:\Windows\System\WMFImfJ.exe
  2⤵
  PID:10100
- C:\Windows\System\mBosBBl.exe
  C:\Windows\System\mBosBBl.exe
  2⤵
  PID:10460
- C:\Windows\System\OzCfzaX.exe
  C:\Windows\System\OzCfzaX.exe
  2⤵
  PID:11256
- C:\Windows\System\yLUnQYv.exe
  C:\Windows\System\yLUnQYv.exe
  2⤵
  PID:6032
- C:\Windows\System\vhAAbVl.exe
  C:\Windows\System\vhAAbVl.exe
  2⤵
  PID:11304
- C:\Windows\System\zdLaZbM.exe
  C:\Windows\System\zdLaZbM.exe
  2⤵
  PID:11360
- C:\Windows\System\ilFbXVk.exe
  C:\Windows\System\ilFbXVk.exe
  2⤵
  PID:11740
- C:\Windows\System\howcXhN.exe
  C:\Windows\System\howcXhN.exe
  2⤵
  PID:4388
- C:\Windows\System\LdPgaQv.exe
  C:\Windows\System\LdPgaQv.exe
  2⤵
  PID:11052
- C:\Windows\System\bKUWBmA.exe
  C:\Windows\System\bKUWBmA.exe
  2⤵
  PID:64
- C:\Windows\System\UtkvhYE.exe
  C:\Windows\System\UtkvhYE.exe
  2⤵
  PID:6536
- C:\Windows\System\XZfYmYF.exe
  C:\Windows\System\XZfYmYF.exe
  2⤵
  PID:6732
- C:\Windows\System\beSkEDJ.exe
  C:\Windows\System\beSkEDJ.exe
  2⤵
  PID:7140
- C:\Windows\System\HVTldaZ.exe
  C:\Windows\System\HVTldaZ.exe
  2⤵
  PID:9644
- C:\Windows\System\GOxTyWt.exe
  C:\Windows\System\GOxTyWt.exe
  2⤵
  PID:9784
- C:\Windows\System\FfOWcry.exe
  C:\Windows\System\FfOWcry.exe
  2⤵
  PID:3572
- C:\Windows\System\WstHqFX.exe
  C:\Windows\System\WstHqFX.exe
  2⤵
  PID:4612
- C:\Windows\System\NcNjDsw.exe
  C:\Windows\System\NcNjDsw.exe
  2⤵
  PID:10436
- C:\Windows\System\HzUgxsu.exe
  C:\Windows\System\HzUgxsu.exe
  2⤵
  PID:10536
- C:\Windows\System\DkofTHT.exe
  C:\Windows\System\DkofTHT.exe
  2⤵
  PID:9620
- C:\Windows\System\NpbxJAn.exe
  C:\Windows\System\NpbxJAn.exe
  2⤵
  PID:11252
- C:\Windows\System\YudMPac.exe
  C:\Windows\System\YudMPac.exe
  2⤵
  PID:12296
- C:\Windows\System\QDdwbvh.exe
  C:\Windows\System\QDdwbvh.exe
  2⤵
  PID:12316
- C:\Windows\System\xEGxSSV.exe
  C:\Windows\System\xEGxSSV.exe
  2⤵
  PID:12336
- C:\Windows\System\KeTqwiZ.exe
  C:\Windows\System\KeTqwiZ.exe
  2⤵
  PID:12356
- C:\Windows\System\HwKLAHC.exe
  C:\Windows\System\HwKLAHC.exe
  2⤵
  PID:12376
- C:\Windows\System\evtgPij.exe
  C:\Windows\System\evtgPij.exe
  2⤵
  PID:12396
- C:\Windows\System\IeqJPRq.exe
  C:\Windows\System\IeqJPRq.exe
  2⤵
  PID:12412
- C:\Windows\System\WGGCBaH.exe
  C:\Windows\System\WGGCBaH.exe
  2⤵
  PID:12432
- C:\Windows\System\hbTMwZZ.exe
  C:\Windows\System\hbTMwZZ.exe
  2⤵
  PID:12452
- C:\Windows\System\NqigIbr.exe
  C:\Windows\System\NqigIbr.exe
  2⤵
  PID:12472
- C:\Windows\System\qOBTeJn.exe
  C:\Windows\System\qOBTeJn.exe
  2⤵
  PID:12492
- C:\Windows\System\iTCoKXD.exe
  C:\Windows\System\iTCoKXD.exe
  2⤵
  PID:12528
- C:\Windows\System\lPtlzdE.exe
  C:\Windows\System\lPtlzdE.exe
  2⤵
  PID:12544
- C:\Windows\System\SfgFMca.exe
  C:\Windows\System\SfgFMca.exe
  2⤵
  PID:12564
- C:\Windows\System\FeZrfZq.exe
  C:\Windows\System\FeZrfZq.exe
  2⤵
  PID:12584
- C:\Windows\System\HXPcIDb.exe
  C:\Windows\System\HXPcIDb.exe
  2⤵
  PID:12604
- C:\Windows\System\OejSkio.exe
  C:\Windows\System\OejSkio.exe
  2⤵
  PID:12620
- C:\Windows\System\HfUwVhj.exe
  C:\Windows\System\HfUwVhj.exe
  2⤵
  PID:12640
- C:\Windows\System\HYabRkd.exe
  C:\Windows\System\HYabRkd.exe
  2⤵
  PID:12660
- C:\Windows\System\hhBnJXv.exe
  C:\Windows\System\hhBnJXv.exe
  2⤵
  PID:12680
- C:\Windows\System\WWfOzYd.exe
  C:\Windows\System\WWfOzYd.exe
  2⤵
  PID:12704
- C:\Windows\System\HgQdZoI.exe
  C:\Windows\System\HgQdZoI.exe
  2⤵
  PID:12720
- C:\Windows\System\yGoEScI.exe
  C:\Windows\System\yGoEScI.exe
  2⤵
  PID:12740
- C:\Windows\System\wElnVxE.exe
  C:\Windows\System\wElnVxE.exe
  2⤵
  PID:12756
- C:\Windows\System\XDfRFOi.exe
  C:\Windows\System\XDfRFOi.exe
  2⤵
  PID:12772
- C:\Windows\System\gHNjfaw.exe
  C:\Windows\System\gHNjfaw.exe
  2⤵
  PID:12792
- C:\Windows\System\tCbAeMD.exe
  C:\Windows\System\tCbAeMD.exe
  2⤵
  PID:12808
- C:\Windows\System\qRAbWUW.exe
  C:\Windows\System\qRAbWUW.exe
  2⤵
  PID:12824
- C:\Windows\System\cqWcXsD.exe
  C:\Windows\System\cqWcXsD.exe
  2⤵
  PID:12840
- C:\Windows\System\FeawhLk.exe
  C:\Windows\System\FeawhLk.exe
  2⤵
  PID:12856
- C:\Windows\System\NPfHNYk.exe
  C:\Windows\System\NPfHNYk.exe
  2⤵
  PID:12872
- C:\Windows\System\ccxtOis.exe
  C:\Windows\System\ccxtOis.exe
  2⤵
  PID:12892
- C:\Windows\System\VANiUyr.exe
  C:\Windows\System\VANiUyr.exe
  2⤵
  PID:12912
- C:\Windows\System\IecaZCo.exe
  C:\Windows\System\IecaZCo.exe
  2⤵
  PID:12428
- C:\Windows\System\nFHmFoF.exe
  C:\Windows\System\nFHmFoF.exe
  2⤵
  PID:12468
- C:\Windows\System\AyoYeoS.exe
  C:\Windows\System\AyoYeoS.exe
  2⤵
  PID:12504
- C:\Windows\System\RhVcqMl.exe
  C:\Windows\System\RhVcqMl.exe
  2⤵
  PID:12560
- C:\Windows\System\Gaqrpkg.exe
  C:\Windows\System\Gaqrpkg.exe
  2⤵
  PID:12596
- C:\Windows\System\PUekGOB.exe
  C:\Windows\System\PUekGOB.exe
  2⤵
  PID:12628
- C:\Windows\System\pAjSNlk.exe
  C:\Windows\System\pAjSNlk.exe
  2⤵
  PID:12752
- C:\Windows\System\DhuBmtH.exe
  C:\Windows\System\DhuBmtH.exe
  2⤵
  PID:12804
- C:\Windows\System\FigSWhx.exe
  C:\Windows\System\FigSWhx.exe
  2⤵
  PID:12920
- C:\Windows\System\RmymcgY.exe
  C:\Windows\System\RmymcgY.exe
  2⤵
  PID:12940
- C:\Windows\System\NKRGDxy.exe
  C:\Windows\System\NKRGDxy.exe
