xmrig | a5cd75a3c01bf357b68066b2185d82c454cd7fff5ed2aec36580cd8175844b3b

Analysis

max time kernel
131s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
Size

1.7MB
MD5

95a67ce5aaecb0f2847d9267f29c81b0
SHA1

39792d00f7be2610080256a8f9972d4cb8593ab7
SHA256

a5cd75a3c01bf357b68066b2185d82c454cd7fff5ed2aec36580cd8175844b3b
SHA512

b725af503ddcbc261cce7b9b3fa02f787cc59526ee006ddc999a1b70ea7e5b1f4de80a7cb877085b3fa4718f10e71b202243edce6f91a465088baad7aac8836c
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCUATSU4HE1ltb4a:Lz071uv4BPMkFfdg6NsIRh4HE5b

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/1576-207-0x00007FF632C90000-0x00007FF633082000-memory.dmp	xmrig
behavioral2/memory/3092-246-0x00007FF77CFE0000-0x00007FF77D3D2000-memory.dmp	xmrig
behavioral2/memory/2268-306-0x00007FF783F50000-0x00007FF784342000-memory.dmp	xmrig
behavioral2/memory/892-383-0x00007FF7DF710000-0x00007FF7DFB02000-memory.dmp	xmrig
behavioral2/memory/3552-423-0x00007FF6F2A50000-0x00007FF6F2E42000-memory.dmp	xmrig
behavioral2/memory/3440-430-0x00007FF6BD160000-0x00007FF6BD552000-memory.dmp	xmrig
behavioral2/memory/4384-436-0x00007FF664070000-0x00007FF664462000-memory.dmp	xmrig
behavioral2/memory/4820-435-0x00007FF6E2720000-0x00007FF6E2B12000-memory.dmp	xmrig
behavioral2/memory/3944-434-0x00007FF646590000-0x00007FF646982000-memory.dmp	xmrig
behavioral2/memory/3516-432-0x00007FF760360000-0x00007FF760752000-memory.dmp	xmrig
behavioral2/memory/3676-431-0x00007FF63B7D0000-0x00007FF63BBC2000-memory.dmp	xmrig
behavioral2/memory/4412-399-0x00007FF6055E0000-0x00007FF6059D2000-memory.dmp	xmrig
behavioral2/memory/3100-312-0x00007FF65D9C0000-0x00007FF65DDB2000-memory.dmp	xmrig
behavioral2/memory/1772-304-0x00007FF643490000-0x00007FF643882000-memory.dmp	xmrig
behavioral2/memory/2772-302-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp	xmrig
behavioral2/memory/1156-278-0x00007FF65C5E0000-0x00007FF65C9D2000-memory.dmp	xmrig
behavioral2/memory/3856-245-0x00007FF6E2A70000-0x00007FF6E2E62000-memory.dmp	xmrig
behavioral2/memory/768-190-0x00007FF67E8A0000-0x00007FF67EC92000-memory.dmp	xmrig
behavioral2/memory/1312-121-0x00007FF7C2D20000-0x00007FF7C3112000-memory.dmp	xmrig
behavioral2/memory/1928-99-0x00007FF68B8F0000-0x00007FF68BCE2000-memory.dmp	xmrig
behavioral2/memory/1540-4210-0x00007FF755DD0000-0x00007FF7561C2000-memory.dmp	xmrig
behavioral2/memory/4476-4212-0x00007FF77DF10000-0x00007FF77E302000-memory.dmp	xmrig
behavioral2/memory/1928-4214-0x00007FF68B8F0000-0x00007FF68BCE2000-memory.dmp	xmrig
behavioral2/memory/3944-4216-0x00007FF646590000-0x00007FF646982000-memory.dmp	xmrig
behavioral2/memory/1312-4218-0x00007FF7C2D20000-0x00007FF7C3112000-memory.dmp	xmrig
behavioral2/memory/1552-4220-0x00007FF7CF7A0000-0x00007FF7CFB92000-memory.dmp	xmrig
behavioral2/memory/3856-4224-0x00007FF6E2A70000-0x00007FF6E2E62000-memory.dmp	xmrig
behavioral2/memory/768-4223-0x00007FF67E8A0000-0x00007FF67EC92000-memory.dmp	xmrig
behavioral2/memory/3092-4235-0x00007FF77CFE0000-0x00007FF77D3D2000-memory.dmp	xmrig
behavioral2/memory/4820-4234-0x00007FF6E2720000-0x00007FF6E2B12000-memory.dmp	xmrig
behavioral2/memory/2772-4239-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp	xmrig
behavioral2/memory/2268-4238-0x00007FF783F50000-0x00007FF784342000-memory.dmp	xmrig
behavioral2/memory/3444-4233-0x00007FF7CABA0000-0x00007FF7CAF92000-memory.dmp	xmrig
behavioral2/memory/1576-4228-0x00007FF632C90000-0x00007FF633082000-memory.dmp	xmrig
behavioral2/memory/4384-4227-0x00007FF664070000-0x00007FF664462000-memory.dmp	xmrig
behavioral2/memory/3440-4252-0x00007FF6BD160000-0x00007FF6BD552000-memory.dmp	xmrig
behavioral2/memory/1156-4264-0x00007FF65C5E0000-0x00007FF65C9D2000-memory.dmp	xmrig
behavioral2/memory/892-4267-0x00007FF7DF710000-0x00007FF7DFB02000-memory.dmp	xmrig
behavioral2/memory/4412-4261-0x00007FF6055E0000-0x00007FF6059D2000-memory.dmp	xmrig
behavioral2/memory/3676-4258-0x00007FF63B7D0000-0x00007FF63BBC2000-memory.dmp	xmrig
behavioral2/memory/1772-4254-0x00007FF643490000-0x00007FF643882000-memory.dmp	xmrig
behavioral2/memory/3100-4262-0x00007FF65D9C0000-0x00007FF65DDB2000-memory.dmp	xmrig
behavioral2/memory/3516-4247-0x00007FF760360000-0x00007FF760752000-memory.dmp	xmrig
behavioral2/memory/3552-4250-0x00007FF6F2A50000-0x00007FF6F2E42000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	3380	powershell.exe
11	3380	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3380	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1540	KDqPeTB.exe
1552	LQNOVyT.exe
4476	VQuVXbb.exe
1928	QgXfREe.exe
3444	dZeuotG.exe
1312	onxqNLK.exe
768	HZtFrhV.exe
3944	jahdLYR.exe
1576	WBAbTSl.exe
3856	kYbbRKn.exe
3092	dOWSHez.exe
1156	DQBuMaX.exe
2772	ddWIewI.exe
4820	LQGziuW.exe
1772	KDYMNRo.exe
2268	KPvFbsh.exe
3100	PGENBxS.exe
892	LvokWQN.exe
4412	NkdSQro.exe
4384	aNMJHUB.exe
3552	xVqDbkp.exe
3440	XOIPosa.exe
3676	dyWotMj.exe
3516	DTlBvDc.exe
1276	rVgVmqs.exe
2408	xZKLyuF.exe
548	LzqlyAD.exe
3868	ZVXwiKj.exe
3664	vrgkNcp.exe
2988	iqFjLou.exe
4180	JMQYiDx.exe
4968	IRgGlle.exe
2196	NVtPgPE.exe
4108	kxshDKP.exe
2460	asnXeux.exe
4592	pfNRDte.exe
636	Vvtwpbz.exe
3036	IUGRuQO.exe
2616	fpajiGu.exe
2756	vswdhQC.exe
4252	VaJqWJj.exe
4944	vjNvZxk.exe
1444	ugzrECb.exe
1572	edOQVUM.exe
1324	BrxmGeW.exe
2164	OUcJYRy.exe
3080	PKEjlPb.exe
5104	PSaxoks.exe
884	AvcSAqu.exe
3200	KTaLdBd.exe
208	cLOanfC.exe
1004	jnozRUR.exe
2308	lwdYMcL.exe
4344	ZjRcUxA.exe
2456	FIsSfap.exe
4688	YGAtTSn.exe
2248	xFfnaXA.exe
5088	tFRdtqZ.exe
3104	uRADHFg.exe
4616	KqTwLhw.exe
4228	UTqqnpw.exe
2284	pkfQFrH.exe
528	QgYJxdZ.exe
5032	hWQRclx.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4808-0-0x00007FF787800000-0x00007FF787BF2000-memory.dmp	upx
behavioral2/files/0x0007000000023435-7.dat	upx
behavioral2/files/0x0008000000023430-26.dat	upx
behavioral2/files/0x0007000000023441-76.dat	upx
behavioral2/files/0x0007000000023442-81.dat	upx
behavioral2/files/0x000700000002344c-113.dat	upx
behavioral2/files/0x000700000002343f-126.dat	upx
behavioral2/memory/1576-207-0x00007FF632C90000-0x00007FF633082000-memory.dmp	upx
behavioral2/memory/3092-246-0x00007FF77CFE0000-0x00007FF77D3D2000-memory.dmp	upx
behavioral2/memory/2268-306-0x00007FF783F50000-0x00007FF784342000-memory.dmp	upx
behavioral2/memory/892-383-0x00007FF7DF710000-0x00007FF7DFB02000-memory.dmp	upx
behavioral2/memory/3552-423-0x00007FF6F2A50000-0x00007FF6F2E42000-memory.dmp	upx
behavioral2/memory/3440-430-0x00007FF6BD160000-0x00007FF6BD552000-memory.dmp	upx
behavioral2/memory/4384-436-0x00007FF664070000-0x00007FF664462000-memory.dmp	upx
behavioral2/memory/4820-435-0x00007FF6E2720000-0x00007FF6E2B12000-memory.dmp	upx
behavioral2/memory/3944-434-0x00007FF646590000-0x00007FF646982000-memory.dmp	upx
behavioral2/memory/3516-432-0x00007FF760360000-0x00007FF760752000-memory.dmp	upx
behavioral2/memory/3676-431-0x00007FF63B7D0000-0x00007FF63BBC2000-memory.dmp	upx
behavioral2/memory/4412-399-0x00007FF6055E0000-0x00007FF6059D2000-memory.dmp	upx
behavioral2/memory/3100-312-0x00007FF65D9C0000-0x00007FF65DDB2000-memory.dmp	upx
behavioral2/memory/1772-304-0x00007FF643490000-0x00007FF643882000-memory.dmp	upx
behavioral2/memory/2772-302-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp	upx
behavioral2/memory/1156-278-0x00007FF65C5E0000-0x00007FF65C9D2000-memory.dmp	upx
behavioral2/memory/3856-245-0x00007FF6E2A70000-0x00007FF6E2E62000-memory.dmp	upx
behavioral2/memory/768-190-0x00007FF67E8A0000-0x00007FF67EC92000-memory.dmp	upx
behavioral2/files/0x0007000000023453-183.dat	upx
behavioral2/files/0x000700000002345d-181.dat	upx
behavioral2/files/0x000700000002345c-179.dat	upx
behavioral2/files/0x000700000002345b-177.dat	upx
behavioral2/files/0x000700000002345a-176.dat	upx
behavioral2/files/0x0007000000023459-175.dat	upx
behavioral2/files/0x0007000000023458-174.dat	upx
behavioral2/files/0x0007000000023457-172.dat	upx
behavioral2/files/0x0007000000023456-171.dat	upx
behavioral2/files/0x0007000000023455-170.dat	upx
behavioral2/files/0x0007000000023454-169.dat	upx
behavioral2/files/0x0008000000023431-168.dat	upx
behavioral2/files/0x0007000000023452-139.dat	upx
behavioral2/files/0x0007000000023447-129.dat	upx
behavioral2/files/0x0007000000023440-128.dat	upx
behavioral2/files/0x000700000002344d-127.dat	upx
behavioral2/files/0x0007000000023443-125.dat	upx
behavioral2/memory/1312-121-0x00007FF7C2D20000-0x00007FF7C3112000-memory.dmp	upx
behavioral2/files/0x0007000000023451-120.dat	upx
behavioral2/files/0x0007000000023450-119.dat	upx
behavioral2/files/0x0007000000023446-118.dat	upx
behavioral2/files/0x000700000002344f-117.dat	upx
behavioral2/files/0x0007000000023444-116.dat	upx
behavioral2/files/0x000700000002344e-115.dat	upx
behavioral2/files/0x000700000002343e-114.dat	upx
behavioral2/files/0x000700000002343d-112.dat	upx
behavioral2/files/0x000700000002343c-111.dat	upx
behavioral2/files/0x000700000002344b-110.dat	upx
behavioral2/files/0x000700000002343b-109.dat	upx
behavioral2/files/0x0007000000023448-105.dat	upx
behavioral2/files/0x0007000000023449-104.dat	upx
behavioral2/files/0x000700000002344a-122.dat	upx
behavioral2/memory/3444-103-0x00007FF7CABA0000-0x00007FF7CAF92000-memory.dmp	upx
behavioral2/memory/1928-99-0x00007FF68B8F0000-0x00007FF68BCE2000-memory.dmp	upx
behavioral2/files/0x0007000000023437-95.dat	upx
behavioral2/files/0x0007000000023445-92.dat	upx
behavioral2/files/0x0007000000023439-85.dat	upx
behavioral2/files/0x0007000000023438-77.dat	upx
behavioral2/files/0x000700000002343a-68.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dEnXmUJ.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\FfuiTPo.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\ruIOTOV.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\NAJqpES.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\ZoYivNU.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\WXCemry.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\CtUPUIS.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\sZSRtSE.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\Kfdrsdv.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\xdJodhn.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\dqZtweW.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\hySEkKi.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\XdaQfKG.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\ofeJexJ.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\jZkddfy.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\mbwpajL.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\CavxmaH.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\DoiuYrH.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\zmqaarc.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\PgvlfOe.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\UNelvNO.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\WiOKvfe.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\zgZBuNr.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\EBsZZFc.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\OZLJrND.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\BOTKfky.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\YFnTHnf.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\hPQwsza.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\ZeTKWBA.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\AtIPohp.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\YRyvkxd.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\hfqioLq.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\BsTqRxL.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\SKnXnfi.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\akaPKiZ.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\MbjPHeZ.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\hDLsqgU.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\VloRmoW.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\dChINKX.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\NLIqQts.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\LoXNPxT.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\PlszNfb.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\iwwTgSo.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\CTwkTFx.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\EafIxQM.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\GbAuRTC.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\lhMHGMA.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\tSlAMEj.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\YfLwPGJ.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\SCFzZHJ.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\tuILKfZ.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\AOdwTQo.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\AxrTTMA.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\qPCLtfk.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\JCLYasn.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\pTJtdmw.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\rKGxvKX.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\IYDzppC.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\dGKVACR.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\odzezTH.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\QEZsuRo.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\lcUWkGr.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\QWkwQZP.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
File created	C:\Windows\System\KwJmmNo.exe	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeLockMemoryPrivilege	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 3380	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	83
PID 4808 wrote to memory of 3380	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	83
PID 4808 wrote to memory of 1540	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	84
PID 4808 wrote to memory of 1540	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	84
