xmrig | 8cdfb0c00ba6bf137ed9efc1fcc6e6db5ef640feb816d1185cdb179962958a79

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
Size

1.7MB
MD5

36595325939d7d009a5de72779b7ec10
SHA1

9e538293f92cce2e5002444152b9ee487ee65a91
SHA256

8cdfb0c00ba6bf137ed9efc1fcc6e6db5ef640feb816d1185cdb179962958a79
SHA512

45b31966b4e9e50b6ada8174dd7c38d911df9a1319f76aff13fda4ad5d01f722c404b69d35c1e6a62e31fc6a3776b670c714f8ae38f0ce2e867629dd564ffc68
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYlZ3pBjqlx7TovQmVV4dThen9ze:Lz071uv4BPMkibTIA5lCx7kvRWa4pUaz

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral2/memory/1824-293-0x00007FF6DCC00000-0x00007FF6DCFF2000-memory.dmp	xmrig
behavioral2/memory/1504-396-0x00007FF656070000-0x00007FF656462000-memory.dmp	xmrig
behavioral2/memory/2980-469-0x00007FF7F57A0000-0x00007FF7F5B92000-memory.dmp	xmrig
behavioral2/memory/3880-474-0x00007FF7C04E0000-0x00007FF7C08D2000-memory.dmp	xmrig
behavioral2/memory/4652-478-0x00007FF6B9520000-0x00007FF6B9912000-memory.dmp	xmrig
behavioral2/memory/4064-477-0x00007FF73FB80000-0x00007FF73FF72000-memory.dmp	xmrig
behavioral2/memory/4228-476-0x00007FF610640000-0x00007FF610A32000-memory.dmp	xmrig
behavioral2/memory/3496-473-0x00007FF7E9C20000-0x00007FF7EA012000-memory.dmp	xmrig
behavioral2/memory/1768-472-0x00007FF7A3340000-0x00007FF7A3732000-memory.dmp	xmrig
behavioral2/memory/3852-471-0x00007FF779230000-0x00007FF779622000-memory.dmp	xmrig
behavioral2/memory/64-470-0x00007FF69D630000-0x00007FF69DA22000-memory.dmp	xmrig
behavioral2/memory/4824-468-0x00007FF64D310000-0x00007FF64D702000-memory.dmp	xmrig
behavioral2/memory/1996-456-0x00007FF79AFB0000-0x00007FF79B3A2000-memory.dmp	xmrig
behavioral2/memory/2016-393-0x00007FF676E70000-0x00007FF677262000-memory.dmp	xmrig
behavioral2/memory/4944-371-0x00007FF61B770000-0x00007FF61BB62000-memory.dmp	xmrig
behavioral2/memory/1484-338-0x00007FF6D3200000-0x00007FF6D35F2000-memory.dmp	xmrig
behavioral2/memory/1664-269-0x00007FF6E5F40000-0x00007FF6E6332000-memory.dmp	xmrig
behavioral2/memory/2796-256-0x00007FF63DE70000-0x00007FF63E262000-memory.dmp	xmrig
behavioral2/memory/2524-242-0x00007FF740B40000-0x00007FF740F32000-memory.dmp	xmrig
behavioral2/memory/2376-213-0x00007FF61A4C0000-0x00007FF61A8B2000-memory.dmp	xmrig
behavioral2/memory/3232-158-0x00007FF6FEEE0000-0x00007FF6FF2D2000-memory.dmp	xmrig
behavioral2/memory/1132-116-0x00007FF699500000-0x00007FF6998F2000-memory.dmp	xmrig
behavioral2/memory/2604-75-0x00007FF603E90000-0x00007FF604282000-memory.dmp	xmrig
behavioral2/memory/4048-69-0x00007FF600E20000-0x00007FF601212000-memory.dmp	xmrig
behavioral2/memory/4356-3782-0x00007FF7762A0000-0x00007FF776692000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1608	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4048	dWJSnrg.exe
2604	QQwlxwG.exe
1132	lCOdCiI.exe
3232	nRUwykf.exe
2376	MejGivc.exe
2524	IGSXVvR.exe
2796	AvTVequ.exe
4228	uHLiGzX.exe
1664	dnHcjQg.exe
1824	gXIkmGo.exe
1484	oZKgSWN.exe
4944	PRcKveu.exe
4064	SkfngkZ.exe
2016	UplyAmc.exe
1504	eNIwawA.exe
1996	HrzAQNC.exe
4824	eXQZLwm.exe
2980	KxKGGMg.exe
4652	UQKNkCP.exe
64	mtehetf.exe
3852	zZnXyqU.exe
1768	YQVXBqv.exe
3496	VLuUJNn.exe
3880	JdaWqVm.exe
5016	zfXpbDv.exe
4528	mxyhKnj.exe
1856	FyqdVKk.exe
3500	xAvmDHE.exe
1004	xJSNQcz.exe
2444	gonqDad.exe
3948	kZnjMwq.exe
2600	RaXLNoj.exe
324	UMsFxNf.exe
752	ooOZXga.exe
1692	vtLfeUj.exe
2252	RlPVOVm.exe
1652	vaeICjZ.exe
4388	bFQNTFz.exe
2044	QDdWeUT.exe
2696	CXtDZqE.exe
3476	rnEWGUh.exe
3392	OWmCvIg.exe
1020	ydHpiVf.exe
3256	QCXYYbH.exe
4508	yxowXJq.exe
4512	wzbvuSl.exe
4180	rjVEpAy.exe
2424	vjyrTTA.exe
4900	OXsQvSU.exe
3220	VCWLDwb.exe
3996	wEnpRii.exe
1628	HToOFPq.exe
2152	cBqcCHo.exe
1604	TAUpUVX.exe
4300	txrVpbQ.exe
1028	BuuGytv.exe
3828	BagGMXe.exe
1964	QdUESwT.exe
3780	WKxwTjm.exe
4520	mgbyTWJ.exe
1916	baQImiL.exe
3288	NnudOtm.exe
3108	EXzEwmB.exe
1228	WMCcdGx.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4356-0-0x00007FF7762A0000-0x00007FF776692000-memory.dmp	upx
behavioral2/files/0x000700000002340b-8.dat	upx
behavioral2/files/0x00090000000233ff-6.dat	upx
behavioral2/files/0x0007000000023417-79.dat	upx
behavioral2/files/0x000700000002341c-120.dat	upx
behavioral2/memory/1824-293-0x00007FF6DCC00000-0x00007FF6DCFF2000-memory.dmp	upx
behavioral2/memory/1504-396-0x00007FF656070000-0x00007FF656462000-memory.dmp	upx
behavioral2/memory/2980-469-0x00007FF7F57A0000-0x00007FF7F5B92000-memory.dmp	upx
behavioral2/memory/3880-474-0x00007FF7C04E0000-0x00007FF7C08D2000-memory.dmp	upx
behavioral2/memory/4652-478-0x00007FF6B9520000-0x00007FF6B9912000-memory.dmp	upx
behavioral2/memory/4064-477-0x00007FF73FB80000-0x00007FF73FF72000-memory.dmp	upx
behavioral2/memory/4228-476-0x00007FF610640000-0x00007FF610A32000-memory.dmp	upx
behavioral2/memory/3496-473-0x00007FF7E9C20000-0x00007FF7EA012000-memory.dmp	upx
behavioral2/memory/1768-472-0x00007FF7A3340000-0x00007FF7A3732000-memory.dmp	upx
behavioral2/memory/3852-471-0x00007FF779230000-0x00007FF779622000-memory.dmp	upx
behavioral2/memory/64-470-0x00007FF69D630000-0x00007FF69DA22000-memory.dmp	upx
behavioral2/memory/4824-468-0x00007FF64D310000-0x00007FF64D702000-memory.dmp	upx
behavioral2/memory/1996-456-0x00007FF79AFB0000-0x00007FF79B3A2000-memory.dmp	upx
behavioral2/memory/2016-393-0x00007FF676E70000-0x00007FF677262000-memory.dmp	upx
behavioral2/memory/4944-371-0x00007FF61B770000-0x00007FF61BB62000-memory.dmp	upx
behavioral2/memory/1484-338-0x00007FF6D3200000-0x00007FF6D35F2000-memory.dmp	upx
behavioral2/memory/1664-269-0x00007FF6E5F40000-0x00007FF6E6332000-memory.dmp	upx
behavioral2/memory/2796-256-0x00007FF63DE70000-0x00007FF63E262000-memory.dmp	upx
behavioral2/memory/2524-242-0x00007FF740B40000-0x00007FF740F32000-memory.dmp	upx
behavioral2/files/0x0007000000023421-207.dat	upx
behavioral2/files/0x000700000002342e-199.dat	upx
behavioral2/files/0x000700000002342a-198.dat	upx
behavioral2/files/0x0009000000023400-195.dat	upx
behavioral2/files/0x0007000000023429-194.dat	upx
behavioral2/files/0x000700000002341e-193.dat	upx
behavioral2/files/0x000700000002341f-189.dat	upx
behavioral2/files/0x0008000000023410-183.dat	upx
behavioral2/files/0x000700000002341d-180.dat	upx
behavioral2/files/0x0007000000023425-172.dat	upx
behavioral2/files/0x000700000002342d-171.dat	upx
behavioral2/files/0x0007000000023424-170.dat	upx
behavioral2/files/0x000700000002341b-169.dat	upx
behavioral2/files/0x0007000000023423-163.dat	upx
behavioral2/files/0x000700000002342c-162.dat	upx
behavioral2/memory/2376-213-0x00007FF61A4C0000-0x00007FF61A8B2000-memory.dmp	upx
behavioral2/memory/3232-158-0x00007FF6FEEE0000-0x00007FF6FF2D2000-memory.dmp	upx
behavioral2/files/0x0007000000023419-156.dat	upx
behavioral2/files/0x000700000002342b-153.dat	upx
behavioral2/files/0x0007000000023415-151.dat	upx
behavioral2/files/0x0007000000023427-149.dat	upx
behavioral2/files/0x0007000000023422-144.dat	upx
behavioral2/files/0x0007000000023420-135.dat	upx
behavioral2/files/0x0007000000023416-132.dat	upx
behavioral2/files/0x0007000000023428-150.dat	upx
behavioral2/files/0x0007000000023426-148.dat	upx
behavioral2/memory/1132-116-0x00007FF699500000-0x00007FF6998F2000-memory.dmp	upx
behavioral2/files/0x0008000000023411-115.dat	upx
behavioral2/files/0x000700000002341a-106.dat	upx
behavioral2/files/0x0007000000023414-92.dat	upx
behavioral2/files/0x0007000000023418-86.dat	upx
behavioral2/files/0x0007000000023413-83.dat	upx
behavioral2/files/0x0007000000023412-77.dat	upx
behavioral2/memory/2604-75-0x00007FF603E90000-0x00007FF604282000-memory.dmp	upx
behavioral2/files/0x000700000002340f-72.dat	upx
behavioral2/memory/4048-69-0x00007FF600E20000-0x00007FF601212000-memory.dmp	upx
behavioral2/files/0x000700000002340e-59.dat	upx
behavioral2/files/0x000700000002340d-36.dat	upx
behavioral2/files/0x000700000002340c-27.dat	upx
behavioral2/files/0x000800000002340a-20.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ZOWGzWR.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\RklTbjW.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\qSBXJSl.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\ravmyEE.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\aGfjCpN.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\BagGMXe.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\VWkwzix.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\mIsjYes.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\ijlzxpU.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\zaiZxLp.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\aaVvibk.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\WTibIIa.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\ovjrMZh.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\zLqKNKO.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\nniqGYj.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\SyzyRWj.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\EoGpjrY.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\IIeSWIp.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\RueTnwk.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\liRFHEd.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\FckDOEM.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\BntPQMf.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\pHVChck.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\rlRYJaV.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\HcnTawM.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\ymCMDHm.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\GLxbBCf.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\GKRWnAA.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\DuhigxF.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\gmXnMFF.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\NIbiTvZ.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\uEqNUte.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\lWJJHxr.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\hUdbOFh.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\QDdWeUT.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\gJxFEdW.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\ybVXnwO.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\mtehetf.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\vtLfeUj.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\xuxwHXp.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\KQmviIp.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\EczHdOT.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\pozYsMb.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\gvStGHJ.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\DISQSvr.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\OoSalHD.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\ubRbqpB.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\ifLXdKY.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\GKNaNOk.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\LMCrWgL.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\dThPvhr.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\nxbbblv.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\DAEUZyV.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\yVpITcs.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\pMZjhVC.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\nlwNEKV.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\bEElRhy.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\fgRQrgL.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\KDEklIx.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\QAoVfnY.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\nLNTIhm.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\HKtwFvK.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\XFrxCap.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
File created	C:\Windows\System\hcdGewF.exe	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1608	powershell.exe
1608	powershell.exe
1608	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3264	Process not Found
4020	Process not Found
4440	Process not Found
3788	Process not Found
3792	Process not Found
3068	Process not Found
456	Process not Found
3716	Process not Found
3768	Process not Found
860	Process not Found
1152	Process not Found
3584	Process not Found
4820	Process not Found
2528	Process not Found
2124	Process not Found
4980	Process not Found
3312	Process not Found
3868	Process not Found
1508	Process not Found
3128	Process not Found
1784	Process not Found
3712	Process not Found
4852	Process not Found
2808	Process not Found
1012	Process not Found
800	Process not Found
4396	Process not Found
2312	Process not Found
5068	Process not Found
2108	Process not Found
4716	Process not Found
3280	Process not Found
1468	Process not Found
2736	Process not Found
2028	Process not Found
14848	Process not Found
3672	Process not Found
14680	Process not Found
2940	Process not Found
3036	Process not Found
5124	Process not Found
4084	Process not Found
948	Process not Found
232	Process not Found
14952	Process not Found
4896	Process not Found
14956	Process not Found
5432	Process not Found
5528	Process not Found
1568	Process not Found
5192	Process not Found
5680	Process not Found
5700	Process not Found
3800	Process not Found
14936	Process not Found
5752	Process not Found
5816	Process not Found
4120	Process not Found
4748	Process not Found
4420	Process not Found
5948	Process not Found
6704	Process not Found
14940	Process not Found
6124	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
Token: SeDebugPrivilege	1608	powershell.exe
Token: SeLockMemoryPrivilege	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
Token: SeCreateGlobalPrivilege	13440	dwm.exe
Token: SeChangeNotifyPrivilege	13440	dwm.exe
Token: 33	13440	dwm.exe
Token: SeIncBasePriorityPrivilege	13440	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 1608	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	83
PID 4356 wrote to memory of 1608	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	83
PID 4356 wrote to memory of 4048	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	84
PID 4356 wrote to memory of 4048	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	84
PID 4356 wrote to memory of 2604	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	85
PID 4356 wrote to memory of 2604	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	85
PID 4356 wrote to memory of 1132	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	86
PID 4356 wrote to memory of 1132	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	86
PID 4356 wrote to memory of 3232	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	87