  2⤵
  PID:8904
- C:\Windows\System\tUwePhf.exe
  C:\Windows\System\tUwePhf.exe
  2⤵
  PID:13012
- C:\Windows\System\TrajCnB.exe
  C:\Windows\System\TrajCnB.exe
  2⤵
  PID:13040
- C:\Windows\System\HtSzzjK.exe
  C:\Windows\System\HtSzzjK.exe
  2⤵
  PID:11212
- C:\Windows\System\ByKUUXD.exe
  C:\Windows\System\ByKUUXD.exe
  2⤵
  PID:10904
- C:\Windows\System\oWGiVhx.exe
  C:\Windows\System\oWGiVhx.exe
  2⤵
  PID:5380
- C:\Windows\System\WvFoVIy.exe
  C:\Windows\System\WvFoVIy.exe
  2⤵
  PID:10084
- C:\Windows\System\VlRsKol.exe
  C:\Windows\System\VlRsKol.exe
  2⤵
  PID:12656
- C:\Windows\System\kvoyQAG.exe
  C:\Windows\System\kvoyQAG.exe
  2⤵
  PID:3472
- C:\Windows\System\JZOMPtn.exe
  C:\Windows\System\JZOMPtn.exe
  2⤵
  PID:13020
- C:\Windows\System\xmZpOiH.exe
  C:\Windows\System\xmZpOiH.exe
  2⤵
  PID:4916
- C:\Windows\System\wbTXJOg.exe
  C:\Windows\System\wbTXJOg.exe
  2⤵
  PID:11288
- C:\Windows\System\nzwUGSE.exe
  C:\Windows\System\nzwUGSE.exe
  2⤵
  PID:12700
- C:\Windows\System\DIbsVyc.exe
  C:\Windows\System\DIbsVyc.exe
  2⤵
  PID:12652
- C:\Windows\System\FFmYYRM.exe
  C:\Windows\System\FFmYYRM.exe
  2⤵
  PID:10120
- C:\Windows\System\AaKqVyt.exe
  C:\Windows\System\AaKqVyt.exe
  2⤵
  PID:7920
- C:\Windows\System\nFanMuy.exe
  C:\Windows\System\nFanMuy.exe
  2⤵
  PID:6900
- C:\Windows\System\mhBNoTZ.exe
  C:\Windows\System\mhBNoTZ.exe
  2⤵
  PID:12092
- C:\Windows\System\BwCWXWa.exe
  C:\Windows\System\BwCWXWa.exe
  2⤵
  PID:11040
- C:\Windows\System\ETqXozx.exe
  C:\Windows\System\ETqXozx.exe
  2⤵
  PID:2380
- C:\Windows\System\XaiciaO.exe
  C:\Windows\System\XaiciaO.exe
  2⤵
  PID:12832
- C:\Windows\System\UXcoARE.exe
  C:\Windows\System\UXcoARE.exe
  2⤵
  PID:12884
- C:\Windows\System\fChYFsH.exe
  C:\Windows\System\fChYFsH.exe
  2⤵
  PID:13160
- C:\Windows\System\zkKsjpC.exe
  C:\Windows\System\zkKsjpC.exe
  2⤵
  PID:13292
- C:\Windows\System\KQVnGRJ.exe
  C:\Windows\System\KQVnGRJ.exe
  2⤵
  PID:212
- C:\Windows\System\dcEKKsN.exe
  C:\Windows\System\dcEKKsN.exe
  2⤵
  PID:1580
- C:\Windows\System\znpYfuv.exe
  C:\Windows\System\znpYfuv.exe
  2⤵
  PID:13112
- C:\Windows\System\tVOVNnJ.exe
  C:\Windows\System\tVOVNnJ.exe
  2⤵
  PID:11484
- C:\Windows\System\HaYEvtf.exe
  C:\Windows\System\HaYEvtf.exe
  2⤵
  PID:11448
- C:\Windows\System\hOahOnd.exe
  C:\Windows\System\hOahOnd.exe
  2⤵
  PID:11284
- C:\Windows\System\GyjugBm.exe
  C:\Windows\System\GyjugBm.exe
  2⤵
  PID:12160
- C:\Windows\System\hClUWbg.exe
  C:\Windows\System\hClUWbg.exe
  2⤵
  PID:12572
- C:\Windows\System\JUzEdme.exe
  C:\Windows\System\JUzEdme.exe
  2⤵
  PID:13236
- C:\Windows\System\dEUCgMi.exe
  C:\Windows\System\dEUCgMi.exe
  2⤵
  PID:11240
- C:\Windows\System\FwYWtvG.exe
  C:\Windows\System\FwYWtvG.exe
  2⤵
  PID:12096
- C:\Windows\System\EnrmLOs.exe
  C:\Windows\System\EnrmLOs.exe
  2⤵
  PID:2168
- C:\Windows\System\ZBsmyaS.exe
  C:\Windows\System\ZBsmyaS.exe
  2⤵
  PID:9880
- C:\Windows\System\GANDDKd.exe
  C:\Windows\System\GANDDKd.exe
  2⤵
  PID:13116
- C:\Windows\System\DqJboON.exe
  C:\Windows\System\DqJboON.exe
  2⤵
  PID:13188
- C:\Windows\System\UlOSqpc.exe
  C:\Windows\System\UlOSqpc.exe
  2⤵
  PID:9520
- C:\Windows\System\uppqxUI.exe
  C:\Windows\System\uppqxUI.exe
  2⤵
  PID:6604
- C:\Windows\System\KzZoCyC.exe
  C:\Windows\System\KzZoCyC.exe
  2⤵
  PID:11632
- C:\Windows\System\SRGZgxQ.exe
  C:\Windows\System\SRGZgxQ.exe
  2⤵
  PID:13300
- C:\Windows\System\MXCuxqw.exe
  C:\Windows\System\MXCuxqw.exe
  2⤵
  PID:10608
- C:\Windows\System\kHITaYS.exe
  C:\Windows\System\kHITaYS.exe
  2⤵
  PID:9968
- C:\Windows\System\AvkBzdh.exe
  C:\Windows\System\AvkBzdh.exe
  2⤵
  PID:10680
- C:\Windows\System\LFkgyyt.exe
  C:\Windows\System\LFkgyyt.exe
  2⤵
  PID:13108
- C:\Windows\System\rZgfYpP.exe
  C:\Windows\System\rZgfYpP.exe
  2⤵
  PID:12956
- C:\Windows\System\dbINfgs.exe
  C:\Windows\System\dbINfgs.exe
  2⤵
  PID:11816
- C:\Windows\System\mVWwjqZ.exe
  C:\Windows\System\mVWwjqZ.exe
  2⤵
  PID:13120
- C:\Windows\System\lCTReSf.exe
  C:\Windows\System\lCTReSf.exe
  2⤵
  PID:10916
- C:\Windows\System\uVZCshH.exe
  C:\Windows\System\uVZCshH.exe
  2⤵
  PID:4304
- C:\Windows\System\YEbKWtK.exe
  C:\Windows\System\YEbKWtK.exe
  2⤵
  PID:12944
- C:\Windows\System\LgLvjNV.exe
  C:\Windows\System\LgLvjNV.exe
  2⤵
  PID:11112
- C:\Windows\System\NIVFtRZ.exe
  C:\Windows\System\NIVFtRZ.exe
  2⤵
  PID:4088
- C:\Windows\System\iahVAiZ.exe
  C:\Windows\System\iahVAiZ.exe
  2⤵
  PID:13148
- C:\Windows\System\mtOGfhw.exe
  C:\Windows\System\mtOGfhw.exe
  2⤵
  PID:13004
- C:\Windows\System\rTyEOsy.exe
  C:\Windows\System\rTyEOsy.exe
  2⤵
  PID:13056
- C:\Windows\System\pQfEKzs.exe
  C:\Windows\System\pQfEKzs.exe
  2⤵
  PID:2688
- C:\Windows\System\LwtEOkj.exe
  C:\Windows\System\LwtEOkj.exe
  2⤵
  PID:7984
- C:\Windows\System\mayPlud.exe
  C:\Windows\System\mayPlud.exe
  2⤵
  PID:11400
- C:\Windows\System\SuZhmZD.exe
  C:\Windows\System\SuZhmZD.exe
  2⤵
  PID:13032
- C:\Windows\System\bPHVEEK.exe
  C:\Windows\System\bPHVEEK.exe
  2⤵
  PID:2460
- C:\Windows\System\tYtPlsX.exe
  C:\Windows\System\tYtPlsX.exe
  2⤵
  PID:5372
- C:\Windows\System\NaSSDGM.exe
  C:\Windows\System\NaSSDGM.exe
  2⤵
  PID:10648
