xmrig | 5004974953a77156cc5c39d1081b9e26b21621c2be3fba4baf83086f2549cb3d

Analysis

max time kernel
121s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 21:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
Size

1.6MB
MD5

6a9b7b933ed09b8e2398757812360f30
SHA1

b19163ba5515018d283fcad3eebd3d20e565d7d3
SHA256

5004974953a77156cc5c39d1081b9e26b21621c2be3fba4baf83086f2549cb3d
SHA512

2e0bce1b249fefc795972d3c13fdf22be89f15eaa54f916ca648645f4e984507f1e8e1741e77d9c495597c12a0b73a938bd90c00d593ef2c49d7a906c99f1877
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoz5XdUK6S1uBkr5GqlfiQzf0Y098ds:Lz071uv4BPMkHC0I6Gz3N1pHVfyH1d

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/5040-237-0x00007FF734890000-0x00007FF734C82000-memory.dmp	xmrig
behavioral2/memory/760-259-0x00007FF7B99A0000-0x00007FF7B9D92000-memory.dmp	xmrig
behavioral2/memory/2232-283-0x00007FF6FFF00000-0x00007FF7002F2000-memory.dmp	xmrig
behavioral2/memory/4484-483-0x00007FF72A0F0000-0x00007FF72A4E2000-memory.dmp	xmrig
behavioral2/memory/1172-454-0x00007FF6DCE50000-0x00007FF6DD242000-memory.dmp	xmrig
behavioral2/memory/4552-507-0x00007FF7570E0000-0x00007FF7574D2000-memory.dmp	xmrig
behavioral2/memory/4632-512-0x00007FF6B3C30000-0x00007FF6B4022000-memory.dmp	xmrig
behavioral2/memory/1308-513-0x00007FF7FAEA0000-0x00007FF7FB292000-memory.dmp	xmrig
behavioral2/memory/4428-510-0x00007FF6195A0000-0x00007FF619992000-memory.dmp	xmrig
behavioral2/memory/4848-509-0x00007FF6F4630000-0x00007FF6F4A22000-memory.dmp	xmrig
behavioral2/memory/2280-508-0x00007FF6912A0000-0x00007FF691692000-memory.dmp	xmrig
behavioral2/memory/1860-506-0x00007FF6BA930000-0x00007FF6BAD22000-memory.dmp	xmrig
behavioral2/memory/4872-505-0x00007FF7A70C0000-0x00007FF7A74B2000-memory.dmp	xmrig
behavioral2/memory/348-504-0x00007FF7A72C0000-0x00007FF7A76B2000-memory.dmp	xmrig
behavioral2/memory/3816-503-0x00007FF744330000-0x00007FF744722000-memory.dmp	xmrig
behavioral2/memory/4396-502-0x00007FF6EF8A0000-0x00007FF6EFC92000-memory.dmp	xmrig
behavioral2/memory/4324-418-0x00007FF7B9D50000-0x00007FF7BA142000-memory.dmp	xmrig
behavioral2/memory/3100-355-0x00007FF73F6F0000-0x00007FF73FAE2000-memory.dmp	xmrig
behavioral2/memory/5112-331-0x00007FF611260000-0x00007FF611652000-memory.dmp	xmrig
behavioral2/memory/532-302-0x00007FF69F170000-0x00007FF69F562000-memory.dmp	xmrig
behavioral2/memory/4840-184-0x00007FF732340000-0x00007FF732732000-memory.dmp	xmrig
behavioral2/memory/2504-21-0x00007FF650FC0000-0x00007FF6513B2000-memory.dmp	xmrig
behavioral2/memory/2080-3750-0x00007FF787140000-0x00007FF787532000-memory.dmp	xmrig
behavioral2/memory/4784-3752-0x00007FF6021A0000-0x00007FF602592000-memory.dmp	xmrig
behavioral2/memory/2504-3768-0x00007FF650FC0000-0x00007FF6513B2000-memory.dmp	xmrig
behavioral2/memory/4428-3770-0x00007FF6195A0000-0x00007FF619992000-memory.dmp	xmrig
behavioral2/memory/2080-3772-0x00007FF787140000-0x00007FF787532000-memory.dmp	xmrig
behavioral2/memory/4632-3774-0x00007FF6B3C30000-0x00007FF6B4022000-memory.dmp	xmrig
behavioral2/memory/4784-3780-0x00007FF6021A0000-0x00007FF602592000-memory.dmp	xmrig
behavioral2/memory/1308-3782-0x00007FF7FAEA0000-0x00007FF7FB292000-memory.dmp	xmrig
behavioral2/memory/5040-3786-0x00007FF734890000-0x00007FF734C82000-memory.dmp	xmrig
behavioral2/memory/4324-3784-0x00007FF7B9D50000-0x00007FF7BA142000-memory.dmp	xmrig
behavioral2/memory/2232-3777-0x00007FF6FFF00000-0x00007FF7002F2000-memory.dmp	xmrig
behavioral2/memory/4840-3778-0x00007FF732340000-0x00007FF732732000-memory.dmp	xmrig
behavioral2/memory/532-3819-0x00007FF69F170000-0x00007FF69F562000-memory.dmp	xmrig
behavioral2/memory/760-3813-0x00007FF7B99A0000-0x00007FF7B9D92000-memory.dmp	xmrig
behavioral2/memory/4396-3807-0x00007FF6EF8A0000-0x00007FF6EFC92000-memory.dmp	xmrig
behavioral2/memory/1860-3802-0x00007FF6BA930000-0x00007FF6BAD22000-memory.dmp	xmrig
behavioral2/memory/4552-3800-0x00007FF7570E0000-0x00007FF7574D2000-memory.dmp	xmrig
behavioral2/memory/4484-3794-0x00007FF72A0F0000-0x00007FF72A4E2000-memory.dmp	xmrig
behavioral2/memory/4872-3792-0x00007FF7A70C0000-0x00007FF7A74B2000-memory.dmp	xmrig