PID 4808 wrote to memory of 1552	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	85
PID 4808 wrote to memory of 1552	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	85
PID 4808 wrote to memory of 4476	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	86
PID 4808 wrote to memory of 4476	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	86
PID 4808 wrote to memory of 1928	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	87
PID 4808 wrote to memory of 1928	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	87
PID 4808 wrote to memory of 3444	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	88
PID 4808 wrote to memory of 3444	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	88
PID 4808 wrote to memory of 1312	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	89
PID 4808 wrote to memory of 1312	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	89
PID 4808 wrote to memory of 768	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	90
PID 4808 wrote to memory of 768	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	90
PID 4808 wrote to memory of 3944	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	91
PID 4808 wrote to memory of 3944	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	91
PID 4808 wrote to memory of 1576	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	92
PID 4808 wrote to memory of 1576	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	92
PID 4808 wrote to memory of 3856	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	93
PID 4808 wrote to memory of 3856	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	93
PID 4808 wrote to memory of 3092	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	94
PID 4808 wrote to memory of 3092	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	94
PID 4808 wrote to memory of 1156	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	95
PID 4808 wrote to memory of 1156	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	95
PID 4808 wrote to memory of 3100	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	96
PID 4808 wrote to memory of 3100	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	96
PID 4808 wrote to memory of 2772	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	97
PID 4808 wrote to memory of 2772	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	97
PID 4808 wrote to memory of 4820	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	98
PID 4808 wrote to memory of 4820	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	98
PID 4808 wrote to memory of 1772	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	99
PID 4808 wrote to memory of 1772	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	99
PID 4808 wrote to memory of 2268	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	100
PID 4808 wrote to memory of 2268	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	100
PID 4808 wrote to memory of 1276	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	101
PID 4808 wrote to memory of 1276	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	101
PID 4808 wrote to memory of 892	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	102
PID 4808 wrote to memory of 892	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	102
PID 4808 wrote to memory of 548	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	103
PID 4808 wrote to memory of 548	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	103
PID 4808 wrote to memory of 4412	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	104
PID 4808 wrote to memory of 4412	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	104
PID 4808 wrote to memory of 4384	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	105
PID 4808 wrote to memory of 4384	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	105
PID 4808 wrote to memory of 3552	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	106
PID 4808 wrote to memory of 3552	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	106
PID 4808 wrote to memory of 2988	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	107
PID 4808 wrote to memory of 2988	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	107
PID 4808 wrote to memory of 3440	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	108
PID 4808 wrote to memory of 3440	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	108
PID 4808 wrote to memory of 3676	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	109
PID 4808 wrote to memory of 3676	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	109
PID 4808 wrote to memory of 4180	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	110
PID 4808 wrote to memory of 4180	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	110
PID 4808 wrote to memory of 3516	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	111
PID 4808 wrote to memory of 3516	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	111
PID 4808 wrote to memory of 2408	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	112
PID 4808 wrote to memory of 2408	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	112
PID 4808 wrote to memory of 3868	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	113
PID 4808 wrote to memory of 3868	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	113
PID 4808 wrote to memory of 3664	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	114
PID 4808 wrote to memory of 3664	4808	95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\95a67ce5aaecb0f2847d9267f29c81b0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3380
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3380" "2992" "2928" "2996" "0" "0" "3000" "0" "0" "0" "0" "0"
    3⤵
    PID:6392
- C:\Windows\System\KDqPeTB.exe
  C:\Windows\System\KDqPeTB.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\LQNOVyT.exe
  C:\Windows\System\LQNOVyT.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\VQuVXbb.exe
  C:\Windows\System\VQuVXbb.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\QgXfREe.exe
  C:\Windows\System\QgXfREe.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\dZeuotG.exe
  C:\Windows\System\dZeuotG.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\onxqNLK.exe
  C:\Windows\System\onxqNLK.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\HZtFrhV.exe
  C:\Windows\System\HZtFrhV.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\jahdLYR.exe
  C:\Windows\System\jahdLYR.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\WBAbTSl.exe
  C:\Windows\System\WBAbTSl.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\kYbbRKn.exe
  C:\Windows\System\kYbbRKn.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\dOWSHez.exe
  C:\Windows\System\dOWSHez.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\DQBuMaX.exe
  C:\Windows\System\DQBuMaX.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\PGENBxS.exe
  C:\Windows\System\PGENBxS.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\ddWIewI.exe
  C:\Windows\System\ddWIewI.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\LQGziuW.exe
  C:\Windows\System\LQGziuW.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\KDYMNRo.exe
  C:\Windows\System\KDYMNRo.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\KPvFbsh.exe
  C:\Windows\System\KPvFbsh.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\rVgVmqs.exe
  C:\Windows\System\rVgVmqs.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\LvokWQN.exe
  C:\Windows\System\LvokWQN.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\LzqlyAD.exe
  C:\Windows\System\LzqlyAD.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\NkdSQro.exe
  C:\Windows\System\NkdSQro.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\aNMJHUB.exe
  C:\Windows\System\aNMJHUB.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\xVqDbkp.exe
  C:\Windows\System\xVqDbkp.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\iqFjLou.exe
  C:\Windows\System\iqFjLou.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\XOIPosa.exe
  C:\Windows\System\XOIPosa.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\dyWotMj.exe
  C:\Windows\System\dyWotMj.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\JMQYiDx.exe
  C:\Windows\System\JMQYiDx.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\DTlBvDc.exe
  C:\Windows\System\DTlBvDc.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\xZKLyuF.exe
  C:\Windows\System\xZKLyuF.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\ZVXwiKj.exe
  C:\Windows\System\ZVXwiKj.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\vrgkNcp.exe
  C:\Windows\System\vrgkNcp.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\IRgGlle.exe
  C:\Windows\System\IRgGlle.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\edOQVUM.exe
  C:\Windows\System\edOQVUM.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\NVtPgPE.exe
  C:\Windows\System\NVtPgPE.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\kxshDKP.exe
  C:\Windows\System\kxshDKP.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\asnXeux.exe
  C:\Windows\System\asnXeux.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\pfNRDte.exe
  C:\Windows\System\pfNRDte.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\Vvtwpbz.exe
  C:\Windows\System\Vvtwpbz.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\IUGRuQO.exe
  C:\Windows\System\IUGRuQO.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\fpajiGu.exe
  C:\Windows\System\fpajiGu.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\vswdhQC.exe
  C:\Windows\System\vswdhQC.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\VaJqWJj.exe
  C:\Windows\System\VaJqWJj.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\vjNvZxk.exe
  C:\Windows\System\vjNvZxk.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\ugzrECb.exe
  C:\Windows\System\ugzrECb.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\BrxmGeW.exe
  C:\Windows\System\BrxmGeW.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\OUcJYRy.exe
  C:\Windows\System\OUcJYRy.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\PKEjlPb.exe
  C:\Windows\System\PKEjlPb.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\PSaxoks.exe
  C:\Windows\System\PSaxoks.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\AvcSAqu.exe
  C:\Windows\System\AvcSAqu.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\KTaLdBd.exe
  C:\Windows\System\KTaLdBd.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\cLOanfC.exe
  C:\Windows\System\cLOanfC.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\jnozRUR.exe
  C:\Windows\System\jnozRUR.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\lwdYMcL.exe
  C:\Windows\System\lwdYMcL.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\ZjRcUxA.exe
  C:\Windows\System\ZjRcUxA.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\FIsSfap.exe
  C:\Windows\System\FIsSfap.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\YGAtTSn.exe
  C:\Windows\System\YGAtTSn.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\xFfnaXA.exe
  C:\Windows\System\xFfnaXA.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\tFRdtqZ.exe
  C:\Windows\System\tFRdtqZ.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\uRADHFg.exe
  C:\Windows\System\uRADHFg.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\KqTwLhw.exe
  C:\Windows\System\KqTwLhw.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\UTqqnpw.exe
  C:\Windows\System\UTqqnpw.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\pkfQFrH.exe
  C:\Windows\System\pkfQFrH.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\QgYJxdZ.exe
  C:\Windows\System\QgYJxdZ.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\hWQRclx.exe
  C:\Windows\System\hWQRclx.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\IoCbYHB.exe
  C:\Windows\System\IoCbYHB.exe
  2⤵
  PID:4936
- C:\Windows\System\iQnvRfh.exe
  C:\Windows\System\iQnvRfh.exe
  2⤵
  PID:3528
- C:\Windows\System\GBkoEDf.exe
  C:\Windows\System\GBkoEDf.exe
  2⤵
  PID:704
- C:\Windows\System\MveaGXK.exe
  C:\Windows\System\MveaGXK.exe
  2⤵
  PID:1684
- C:\Windows\System\gPTWEIF.exe
  C:\Windows\System\gPTWEIF.exe
  2⤵
  PID:3388
- C:\Windows\System\CBnJwZV.exe
  C:\Windows\System\CBnJwZV.exe
  2⤵
  PID:404
- C:\Windows\System\JLpnuTM.exe
  C:\Windows\System\JLpnuTM.exe
  2⤵
  PID:1672
- C:\Windows\System\ZEyuWWa.exe
  C:\Windows\System\ZEyuWWa.exe
  2⤵
  PID:2172
- C:\Windows\System\eOTzXMe.exe
  C:\Windows\System\eOTzXMe.exe
  2⤵
  PID:872
- C:\Windows\System\dXShCPn.exe
  C:\Windows\System\dXShCPn.exe
  2⤵
  PID:3848
- C:\Windows\System\yIdXMpE.exe
  C:\Windows\System\yIdXMpE.exe
  2⤵
  PID:5132
- C:\Windows\System\worifMv.exe
  C:\Windows\System\worifMv.exe
  2⤵
  PID:5148
- C:\Windows\System\CDQqBxK.exe
  C:\Windows\System\CDQqBxK.exe
  2⤵
  PID:5172
- C:\Windows\System\xSjWqOa.exe
  C:\Windows\System\xSjWqOa.exe
  2⤵
  PID:5188
- C:\Windows\System\BwgABow.exe
  C:\Windows\System\BwgABow.exe
  2⤵
  PID:5204
- C:\Windows\System\oXCluPC.exe
  C:\Windows\System\oXCluPC.exe
  2⤵
  PID:5248
- C:\Windows\System\dbLgacg.exe
  C:\Windows\System\dbLgacg.exe
  2⤵
  PID:5288
- C:\Windows\System\fdoutCI.exe
  C:\Windows\System\fdoutCI.exe
  2⤵
  PID:5480
- C:\Windows\System\FXzBAmw.exe
  C:\Windows\System\FXzBAmw.exe
  2⤵
  PID:5500
- C:\Windows\System\GbbhtAH.exe
  C:\Windows\System\GbbhtAH.exe
  2⤵
  PID:5560
- C:\Windows\System\mgTuutX.exe
  C:\Windows\System\mgTuutX.exe
  2⤵
  PID:5588
- C:\Windows\System\zlvQOpT.exe
  C:\Windows\System\zlvQOpT.exe
  2⤵
  PID:5620
- C:\Windows\System\yyruPmY.exe
  C:\Windows\System\yyruPmY.exe
  2⤵
  PID:5636
- C:\Windows\System\pjkjQuV.exe
  C:\Windows\System\pjkjQuV.exe
  2⤵
  PID:5688
- C:\Windows\System\KoIceLW.exe
  C:\Windows\System\KoIceLW.exe
  2⤵
  PID:5704
- C:\Windows\System\jpYEKhm.exe
  C:\Windows\System\jpYEKhm.exe
  2⤵
  PID:5728
- C:\Windows\System\kxnzPCg.exe
  C:\Windows\System\kxnzPCg.exe
  2⤵
  PID:5752
- C:\Windows\System\zsoLrCA.exe
  C:\Windows\System\zsoLrCA.exe