- C:\Windows\System\kkzANpz.exe
  C:\Windows\System\kkzANpz.exe
  2⤵
  PID:12308
- C:\Windows\System\gAlUzkx.exe
  C:\Windows\System\gAlUzkx.exe
  2⤵
  PID:9408
- C:\Windows\System\ENrhbdC.exe
  C:\Windows\System\ENrhbdC.exe
  2⤵
  PID:13088
- C:\Windows\System\YHnmPrn.exe
  C:\Windows\System\YHnmPrn.exe
  2⤵
  PID:168
- C:\Windows\System\BTgyCdn.exe
  C:\Windows\System\BTgyCdn.exe
  2⤵
  PID:5752
- C:\Windows\System\qafVmvD.exe
  C:\Windows\System\qafVmvD.exe
  2⤵
  PID:5728
- C:\Windows\System\TAZKGoh.exe
  C:\Windows\System\TAZKGoh.exe
  2⤵
  PID:5756
- C:\Windows\System\uvAYxnj.exe
  C:\Windows\System\uvAYxnj.exe
  2⤵
  PID:6168
- C:\Windows\System\HBMOhir.exe
  C:\Windows\System\HBMOhir.exe
  2⤵
  PID:6160
- C:\Windows\System\rPsNQJT.exe
  C:\Windows\System\rPsNQJT.exe
  2⤵
  PID:12728
- C:\Windows\System\rSFrfmO.exe
  C:\Windows\System\rSFrfmO.exe
  2⤵
  PID:11380
- C:\Windows\System\kkYPcFi.exe
  C:\Windows\System\kkYPcFi.exe
  2⤵
  PID:13016
- C:\Windows\System\tSHePPQ.exe
  C:\Windows\System\tSHePPQ.exe
  2⤵
  PID:8520
- C:\Windows\System\uofHbJe.exe
  C:\Windows\System\uofHbJe.exe
  2⤵
  PID:12208
- C:\Windows\System\zziljNQ.exe
  C:\Windows\System\zziljNQ.exe
  2⤵
  PID:8068
- C:\Windows\System\pwYOpMo.exe
  C:\Windows\System\pwYOpMo.exe
  2⤵
  PID:5316
- C:\Windows\System\CgXOMHf.exe
  C:\Windows\System\CgXOMHf.exe
  2⤵
  PID:800
- C:\Windows\System\PYSxspK.exe
  C:\Windows\System\PYSxspK.exe
  2⤵
  PID:6224
- C:\Windows\System\TAeBYqf.exe
  C:\Windows\System\TAeBYqf.exe
  2⤵
  PID:13320
- C:\Windows\System\sIdrenv.exe
  C:\Windows\System\sIdrenv.exe
  2⤵
  PID:13344
- C:\Windows\System\LhAdBzh.exe
  C:\Windows\System\LhAdBzh.exe
  2⤵
  PID:13360
- C:\Windows\System\kIgdzbc.exe
  C:\Windows\System\kIgdzbc.exe
  2⤵
  PID:13384
- C:\Windows\System\sfeXIvI.exe
  C:\Windows\System\sfeXIvI.exe
  2⤵
  PID:13404
- C:\Windows\System\ziARKdc.exe
  C:\Windows\System\ziARKdc.exe
  2⤵
  PID:13424
- C:\Windows\System\wvSrnyJ.exe
  C:\Windows\System\wvSrnyJ.exe
  2⤵
  PID:13448
- C:\Windows\System\KGrzcTe.exe
  C:\Windows\System\KGrzcTe.exe
  2⤵
  PID:13468
- C:\Windows\System\tnDPEBp.exe
  C:\Windows\System\tnDPEBp.exe
  2⤵
  PID:13492
- C:\Windows\System\zgILTIS.exe
  C:\Windows\System\zgILTIS.exe
  2⤵
  PID:13508
- C:\Windows\System\DQLoySS.exe
  C:\Windows\System\DQLoySS.exe
  2⤵
  PID:13532
- C:\Windows\System\wJXvYwn.exe
  C:\Windows\System\wJXvYwn.exe
  2⤵
  PID:13552
- C:\Windows\System\QwNLfug.exe
  C:\Windows\System\QwNLfug.exe
  2⤵
  PID:13572
- C:\Windows\System\IBFRxOC.exe
  C:\Windows\System\IBFRxOC.exe
  2⤵
  PID:13588
- C:\Windows\System\MuguqYP.exe
  C:\Windows\System\MuguqYP.exe
  2⤵
  PID:13608
- C:\Windows\System\fumrxKM.exe
  C:\Windows\System\fumrxKM.exe
  2⤵
  PID:13624
- C:\Windows\System\qhoikGi.exe
  C:\Windows\System\qhoikGi.exe
  2⤵
  PID:13648
- C:\Windows\System\gGqpqLj.exe
  C:\Windows\System\gGqpqLj.exe
  2⤵
  PID:13664
- C:\Windows\System\PLYiyRE.exe
  C:\Windows\System\PLYiyRE.exe
  2⤵
  PID:13688
- C:\Windows\System\VPpYcuo.exe
  C:\Windows\System\VPpYcuo.exe
  2⤵
  PID:13704
- C:\Windows\System\FBMwBlw.exe
  C:\Windows\System\FBMwBlw.exe
  2⤵
  PID:13724
- C:\Windows\System\DJdkZKo.exe
  C:\Windows\System\DJdkZKo.exe
  2⤵
  PID:13744
- C:\Windows\System\gZYqXns.exe
  C:\Windows\System\gZYqXns.exe
  2⤵
  PID:13764
- C:\Windows\System\PtdbDuu.exe
  C:\Windows\System\PtdbDuu.exe
  2⤵
  PID:13792
- C:\Windows\System\lvWRMTJ.exe
  C:\Windows\System\lvWRMTJ.exe
  2⤵
  PID:13812
- C:\Windows\System\XquqMtw.exe
  C:\Windows\System\XquqMtw.exe
  2⤵
  PID:13836
- C:\Windows\System\OnOfXdG.exe
  C:\Windows\System\OnOfXdG.exe
  2⤵
  PID:13856
- C:\Windows\System\IDLPNNS.exe
  C:\Windows\System\IDLPNNS.exe
  2⤵
  PID:13872
- C:\Windows\System\yNMsllh.exe
  C:\Windows\System\yNMsllh.exe
  2⤵
  PID:13400
- C:\Windows\System\SpVyoSY.exe
  C:\Windows\System\SpVyoSY.exe
  2⤵
  PID:13432
- C:\Windows\System\IKkHPwo.exe
  C:\Windows\System\IKkHPwo.exe
  2⤵
  PID:12372
- C:\Windows\System\VriZutR.exe
  C:\Windows\System\VriZutR.exe
  2⤵
  PID:13584
- C:\Windows\System\hkjERYh.exe
  C:\Windows\System\hkjERYh.exe
  2⤵
  PID:5760
- C:\Windows\System\uoCvEoF.exe
  C:\Windows\System\uoCvEoF.exe
  2⤵
  PID:13396
- C:\Windows\System\TYRQnsw.exe
  C:\Windows\System\TYRQnsw.exe
  2⤵
  PID:13808
- C:\Windows\System\hfFFqxf.exe
  C:\Windows\System\hfFFqxf.exe
  2⤵
  PID:13864
- C:\Windows\System\nmrhQDE.exe
  C:\Windows\System\nmrhQDE.exe
  2⤵
  PID:13440
- C:\Windows\System\tYPaNsH.exe
  C:\Windows\System\tYPaNsH.exe
  2⤵
  PID:13828
- C:\Windows\System\oPDwQai.exe
  C:\Windows\System\oPDwQai.exe
  2⤵
  PID:13656
- C:\Windows\System\RjpOLiN.exe
  C:\Windows\System\RjpOLiN.exe
  2⤵
  PID:14112
- C:\Windows\System\EMFOmgO.exe
  C:\Windows\System\EMFOmgO.exe
  2⤵
  PID:14168
- C:\Windows\System\eQDCnxg.exe
  C:\Windows\System\eQDCnxg.exe
  2⤵
  PID:432
- C:\Windows\System\soEquxV.exe
  C:\Windows\System\soEquxV.exe
  2⤵
  PID:10724
- C:\Windows\System\mDlWsbV.exe
  C:\Windows\System\mDlWsbV.exe
  2⤵
  PID:14332
- C:\Windows\System\EaWrRsn.exe
  C:\Windows\System\EaWrRsn.exe
  2⤵
  PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e4n25wd5.z05.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CCXLpnu.exe