PID 4356 wrote to memory of 3232	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	87
PID 4356 wrote to memory of 2376	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	88
PID 4356 wrote to memory of 2376	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	88
PID 4356 wrote to memory of 2524	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	89
PID 4356 wrote to memory of 2524	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	89
PID 4356 wrote to memory of 2796	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	90
PID 4356 wrote to memory of 2796	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	90
PID 4356 wrote to memory of 4228	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	91
PID 4356 wrote to memory of 4228	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	91
PID 4356 wrote to memory of 1664	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	92
PID 4356 wrote to memory of 1664	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	92
PID 4356 wrote to memory of 1824	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	93
PID 4356 wrote to memory of 1824	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	93
PID 4356 wrote to memory of 1484	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	94
PID 4356 wrote to memory of 1484	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	94
PID 4356 wrote to memory of 1504	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	95
PID 4356 wrote to memory of 1504	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	95
PID 4356 wrote to memory of 4944	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	96
PID 4356 wrote to memory of 4944	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	96
PID 4356 wrote to memory of 4064	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	97
PID 4356 wrote to memory of 4064	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	97
PID 4356 wrote to memory of 2016	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	98
PID 4356 wrote to memory of 2016	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	98
PID 4356 wrote to memory of 1996	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	99
PID 4356 wrote to memory of 1996	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	99
PID 4356 wrote to memory of 4824	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	100
PID 4356 wrote to memory of 4824	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	100
PID 4356 wrote to memory of 2980	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	101
PID 4356 wrote to memory of 2980	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	101
PID 4356 wrote to memory of 4652	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	102
PID 4356 wrote to memory of 4652	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	102
PID 4356 wrote to memory of 64	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	103
PID 4356 wrote to memory of 64	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	103
PID 4356 wrote to memory of 3852	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	104
PID 4356 wrote to memory of 3852	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	104
PID 4356 wrote to memory of 1768	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	105
PID 4356 wrote to memory of 1768	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	105
PID 4356 wrote to memory of 3496	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	106
PID 4356 wrote to memory of 3496	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	106
PID 4356 wrote to memory of 3880	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	107
PID 4356 wrote to memory of 3880	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	107
PID 4356 wrote to memory of 5016	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	108
PID 4356 wrote to memory of 5016	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	108
PID 4356 wrote to memory of 4528	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	109
PID 4356 wrote to memory of 4528	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	109
PID 4356 wrote to memory of 2600	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	110
PID 4356 wrote to memory of 2600	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	110
PID 4356 wrote to memory of 324	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	111
PID 4356 wrote to memory of 324	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	111
PID 4356 wrote to memory of 1692	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	112
PID 4356 wrote to memory of 1692	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	112
PID 4356 wrote to memory of 1856	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	113
PID 4356 wrote to memory of 1856	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	113
PID 4356 wrote to memory of 3500	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	114
PID 4356 wrote to memory of 3500	4356	36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\36595325939d7d009a5de72779b7ec10_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1608
- C:\Windows\System\dWJSnrg.exe
  C:\Windows\System\dWJSnrg.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\QQwlxwG.exe
  C:\Windows\System\QQwlxwG.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\lCOdCiI.exe
  C:\Windows\System\lCOdCiI.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\nRUwykf.exe
  C:\Windows\System\nRUwykf.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\MejGivc.exe
  C:\Windows\System\MejGivc.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\IGSXVvR.exe
  C:\Windows\System\IGSXVvR.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\AvTVequ.exe
  C:\Windows\System\AvTVequ.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\uHLiGzX.exe
  C:\Windows\System\uHLiGzX.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\dnHcjQg.exe
  C:\Windows\System\dnHcjQg.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\gXIkmGo.exe
  C:\Windows\System\gXIkmGo.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\oZKgSWN.exe
  C:\Windows\System\oZKgSWN.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\eNIwawA.exe
  C:\Windows\System\eNIwawA.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\PRcKveu.exe
  C:\Windows\System\PRcKveu.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\SkfngkZ.exe
  C:\Windows\System\SkfngkZ.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\UplyAmc.exe
  C:\Windows\System\UplyAmc.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\HrzAQNC.exe
  C:\Windows\System\HrzAQNC.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\eXQZLwm.exe
  C:\Windows\System\eXQZLwm.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\KxKGGMg.exe
  C:\Windows\System\KxKGGMg.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\UQKNkCP.exe
  C:\Windows\System\UQKNkCP.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\mtehetf.exe
  C:\Windows\System\mtehetf.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\zZnXyqU.exe
  C:\Windows\System\zZnXyqU.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\YQVXBqv.exe
  C:\Windows\System\YQVXBqv.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\VLuUJNn.exe
  C:\Windows\System\VLuUJNn.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\JdaWqVm.exe
  C:\Windows\System\JdaWqVm.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\zfXpbDv.exe
  C:\Windows\System\zfXpbDv.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\mxyhKnj.exe
  C:\Windows\System\mxyhKnj.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\RaXLNoj.exe
  C:\Windows\System\RaXLNoj.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\UMsFxNf.exe
  C:\Windows\System\UMsFxNf.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\vtLfeUj.exe
  C:\Windows\System\vtLfeUj.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\FyqdVKk.exe
  C:\Windows\System\FyqdVKk.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\xAvmDHE.exe
  C:\Windows\System\xAvmDHE.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\xJSNQcz.exe
  C:\Windows\System\xJSNQcz.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\RlPVOVm.exe
  C:\Windows\System\RlPVOVm.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\bFQNTFz.exe
  C:\Windows\System\bFQNTFz.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\gonqDad.exe
  C:\Windows\System\gonqDad.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\kZnjMwq.exe
  C:\Windows\System\kZnjMwq.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\ooOZXga.exe
  C:\Windows\System\ooOZXga.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\vaeICjZ.exe
  C:\Windows\System\vaeICjZ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\QDdWeUT.exe
  C:\Windows\System\QDdWeUT.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\CXtDZqE.exe
  C:\Windows\System\CXtDZqE.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\rnEWGUh.exe
  C:\Windows\System\rnEWGUh.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\OWmCvIg.exe
  C:\Windows\System\OWmCvIg.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\ydHpiVf.exe
  C:\Windows\System\ydHpiVf.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\QCXYYbH.exe
  C:\Windows\System\QCXYYbH.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\yxowXJq.exe
  C:\Windows\System\yxowXJq.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\wzbvuSl.exe
  C:\Windows\System\wzbvuSl.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\rjVEpAy.exe
  C:\Windows\System\rjVEpAy.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\vjyrTTA.exe
  C:\Windows\System\vjyrTTA.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\OXsQvSU.exe
  C:\Windows\System\OXsQvSU.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\VCWLDwb.exe
  C:\Windows\System\VCWLDwb.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\baQImiL.exe
  C:\Windows\System\baQImiL.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\wEnpRii.exe
  C:\Windows\System\wEnpRii.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\HToOFPq.exe
  C:\Windows\System\HToOFPq.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\cBqcCHo.exe
  C:\Windows\System\cBqcCHo.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\TAUpUVX.exe
  C:\Windows\System\TAUpUVX.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\txrVpbQ.exe
  C:\Windows\System\txrVpbQ.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\BuuGytv.exe
  C:\Windows\System\BuuGytv.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\BagGMXe.exe
  C:\Windows\System\BagGMXe.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\QdUESwT.exe
  C:\Windows\System\QdUESwT.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\WKxwTjm.exe
  C:\Windows\System\WKxwTjm.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\mgbyTWJ.exe
  C:\Windows\System\mgbyTWJ.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\NnudOtm.exe
  C:\Windows\System\NnudOtm.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\EXzEwmB.exe
  C:\Windows\System\EXzEwmB.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\WMCcdGx.exe
  C:\Windows\System\WMCcdGx.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\GKRWnAA.exe
  C:\Windows\System\GKRWnAA.exe
  2⤵
  PID:2776
- C:\Windows\System\vvUAaNA.exe
  C:\Windows\System\vvUAaNA.exe
  2⤵
  PID:224
- C:\Windows\System\sKQKduS.exe
  C:\Windows\System\sKQKduS.exe
  2⤵
  PID:2296
- C:\Windows\System\JdFWPyJ.exe
  C:\Windows\System\JdFWPyJ.exe
  2⤵
  PID:2960
- C:\Windows\System\nvFqwdh.exe
  C:\Windows\System\nvFqwdh.exe
  2⤵
  PID:2588
- C:\Windows\System\fAdiRxC.exe
  C:\Windows\System\fAdiRxC.exe
  2⤵
  PID:5056
- C:\Windows\System\vkKvWjP.exe
  C:\Windows\System\vkKvWjP.exe
  2⤵
  PID:2412
- C:\Windows\System\hOAGwDv.exe
  C:\Windows\System\hOAGwDv.exe
  2⤵
  PID:4040
- C:\Windows\System\eKWSWiK.exe
  C:\Windows\System\eKWSWiK.exe
  2⤵
  PID:3656
- C:\Windows\System\DTVzfbu.exe
  C:\Windows\System\DTVzfbu.exe
  2⤵
  PID:3052
- C:\Windows\System\wenVmSM.exe
  C:\Windows\System\wenVmSM.exe
  2⤵
  PID:5152
- C:\Windows\System\GKNtBbR.exe
  C:\Windows\System\GKNtBbR.exe
  2⤵
  PID:5168
- C:\Windows\System\KScRFrv.exe
  C:\Windows\System\KScRFrv.exe
  2⤵
  PID:5200
- C:\Windows\System\XzUEjrn.exe
  C:\Windows\System\XzUEjrn.exe
  2⤵
  PID:5216
- C:\Windows\System\oZixNud.exe
  C:\Windows\System\oZixNud.exe
  2⤵
  PID:5236
- C:\Windows\System\NpxqVOU.exe
  C:\Windows\System\NpxqVOU.exe
  2⤵
  PID:5272
- C:\Windows\System\QEVWdTA.exe
  C:\Windows\System\QEVWdTA.exe
  2⤵
  PID:5292
- C:\Windows\System\POvpBNI.exe
  C:\Windows\System\POvpBNI.exe
  2⤵
  PID:5308
- C:\Windows\System\uQwVnsZ.exe
  C:\Windows\System\uQwVnsZ.exe
  2⤵
  PID:5324
- C:\Windows\System\MUVPcrE.exe
  C:\Windows\System\MUVPcrE.exe
  2⤵
  PID:5348
- C:\Windows\System\KfqGSka.exe
  C:\Windows\System\KfqGSka.exe
  2⤵
  PID:5380
- C:\Windows\System\BqIwTPW.exe
  C:\Windows\System\BqIwTPW.exe
  2⤵
  PID:5404
- C:\Windows\System\qZHZYCP.exe
  C:\Windows\System\qZHZYCP.exe
  2⤵
  PID:5420
- C:\Windows\System\VKUjxVD.exe
  C:\Windows\System\VKUjxVD.exe
  2⤵
  PID:5444
- C:\Windows\System\iCMjJMX.exe
  C:\Windows\System\iCMjJMX.exe
  2⤵
  PID:5472
- C:\Windows\System\HgNSHxM.exe
  C:\Windows\System\HgNSHxM.exe
  2⤵
  PID:5488
- C:\Windows\System\UuSOBhB.exe
  C:\Windows\System\UuSOBhB.exe
  2⤵
  PID:5508
- C:\Windows\System\xrnprfL.exe
  C:\Windows\System\xrnprfL.exe
  2⤵
  PID:5548
- C:\Windows\System\TnBDTum.exe
  C:\Windows\System\TnBDTum.exe
  2⤵
  PID:5564
- C:\Windows\System\JRVJnso.exe
  C:\Windows\System\JRVJnso.exe
  2⤵
  PID:5592
- C:\Windows\System\WgQbiGq.exe
  C:\Windows\System\WgQbiGq.exe
  2⤵
  PID:5608
- C:\Windows\System\wPsWGxq.exe
  C:\Windows\System\wPsWGxq.exe
  2⤵
  PID:5624
- C:\Windows\System\LfjnsJC.exe
  C:\Windows\System\LfjnsJC.exe
  2⤵
  PID:5648
- C:\Windows\System\YjFTSFe.exe
  C:\Windows\System\YjFTSFe.exe
  2⤵
  PID:5664
- C:\Windows\System\gqhKQWl.exe
  C:\Windows\System\gqhKQWl.exe
  2⤵
  PID:5684
- C:\Windows\System\fTGPrNZ.exe
  C:\Windows\System\fTGPrNZ.exe
  2⤵
  PID:5736
- C:\Windows\System\imbSCoT.exe
  C:\Windows\System\imbSCoT.exe
  2⤵
  PID:5768
- C:\Windows\System\jWMpktj.exe
  C:\Windows\System\jWMpktj.exe
  2⤵
  PID:5788
- C:\Windows\System\NMqARTe.exe
  C:\Windows\System\NMqARTe.exe
  2⤵
  PID:5828
- C:\Windows\System\GtGCNFc.exe
  C:\Windows\System\GtGCNFc.exe
  2⤵
  PID:5848
- C:\Windows\System\rlRYJaV.exe
  C:\Windows\System\rlRYJaV.exe
  2⤵
  PID:5868
- C:\Windows\System\JTSydXt.exe
  C:\Windows\System\JTSydXt.exe
  2⤵
  PID:5952
- C:\Windows\System\uCjfXKB.exe
  C:\Windows\System\uCjfXKB.exe