  2⤵
  PID:5768
- C:\Windows\System\VppJgqW.exe
  C:\Windows\System\VppJgqW.exe
  2⤵
  PID:5792
- C:\Windows\System\EVpPGFZ.exe
  C:\Windows\System\EVpPGFZ.exe
  2⤵
  PID:5808
- C:\Windows\System\PFyMcpW.exe
  C:\Windows\System\PFyMcpW.exe
  2⤵
  PID:5832
- C:\Windows\System\xPUmACL.exe
  C:\Windows\System\xPUmACL.exe
  2⤵
  PID:5852
- C:\Windows\System\euQtGtn.exe
  C:\Windows\System\euQtGtn.exe
  2⤵
  PID:5868
- C:\Windows\System\iqWfElG.exe
  C:\Windows\System\iqWfElG.exe
  2⤵
  PID:5888
- C:\Windows\System\PsaODkT.exe
  C:\Windows\System\PsaODkT.exe
  2⤵
  PID:5908
- C:\Windows\System\HHnDuVE.exe
  C:\Windows\System\HHnDuVE.exe
  2⤵
  PID:5944
- C:\Windows\System\EIySpQH.exe
  C:\Windows\System\EIySpQH.exe
  2⤵
  PID:5960
- C:\Windows\System\BMdxaVk.exe
  C:\Windows\System\BMdxaVk.exe
  2⤵
  PID:5980
- C:\Windows\System\huKPdQW.exe
  C:\Windows\System\huKPdQW.exe
  2⤵
  PID:6004
- C:\Windows\System\UXhypGY.exe
  C:\Windows\System\UXhypGY.exe
  2⤵
  PID:6024
- C:\Windows\System\DXDBisJ.exe
  C:\Windows\System\DXDBisJ.exe
  2⤵
  PID:6044
- C:\Windows\System\mTFEdNB.exe
  C:\Windows\System\mTFEdNB.exe
  2⤵
  PID:6064
- C:\Windows\System\NDhRUub.exe
  C:\Windows\System\NDhRUub.exe
  2⤵
  PID:6084
- C:\Windows\System\PmhLrrM.exe
  C:\Windows\System\PmhLrrM.exe
  2⤵
  PID:6128
- C:\Windows\System\zBguFji.exe
  C:\Windows\System\zBguFji.exe
  2⤵
  PID:4904
- C:\Windows\System\WaJLYjh.exe
  C:\Windows\System\WaJLYjh.exe
  2⤵
  PID:1328
- C:\Windows\System\aJQqWdA.exe
  C:\Windows\System\aJQqWdA.exe
  2⤵
  PID:8
- C:\Windows\System\JwmyjxU.exe
  C:\Windows\System\JwmyjxU.exe
  2⤵
  PID:4724
- C:\Windows\System\NvCTRZQ.exe
  C:\Windows\System\NvCTRZQ.exe
  2⤵
  PID:2968
- C:\Windows\System\oPxjILl.exe
  C:\Windows\System\oPxjILl.exe
  2⤵
  PID:4696
- C:\Windows\System\NSEaUao.exe
  C:\Windows\System\NSEaUao.exe
  2⤵
  PID:5024
- C:\Windows\System\MWjZnwd.exe
  C:\Windows\System\MWjZnwd.exe
  2⤵
  PID:1164
- C:\Windows\System\oMwIvRg.exe
  C:\Windows\System\oMwIvRg.exe
  2⤵
  PID:2440
- C:\Windows\System\DXxdNCl.exe
  C:\Windows\System\DXxdNCl.exe
  2⤵
  PID:3932
- C:\Windows\System\lTKJPSF.exe
  C:\Windows\System\lTKJPSF.exe
  2⤵
  PID:3512
- C:\Windows\System\JLSVsxa.exe
  C:\Windows\System\JLSVsxa.exe
  2⤵
  PID:5512
- C:\Windows\System\LDEgMEK.exe
  C:\Windows\System\LDEgMEK.exe
  2⤵
  PID:4512
- C:\Windows\System\LyIlwee.exe
  C:\Windows\System\LyIlwee.exe
  2⤵
  PID:2368
- C:\Windows\System\pRkjmnm.exe
  C:\Windows\System\pRkjmnm.exe
  2⤵
  PID:2492
- C:\Windows\System\SMpBHmN.exe
  C:\Windows\System\SMpBHmN.exe
  2⤵
  PID:3948
- C:\Windows\System\OEgmRvt.exe
  C:\Windows\System\OEgmRvt.exe
  2⤵
  PID:3864
- C:\Windows\System\IONkuYf.exe
  C:\Windows\System\IONkuYf.exe
  2⤵
  PID:5184
- C:\Windows\System\KZcvPHM.exe
  C:\Windows\System\KZcvPHM.exe
  2⤵
  PID:5232
- C:\Windows\System\vWFCVdU.exe
  C:\Windows\System\vWFCVdU.exe
  2⤵
  PID:4536
- C:\Windows\System\klNCroT.exe
  C:\Windows\System\klNCroT.exe
  2⤵
  PID:1984
- C:\Windows\System\ayfmRCP.exe
  C:\Windows\System\ayfmRCP.exe
  2⤵
  PID:4224
- C:\Windows\System\PQpwceP.exe
  C:\Windows\System\PQpwceP.exe
  2⤵
  PID:3308
- C:\Windows\System\iwwTgSo.exe
  C:\Windows\System\iwwTgSo.exe
  2⤵
  PID:4504
- C:\Windows\System\LuGcCeo.exe
  C:\Windows\System\LuGcCeo.exe
  2⤵
  PID:1808
- C:\Windows\System\UZionfK.exe
  C:\Windows\System\UZionfK.exe
  2⤵
  PID:4744
- C:\Windows\System\FXuoyZR.exe
  C:\Windows\System\FXuoyZR.exe
  2⤵
  PID:4456
- C:\Windows\System\lXsQzGs.exe
  C:\Windows\System\lXsQzGs.exe
  2⤵
  PID:116
- C:\Windows\System\ujXzRvG.exe
  C:\Windows\System\ujXzRvG.exe
  2⤵
  PID:4684
- C:\Windows\System\PqiULDg.exe
  C:\Windows\System\PqiULDg.exe
  2⤵
  PID:808
- C:\Windows\System\dqGRFKS.exe
  C:\Windows\System\dqGRFKS.exe
  2⤵
  PID:1160
- C:\Windows\System\FYJGinG.exe
  C:\Windows\System\FYJGinG.exe
  2⤵
  PID:3892
- C:\Windows\System\OxSSTwW.exe
  C:\Windows\System\OxSSTwW.exe
  2⤵
  PID:5508
- C:\Windows\System\MtcpHyn.exe
  C:\Windows\System\MtcpHyn.exe
  2⤵
  PID:5372
- C:\Windows\System\HGqAoqE.exe
  C:\Windows\System\HGqAoqE.exe
  2⤵
  PID:464
- C:\Windows\System\TADsDgH.exe
  C:\Windows\System\TADsDgH.exe
  2⤵
  PID:5844
- C:\Windows\System\MuvTdHV.exe
  C:\Windows\System\MuvTdHV.exe
  2⤵
  PID:5916
- C:\Windows\System\ntulPMP.exe
  C:\Windows\System\ntulPMP.exe
  2⤵
  PID:4360
- C:\Windows\System\dChINKX.exe
  C:\Windows\System\dChINKX.exe
  2⤵
  PID:5928
- C:\Windows\System\VloRmoW.exe
  C:\Windows\System\VloRmoW.exe
  2⤵
  PID:5992
- C:\Windows\System\hCzjCxG.exe
  C:\Windows\System\hCzjCxG.exe
  2⤵
  PID:6016
- C:\Windows\System\Swxmyeu.exe
  C:\Windows\System\Swxmyeu.exe
  2⤵
  PID:4448
- C:\Windows\System\ZSscsZg.exe
  C:\Windows\System\ZSscsZg.exe
  2⤵
  PID:428
- C:\Windows\System\tSBiRWv.exe
  C:\Windows\System\tSBiRWv.exe
  2⤵
  PID:3228
- C:\Windows\System\MEpJYyB.exe
  C:\Windows\System\MEpJYyB.exe
  2⤵
  PID:2476
- C:\Windows\System\WhEJmhl.exe
  C:\Windows\System\WhEJmhl.exe
  2⤵
  PID:1348
- C:\Windows\System\YAzjcgE.exe
  C:\Windows\System\YAzjcgE.exe
  2⤵
  PID:4708
- C:\Windows\System\zqvwQpK.exe
  C:\Windows\System\zqvwQpK.exe
  2⤵
  PID:4396
- C:\Windows\System\RGmtSQy.exe
  C:\Windows\System\RGmtSQy.exe
  2⤵
  PID:64
- C:\Windows\System\rAneUdd.exe
  C:\Windows\System\rAneUdd.exe
  2⤵
  PID:1604
- C:\Windows\System\iCkFZXM.exe
  C:\Windows\System\iCkFZXM.exe
  2⤵
  PID:5900
- C:\Windows\System\fCvsetV.exe
  C:\Windows\System\fCvsetV.exe
  2⤵
  PID:5724
- C:\Windows\System\YJqKQmV.exe
  C:\Windows\System\YJqKQmV.exe
  2⤵
  PID:6152
- C:\Windows\System\lTBIndZ.exe
  C:\Windows\System\lTBIndZ.exe
  2⤵
  PID:6184
- C:\Windows\System\GbyJqkv.exe
  C:\Windows\System\GbyJqkv.exe
  2⤵
  PID:6200
- C:\Windows\System\TkMvGhV.exe
  C:\Windows\System\TkMvGhV.exe
  2⤵
  PID:6224
- C:\Windows\System\RmiRtJE.exe
  C:\Windows\System\RmiRtJE.exe
  2⤵
  PID:6240
- C:\Windows\System\QcpdwEg.exe
  C:\Windows\System\QcpdwEg.exe
  2⤵
  PID:6268
- C:\Windows\System\OIHIScE.exe
  C:\Windows\System\OIHIScE.exe
  2⤵
  PID:6292
- C:\Windows\System\CrLTaoC.exe
  C:\Windows\System\CrLTaoC.exe
  2⤵
  PID:6316
- C:\Windows\System\WlbIkWJ.exe
  C:\Windows\System\WlbIkWJ.exe
  2⤵
  PID:6340
- C:\Windows\System\QNDRfsg.exe
  C:\Windows\System\QNDRfsg.exe
  2⤵
  PID:6364
- C:\Windows\System\wnTkKLH.exe
  C:\Windows\System\wnTkKLH.exe
  2⤵
  PID:6396
- C:\Windows\System\PuTjvYo.exe
  C:\Windows\System\PuTjvYo.exe
  2⤵
  PID:6420
- C:\Windows\System\VvmNzwu.exe
  C:\Windows\System\VvmNzwu.exe
  2⤵
  PID:6436
- C:\Windows\System\RXyyxpf.exe
  C:\Windows\System\RXyyxpf.exe
  2⤵
  PID:6460
- C:\Windows\System\pSRYEwX.exe
  C:\Windows\System\pSRYEwX.exe
  2⤵
  PID:6476
- C:\Windows\System\RLcNJFj.exe
  C:\Windows\System\RLcNJFj.exe
  2⤵
  PID:6496
- C:\Windows\System\NNAszGE.exe
  C:\Windows\System\NNAszGE.exe
  2⤵
  PID:6520
- C:\Windows\System\TfXFOfU.exe
  C:\Windows\System\TfXFOfU.exe
  2⤵
  PID:6540
- C:\Windows\System\zywDhEn.exe
  C:\Windows\System\zywDhEn.exe
  2⤵
  PID:6560
- C:\Windows\System\csZmyxi.exe
  C:\Windows\System\csZmyxi.exe
  2⤵
  PID:6580
- C:\Windows\System\XjBKRFx.exe
  C:\Windows\System\XjBKRFx.exe
  2⤵
  PID:6604
- C:\Windows\System\UpqpkrX.exe
  C:\Windows\System\UpqpkrX.exe
  2⤵
  PID:6632
- C:\Windows\System\UUzblnW.exe
  C:\Windows\System\UUzblnW.exe
  2⤵
  PID:6660
- C:\Windows\System\DSiOAmV.exe
  C:\Windows\System\DSiOAmV.exe
  2⤵
  PID:6680
- C:\Windows\System\NlUYHRy.exe
  C:\Windows\System\NlUYHRy.exe
  2⤵
  PID:6700
- C:\Windows\System\bYNzGej.exe
  C:\Windows\System\bYNzGej.exe
  2⤵
  PID:6716
- C:\Windows\System\OuWXUov.exe
  C:\Windows\System\OuWXUov.exe
  2⤵
  PID:6740
- C:\Windows\System\FIEyMrM.exe
  C:\Windows\System\FIEyMrM.exe
  2⤵
  PID:6764
- C:\Windows\System\VlEJmny.exe
  C:\Windows\System\VlEJmny.exe
  2⤵
  PID:6784
- C:\Windows\System\xfjPJGA.exe
  C:\Windows\System\xfjPJGA.exe
  2⤵
  PID:6804
- C:\Windows\System\vVARedm.exe
  C:\Windows\System\vVARedm.exe
  2⤵
  PID:6824
- C:\Windows\System\GTdsUfA.exe
  C:\Windows\System\GTdsUfA.exe
  2⤵
  PID:6840
- C:\Windows\System\gzBBTRs.exe
  C:\Windows\System\gzBBTRs.exe
  2⤵
  PID:6868
- C:\Windows\System\ffYWfLm.exe
  C:\Windows\System\ffYWfLm.exe
  2⤵
  PID:6884
- C:\Windows\System\lnEankP.exe
  C:\Windows\System\lnEankP.exe
  2⤵
  PID:6908
- C:\Windows\System\cFHxIGQ.exe
  C:\Windows\System\cFHxIGQ.exe
  2⤵
  PID:6928
- C:\Windows\System\Mmnwcmj.exe
  C:\Windows\System\Mmnwcmj.exe
  2⤵
  PID:6948
- C:\Windows\System\xAEKkyU.exe
  C:\Windows\System\xAEKkyU.exe
  2⤵
  PID:6964
- C:\Windows\System\NJmSoxo.exe
  C:\Windows\System\NJmSoxo.exe
  2⤵
  PID:6988
- C:\Windows\System\NbNbgmN.exe
  C:\Windows\System\NbNbgmN.exe
  2⤵
  PID:7004
- C:\Windows\System\odzezTH.exe
  C:\Windows\System\odzezTH.exe
  2⤵
  PID:7028
- C:\Windows\System\qGRWrRV.exe
  C:\Windows\System\qGRWrRV.exe
  2⤵
  PID:7048
- C:\Windows\System\xVZWYBE.exe
  C:\Windows\System\xVZWYBE.exe
  2⤵
  PID:7076
- C:\Windows\System\FpLCHzb.exe
  C:\Windows\System\FpLCHzb.exe
  2⤵
  PID:7092
- C:\Windows\System\osDvhmG.exe
  C:\Windows\System\osDvhmG.exe
  2⤵
  PID:7116
- C:\Windows\System\TEFeoSu.exe
  C:\Windows\System\TEFeoSu.exe
  2⤵
  PID:7132
- C:\Windows\System\XKIQyya.exe
  C:\Windows\System\XKIQyya.exe
  2⤵
  PID:7160
- C:\Windows\System\XKzsmHQ.exe
  C:\Windows\System\XKzsmHQ.exe
  2⤵
  PID:5720
- C:\Windows\System\pLaOGYk.exe
  C:\Windows\System\pLaOGYk.exe
  2⤵
  PID:2316
- C:\Windows\System\AKCmQaj.exe
  C:\Windows\System\AKCmQaj.exe
  2⤵
  PID:5876
- C:\Windows\System\yXIUUOC.exe
  C:\Windows\System\yXIUUOC.exe
  2⤵
  PID:6212
- C:\Windows\System\KeMwHFD.exe
  C:\Windows\System\KeMwHFD.exe
  2⤵
  PID:6308
- C:\Windows\System\mUymqUt.exe
  C:\Windows\System\mUymqUt.exe
  2⤵
  PID:5224
- C:\Windows\System\tqjEXYX.exe
  C:\Windows\System\tqjEXYX.exe
  2⤵
  PID:6512
- C:\Windows\System\kYyeqwv.exe
  C:\Windows\System\kYyeqwv.exe
  2⤵
  PID:6568
- C:\Windows\System\pMIqwJe.exe
  C:\Windows\System\pMIqwJe.exe
  2⤵
  PID:6256
- C:\Windows\System\NGWNMCe.exe
  C:\Windows\System\NGWNMCe.exe
  2⤵
  PID:6656
- C:\Windows\System\SVTXSUI.exe
  C:\Windows\System\SVTXSUI.exe
  2⤵
  PID:6328
- C:\Windows\System\NXqJzYw.exe
  C:\Windows\System\NXqJzYw.exe
  2⤵
  PID:6760
- C:\Windows\System\xYScGZK.exe
  C:\Windows\System\xYScGZK.exe
  2⤵
  PID:6796
- C:\Windows\System\zUtSStT.exe
  C:\Windows\System\zUtSStT.exe
  2⤵
  PID:5700
- C:\Windows\System\ISdFTtw.exe
  C:\Windows\System\ISdFTtw.exe
  2⤵
  PID:6876
- C:\Windows\System\QmjIayx.exe
  C:\Windows\System\QmjIayx.exe
  2⤵
  PID:6896
- C:\Windows\System\SKnXnfi.exe
  C:\Windows\System\SKnXnfi.exe
  2⤵
  PID:6192
- C:\Windows\System\prUuLLA.exe
  C:\Windows\System\prUuLLA.exe
  2⤵
  PID:6596
- C:\Windows\System\kiFvVsX.exe
  C:\Windows\System\kiFvVsX.exe
  2⤵
  PID:7172
- C:\Windows\System\POQqNvH.exe
  C:\Windows\System\POQqNvH.exe
  2⤵
  PID:7200
- C:\Windows\System\SbVWItJ.exe
  C:\Windows\System\SbVWItJ.exe
  2⤵
  PID:7220
- C:\Windows\System\iEEhNFd.exe
  C:\Windows\System\iEEhNFd.exe
  2⤵
  PID:7240
- C:\Windows\System\qGGFszW.exe
  C:\Windows\System\qGGFszW.exe
  2⤵
  PID:7264
- C:\Windows\System\hUbtAWo.exe
  C:\Windows\System\hUbtAWo.exe
  2⤵
  PID:7284
- C:\Windows\System\JrmZGIr.exe
  C:\Windows\System\JrmZGIr.exe
  2⤵
  PID:7308
- C:\Windows\System\gRHQaMk.exe
  C:\Windows\System\gRHQaMk.exe
  2⤵
  PID:7332
- C:\Windows\System\wXGXByb.exe
  C:\Windows\System\wXGXByb.exe
  2⤵
  PID:7352
- C:\Windows\System\wVwJfOj.exe
  C:\Windows\System\wVwJfOj.exe
  2⤵
  PID:7380
- C:\Windows\System\fdRqgOC.exe
  C:\Windows\System\fdRqgOC.exe
  2⤵
  PID:7396
- C:\Windows\System\pWtwomC.exe
  C:\Windows\System\pWtwomC.exe
  2⤵
  PID:7416
- C:\Windows\System\Lbkbcbn.exe
  C:\Windows\System\Lbkbcbn.exe
  2⤵
  PID:7432
- C:\Windows\System\QiRVckB.exe
  C:\Windows\System\QiRVckB.exe
  2⤵
  PID:7456
- C:\Windows\System\RfMKyUf.exe
  C:\Windows\System\RfMKyUf.exe
  2⤵
  PID:7480
- C:\Windows\System\kCeYuOO.exe
  C:\Windows\System\kCeYuOO.exe
  2⤵
  PID:7500
- C:\Windows\System\zRulvBw.exe
  C:\Windows\System\zRulvBw.exe
  2⤵
  PID:7520
- C:\Windows\System\uvfuEwy.exe
  C:\Windows\System\uvfuEwy.exe
  2⤵
  PID:7548
- C:\Windows\System\TcwDOSS.exe
  C:\Windows\System\TcwDOSS.exe
  2⤵
  PID:7564
- C:\Windows\System\sLxmmbS.exe
  C:\Windows\System\sLxmmbS.exe
  2⤵
  PID:7584
- C:\Windows\System\oqGlcWX.exe
  C:\Windows\System\oqGlcWX.exe
  2⤵
  PID:7604
- C:\Windows\System\erRFsBa.exe
  C:\Windows\System\erRFsBa.exe
  2⤵
  PID:7624
- C:\Windows\System\fhwFzXv.exe
  C:\Windows\System\fhwFzXv.exe
  2⤵
  PID:7652
- C:\Windows\System\WEpMTbc.exe
  C:\Windows\System\WEpMTbc.exe
  2⤵
  PID:7676
- C:\Windows\System\kzhmvwY.exe
  C:\Windows\System\kzhmvwY.exe
  2⤵
  PID:7700
- C:\Windows\System\UQuipIp.exe
  C:\Windows\System\UQuipIp.exe
  2⤵
  PID:7720
- C:\Windows\System\cvHqLhW.exe
  C:\Windows\System\cvHqLhW.exe
  2⤵
  PID:7740
- C:\Windows\System\NvaFqNb.exe
  C:\Windows\System\NvaFqNb.exe
  2⤵
  PID:7768
- C:\Windows\System\qaqhoVY.exe
  C:\Windows\System\qaqhoVY.exe
  2⤵
  PID:7784
- C:\Windows\System\rEEjVIS.exe
  C:\Windows\System\rEEjVIS.exe
  2⤵
  PID:7808
- C:\Windows\System\hZOYTZf.exe
  C:\Windows\System\hZOYTZf.exe
  2⤵
  PID:7828
- C:\Windows\System\TFVrZTO.exe
  C:\Windows\System\TFVrZTO.exe
  2⤵
  PID:7852
- C:\Windows\System\laIYZfZ.exe
  C:\Windows\System\laIYZfZ.exe
  2⤵
  PID:7872
- C:\Windows\System\FLNiRQn.exe
  C:\Windows\System\FLNiRQn.exe
  2⤵
  PID:7896
- C:\Windows\System\pfumUCn.exe
  C:\Windows\System\pfumUCn.exe
  2⤵
  PID:7916
- C:\Windows\System\ebCNKFC.exe
  C:\Windows\System\ebCNKFC.exe
  2⤵
  PID:7932
- C:\Windows\System\BKDYqmu.exe
  C:\Windows\System\BKDYqmu.exe
  2⤵
  PID:7952
- C:\Windows\System\ADLeOsN.exe
  C:\Windows\System\ADLeOsN.exe
  2⤵
  PID:7976
- C:\Windows\System\HfoFUwr.exe
  C:\Windows\System\HfoFUwr.exe
  2⤵
  PID:7992
- C:\Windows\System\WbCZODX.exe
  C:\Windows\System\WbCZODX.exe
  2⤵
  PID:8020