Filesize
1.3MB

MD5
b3a1ca52eb51e582413d6584d05cda94

SHA1
cf9a67a714a134eb2e2390661f8ae14724b41dc1

SHA256
d5e7228e7289381d4c26b79de022dc284b8a8980cb7bfaee3762163e0cb170ed

SHA512
2498e3f06a5bcd075b08cbaaefef8d01b9e65238f078a1150612935ac47e80e9bc929b44f87d0d74e79b41722da3fb554fca070eb10f50cd74eb697a7c5594e8

Download Submit
C:\Windows\System\CeJiHBn.exe

Filesize
1.3MB

MD5
b39be8fc77176a32971e68fd049f0ca7

SHA1
08abdf268fc55a527f6c35b51ee3fe184b32f596

SHA256
88c1a1b7e0970670abefe37f3ee99527ccbbfc1f41088db1d0b54d9996c7edba

SHA512
47e5e18e2beb290bf1190cee988fe66ae773ff0bc9502308b3f35b0c5d9334faf0fc9184303c6faaa9bac3f14f2ab35649bd62f96022440537d6305ef419d2c5

Download Submit
C:\Windows\System\EaMOgnz.exe

Filesize
1.3MB

MD5
e024b5baef8d2f87128d2ac6c4336afa

SHA1
8a242890bdf4adf927075cd14b82f4d8b99f1f80

SHA256
e9c17bc03eb026fde9462d6b9f65177c068ab3d307a6e712c231110670770de0

SHA512
994a9426bd004e684dd60d190ed34567965699afb9c69d8afa528b769fd2b402f705e85eb144b34fd8fb6994873927d6a199bd3d1c2893d9f6bff9b6732b0fdf