  2⤵
  PID:5972
- C:\Windows\System\SwNBSbe.exe
  C:\Windows\System\SwNBSbe.exe
  2⤵
  PID:5988
- C:\Windows\System\fIdahtY.exe
  C:\Windows\System\fIdahtY.exe
  2⤵
  PID:6016
- C:\Windows\System\wmJMFWd.exe
  C:\Windows\System\wmJMFWd.exe
  2⤵
  PID:6036
- C:\Windows\System\PJoBIcD.exe
  C:\Windows\System\PJoBIcD.exe
  2⤵
  PID:6056
- C:\Windows\System\dBmtpSO.exe
  C:\Windows\System\dBmtpSO.exe
  2⤵
  PID:6076
- C:\Windows\System\lJMACUK.exe
  C:\Windows\System\lJMACUK.exe
  2⤵
  PID:6100
- C:\Windows\System\kqHZBRY.exe
  C:\Windows\System\kqHZBRY.exe
  2⤵
  PID:6128
- C:\Windows\System\URCDYJK.exe
  C:\Windows\System\URCDYJK.exe
  2⤵
  PID:1584
- C:\Windows\System\TsxpFoE.exe
  C:\Windows\System\TsxpFoE.exe
  2⤵
  PID:4280
- C:\Windows\System\XKVnFuv.exe
  C:\Windows\System\XKVnFuv.exe
  2⤵
  PID:1560
- C:\Windows\System\FVcEqOy.exe
  C:\Windows\System\FVcEqOy.exe
  2⤵
  PID:3272
- C:\Windows\System\TeWfWGs.exe
  C:\Windows\System\TeWfWGs.exe
  2⤵
  PID:4784
- C:\Windows\System\vApQDTy.exe
  C:\Windows\System\vApQDTy.exe
  2⤵
  PID:3504
- C:\Windows\System\fxYrQTC.exe
  C:\Windows\System\fxYrQTC.exe
  2⤵
  PID:2912
- C:\Windows\System\OOiINPF.exe
  C:\Windows\System\OOiINPF.exe
  2⤵
  PID:5212
- C:\Windows\System\SRifaTQ.exe
  C:\Windows\System\SRifaTQ.exe
  2⤵
  PID:928
- C:\Windows\System\OsRkRSw.exe
  C:\Windows\System\OsRkRSw.exe
  2⤵
  PID:2780
- C:\Windows\System\AmpcvPx.exe
  C:\Windows\System\AmpcvPx.exe
  2⤵
  PID:5180
- C:\Windows\System\MGCZsXw.exe
  C:\Windows\System\MGCZsXw.exe
  2⤵
  PID:1624
- C:\Windows\System\eJwcxwP.exe
  C:\Windows\System\eJwcxwP.exe
  2⤵
  PID:4348
- C:\Windows\System\pzCygoX.exe
  C:\Windows\System\pzCygoX.exe
  2⤵
  PID:3104
- C:\Windows\System\JSAlCWd.exe
  C:\Windows\System\JSAlCWd.exe
  2⤵
  PID:5164
- C:\Windows\System\GTdtklp.exe
  C:\Windows\System\GTdtklp.exe
  2⤵
  PID:5208
- C:\Windows\System\yLjGthX.exe
  C:\Windows\System\yLjGthX.exe
  2⤵
  PID:5364
- C:\Windows\System\plkRRqY.exe
  C:\Windows\System\plkRRqY.exe
  2⤵
  PID:5416
- C:\Windows\System\JNlYwlE.exe
  C:\Windows\System\JNlYwlE.exe
  2⤵
  PID:5452
- C:\Windows\System\TGaZRVM.exe
  C:\Windows\System\TGaZRVM.exe
  2⤵
  PID:5504
- C:\Windows\System\jlYmRql.exe
  C:\Windows\System\jlYmRql.exe
  2⤵
  PID:5560
- C:\Windows\System\LaKAXdR.exe
  C:\Windows\System\LaKAXdR.exe
  2⤵
  PID:6148
- C:\Windows\System\kLkNyRc.exe
  C:\Windows\System\kLkNyRc.exe
  2⤵
  PID:6168
- C:\Windows\System\RMgolHb.exe
  C:\Windows\System\RMgolHb.exe
  2⤵
  PID:6192
- C:\Windows\System\nLNTIhm.exe
  C:\Windows\System\nLNTIhm.exe
  2⤵
  PID:6356
- C:\Windows\System\ffkCPfy.exe
  C:\Windows\System\ffkCPfy.exe
  2⤵
  PID:6372
- C:\Windows\System\sjmWmqi.exe
  C:\Windows\System\sjmWmqi.exe
  2⤵
  PID:6388
- C:\Windows\System\CVEdVbp.exe
  C:\Windows\System\CVEdVbp.exe
  2⤵
  PID:6408
- C:\Windows\System\RFRgWsq.exe
  C:\Windows\System\RFRgWsq.exe
  2⤵
  PID:6424
- C:\Windows\System\jbMRrap.exe
  C:\Windows\System\jbMRrap.exe
  2⤵
  PID:6444
- C:\Windows\System\hzVgnce.exe
  C:\Windows\System\hzVgnce.exe
  2⤵
  PID:6460
- C:\Windows\System\LRpDyqX.exe
  C:\Windows\System\LRpDyqX.exe
  2⤵
  PID:6476
- C:\Windows\System\dlCTIiW.exe
  C:\Windows\System\dlCTIiW.exe
  2⤵
  PID:6492
- C:\Windows\System\fBnyhLu.exe
  C:\Windows\System\fBnyhLu.exe
  2⤵
  PID:6508
- C:\Windows\System\xPiEzBO.exe
  C:\Windows\System\xPiEzBO.exe
  2⤵
  PID:6524
- C:\Windows\System\HcOaVtJ.exe
  C:\Windows\System\HcOaVtJ.exe
  2⤵
  PID:6540
- C:\Windows\System\JuyfSUb.exe
  C:\Windows\System\JuyfSUb.exe
  2⤵
  PID:6556
- C:\Windows\System\icDWTtb.exe
  C:\Windows\System\icDWTtb.exe
  2⤵
  PID:6572
- C:\Windows\System\XhTkXmb.exe
  C:\Windows\System\XhTkXmb.exe
  2⤵
  PID:6588
- C:\Windows\System\MpiwIkv.exe
  C:\Windows\System\MpiwIkv.exe
  2⤵
  PID:6604
- C:\Windows\System\TDmOmOZ.exe
  C:\Windows\System\TDmOmOZ.exe
  2⤵
  PID:6624
- C:\Windows\System\RIsdkqL.exe
  C:\Windows\System\RIsdkqL.exe
  2⤵
  PID:6640
- C:\Windows\System\LzTIeOH.exe
  C:\Windows\System\LzTIeOH.exe
  2⤵
  PID:6664
- C:\Windows\System\TIqBxXk.exe
  C:\Windows\System\TIqBxXk.exe
  2⤵
  PID:6740
- C:\Windows\System\JEzJdeU.exe
  C:\Windows\System\JEzJdeU.exe
  2⤵
  PID:6756
- C:\Windows\System\GPflCxc.exe
  C:\Windows\System\GPflCxc.exe
  2⤵
  PID:6772
- C:\Windows\System\vwtZClb.exe
  C:\Windows\System\vwtZClb.exe
  2⤵
  PID:6788
- C:\Windows\System\UJCLsJN.exe
  C:\Windows\System\UJCLsJN.exe
  2⤵
  PID:6804
- C:\Windows\System\dShNDIn.exe
  C:\Windows\System\dShNDIn.exe
  2⤵
  PID:6820
- C:\Windows\System\kwFYTLU.exe
  C:\Windows\System\kwFYTLU.exe
  2⤵
  PID:6836
- C:\Windows\System\QFtpvmp.exe
  C:\Windows\System\QFtpvmp.exe
  2⤵
  PID:6852
- C:\Windows\System\AhdHyDB.exe
  C:\Windows\System\AhdHyDB.exe
  2⤵
  PID:6868
- C:\Windows\System\wPBfsKS.exe
  C:\Windows\System\wPBfsKS.exe
  2⤵
  PID:6884
- C:\Windows\System\PnoXnfo.exe
  C:\Windows\System\PnoXnfo.exe
  2⤵
  PID:6900
- C:\Windows\System\MeMvYaF.exe
  C:\Windows\System\MeMvYaF.exe
  2⤵
  PID:6916
- C:\Windows\System\nEWkIZh.exe
  C:\Windows\System\nEWkIZh.exe
  2⤵
  PID:6936
- C:\Windows\System\tcjrqSD.exe
  C:\Windows\System\tcjrqSD.exe
  2⤵
  PID:6968
- C:\Windows\System\OMSmtLe.exe
  C:\Windows\System\OMSmtLe.exe
  2⤵
  PID:6984
- C:\Windows\System\jQflMUV.exe
  C:\Windows\System\jQflMUV.exe
  2⤵
  PID:7012
- C:\Windows\System\iLeJTGK.exe
  C:\Windows\System\iLeJTGK.exe
  2⤵
  PID:7036
- C:\Windows\System\GOnCvEQ.exe
  C:\Windows\System\GOnCvEQ.exe
  2⤵
  PID:7056
- C:\Windows\System\vAXWwfy.exe
  C:\Windows\System\vAXWwfy.exe
  2⤵
  PID:7080
- C:\Windows\System\CaTXSzs.exe
  C:\Windows\System\CaTXSzs.exe
  2⤵
  PID:7096
- C:\Windows\System\ubGSpRs.exe
  C:\Windows\System\ubGSpRs.exe
  2⤵
  PID:7116
- C:\Windows\System\gVBYQOE.exe
  C:\Windows\System\gVBYQOE.exe
  2⤵
  PID:7132
- C:\Windows\System\bPWmwKy.exe
  C:\Windows\System\bPWmwKy.exe
  2⤵
  PID:7156
- C:\Windows\System\ZmHSzMH.exe
  C:\Windows\System\ZmHSzMH.exe
  2⤵
  PID:5632
- C:\Windows\System\oXGLejl.exe
  C:\Windows\System\oXGLejl.exe
  2⤵
  PID:5672
- C:\Windows\System\QKDwkpf.exe
  C:\Windows\System\QKDwkpf.exe
  2⤵
  PID:5744
- C:\Windows\System\FVRuMmf.exe
  C:\Windows\System\FVRuMmf.exe
  2⤵
  PID:5796
- C:\Windows\System\efRBGxE.exe
  C:\Windows\System\efRBGxE.exe
  2⤵
  PID:6028
- C:\Windows\System\LLMHAno.exe
  C:\Windows\System\LLMHAno.exe
  2⤵
  PID:6052
- C:\Windows\System\BLkFUyI.exe
  C:\Windows\System\BLkFUyI.exe
  2⤵
  PID:1912
- C:\Windows\System\sdgYqBi.exe
  C:\Windows\System\sdgYqBi.exe
  2⤵
  PID:3472
- C:\Windows\System\qQoxIfk.exe
  C:\Windows\System\qQoxIfk.exe
  2⤵
  PID:2908
- C:\Windows\System\NgdxVPf.exe
  C:\Windows\System\NgdxVPf.exe
  2⤵
  PID:4788
- C:\Windows\System\ierzhqG.exe
  C:\Windows\System\ierzhqG.exe
  2⤵
  PID:2824
- C:\Windows\System\HbfiFpY.exe
  C:\Windows\System\HbfiFpY.exe
  2⤵
  PID:5576
- C:\Windows\System\uReBiJe.exe
  C:\Windows\System\uReBiJe.exe
  2⤵
  PID:5008
- C:\Windows\System\sFvoMMZ.exe
  C:\Windows\System\sFvoMMZ.exe
  2⤵
  PID:5160
- C:\Windows\System\oCnvvXz.exe
  C:\Windows\System\oCnvvXz.exe
  2⤵
  PID:5300
- C:\Windows\System\fHJweKc.exe
  C:\Windows\System\fHJweKc.exe
  2⤵
  PID:6204
- C:\Windows\System\CRhMyOS.exe
  C:\Windows\System\CRhMyOS.exe
  2⤵
  PID:6352
- C:\Windows\System\mmmhYSy.exe
  C:\Windows\System\mmmhYSy.exe
  2⤵
  PID:5412
- C:\Windows\System\cYNYEyP.exe
  C:\Windows\System\cYNYEyP.exe
  2⤵
  PID:6088
- C:\Windows\System\dzUMTHl.exe
  C:\Windows\System\dzUMTHl.exe
  2⤵
  PID:6368
- C:\Windows\System\ogRLEpj.exe
  C:\Windows\System\ogRLEpj.exe
  2⤵
  PID:6432
- C:\Windows\System\mOWgini.exe
  C:\Windows\System\mOWgini.exe
  2⤵
  PID:6468
- C:\Windows\System\LWIsDnr.exe
  C:\Windows\System\LWIsDnr.exe
  2⤵
  PID:6504
- C:\Windows\System\BTGDKER.exe
  C:\Windows\System\BTGDKER.exe
  2⤵
  PID:7024
- C:\Windows\System\eKUJUBI.exe
  C:\Windows\System\eKUJUBI.exe
  2⤵
  PID:7088
- C:\Windows\System\DOSyvUo.exe
  C:\Windows\System\DOSyvUo.exe
  2⤵
  PID:7148
- C:\Windows\System\FkjMbHo.exe
  C:\Windows\System\FkjMbHo.exe
  2⤵
  PID:7172
- C:\Windows\System\MSfjvxF.exe
  C:\Windows\System\MSfjvxF.exe
  2⤵
  PID:7188
- C:\Windows\System\vSbSstR.exe
  C:\Windows\System\vSbSstR.exe
  2⤵
  PID:7216
- C:\Windows\System\bAoHEuY.exe
  C:\Windows\System\bAoHEuY.exe
  2⤵
  PID:7232
- C:\Windows\System\DkJXvAt.exe
  C:\Windows\System\DkJXvAt.exe
  2⤵
  PID:7248
- C:\Windows\System\YNrlugd.exe
  C:\Windows\System\YNrlugd.exe
  2⤵
  PID:7264
- C:\Windows\System\kPGYqFd.exe
  C:\Windows\System\kPGYqFd.exe
  2⤵
  PID:7292
- C:\Windows\System\HcnTawM.exe
  C:\Windows\System\HcnTawM.exe
  2⤵
  PID:7312
- C:\Windows\System\dSBYMAA.exe
  C:\Windows\System\dSBYMAA.exe
  2⤵
  PID:7336
- C:\Windows\System\OnDWuLt.exe
  C:\Windows\System\OnDWuLt.exe
  2⤵
  PID:7352
- C:\Windows\System\xSyWJNU.exe
  C:\Windows\System\xSyWJNU.exe
  2⤵
  PID:7376
- C:\Windows\System\demtYdB.exe
  C:\Windows\System\demtYdB.exe
  2⤵
  PID:7392
- C:\Windows\System\FRjApqY.exe
  C:\Windows\System\FRjApqY.exe
  2⤵
  PID:7416
- C:\Windows\System\mdsNVXv.exe
  C:\Windows\System\mdsNVXv.exe
  2⤵
  PID:7440
- C:\Windows\System\vdinatX.exe
  C:\Windows\System\vdinatX.exe
  2⤵
  PID:7460
- C:\Windows\System\aOqZqzx.exe
  C:\Windows\System\aOqZqzx.exe
  2⤵
  PID:7484
- C:\Windows\System\OaSuTHv.exe
  C:\Windows\System\OaSuTHv.exe
  2⤵
  PID:7504
- C:\Windows\System\pLiagsc.exe
  C:\Windows\System\pLiagsc.exe
  2⤵
  PID:7528
- C:\Windows\System\opSinOp.exe
  C:\Windows\System\opSinOp.exe
  2⤵
  PID:7552
- C:\Windows\System\cZIlTgC.exe
  C:\Windows\System\cZIlTgC.exe
  2⤵
  PID:7568
- C:\Windows\System\NDpFYyX.exe
  C:\Windows\System\NDpFYyX.exe
  2⤵
  PID:7592
- C:\Windows\System\yBtZxrg.exe
  C:\Windows\System\yBtZxrg.exe
  2⤵
  PID:7612
- C:\Windows\System\ZJEiZMH.exe
  C:\Windows\System\ZJEiZMH.exe
  2⤵
  PID:7636
- C:\Windows\System\ULMgvLk.exe
  C:\Windows\System\ULMgvLk.exe
  2⤵
  PID:7656
- C:\Windows\System\UGHibXX.exe
  C:\Windows\System\UGHibXX.exe
  2⤵
  PID:7672
- C:\Windows\System\nLjbvcB.exe
  C:\Windows\System\nLjbvcB.exe
  2⤵
  PID:7696
- C:\Windows\System\aWKxTmO.exe
  C:\Windows\System\aWKxTmO.exe
  2⤵
  PID:7720
- C:\Windows\System\cbXIByw.exe
  C:\Windows\System\cbXIByw.exe
  2⤵
  PID:7736
- C:\Windows\System\MEEdqyu.exe
  C:\Windows\System\MEEdqyu.exe
  2⤵
  PID:7760
- C:\Windows\System\zvBvbhn.exe
  C:\Windows\System\zvBvbhn.exe
  2⤵
  PID:7784
- C:\Windows\System\KatDpyU.exe
  C:\Windows\System\KatDpyU.exe
  2⤵
  PID:7808
- C:\Windows\System\OoSalHD.exe
  C:\Windows\System\OoSalHD.exe
  2⤵
  PID:7904
- C:\Windows\System\iPkAJZu.exe
  C:\Windows\System\iPkAJZu.exe
  2⤵
  PID:7920
- C:\Windows\System\QjoNNkx.exe
  C:\Windows\System\QjoNNkx.exe
  2⤵
  PID:7940
- C:\Windows\System\BjdXpmD.exe
  C:\Windows\System\BjdXpmD.exe
  2⤵
  PID:7960
- C:\Windows\System\QBEJehn.exe
  C:\Windows\System\QBEJehn.exe
  2⤵
  PID:7988
- C:\Windows\System\wKsjZrU.exe
  C:\Windows\System\wKsjZrU.exe
  2⤵
  PID:8008
- C:\Windows\System\lpajylJ.exe
  C:\Windows\System\lpajylJ.exe
  2⤵
  PID:8032
- C:\Windows\System\cTWrLuB.exe
  C:\Windows\System\cTWrLuB.exe
  2⤵
  PID:8052
- C:\Windows\System\YxGytRR.exe
  C:\Windows\System\YxGytRR.exe
  2⤵
  PID:8144
- C:\Windows\System\HGzOaRS.exe
  C:\Windows\System\HGzOaRS.exe
  2⤵
  PID:8164
- C:\Windows\System\rrxqJkP.exe
  C:\Windows\System\rrxqJkP.exe
  2⤵
  PID:8184
- C:\Windows\System\DPlXcNc.exe
  C:\Windows\System\DPlXcNc.exe
  2⤵
  PID:6552
- C:\Windows\System\nlwNEKV.exe
  C:\Windows\System\nlwNEKV.exe
  2⤵
  PID:6596
- C:\Windows\System\btTlUfe.exe
  C:\Windows\System\btTlUfe.exe
  2⤵
  PID:6632
- C:\Windows\System\spNwbiZ.exe
  C:\Windows\System\spNwbiZ.exe
  2⤵
  PID:6728
- C:\Windows\System\vwjvryN.exe
  C:\Windows\System\vwjvryN.exe
  2⤵
  PID:5604
- C:\Windows\System\XWummYi.exe
  C:\Windows\System\XWummYi.exe
  2⤵
  PID:5692
- C:\Windows\System\XucyamF.exe
  C:\Windows\System\XucyamF.exe
  2⤵
  PID:6488
- C:\Windows\System\hcNJLCU.exe
  C:\Windows\System\hcNJLCU.exe
  2⤵
  PID:7072
- C:\Windows\System\YHedUhc.exe
  C:\Windows\System\YHedUhc.exe
  2⤵
  PID:5784
- C:\Windows\System\pbdGubv.exe
  C:\Windows\System\pbdGubv.exe
  2⤵
  PID:6736
- C:\Windows\System\upXDLNh.exe
  C:\Windows\System\upXDLNh.exe
  2⤵
  PID:7768
- C:\Windows\System\WNtzeYY.exe
  C:\Windows\System\WNtzeYY.exe
  2⤵
  PID:8200
- C:\Windows\System\wRNzZxP.exe
  C:\Windows\System\wRNzZxP.exe
  2⤵
  PID:8220
- C:\Windows\System\malQbBp.exe
  C:\Windows\System\malQbBp.exe
  2⤵
  PID:8244
- C:\Windows\System\EOcHqnX.exe
  C:\Windows\System\EOcHqnX.exe
  2⤵
  PID:8264
- C:\Windows\System\nRPWufk.exe
  C:\Windows\System\nRPWufk.exe
  2⤵
  PID:8284
- C:\Windows\System\mIsSvab.exe
  C:\Windows\System\mIsSvab.exe
  2⤵
  PID:8308
- C:\Windows\System\MeGBPZI.exe
  C:\Windows\System\MeGBPZI.exe
  2⤵
  PID:8328
- C:\Windows\System\iePctEu.exe
  C:\Windows\System\iePctEu.exe
  2⤵
  PID:8348
- C:\Windows\System\FdHoXCo.exe
  C:\Windows\System\FdHoXCo.exe
  2⤵
  PID:8372
- C:\Windows\System\TauOjzN.exe
  C:\Windows\System\TauOjzN.exe
  2⤵
  PID:8388
- C:\Windows\System\huynNaX.exe
  C:\Windows\System\huynNaX.exe
  2⤵
  PID:8412
- C:\Windows\System\RaTTbDf.exe
  C:\Windows\System\RaTTbDf.exe
  2⤵
  PID:8428
- C:\Windows\System\FjbDJUj.exe
  C:\Windows\System\FjbDJUj.exe
  2⤵
  PID:8532
- C:\Windows\System\WIQkYPc.exe
  C:\Windows\System\WIQkYPc.exe
  2⤵
  PID:8552
- C:\Windows\System\zpflAuw.exe
  C:\Windows\System\zpflAuw.exe
  2⤵
  PID:8576
- C:\Windows\System\MQwxvwP.exe
  C:\Windows\System\MQwxvwP.exe
  2⤵
  PID:8596
- C:\Windows\System\bVuoKyw.exe
  C:\Windows\System\bVuoKyw.exe
  2⤵
  PID:8616
- C:\Windows\System\SJXmfke.exe
  C:\Windows\System\SJXmfke.exe
  2⤵
  PID:8640
- C:\Windows\System\ITqhTpg.exe
  C:\Windows\System\ITqhTpg.exe
  2⤵
  PID:8656
- C:\Windows\System\mdKehkV.exe
  C:\Windows\System\mdKehkV.exe
  2⤵
  PID:8672
- C:\Windows\System\yYnZaBq.exe
  C:\Windows\System\yYnZaBq.exe
  2⤵
  PID:8688
- C:\Windows\System\JjLrLZu.exe
  C:\Windows\System\JjLrLZu.exe
  2⤵
  PID:8704
- C:\Windows\System\NxcodVB.exe
  C:\Windows\System\NxcodVB.exe
  2⤵
  PID:8720
- C:\Windows\System\bEElRhy.exe
  C:\Windows\System\bEElRhy.exe
  2⤵
  PID:8736
- C:\Windows\System\gpKiiog.exe
  C:\Windows\System\gpKiiog.exe
  2⤵
  PID:8752
- C:\Windows\System\jradUgq.exe
  C:\Windows\System\jradUgq.exe
  2⤵
  PID:8776
- C:\Windows\System\vbMCLgK.exe
  C:\Windows\System\vbMCLgK.exe
  2⤵
  PID:8792
- C:\Windows\System\EczHdOT.exe
  C:\Windows\System\EczHdOT.exe
  2⤵
  PID:8808
- C:\Windows\System\GxmKLnf.exe
  C:\Windows\System\GxmKLnf.exe
  2⤵
  PID:8832
- C:\Windows\System\vNuYXFg.exe