- C:\Windows\System\OXSMNiC.exe
  C:\Windows\System\OXSMNiC.exe
  2⤵
  PID:8048
- C:\Windows\System\OpTgzcO.exe
  C:\Windows\System\OpTgzcO.exe
  2⤵
  PID:8068
- C:\Windows\System\wuRdFXR.exe
  C:\Windows\System\wuRdFXR.exe
  2⤵
  PID:8088
- C:\Windows\System\aridyOK.exe
  C:\Windows\System\aridyOK.exe
  2⤵
  PID:8116
- C:\Windows\System\koiMnXn.exe
  C:\Windows\System\koiMnXn.exe
  2⤵
  PID:8132
- C:\Windows\System\bubrcOn.exe
  C:\Windows\System\bubrcOn.exe
  2⤵
  PID:8160
- C:\Windows\System\MIoVAha.exe
  C:\Windows\System\MIoVAha.exe
  2⤵
  PID:8180
- C:\Windows\System\mIjoElN.exe
  C:\Windows\System\mIjoElN.exe
  2⤵
  PID:6360
- C:\Windows\System\rwRkhNX.exe
  C:\Windows\System\rwRkhNX.exe
  2⤵
  PID:6404
- C:\Windows\System\EYhiLfh.exe
  C:\Windows\System\EYhiLfh.exe
  2⤵
  PID:7088
- C:\Windows\System\DmxTOnN.exe
  C:\Windows\System\DmxTOnN.exe
  2⤵
  PID:5712
- C:\Windows\System\LSbapuM.exe
  C:\Windows\System\LSbapuM.exe
  2⤵
  PID:6752
- C:\Windows\System\Cmqyufb.exe
  C:\Windows\System\Cmqyufb.exe
  2⤵
  PID:6800
- C:\Windows\System\SZXgWcY.exe
  C:\Windows\System\SZXgWcY.exe
  2⤵
  PID:6556
- C:\Windows\System\DwePfvJ.exe
  C:\Windows\System\DwePfvJ.exe
  2⤵
  PID:6428
- C:\Windows\System\yzjVEGy.exe
  C:\Windows\System\yzjVEGy.exe
  2⤵
  PID:5464
- C:\Windows\System\gqLUlKf.exe
  C:\Windows\System\gqLUlKf.exe
  2⤵
  PID:6572
- C:\Windows\System\jbzkiPw.exe
  C:\Windows\System\jbzkiPw.exe
  2⤵
  PID:6956
- C:\Windows\System\PUlktBA.exe
  C:\Windows\System\PUlktBA.exe
  2⤵
  PID:7232
- C:\Windows\System\JnmdaRw.exe
  C:\Windows\System\JnmdaRw.exe
  2⤵
  PID:7124
- C:\Windows\System\AisQriE.exe
  C:\Windows\System\AisQriE.exe
  2⤵
  PID:6736
- C:\Windows\System\mQlsURo.exe
  C:\Windows\System\mQlsURo.exe
  2⤵
  PID:7300
- C:\Windows\System\TWmkoEg.exe
  C:\Windows\System\TWmkoEg.exe
  2⤵
  PID:7368
- C:\Windows\System\yUOObKq.exe
  C:\Windows\System\yUOObKq.exe
  2⤵
  PID:7408
- C:\Windows\System\JdQkDyG.exe
  C:\Windows\System\JdQkDyG.exe
  2⤵
  PID:7556
- C:\Windows\System\eOMUbIX.exe
  C:\Windows\System\eOMUbIX.exe
  2⤵
  PID:7640
- C:\Windows\System\pVyxjVy.exe
  C:\Windows\System\pVyxjVy.exe
  2⤵
  PID:6592
- C:\Windows\System\ZjBfLvv.exe
  C:\Windows\System\ZjBfLvv.exe
  2⤵
  PID:7184
- C:\Windows\System\oLqdwzS.exe
  C:\Windows\System\oLqdwzS.exe
  2⤵
  PID:7804
- C:\Windows\System\QewRmkX.exe
  C:\Windows\System\QewRmkX.exe
  2⤵
  PID:7924
- C:\Windows\System\CXENJYZ.exe
  C:\Windows\System\CXENJYZ.exe
  2⤵
  PID:8204
- C:\Windows\System\akaPKiZ.exe
  C:\Windows\System\akaPKiZ.exe
  2⤵
  PID:8224
- C:\Windows\System\NHkXFqy.exe
  C:\Windows\System\NHkXFqy.exe
  2⤵
  PID:8248
- C:\Windows\System\GTakczf.exe
  C:\Windows\System\GTakczf.exe
  2⤵
  PID:8268
- C:\Windows\System\tzzSfJu.exe
  C:\Windows\System\tzzSfJu.exe
  2⤵
  PID:8288
- C:\Windows\System\KKjOFkC.exe
  C:\Windows\System\KKjOFkC.exe
  2⤵
  PID:8312
- C:\Windows\System\gNBVXaN.exe
  C:\Windows\System\gNBVXaN.exe
  2⤵
  PID:8332
- C:\Windows\System\pphPFYw.exe
  C:\Windows\System\pphPFYw.exe
  2⤵
  PID:8348
- C:\Windows\System\LkqhadW.exe
  C:\Windows\System\LkqhadW.exe
  2⤵
  PID:8368
- C:\Windows\System\HFARGcT.exe
  C:\Windows\System\HFARGcT.exe
  2⤵
  PID:8396
- C:\Windows\System\YzTifKc.exe
  C:\Windows\System\YzTifKc.exe
  2⤵
  PID:8412
- C:\Windows\System\akYXibu.exe
  C:\Windows\System\akYXibu.exe
  2⤵
  PID:8436
- C:\Windows\System\ZLfgzUM.exe
  C:\Windows\System\ZLfgzUM.exe
  2⤵
  PID:8456
- C:\Windows\System\yADLfsI.exe
  C:\Windows\System\yADLfsI.exe
  2⤵
  PID:8476
- C:\Windows\System\zSLEppS.exe
  C:\Windows\System\zSLEppS.exe
  2⤵
  PID:8496
- C:\Windows\System\TGmLALg.exe
  C:\Windows\System\TGmLALg.exe
  2⤵
  PID:8520
- C:\Windows\System\PZdxdVS.exe
  C:\Windows\System\PZdxdVS.exe
  2⤵
  PID:8536
- C:\Windows\System\eXGogOw.exe
  C:\Windows\System\eXGogOw.exe
  2⤵
  PID:8560
- C:\Windows\System\CnmDXpx.exe
  C:\Windows\System\CnmDXpx.exe
  2⤵
  PID:8584
- C:\Windows\System\qWwqVGf.exe
  C:\Windows\System\qWwqVGf.exe
  2⤵
  PID:8604
- C:\Windows\System\lUzWXsV.exe
  C:\Windows\System\lUzWXsV.exe
  2⤵
  PID:8628
- C:\Windows\System\TSizBKI.exe
  C:\Windows\System\TSizBKI.exe
  2⤵
  PID:8652
- C:\Windows\System\yPwABch.exe
  C:\Windows\System\yPwABch.exe
  2⤵
  PID:8672
- C:\Windows\System\iFFAWkk.exe
  C:\Windows\System\iFFAWkk.exe
  2⤵
  PID:8692
- C:\Windows\System\OEuqhZT.exe
  C:\Windows\System\OEuqhZT.exe
  2⤵
  PID:8712
- C:\Windows\System\VhGVcuj.exe
  C:\Windows\System\VhGVcuj.exe
  2⤵
  PID:8736
- C:\Windows\System\JdOMiGc.exe
  C:\Windows\System\JdOMiGc.exe
  2⤵
  PID:8752
- C:\Windows\System\qAkzqfY.exe
  C:\Windows\System\qAkzqfY.exe
  2⤵
  PID:8776
- C:\Windows\System\BZZbCnn.exe
  C:\Windows\System\BZZbCnn.exe
  2⤵
  PID:8800
- C:\Windows\System\hYXcSDO.exe
  C:\Windows\System\hYXcSDO.exe
  2⤵
  PID:8820
- C:\Windows\System\UuptxqV.exe
  C:\Windows\System\UuptxqV.exe
  2⤵
  PID:8840
- C:\Windows\System\nfzLxtp.exe
  C:\Windows\System\nfzLxtp.exe
  2⤵
  PID:8868
- C:\Windows\System\qsAHrEJ.exe
  C:\Windows\System\qsAHrEJ.exe
  2⤵
  PID:8888
- C:\Windows\System\rLqUngl.exe
  C:\Windows\System\rLqUngl.exe
  2⤵
  PID:8916
- C:\Windows\System\MJZRflD.exe
  C:\Windows\System\MJZRflD.exe
  2⤵
  PID:8936
- C:\Windows\System\wNDPtwA.exe
  C:\Windows\System\wNDPtwA.exe
  2⤵
  PID:8956
- C:\Windows\System\qxjETIC.exe
  C:\Windows\System\qxjETIC.exe
  2⤵
  PID:8976
- C:\Windows\System\qDqtetW.exe
  C:\Windows\System\qDqtetW.exe
  2⤵
  PID:9000
- C:\Windows\System\FwYFjQG.exe
  C:\Windows\System\FwYFjQG.exe
  2⤵
  PID:9020
- C:\Windows\System\SIFnPDt.exe
  C:\Windows\System\SIFnPDt.exe
  2⤵
  PID:9044
- C:\Windows\System\CzXlmlg.exe
  C:\Windows\System\CzXlmlg.exe
  2⤵
  PID:9064
- C:\Windows\System\ienODzo.exe
  C:\Windows\System\ienODzo.exe
  2⤵
  PID:9088
- C:\Windows\System\juxIZQX.exe
  C:\Windows\System\juxIZQX.exe
  2⤵
  PID:9108
- C:\Windows\System\DhZFBoM.exe
  C:\Windows\System\DhZFBoM.exe
  2⤵
  PID:9136
- C:\Windows\System\rMOeWNu.exe
  C:\Windows\System\rMOeWNu.exe
  2⤵
  PID:9156
- C:\Windows\System\delprCI.exe
  C:\Windows\System\delprCI.exe
  2⤵
  PID:9184
- C:\Windows\System\nllHNSV.exe
  C:\Windows\System\nllHNSV.exe
  2⤵
  PID:9204
- C:\Windows\System\jtJlDBb.exe
  C:\Windows\System\jtJlDBb.exe
  2⤵
  PID:7280
- C:\Windows\System\PoJHlXk.exe
  C:\Windows\System\PoJHlXk.exe
  2⤵
  PID:8060
- C:\Windows\System\lDEBSDP.exe
  C:\Windows\System\lDEBSDP.exe
  2⤵
  PID:7532
- C:\Windows\System\aYimGmS.exe
  C:\Windows\System\aYimGmS.exe
  2⤵
  PID:8176
- C:\Windows\System\OzvVDgg.exe
  C:\Windows\System\OzvVDgg.exe
  2⤵
  PID:6536
- C:\Windows\System\ETcEdKd.exe
  C:\Windows\System\ETcEdKd.exe
  2⤵
  PID:6732
- C:\Windows\System\teeikEG.exe
  C:\Windows\System\teeikEG.exe
  2⤵
  PID:6284
- C:\Windows\System\whWSZwb.exe
  C:\Windows\System\whWSZwb.exe
  2⤵
  PID:6472
- C:\Windows\System\qsonMBB.exe
  C:\Windows\System\qsonMBB.exe
  2⤵
  PID:6380
- C:\Windows\System\MHHTfXJ.exe
  C:\Windows\System\MHHTfXJ.exe
  2⤵
  PID:7180
- C:\Windows\System\ScguYZa.exe
  C:\Windows\System\ScguYZa.exe
  2⤵
  PID:7820
- C:\Windows\System\LIdnTel.exe
  C:\Windows\System\LIdnTel.exe
  2⤵
  PID:7844
- C:\Windows\System\pbeEzcU.exe
  C:\Windows\System\pbeEzcU.exe
  2⤵
  PID:7884
- C:\Windows\System\SWHjbTd.exe
  C:\Windows\System\SWHjbTd.exe
  2⤵
  PID:7428
- C:\Windows\System\oivTVAU.exe
  C:\Windows\System\oivTVAU.exe
  2⤵
  PID:7688
- C:\Windows\System\YjDMubJ.exe
  C:\Windows\System\YjDMubJ.exe
  2⤵
  PID:7908
- C:\Windows\System\pkVSOPL.exe
  C:\Windows\System\pkVSOPL.exe
  2⤵
  PID:7996
- C:\Windows\System\nMwvUZv.exe
  C:\Windows\System\nMwvUZv.exe
  2⤵
  PID:7324
- C:\Windows\System\KFSBTCH.exe
  C:\Windows\System\KFSBTCH.exe
  2⤵
  PID:7452
- C:\Windows\System\rWQENFp.exe
  C:\Windows\System\rWQENFp.exe
  2⤵
  PID:7488
- C:\Windows\System\cVLNXfz.exe
  C:\Windows\System\cVLNXfz.exe
  2⤵
  PID:8384
- C:\Windows\System\bjJYGEn.exe
  C:\Windows\System\bjJYGEn.exe
  2⤵
  PID:8124
- C:\Windows\System\gCXBoIi.exe
  C:\Windows\System\gCXBoIi.exe
  2⤵
  PID:8484
- C:\Windows\System\cxSeMGq.exe
  C:\Windows\System\cxSeMGq.exe
  2⤵
  PID:8596
- C:\Windows\System\RqWLrxG.exe
  C:\Windows\System\RqWLrxG.exe
  2⤵
  PID:9232
- C:\Windows\System\eZPBthu.exe
  C:\Windows\System\eZPBthu.exe
  2⤵
  PID:9252
- C:\Windows\System\gXqkYOV.exe
  C:\Windows\System\gXqkYOV.exe
  2⤵
  PID:9276
- C:\Windows\System\PhnByaY.exe
  C:\Windows\System\PhnByaY.exe
  2⤵
  PID:9300
- C:\Windows\System\YuCFEJN.exe
  C:\Windows\System\YuCFEJN.exe
  2⤵
  PID:9328
- C:\Windows\System\jBKYWWc.exe
  C:\Windows\System\jBKYWWc.exe
  2⤵
  PID:9352
- C:\Windows\System\NeHeisZ.exe
  C:\Windows\System\NeHeisZ.exe
  2⤵
  PID:9372
- C:\Windows\System\GAEUnMH.exe
  C:\Windows\System\GAEUnMH.exe
  2⤵
  PID:9396
- C:\Windows\System\kTEMpKE.exe
  C:\Windows\System\kTEMpKE.exe
  2⤵
  PID:9416
- C:\Windows\System\hhLLWHl.exe
  C:\Windows\System\hhLLWHl.exe
  2⤵
  PID:9432
- C:\Windows\System\FgPfXim.exe
  C:\Windows\System\FgPfXim.exe
  2⤵
  PID:9460
- C:\Windows\System\FraSzsO.exe
  C:\Windows\System\FraSzsO.exe
  2⤵
  PID:9488
- C:\Windows\System\yEIckbt.exe
  C:\Windows\System\yEIckbt.exe
  2⤵
  PID:9504
- C:\Windows\System\tUaizfX.exe
  C:\Windows\System\tUaizfX.exe
  2⤵
  PID:9524
- C:\Windows\System\lVtufel.exe
  C:\Windows\System\lVtufel.exe
  2⤵
  PID:9544
- C:\Windows\System\hkfWLkN.exe
  C:\Windows\System\hkfWLkN.exe
  2⤵
  PID:9568
- C:\Windows\System\stlMJYE.exe
  C:\Windows\System\stlMJYE.exe
  2⤵
  PID:9588
- C:\Windows\System\MHUKCjz.exe
  C:\Windows\System\MHUKCjz.exe
  2⤵
  PID:9608
- C:\Windows\System\DAmCnte.exe
  C:\Windows\System\DAmCnte.exe
  2⤵
  PID:9632
- C:\Windows\System\hlStSEj.exe
  C:\Windows\System\hlStSEj.exe
  2⤵
  PID:9656
- C:\Windows\System\fxlBnIA.exe
  C:\Windows\System\fxlBnIA.exe
  2⤵
  PID:9676
- C:\Windows\System\AtIPohp.exe
  C:\Windows\System\AtIPohp.exe
  2⤵
  PID:9696
- C:\Windows\System\KufcZrN.exe
  C:\Windows\System\KufcZrN.exe
  2⤵
  PID:9716
- C:\Windows\System\ONEWGKG.exe
  C:\Windows\System\ONEWGKG.exe
  2⤵
  PID:9740
- C:\Windows\System\QFcLeyy.exe
  C:\Windows\System\QFcLeyy.exe
  2⤵
  PID:9760
- C:\Windows\System\GBnIVLv.exe
  C:\Windows\System\GBnIVLv.exe
  2⤵
  PID:9788
- C:\Windows\System\rOiuUWd.exe
  C:\Windows\System\rOiuUWd.exe
  2⤵
  PID:9808
- C:\Windows\System\mTavtoY.exe
  C:\Windows\System\mTavtoY.exe
  2⤵
  PID:9828
- C:\Windows\System\TSAoSIC.exe
  C:\Windows\System\TSAoSIC.exe
  2⤵
  PID:9848
- C:\Windows\System\XbRqvVV.exe
  C:\Windows\System\XbRqvVV.exe
  2⤵
  PID:9868
- C:\Windows\System\KExzpSm.exe
  C:\Windows\System\KExzpSm.exe
  2⤵
  PID:9896
- C:\Windows\System\NCdGszQ.exe
  C:\Windows\System\NCdGszQ.exe
  2⤵
  PID:9916
- C:\Windows\System\MUUhzsS.exe
  C:\Windows\System\MUUhzsS.exe
  2⤵
  PID:9940
- C:\Windows\System\ymltjxV.exe
  C:\Windows\System\ymltjxV.exe
  2⤵
  PID:9956
- C:\Windows\System\dgLHHdt.exe
  C:\Windows\System\dgLHHdt.exe
  2⤵
  PID:9980
- C:\Windows\System\wJwmPFX.exe
  C:\Windows\System\wJwmPFX.exe
  2⤵
  PID:10000
- C:\Windows\System\XTTKbzk.exe
  C:\Windows\System\XTTKbzk.exe
  2⤵
  PID:10024
- C:\Windows\System\CRDEnId.exe
  C:\Windows\System\CRDEnId.exe
  2⤵
  PID:10044
- C:\Windows\System\JhSYUhz.exe
  C:\Windows\System\JhSYUhz.exe
  2⤵
  PID:10064
- C:\Windows\System\PGjESux.exe
  C:\Windows\System\PGjESux.exe
  2⤵
  PID:10088
- C:\Windows\System\vPDakis.exe
  C:\Windows\System\vPDakis.exe
  2⤵
  PID:10112
- C:\Windows\System\PMHwWKX.exe
  C:\Windows\System\PMHwWKX.exe
  2⤵
  PID:10132
- C:\Windows\System\wSpYpBq.exe
  C:\Windows\System\wSpYpBq.exe
  2⤵
  PID:10156
- C:\Windows\System\GuShnBl.exe
  C:\Windows\System\GuShnBl.exe
  2⤵
  PID:10176
- C:\Windows\System\HhETIAc.exe
  C:\Windows\System\HhETIAc.exe
  2⤵
  PID:10196
- C:\Windows\System\EgADicj.exe
  C:\Windows\System\EgADicj.exe
  2⤵
  PID:10224
- C:\Windows\System\epvQydD.exe
  C:\Windows\System\epvQydD.exe
  2⤵
  PID:8704
- C:\Windows\System\WjlDzys.exe
  C:\Windows\System\WjlDzys.exe
  2⤵
  PID:8836
- C:\Windows\System\OMOFlNc.exe
  C:\Windows\System\OMOFlNc.exe
  2⤵
  PID:8832
- C:\Windows\System\zgOLKZP.exe
  C:\Windows\System\zgOLKZP.exe
  2⤵
  PID:8908
- C:\Windows\System\AubaGcA.exe
  C:\Windows\System\AubaGcA.exe
  2⤵
  PID:6552
- C:\Windows\System\OMdXzVo.exe
  C:\Windows\System\OMdXzVo.exe
  2⤵
  PID:8992
- C:\Windows\System\RsiynfM.exe
  C:\Windows\System\RsiynfM.exe
  2⤵
  PID:6860
- C:\Windows\System\XGQdMFH.exe
  C:\Windows\System\XGQdMFH.exe
  2⤵
  PID:9128
- C:\Windows\System\ZqDcyIC.exe
  C:\Windows\System\ZqDcyIC.exe
  2⤵
  PID:7968
- C:\Windows\System\MdMrBkd.exe
  C:\Windows\System\MdMrBkd.exe
  2⤵
  PID:9172
- C:\Windows\System\OkOpPai.exe
  C:\Windows\System\OkOpPai.exe
  2⤵
  PID:8044
- C:\Windows\System\WqSOqiV.exe
  C:\Windows\System\WqSOqiV.exe
  2⤵
  PID:6304
- C:\Windows\System\NJPHaZI.exe
  C:\Windows\System\NJPHaZI.exe
  2⤵
  PID:7036
- C:\Windows\System\OTPLjCB.exe
  C:\Windows\System\OTPLjCB.exe
  2⤵
  PID:8472
- C:\Windows\System\UIufuuv.exe
  C:\Windows\System\UIufuuv.exe
  2⤵
  PID:8244
- C:\Windows\System\MbErLcU.exe
  C:\Windows\System\MbErLcU.exe
  2⤵
  PID:10264
- C:\Windows\System\zDZVPPS.exe
  C:\Windows\System\zDZVPPS.exe
  2⤵
  PID:10288
- C:\Windows\System\IVQSdiQ.exe
  C:\Windows\System\IVQSdiQ.exe
  2⤵
  PID:10308
- C:\Windows\System\ZyeshDd.exe
  C:\Windows\System\ZyeshDd.exe
  2⤵
  PID:10332
- C:\Windows\System\qKJjbAa.exe
  C:\Windows\System\qKJjbAa.exe
  2⤵
  PID:10356
- C:\Windows\System\lUpQbhF.exe
  C:\Windows\System\lUpQbhF.exe
  2⤵
  PID:10376
- C:\Windows\System\uJBpQZU.exe
  C:\Windows\System\uJBpQZU.exe
  2⤵
  PID:10400
- C:\Windows\System\LlDBVZZ.exe
  C:\Windows\System\LlDBVZZ.exe
  2⤵
  PID:10420
- C:\Windows\System\DVJUNZW.exe
  C:\Windows\System\DVJUNZW.exe
  2⤵
  PID:10444
- C:\Windows\System\dQNTVaL.exe
  C:\Windows\System\dQNTVaL.exe
  2⤵
  PID:10464
- C:\Windows\System\bZwCaou.exe
  C:\Windows\System\bZwCaou.exe
  2⤵
  PID:10488