Download Submit
C:\Windows\System\JQpQoqD.exe

Filesize
1.3MB

MD5
8946237fbe3ec04f182b00e247db58fc

SHA1
767a253419d4dcaf8bae9735ea5adc7cfc8d6079

SHA256
fac6b0b680d39a0d74b9bbf89f1ad56c1939a2516b45e1d33d5597b59b741518

SHA512
1672ff794f35a9c54c32075daa13f839c81061c4cc62ea16a0f792513b1772d4170d2f74bc939312c91c832d74ccc68d1497f8d4e53438daad7c1acc3b119b2b

Download Submit
C:\Windows\System\Jarjyot.exe

Filesize
1.3MB

MD5
824c99d3e4bbe0193cebfb2872077392

SHA1
4e9eb6de10095cfc974d6ff48c3acdebdcaefe15

SHA256
b9c46cc4cf5262b6c6d7da2cb4cba684538ee247540084c2816a8ae651f8e344

SHA512
8ec22e44280f6dd95e6e739379036a9182a1db8022237c948535899f0ad9248f72017fb25e1b3f65fdaf6b7f01ec43e05dc66874a29b0484102810c593704b7b

Download Submit
C:\Windows\System\KojtlgL.exe

Filesize
1.3MB

MD5
7c99b71f39b374a46b34d0d2cba929dc

SHA1
2d909be00456e82e3897220a8cafd63e671a0507

SHA256
873257bf58cf03df64d9c2b743f488089c2136f8bd3952ab599e5807113f94d9

SHA512
b978a6c165984866ffac68952202325ab7df7711846ca00a541f30a219a1c468d94d13480ecc96d6002161e812a4ffe4bc9748a81a39031302485fc35a802aa1

Download Submit
C:\Windows\System\KyMIcJG.exe

Filesize
1.3MB

MD5
fbde4fff0092e8f216c3b83a67e724ff

SHA1
5073a0a2164ea735a32a45b34ebbadf7a192518a

SHA256
bb244108401aa264d2cfda98ae4935dd83bfdd88b6f12628cd2d1fc73bc78691

SHA512
7b2eb06aaa4d17913ab1e7a02bfa8e38b21e55c6b1c8ca28330553a5a53defd3aa94cf63f4361fb0ddafe27230251e0f09e2200b7888b69ab98aaff4cfed741c

Download Submit
C:\Windows\System\MrBASEH.exe

Filesize
1.3MB

MD5
c331e9b877e963628c6dd011debb38c5

SHA1
ea96f49659b039ba2e5d378dbfefde7a1c545c18

SHA256
fb85cc71786e5d2658a9e68cb12b1afc6c897b6d190329cb46d64f5335883e15

SHA512
b530ea361a5b36f371dee1d5ea3cbe85b21a7930e11fbc476f2933b3e3a2975ad6931567870b3bba4b3025af4cf1f7d0d8dfdc22a2db8838640a8b85df3cd7ee

Download Submit
C:\Windows\System\MtwfMnr.exe

Filesize
1.3MB

MD5
09b3c16fee5237665f3066aac6c8aa08

SHA1
d8604c1bcdf312a2821ae30f314ed227ee82e218

SHA256
01c79f4bb8e0ae3d7d9cd0101cf619a7175f8f8af0df7bc7e44048d9056a1751

SHA512
c5af32cdada6545dfa2b5faba4a59ca84bfb0d761e39a6e20c25727eff8327ba8bdbf4e2b2312e3a59632aa98be37e1619c1dc426a78981e2b319fb4ba3de320

Download Submit
C:\Windows\System\NJTqeFP.exe

Filesize
1.3MB

MD5
81f916e074b7adc36bfdac097388baaa

SHA1
39cb37e6c523a9ad56af0dbb1e36d3ce45e09eee

SHA256
a10937212aaf0c70721fe67db79a6529e41659936d365187bc92e8b1e64edab2

SHA512
1de665626481459da620190523651fb6b6f32b8e3fe7e43b93ee228732cea94da2b9dbe673963427dece884562b6deae3a5c30d580cfe20d2a1d81359af88ec3

Download Submit
C:\Windows\System\NLfdKqO.exe

Filesize
1.3MB

MD5
07bc08dc67d1b6692c174b7318a43564

SHA1
6fdd97491edbd4451896435f0f983cde2475c587

SHA256
cc7fe62dd7ce5070badd8b04fd1e3aa530df4a97d3bc92ebb427cadb69e907b5

SHA512
98ccbbcb1b432305e5cdf486dfdb466e4b5d4b47f3967a630cfe51e7697566a7affbf2c03b41388915fde084520017e109036d7131b5ed8404a8a71a13628e77

Download Submit
C:\Windows\System\NnJiRnK.exe

Filesize
1.3MB

MD5
eb66b9e06cc5e750815d91ab85fc6b73

SHA1
21a1d80c95655282ec317afd5f67975f9d69eaad

SHA256
b35c67691824355e30751f7202665d126752d235f7f6b5dd86f6a4c5a66e3916

SHA512
d52132cb4a3965cfd6da499dd08119825e6a254ac3b7f6507afe2502fb7bda1ff9cb6071c7c6592e2cfccd6c04c197872a8310d6bbfa347fe793bd37294e7ff8

Download Submit
C:\Windows\System\QdCzjLk.exe

Filesize
1.3MB

MD5
7776cc241305566f82ffc9e673104b02

SHA1
90d7c0c5c0b2ea8d731233bc1b5367abfdf661bc

SHA256
cdc5be5d3ae4272eb1cf2586d847f26eeba8bc8be665b5ebb5021876154acc8d

SHA512
d2bc5be6c03b8064f337189487c6dd8460d2bc83b7d7fed4892973cdd0dc3bc0307dc6811fbdb87ac094f78c07630dcfd09031707c57b83ec24d8351152c8981

Download Submit
C:\Windows\System\RQOZiaU.exe

Filesize
1.3MB

MD5
48eb278e744e8769a8ed7908bfd6ac35

SHA1
f02c4ac47c30e02284588c24532d33c087398108

SHA256
4c91375c8177319f71bae6282531ba4ee783b8cdfe0e7853706883da75948160

SHA512
384d4a5075aa9fcbf2d026dbb25b09e91c2fb0aaab9320974f7d14a18e94f5ed7a215a792db5e362d6f4ee8d82ec5c59ac51a410aef4cef2111ec3d31926705f

Download Submit
C:\Windows\System\RmFQgiM.exe

Filesize
1.3MB

MD5
a0f54ad7a3bae5e6b058aa04c2be92c3

SHA1
19dc5f87f0a10ceab969fce43a2bff977cf186de

SHA256
cb35b023b5491e6885bef8011a3932e938f0ffd56ffd6e2b7926f5982118186b

SHA512
da1fb8d20e98bb4bb7fb13d82bc0a16dea90820d77c3d57fd518b28ffceea6c59995d40307cb1cb4952e000c66b4b5fcd4745da20ed996d2ecc5f10227a1e99f