  C:\Windows\System\vNuYXFg.exe
  2⤵
  PID:8848
- C:\Windows\System\TymWnet.exe
  C:\Windows\System\TymWnet.exe
  2⤵
  PID:8876
- C:\Windows\System\oBJInXz.exe
  C:\Windows\System\oBJInXz.exe
  2⤵
  PID:8900
- C:\Windows\System\qEBmwjU.exe
  C:\Windows\System\qEBmwjU.exe
  2⤵
  PID:8920
- C:\Windows\System\yKHqVNn.exe
  C:\Windows\System\yKHqVNn.exe
  2⤵
  PID:8948
- C:\Windows\System\oAuyAIL.exe
  C:\Windows\System\oAuyAIL.exe
  2⤵
  PID:8968
- C:\Windows\System\DAUkdcd.exe
  C:\Windows\System\DAUkdcd.exe
  2⤵
  PID:8988
- C:\Windows\System\mbiMMpS.exe
  C:\Windows\System\mbiMMpS.exe
  2⤵
  PID:9012
- C:\Windows\System\LlDExwg.exe
  C:\Windows\System\LlDExwg.exe
  2⤵
  PID:9048
- C:\Windows\System\BflyEaN.exe
  C:\Windows\System\BflyEaN.exe
  2⤵
  PID:9072
- C:\Windows\System\DUxJQRh.exe
  C:\Windows\System\DUxJQRh.exe
  2⤵
  PID:9096
- C:\Windows\System\aKTZwYc.exe
  C:\Windows\System\aKTZwYc.exe
  2⤵
  PID:9116
- C:\Windows\System\qQYXfIn.exe
  C:\Windows\System\qQYXfIn.exe
  2⤵
  PID:9136
- C:\Windows\System\TswDzyM.exe
  C:\Windows\System\TswDzyM.exe
  2⤵
  PID:9156
- C:\Windows\System\zqgdjER.exe
  C:\Windows\System\zqgdjER.exe
  2⤵
  PID:9172
- C:\Windows\System\JhreQoz.exe
  C:\Windows\System\JhreQoz.exe
  2⤵
  PID:9188
- C:\Windows\System\yeljPHX.exe
  C:\Windows\System\yeljPHX.exe
  2⤵
  PID:9204
- C:\Windows\System\tUkGlIg.exe
  C:\Windows\System\tUkGlIg.exe
  2⤵
  PID:7816
- C:\Windows\System\LkzAYPb.exe
  C:\Windows\System\LkzAYPb.exe
  2⤵
  PID:6784
- C:\Windows\System\YGooVqV.exe
  C:\Windows\System\YGooVqV.exe
  2⤵
  PID:6832
- C:\Windows\System\uyNKQGS.exe
  C:\Windows\System\uyNKQGS.exe
  2⤵
  PID:6864
- C:\Windows\System\WixCoEa.exe
  C:\Windows\System\WixCoEa.exe
  2⤵
  PID:6912
- C:\Windows\System\XZpozyV.exe
  C:\Windows\System\XZpozyV.exe
  2⤵
  PID:6956
- C:\Windows\System\xWVohxh.exe
  C:\Windows\System\xWVohxh.exe
  2⤵
  PID:7092
- C:\Windows\System\iwrohOI.exe
  C:\Windows\System\iwrohOI.exe
  2⤵
  PID:6532
- C:\Windows\System\PBwJaDZ.exe
  C:\Windows\System\PBwJaDZ.exe
  2⤵
  PID:5880
- C:\Windows\System\AtruVHI.exe
  C:\Windows\System\AtruVHI.exe
  2⤵
  PID:6568
- C:\Windows\System\qscNbkF.exe
  C:\Windows\System\qscNbkF.exe
  2⤵
  PID:7712
- C:\Windows\System\lRrMMEl.exe
  C:\Windows\System\lRrMMEl.exe
  2⤵
  PID:5804
- C:\Windows\System\iaxWDtG.exe
  C:\Windows\System\iaxWDtG.exe
  2⤵
  PID:8216
- C:\Windows\System\GFJmxvh.exe
  C:\Windows\System\GFJmxvh.exe
  2⤵
  PID:8252
- C:\Windows\System\vLntzqS.exe
  C:\Windows\System\vLntzqS.exe
  2⤵
  PID:8304
- C:\Windows\System\TpdpDej.exe
  C:\Windows\System\TpdpDej.exe
  2⤵
  PID:8368
- C:\Windows\System\vrzFBUw.exe
  C:\Windows\System\vrzFBUw.exe
  2⤵
  PID:9256
- C:\Windows\System\jKsFkBa.exe
  C:\Windows\System\jKsFkBa.exe
  2⤵
  PID:9280
- C:\Windows\System\LycSivx.exe
  C:\Windows\System\LycSivx.exe
  2⤵
  PID:9300
- C:\Windows\System\xrTTNPG.exe
  C:\Windows\System\xrTTNPG.exe
  2⤵
  PID:9328
- C:\Windows\System\fRScOUh.exe
  C:\Windows\System\fRScOUh.exe
  2⤵
  PID:9344
- C:\Windows\System\ZIWismW.exe
  C:\Windows\System\ZIWismW.exe
  2⤵
  PID:9364
- C:\Windows\System\IFPDdHK.exe
  C:\Windows\System\IFPDdHK.exe
  2⤵
  PID:9392
- C:\Windows\System\JeeJBEb.exe
  C:\Windows\System\JeeJBEb.exe
  2⤵
  PID:9412
- C:\Windows\System\hWuQCnU.exe
  C:\Windows\System\hWuQCnU.exe
  2⤵
  PID:9428
- C:\Windows\System\cXTJHAc.exe
  C:\Windows\System\cXTJHAc.exe
  2⤵
  PID:9444
- C:\Windows\System\vHyhtxs.exe
  C:\Windows\System\vHyhtxs.exe
  2⤵
  PID:9480
- C:\Windows\System\RntNIAB.exe
  C:\Windows\System\RntNIAB.exe
  2⤵
  PID:9504
- C:\Windows\System\eBSpDVb.exe
  C:\Windows\System\eBSpDVb.exe
  2⤵
  PID:9528
- C:\Windows\System\MbKDPou.exe
  C:\Windows\System\MbKDPou.exe
  2⤵
  PID:9544
- C:\Windows\System\CRbNkhI.exe
  C:\Windows\System\CRbNkhI.exe
  2⤵
  PID:9568
- C:\Windows\System\bdoyRHc.exe
  C:\Windows\System\bdoyRHc.exe
  2⤵
  PID:9592
- C:\Windows\System\ybDoeUr.exe
  C:\Windows\System\ybDoeUr.exe
  2⤵
  PID:9608
- C:\Windows\System\ZsphBTr.exe
  C:\Windows\System\ZsphBTr.exe
  2⤵
  PID:9632
- C:\Windows\System\XIvvKlI.exe
  C:\Windows\System\XIvvKlI.exe
  2⤵
  PID:9652
- C:\Windows\System\IcMCBii.exe
  C:\Windows\System\IcMCBii.exe
  2⤵
  PID:9672
- C:\Windows\System\DSQeoeV.exe
  C:\Windows\System\DSQeoeV.exe
  2⤵
  PID:9696
- C:\Windows\System\SkxYiqj.exe
  C:\Windows\System\SkxYiqj.exe
  2⤵
  PID:9716
- C:\Windows\System\dxYmJNt.exe
  C:\Windows\System\dxYmJNt.exe
  2⤵
  PID:9740
- C:\Windows\System\beiBITk.exe
  C:\Windows\System\beiBITk.exe
  2⤵
  PID:9772
- C:\Windows\System\dpiJoZx.exe
  C:\Windows\System\dpiJoZx.exe
  2⤵
  PID:9792
- C:\Windows\System\IkmUYjD.exe
  C:\Windows\System\IkmUYjD.exe
  2⤵
  PID:9812
- C:\Windows\System\sHrmuDW.exe
  C:\Windows\System\sHrmuDW.exe
  2⤵
  PID:9840
- C:\Windows\System\eaCMIyL.exe
  C:\Windows\System\eaCMIyL.exe
  2⤵
  PID:9856
- C:\Windows\System\NTtyHrY.exe
  C:\Windows\System\NTtyHrY.exe
  2⤵
  PID:9876
- C:\Windows\System\cxGxftr.exe
  C:\Windows\System\cxGxftr.exe
  2⤵
  PID:9904
- C:\Windows\System\scrXAYk.exe
  C:\Windows\System\scrXAYk.exe
  2⤵
  PID:9928
- C:\Windows\System\YTUKbpD.exe
  C:\Windows\System\YTUKbpD.exe
  2⤵
  PID:9952
- C:\Windows\System\rFFkFjT.exe
  C:\Windows\System\rFFkFjT.exe
  2⤵
  PID:9968
- C:\Windows\System\HcfhvPp.exe
  C:\Windows\System\HcfhvPp.exe
  2⤵
  PID:9988
- C:\Windows\System\syTbaYl.exe
  C:\Windows\System\syTbaYl.exe
  2⤵
  PID:10012
- C:\Windows\System\zgWEelm.exe
  C:\Windows\System\zgWEelm.exe
  2⤵
  PID:10036
- C:\Windows\System\DQbbRtX.exe
  C:\Windows\System\DQbbRtX.exe
  2⤵
  PID:10056
- C:\Windows\System\GVDjTbX.exe
  C:\Windows\System\GVDjTbX.exe
  2⤵
  PID:10080
- C:\Windows\System\qhSkOUh.exe
  C:\Windows\System\qhSkOUh.exe
  2⤵
  PID:10108
- C:\Windows\System\dMObLGz.exe
  C:\Windows\System\dMObLGz.exe
  2⤵
  PID:10128
- C:\Windows\System\WsbjYVJ.exe
  C:\Windows\System\WsbjYVJ.exe
  2⤵
  PID:10156
- C:\Windows\System\JFvTLzu.exe
  C:\Windows\System\JFvTLzu.exe
  2⤵
  PID:10172
- C:\Windows\System\zjweVbu.exe
  C:\Windows\System\zjweVbu.exe
  2⤵
  PID:10188
- C:\Windows\System\dsjRrsH.exe
  C:\Windows\System\dsjRrsH.exe
  2⤵
  PID:10204
- C:\Windows\System\OroMsKv.exe
  C:\Windows\System\OroMsKv.exe
  2⤵
  PID:10220
- C:\Windows\System\LZuDVgZ.exe
  C:\Windows\System\LZuDVgZ.exe
  2⤵
  PID:6096
- C:\Windows\System\JXBBYDj.exe
  C:\Windows\System\JXBBYDj.exe
  2⤵
  PID:4308
- C:\Windows\System\kJoPZpn.exe
  C:\Windows\System\kJoPZpn.exe
  2⤵
  PID:4024
- C:\Windows\System\WFkZeSc.exe
  C:\Windows\System\WFkZeSc.exe
  2⤵
  PID:2364
- C:\Windows\System\uIoThOt.exe
  C:\Windows\System\uIoThOt.exe
  2⤵
  PID:2848
- C:\Windows\System\liRFHEd.exe
  C:\Windows\System\liRFHEd.exe
  2⤵
  PID:5460
- C:\Windows\System\jVtnjSd.exe
  C:\Windows\System\jVtnjSd.exe
  2⤵
  PID:7368
- C:\Windows\System\eiuaSsT.exe
  C:\Windows\System\eiuaSsT.exe
  2⤵
  PID:7408
- C:\Windows\System\KGSSfMS.exe
  C:\Windows\System\KGSSfMS.exe
  2⤵
  PID:7432
- C:\Windows\System\ueCsyNq.exe
  C:\Windows\System\ueCsyNq.exe
  2⤵
  PID:7476
- C:\Windows\System\bnsaugI.exe
  C:\Windows\System\bnsaugI.exe
  2⤵
  PID:7524
- C:\Windows\System\XxYjtcA.exe
  C:\Windows\System\XxYjtcA.exe
  2⤵
  PID:7560
- C:\Windows\System\eyfWsfD.exe
  C:\Windows\System\eyfWsfD.exe
  2⤵
  PID:7600
- C:\Windows\System\tSXZPvh.exe
  C:\Windows\System\tSXZPvh.exe
  2⤵
  PID:4928
- C:\Windows\System\WnESjWj.exe
  C:\Windows\System\WnESjWj.exe
  2⤵
  PID:7680
- C:\Windows\System\niMmrku.exe
  C:\Windows\System\niMmrku.exe
  2⤵
  PID:8768
- C:\Windows\System\jwUtJNK.exe
  C:\Windows\System\jwUtJNK.exe
  2⤵
  PID:8868
- C:\Windows\System\tmWAdZL.exe
  C:\Windows\System\tmWAdZL.exe
  2⤵
  PID:8964
- C:\Windows\System\xNGxNFD.exe
  C:\Windows\System\xNGxNFD.exe
  2⤵
  PID:9040
- C:\Windows\System\TEDvORM.exe
  C:\Windows\System\TEDvORM.exe
  2⤵
  PID:9108
- C:\Windows\System\YXuEfZF.exe
  C:\Windows\System\YXuEfZF.exe
  2⤵
  PID:6860
- C:\Windows\System\NKWhyby.exe
  C:\Windows\System\NKWhyby.exe
  2⤵
  PID:9180
- C:\Windows\System\lexyUhZ.exe
  C:\Windows\System\lexyUhZ.exe
  2⤵
  PID:7020
- C:\Windows\System\PWGYQgt.exe
  C:\Windows\System\PWGYQgt.exe
  2⤵
  PID:7912
- C:\Windows\System\jAmpKVT.exe
  C:\Windows\System\jAmpKVT.exe
  2⤵
  PID:7956
- C:\Windows\System\ilbeTen.exe
  C:\Windows\System\ilbeTen.exe
  2⤵
  PID:8024
- C:\Windows\System\ycjfPbU.exe
  C:\Windows\System\ycjfPbU.exe
  2⤵
  PID:9372
- C:\Windows\System\BMGyTQD.exe
  C:\Windows\System\BMGyTQD.exe
  2⤵
  PID:8060
- C:\Windows\System\GJDsscs.exe
  C:\Windows\System\GJDsscs.exe
  2⤵
  PID:8080
- C:\Windows\System\vJQvyeI.exe
  C:\Windows\System\vJQvyeI.exe
  2⤵
  PID:9536
- C:\Windows\System\JOZqLIn.exe
  C:\Windows\System\JOZqLIn.exe
  2⤵
  PID:9576
- C:\Windows\System\rMYqMpP.exe
  C:\Windows\System\rMYqMpP.exe
  2⤵
  PID:9648
- C:\Windows\System\ookqiSC.exe
  C:\Windows\System\ookqiSC.exe
  2⤵
  PID:10256
- C:\Windows\System\yLBtRSj.exe
  C:\Windows\System\yLBtRSj.exe
  2⤵
  PID:10280
- C:\Windows\System\OdKohrc.exe
  C:\Windows\System\OdKohrc.exe
  2⤵
  PID:10308
- C:\Windows\System\ZWXyVdc.exe
  C:\Windows\System\ZWXyVdc.exe
  2⤵
  PID:10328
- C:\Windows\System\yatXsuq.exe
  C:\Windows\System\yatXsuq.exe
  2⤵
  PID:10348
- C:\Windows\System\dpDSWSB.exe
  C:\Windows\System\dpDSWSB.exe
  2⤵
  PID:10372
- C:\Windows\System\ZZacgnx.exe
  C:\Windows\System\ZZacgnx.exe
  2⤵
  PID:10396
- C:\Windows\System\sntoEFz.exe
  C:\Windows\System\sntoEFz.exe
  2⤵
  PID:10420
- C:\Windows\System\HlDubMy.exe
  C:\Windows\System\HlDubMy.exe
  2⤵
  PID:10440
- C:\Windows\System\kcJqZBb.exe
  C:\Windows\System\kcJqZBb.exe
  2⤵
  PID:10464
- C:\Windows\System\WFQrYVX.exe
  C:\Windows\System\WFQrYVX.exe
  2⤵
  PID:10484
- C:\Windows\System\RhFgAjm.exe
  C:\Windows\System\RhFgAjm.exe
  2⤵
  PID:10508
- C:\Windows\System\haNdzMO.exe
  C:\Windows\System\haNdzMO.exe
  2⤵
  PID:10532
- C:\Windows\System\iFjzOGd.exe
  C:\Windows\System\iFjzOGd.exe
  2⤵
  PID:10548
- C:\Windows\System\YTzKpbv.exe
  C:\Windows\System\YTzKpbv.exe
  2⤵
  PID:10568
- C:\Windows\System\VvFjPaX.exe
  C:\Windows\System\VvFjPaX.exe
  2⤵
  PID:10588
- C:\Windows\System\WFNTYiA.exe
  C:\Windows\System\WFNTYiA.exe
  2⤵
  PID:10604
- C:\Windows\System\FckDOEM.exe
  C:\Windows\System\FckDOEM.exe
  2⤵
  PID:10624
- C:\Windows\System\exUBTWj.exe
  C:\Windows\System\exUBTWj.exe
  2⤵
  PID:10644
- C:\Windows\System\tsFdNjA.exe
  C:\Windows\System\tsFdNjA.exe
  2⤵
  PID:10664
- C:\Windows\System\yQxEtvC.exe
  C:\Windows\System\yQxEtvC.exe
  2⤵
  PID:10684
- C:\Windows\System\DcUwPTv.exe
  C:\Windows\System\DcUwPTv.exe
  2⤵
  PID:10704
- C:\Windows\System\LMCrWgL.exe
  C:\Windows\System\LMCrWgL.exe
  2⤵
  PID:10728
- C:\Windows\System\TXOZJUY.exe
  C:\Windows\System\TXOZJUY.exe
  2⤵
  PID:10744
- C:\Windows\System\cNlulfa.exe
  C:\Windows\System\cNlulfa.exe
  2⤵
  PID:10772
- C:\Windows\System\EcDVLLT.exe
  C:\Windows\System\EcDVLLT.exe
  2⤵
  PID:10796
- C:\Windows\System\BNQeBeO.exe
  C:\Windows\System\BNQeBeO.exe
  2⤵
  PID:10812
- C:\Windows\System\LiCppvD.exe
  C:\Windows\System\LiCppvD.exe
  2⤵
  PID:10840
- C:\Windows\System\DoeYFHm.exe
  C:\Windows\System\DoeYFHm.exe
  2⤵
  PID:10860
- C:\Windows\System\JYDAKER.exe
  C:\Windows\System\JYDAKER.exe
  2⤵
  PID:10880
- C:\Windows\System\bxbCVor.exe
  C:\Windows\System\bxbCVor.exe
  2⤵
  PID:10904
- C:\Windows\System\GpwyJnx.exe
  C:\Windows\System\GpwyJnx.exe
  2⤵
  PID:10928
- C:\Windows\System\DHLxusd.exe
  C:\Windows\System\DHLxusd.exe
  2⤵
  PID:10948
- C:\Windows\System\haFStlu.exe
  C:\Windows\System\haFStlu.exe
  2⤵
  PID:10964
- C:\Windows\System\zadILlE.exe
  C:\Windows\System\zadILlE.exe
  2⤵
  PID:10988
- C:\Windows\System\fyVeILr.exe
  C:\Windows\System\fyVeILr.exe
  2⤵
  PID:11008
- C:\Windows\System\VAZJrAR.exe
  C:\Windows\System\VAZJrAR.exe
  2⤵
  PID:11024
- C:\Windows\System\EBcLgzy.exe
  C:\Windows\System\EBcLgzy.exe
  2⤵
  PID:11048
- C:\Windows\System\lelSQVD.exe
  C:\Windows\System\lelSQVD.exe
  2⤵
  PID:11068
- C:\Windows\System\chSZsNR.exe
  C:\Windows\System\chSZsNR.exe
  2⤵
  PID:11092
- C:\Windows\System\hbxEMrP.exe
  C:\Windows\System\hbxEMrP.exe
  2⤵
  PID:11112
- C:\Windows\System\PPceZBl.exe
  C:\Windows\System\PPceZBl.exe
  2⤵
  PID:11132
- C:\Windows\System\tpnAWXx.exe
  C:\Windows\System\tpnAWXx.exe
  2⤵
  PID:11156
- C:\Windows\System\uaZTnlh.exe
  C:\Windows\System\uaZTnlh.exe
  2⤵
  PID:11172
- C:\Windows\System\SQMkBWe.exe
  C:\Windows\System\SQMkBWe.exe
  2⤵
  PID:11192
- C:\Windows\System\JQQqjwe.exe
  C:\Windows\System\JQQqjwe.exe
  2⤵
  PID:11216
- C:\Windows\System\KahfLSA.exe
  C:\Windows\System\KahfLSA.exe
  2⤵
  PID:11240
- C:\Windows\System\WxJfrxj.exe
  C:\Windows\System\WxJfrxj.exe
  2⤵
  PID:11256
- C:\Windows\System\xypdQgr.exe
  C:\Windows\System\xypdQgr.exe
  2⤵
  PID:9724
- C:\Windows\System\tXqpcbK.exe
  C:\Windows\System\tXqpcbK.exe
  2⤵
  PID:9804
- C:\Windows\System\UUuBjob.exe
  C:\Windows\System\UUuBjob.exe
  2⤵
  PID:3044
- C:\Windows\System\ABnalZK.exe
  C:\Windows\System\ABnalZK.exe
  2⤵
  PID:8804
- C:\Windows\System\RuAKMkL.exe
  C:\Windows\System\RuAKMkL.exe
  2⤵
  PID:8828
- C:\Windows\System\NBuVusA.exe
  C:\Windows\System\NBuVusA.exe
  2⤵
  PID:5712
- C:\Windows\System\tyjXchR.exe
  C:\Windows\System\tyjXchR.exe
  2⤵
  PID:9056
- C:\Windows\System\LbhHOCq.exe
  C:\Windows\System\LbhHOCq.exe
  2⤵
  PID:6136
- C:\Windows\System\owqcHpE.exe
  C:\Windows\System\owqcHpE.exe
  2⤵
  PID:9132
- C:\Windows\System\anIHKpe.exe
  C:\Windows\System\anIHKpe.exe
  2⤵
  PID:8396
- C:\Windows\System\AKKDwHR.exe
  C:\Windows\System\AKKDwHR.exe
  2⤵
  PID:5544
- C:\Windows\System\qDgBSYV.exe
  C:\Windows\System\qDgBSYV.exe
  2⤵
  PID:1760
- C:\Windows\System\kAwiOif.exe
  C:\Windows\System\kAwiOif.exe
  2⤵
  PID:8492
- C:\Windows\System\oFlBzTt.exe
  C:\Windows\System\oFlBzTt.exe
  2⤵
  PID:11280
- C:\Windows\System\yddBzfI.exe
  C:\Windows\System\yddBzfI.exe
  2⤵
  PID:11304
- C:\Windows\System\etsYUzR.exe
  C:\Windows\System\etsYUzR.exe
  2⤵
  PID:11320
- C:\Windows\System\ajAWBui.exe
  C:\Windows\System\ajAWBui.exe
  2⤵
  PID:11348
- C:\Windows\System\ObGkMux.exe
  C:\Windows\System\ObGkMux.exe
  2⤵
  PID:11372
- C:\Windows\System\nkaOAdq.exe
  C:\Windows\System\nkaOAdq.exe
  2⤵
  PID:11396
- C:\Windows\System\DqNLKGo.exe
  C:\Windows\System\DqNLKGo.exe
  2⤵
  PID:11416
- C:\Windows\System\PRbwFzU.exe
  C:\Windows\System\PRbwFzU.exe
  2⤵
  PID:11444
- C:\Windows\System\JCyWdPO.exe
  C:\Windows\System\JCyWdPO.exe
  2⤵
  PID:11464
- C:\Windows\System\KOZFeTq.exe
  C:\Windows\System\KOZFeTq.exe
  2⤵
  PID:11480