- C:\Windows\System\cayAYBG.exe
  C:\Windows\System\cayAYBG.exe
  2⤵
  PID:10508
- C:\Windows\System\AWYfjnY.exe
  C:\Windows\System\AWYfjnY.exe
  2⤵
  PID:10532
- C:\Windows\System\DYIaaCr.exe
  C:\Windows\System\DYIaaCr.exe
  2⤵
  PID:10556
- C:\Windows\System\pHzvVyL.exe
  C:\Windows\System\pHzvVyL.exe
  2⤵
  PID:10576
- C:\Windows\System\nIabveQ.exe
  C:\Windows\System\nIabveQ.exe
  2⤵
  PID:10600
- C:\Windows\System\hfVNNja.exe
  C:\Windows\System\hfVNNja.exe
  2⤵
  PID:10616
- C:\Windows\System\llVnBQb.exe
  C:\Windows\System\llVnBQb.exe
  2⤵
  PID:10640
- C:\Windows\System\HrtrmpL.exe
  C:\Windows\System\HrtrmpL.exe
  2⤵
  PID:10656
- C:\Windows\System\lkuBYFm.exe
  C:\Windows\System\lkuBYFm.exe
  2⤵
  PID:10680
- C:\Windows\System\snUHmAz.exe
  C:\Windows\System\snUHmAz.exe
  2⤵
  PID:10704
- C:\Windows\System\XViIUFH.exe
  C:\Windows\System\XViIUFH.exe
  2⤵
  PID:10720
- C:\Windows\System\LlowJEa.exe
  C:\Windows\System\LlowJEa.exe
  2⤵
  PID:10736
- C:\Windows\System\aupOeIw.exe
  C:\Windows\System\aupOeIw.exe
  2⤵
  PID:10756
- C:\Windows\System\uUTfIvW.exe
  C:\Windows\System\uUTfIvW.exe
  2⤵
  PID:10776
- C:\Windows\System\PogKkWF.exe
  C:\Windows\System\PogKkWF.exe
  2⤵
  PID:11004
- C:\Windows\System\Livzfsl.exe
  C:\Windows\System\Livzfsl.exe
  2⤵
  PID:11032
- C:\Windows\System\AGBqDPO.exe
  C:\Windows\System\AGBqDPO.exe
  2⤵
  PID:11056
- C:\Windows\System\TvJCaZp.exe
  C:\Windows\System\TvJCaZp.exe
  2⤵
  PID:11076
- C:\Windows\System\OHPQPAL.exe
  C:\Windows\System\OHPQPAL.exe
  2⤵
  PID:11096
- C:\Windows\System\OihHdAO.exe
  C:\Windows\System\OihHdAO.exe
  2⤵
  PID:11116
- C:\Windows\System\woIHeyw.exe
  C:\Windows\System\woIHeyw.exe
  2⤵
  PID:11136
- C:\Windows\System\EnIpprW.exe
  C:\Windows\System\EnIpprW.exe
  2⤵
  PID:11160
- C:\Windows\System\QhOLLqX.exe
  C:\Windows\System\QhOLLqX.exe
  2⤵
  PID:11188
- C:\Windows\System\EmfKjBz.exe
  C:\Windows\System\EmfKjBz.exe
  2⤵
  PID:11212
- C:\Windows\System\pYSkBSA.exe
  C:\Windows\System\pYSkBSA.exe
  2⤵
  PID:11236
- C:\Windows\System\qOcAbTb.exe
  C:\Windows\System\qOcAbTb.exe
  2⤵
  PID:11256
- C:\Windows\System\fEAlgIp.exe
  C:\Windows\System\fEAlgIp.exe
  2⤵
  PID:8516
- C:\Windows\System\iJNhxxL.exe
  C:\Windows\System\iJNhxxL.exe
  2⤵
  PID:8580
- C:\Windows\System\IuXFPYP.exe
  C:\Windows\System\IuXFPYP.exe
  2⤵
  PID:6648
- C:\Windows\System\EkMmxfO.exe
  C:\Windows\System\EkMmxfO.exe
  2⤵
  PID:9260
- C:\Windows\System\mWRWBvb.exe
  C:\Windows\System\mWRWBvb.exe
  2⤵
  PID:8684
- C:\Windows\System\WHexDHm.exe
  C:\Windows\System\WHexDHm.exe
  2⤵
  PID:9380
- C:\Windows\System\CUdfbkn.exe
  C:\Windows\System\CUdfbkn.exe
  2⤵
  PID:9516
- C:\Windows\System\ICCmynG.exe
  C:\Windows\System\ICCmynG.exe
  2⤵
  PID:9604
- C:\Windows\System\qPCLtfk.exe
  C:\Windows\System\qPCLtfk.exe
  2⤵
  PID:9684
- C:\Windows\System\TVpuzmo.exe
  C:\Windows\System\TVpuzmo.exe
  2⤵
  PID:6164
- C:\Windows\System\kCbYErs.exe
  C:\Windows\System\kCbYErs.exe
  2⤵
  PID:9820
- C:\Windows\System\DsHHAmA.exe
  C:\Windows\System\DsHHAmA.exe
  2⤵
  PID:7140
- C:\Windows\System\EmrIvoh.exe
  C:\Windows\System\EmrIvoh.exe
  2⤵
  PID:3176
- C:\Windows\System\cHQpjZH.exe
  C:\Windows\System\cHQpjZH.exe
  2⤵
  PID:9964
- C:\Windows\System\hCFLaSW.exe
  C:\Windows\System\hCFLaSW.exe
  2⤵
  PID:8216
- C:\Windows\System\bvXpjqd.exe
  C:\Windows\System\bvXpjqd.exe
  2⤵
  PID:8284
- C:\Windows\System\SCplmQk.exe
  C:\Windows\System\SCplmQk.exe
  2⤵
  PID:7388
- C:\Windows\System\vlqUJSX.exe
  C:\Windows\System\vlqUJSX.exe
  2⤵
  PID:2852
- C:\Windows\System\zONlyMR.exe
  C:\Windows\System\zONlyMR.exe
  2⤵
  PID:3960
- C:\Windows\System\fIVnTPX.exe
  C:\Windows\System\fIVnTPX.exe
  2⤵
  PID:7716
- C:\Windows\System\PvybKCU.exe
  C:\Windows\System\PvybKCU.exe
  2⤵
  PID:8404
- C:\Windows\System\rWxSpGv.exe
  C:\Windows\System\rWxSpGv.exe
  2⤵
  PID:8444
- C:\Windows\System\CSjtWOr.exe
  C:\Windows\System\CSjtWOr.exe
  2⤵
  PID:8424
- C:\Windows\System\BpuLOFw.exe
  C:\Windows\System\BpuLOFw.exe
  2⤵
  PID:6236
- C:\Windows\System\kUbRBir.exe
  C:\Windows\System\kUbRBir.exe
  2⤵
  PID:8240
- C:\Windows\System\WYvXVmw.exe
  C:\Windows\System\WYvXVmw.exe
  2⤵
  PID:11284
- C:\Windows\System\hcjOvfE.exe
  C:\Windows\System\hcjOvfE.exe
  2⤵
  PID:11304
- C:\Windows\System\wYKcsku.exe
  C:\Windows\System\wYKcsku.exe
  2⤵
  PID:11324
- C:\Windows\System\QBxsAEv.exe
  C:\Windows\System\QBxsAEv.exe
  2⤵
  PID:11352
- C:\Windows\System\KCuOobN.exe
  C:\Windows\System\KCuOobN.exe
  2⤵
  PID:11372
- C:\Windows\System\vtvIyBr.exe
  C:\Windows\System\vtvIyBr.exe
  2⤵
  PID:11392
- C:\Windows\System\TFaqddG.exe
  C:\Windows\System\TFaqddG.exe
  2⤵
  PID:11420
- C:\Windows\System\JrnamEc.exe
  C:\Windows\System\JrnamEc.exe
  2⤵
  PID:11440
- C:\Windows\System\rRgnSag.exe
  C:\Windows\System\rRgnSag.exe
  2⤵
  PID:11460
- C:\Windows\System\OcqfdQw.exe
  C:\Windows\System\OcqfdQw.exe
  2⤵
  PID:11476
- C:\Windows\System\PYpcitG.exe
  C:\Windows\System\PYpcitG.exe
  2⤵
  PID:11496
- C:\Windows\System\aTJNPDR.exe
  C:\Windows\System\aTJNPDR.exe
  2⤵
  PID:11512
- C:\Windows\System\MMFVyVT.exe
  C:\Windows\System\MMFVyVT.exe
  2⤵
  PID:11528
- C:\Windows\System\mcUFTNr.exe
  C:\Windows\System\mcUFTNr.exe
  2⤵
  PID:11544
- C:\Windows\System\UUTMSaI.exe
  C:\Windows\System\UUTMSaI.exe
  2⤵
  PID:11560
- C:\Windows\System\AmCpDOh.exe
  C:\Windows\System\AmCpDOh.exe
  2⤵
  PID:11584
- C:\Windows\System\nYvEfrt.exe
  C:\Windows\System\nYvEfrt.exe
  2⤵
  PID:11608
- C:\Windows\System\SADoMcK.exe
  C:\Windows\System\SADoMcK.exe
  2⤵
  PID:11632
- C:\Windows\System\wkBkAAI.exe
  C:\Windows\System\wkBkAAI.exe
  2⤵
  PID:11648
- C:\Windows\System\JyQeBhk.exe
  C:\Windows\System\JyQeBhk.exe
  2⤵
  PID:11676
- C:\Windows\System\REEYqyb.exe
  C:\Windows\System\REEYqyb.exe
  2⤵
  PID:11696
- C:\Windows\System\SpTxQOm.exe
  C:\Windows\System\SpTxQOm.exe
  2⤵
  PID:11720
- C:\Windows\System\IrDKNYD.exe
  C:\Windows\System\IrDKNYD.exe
  2⤵
  PID:11740
- C:\Windows\System\mtDwSZW.exe
  C:\Windows\System\mtDwSZW.exe
  2⤵
  PID:11760
- C:\Windows\System\SSdErPN.exe
  C:\Windows\System\SSdErPN.exe
  2⤵
  PID:11780
- C:\Windows\System\ulqMRnp.exe
  C:\Windows\System\ulqMRnp.exe
  2⤵
  PID:11816
- C:\Windows\System\QFmSVmp.exe
  C:\Windows\System\QFmSVmp.exe
  2⤵
  PID:11840
- C:\Windows\System\OTIeFsV.exe
  C:\Windows\System\OTIeFsV.exe
  2⤵
  PID:11860
- C:\Windows\System\UXqDSGP.exe
  C:\Windows\System\UXqDSGP.exe
  2⤵
  PID:11880
- C:\Windows\System\QaGtGlM.exe
  C:\Windows\System\QaGtGlM.exe
  2⤵
  PID:11900
- C:\Windows\System\FacCPxA.exe
  C:\Windows\System\FacCPxA.exe
  2⤵
  PID:11916
- C:\Windows\System\kwXCHDH.exe
  C:\Windows\System\kwXCHDH.exe
  2⤵
  PID:11936
- C:\Windows\System\SxnowkT.exe
  C:\Windows\System\SxnowkT.exe
  2⤵
  PID:11956
- C:\Windows\System\xKuclHi.exe
  C:\Windows\System\xKuclHi.exe
  2⤵
  PID:11980
- C:\Windows\System\vyvqDqu.exe
  C:\Windows\System\vyvqDqu.exe
  2⤵
  PID:12004
- C:\Windows\System\DLlQstz.exe
  C:\Windows\System\DLlQstz.exe
  2⤵
  PID:12020
- C:\Windows\System\SdxOaJN.exe
  C:\Windows\System\SdxOaJN.exe
  2⤵
  PID:12048
- C:\Windows\System\FONCwgx.exe
  C:\Windows\System\FONCwgx.exe
  2⤵
  PID:12068
- C:\Windows\System\kySImnd.exe
  C:\Windows\System\kySImnd.exe
  2⤵
  PID:12088
- C:\Windows\System\xiUxysz.exe
  C:\Windows\System\xiUxysz.exe
  2⤵
  PID:12112
- C:\Windows\System\tFsSqHH.exe
  C:\Windows\System\tFsSqHH.exe
  2⤵
  PID:12140
- C:\Windows\System\SeBxyRr.exe
  C:\Windows\System\SeBxyRr.exe
  2⤵
  PID:12176
- C:\Windows\System\RSirILK.exe
  C:\Windows\System\RSirILK.exe
  2⤵
  PID:12200
- C:\Windows\System\XbWZALT.exe
  C:\Windows\System\XbWZALT.exe
  2⤵
  PID:12224
- C:\Windows\System\xRyBywf.exe
  C:\Windows\System\xRyBywf.exe
  2⤵
  PID:12248
- C:\Windows\System\MbjPHeZ.exe
  C:\Windows\System\MbjPHeZ.exe
  2⤵
  PID:12284
- C:\Windows\System\zcwiRHB.exe
  C:\Windows\System\zcwiRHB.exe
  2⤵
  PID:8408
- C:\Windows\System\fSrFuuI.exe
  C:\Windows\System\fSrFuuI.exe
  2⤵
  PID:8636
- C:\Windows\System\NdmZnWY.exe
  C:\Windows\System\NdmZnWY.exe
  2⤵
  PID:10416
- C:\Windows\System\jBtdbBt.exe
  C:\Windows\System\jBtdbBt.exe
  2⤵
  PID:10504
- C:\Windows\System\qDrdoFD.exe
  C:\Windows\System\qDrdoFD.exe
  2⤵
  PID:10544
- C:\Windows\System\fvUxvHq.exe
  C:\Windows\System\fvUxvHq.exe
  2⤵
  PID:9344
- C:\Windows\System\lqSKjog.exe
  C:\Windows\System\lqSKjog.exe
  2⤵
  PID:9404
- C:\Windows\System\LyQBFcN.exe
  C:\Windows\System\LyQBFcN.exe
  2⤵
  PID:10652
- C:\Windows\System\wRjxcNH.exe
  C:\Windows\System\wRjxcNH.exe
  2⤵
  PID:10676
- C:\Windows\System\HGMDCtK.exe
  C:\Windows\System\HGMDCtK.exe
  2⤵
  PID:10772
- C:\Windows\System\QuZHbyD.exe
  C:\Windows\System\QuZHbyD.exe
  2⤵
  PID:9564
- C:\Windows\System\BBNWJsd.exe
  C:\Windows\System\BBNWJsd.exe
  2⤵
  PID:9624
- C:\Windows\System\CcboyzY.exe
  C:\Windows\System\CcboyzY.exe
  2⤵
  PID:9008
- C:\Windows\System\Gwnjpbd.exe
  C:\Windows\System\Gwnjpbd.exe
  2⤵
  PID:9080
- C:\Windows\System\JBSQWkA.exe
  C:\Windows\System\JBSQWkA.exe
  2⤵
  PID:10928
- C:\Windows\System\BDUYNeC.exe
  C:\Windows\System\BDUYNeC.exe
  2⤵
  PID:10952
- C:\Windows\System\KUpSerO.exe
  C:\Windows\System\KUpSerO.exe
  2⤵
  PID:10972
- C:\Windows\System\uWbGFvZ.exe
  C:\Windows\System\uWbGFvZ.exe
  2⤵
  PID:11024
- C:\Windows\System\zuFCGVf.exe
  C:\Windows\System\zuFCGVf.exe
  2⤵
  PID:11052
- C:\Windows\System\TlCDAbg.exe
  C:\Windows\System\TlCDAbg.exe
  2⤵
  PID:11168
- C:\Windows\System\zYlCLVi.exe
  C:\Windows\System\zYlCLVi.exe
  2⤵
  PID:11196
- C:\Windows\System\tDzXFgY.exe
  C:\Windows\System\tDzXFgY.exe
  2⤵
  PID:7044
- C:\Windows\System\gTgaodP.exe
  C:\Windows\System\gTgaodP.exe
  2⤵
  PID:9476
- C:\Windows\System\FuMIvQz.exe
  C:\Windows\System\FuMIvQz.exe
  2⤵
  PID:9712
- C:\Windows\System\prhbhZy.exe
  C:\Windows\System\prhbhZy.exe
  2⤵
  PID:12300
- C:\Windows\System\DBCpnUV.exe
  C:\Windows\System\DBCpnUV.exe
  2⤵
  PID:12324
- C:\Windows\System\IZKfqiY.exe
  C:\Windows\System\IZKfqiY.exe
  2⤵
  PID:12344
- C:\Windows\System\XYLaUig.exe
  C:\Windows\System\XYLaUig.exe
  2⤵
  PID:12364
- C:\Windows\System\iNQzPKh.exe
  C:\Windows\System\iNQzPKh.exe
  2⤵
  PID:12388
- C:\Windows\System\RmTFQXb.exe
  C:\Windows\System\RmTFQXb.exe
  2⤵
  PID:12412
- C:\Windows\System\Mavfrre.exe
  C:\Windows\System\Mavfrre.exe
  2⤵
  PID:12436
- C:\Windows\System\odKtMiJ.exe
  C:\Windows\System\odKtMiJ.exe
  2⤵
  PID:12452
- C:\Windows\System\lWznNHn.exe
  C:\Windows\System\lWznNHn.exe
  2⤵
  PID:12468
- C:\Windows\System\lDfzQjm.exe
  C:\Windows\System\lDfzQjm.exe
  2⤵
  PID:12484
- C:\Windows\System\hWxMLyW.exe
  C:\Windows\System\hWxMLyW.exe
  2⤵
  PID:12500
- C:\Windows\System\FQZrlZQ.exe
  C:\Windows\System\FQZrlZQ.exe
  2⤵
  PID:12516
- C:\Windows\System\KstiYpw.exe
  C:\Windows\System\KstiYpw.exe
  2⤵
  PID:12532
- C:\Windows\System\LjcCxFi.exe
  C:\Windows\System\LjcCxFi.exe
  2⤵
  PID:12552
- C:\Windows\System\FRvpzAt.exe
  C:\Windows\System\FRvpzAt.exe
  2⤵
  PID:12576
- C:\Windows\System\FBchCoN.exe
  C:\Windows\System\FBchCoN.exe
  2⤵
  PID:12592
- C:\Windows\System\SELKgvn.exe
  C:\Windows\System\SELKgvn.exe
  2⤵
  PID:12616
- C:\Windows\System\hcYtlPP.exe
  C:\Windows\System\hcYtlPP.exe
  2⤵
  PID:12636
- C:\Windows\System\uEPWBkg.exe
  C:\Windows\System\uEPWBkg.exe
  2⤵
  PID:12656
- C:\Windows\System\coCvKoe.exe
  C:\Windows\System\coCvKoe.exe
  2⤵
  PID:12680
- C:\Windows\System\UNelvNO.exe
  C:\Windows\System\UNelvNO.exe
  2⤵
  PID:12700
- C:\Windows\System\ROujqIF.exe
  C:\Windows\System\ROujqIF.exe
  2⤵
  PID:12724
- C:\Windows\System\nZNbNgH.exe
  C:\Windows\System\nZNbNgH.exe
  2⤵
  PID:12744
- C:\Windows\System\XZfgeMo.exe
  C:\Windows\System\XZfgeMo.exe
  2⤵
  PID:12764
- C:\Windows\System\RltjGMy.exe
  C:\Windows\System\RltjGMy.exe
  2⤵
  PID:12792
- C:\Windows\System\pOHHAuV.exe
  C:\Windows\System\pOHHAuV.exe
  2⤵
  PID:12812
- C:\Windows\System\MtiHzmd.exe
  C:\Windows\System\MtiHzmd.exe
  2⤵
  PID:12836
- C:\Windows\System\UBuCcOV.exe
  C:\Windows\System\UBuCcOV.exe
  2⤵
  PID:12856
- C:\Windows\System\CENsiOn.exe
  C:\Windows\System\CENsiOn.exe
  2⤵
  PID:12880
- C:\Windows\System\nhbLYas.exe
  C:\Windows\System\nhbLYas.exe
  2⤵
  PID:12908
- C:\Windows\System\HjrGDAc.exe
  C:\Windows\System\HjrGDAc.exe
  2⤵
  PID:12932
- C:\Windows\System\UisjzUw.exe
  C:\Windows\System\UisjzUw.exe
  2⤵
  PID:12952
- C:\Windows\System\Pwqukqs.exe
  C:\Windows\System\Pwqukqs.exe
  2⤵
  PID:12972
- C:\Windows\System\NAJqpES.exe
  C:\Windows\System\NAJqpES.exe
  2⤵
  PID:13000
- C:\Windows\System\VuZoKkn.exe
  C:\Windows\System\VuZoKkn.exe
  2⤵
  PID:13020
- C:\Windows\System\uKBXFYb.exe
  C:\Windows\System\uKBXFYb.exe
  2⤵
  PID:13044
- C:\Windows\System\Bvnkwoz.exe
  C:\Windows\System\Bvnkwoz.exe
  2⤵
  PID:13064
- C:\Windows\System\KtGhXuX.exe
  C:\Windows\System\KtGhXuX.exe
  2⤵
  PID:13084
- C:\Windows\System\afFZeKt.exe
  C:\Windows\System\afFZeKt.exe
  2⤵
  PID:13104
- C:\Windows\System\ytZDZxE.exe
  C:\Windows\System\ytZDZxE.exe
  2⤵
  PID:13120
- C:\Windows\System\jawkPmd.exe
  C:\Windows\System\jawkPmd.exe
  2⤵
  PID:13144
- C:\Windows\System\LhFbJOl.exe
  C:\Windows\System\LhFbJOl.exe
  2⤵
  PID:13168
- C:\Windows\System\QtVdJhY.exe
  C:\Windows\System\QtVdJhY.exe
  2⤵
  PID:13188
- C:\Windows\System\fjdVVoZ.exe
  C:\Windows\System\fjdVVoZ.exe
  2⤵
  PID:13212
- C:\Windows\System\vcOfhEH.exe
  C:\Windows\System\vcOfhEH.exe
  2⤵
  PID:13232
- C:\Windows\System\occFeUY.exe
  C:\Windows\System\occFeUY.exe
  2⤵
  PID:13260
- C:\Windows\System\AXANWaF.exe
  C:\Windows\System\AXANWaF.exe
  2⤵
  PID:13160
- C:\Windows\System\vtaFyfs.exe
  C:\Windows\System\vtaFyfs.exe
  2⤵
  PID:13184
- C:\Windows\System\sItxMTh.exe
  C:\Windows\System\sItxMTh.exe
  2⤵
  PID:6528
- C:\Windows\System\zxMmwUr.exe
  C:\Windows\System\zxMmwUr.exe
  2⤵
  PID:5052
- C:\Windows\System\mmjFbfx.exe
  C:\Windows\System\mmjFbfx.exe