Download Submit
C:\Windows\System\SIDlUfC.exe

Filesize
1.3MB

MD5
50ccfd943989c016e2be9d61ce93bfb5

SHA1
e8a629adbf59178f44aaeac7068524ef58cc89e1

SHA256
3c3bd9e019b2c4046db8dcb0507b25804fee0a5499368a027dffbb2e6891727f

SHA512
be999cdc07d6437bc1e002f6b6d91604244248631a9f5a9159c0bc19b73243ac80d2ebdf275995b037cf40842123ce4721de6224d0db4d5e9c3ca5b622f7fc48

Download Submit
C:\Windows\System\TXcKeXC.exe

Filesize
1.3MB

MD5
b8dd31845aacbae044d8c58e0f38eb05

SHA1
b59bb36d9f4a8186a77eb535a31833ce7ee82092

SHA256
78d66bd7d72a29d0bcd3ce521835cd9458a73d1f93a6efabcfeb75c0f82a4319

SHA512
8d1a99ce4f8136eab672806d094dce8fd2294c0ba57433eae83f9d31fae48312558456be5a12388054ee4cc0dfaf4b01493840026dc0a47c7f5b4f96cafce71a

Download Submit
C:\Windows\System\TdoZycT.exe

Filesize
1.3MB

MD5
7a7523896f129aac3ee19fa95fbb9981

SHA1
b73d73f7abc367e0a2d8b23535c08b1b6571d674

SHA256
f1dbaa6f353e261c786e2606c3cd47e990a180c946c1dd007d98241b35ae0b70

SHA512
4232e3ff07828327001276c07b9a8065be22f4355e4b344d85929a63acc462308594513c8232ccf509144d28e58edd1e9c94ed44b0e9b21fbc2f0c2fb270ec9c

Download Submit
C:\Windows\System\UmLhxtZ.exe

Filesize
1.3MB

MD5
4b0438b6821436abd3d2b1bce339cbe6

SHA1
e7eb1d2b1aee707fa0365b4fb9970c072d46fabb

SHA256
6996b882a3c8d3fe03cad04758b34e13508b2f9d6dd48884c761cf861a243fa1

SHA512
b12fa70b096479f0e1d9f91b42a45158bac962fa0bd363c659d7df88181f32a3b06c13495f47d9c87c3b5acff1259c582e6d28d60a8870cdececa23fe6b251bf

Download Submit
C:\Windows\System\cZnlaLG.exe

Filesize
1.3MB

MD5
23af32a0cece491d3be7ba358759ccf4

SHA1
e932e85e1a2bb8df113287236dea9b25b099c62a

SHA256
15b32776b4131991fd9e92478f4ec4ddc7f39940fa911a23a069f9de2906b10b

SHA512
056b74cea9b2530871cb7fed02bc6791c3ba4d73d3f33fff47ddc120c3dc2e308644e80c1f636d63dac5bc69d089ea236745f5e3df509f49ed49eb6777e2e3da

Download Submit
C:\Windows\System\ciFoAtB.exe

Filesize
8B

MD5
df9f51a1b551c980f8fba6cb17278b4c

SHA1
afc88e532b2022bea92d5c0b9b385d3c5cb999b8

SHA256
055dcd514a2542509f068419247af897ae44ac816177996de78f41054584b6d8

SHA512
b6db0ce137231f359601e4e32e1c1ebb7f37eb538721849b884584421ccc171e728d5e3ef35153d8dfcc0ee39ac75e7674fbb19971bf842685c872c4c29458ec

Download Submit
C:\Windows\System\dAFjGUn.exe

Filesize
1.3MB

MD5
37bffa91ad91b4d43c302c0472f4a7ae

SHA1
9fbe50defe70e294aca7f374f234b8efe2ff937b

SHA256
8b9133ca6c0f4510c74bbc45c3efc32b0b25e0a76ea1ef6580f8bb193afbc3b3

SHA512
8ab39155425b09a409413b44ee4970e5c38bffc580f2198cee4bf38da9cc105523e33b92725e6d0e7f4c627e9c2c4e719dbef755b1e5e4fbb372a03f75a2b877

Download Submit
C:\Windows\System\dwccSwD.exe

Filesize
1.3MB

MD5
81ef4e1454fd4ec5b508dc1008d28502

SHA1
3c6941e31668cee6daa08cdf104fdb853562c652

SHA256
546471b63e9b3dba56f27d081b9408142e0104e6c696b69f6aabdea41297f5c7

SHA512
3c6b14f819ef2e86238bb8e35b26080b825f35cfc9196e9a1a8cc907c978f8827c92477801749874130dec6a642da80cc7433f60fe401cbfeacc8c5daaf9c5f8

Download Submit
C:\Windows\System\epDZoPI.exe

Filesize
1.3MB

MD5
3775a9d9d46ea285d3a2403b6dd6955c

SHA1
1481f9652a9ca31e5eefedc6a351b66a18393001

SHA256
6a20f2af37ec2c7d166b0dfe2dddcd82cbf6972bd5590545bc1b252ae4d258ce

SHA512
107bb5db562a4b3603c736b0576029b12ffe8507f10f277639c454da32d06d6254ced63e4eca5ad17ddd576ae9f794b7a8afd22ea8316210c0413df510101830

Download Submit
C:\Windows\System\fIjVJpV.exe

Filesize
1.3MB

MD5
5696e2ef562c46d3cf32f032ca892aa9

SHA1
134bc710ab1626ab30bde125febd1bf5f06f8d12

SHA256
d313790f969466fe6ccdb7a8bc9a3b4c24c298e98825cf8ab255ac5e3c6bec24

SHA512
699dd49f8c0faea4abe43a2eaefa414d1b2ad859c80e36438046cd68bd2ac94ce5152773682d34c26af4fe29a81c500eb185b89a474216863ffec23be2aeedb9

Download Submit
C:\Windows\System\fWPbKhE.exe

Filesize
1.3MB

MD5
b295b4495cee362bf97983af0f8e7ccd

SHA1
21900118ed0a4baaf0026324f6a0e2a007ecda17

SHA256
a76e46b625c7b6221e0250e6c0efa093130616fe73cbee6783a7eab5c7ebd261

SHA512
69a37e958c27c21250d82a801fa49efc5bd576d55f094a7e515c1af2b1379df0cf740fe2ca0033e5ba69f34303f15186ff8ce6cc21f2d5976a8a7aba1a3bd132

Download Submit
C:\Windows\System\fwfnfSl.exe

Filesize
1.3MB

MD5
594b25663583d51350224fa884372151

SHA1
8e003cc4067e4757e8a8ebdd957c614ad3ad9574

SHA256
522cb0c4dbb74249137281c6a4e720e728c9be363e9e475676e39a2daa639c3f

SHA512
ef7dd671d7e2f0d27f4ff33429d5545af9f4095ed97b35d5c4879e7415564ff657c679fff28051479e0d06d702b7d0ec7ec5faacb68fb3580a80c977908b1838