- C:\Windows\System\KMQOMdV.exe
  C:\Windows\System\KMQOMdV.exe
  2⤵
  PID:11500
- C:\Windows\System\GecYzEd.exe
  C:\Windows\System\GecYzEd.exe
  2⤵
  PID:11520
- C:\Windows\System\GEHrGgo.exe
  C:\Windows\System\GEHrGgo.exe
  2⤵
  PID:11540
- C:\Windows\System\DDpJsdn.exe
  C:\Windows\System\DDpJsdn.exe
  2⤵
  PID:11556
- C:\Windows\System\oMkFWBH.exe
  C:\Windows\System\oMkFWBH.exe
  2⤵
  PID:11576
- C:\Windows\System\KYEAlsj.exe
  C:\Windows\System\KYEAlsj.exe
  2⤵
  PID:11600
- C:\Windows\System\aaVvibk.exe
  C:\Windows\System\aaVvibk.exe
  2⤵
  PID:11620
- C:\Windows\System\TUNiIHh.exe
  C:\Windows\System\TUNiIHh.exe
  2⤵
  PID:11636
- C:\Windows\System\nBLnCvq.exe
  C:\Windows\System\nBLnCvq.exe
  2⤵
  PID:11652
- C:\Windows\System\pdORJHa.exe
  C:\Windows\System\pdORJHa.exe
  2⤵
  PID:11668
- C:\Windows\System\aVidqIP.exe
  C:\Windows\System\aVidqIP.exe
  2⤵
  PID:11688
- C:\Windows\System\umovPgP.exe
  C:\Windows\System\umovPgP.exe
  2⤵
  PID:11716
- C:\Windows\System\golnqOM.exe
  C:\Windows\System\golnqOM.exe
  2⤵
  PID:11744
- C:\Windows\System\odrhYtt.exe
  C:\Windows\System\odrhYtt.exe
  2⤵
  PID:11760
- C:\Windows\System\spbyRDN.exe
  C:\Windows\System\spbyRDN.exe
  2⤵
  PID:11788
- C:\Windows\System\rArZemv.exe
  C:\Windows\System\rArZemv.exe
  2⤵
  PID:11804
- C:\Windows\System\ESkjtpF.exe
  C:\Windows\System\ESkjtpF.exe
  2⤵
  PID:11824
- C:\Windows\System\LxBtqsJ.exe
  C:\Windows\System\LxBtqsJ.exe
  2⤵
  PID:11848
- C:\Windows\System\vsQhRAj.exe
  C:\Windows\System\vsQhRAj.exe
  2⤵
  PID:11876
- C:\Windows\System\mOMBGbx.exe
  C:\Windows\System\mOMBGbx.exe
  2⤵
  PID:11904
- C:\Windows\System\XxGipNY.exe
  C:\Windows\System\XxGipNY.exe
  2⤵
  PID:11928
- C:\Windows\System\loVmbHg.exe
  C:\Windows\System\loVmbHg.exe
  2⤵
  PID:11944
- C:\Windows\System\lAFNTrc.exe
  C:\Windows\System\lAFNTrc.exe
  2⤵
  PID:11972
- C:\Windows\System\drMAcTF.exe
  C:\Windows\System\drMAcTF.exe
  2⤵
  PID:11992
- C:\Windows\System\EuqUSBN.exe
  C:\Windows\System\EuqUSBN.exe
  2⤵
  PID:12016
- C:\Windows\System\SIierKW.exe
  C:\Windows\System\SIierKW.exe
  2⤵
  PID:12036
- C:\Windows\System\BzFCtjj.exe
  C:\Windows\System\BzFCtjj.exe
  2⤵
  PID:12060
- C:\Windows\System\gDpEARp.exe
  C:\Windows\System\gDpEARp.exe
  2⤵
  PID:12084
- C:\Windows\System\LNOhUzw.exe
  C:\Windows\System\LNOhUzw.exe
  2⤵
  PID:12108
- C:\Windows\System\POGEWtI.exe
  C:\Windows\System\POGEWtI.exe
  2⤵
  PID:12128
- C:\Windows\System\EIGsBjI.exe
  C:\Windows\System\EIGsBjI.exe
  2⤵
  PID:12148
- C:\Windows\System\KMOIibE.exe
  C:\Windows\System\KMOIibE.exe
  2⤵
  PID:12188
- C:\Windows\System\ToIlCsL.exe
  C:\Windows\System\ToIlCsL.exe
  2⤵
  PID:12208
- C:\Windows\System\PosicTI.exe
  C:\Windows\System\PosicTI.exe
  2⤵
  PID:12232
- C:\Windows\System\vyaDhrf.exe
  C:\Windows\System\vyaDhrf.exe
  2⤵
  PID:12252
- C:\Windows\System\YfKOaXj.exe
  C:\Windows\System\YfKOaXj.exe
  2⤵
  PID:12276
- C:\Windows\System\pZvZdgc.exe
  C:\Windows\System\pZvZdgc.exe
  2⤵
  PID:8232
- C:\Windows\System\zPNMHLv.exe
  C:\Windows\System\zPNMHLv.exe
  2⤵
  PID:8520
- C:\Windows\System\ABzHnJj.exe
  C:\Windows\System\ABzHnJj.exe
  2⤵
  PID:7664
- C:\Windows\System\KiPOwCM.exe
  C:\Windows\System\KiPOwCM.exe
  2⤵
  PID:9296
- C:\Windows\System\LfEoaup.exe
  C:\Windows\System\LfEoaup.exe
  2⤵
  PID:9000
- C:\Windows\System\pGOtbkl.exe
  C:\Windows\System\pGOtbkl.exe
  2⤵
  PID:9424
- C:\Windows\System\aMyQsAg.exe
  C:\Windows\System\aMyQsAg.exe
  2⤵
  PID:5856
- C:\Windows\System\gnhGMNT.exe
  C:\Windows\System\gnhGMNT.exe
  2⤵
  PID:440
- C:\Windows\System\AknkZcL.exe
  C:\Windows\System\AknkZcL.exe
  2⤵
  PID:8712
- C:\Windows\System\dSyfGqL.exe
  C:\Windows\System\dSyfGqL.exe
  2⤵
  PID:9624
- C:\Windows\System\PnoEJCj.exe
  C:\Windows\System\PnoEJCj.exe
  2⤵
  PID:1972
- C:\Windows\System\hPSudJo.exe
  C:\Windows\System\hPSudJo.exe
  2⤵
  PID:9708
- C:\Windows\System\SfmLQkA.exe
  C:\Windows\System\SfmLQkA.exe
  2⤵
  PID:9756
- C:\Windows\System\hXfXMTS.exe
  C:\Windows\System\hXfXMTS.exe
  2⤵
  PID:9784
- C:\Windows\System\SJetDGP.exe
  C:\Windows\System\SJetDGP.exe
  2⤵
  PID:10496
- C:\Windows\System\NqEOtpj.exe
  C:\Windows\System\NqEOtpj.exe
  2⤵
  PID:10556
- C:\Windows\System\eTWfOnp.exe
  C:\Windows\System\eTWfOnp.exe
  2⤵
  PID:10636
- C:\Windows\System\JAiNJQN.exe
  C:\Windows\System\JAiNJQN.exe
  2⤵
  PID:10724
- C:\Windows\System\mcgCjiS.exe
  C:\Windows\System\mcgCjiS.exe
  2⤵
  PID:9944
- C:\Windows\System\CGmXZOX.exe
  C:\Windows\System\CGmXZOX.exe
  2⤵
  PID:9960
- C:\Windows\System\zyUmldv.exe
  C:\Windows\System\zyUmldv.exe
  2⤵
  PID:10808
- C:\Windows\System\NajCwCH.exe
  C:\Windows\System\NajCwCH.exe
  2⤵
  PID:10828
- C:\Windows\System\pstIItm.exe
  C:\Windows\System\pstIItm.exe
  2⤵
  PID:10848
- C:\Windows\System\pbipYQz.exe
  C:\Windows\System\pbipYQz.exe
  2⤵
  PID:10912
- C:\Windows\System\WruVxpe.exe
  C:\Windows\System\WruVxpe.exe
  2⤵
  PID:10984
- C:\Windows\System\XGdDLQU.exe
  C:\Windows\System\XGdDLQU.exe
  2⤵
  PID:5520
- C:\Windows\System\qWbRolY.exe
  C:\Windows\System\qWbRolY.exe
  2⤵
  PID:11148
- C:\Windows\System\vIEjhHm.exe
  C:\Windows\System\vIEjhHm.exe
  2⤵
  PID:11200
- C:\Windows\System\iIGMzSn.exe
  C:\Windows\System\iIGMzSn.exe
  2⤵
  PID:6748
- C:\Windows\System\CRIuHlJ.exe
  C:\Windows\System\CRIuHlJ.exe
  2⤵
  PID:8748
- C:\Windows\System\FtGqZiP.exe
  C:\Windows\System\FtGqZiP.exe
  2⤵
  PID:12316
- C:\Windows\System\xQlgEtj.exe
  C:\Windows\System\xQlgEtj.exe
  2⤵
  PID:12336
- C:\Windows\System\Pzhwhuy.exe
  C:\Windows\System\Pzhwhuy.exe
  2⤵
  PID:12352
- C:\Windows\System\GcsRggc.exe
  C:\Windows\System\GcsRggc.exe
  2⤵
  PID:12368
- C:\Windows\System\jjmsZRr.exe
  C:\Windows\System\jjmsZRr.exe
  2⤵
  PID:12388
- C:\Windows\System\tDrkAWG.exe
  C:\Windows\System\tDrkAWG.exe
  2⤵
  PID:12408
- C:\Windows\System\qWokGBq.exe
  C:\Windows\System\qWokGBq.exe
  2⤵
  PID:12436
- C:\Windows\System\FPRbCis.exe
  C:\Windows\System\FPRbCis.exe
  2⤵
  PID:12456
- C:\Windows\System\ikVVrPB.exe
  C:\Windows\System\ikVVrPB.exe
  2⤵
  PID:12476
- C:\Windows\System\HTilGrU.exe
  C:\Windows\System\HTilGrU.exe
  2⤵
  PID:12492
- C:\Windows\System\eaawZli.exe
  C:\Windows\System\eaawZli.exe
  2⤵
  PID:12524
- C:\Windows\System\SgmoJTr.exe
  C:\Windows\System\SgmoJTr.exe
  2⤵
  PID:12556
- C:\Windows\System\yNBbGLA.exe
  C:\Windows\System\yNBbGLA.exe
  2⤵
  PID:12576
- C:\Windows\System\zCZNNvm.exe
  C:\Windows\System\zCZNNvm.exe
  2⤵
  PID:12600
- C:\Windows\System\wEEhAyz.exe
  C:\Windows\System\wEEhAyz.exe
  2⤵
  PID:12624
- C:\Windows\System\vzUsPit.exe
  C:\Windows\System\vzUsPit.exe
  2⤵
  PID:12644
- C:\Windows\System\BdKPUJi.exe
  C:\Windows\System\BdKPUJi.exe
  2⤵
  PID:12664
- C:\Windows\System\hWXszdO.exe
  C:\Windows\System\hWXszdO.exe
  2⤵
  PID:12692
- C:\Windows\System\yWmlKVQ.exe
  C:\Windows\System\yWmlKVQ.exe
  2⤵
  PID:12712
- C:\Windows\System\OdtzozR.exe
  C:\Windows\System\OdtzozR.exe
  2⤵
  PID:12736
- C:\Windows\System\XnaPDyk.exe
  C:\Windows\System\XnaPDyk.exe
  2⤵
  PID:12756
- C:\Windows\System\jCNNhtq.exe
  C:\Windows\System\jCNNhtq.exe
  2⤵
  PID:12772
- C:\Windows\System\Ayytusd.exe
  C:\Windows\System\Ayytusd.exe
  2⤵
  PID:12796
- C:\Windows\System\qkxoQhj.exe
  C:\Windows\System\qkxoQhj.exe
  2⤵
  PID:12816
- C:\Windows\System\UMibCfj.exe
  C:\Windows\System\UMibCfj.exe
  2⤵
  PID:12840
- C:\Windows\System\PfwYJaE.exe
  C:\Windows\System\PfwYJaE.exe
  2⤵
  PID:12864
- C:\Windows\System\XVQCxyI.exe
  C:\Windows\System\XVQCxyI.exe
  2⤵
  PID:12880
- C:\Windows\System\lRBOABG.exe
  C:\Windows\System\lRBOABG.exe
  2⤵
  PID:12904
- C:\Windows\System\GaTmWga.exe
  C:\Windows\System\GaTmWga.exe
  2⤵
  PID:12928
- C:\Windows\System\afgjKcn.exe
  C:\Windows\System\afgjKcn.exe
  2⤵
  PID:12948
- C:\Windows\System\LBdNjHy.exe
  C:\Windows\System\LBdNjHy.exe
  2⤵
  PID:12968
- C:\Windows\System\ODIokZO.exe
  C:\Windows\System\ODIokZO.exe
  2⤵
  PID:13000
- C:\Windows\System\PFVRbpQ.exe
  C:\Windows\System\PFVRbpQ.exe
  2⤵
  PID:13020
- C:\Windows\System\SrClmwi.exe
  C:\Windows\System\SrClmwi.exe
  2⤵
  PID:13036
- C:\Windows\System\cRpeeOz.exe
  C:\Windows\System\cRpeeOz.exe
  2⤵
  PID:13056
- C:\Windows\System\XrDCbcG.exe
  C:\Windows\System\XrDCbcG.exe
  2⤵
  PID:13084
- C:\Windows\System\wQRPOjJ.exe
  C:\Windows\System\wQRPOjJ.exe
  2⤵
  PID:13100
- C:\Windows\System\KUlbjki.exe
  C:\Windows\System\KUlbjki.exe
  2⤵
  PID:13120
- C:\Windows\System\RgXERgv.exe
  C:\Windows\System\RgXERgv.exe
  2⤵
  PID:13144
- C:\Windows\System\eSodZxv.exe
  C:\Windows\System\eSodZxv.exe
  2⤵
  PID:13164
- C:\Windows\System\mzLJnEh.exe
  C:\Windows\System\mzLJnEh.exe
  2⤵
  PID:13180
- C:\Windows\System\jtCulPp.exe
  C:\Windows\System\jtCulPp.exe
  2⤵
  PID:13196
- C:\Windows\System\UoxMrWi.exe
  C:\Windows\System\UoxMrWi.exe
  2⤵
  PID:13212
- C:\Windows\System\xvGByjf.exe
  C:\Windows\System\xvGByjf.exe
  2⤵
  PID:13244
- C:\Windows\System\qZWEzaS.exe
  C:\Windows\System\qZWEzaS.exe
  2⤵
  PID:13268
- C:\Windows\System\dxGrpgC.exe
  C:\Windows\System\dxGrpgC.exe
  2⤵
  PID:13292
- C:\Windows\System\GXSTlAW.exe
  C:\Windows\System\GXSTlAW.exe
  2⤵
  PID:9752
- C:\Windows\System\LeSjeev.exe
  C:\Windows\System\LeSjeev.exe
  2⤵
  PID:9312
- C:\Windows\System\EoGpjrY.exe
  C:\Windows\System\EoGpjrY.exe
  2⤵
  PID:9408
- C:\Windows\System\HxWfkGD.exe
  C:\Windows\System\HxWfkGD.exe
  2⤵
  PID:2000
- C:\Windows\System\tWCTWkO.exe
  C:\Windows\System\tWCTWkO.exe
  2⤵
  PID:1744
- C:\Windows\System\XcoETPj.exe
  C:\Windows\System\XcoETPj.exe
  2⤵
  PID:9564
- C:\Windows\System\pgGCxVr.exe
  C:\Windows\System\pgGCxVr.exe
  2⤵
  PID:10600
- C:\Windows\System\DtmBqSM.exe
  C:\Windows\System\DtmBqSM.exe
  2⤵
  PID:12204
- C:\Windows\System\XvwmwqF.exe
  C:\Windows\System\XvwmwqF.exe
  2⤵
  PID:7468
- C:\Windows\System\PvWhqid.exe
  C:\Windows\System\PvWhqid.exe
  2⤵
  PID:11040
- C:\Windows\System\buWRPUG.exe
  C:\Windows\System\buWRPUG.exe
  2⤵
  PID:11164
- C:\Windows\System\pNCnjHd.exe
  C:\Windows\System\pNCnjHd.exe
  2⤵
  PID:5116
- C:\Windows\System\HfRkjTt.exe
  C:\Windows\System\HfRkjTt.exe
  2⤵
  PID:9828
- C:\Windows\System\HWUddMX.exe
  C:\Windows\System\HWUddMX.exe
  2⤵
  PID:8816
- C:\Windows\System\vyTzoAk.exe
  C:\Windows\System\vyTzoAk.exe
  2⤵
  PID:9128
- C:\Windows\System\ADthCsL.exe
  C:\Windows\System\ADthCsL.exe
  2⤵
  PID:9168
- C:\Windows\System\MIUlhFW.exe
  C:\Windows\System\MIUlhFW.exe
  2⤵
  PID:11316
- C:\Windows\System\ixnftpY.exe
  C:\Windows\System\ixnftpY.exe
  2⤵
  PID:11364
- C:\Windows\System\GbfyXip.exe
  C:\Windows\System\GbfyXip.exe
  2⤵
  PID:12568
- C:\Windows\System\eTdsauT.exe
  C:\Windows\System\eTdsauT.exe
  2⤵
  PID:12612
- C:\Windows\System\ErVtuNa.exe
  C:\Windows\System\ErVtuNa.exe
  2⤵
  PID:12672
- C:\Windows\System\sFvhbBx.exe
  C:\Windows\System\sFvhbBx.exe
  2⤵
  PID:8940
- C:\Windows\System\jhvgKYr.exe
  C:\Windows\System\jhvgKYr.exe
  2⤵
  PID:10756
- C:\Windows\System\YCrYNXB.exe
  C:\Windows\System\YCrYNXB.exe
  2⤵
  PID:9820
- C:\Windows\System\snzTJCe.exe
  C:\Windows\System\snzTJCe.exe
  2⤵
  PID:8648
- C:\Windows\System\DqCKABP.exe
  C:\Windows\System\DqCKABP.exe
  2⤵
  PID:12272
- C:\Windows\System\jGDgpaR.exe
  C:\Windows\System\jGDgpaR.exe
  2⤵
  PID:12164
- C:\Windows\System\MpLiVdC.exe
  C:\Windows\System\MpLiVdC.exe
  2⤵
  PID:12092
- C:\Windows\System\WUwjFIz.exe
  C:\Windows\System\WUwjFIz.exe
  2⤵
  PID:12012
- C:\Windows\System\MMmALwl.exe
  C:\Windows\System\MMmALwl.exe
  2⤵
  PID:11916
- C:\Windows\System\khPylxT.exe
  C:\Windows\System\khPylxT.exe
  2⤵
  PID:11840
- C:\Windows\System\zwtcrQq.exe
  C:\Windows\System\zwtcrQq.exe
  2⤵
  PID:11596
- C:\Windows\System\XDFeaBc.exe
  C:\Windows\System\XDFeaBc.exe
  2⤵
  PID:8996
- C:\Windows\System\SbvIndo.exe
  C:\Windows\System\SbvIndo.exe
  2⤵
  PID:10892
- C:\Windows\System\slqPRfb.exe
  C:\Windows\System\slqPRfb.exe
  2⤵
  PID:6248
- C:\Windows\System\ypepFrH.exe
  C:\Windows\System\ypepFrH.exe
  2⤵
  PID:12364
- C:\Windows\System\RGsFGgf.exe
  C:\Windows\System\RGsFGgf.exe
  2⤵
  PID:12484
- C:\Windows\System\bDFrZsS.exe
  C:\Windows\System\bDFrZsS.exe
  2⤵
  PID:12428
- C:\Windows\System\VWkwzix.exe
  C:\Windows\System\VWkwzix.exe
  2⤵
  PID:11608
- C:\Windows\System\sxMXxSe.exe
  C:\Windows\System\sxMXxSe.exe
  2⤵
  PID:12592
- C:\Windows\System\KyfwQzs.exe
  C:\Windows\System\KyfwQzs.exe
  2⤵
  PID:12768
- C:\Windows\System\cfJrcEK.exe
  C:\Windows\System\cfJrcEK.exe
  2⤵
  PID:12960
- C:\Windows\System\Egmhzay.exe
  C:\Windows\System\Egmhzay.exe
  2⤵
  PID:13012
- C:\Windows\System\HQNfhHu.exe
  C:\Windows\System\HQNfhHu.exe
  2⤵
  PID:13192
- C:\Windows\System\fmCRQQk.exe
  C:\Windows\System\fmCRQQk.exe
  2⤵
  PID:13276
- C:\Windows\System\azYALpj.exe
  C:\Windows\System\azYALpj.exe
  2⤵
  PID:13308
- C:\Windows\System\NTGSLjm.exe
  C:\Windows\System\NTGSLjm.exe
  2⤵
  PID:2572
- C:\Windows\System\uxcCUfb.exe
  C:\Windows\System\uxcCUfb.exe
  2⤵
  PID:6456
- C:\Windows\System\lCVBfSm.exe
  C:\Windows\System\lCVBfSm.exe
  2⤵
  PID:11680
- C:\Windows\System\AYktPyP.exe
  C:\Windows\System\AYktPyP.exe
  2⤵
  PID:4272
- C:\Windows\System\YpcXAIP.exe
  C:\Windows\System\YpcXAIP.exe
  2⤵
  PID:9512
- C:\Windows\System\kGZgsLC.exe
  C:\Windows\System\kGZgsLC.exe
  2⤵
  PID:10304
- C:\Windows\System\fAGvqmz.exe
  C:\Windows\System\fAGvqmz.exe
  2⤵
  PID:11800
- C:\Windows\System\QJidqnR.exe
  C:\Windows\System\QJidqnR.exe
  2⤵
  PID:8680
- C:\Windows\System\cpGVqnh.exe
  C:\Windows\System\cpGVqnh.exe
  2⤵
  PID:9704
- C:\Windows\System\LyHMceb.exe
  C:\Windows\System\LyHMceb.exe
  2⤵
  PID:6696
- C:\Windows\System\qlDseIs.exe
  C:\Windows\System\qlDseIs.exe
  2⤵
  PID:436
- C:\Windows\System\pDNxJEF.exe
  C:\Windows\System\pDNxJEF.exe
  2⤵
  PID:10544
- C:\Windows\System\vsJrmGO.exe
  C:\Windows\System\vsJrmGO.exe
  2⤵
  PID:5440
- C:\Windows\System\pOtfxPz.exe
  C:\Windows\System\pOtfxPz.exe
  2⤵
  PID:1044
- C:\Windows\System\JmjlWdr.exe
  C:\Windows\System\JmjlWdr.exe
  2⤵
  PID:7424
- C:\Windows\System\nvgwdre.exe
  C:\Windows\System\nvgwdre.exe
  2⤵
  PID:12744
- C:\Windows\System\TmvWNdF.exe
  C:\Windows\System\TmvWNdF.exe
  2⤵
  PID:6896
- C:\Windows\System\HyIkEHg.exe
  C:\Windows\System\HyIkEHg.exe
  2⤵
  PID:11232
- C:\Windows\System\LhddLWy.exe
  C:\Windows\System\LhddLWy.exe
  2⤵
  PID:10216
- C:\Windows\System\ULPytep.exe
  C:\Windows\System\ULPytep.exe
  2⤵
  PID:13156
- C:\Windows\System\ifLXdKY.exe
  C:\Windows\System\ifLXdKY.exe
  2⤵
  PID:10476
- C:\Windows\System\obahwER.exe
  C:\Windows\System\obahwER.exe
  2⤵
  PID:13228