behavioral2/memory/5112-3815-0x00007FF611260000-0x00007FF611652000-memory.dmp	xmrig
behavioral2/memory/3816-3825-0x00007FF744330000-0x00007FF744722000-memory.dmp	xmrig
behavioral2/memory/3100-3811-0x00007FF73F6F0000-0x00007FF73FAE2000-memory.dmp	xmrig
behavioral2/memory/1172-3809-0x00007FF6DCE50000-0x00007FF6DD242000-memory.dmp	xmrig
behavioral2/memory/348-3805-0x00007FF7A72C0000-0x00007FF7A76B2000-memory.dmp	xmrig
behavioral2/memory/2280-3798-0x00007FF6912A0000-0x00007FF691692000-memory.dmp	xmrig
behavioral2/memory/4848-3796-0x00007FF6F4630000-0x00007FF6F4A22000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4356	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2504	HyJrJzB.exe
4428	EWQYZKx.exe
2080	WsLwvUB.exe
4784	LpjtCcv.exe
4632	gHfGVfP.exe
4840	nQKUAZj.exe
5040	bGdJVJb.exe
760	RXDYSIf.exe
1308	XKciiLV.exe
2232	tulCmwF.exe
532	gciVENE.exe
5112	JCyXSzW.exe
3100	xoCusTJ.exe
4324	cADQcil.exe
1172	nYgAYSp.exe
4484	bKLpkVW.exe
4396	wQTfuHp.exe
3816	wfCPDwA.exe
348	dgChxFt.exe
4872	hBodIVS.exe
1860	fWWCMLD.exe
4552	gvqSapK.exe
2280	JghfOLj.exe
4848	gAKbDBx.exe
5092	TaurMkG.exe
956	TkuPPmO.exe
4732	YYCvKjT.exe
2996	jdGdlQr.exe
3888	EmkoBdq.exe
4860	aXUiHlU.exe
5076	TlzCHNQ.exe
4896	rSjSVvg.exe
1780	tFZcTfE.exe
228	vnZEkXh.exe
3592	xPlQtMP.exe
4688	hMkXgpi.exe
4256	zVtNwwy.exe
1580	JhPoiAR.exe
1920	beDxqUP.exe
4076	bxUCAgI.exe
452	ZRkmClK.exe
2224	ppCcCJa.exe
3180	qpCfZGg.exe
4372	shlVRdi.exe
1948	wBkGaiU.exe
2468	ffGDZmQ.exe
1852	iNRAETy.exe
4400	KotzGYO.exe
4820	wfPfGbH.exe
2516	ZngnBoG.exe
1548	WARtHWm.exe
4984	eQwvXJa.exe
1532	wRGiMLo.exe
4392	CIsiJzb.exe
2476	krDaFNO.exe
728	sWZsSHC.exe
4612	ukUASDw.exe
1056	mQROztJ.exe
3976	hDptIES.exe
2332	CysGgkz.exe
4892	BrxfZiU.exe
4212	UwvcDUJ.exe
4312	ZaJoSSC.exe
3920	jnNXfse.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2916-0-0x00007FF775370000-0x00007FF775762000-memory.dmp	upx
behavioral2/files/0x00090000000233f3-5.dat	upx
behavioral2/files/0x00070000000233fd-18.dat	upx
behavioral2/files/0x00070000000233fe-45.dat	upx
behavioral2/files/0x0007000000023405-52.dat	upx
behavioral2/files/0x0007000000023403-73.dat	upx
behavioral2/files/0x0007000000023414-179.dat	upx
behavioral2/memory/5040-237-0x00007FF734890000-0x00007FF734C82000-memory.dmp	upx
behavioral2/memory/760-259-0x00007FF7B99A0000-0x00007FF7B9D92000-memory.dmp	upx
behavioral2/memory/2232-283-0x00007FF6FFF00000-0x00007FF7002F2000-memory.dmp	upx
behavioral2/memory/4484-483-0x00007FF72A0F0000-0x00007FF72A4E2000-memory.dmp	upx
behavioral2/memory/1172-454-0x00007FF6DCE50000-0x00007FF6DD242000-memory.dmp	upx
behavioral2/memory/4552-507-0x00007FF7570E0000-0x00007FF7574D2000-memory.dmp	upx
behavioral2/memory/4632-512-0x00007FF6B3C30000-0x00007FF6B4022000-memory.dmp	upx
behavioral2/memory/1308-513-0x00007FF7FAEA0000-0x00007FF7FB292000-memory.dmp	upx
behavioral2/memory/4428-510-0x00007FF6195A0000-0x00007FF619992000-memory.dmp	upx
behavioral2/memory/4848-509-0x00007FF6F4630000-0x00007FF6F4A22000-memory.dmp	upx
behavioral2/memory/2280-508-0x00007FF6912A0000-0x00007FF691692000-memory.dmp	upx
behavioral2/memory/1860-506-0x00007FF6BA930000-0x00007FF6BAD22000-memory.dmp	upx
behavioral2/memory/4872-505-0x00007FF7A70C0000-0x00007FF7A74B2000-memory.dmp	upx
behavioral2/memory/348-504-0x00007FF7A72C0000-0x00007FF7A76B2000-memory.dmp	upx
behavioral2/memory/3816-503-0x00007FF744330000-0x00007FF744722000-memory.dmp	upx
behavioral2/memory/4396-502-0x00007FF6EF8A0000-0x00007FF6EFC92000-memory.dmp	upx
behavioral2/memory/4324-418-0x00007FF7B9D50000-0x00007FF7BA142000-memory.dmp	upx
behavioral2/memory/3100-355-0x00007FF73F6F0000-0x00007FF73FAE2000-memory.dmp	upx
behavioral2/memory/5112-331-0x00007FF611260000-0x00007FF611652000-memory.dmp	upx
behavioral2/memory/532-302-0x00007FF69F170000-0x00007FF69F562000-memory.dmp	upx
behavioral2/files/0x0007000000023422-198.dat	upx
behavioral2/files/0x0007000000023421-195.dat	upx
behavioral2/files/0x0007000000023416-193.dat	upx
behavioral2/files/0x0007000000023420-192.dat	upx
behavioral2/files/0x000700000002340c-171.dat	upx