Download Submit
C:\Windows\System\iusoihH.exe

Filesize
1.3MB

MD5
4839dff511c326084ddc5ecd2517f7f1

SHA1
b1b63abb987fc53aae2342e6f2910f7aeb2668d7

SHA256
4d46df8d036aca73458326d8524a0a66dd5ec1344b2c119fc95b96b59d6bb26b

SHA512
4caf838592e41e90bd6fa260409d9fa5b58f889e612b3403007b219a45d649053fa7cac5016e72eaec31f61449f82c8a0cd5e844c39717e91e4db931cb4a0f0a

Download Submit
C:\Windows\System\jAeeAdk.exe

Filesize
1.3MB

MD5
110cd0462faa0352a8704d8f14ab827c

SHA1
30a4453b06a544bf8388c520287645ec70aa4695

SHA256
497dc48d4cf9e98a714b38011518b806da2bb00e3d19080380d0cf1b2c376896

SHA512
4f828d8bdcd3fe3dfb3e77cdf76fbcdf66cc98db3ddc6593997ec920798e17926c1cb046863d1d7e149feffab00368c2e8eeb1e6eeff73a50d8ebf518597f962

Download Submit
C:\Windows\System\jFmEcZA.exe

Filesize
1.3MB

MD5
af5d560b1a1f74d92f588b3611f14147

SHA1
48c2d4a1a547b557ed52e8778b7ba15dc86a8350

SHA256
bd138115418ae242a1fdb573d128a4aa36b2a561d850a3b2750b4ebe212f3466

SHA512
32a7ed7f0d62bfeb2855e5a730d189ae35ebb6eef7fbde0d21c7edcd063bc7137d4d76ef2db9b998d3089aa42a623126d04993b4aa4e0edfc7e8ccd29de59a1a

Download Submit
C:\Windows\System\jnEtKtG.exe

Filesize
1.3MB

MD5
820557503069784b627a023d2a545037

SHA1
c9446d3c5c5e00c061dde59e44be85d5c2dd696c

SHA256
5a42203e3408b6d2a625b36cc0ddd1f4c89f98dc3e681cb6a557c101d1d48fc7

SHA512
d95ca485536f1da9513653648803fc9d70a7b1bb212876cb0ecff7f0ab70e90f3c08321af5aab836f74a41d57f8d5992b3d518d4169ad37e29358f06f0d99a1b

Download Submit
C:\Windows\System\jwMRFEp.exe

Filesize
1.3MB

MD5
35b3d5f585ad5c97e8ef9be2bcb879b0

SHA1
ff48bf50c6a22861b544b5e1715843134c10e6f6

SHA256
b67ddf153fe46539bbb83321c93f03072ec3c2cdef88b2ab47b9bf2222757ad1

SHA512
fefe9a52d6f13e294992d78e40ad90879a64c18794e80163e40e8f255a85ee12a71ca9cb735b9cf9554f8edb5d63efdde887553c1cc90be9f2cf67321eacbec9

Download Submit
C:\Windows\System\lbDuEPy.exe

Filesize
1.3MB

MD5
82b8ceded0e46952ac2704831b79411e

SHA1
be961db43bd05bee98bb134f3543205e866b94da

SHA256
54ee1338999073ddc6684f70fec10808742f4466e7eebd06b01e3d50dbb9c596

SHA512
ea6ddb5b31754abbd8f2e6757656f8a3abfc1dab97afcdf9f48647754dd870a5fb6728fdee42ede4dea35d82e8c0593f8cf25bea067aa5f7a564787265942524

Download Submit
C:\Windows\System\mjXehCT.exe

Filesize
1.3MB

MD5
8074d9b5d3291d0eb61a6d73679d5277

SHA1
9db1121972eefc7a78bb48c841fc8521ed622ae9

SHA256
ae911693854d70f73b16e9615e39d9ac68870f97dbfd762e31a8214939c5504a

SHA512
f461057c24aa9f68081774a87161181f6a4714f03f2180cebde528c776da7dba40a1443c8263dbce00c875d6c8a238f219b0d3275ee8061945e87ba44ffc0a1d

Download Submit
C:\Windows\System\pgcfZPl.exe

Filesize
1.3MB

MD5
4b7d5b9b811f7587c55c24cd922b9719

SHA1
326840c7a8f34e01645d4e2208b5df5ef1268a56

SHA256
3e3288654b7bf8f9c5e8eb9c0992cbf4574c5aecf02cc25e6a1fa6af27670c11

SHA512
d967bada563ed0aa62d38585eb65f2af277cfa9a1f5180b9f963ccd8ccc976672f7c01274f89781655a4ca90168bc7153cfde33e0a247bbc6729b3c632d82ee7

Download Submit
C:\Windows\System\rswmGTd.exe

Filesize
1.3MB

MD5
299cc9cf672e3cb61cfe0e1d744aa461

SHA1
53645397f24e64dcc79f53e5b0e979b8c7645f17

SHA256
9060c5fab107291b439c6496bb6ccc4bdbb2f19862deacd04ea56bfe0200c1c5

SHA512
52375d6fd756b14494ff8b540a3a498b2869bfda4a17f908805b243e8d1f43b956afde645d9d6b66d6033b55bd29ec5479ea25dc59010b61442e3b31b9dc979e

Download Submit
C:\Windows\System\uCkPgFH.exe

Filesize
1.3MB

MD5
db8cd7a8b21b5e7532f733fdf60b3705

SHA1
3a6f7e8c35f8b37c2bb6b4fc38f22a4ff0bae59f

SHA256
4e3853ae0752561303646dca180bcdd1ed7284cd6491f635c090ba2241bfe879

SHA512
e55943cfa448671afc8052b0bc6d2f95b1f460316fef89fa1ee43267a94f75a14a4c8c88f0f20700c3003088773e4f92080e31945552456c843dc078f0c3f319

Download Submit
C:\Windows\System\vcqouFx.exe

Filesize
1.3MB

MD5
b6c221b66c12095cd2f245ea6ce0decd

SHA1
317183cfcec52a98a3381278575e694c78ceb688

SHA256
abdc6a2b55085538400a71891b819fa055674b5eb4b1b629cd5fd311906c031a

SHA512
684474740865e6a18da50f9e4ee9d6e2ab629234a61e12209ed96e28ed84ae0cae2b242b7d5b91bd59bfd0e94a36dfe27c27179d69a7af71218af1ece20afbf3

Download Submit
C:\Windows\System\wCKIqnj.exe

Filesize
1.3MB

MD5
e761d94e7f5c84cc92b702780bd95ad5

SHA1
8d48a0391e5e3b9001a584538ff2d5f5941a4d61

SHA256
757f4847e13e69a3f425114200280559639a7f89d378770ae5ba5c674d277c77

SHA512
9d250b76fafb41ca69ed1946dcdba1a07ef081682c3228fe7c69f1cb11884e4f4bd4257fb7f912087929ff968e32207a74e201845e2db2208946dd9199c5751f