- C:\Windows\System\ravmyEE.exe
  C:\Windows\System\ravmyEE.exe
  2⤵
  PID:10560
- C:\Windows\System\qfhkIap.exe
  C:\Windows\System\qfhkIap.exe
  2⤵
  PID:12784
- C:\Windows\System\ZUzaoXt.exe
  C:\Windows\System\ZUzaoXt.exe
  2⤵
  PID:6848
- C:\Windows\System\qiitRqZ.exe
  C:\Windows\System\qiitRqZ.exe
  2⤵
  PID:11784
- C:\Windows\System\JtvBvqr.exe
  C:\Windows\System\JtvBvqr.exe
  2⤵
  PID:876
- C:\Windows\System\SwUJtXX.exe
  C:\Windows\System\SwUJtXX.exe
  2⤵
  PID:9212
- C:\Windows\System\XNFGNyn.exe
  C:\Windows\System\XNFGNyn.exe
  2⤵
  PID:8320
- C:\Windows\System\BsYOXZO.exe
  C:\Windows\System\BsYOXZO.exe
  2⤵
  PID:10764
- C:\Windows\System\XFrxCap.exe
  C:\Windows\System\XFrxCap.exe
  2⤵
  PID:11064
- C:\Windows\System\AXLqWqL.exe
  C:\Windows\System\AXLqWqL.exe
  2⤵
  PID:12400
- C:\Windows\System\SygAHuS.exe
  C:\Windows\System\SygAHuS.exe
  2⤵
  PID:9064
- C:\Windows\System\lYAcIkh.exe
  C:\Windows\System\lYAcIkh.exe
  2⤵
  PID:10736
- C:\Windows\System\wJJlsBz.exe
  C:\Windows\System\wJJlsBz.exe
  2⤵
  PID:12200
- C:\Windows\System\zzOWAnl.exe
  C:\Windows\System\zzOWAnl.exe
  2⤵
  PID:11868
- C:\Windows\System\rXjvmuG.exe
  C:\Windows\System\rXjvmuG.exe
  2⤵
  PID:11536
- C:\Windows\System\QCtsFho.exe
  C:\Windows\System\QCtsFho.exe
  2⤵
  PID:11332
- C:\Windows\System\pPUJHKe.exe
  C:\Windows\System\pPUJHKe.exe
  2⤵
  PID:12140
- C:\Windows\System\NvyPAEg.exe
  C:\Windows\System\NvyPAEg.exe
  2⤵
  PID:8300
- C:\Windows\System\DHvnyRf.exe
  C:\Windows\System\DHvnyRf.exe
  2⤵
  PID:11660
- C:\Windows\System\LErdadI.exe
  C:\Windows\System\LErdadI.exe
  2⤵
  PID:10184
- C:\Windows\System\jWBPNQc.exe
  C:\Windows\System\jWBPNQc.exe
  2⤵
  PID:12380
- C:\Windows\System\qfkeWyw.exe
  C:\Windows\System\qfkeWyw.exe
  2⤵
  PID:3984
- C:\Windows\System\wZTTaQS.exe
  C:\Windows\System\wZTTaQS.exe
  2⤵
  PID:13048
- C:\Windows\System\lhSJRAA.exe
  C:\Windows\System\lhSJRAA.exe
  2⤵
  PID:13128
- C:\Windows\System\xveJztN.exe
  C:\Windows\System\xveJztN.exe
  2⤵
  PID:7272
- C:\Windows\System\dfiPaEE.exe
  C:\Windows\System\dfiPaEE.exe
  2⤵
  PID:13260
- C:\Windows\System\ijnJEJy.exe
  C:\Windows\System\ijnJEJy.exe
  2⤵
  PID:9248
- C:\Windows\System\sYIxBDn.exe
  C:\Windows\System\sYIxBDn.exe
  2⤵
  PID:11460
- C:\Windows\System\bvxkLoX.exe
  C:\Windows\System\bvxkLoX.exe
  2⤵
  PID:11592
- C:\Windows\System\Xcpdfir.exe
  C:\Windows\System\Xcpdfir.exe
  2⤵
  PID:7048
- C:\Windows\System\xLLOzaI.exe
  C:\Windows\System\xLLOzaI.exe
  2⤵
  PID:7692
- C:\Windows\System\ZpRjYAE.exe
  C:\Windows\System\ZpRjYAE.exe
  2⤵
  PID:4700
- C:\Windows\System\StsuvIO.exe
  C:\Windows\System\StsuvIO.exe
  2⤵
  PID:13328
- C:\Windows\System\vqbephL.exe
  C:\Windows\System\vqbephL.exe
  2⤵
  PID:13344
- C:\Windows\System\SmxDXZw.exe
  C:\Windows\System\SmxDXZw.exe
  2⤵
  PID:13372
- C:\Windows\System\MDXLrAp.exe
  C:\Windows\System\MDXLrAp.exe
  2⤵
  PID:13396
- C:\Windows\System\dxpXaxh.exe
  C:\Windows\System\dxpXaxh.exe
  2⤵
  PID:13412
- C:\Windows\System\BOtUanY.exe
  C:\Windows\System\BOtUanY.exe
  2⤵
  PID:13432
- C:\Windows\System\BLDRriu.exe
  C:\Windows\System\BLDRriu.exe
  2⤵
  PID:13456
- C:\Windows\System\jXroLOe.exe
  C:\Windows\System\jXroLOe.exe
  2⤵
  PID:13528
- C:\Windows\System\AIfRygi.exe
  C:\Windows\System\AIfRygi.exe
  2⤵
  PID:13556
- C:\Windows\System\iSnXcGf.exe
  C:\Windows\System\iSnXcGf.exe
  2⤵
  PID:13580
- C:\Windows\System\PUVIwAv.exe
  C:\Windows\System\PUVIwAv.exe
  2⤵
  PID:13600
- C:\Windows\System\eMCjWyd.exe
  C:\Windows\System\eMCjWyd.exe
  2⤵
  PID:13616
- C:\Windows\System\mGaDLGR.exe
  C:\Windows\System\mGaDLGR.exe
  2⤵
  PID:13636
- C:\Windows\System\CanKzty.exe
  C:\Windows\System\CanKzty.exe
  2⤵
  PID:13660
- C:\Windows\System\wEQigbN.exe
  C:\Windows\System\wEQigbN.exe
  2⤵
  PID:13680
- C:\Windows\System\QKEBtYy.exe
  C:\Windows\System\QKEBtYy.exe
  2⤵
  PID:13704
- C:\Windows\System\uDFDrAr.exe
  C:\Windows\System\uDFDrAr.exe
  2⤵
  PID:13924
- C:\Windows\System\KgCbNQW.exe
  C:\Windows\System\KgCbNQW.exe
  2⤵
  PID:13944
- C:\Windows\System\YPiWHJq.exe
  C:\Windows\System\YPiWHJq.exe
  2⤵
  PID:13964
- C:\Windows\System\FvCtpHL.exe
  C:\Windows\System\FvCtpHL.exe
  2⤵
  PID:12444
- C:\Windows\System\tSpoVvG.exe
  C:\Windows\System\tSpoVvG.exe
  2⤵
  PID:13008
- C:\Windows\System\UslahTd.exe
  C:\Windows\System\UslahTd.exe
  2⤵
  PID:13976
- C:\Windows\System\splqTpo.exe
  C:\Windows\System\splqTpo.exe
  2⤵
  PID:14000
- C:\Windows\System\gveWXCa.exe
  C:\Windows\System\gveWXCa.exe
  2⤵
  PID:14056
- C:\Windows\System\XEYfKBH.exe
  C:\Windows\System\XEYfKBH.exe
  2⤵
  PID:13836
- C:\Windows\System\lhODJLd.exe
  C:\Windows\System\lhODJLd.exe
  2⤵
  PID:13856
- C:\Windows\System\XXGKXEV.exe
  C:\Windows\System\XXGKXEV.exe
  2⤵
  PID:13916
- C:\Windows\System\eyFVGHT.exe
  C:\Windows\System\eyFVGHT.exe
  2⤵
  PID:14184
- C:\Windows\System\IHSljiC.exe
  C:\Windows\System\IHSljiC.exe
  2⤵
  PID:14048
- C:\Windows\System\nJEiHvT.exe
  C:\Windows\System\nJEiHvT.exe
  2⤵
  PID:14216
- C:\Windows\System\dlCUmWl.exe
  C:\Windows\System\dlCUmWl.exe
  2⤵
  PID:14304
- C:\Windows\System\iQVusJe.exe
  C:\Windows\System\iQVusJe.exe
  2⤵
  PID:9292
- C:\Windows\System\foNzKxB.exe
  C:\Windows\System\foNzKxB.exe
  2⤵
  PID:11492
- C:\Windows\System\zsRGWnh.exe
  C:\Windows\System\zsRGWnh.exe
  2⤵
  PID:6044
- C:\Windows\System\eeIEbRx.exe
  C:\Windows\System\eeIEbRx.exe
  2⤵
  PID:12032
- C:\Windows\System\VptOhXz.exe
  C:\Windows\System\VptOhXz.exe
  2⤵
  PID:4424
- C:\Windows\System\XWScJGC.exe
  C:\Windows\System\XWScJGC.exe
  2⤵
  PID:13428
- C:\Windows\System\XNBIWhy.exe
  C:\Windows\System\XNBIWhy.exe
  2⤵
  PID:13852
- C:\Windows\System\MmXuUar.exe
  C:\Windows\System\MmXuUar.exe
  2⤵
  PID:1232
- C:\Windows\System\TaCudEC.exe
  C:\Windows\System\TaCudEC.exe
  2⤵
  PID:13364
- C:\Windows\System\DVqdAbp.exe
  C:\Windows\System\DVqdAbp.exe
  2⤵
  PID:14284
- C:\Windows\System\ePndufN.exe
  C:\Windows\System\ePndufN.exe
  2⤵
  PID:1452
- C:\Windows\System\AUCSkAd.exe
  C:\Windows\System\AUCSkAd.exe
  2⤵
  PID:13792
- C:\Windows\System\UrwLJfu.exe
  C:\Windows\System\UrwLJfu.exe
  2⤵
  PID:10228
- C:\Windows\System\XbUJGXM.exe
  C:\Windows\System\XbUJGXM.exe
  2⤵
  PID:14264
- C:\Windows\System\iRMMaMj.exe
  C:\Windows\System\iRMMaMj.exe
  2⤵
  PID:11488
- C:\Windows\System\fucrJRk.exe
  C:\Windows\System\fucrJRk.exe
  2⤵
  PID:14180
- C:\Windows\System\RVMZfLA.exe
  C:\Windows\System\RVMZfLA.exe
  2⤵
  PID:13988
- C:\Windows\System\rhXbnBG.exe
  C:\Windows\System\rhXbnBG.exe
  2⤵
  PID:14204
- C:\Windows\System\LtZdxVy.exe
  C:\Windows\System\LtZdxVy.exe
  2⤵
  PID:11912
- C:\Windows\System\ijlzxpU.exe
  C:\Windows\System\ijlzxpU.exe
  2⤵
  PID:14328
- C:\Windows\System\pokPAyT.exe
  C:\Windows\System\pokPAyT.exe
  2⤵
  PID:8480
- C:\Windows\System\rzzVvzY.exe
  C:\Windows\System\rzzVvzY.exe
  2⤵
  PID:12304
- C:\Windows\System\LLYVoQW.exe
  C:\Windows\System\LLYVoQW.exe
  2⤵
  PID:13096
- C:\Windows\System\nWgOMhw.exe
  C:\Windows\System\nWgOMhw.exe
  2⤵
  PID:3368
- C:\Windows\System\JnnBEzx.exe
  C:\Windows\System\JnnBEzx.exe
  2⤵
  PID:5920
- C:\Windows\System\ftMAmCS.exe
  C:\Windows\System\ftMAmCS.exe
  2⤵
  PID:6320
- C:\Windows\System\AVzWaiy.exe
  C:\Windows\System\AVzWaiy.exe
  2⤵
  PID:9616
- C:\Windows\System\IJmCubi.exe
  C:\Windows\System\IJmCubi.exe
  2⤵
  PID:3732
- C:\Windows\System\YCOpoBN.exe
  C:\Windows\System\YCOpoBN.exe
  2⤵
  PID:13408
- C:\Windows\System\gmXnMFF.exe
  C:\Windows\System\gmXnMFF.exe
  2⤵
  PID:9472
- C:\Windows\System\igFMYnM.exe
  C:\Windows\System\igFMYnM.exe
  2⤵
  PID:2752
- C:\Windows\System\ovonhCp.exe
  C:\Windows\System\ovonhCp.exe
  2⤵
  PID:13744
- C:\Windows\System\aEfTrYv.exe
  C:\Windows\System\aEfTrYv.exe
  2⤵
  PID:13656
- C:\Windows\System\bBLtvAD.exe
  C:\Windows\System\bBLtvAD.exe
  2⤵
  PID:13628
- C:\Windows\System\ZoOtuPu.exe
  C:\Windows\System\ZoOtuPu.exe
  2⤵
  PID:12572
- C:\Windows\System\BRvUHfG.exe
  C:\Windows\System\BRvUHfG.exe
  2⤵
  PID:14016
- C:\Windows\System\XZIrPJb.exe
  C:\Windows\System\XZIrPJb.exe
  2⤵
  PID:10212
- C:\Windows\System\pjcmlCe.exe
  C:\Windows\System\pjcmlCe.exe
  2⤵
  PID:13972
- C:\Windows\System\mPlCbAM.exe
  C:\Windows\System\mPlCbAM.exe
  2⤵
  PID:14076
- C:\Windows\System\gmDBLVD.exe
  C:\Windows\System\gmDBLVD.exe
  2⤵
  PID:13884
- C:\Windows\System\HtqUZZj.exe
  C:\Windows\System\HtqUZZj.exe
  2⤵
  PID:13512
- C:\Windows\System\XOlsNDH.exe
  C:\Windows\System\XOlsNDH.exe
  2⤵
  PID:14136
- C:\Windows\System\iRdtYOi.exe
  C:\Windows\System\iRdtYOi.exe
  2⤵
  PID:3532
- C:\Windows\System\LJFntmX.exe
  C:\Windows\System\LJFntmX.exe
  2⤵
  PID:1700
- C:\Windows\System\cgpaqOk.exe
  C:\Windows\System\cgpaqOk.exe
  2⤵
  PID:6344
- C:\Windows\System\DypwniS.exe
  C:\Windows\System\DypwniS.exe
  2⤵
  PID:6112
- C:\Windows\System\kfQKseD.exe
  C:\Windows\System\kfQKseD.exe
  2⤵
  PID:2892
- C:\Windows\System\bbdMjZA.exe
  C:\Windows\System\bbdMjZA.exe
  2⤵
  PID:12832
- C:\Windows\System\HCIvbNe.exe
  C:\Windows\System\HCIvbNe.exe
  2⤵
  PID:7400
- C:\Windows\System\Dcsasjb.exe
  C:\Windows\System\Dcsasjb.exe
  2⤵
  PID:14324
- C:\Windows\System\vvwIFQD.exe
  C:\Windows\System\vvwIFQD.exe
  2⤵
  PID:14176
- C:\Windows\System\sStIRUi.exe
  C:\Windows\System\sStIRUi.exe
  2⤵
  PID:11224
- C:\Windows\System\TsPuopI.exe
  C:\Windows\System\TsPuopI.exe
  2⤵
  PID:10104
- C:\Windows\System\srLcLIy.exe
  C:\Windows\System\srLcLIy.exe
  2⤵
  PID:14280
- C:\Windows\System\zQXOrYL.exe
  C:\Windows\System\zQXOrYL.exe
  2⤵
  PID:12872
- C:\Windows\System\cmshhCL.exe
  C:\Windows\System\cmshhCL.exe
  2⤵
  PID:1532
- C:\Windows\System\OTIYjbD.exe
  C:\Windows\System\OTIYjbD.exe
  2⤵
  PID:5184
- C:\Windows\System\xFavyKg.exe
  C:\Windows\System\xFavyKg.exe
  2⤵
  PID:664
- C:\Windows\System\bmwTEeV.exe
  C:\Windows\System\bmwTEeV.exe
  2⤵
  PID:4144
- C:\Windows\System\NTVbvUa.exe
  C:\Windows\System\NTVbvUa.exe
  2⤵
  PID:8696
- C:\Windows\System\YNsSKHe.exe
  C:\Windows\System\YNsSKHe.exe
  2⤵
  PID:3764
- C:\Windows\System\cSuZbwo.exe
  C:\Windows\System\cSuZbwo.exe
  2⤵
  PID:13932
- C:\Windows\System\pVUJnNy.exe
  C:\Windows\System\pVUJnNy.exe
  2⤵
  PID:548
- C:\Windows\System\mXbtipL.exe
  C:\Windows\System\mXbtipL.exe
  2⤵
  PID:1216
- C:\Windows\System\yEpRkch.exe
  C:\Windows\System\yEpRkch.exe
  2⤵
  PID:14348
- C:\Windows\System\BdyhPzr.exe
  C:\Windows\System\BdyhPzr.exe
  2⤵
  PID:14372
- C:\Windows\System\gbKFbwT.exe
  C:\Windows\System\gbKFbwT.exe
  2⤵
  PID:14580
- C:\Windows\System\lBdronE.exe
  C:\Windows\System\lBdronE.exe
  2⤵
  PID:15012
- C:\Windows\System\NnfENCb.exe
  C:\Windows\System\NnfENCb.exe
  2⤵
  PID:15040
- C:\Windows\System\xxULZwC.exe
  C:\Windows\System\xxULZwC.exe
  2⤵
  PID:15128
- C:\Windows\System\PdGqPMo.exe
  C:\Windows\System\PdGqPMo.exe
  2⤵
  PID:15192
- C:\Windows\System\EdWRned.exe
  C:\Windows\System\EdWRned.exe
  2⤵
  PID:15208
- C:\Windows\System\sLKNYzz.exe
  C:\Windows\System\sLKNYzz.exe
  2⤵
  PID:15232
- C:\Windows\System\ukGlQnu.exe
  C:\Windows\System\ukGlQnu.exe
  2⤵
  PID:15252
- C:\Windows\System\pHoXprZ.exe
  C:\Windows\System\pHoXprZ.exe
  2⤵
  PID:15272
- C:\Windows\System\xPODSbQ.exe
  C:\Windows\System\xPODSbQ.exe
  2⤵
  PID:14528
- C:\Windows\System\vVnFLSj.exe
  C:\Windows\System\vVnFLSj.exe
  2⤵
  PID:14460
- C:\Windows\System\MndpVeJ.exe
  C:\Windows\System\MndpVeJ.exe
  2⤵
  PID:14568
- C:\Windows\System\grVMJJY.exe
  C:\Windows\System\grVMJJY.exe
  2⤵
  PID:14552
- C:\Windows\System\tdqMXHP.exe
  C:\Windows\System\tdqMXHP.exe
  2⤵
  PID:14516
- C:\Windows\System\wUjDAOa.exe
  C:\Windows\System\wUjDAOa.exe
  2⤵
  PID:14656
- C:\Windows\System\CbWWzwm.exe
  C:\Windows\System\CbWWzwm.exe
  2⤵
  PID:14764
- C:\Windows\System\vocWKhG.exe
  C:\Windows\System\vocWKhG.exe
  2⤵
  PID:15008
- C:\Windows\System\pozYsMb.exe
  C:\Windows\System\pozYsMb.exe
  2⤵
  PID:15140
- C:\Windows\System\cONShKn.exe
  C:\Windows\System\cONShKn.exe
  2⤵
  PID:15224
- C:\Windows\System\hYtidmk.exe
  C:\Windows\System\hYtidmk.exe
  2⤵
  PID:15304
- C:\Windows\System\QMrAVpi.exe
  C:\Windows\System\QMrAVpi.exe
  2⤵
  PID:15344
- C:\Windows\System\shfqXEb.exe
  C:\Windows\System\shfqXEb.exe
  2⤵
  PID:15332
- C:\Windows\System\yxxpAsw.exe
  C:\Windows\System\yxxpAsw.exe
  2⤵
  PID:15320
- C:\Windows\System\UsCnCaa.exe
  C:\Windows\System\UsCnCaa.exe
  2⤵
  PID:692
- C:\Windows\System\owABwPQ.exe
  C:\Windows\System\owABwPQ.exe
  2⤵
  PID:14140
- C:\Windows\System\wWQWkli.exe
  C:\Windows\System\wWQWkli.exe
  2⤵
  PID:14504
- C:\Windows\System\AZNaUcu.exe
  C:\Windows\System\AZNaUcu.exe
  2⤵
  PID:14360
- C:\Windows\System\rOTRqJB.exe
  C:\Windows\System\rOTRqJB.exe
  2⤵
  PID:14396
- C:\Windows\System\esMuTyq.exe
  C:\Windows\System\esMuTyq.exe
  2⤵
  PID:13588
- C:\Windows\System\lEggwTz.exe
  C:\Windows\System\lEggwTz.exe
  2⤵
  PID:1136
- C:\Windows\System\iRsmAwg.exe
  C:\Windows\System\iRsmAwg.exe
  2⤵
  PID:1184
- C:\Windows\System\IARJfGd.exe
  C:\Windows\System\IARJfGd.exe
  2⤵
  PID:14544
- C:\Windows\System\QfNbOHN.exe
  C:\Windows\System\QfNbOHN.exe
  2⤵
  PID:14476
- C:\Windows\System\DrJvuFw.exe
  C:\Windows\System\DrJvuFw.exe
  2⤵
  PID:14664
- C:\Windows\System\RklTbjW.exe
  C:\Windows\System\RklTbjW.exe
  2⤵
  PID:14740
- C:\Windows\System\MVChOjj.exe
  C:\Windows\System\MVChOjj.exe
  2⤵
  PID:14736
- C:\Windows\System\NHYbuyF.exe
  C:\Windows\System\NHYbuyF.exe
  2⤵
  PID:14800
- C:\Windows\System\aBmbhQb.exe
  C:\Windows\System\aBmbhQb.exe
  2⤵
  PID:14752
- C:\Windows\System\jYQMJgZ.exe
  C:\Windows\System\jYQMJgZ.exe
  2⤵
  PID:14868
- C:\Windows\System\qkfqRBp.exe
  C:\Windows\System\qkfqRBp.exe
  2⤵
  PID:892
- C:\Windows\System\FLrryNe.exe
  C:\Windows\System\FLrryNe.exe
  2⤵
  PID:14904
- C:\Windows\System\yVKKfWT.exe
  C:\Windows\System\yVKKfWT.exe
  2⤵
  PID:4092
- C:\Windows\System\TYVqMAX.exe
  C:\Windows\System\TYVqMAX.exe
  2⤵
  PID:15068
- C:\Windows\System\AfEnWfZ.exe
  C:\Windows\System\AfEnWfZ.exe
  2⤵
  PID:1676
- C:\Windows\System\dcFDHvr.exe
  C:\Windows\System\dcFDHvr.exe
  2⤵
  PID:13776
- C:\Windows\System\MHJwnvx.exe
  C:\Windows\System\MHJwnvx.exe
  2⤵
  PID:14500
- C:\Windows\System\efBZxWg.exe
  C:\Windows\System\efBZxWg.exe
  2⤵
  PID:14716
- C:\Windows\System\SdVlzBH.exe
  C:\Windows\System\SdVlzBH.exe
  2⤵
  PID:14804
- C:\Windows\System\TrvOALN.exe
  C:\Windows\System\TrvOALN.exe
  2⤵
  PID:820
- C:\Windows\System\JBFOlyL.exe
  C:\Windows\System\JBFOlyL.exe
  2⤵
  PID:3316
- C:\Windows\System\pjJzxGN.exe
  C:\Windows\System\pjJzxGN.exe
  2⤵
  PID:14808