behavioral2/files/0x000700000002341d-168.dat	upx
behavioral2/files/0x0007000000023412-167.dat	upx
behavioral2/files/0x0007000000023410-159.dat	upx
behavioral2/files/0x000700000002340f-155.dat	upx
behavioral2/files/0x000700000002340e-152.dat	upx
behavioral2/files/0x000700000002341e-190.dat	upx
behavioral2/memory/4840-184-0x00007FF732340000-0x00007FF732732000-memory.dmp	upx
behavioral2/files/0x000700000002340d-145.dat	upx
behavioral2/files/0x000700000002341c-144.dat	upx
behavioral2/files/0x0007000000023415-143.dat	upx
behavioral2/files/0x000700000002341b-142.dat	upx
behavioral2/files/0x000700000002341a-141.dat	upx
behavioral2/files/0x000700000002340b-136.dat	upx
behavioral2/files/0x0007000000023417-135.dat	upx
behavioral2/files/0x0007000000023411-163.dat	upx
behavioral2/files/0x0007000000023413-121.dat	upx
behavioral2/files/0x0007000000023406-117.dat	upx
behavioral2/files/0x000700000002340a-115.dat	upx
behavioral2/files/0x0007000000023409-113.dat	upx
behavioral2/files/0x0007000000023407-131.dat	upx
behavioral2/files/0x0007000000023402-96.dat	upx
behavioral2/files/0x0007000000023408-81.dat	upx
behavioral2/files/0x0007000000023404-66.dat	upx
behavioral2/files/0x0007000000023400-58.dat	upx
behavioral2/files/0x0007000000023401-64.dat	upx
behavioral2/files/0x00070000000233ff-30.dat	upx
behavioral2/memory/4784-40-0x00007FF6021A0000-0x00007FF602592000-memory.dmp	upx
behavioral2/memory/2080-26-0x00007FF787140000-0x00007FF787532000-memory.dmp	upx
behavioral2/memory/2504-21-0x00007FF650FC0000-0x00007FF6513B2000-memory.dmp	upx
behavioral2/files/0x00070000000233fc-14.dat	upx
behavioral2/memory/2080-3750-0x00007FF787140000-0x00007FF787532000-memory.dmp	upx
behavioral2/memory/4784-3752-0x00007FF6021A0000-0x00007FF602592000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RlchHTH.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\TLuPLDR.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\LioZimE.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\UMrgTsj.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\XBebaCG.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\ZYrKyoC.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\sypVnZJ.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\wglZzhx.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\pLaydyz.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\uNHEgbk.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\zHfoFxl.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\sIlrLFL.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\exnTYbs.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\BnXylYC.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\iPshfVQ.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\ujfIWJO.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\oATcLWD.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\fwvavgM.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\OsKiJCM.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\RkZTSVn.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\WtsvISE.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\qWxGkBx.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\ZkIjHWq.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\VLsXQpt.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\RHGttxz.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\HFyfYgR.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\uWSEcan.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\fpnDKGl.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\sbuebqb.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\LIEenui.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\JkWGAxZ.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\VLHudEF.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\loWbCcd.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\YhpaPBA.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\fzlnxbN.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\ecEzrZu.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\nplEqFe.