Download Submit
memory/372-2997-0x00007FF672A40000-0x00007FF672E32000-memory.dmp

Filesize
3.9MB

Download
memory/372-332-0x00007FF672A40000-0x00007FF672E32000-memory.dmp

Filesize
3.9MB

Download
memory/668-2975-0x00007FF63F420000-0x00007FF63F812000-memory.dmp

Filesize
3.9MB

Download
memory/668-42-0x00007FF63F420000-0x00007FF63F812000-memory.dmp

Filesize
3.9MB

Download
memory/740-3012-0x00007FF72ED60000-0x00007FF72F152000-memory.dmp

Filesize
3.9MB

Download
memory/740-456-0x00007FF72ED60000-0x00007FF72F152000-memory.dmp

Filesize
3.9MB

Download
memory/1136-3003-0x00007FF755EF0000-0x00007FF7562E2000-memory.dmp

Filesize
3.9MB

Download
memory/1136-337-0x00007FF755EF0000-0x00007FF7562E2000-memory.dmp

Filesize
3.9MB

Download
memory/1152-338-0x00007FF79D370000-0x00007FF79D762000-memory.dmp

Filesize
3.9MB

Download
memory/1152-2999-0x00007FF79D370000-0x00007FF79D762000-memory.dmp

Filesize
3.9MB

Download
memory/1348-3009-0x00007FF7BFC90000-0x00007FF7C0082000-memory.dmp

Filesize
3.9MB

Download
memory/1348-341-0x00007FF7BFC90000-0x00007FF7C0082000-memory.dmp

Filesize
3.9MB

Download
memory/1556-330-0x00007FF7DA620000-0x00007FF7DAA12000-memory.dmp

Filesize
3.9MB

Download
memory/1556-2992-0x00007FF7DA620000-0x00007FF7DAA12000-memory.dmp

Filesize
3.9MB

Download
memory/1648-334-0x00007FF685700000-0x00007FF685AF2000-memory.dmp

Filesize
3.9MB

Download
memory/1648-2984-0x00007FF685700000-0x00007FF685AF2000-memory.dmp

Filesize
3.9MB

Download
memory/1692-335-0x00007FF7081B0000-0x00007FF7085A2000-memory.dmp

Filesize
3.9MB

Download
memory/1692-2982-0x00007FF7081B0000-0x00007FF7085A2000-memory.dmp

Filesize
3.9MB

Download
memory/1872-3005-0x00007FF6E1740000-0x00007FF6E1B32000-memory.dmp

Filesize
3.9MB

Download
memory/1872-340-0x00007FF6E1740000-0x00007FF6E1B32000-memory.dmp

Filesize
3.9MB

Download
memory/2104-455-0x00007FF6D74F0000-0x00007FF6D78E2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-2986-0x00007FF6D74F0000-0x00007FF6D78E2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-331-0x00007FF607650000-0x00007FF607A42000-memory.dmp

Filesize
3.9MB

Download
memory/2188-2995-0x00007FF607650000-0x00007FF607A42000-memory.dmp

Filesize
3.9MB

Download
memory/2348-342-0x00007FF741400000-0x00007FF7417F2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-3050-0x00007FF741400000-0x00007FF7417F2000-memory.dmp

Filesize
3.9MB

Download
memory/2696-333-0x00007FF6E0610000-0x00007FF6E0A02000-memory.dmp

Filesize
3.9MB

Download
memory/2696-2987-0x00007FF6E0610000-0x00007FF6E0A02000-memory.dmp

Filesize
3.9MB

Download
memory/2892-3001-0x00007FF6DE5D0000-0x00007FF6DE9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2892-336-0x00007FF6DE5D0000-0x00007FF6DE9C2000-memory.dmp

Filesize
3.9MB

Download
memory/3032-1-0x000001E4BCE40000-0x000001E4BCE50000-memory.dmp

Filesize
64KB

Download
memory/3032-0-0x00007FF75A160000-0x00007FF75A552000-memory.dmp

Filesize
3.9MB

Download
memory/3076-101-0x00007FF6AED90000-0x00007FF6AF182000-memory.dmp

Filesize
3.9MB

Download
memory/3076-3064-0x00007FF6AED90000-0x00007FF6AF182000-memory.dmp

Filesize
3.9MB

Download
memory/3624-2990-0x00007FF7317D0000-0x00007FF731BC2000-memory.dmp

Filesize
3.9MB

Download
memory/3624-452-0x00007FF7317D0000-0x00007FF731BC2000-memory.dmp

Filesize
3.9MB

Download
memory/3804-2973-0x00007FF6CF920000-0x00007FF6CFD12000-memory.dmp

Filesize
3.9MB

Download
memory/3804-71-0x00007FF6CF920000-0x00007FF6CFD12000-memory.dmp

Filesize
3.9MB

Download
memory/3848-2119-0x00007FF8E44D0000-0x00007FF8E4F91000-memory.dmp

Filesize
10.8MB

Download
memory/3848-228-0x00007FF8E44D0000-0x00007FF8E4F91000-memory.dmp

Filesize
10.8MB

Download
memory/3848-22-0x00007FF8E44D3000-0x00007FF8E44D5000-memory.dmp

Filesize
8KB

Download
memory/3848-314-0x00007FF8E44D0000-0x00007FF8E4F91000-memory.dmp

Filesize
10.8MB

Download
memory/3848-300-0x000001ED28420000-0x000001ED28442000-memory.dmp

Filesize
136KB

Download
memory/4008-317-0x00007FF674C60000-0x00007FF675052000-memory.dmp

Filesize
3.9MB

Download
memory/4008-2994-0x00007FF674C60000-0x00007FF675052000-memory.dmp

Filesize
3.9MB

Download
memory/4416-403-0x00007FF6EFCD0000-0x00007FF6F00C2000-memory.dmp

Filesize
3.9MB

Download
memory/4416-2979-0x00007FF6EFCD0000-0x00007FF6F00C2000-memory.dmp

Filesize
3.9MB

Download
memory/4548-3007-0x00007FF6323D0000-0x00007FF6327C2000-memory.dmp

Filesize
3.9MB

Download
memory/4548-343-0x00007FF6323D0000-0x00007FF6327C2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-339-0x00007FF6DC530000-0x00007FF6DC922000-memory.dmp

Filesize
3.9MB

Download
memory/4588-3063-0x00007FF6DC530000-0x00007FF6DC922000-memory.dmp

Filesize
3.9MB

Download
memory/4716-344-0x00007FF696930000-0x00007FF696D22000-memory.dmp

Filesize
3.9MB

Download
memory/4716-2977-0x00007FF696930000-0x00007FF696D22000-memory.dmp

Filesize
3.9MB

Download
memory/4876-2971-0x00007FF7652D0000-0x00007FF7656C2000-memory.dmp

Filesize
3.9MB

Download
memory/4876-17-0x00007FF7652D0000-0x00007FF7656C2000-memory.dmp

Filesize
3.9MB

Download