  2⤵
  PID:10612
- C:\Windows\System\RDMJWuo.exe
  C:\Windows\System\RDMJWuo.exe
  2⤵
  PID:10700
- C:\Windows\System\YRyvkxd.exe
  C:\Windows\System\YRyvkxd.exe
  2⤵
  PID:11976
- C:\Windows\System\PJFsodL.exe
  C:\Windows\System\PJFsodL.exe
  2⤵
  PID:11428
- C:\Windows\System\CCepmrz.exe
  C:\Windows\System\CCepmrz.exe
  2⤵
  PID:11520
- C:\Windows\System\fFvlNpk.exe
  C:\Windows\System\fFvlNpk.exe
  2⤵
  PID:10712
- C:\Windows\System\CqWUBfV.exe
  C:\Windows\System\CqWUBfV.exe
  2⤵
  PID:10948
- C:\Windows\System\bjEmvUU.exe
  C:\Windows\System\bjEmvUU.exe
  2⤵
  PID:12512
- C:\Windows\System\MrTHRSQ.exe
  C:\Windows\System\MrTHRSQ.exe
  2⤵
  PID:10212
- C:\Windows\System\txbfIrI.exe
  C:\Windows\System\txbfIrI.exe
  2⤵
  PID:12692
- C:\Windows\System\ZjcEaXk.exe
  C:\Windows\System\ZjcEaXk.exe
  2⤵
  PID:11296
- C:\Windows\System\inTrZsK.exe
  C:\Windows\System\inTrZsK.exe
  2⤵
  PID:12876
- C:\Windows\System\pgtyZRM.exe
  C:\Windows\System\pgtyZRM.exe
  2⤵
  PID:11988
- C:\Windows\System\qrLxQVi.exe
  C:\Windows\System\qrLxQVi.exe
  2⤵
  PID:9724
- C:\Windows\System\FAFkSTC.exe
  C:\Windows\System\FAFkSTC.exe
  2⤵
  PID:11252
- C:\Windows\System\bZicOjC.exe
  C:\Windows\System\bZicOjC.exe
  2⤵
  PID:12848
- C:\Windows\System\VewfpWq.exe
  C:\Windows\System\VewfpWq.exe
  2⤵
  PID:11104
- C:\Windows\System\SiiCQkF.exe
  C:\Windows\System\SiiCQkF.exe
  2⤵
  PID:12152
- C:\Windows\System\ZGEnpSp.exe
  C:\Windows\System\ZGEnpSp.exe
  2⤵
  PID:12216
- C:\Windows\System\RzEnuOj.exe
  C:\Windows\System\RzEnuOj.exe
  2⤵
  PID:8748
- C:\Windows\System\keaevzN.exe
  C:\Windows\System\keaevzN.exe
  2⤵
  PID:10320
- C:\Windows\System\JsCqLwT.exe
  C:\Windows\System\JsCqLwT.exe
  2⤵
  PID:4948
- C:\Windows\System\hLfBxbq.exe
  C:\Windows\System\hLfBxbq.exe
  2⤵
  PID:12916
- C:\Windows\System\xNQfYFY.exe
  C:\Windows\System\xNQfYFY.exe
  2⤵
  PID:13228
- C:\Windows\System\DyGVOgN.exe
  C:\Windows\System\DyGVOgN.exe
  2⤵
  PID:11656
- C:\Windows\System\BqWRiMh.exe
  C:\Windows\System\BqWRiMh.exe
  2⤵
  PID:12188
- C:\Windows\System\JuVtJdM.exe
  C:\Windows\System\JuVtJdM.exe
  2⤵
  PID:9876
- C:\Windows\System\wDJKdCE.exe
  C:\Windows\System\wDJKdCE.exe
  2⤵
  PID:12612
- C:\Windows\System\YBUJUZz.exe
  C:\Windows\System\YBUJUZz.exe
  2⤵
  PID:9268
- C:\Windows\System\UJpFwOq.exe
  C:\Windows\System\UJpFwOq.exe
  2⤵
  PID:12864
- C:\Windows\System\VKfrVJx.exe
  C:\Windows\System\VKfrVJx.exe
  2⤵
  PID:13156
- C:\Windows\System\VGbfoYj.exe
  C:\Windows\System\VGbfoYj.exe
  2⤵
  PID:10248
- C:\Windows\System\HkKhyPc.exe
  C:\Windows\System\HkKhyPc.exe
  2⤵
  PID:7748
- C:\Windows\System\fdEpHXr.exe
  C:\Windows\System\fdEpHXr.exe
  2⤵
  PID:100
- C:\Windows\System\FZaBtaM.exe
  C:\Windows\System\FZaBtaM.exe
  2⤵
  PID:13112
- C:\Windows\System\danFAPK.exe
  C:\Windows\System\danFAPK.exe
  2⤵
  PID:11576
- C:\Windows\System\qpzwiLi.exe
  C:\Windows\System\qpzwiLi.exe
  2⤵
  PID:13284
- C:\Windows\System\NHvxfdF.exe
  C:\Windows\System\NHvxfdF.exe
  2⤵
  PID:8264
- C:\Windows\System\phGdhLH.exe
  C:\Windows\System\phGdhLH.exe
  2⤵
  PID:12804
- C:\Windows\System\AcrhKBX.exe
  C:\Windows\System\AcrhKBX.exe
  2⤵
  PID:10732
- C:\Windows\System\jwXXDeh.exe
  C:\Windows\System\jwXXDeh.exe
  2⤵
  PID:8576
- C:\Windows\System\vQRICTw.exe
  C:\Windows\System\vQRICTw.exe
  2⤵
  PID:12628
- C:\Windows\System\aQPWcub.exe
  C:\Windows\System\aQPWcub.exe
  2⤵
  PID:9912
- C:\Windows\System\fkWoPDW.exe
  C:\Windows\System\fkWoPDW.exe
  2⤵
  PID:12420
- C:\Windows\System\VOVScvl.exe
  C:\Windows\System\VOVScvl.exe
  2⤵
  PID:11888
- C:\Windows\System\YmaIKkT.exe
  C:\Windows\System\YmaIKkT.exe
  2⤵
  PID:12340
- C:\Windows\System\kCfkPaa.exe
  C:\Windows\System\kCfkPaa.exe
  2⤵
  PID:8108
- C:\Windows\System\IKvBezh.exe
  C:\Windows\System\IKvBezh.exe
  2⤵
  PID:4736
- C:\Windows\System\rRTdIsN.exe
  C:\Windows\System\rRTdIsN.exe
  2⤵
  PID:13280
- C:\Windows\System\xZjzkMN.exe
  C:\Windows\System\xZjzkMN.exe
  2⤵
  PID:10608
- C:\Windows\System\tyjeHrs.exe
  C:\Windows\System\tyjeHrs.exe
  2⤵
  PID:3144
- C:\Windows\System\rIetjwM.exe
  C:\Windows\System\rIetjwM.exe
  2⤵
  PID:8772
- C:\Windows\System\aoxfGev.exe
  C:\Windows\System\aoxfGev.exe
  2⤵
  PID:12212
- C:\Windows\System\xxScTyL.exe
  C:\Windows\System\xxScTyL.exe
  2⤵
  PID:4328
- C:\Windows\System\KYbeCjH.exe
  C:\Windows\System\KYbeCjH.exe
  2⤵
  PID:13276
- C:\Windows\System\ELbIPld.exe
  C:\Windows\System\ELbIPld.exe
  2⤵
  PID:10148
- C:\Windows\System\tdntFMf.exe
  C:\Windows\System\tdntFMf.exe
  2⤵
  PID:13204
- C:\Windows\System\WOEzQep.exe
  C:\Windows\System\WOEzQep.exe
  2⤵
  PID:9784
- C:\Windows\System\hShVdJA.exe
  C:\Windows\System\hShVdJA.exe
  2⤵
  PID:13272
- C:\Windows\System\mcgdwXD.exe
  C:\Windows\System\mcgdwXD.exe
  2⤵
  PID:8504
- C:\Windows\System\HpWrXzl.exe
  C:\Windows\System\HpWrXzl.exe
  2⤵
  PID:10104
- C:\Windows\System\VQPuqTt.exe
  C:\Windows\System\VQPuqTt.exe
  2⤵
  PID:8376
- C:\Windows\System\OcQssnR.exe
  C:\Windows\System\OcQssnR.exe
  2⤵
  PID:12668
- C:\Windows\System\LhdSgXm.exe
  C:\Windows\System\LhdSgXm.exe
  2⤵
  PID:12632
- C:\Windows\System\TJlBNSN.exe
  C:\Windows\System\TJlBNSN.exe
  2⤵
  PID:12544
- C:\Windows\System\PfEMtik.exe
  C:\Windows\System\PfEMtik.exe
  2⤵
  PID:11400
- C:\Windows\System\GRVtzjk.exe
  C:\Windows\System\GRVtzjk.exe
  2⤵
  PID:1872
- C:\Windows\System\EnHNlqJ.exe
  C:\Windows\System\EnHNlqJ.exe
  2⤵
  PID:7516
- C:\Windows\System\ZlAwEeP.exe
  C:\Windows\System\ZlAwEeP.exe
  2⤵
  PID:10872
- C:\Windows\System\GNbmQBg.exe
  C:\Windows\System\GNbmQBg.exe
  2⤵
  PID:12260
- C:\Windows\System\mggrKNe.exe
  C:\Windows\System\mggrKNe.exe
  2⤵
  PID:13340
- C:\Windows\System\QyrMtCD.exe
  C:\Windows\System\QyrMtCD.exe
  2⤵
  PID:13392
- C:\Windows\System\iUvCwbL.exe
  C:\Windows\System\iUvCwbL.exe
  2⤵
  PID:13592
- C:\Windows\System\WBpeWWA.exe
  C:\Windows\System\WBpeWWA.exe
  2⤵
  PID:13688
- C:\Windows\System\nrTvRql.exe
  C:\Windows\System\nrTvRql.exe
  2⤵
  PID:13828
- C:\Windows\System\BBkuzeX.exe
  C:\Windows\System\BBkuzeX.exe
  2⤵
  PID:13936
- C:\Windows\System\aPNvVyM.exe
  C:\Windows\System\aPNvVyM.exe
  2⤵
  PID:14004
- C:\Windows\System\toAYFmc.exe
  C:\Windows\System\toAYFmc.exe
  2⤵
  PID:14032
- C:\Windows\System\gZCYlKi.exe
  C:\Windows\System\gZCYlKi.exe
  2⤵
  PID:14244
- C:\Windows\System\vtoXcvD.exe
  C:\Windows\System\vtoXcvD.exe
  2⤵
  PID:14276
- C:\Windows\System\CQVcALY.exe
  C:\Windows\System\CQVcALY.exe
  2⤵
  PID:14296
- C:\Windows\System\aUuqsXx.exe
  C:\Windows\System\aUuqsXx.exe
  2⤵
  PID:14320
- C:\Windows\System\xOUNYbD.exe
  C:\Windows\System\xOUNYbD.exe
  2⤵
  PID:13016
- C:\Windows\System\asAHjNZ.exe
  C:\Windows\System\asAHjNZ.exe
  2⤵
  PID:13720
- C:\Windows\System\VJNZYXW.exe
  C:\Windows\System\VJNZYXW.exe
  2⤵
  PID:13752
- C:\Windows\System\tvTGpTl.exe
  C:\Windows\System\tvTGpTl.exe
  2⤵
  PID:13768
- C:\Windows\System\zaKYBwo.exe
  C:\Windows\System\zaKYBwo.exe
  2⤵
  PID:13848
- C:\Windows\System\JdHJPun.exe
  C:\Windows\System\JdHJPun.exe
  2⤵
  PID:9728
- C:\Windows\System\JDEaENC.exe
  C:\Windows\System\JDEaENC.exe
  2⤵
  PID:13452
- C:\Windows\System\ZiXvtvF.exe
  C:\Windows\System\ZiXvtvF.exe
  2⤵
  PID:13432
- C:\Windows\System\VGvetza.exe
  C:\Windows\System\VGvetza.exe
  2⤵
  PID:13576
- C:\Windows\System\ugnJDdb.exe
  C:\Windows\System\ugnJDdb.exe
  2⤵
  PID:12988
- C:\Windows\System\RyBJWOJ.exe
  C:\Windows\System\RyBJWOJ.exe
  2⤵
  PID:13496
- C:\Windows\System\lyFFZsQ.exe
  C:\Windows\System\lyFFZsQ.exe
  2⤵
  PID:13380
- C:\Windows\System\lVmbsiM.exe
  C:\Windows\System\lVmbsiM.exe
  2⤵
  PID:12600
- C:\Windows\System\UCOYjFE.exe
  C:\Windows\System\UCOYjFE.exe
  2⤵
  PID:13584
- C:\Windows\System\PKeBYQZ.exe
  C:\Windows\System\PKeBYQZ.exe
  2⤵
  PID:13440
- C:\Windows\System\vulEjtM.exe
  C:\Windows\System\vulEjtM.exe
  2⤵
  PID:13436
- C:\Windows\System\YFnTHnf.exe
  C:\Windows\System\YFnTHnf.exe
  2⤵
  PID:13316
- C:\Windows\System\lSdfvdl.exe
  C:\Windows\System\lSdfvdl.exe
  2⤵
  PID:13600
- C:\Windows\System\AUUxCxZ.exe
  C:\Windows\System\AUUxCxZ.exe
  2⤵
  PID:13712
- C:\Windows\System\NHgYprK.exe
  C:\Windows\System\NHgYprK.exe
  2⤵
  PID:13656
- C:\Windows\System\zkwMGyj.exe
  C:\Windows\System\zkwMGyj.exe
  2⤵
  PID:8792
- C:\Windows\System\fzgzhoD.exe
  C:\Windows\System\fzgzhoD.exe
  2⤵
  PID:13748
- C:\Windows\System\SHzqzSe.exe
  C:\Windows\System\SHzqzSe.exe
  2⤵
  PID:13884
- C:\Windows\System\rvaFiIv.exe
  C:\Windows\System\rvaFiIv.exe
  2⤵
  PID:13920
- C:\Windows\System\ZyvjCuc.exe
  C:\Windows\System\ZyvjCuc.exe
  2⤵
  PID:12448
- C:\Windows\System\ZuKVmpC.exe
  C:\Windows\System\ZuKVmpC.exe
  2⤵
  PID:13908
- C:\Windows\System\teardYe.exe
  C:\Windows\System\teardYe.exe
  2⤵
  PID:14000
- C:\Windows\System\EgfDZNi.exe
  C:\Windows\System\EgfDZNi.exe
  2⤵
  PID:13932
- C:\Windows\System\QOoybHG.exe
  C:\Windows\System\QOoybHG.exe
  2⤵
  PID:13956
- C:\Windows\System\LixBnID.exe
  C:\Windows\System\LixBnID.exe
  2⤵
  PID:13700
- C:\Windows\System\aoohsHA.exe
  C:\Windows\System\aoohsHA.exe
  2⤵
  PID:14012
- C:\Windows\System\ilXMAbE.exe
  C:\Windows\System\ilXMAbE.exe
  2⤵
  PID:13928
- C:\Windows\System\kTbDepg.exe
  C:\Windows\System\kTbDepg.exe
  2⤵
  PID:14068
- C:\Windows\System\vcVPnDw.exe
  C:\Windows\System\vcVPnDw.exe
  2⤵
  PID:14028
- C:\Windows\System\BITAsJj.exe
  C:\Windows\System\BITAsJj.exe
  2⤵
  PID:13952
- C:\Windows\System\GrGOmsM.exe
  C:\Windows\System\GrGOmsM.exe
  2⤵
  PID:14104
- C:\Windows\System\acMVkbV.exe
  C:\Windows\System\acMVkbV.exe
  2⤵
  PID:14140
- C:\Windows\System\MjPWMRj.exe
  C:\Windows\System\MjPWMRj.exe
  2⤵
  PID:13856
- C:\Windows\System\tlusdbI.exe
  C:\Windows\System\tlusdbI.exe
  2⤵
  PID:14072
- C:\Windows\System\yKMEaug.exe
  C:\Windows\System\yKMEaug.exe
  2⤵
  PID:3700
- C:\Windows\System\GmpAVPV.exe
  C:\Windows\System\GmpAVPV.exe
  2⤵
  PID:840
- C:\Windows\System\PNNfqQh.exe
  C:\Windows\System\PNNfqQh.exe
  2⤵
  PID:14124
- C:\Windows\System\QzeyqWy.exe
  C:\Windows\System\QzeyqWy.exe
  2⤵
  PID:14212
- C:\Windows\System\iVrftgz.exe
  C:\Windows\System\iVrftgz.exe
  2⤵
  PID:14220
- C:\Windows\System\XTwXlAC.exe
  C:\Windows\System\XTwXlAC.exe
  2⤵
  PID:13792
- C:\Windows\System\HMeZwug.exe
  C:\Windows\System\HMeZwug.exe
  2⤵
  PID:14204
- C:\Windows\System\rMUUxlj.exe
  C:\Windows\System\rMUUxlj.exe
  2⤵
  PID:13924
- C:\Windows\System\xaBvKgO.exe
  C:\Windows\System\xaBvKgO.exe
  2⤵
  PID:14268
- C:\Windows\System\gbjZkBo.exe
  C:\Windows\System\gbjZkBo.exe
  2⤵
  PID:14288
- C:\Windows\System\JrPvFMk.exe
  C:\Windows\System\JrPvFMk.exe
  2⤵
  PID:12428
- C:\Windows\System\ZYUXeeo.exe
  C:\Windows\System\ZYUXeeo.exe
  2⤵
  PID:14272
- C:\Windows\System\ttrbaDd.exe
  C:\Windows\System\ttrbaDd.exe
  2⤵
  PID:12424
- C:\Windows\System\laPiEEa.exe
  C:\Windows\System\laPiEEa.exe
  2⤵
  PID:13356
- C:\Windows\System\mfruExZ.exe
  C:\Windows\System\mfruExZ.exe
  2⤵
  PID:10052
- C:\Windows\System\DobXStQ.exe
  C:\Windows\System\DobXStQ.exe
  2⤵
  PID:13460
- C:\Windows\System\BsQEAol.exe
  C:\Windows\System\BsQEAol.exe
  2⤵
  PID:10388
- C:\Windows\System\DguWHUP.exe
  C:\Windows\System\DguWHUP.exe
  2⤵
  PID:1960
- C:\Windows\System\lNUKhYi.exe
  C:\Windows\System\lNUKhYi.exe
  2⤵
  PID:5256
- C:\Windows\System\WiqaLbY.exe
  C:\Windows\System\WiqaLbY.exe
  2⤵
  PID:2044
- C:\Windows\System\DqUmfRr.exe
  C:\Windows\System\DqUmfRr.exe
  2⤵
  PID:10500
- C:\Windows\System\qxiwJYC.exe
  C:\Windows\System\qxiwJYC.exe
  2⤵
  PID:13400
- C:\Windows\System\UmyjWSp.exe
  C:\Windows\System\UmyjWSp.exe
  2⤵
  PID:13444
- C:\Windows\System\hGnHRfG.exe
  C:\Windows\System\hGnHRfG.exe
  2⤵
  PID:13632
- C:\Windows\System\kxTbXhh.exe
  C:\Windows\System\kxTbXhh.exe
  2⤵
  PID:13736
- C:\Windows\System\lNhwTtx.exe
  C:\Windows\System\lNhwTtx.exe
  2⤵
  PID:13644
- C:\Windows\System\UPwKLne.exe
  C:\Windows\System\UPwKLne.exe
  2⤵
  PID:13628
- C:\Windows\System\OnBVYFm.exe
  C:\Windows\System\OnBVYFm.exe
  2⤵
  PID:13796
- C:\Windows\System\GKiBzML.exe
  C:\Windows\System\GKiBzML.exe
  2⤵
  PID:14044
- C:\Windows\System\WNgYwjA.exe
  C:\Windows\System\WNgYwjA.exe
  2⤵
  PID:13756
- C:\Windows\System\KrjsuUE.exe
  C:\Windows\System\KrjsuUE.exe
  2⤵
  PID:14020
- C:\Windows\System\JKcEUob.exe
  C:\Windows\System\JKcEUob.exe
  2⤵
  PID:13944
- C:\Windows\System\kLtItBE.exe
  C:\Windows\System\kLtItBE.exe
  2⤵
  PID:14092
- C:\Windows\System\QEZsuRo.exe
  C:\Windows\System\QEZsuRo.exe
  2⤵
  PID:14156
- C:\Windows\System\YTTQuuG.exe
  C:\Windows\System\YTTQuuG.exe
  2⤵
  PID:13764
- C:\Windows\System\kuXJLQD.exe
  C:\Windows\System\kuXJLQD.exe
  2⤵
  PID:4280
- C:\Windows\System\anveYfJ.exe
  C:\Windows\System\anveYfJ.exe
  2⤵
  PID:13980
- C:\Windows\System\oxUxzce.exe
  C:\Windows\System\oxUxzce.exe
  2⤵
  PID:14200
- C:\Windows\System\IWXEDNB.exe
  C:\Windows\System\IWXEDNB.exe
  2⤵
  PID:11804
- C:\Windows\System\BkSkidT.exe
  C:\Windows\System\BkSkidT.exe
  2⤵
  PID:6276
- C:\Windows\System\WLjMwPk.exe
  C:\Windows\System\WLjMwPk.exe
  2⤵
  PID:4312
- C:\Windows\System\kMlnZuU.exe
  C:\Windows\System\kMlnZuU.exe
  2⤵
  PID:2132
- C:\Windows\System\leZSobf.exe
  C:\Windows\System\leZSobf.exe
  2⤵
  PID:12832
- C:\Windows\System\fXpYgtR.exe
  C:\Windows\System\fXpYgtR.exe
  2⤵
  PID:13408
- C:\Windows\System\bAUKRJL.exe
  C:\Windows\System\bAUKRJL.exe
  2⤵
  PID:13480
- C:\Windows\System\xcHUOxy.exe
  C:\Windows\System\xcHUOxy.exe
  2⤵
  PID:13368
- C:\Windows\System\fnHgLVl.exe
  C:\Windows\System\fnHgLVl.exe
  2⤵
  PID:13416
- C:\Windows\System\nTDnnIB.exe
  C:\Windows\System\nTDnnIB.exe
  2⤵
  PID:13876
- C:\Windows\System\uWVbTGD.exe
  C:\Windows\System\uWVbTGD.exe
  2⤵
  PID:13424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:10248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5tmolwub.1bi.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DQBuMaX.exe