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:13440

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:14940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:11708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nreue4vh.1hy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AvTVequ.exe

Filesize
1.7MB

MD5
de55a62dbd3f985b94bfd8f1b6a9b4c1

SHA1
1295adfc96629e69fa71847f59dd539dd188da32

SHA256
ae2dc111ff0590cc7e264278ff1de51be6f435382498b8b78cfc1ab7f389e6df

SHA512
11fc24c47aaad15b3619aeb34db4714d52412ee1cb5869c2c979c3d1c450753340b36198243ae4b2b65e17176548fdc906f33e19a7c514337ddb15b7b2f18ef6

Download Submit
C:\Windows\System\FyqdVKk.exe

Filesize
1.7MB

MD5
2f569cd2464751debeee3c6d3c2a00fe

SHA1
a81190ebbccc2f83a35ad1a8ab09136fdb78ac58

SHA256
6cdd58001378d99e6effaeb00c63f475f097736106610313877298b576bb8fc6

SHA512
e5036a7e7e97b8f6676371a5542e7d73b3520077be667dd20015df59a32f5b3b560a307abd04842397f1049b1d455ca71c96548f68f5271f905cb02aafb7479e

Download Submit
C:\Windows\System\HrzAQNC.exe

Filesize
1.7MB

MD5
50b39ae100b7974c87ce0dfefbdf6fb8

SHA1
f5468498b05c3fc7e586ad532c330076a05ebb1b

SHA256
4e85d96a15b77f1ffe9d59961b145493eb1b33c2fa93b15fa0b32c3d83689408

SHA512
d220adc92a34177e3d2c080ea9b3eb9effdb0fc1ed197d5bd231d4aa64af082061b955817d842bdd2d58fd5fd060447d4210871c9ba0fb23d823915d7b58a27b

Download Submit
C:\Windows\System\IGSXVvR.exe

Filesize
1.7MB

MD5
a2fe60e283cfbe17f906d040885255a4

SHA1
381f47295a2f92c1136218333c9e71def4c130cc

SHA256
dc84c44abe5a178d2d3cd76bf8f36a07f543af43bae400b9337d7993d4c7b362

SHA512
8274fb94296f1845278cdd734b61712897313d20dc1b3278afa67ddc73c2bb9ff59ee0b4776d50a65b502c1648f74d9736ae8e488903aa6399f267ee7cd0e3ec

Download Submit
C:\Windows\System\JdaWqVm.exe

Filesize
1.7MB

MD5
ba25df02bca98c23db6cb8959b7468c1

SHA1
48c129bcb8799370ef06ec536b65629813086ab1

SHA256
08337d599090a1dc463357855e250874626bcef77bd66d85b936b2fe6f8ff1e5

SHA512
e1756744c42af028681c476fcf8b0b743f2bd27f194b76140333c74794b5e896b181455f1c85d2108ab8ff05811db6562ecec0f0a68b3336ae1f4c62a4034f31

Download Submit
C:\Windows\System\KxKGGMg.exe

Filesize
1.7MB

MD5
dd34a61156a45974f1042b7af39752f4

SHA1
9755d9e91fe837988561fdb424a601183419dcf0

SHA256
002c1a9591eff7a239a6acad8d0f3a08a7a2407cfad080101c1c601875f2c407

SHA512
2cae0d3297f478eb2e21a5b7fced802f5a7a0ade23951eee313202b707ab1d4f1678b3794de0168c259912b90bab7cf58faa225e7bc10359b8b6dcce5e10d7ad

Download Submit
C:\Windows\System\MejGivc.exe

Filesize
1.7MB

MD5
cc4bba88cdcd0681ee1f7578cee3bcaf

SHA1
1cddc932b2b7542e28776eaf8908f33f8d30b6bd

SHA256
a3d5577d20d61febd8b339e4c8590deb37d7b93b172302c1ddb54787f21a9edd

SHA512
79b1555c35ab04d15103912ae1f7a8337f3656a764801c5f820ea97bfd52ad0538dd235bb569643b7ac533c0f350f2c3db5e90fff58e8392d8a777b46f72cf84

Download Submit
C:\Windows\System\PRcKveu.exe

Filesize
1.7MB

MD5
aa4c276b42186a4453c2816853aba871

SHA1
89e49bee25e715b66e2adad59774e0204ae6846e

SHA256
1d70c3fcca7dce12921bab06245fb76456386093f439ed743419c59706f3fc97

SHA512
1e19a4e9931633b31d03d8ca74d847816476a62b605b53dd7cb3554ae34af688247a45fb9ddaa997fe5c189d7c3f85e3bd863186d53e5d116769ef7e57d546aa

Download Submit
C:\Windows\System\QDdWeUT.exe

Filesize
1.7MB

MD5
e8b88164faba46dab4f841e40b9dabb5

SHA1
cadbfdc611f344b140be195a78b7fb383234465f

SHA256
ade900f7a47b7e0908b9b4c9b416d9d48482f3bce3a4de6c6f4b311de1ec5a03

SHA512
20a8d86d99d35953a7e3b046e6a8b402a93ec63bd82eefe1d9adbab7ec44c094f7a5af2404cbf9e8a5d5eb361f5de90b3e7085c442aaf23fdb65c9fe38ad8fb9

Download Submit
C:\Windows\System\QQwlxwG.exe

Filesize
1.7MB

MD5
dfc34a742fb2c9013877afaef4b259d0

SHA1
a5ccb1b2b77f9f55bbb4cdcb5221831017610532

SHA256
8f68fc77d7a4597760c2a00459bd87fb5d8be0e3746c68c576d959e1f3420a2e

SHA512
5ff2c54c075aa105cd8cdc29739bc6bae2b64663013e04fbc86550d4c24d69d6bdce6d73353d91235c235ef1a038a68592f775d8652f9ca27a8c33baaec432bd

Download Submit
C:\Windows\System\RaXLNoj.exe

Filesize
1.7MB

MD5
4efb3d19396ec05a11e43202cccd298b

SHA1
bcbac44e4dad6b78672db2bdd8dd988525d716b6

SHA256
e6cc98537358c83e38c26961e9bfabeccd4d9c83a2f4b7e6c033f8636f626822

SHA512
44c9334fb0386752a41ed6c1a3ed857380b2069660076dfccd165553dd002a09df107cf879134682dcaab1caf43c422a778ad717bc979677fe9ba44e43006b57

Download Submit
C:\Windows\System\RlPVOVm.exe

Filesize
1.7MB

MD5
0b87b63a0bf410c8b125d6707d6b6fad

SHA1
384161b4b3712692d70da1cd9a80b5450cf15ecf

SHA256
b1b3363b97708f03281f7d47fcb4009a7cbef4422d094151b24f2cdb42df1f9a

SHA512
005d3f66c69773bf96e03436ec908b3b31ef5102415d2d062f50c61a84e48a0112a0579ce5315db16d6c74b80951ef4b8f438a23f934108f18b63c57a77e0837

Download Submit
C:\Windows\System\SkfngkZ.exe

Filesize
1.7MB

MD5
154a412127cd281143b9ee5d628ea197

SHA1
02f00cc24bc692035d8dd9a1e27a541eb324da70

SHA256
a287c7d7cc7623ec0cd1230f7c151930990a69da7b6e5dccf1d01bf5810e00f6

SHA512
8c9f1d99c82e81eea730693156b092aeada53469bf7bfe2cc9b72c2ee1b91b51dc56ca181c807de98c5443a6e779f3559c44a97802c7f6d250f7c2310b8b4c1b