Filesize
1.7MB

MD5
4d68dc9719f90b4eb88cc6c50b85eeb9

SHA1
54e5b293552bed6639ae37774c1aed3c60eafaa4

SHA256
01e9d3ee97b7241d9e94962ecaf6a3d1fdc26a1e3878bc2c4d6cbd20ad992cbf

SHA512
0d898b327afdad7c5ffa62d903cc77c39f90443da7b02d2c5d796419ac27c453440ff53e6e86c5418d254743ccfab6e37ea0bc523e31f28d0c5bede9b37e67e3

Download Submit
C:\Windows\System\DTlBvDc.exe

Filesize
1.7MB

MD5
ce476511e257e9b623e96cb793818865

SHA1
45f3cba4b09dd12b4198d31de5aa269e98278ddc

SHA256
e8b6ea460a3871b4e8a86c62e421248a99669c103d2456b4bad686ee6a8a0d36

SHA512
735d51113c898bab61771ee7e2bee6558fdd2e3d8ec3b01a92c69efcd92c707f6662d1e123cffaae4359d8af5594acb4e47c44ad9a69f3318de461e4146a1642

Download Submit
C:\Windows\System\HZtFrhV.exe

Filesize
1.7MB

MD5
41023cb31f929246e4406e7b6f5d77ae

SHA1
385d9cac4f98ffc63b3fe55a9b7579c13a7b8b9b

SHA256
bf8fb86ee9fc8e166cd9b1feefa6912700800c6e56958bfd53d603975ebad954

SHA512
b476cb7b0dd74329c9a7694b8ddf01f37b713970886f0aea0c0c6c35517d90f76698bd2059bb61a1bd7423373098280b1fe9664fb7bb9c8692c68678a1fcece1

Download Submit
C:\Windows\System\IRgGlle.exe

Filesize
1.7MB

MD5
9447fc93bc1bde641ecb919d7ce8e161

SHA1
9c8fdb35b981340101566d31697ddf27b83282cf

SHA256
bc366e30adb41f34c9adb1a1f649aaef6d0fbac1f5333c0a8350bd055299c92c

SHA512
b54d175b7635f2e5cb1746848a2b7ae9a8b1b5aa95f4323c5010b52bf0532497f81c74b5e4c3854469b4a4ff0b53ef8a6a33a994af273ba4179517f395e4624d

Download Submit
C:\Windows\System\IUGRuQO.exe

Filesize
1.7MB

MD5
928af4aa7e5fc6fca13750b7a8ea1cd3

SHA1
f9a6ee2dfeee38d7dd8801ad02adf4b381a040f6

SHA256
04a0e590e5225bb773b14fc5574168bddf625ea8156d1054363f742ce03e10c5

SHA512
320acfea0a8d802f513e5ab7bc1cc9516096d856beea113facffd1686af87a1878481fda798998b5d93f3e4c34e63025a99b8f41de91ac3f2a3c5fe9fd7b9942

Download Submit
C:\Windows\System\JMQYiDx.exe

Filesize
1.7MB

MD5
21b6e3984eab8ae1476ddce0c0d6b741

SHA1
70587135bff50e7fe854e27d6a8f6656d819da51

SHA256
0327cf7b7afd0c96c668a4da9e6f549cf3ffb1956e8b4c814eea1ec18380625e

SHA512
690eee161a0abd38bf548c80af0bb20d2c6d3f6888ef9a2760e0dc95783bec6642110093697ed05637878fd470bbc4240f95ff59fe3751e211ca4ba24cfa0f3c

Download Submit
C:\Windows\System\KDYMNRo.exe

Filesize
1.7MB

MD5
8857fcf3ed9c652978dd27d28924940c

SHA1
9789abc5f8de3afd783818ab4427a88f134ee7c9

SHA256
6272990a7d5a63d4f16ddd7f0dc5071baf42a518bd885c31462886b241a1673e

SHA512
93bc3e33829216266808a198106fe5307e58f0c42dce15b202cddbef56c363c80aecb17049f39b40a6352bc74dbd35e12c8fb2c32e05169885e1e4087f7d6752

Download Submit
C:\Windows\System\KDqPeTB.exe

Filesize
1.7MB

MD5
8ad2119a953f1cd638a751fd4ebc3015

SHA1
4e33abcb764b6b374d78f3f09d8efa4d249d3c2c

SHA256
d52c03151c9cc8189464d43a8e8eb8f442736dd3ff4577efc97646658746666a

SHA512
3f19b3e7fe2503d61f43b332393054f307cae7a36dd79f9a099c06ef95a49fe035b80d0b365fa918526bd145c21c07d4cdc733c006ab4ff8c7e092c39b5395d4

Download Submit
C:\Windows\System\KPvFbsh.exe

Filesize
1.7MB

MD5
1fe8bada6096e64ad2912e2ecbaa777d

SHA1
8df213fe6368602736b1655cb45519972ac07c83

SHA256
128918dc97f054c8604a2d88e23fe7438ad786e4e1833e0def326b526402a7ee

SHA512
42e03fc5e89c38cfda93080865fbb1d55d435359162b24f589b20d780c309bacea73a5c6365a4fbf7b18cc44b3f07f50a0eca3a3346321c6e8467976af8bf277

Download Submit
C:\Windows\System\LQGziuW.exe

Filesize
1.7MB

MD5
aa92a03c10394f5de25983cef9c828da

SHA1
6e3fd4d4f925b9cafeea3de5e171e0b394fd7511

SHA256
cfb911da765fc7c2c36d1bb3775f44752de69034beb2a81ec6d8bfb514a2bbce

SHA512
abf50e4e77f09a1e0eefadfc955d12779c0a5952fdca796916ec7913869e3c4c14742d84e8223d83ba549a37740e45edb1cebec1a4f1d7330ac9595d045aa26f

Download Submit
C:\Windows\System\LQNOVyT.exe

Filesize
1.7MB

MD5
fc393e47ce96898b6e3a3d2085ce8090

SHA1
38c49c84be412c6224592fc5ccabc15a6bf7cb6d

SHA256
00a26dd3a34d858c5b1a2e07b73a29223e2d462442e306cd2534afcb1ae7dcae

SHA512
15948894c63793359d4f0df5ccc14ee45dd6f734be9cf117265e7048c85a12bd9e517d45954531b03434b6a667b27cf7119f349a14bf7f8368c2501a5370808f

Download Submit
C:\Windows\System\LvokWQN.exe

Filesize
1.7MB

MD5
abd66bf3f8400143e01001f9e69f854a

SHA1
eccf9f7681fcd2bb03abfd344488e393457abb5a

SHA256
8dbec28f7bcc9ff81979071ceef4dacbf2ed94d030ac0060784fccad4674cb82

SHA512
278686bc5b2d35602cc019d4a65e261d15832dfbf1c0545e6297f7e3abf40d201a23f735903900462eb25ff4d64ac59a2d51a9c34371d2fe781b2aaa100c75c2

Download Submit
C:\Windows\System\LzqlyAD.exe

Filesize
1.7MB

MD5
de79bb8534279f39b4b57f6dd36a078c

SHA1
db5d5970d096f52aeb8f3a148cce8821d89135e1

SHA256
c2f327892dc6d1c0d64d208a901538a5f713d4f18efa69fc10728b5d04842354

SHA512
910caf16c4d20fb80ff38f3a965479c0cfbdb3ef96e58362229eef9d5b0bfd7399e2af92d7fcb3fa25a8527ef72273aae52fa02c49b8ed161abbc8a0e3a820a5

Download Submit
C:\Windows\System\NVtPgPE.exe

Filesize
1.7MB

MD5
c6ba01a4c63d3faf3c4e2f9b27db8298

SHA1
06662ee72d480e3c60253c94813398558092c70d

SHA256
8af23e9c91665978b2989c868db0378ca497c8e5dd60e609ba73ff3cf8daf05c

SHA512
700a36cc81fd379123a0fbf298157690ce10df4c84f4f15bb01a468ead277bb8316fafd036d4864d399aa581b35d035af7c961e47d0bcb9410d3426346d8c02f

Download Submit
C:\Windows\System\NkdSQro.exe

Filesize
1.7MB

MD5
6aab8488d5a7d3c1844139f8c0c08b1f

SHA1
50f060ab99172698c7ec6c4afe5fd2b309a048e8

SHA256
074cc88cb672a48a4f83ca91e7f677d5d2f553d9b3804683973e33c9eda45d93

SHA512
2355c28d7425fc969821227c9d9f25a7e7727b35826fa283fe74916e331268ff668f4ec63fe9e0c78f286d3f1e0551ad2fccb4fb627533b3da4d142f62943598

Download Submit
C:\Windows\System\PGENBxS.exe

Filesize
1.7MB

MD5
7358e05a7ac2a1e597596d08379d2677

SHA1
e2a171a5bed0fc189e4ea8ce72cd35bb144f94c2

SHA256
010ae8b6b1c2f8849fa480498a1bad3fc0b4dd84e3edff94746d18e3bb8050c3

SHA512
e166ac087209e2fffb37b145bd39a7132b8012c506bb18f2540ac5679b065a796d0eeabb4788a4e978921453e50835a894c1307ba55c6190d40e6bb31aeef58b

Download Submit
C:\Windows\System\QgXfREe.exe

Filesize
1.7MB

MD5
319d1ff1cd395e56987c1461bf615110

SHA1
4f5329fc4f2337062f86896f8d90e11a80e5c3ee

SHA256
802c18731aa7413a802ead0a632f4c55614702fb275e4f570fa0c42d91f22ae4

SHA512
a9a88a4cdc2a6d743d742e7096adf15c76743eb8466c9a361b5bea95a9642283a4d9619feccb772ba006c0cf8a4fe4b9480c0535d2978219f6095a86e0de0601

Download Submit
C:\Windows\System\VQuVXbb.exe

Filesize
1.7MB

MD5
90558f15df9b6614742ba55f17c0b78f

SHA1
ad5ea3137ac81df95a096d129d642a473ca5f2b6

SHA256
5e40fe5817ed11c48c5bf6cdab3047c3dd46f81d61649b048a1852c32802c6ff

SHA512
fc5a99eca3c053c90cf913fb9f60eb075a79f1a061da11be1c7bea1e8679bbd9804f0a4b7fdef28e563e77cda611416e4a0c6a8d3317217499be97a473c2dca2

Download Submit
C:\Windows\System\VaJqWJj.exe

Filesize
1.7MB

MD5
0f64644bf28fc07fc991eee8f2d4629d

SHA1
12295d014bcd43ecf7fe87220a061957093000d7

SHA256
2458ac09d24c7cfbe3587a581253182f4482a6ec1e0073a5b2a4222753302b62

SHA512
ec3cb530375f85e32414a828c3e4ee86c0702860b517a9be6f4dcea39982beca7f67ae7973ecc048c1452a8a2b856c54fb6c645add064ffae938b3041af78007

Download Submit
C:\Windows\System\Vvtwpbz.exe

Filesize
1.7MB

MD5
5219be3b3595ab0d493b252c65dca2c6

SHA1
cb78917de87d0a98ca19b0993f89eea6aaf8c8aa

SHA256
084879f79719f1ff0a6f292c1035a134722bda6323a7f905a8d2ff921dd4ed10

SHA512
242a558d38db0d4d66fc8e7f3f88531ab8a4f84f2cbbf59293f475cdb2772bc578615c84de5b60fad7f502f269673a32f9f42e354e6b85cb3b56c69f8acb4214

Download Submit
C:\Windows\System\WBAbTSl.exe

Filesize
1.7MB

MD5
5bdba5829370ef2588c0400a2553e647

SHA1
7bcdb9789a6e33c3933a45cf2c66d10a3e3e4a32

SHA256
20690a00f09496af49126c4a8cf9de2434d295661a2dee4b7bc1119c2a292ecc

SHA512
66bf9ca121cc32590f46f4260d45c5823b6ec8ed4cecd75ddab4162b20d9f5c0e91c70ca7fa57cf16af63773728d866fde53554454de886dc3ffae3097c25696

Download Submit
C:\Windows\System\XOIPosa.exe

Filesize
1.7MB

MD5
054e3319d7ce578f862cab285576444f

SHA1
cd90da4b4d7b1b8afdfa39aac2de237c3fb4f48d

SHA256
1f533e57d96ba5f532f50a4944974831c195d938619a4cec1fcaf15e77ecd4cd

SHA512
18dd50aec84a07abab73ed72e6c69d5f29a361d8b476d63a31d80ec20b58002ed41638b55f4010a668b8983c9edb8a83ebdbc5dffb18030b78583e87ea97b09e

Download Submit
C:\Windows\System\ZVXwiKj.exe

Filesize
1.7MB

MD5
e96c15a5bd72381abd629bdc4275b1a2

SHA1
d72c2f9e5071dd3b59bdf670cab7151c2b3ea2ff

SHA256
54f1c407fa0dedf137825bbc28f078bcc11706482ddd1a0946501dcf45f20cb5

SHA512
736cb90ac4659b4c2294475d24a8107cafd6ada9965aa29742029611021ccef6fcb2738ce0d64889d757fffb972a8ebae1c364c2165855e1b74d2b92a45df031

Download Submit
C:\Windows\System\aNMJHUB.exe

Filesize
1.7MB

MD5
489eec69d71028111d5a1990730e247e

SHA1
2a20d82b41cc24dc13359dc448cd528c5272f281

SHA256
80ce984ace22abf0e2af9c86ade3998a34c5dd7c7791bfe091f997373b96b2cd

SHA512
86aa956e6bd5e052d30496a439f149543100a5cbbb548eacd870a1bb68ae719d2401e03bcb4cfe98c5b521832c3cc9f7ce37223883451a973bf34ed394f4e173

Download Submit
C:\Windows\System\asnXeux.exe

Filesize
1.7MB

MD5
75dd5d1edba4471cb1190f02a1f1550b

SHA1
cf234a192ec211ef8f287969628b79935cd2094b

SHA256
efda010c7a6b730a0a8e816807bc4a9d1373c48d25e12a90a14947208980fe6c

SHA512
34f6ed3a394371b3beb290bb6681601fc00e8457f44f9b1ce6bbe19171cbbc7039de18eea872358f146a69ea1cda0f9cd604b2ff0294f99caf872ce4fb00f6ec

Download Submit
C:\Windows\System\brfOehQ.exe

Filesize
8B

MD5
fbef424b1922acb531e69f596a8b8921

SHA1
584ada3a02d95facb3db59252be930cc2019a07e

SHA256
9ba99dfe86f586665444906d4d6c065235a1faa079a57e34597feec2870450c4

SHA512
b7c856eeb52f1f5b978a86cc276964a598136109586a3999d60402c0885755b7f0a6e5ca90b5856e8f2e8d74fc885b0d7e257ea62c297369572d765724b94880

Download Submit
C:\Windows\System\dOWSHez.exe

Filesize
1.7MB

MD5
1c3fd032bfc14ed59bd14cbdb896c1c3

SHA1
58cf6b272fe4db4df472bffc6b9175128bab8146

SHA256
859a3dc32cdc4a8b6c24101e1f19bfa36eb398e1b584d8787d33eb0052f358e7

SHA512
02f281c7607fad759d0ed2bda0bfd70fcb9a853a9aa467290f09ced5b61499f918c0a6977e7aff2d7745da9c78c5d31d48dd5659b29fcf331d22d3a46a0e160f

Download Submit
C:\Windows\System\dZeuotG.exe

Filesize
1.7MB

MD5
a4adcbc858c631dc46775d0171ab1380

SHA1
d7ce9171608d853372a3319f4e7b89f26ae5720b

SHA256
15277073c3dff7e0a4f52395248a983546840e87a44b6a66005a1bf07f863e06

SHA512
fd046ab364c738c0166cd3bdc677931bc66839a2f96df6e4ffd3948ab61a7508b2e1bdfe0297b56adb5bb7fcebff875cead7d3040735d5bebdd392e0a61e7a10

Download Submit
C:\Windows\System\ddWIewI.exe

Filesize
1.7MB

MD5
3df351e1cb938771f6efa575010d6795

SHA1
64879677ecfee027d6204b889410cf27f9e2e706

SHA256
060bdcc2540313090c56675b4fa1f5ce21e9dbf832c6777e87562dff0c720e55

SHA512
5fde2399ba80b2992797379f215f51d6f3acd23754687b1ca72c0c03b619e461b122c6cc46a7d3d85a30a09746a2c4f0b58dff23f4448c611eb3ec21328303da

Download Submit
C:\Windows\System\dyWotMj.exe

Filesize
1.7MB

MD5
20c57e59abd81ac8d1db95d07e5aaa4c

SHA1
9326ce07261fed74668db9253f0fff607b4f00bc

SHA256
3b47c7be3af9dde4724f8e57fa036709f870a25b66c3865b7ef1c277400741c5

SHA512
9ba13121ec4b6e7d94f809bf2e28ef9ff459d522674700a02168917e2afe71f7fe3c3867b5e6c49aaa3e68a9ad2bf3d170638ac04add366dff019215abcede18

Download Submit
C:\Windows\System\edOQVUM.exe

Filesize
1.7MB

MD5
26eca7f7c847a1f01c8844e4096b18c7

SHA1
0031f7419c88563f401e89ae5740468e2f7f6432

SHA256
48ff80a8be1de2a2aa3ce15fdf651cd3f1d156153ee553642250ab161ce96811

SHA512
18db75d5ff52399a0dedb68eb5fe599d36c2d96fa8c4dd02b8bf1890d5742fc07cbd4b0e92c8ea9756c1eaeef011067080c7542d9f3e0e8d8803e094d5c5350e

Download Submit
C:\Windows\System\fpajiGu.exe

Filesize
1.7MB

MD5
ad7fa66d0f6a1428d854f36e0e7865af

SHA1
4274f87837d4579bc86caf9f9002f84032437b59

SHA256
b4e688f1f03ad04d3a76af521f28116dbde93d2b7fcf4406c3c3d37aeb4d23d7

SHA512
c703b277f02eece55f4e2cb965ae3739ac9fce4d0fdc0fe67f902d5cbcb2566ac354fa01212cf2285ad82a0886e267741562fd98af6fd6ea84e5077a3842fdf1

Download Submit
C:\Windows\System\iqFjLou.exe

Filesize
1.7MB

MD5
ab3f3f93a275bd41dec0eda124a68a2f

SHA1
8487b1f93c71bac85c391e55158fca0df43733e5

SHA256
f2aca06fc1b35a86f3ee9f37f1f62a177b3b4d3b466e96c609680aec983816c0

SHA512
cb17cd23573db2d2eff5a526c18cded272d48c8d7bfc522607c5ff7ba24a96c7cdf2cfde357e1cd5ca998532e40f09e12eadb2064d41d549de9c8dfc1c9d3f49

Download Submit
C:\Windows\System\jahdLYR.exe

Filesize
1.7MB

MD5
9c1ab9f655616a9ed9bb3b4ccd4e66df

SHA1
ec7a49417648e0a6432911c1de38e801883deaf5

SHA256
d3e612f68d87881dee03329c9d500306b5432b9739cf5905502bbb68ba77ad8e

SHA512
c3b70aced72ff1317a4af2d7877f83f76b46e49d6aa1eba03d3d3e9192dc5a06cc2a0afd1bc6b2c9b75fd894f67b2d8893f999a2614e50da90c6454f8249eec2

Download Submit
C:\Windows\System\kYbbRKn.exe

Filesize
1.7MB

MD5
76edb9273619cae9789a3c42c5a4d3dc

SHA1
46266d77422ad1593a8d67dffb0c7cc426b820f6

SHA256
c5288c30ca28080c683e9a88a73486fdeedef62ab45cebaed74e452adf4ba5cc

SHA512
00b23f53915ed3a08c0257c8f2e53e35b33d983348a18b8308de9e9b3483c1e1683b1cbc48a7a863e271a4583f0fbca0b9e958768f7598498a07a4ba30d01703

Download Submit
C:\Windows\System\kxshDKP.exe

Filesize
1.7MB

MD5
7215f8603215e7d28b1a81c5390fcce7

SHA1
8e54bb547442537216d7c1e5fdb6dc016516034e

SHA256
51f4ebcdce30f10c3150935c379e6aa450a8e1f6e23f61043d212a1e3298216b

SHA512
38579d0fc1909a025b16e86558d22217193c53fae1fcdf0c86d835e9b873b2c718084b8779b2c03187f15f1bfd7bfb1ca74b2705af15bee769a28441ebdd95a2

Download Submit
C:\Windows\System\onxqNLK.exe

Filesize
1.7MB

MD5
75b130feb6b19267cca78daf53f2d118

SHA1
6bc83ec4d5c85f02813c5a26c433eb1af63c0152

SHA256
b4ca40470de1c810babd1f715b7a67ae7664a22bc88be598f107ae8fb0020f36

SHA512
125ae68d4606ff0fec448990960663ea009f5aed16e16f90171f4353fae07c18fe1934b18f9d8aa66a8876e1044181b1fa620b2f0fb050989b0e6d4aaf741a79

Download Submit
C:\Windows\System\pfNRDte.exe

Filesize
1.7MB

MD5
3acaa8c47740948f40bcaded93a6c765

SHA1
340eaa08cfd946ebd6d5c6db0b95672bbd60581d

SHA256
c47ea688e6683e25fe44a639aaba72315116b3a9e61abaa752ee31b87abb0ec3

SHA512
446dddc82c4f2b07cd4ae0a5a9a19e9a268b888bf3fbf1cf9465d4fcfc25686b8406f0bbc1ef17431e3b6e6b109ec22863fc8632e145bb45ca3f405a266800f4

Download Submit
C:\Windows\System\rVgVmqs.exe

Filesize
1.7MB

MD5
cca001f3d4c61001382b85a78145c1d3

SHA1
1539451995acc1b81c1a1150c9c02ed4e7a534c3

SHA256
09d54f64127789825cdcf91dc2f18138be7c988642c448a371519aad11017335

SHA512
29d4ff964308781dbb9caae5ae71c3eaf61feb9ee9e6eae67d4ee0f67f1412a60c1a33991530de0240a20179dbf21169cd9f0578a1ec986abc128361f5470f24

Download Submit
C:\Windows\System\ugzrECb.exe

Filesize
1.7MB

MD5
d7e64696cbb6b644fcf84b4a942990d7

SHA1
d6c697a6eb98ef886787560d356f8060791be080

SHA256
96a34b6272bb0ffee5aea3d4adecfee07727590f49e53e0b62b3285bf28ec669

SHA512
acb1b2fe080d6a85da0ba980d6816d40707ab2260d7368c29dabc54b5b4ebd5ddb2c5841fc4d4b04c357d4bb5a5e2436e65a72e13263e2a2c023d49d22d34de4

Download Submit
C:\Windows\System\vjNvZxk.exe

Filesize
1.7MB

MD5
c2968be45fa40d5cee1dbbfeeab2832b

SHA1
0a6e5e2f764fa86018617665007462adf5b004e0

SHA256
9031b7f84b04ef4665db9320f2d562db66684c4342e75962a0c8f24f410f9414

SHA512
ae8ab8e98f868f9ecc005eb89f0cab6006f2141a0dffd202df20ed56587a70d7f3b525f0206875a0697fd31d1c384129754b233912c13dceb7d9bf795cd342d1

Download Submit
C:\Windows\System\vrgkNcp.exe

Filesize
1.7MB

MD5
70304193dce7dbee4db11c4c0b24959a

SHA1
a2a65b2045d772ba9533fd7f28b434cb16c4734c

SHA256
b20e01eacf968ff0026c1e356dd00ae680fd142e8dfd21d6fe4c4c9eaff4f2d9

SHA512
54fdd503e06e763cd2c01412249990cf9c546e29b1b5f5eb614be989986cfe42d5af7625d8eefe5aaf1ecfc49bb071c2be9c0f39b39b1e19895fa4007594670f

Download Submit
C:\Windows\System\vswdhQC.exe

Filesize
1.7MB

MD5
6d330c506729ed1b043e1a3a29550905

SHA1
bb542b2bdb0580b66495c0b97dc05875078b98e8

SHA256
96c071cc65fcfa6953f744962a5eea9d5fccd708c9e810f51a44f59428ae3c4e

SHA512
c71083f6dc98692dd04b9d2767020d3ee498e9cae75b291e76fb231786af5e062a438c07b96402a529fcae17d0adbcb9adcba28d88d66e4ea781cd0b92d22dd4

Download Submit
C:\Windows\System\xVqDbkp.exe

Filesize
1.7MB

MD5
08eb870d7a051273ec5e512c904d1553

SHA1
912886690e1d49b6ed33a576792426dc426ea1a5

SHA256
575af2fac9e3880f361bb1a1fb942553467f5340ead4fb75d0876ea7c83e7fb6

SHA512
9c101fd0ecc920f7151f3b4d70f43d6be7cc6b84d5734f2c53dbc52d568d40585a4c0792041c8c4262c50e6f72319982a99de586151e3939aff4ee5df0bdaaf2

Download Submit
C:\Windows\System\xZKLyuF.exe

Filesize
1.7MB

MD5
38a0f4f21c67810164f883f3a1eeb313

SHA1
ded58f59b8218389d80b290f777173102a725d5b

SHA256
97e491654cc2884fb95c1d5e7485d7874d2e15d9c82df381434f894f494dfa99

SHA512
6f8be8deb27201f590f2c6fb40d4db5a9cca47b20792c5d979383cce6f3d9d4c94fdaf49213ce410238ac620a103fea19503669746028c76716bc1639f1561b8

Download Submit
memory/768-190-0x00007FF67E8A0000-0x00007FF67EC92000-memory.dmp

Filesize
3.9MB

Download
memory/768-4223-0x00007FF67E8A0000-0x00007FF67EC92000-memory.dmp

Filesize
3.9MB

Download
memory/892-383-0x00007FF7DF710000-0x00007FF7DFB02000-memory.dmp

Filesize
3.9MB

Download
memory/892-4267-0x00007FF7DF710000-0x00007FF7DFB02000-memory.dmp

Filesize
3.9MB

Download
memory/1156-278-0x00007FF65C5E0000-0x00007FF65C9D2000-memory.dmp

Filesize
3.9MB

Download
memory/1156-4264-0x00007FF65C5E0000-0x00007FF65C9D2000-memory.dmp

Filesize
3.9MB

Download
memory/1312-121-0x00007FF7C2D20000-0x00007FF7C3112000-memory.dmp

Filesize
3.9MB

Download
memory/1312-4218-0x00007FF7C2D20000-0x00007FF7C3112000-memory.dmp

Filesize
3.9MB

Download
memory/1540-14-0x00007FF755DD0000-0x00007FF7561C2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-4210-0x00007FF755DD0000-0x00007FF7561C2000-memory.dmp

Filesize
3.9MB

Download
memory/1552-4220-0x00007FF7CF7A0000-0x00007FF7CFB92000-memory.dmp

Filesize
3.9MB

Download
memory/1552-38-0x00007FF7CF7A0000-0x00007FF7CFB92000-memory.dmp

Filesize
3.9MB

Download
memory/1576-207-0x00007FF632C90000-0x00007FF633082000-memory.dmp

Filesize
3.9MB

Download
memory/1576-4228-0x00007FF632C90000-0x00007FF633082000-memory.dmp

Filesize
3.9MB

Download
memory/1772-304-0x00007FF643490000-0x00007FF643882000-memory.dmp

Filesize
3.9MB

Download
memory/1772-4254-0x00007FF643490000-0x00007FF643882000-memory.dmp

Filesize
3.9MB

Download
memory/1928-4214-0x00007FF68B8F0000-0x00007FF68BCE2000-memory.dmp

Filesize
3.9MB

Download
memory/1928-99-0x00007FF68B8F0000-0x00007FF68BCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-306-0x00007FF783F50000-0x00007FF784342000-memory.dmp

Filesize
3.9MB

Download
memory/2268-4238-0x00007FF783F50000-0x00007FF784342000-memory.dmp

Filesize
3.9MB

Download
memory/2772-302-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2772-4239-0x00007FF64C4C0000-0x00007FF64C8B2000-memory.dmp

Filesize
3.9MB

Download
memory/3092-246-0x00007FF77CFE0000-0x00007FF77D3D2000-memory.dmp

Filesize
3.9MB

Download
memory/3092-4235-0x00007FF77CFE0000-0x00007FF77D3D2000-memory.dmp

Filesize
3.9MB

Download
memory/3100-312-0x00007FF65D9C0000-0x00007FF65DDB2000-memory.dmp

Filesize
3.9MB

Download
memory/3100-4262-0x00007FF65D9C0000-0x00007FF65DDB2000-memory.dmp

Filesize
3.9MB

Download
memory/3380-145-0x00007FF9F1F80000-0x00007FF9F2249000-memory.dmp

Filesize
2.8MB

Download
memory/3380-173-0x00007FF9F1F80000-0x00007FF9F2249000-memory.dmp

Filesize
2.8MB

Download
memory/3380-299-0x000001F8719F0000-0x000001F871A12000-memory.dmp

Filesize
136KB

Download
memory/3380-433-0x00007FF9F1F80000-0x00007FF9F2249000-memory.dmp

Filesize
2.8MB

Download
memory/3440-4252-0x00007FF6BD160000-0x00007FF6BD552000-memory.dmp

Filesize
3.9MB

Download
memory/3440-430-0x00007FF6BD160000-0x00007FF6BD552000-memory.dmp

Filesize
3.9MB

Download
memory/3444-103-0x00007FF7CABA0000-0x00007FF7CAF92000-memory.dmp

Filesize
3.9MB

Download
memory/3444-4233-0x00007FF7CABA0000-0x00007FF7CAF92000-memory.dmp

Filesize
3.9MB

Download
memory/3516-432-0x00007FF760360000-0x00007FF760752000-memory.dmp

Filesize
3.9MB

Download
memory/3516-4247-0x00007FF760360000-0x00007FF760752000-memory.dmp

Filesize
3.9MB

Download
memory/3552-423-0x00007FF6F2A50000-0x00007FF6F2E42000-memory.dmp

Filesize
3.9MB

Download
memory/3552-4250-0x00007FF6F2A50000-0x00007FF6F2E42000-memory.dmp

Filesize
3.9MB

Download
memory/3676-431-0x00007FF63B7D0000-0x00007FF63BBC2000-memory.dmp

Filesize
3.9MB

Download
memory/3676-4258-0x00007FF63B7D0000-0x00007FF63BBC2000-memory.dmp

Filesize
3.9MB

Download
memory/3856-4224-0x00007FF6E2A70000-0x00007FF6E2E62000-memory.dmp

Filesize
3.9MB

Download
memory/3856-245-0x00007FF6E2A70000-0x00007FF6E2E62000-memory.dmp

Filesize
3.9MB

Download
memory/3944-4216-0x00007FF646590000-0x00007FF646982000-memory.dmp

Filesize
3.9MB

Download
memory/3944-434-0x00007FF646590000-0x00007FF646982000-memory.dmp

Filesize
3.9MB

Download
memory/4384-436-0x00007FF664070000-0x00007FF664462000-memory.dmp

Filesize
3.9MB

Download
memory/4384-4227-0x00007FF664070000-0x00007FF664462000-memory.dmp

Filesize
3.9MB

Download
memory/4412-4261-0x00007FF6055E0000-0x00007FF6059D2000-memory.dmp

Filesize
3.9MB

Download
memory/4412-399-0x00007FF6055E0000-0x00007FF6059D2000-memory.dmp

Filesize
3.9MB

Download
memory/4476-62-0x00007FF77DF10000-0x00007FF77E302000-memory.dmp

Filesize
3.9MB

Download
memory/4476-4212-0x00007FF77DF10000-0x00007FF77E302000-memory.dmp

Filesize
3.9MB

Download
memory/4808-1-0x000001812AD40000-0x000001812AD50000-memory.dmp

Filesize
64KB

Download
memory/4808-0-0x00007FF787800000-0x00007FF787BF2000-memory.dmp

Filesize
3.9MB

Download
memory/4820-435-0x00007FF6E2720000-0x00007FF6E2B12000-memory.dmp

Filesize
3.9MB

Download
memory/4820-4234-0x00007FF6E2720000-0x00007FF6E2B12000-memory.dmp

Filesize
3.9MB

Download