Download Submit
C:\Windows\System\UMsFxNf.exe

Filesize
1.7MB

MD5
8234f1176a0ee344a0a4692765969ee1

SHA1
de96d629f0d377694c7497d3ae04345e8bac5632

SHA256
84f2222cea75c1898ca1c2e53e28e7d345408a0e7c523d42cd9aca94b3fc56a8

SHA512
8499bfa657a92c942d0be71b6cdba17d7837e772a625596f2e0c9e8a7dd21477d0b2f05da08777332f4f7fd5af6d0428d74779cc273a344da182ae00faf5bd5a

Download Submit
C:\Windows\System\UQKNkCP.exe

Filesize
1.7MB

MD5
df469af210629882f2285be554a820a5

SHA1
d743bf7c114fbf5286b181f756c71d765a782e64

SHA256
e3ea40a95eb31e673291a0d681b5d673726bfb35ac85bc0c3d0c81a02476c3f5

SHA512
01580e4ac41d45a0d9997a5391f4c335980a45259f30fd877ed9f7eddc52a7840012a06abbd4cde1f7cd5d7d4cbe53ce5994984a027ad9089aa12f7b4465152b

Download Submit
C:\Windows\System\UplyAmc.exe

Filesize
1.7MB

MD5
99210704d8ccfefa16445c527ccddd80

SHA1
716e99831d3ec728437efb923a1d8e80167bf9cc

SHA256
123ace5a5331e1bcbb5013c9cffc1f3efce20ddd04258b93bb6df95bbe606617

SHA512
2852ecc5d5d8bfa8ff11bba6e500d13ecee3bbdcb771afe8afee90bbd1ca1ea82b8f902858e64792b52a15c12fa7829b04f5c37837a36ea3baea15864f1b2997

Download Submit
C:\Windows\System\VLuUJNn.exe

Filesize
1.7MB

MD5
d0db30b5d6ff4a4b245aa8bc92f0c280

SHA1
b68211640be31bcd2b039db744e51f598b57a5b9

SHA256
b004d07965716f93a0d4476a786d48b3e7f138f45e96e5bfd7b2636ee0601533

SHA512
b0e7105841ce756d0c506b5b6f4cccd9ea5a7d00bcb132fd2fb3ce593ed5fa4448d940ff91be317c7d08401c28f50afda76e3efd99a97f497a6b4d87e9f89903

Download Submit
C:\Windows\System\YQVXBqv.exe

Filesize
1.7MB

MD5
223310bb54ae73323e5efe678e86e697

SHA1
94e6bfc74fef1a980abbebd0777174c11f5673ff

SHA256
93e4fdd2b748ad693ff8d9d32acc4ea8b1cc995d97c85e8e126124682f5d44ff

SHA512
ac645de5fd6c9808a527352bcf4439f3d4deb2ba0a08b30cc7eab4e4644152695762db0c129af04c5b6909f5e3498d0a0bc1d45a657de158d681939b3daf410c

Download Submit
C:\Windows\System\bFQNTFz.exe

Filesize
1.7MB

MD5
48f5c87d505a6ee0e54f03921f56dd7e

SHA1
ef1db536b2c00481b25676c55cbf2d9f4b7f449b

SHA256
0d9bc5e1e2a608f75ab08740d97bfd2673827d20d83f223ac9e13575de8a386f

SHA512
7ccbed435f5b31f7aedd10f1d807f10a13a9690fb96d675769aa109b25be9343ec0b36374de85bd3c264ff42a1f9370f2b2686f58f385f67fb047ce98577012c

Download Submit
C:\Windows\System\dWJSnrg.exe

Filesize
1.7MB

MD5
cecd96036666325147d247358b0398a0

SHA1
940e8cc3904bd2fb5d5483a810dbb5673df7d162

SHA256
5a35c86d833d71169cfb5c6704c26a8ee85c824514b025e29d38de0a4fa8004d

SHA512
f5c46f66b420a9ca8c70b2ecd613979128686515c72dabc1e889e2216f260369b9ed57100681bed9eead1f0eae09e88f880753687e7be24df945baf1272e0ade

Download Submit
C:\Windows\System\dnHcjQg.exe

Filesize
1.7MB

MD5
256681bd36f613205e065bdd6afa87f3

SHA1
61a731bff444a21664ec62cbc453bb1ae8202d55

SHA256
da3bd0c9e0cde8775286402572e59eedb70836ef650634ba77e46abc017bb86b

SHA512
bb4721c858f93cccbdbf8122cf64e82a4960bc48fd9fe0d32165c87117f9bec3f0a85a4f8b728febf4f0b721ad15e1c855d7440a4cee506099fbda48a0bfbdda

Download Submit
C:\Windows\System\eNIwawA.exe

Filesize
1.7MB

MD5
1b23196558115d453491c3c203427d0a

SHA1
48865429c83887cb72adad402ecf7789b88aa463

SHA256
3099921be8256b80e7e675f4085aad851b8400229bfb0fc41bff37ff4db21f7f

SHA512
8471a9eef4634bec5cd901d238fa774766b0698218a718d5ad36c3721e35552a12dc0b44b97596ac3595c795aea97c29303ae948b9113b45f1d04123e52808c4

Download Submit
C:\Windows\System\eXQZLwm.exe

Filesize
1.7MB

MD5
f4dba1451be245376ac471dfcc39dff1

SHA1
3e5b1e2874afd0afd757041bcac6c2e146247452

SHA256
45f707dddd3ffd6f4d7f032d7a2e00b387b4729e10ca88d9ae8aa7cbd023528f

SHA512
b7a1c8dfc71c6d25cd06f12101683a7ca393c648f4f6aa842444fe5b374f4a7802b320e1a4d7a09c5a2c6d2a79d2dd76ad8b9ee43497beefb16a3e9e2cae3adb

Download Submit
C:\Windows\System\gXIkmGo.exe

Filesize
1.7MB

MD5
4542711521fc7cfe86fc4d40c8172e40

SHA1
113349b65a224437c152dcefcd97278aff10fc35

SHA256
87dfbc977479dc0214e8a1f50755d1979f5ebb24cec791d766f7cb541205f71b

SHA512
30baa3eca93890b9b37203e0773a8b53998cd5334c729e4b08198a60af0844e368ed44537680f1ac3cde46e434b7ae73f59cd769701bb48d2baefec6c50ba787

Download Submit
C:\Windows\System\gonqDad.exe

Filesize
1.7MB

MD5
1bbbcfba3b4785e7596506ff4ea485f6

SHA1
151ebc331aadf6a30ad028f752bda0f0f3294514

SHA256
63b6874181b837fd5b16f6edf07f04c9726ba2b2023b55ea65981851bb202808

SHA512
be4def13d0c5430a02e032fecb11e532a7c934d9b639e5958ea719c7c35e37b1908f7ecb515c947405f795402ca51ae7d8c5eb4ad9ecd235f99a2ca8ecff38fd

Download Submit
C:\Windows\System\kZnjMwq.exe

Filesize
1.7MB

MD5
ee4a4007020945575a688a55ebbf7e6c

SHA1
c7fc4d63e6ec47502de32c12c27f9c365968dc3e

SHA256
16a051ebb1b7bcb0920bfc65029f3a2dc989f8de776b730231ec26f094902edd

SHA512
83df63c8d36377f442e703c1ef2dcc5933ba732227c37b92c515c8911f89d1a65eca73b7ce96435d996a6d6f294e0987ec35eb4665a55ea6e734324b9b2e4d70

Download Submit
C:\Windows\System\lCOdCiI.exe

Filesize
1.7MB

MD5
5f72cdf7024cd646fcb06c3948b9fc28

SHA1
39818ee6c7adbfc40eafd572092e5eb8ad015fe3

SHA256
57568bb0cbd7df26b75c7cd316db74b18fbca26847ba2ca218ddae4252b3795e

SHA512
0d4535bcc131bfb2600bbf372c793f9f3be1db8a72cbac25e06c34df5b415f1f0d58497163010e272913575bc8a9f4d0bfa8486a7237fa7fd0140997af6f1861

Download Submit
C:\Windows\System\mtehetf.exe

Filesize
1.7MB

MD5
e9bd078ad186b4e2a4f8d0db6e17d97f

SHA1
a1b801b6670674741909d081fa1847ff4fa48c79

SHA256
fa6e187e5ef860e0ce70c7b0115d2281aa07d80fac40ad83504090d5ebbeb999

SHA512
16e63ae90073c13ab1989cc6a914e994bcd48abd262a41220cf00ecb2ff42eaed930ac931cbb9453d7b36f828395f0610215841f92563efbf5f5ec9cf6ccc5ed

Download Submit
C:\Windows\System\mxyhKnj.exe

Filesize
1.7MB

MD5
a7db911f4cebc668de7a5a147ae1f884

SHA1
24e1824e70c2955e6e2d2c330a2914cdac6e8e70

SHA256
6a2ee00be02886a4e8064a434102dc6405865aeb23378e5fa97a3e50a8ed0170

SHA512
8cf6c5f344ca7e3604b07cb0be99800fc6f9f63b9d9b21e3d55d73086a6415e05b28863dedfdadcbdab3724121d5e413546d8b95824e073e032cddf3f5962b23

Download Submit
C:\Windows\System\nRUwykf.exe

Filesize
1.7MB

MD5
01a835e2fbe360cdc0867687d6a0164c

SHA1
282e0c935ae256081dc43688fb0f6b972ef06eb5

SHA256
d227a4c75ff17d3355240904ed75a32db5f24839c0beaa242a68b371bdd8c1cb

SHA512
124092211bb8165abfd79be0b3561e27d97528e80193a4daafd439b1ce0279f802ba3fbe4609fd84e757ff3dfa813a6de5f6b71d5956cf4eca408bf42d92470f

Download Submit
C:\Windows\System\oZKgSWN.exe

Filesize
1.7MB

MD5
5ca4f6f564727dae62c1a4eddd1cb4cb

SHA1
0c5847b71e66e7840bbc4eda205ed465d132c377

SHA256
a0009d397819004a15b4ae6d0b0f7029db6a432cd5fb84964331e330ac1b415a

SHA512
746e505b671d92c30f58522db1bc92227f2d69701dbac22ef49a8dd46eb38c56349d264c75dec147f0e07c856d6ac557126dc59fe7df9028e5ca5fead8c35c1f

Download Submit
C:\Windows\System\ooOZXga.exe

Filesize
1.7MB

MD5
311d68633e27bdcff9f8dc42a6ab6309

SHA1
47158a09f37dd7237da1457e2df3edda20d5da9c

SHA256
5d3a394bedea3395def57e17e931c27ee2fa2eaada87c1a923400459546e9f7d

SHA512
19cedef59dd33bef9df43aae163e91b4b63f30663ad42e0bcd98f73b0bd07921e8c3e3e6601f09b26fea46ede746c4592072b658aedf604de7ac371b1e5a4443

Download Submit
C:\Windows\System\uHLiGzX.exe

Filesize
1.7MB

MD5
f8928f2e9309a021929e6420ffa3c06b

SHA1
c7e5e982e0d43f77867fd645d0f630630cb3db82

SHA256
b502eaec2bb8f4b960c57639a029296110c7ab4c024c1647edbeeb23797bab8e

SHA512
f2d0251eb502d433c613cefd59e1e5077a4ad607f1b3cf1ae82b3a08fa9b340df31238df46a9f6b1b54115cd9db47b115c63a03ac6a60ea4bc637a1acdd5b0c6

Download Submit
C:\Windows\System\usFUdgY.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\System\vaeICjZ.exe

Filesize
1.7MB

MD5
faa114b9fdf2a97a58706c927505be72

SHA1
3b034dde9dc4d1405f46c3f20d3a2b352913e66e

SHA256
e73e40587ebf0fc782b4a2277d091623b6ebd50cb3028e728b6e854cd57fcfca

SHA512
49da1ab3d348aeb8ef87fb27644e3f875876dab9e7e6847d053b556233d5625e835f89d9e1307b18d5e6452751d8f0d525ddcfde25face4aafaafa59586fd758

Download Submit
C:\Windows\System\vtLfeUj.exe

Filesize
1.7MB

MD5
b7b8b810f0847727ccfb62ea88eac9f1

SHA1
5a427b4002349700a2388a4d9908510ec62782f4

SHA256
8b64d6a216970d8c4654c636e1a708f568c29b5706a549a4be05a99b8bb81923

SHA512
c7306e1e2014c1d39cfbaf3b7180a2d1e7edd60d9553cdfbe513a1d226b30e3d068a730a4f23e8109336d3cf3235ba35093a0a8e52abd4bd0ea09c0563ecb623

Download Submit
C:\Windows\System\xAvmDHE.exe

Filesize
1.7MB

MD5
dbd15e15388d751e9e13b35fc5edbdfd

SHA1
62b52ba7e361509da06779c63e4a3c470d735d4a

SHA256
90ce08bb024b28ae031848c82f3723df48b571c57ff56730747f7ca97596308b

SHA512
627f7e4af5c783a7d87bcd10e3e66ab0802a5d5709a47d1c3d10a572752b2358c8475037fd223f6b448dfc983c0585f283bd0bcccf3d8170b92c3118ae5814fe

Download Submit
C:\Windows\System\xJSNQcz.exe

Filesize
1.7MB

MD5
f33ce458d0dd7ce146ca3eece29a5706

SHA1
b98dfb4a5f2ce901012ceaef19ad811985933d5a

SHA256
bd536767ca93f68683610847f704fcdccac8d070f14f6829e888f37df12330e5

SHA512
5ddbc6110e188e9809125f921585d46ceda28282c0308657a46fce3b5ad6d8cc8e10265c0399e01949c9520a4c8dc08016518a30f3883337967cd31e2fb67914

Download Submit
C:\Windows\System\zZnXyqU.exe

Filesize
1.7MB

MD5
319a8e4fc979e471c9af5f19db1d6e60

SHA1
1adae23fe25763947b8ebd223758de8ff0d13f34

SHA256
07713b4262d86f671863735867104c01b264405312468b1db2386961fe5529c6

SHA512
7933c1145a07931994720e153b03ee5170bee8e9de42172f4f661c9cbab1b746664dd3967dcc7af0535b1fb6d2b8db313b273350d6da48176abf09d032cfdcbe

Download Submit
C:\Windows\System\zfXpbDv.exe

Filesize
1.7MB

MD5
ec0197c45a1caa3bca72579cecf3a6a6

SHA1
2a11d6aa8f3d09f26abcd6df0f3614f6743fd42d

SHA256
23c3badb326462d65fc794d3705b2706d8cf80dde523b52797cbea021c8f19d8

SHA512
0904a2f0e0b62a7a01bc395f22404ed4f59e1a7afd668ca2dc9b1ade60480c962e6b36354c39502b5e8749e4d6799880972aca06469028707e2afa6b5c30653e

Download Submit
memory/64-470-0x00007FF69D630000-0x00007FF69DA22000-memory.dmp

Filesize
3.9MB

Download
memory/1132-116-0x00007FF699500000-0x00007FF6998F2000-memory.dmp

Filesize
3.9MB

Download
memory/1484-338-0x00007FF6D3200000-0x00007FF6D35F2000-memory.dmp

Filesize
3.9MB

Download
memory/1504-396-0x00007FF656070000-0x00007FF656462000-memory.dmp

Filesize
3.9MB

Download
memory/1608-475-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Filesize
10.8MB

Download
memory/1608-5-0x00007FFA94B33000-0x00007FFA94B35000-memory.dmp

Filesize
8KB

Download
memory/1608-2360-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Filesize
10.8MB

Download
memory/1608-49-0x000001F0F14F0000-0x000001F0F1512000-memory.dmp

Filesize
136KB

Download
memory/1608-40-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Filesize
10.8MB

Download
memory/1664-269-0x00007FF6E5F40000-0x00007FF6E6332000-memory.dmp

Filesize
3.9MB

Download
memory/1768-472-0x00007FF7A3340000-0x00007FF7A3732000-memory.dmp

Filesize
3.9MB

Download
memory/1824-293-0x00007FF6DCC00000-0x00007FF6DCFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-456-0x00007FF79AFB0000-0x00007FF79B3A2000-memory.dmp

Filesize
3.9MB

Download
memory/2016-393-0x00007FF676E70000-0x00007FF677262000-memory.dmp

Filesize
3.9MB

Download
memory/2376-213-0x00007FF61A4C0000-0x00007FF61A8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2524-242-0x00007FF740B40000-0x00007FF740F32000-memory.dmp

Filesize
3.9MB

Download
memory/2604-75-0x00007FF603E90000-0x00007FF604282000-memory.dmp

Filesize
3.9MB

Download
memory/2796-256-0x00007FF63DE70000-0x00007FF63E262000-memory.dmp

Filesize
3.9MB

Download
memory/2980-469-0x00007FF7F57A0000-0x00007FF7F5B92000-memory.dmp

Filesize
3.9MB

Download
memory/3232-158-0x00007FF6FEEE0000-0x00007FF6FF2D2000-memory.dmp

Filesize
3.9MB

Download
memory/3496-473-0x00007FF7E9C20000-0x00007FF7EA012000-memory.dmp

Filesize
3.9MB

Download
memory/3852-471-0x00007FF779230000-0x00007FF779622000-memory.dmp

Filesize
3.9MB

Download
memory/3880-474-0x00007FF7C04E0000-0x00007FF7C08D2000-memory.dmp

Filesize
3.9MB

Download
memory/4048-69-0x00007FF600E20000-0x00007FF601212000-memory.dmp

Filesize
3.9MB

Download
memory/4064-477-0x00007FF73FB80000-0x00007FF73FF72000-memory.dmp

Filesize
3.9MB

Download
memory/4228-476-0x00007FF610640000-0x00007FF610A32000-memory.dmp

Filesize
3.9MB

Download
memory/4356-0-0x00007FF7762A0000-0x00007FF776692000-memory.dmp

Filesize
3.9MB

Download
memory/4356-1-0x000001A7B10A0000-0x000001A7B10B0000-memory.dmp

Filesize
64KB

Download
memory/4356-3782-0x00007FF7762A0000-0x00007FF776692000-memory.dmp

Filesize
3.9MB

Download
memory/4652-478-0x00007FF6B9520000-0x00007FF6B9912000-memory.dmp

Filesize
3.9MB

Download
memory/4824-468-0x00007FF64D310000-0x00007FF64D702000-memory.dmp

Filesize
3.9MB

Download
memory/4944-371-0x00007FF61B770000-0x00007FF61BB62000-memory.dmp

Filesize
3.9MB

Download