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\efGzbjN.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\HookdAT.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\iXSMoOz.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\UhSbtrK.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\gwOtDyj.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\wMUtoUM.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\LryFiLi.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\HADzpOy.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\xdMXGOg.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\NGqnaoV.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\fDWuGsD.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\WnGwZAV.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\wZlWEKn.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\kzqXeDP.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\dGtqLTM.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\EONWdHl.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\KQzjYea.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\fmXxFVm.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\sfjyLOg.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\bpYXVBe.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\dQKwAGx.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\cKRlVpE.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\qNLzpzD.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\GmiXrYn.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\oIelobA.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\ASrOrJF.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
File created	C:\Windows\System\shznkwZ.exe	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeLockMemoryPrivilege	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 4356	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	84
PID 2916 wrote to memory of 4356	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	84
PID 2916 wrote to memory of 2504	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	85
PID 2916 wrote to memory of 2504	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	85
PID 2916 wrote to memory of 4428	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	86
PID 2916 wrote to memory of 4428	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	86
PID 2916 wrote to memory of 2080	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	87
PID 2916 wrote to memory of 2080	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	87
PID 2916 wrote to memory of 4784	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	88
PID 2916 wrote to memory of 4784	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	88
PID 2916 wrote to memory of 4632	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	89
PID 2916 wrote to memory of 4632	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	89
PID 2916 wrote to memory of 4840	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	90
PID 2916 wrote to memory of 4840	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	90
PID 2916 wrote to memory of 5040	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	91
PID 2916 wrote to memory of 5040	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	91
PID 2916 wrote to memory of 760	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	92
PID 2916 wrote to memory of 760	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	92
PID 2916 wrote to memory of 1308	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	93
PID 2916 wrote to memory of 1308	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	93
PID 2916 wrote to memory of 2232	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	94
PID 2916 wrote to memory of 2232	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	94
PID 2916 wrote to memory of 532	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	95
PID 2916 wrote to memory of 532	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	95
PID 2916 wrote to memory of 5112	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	96
PID 2916 wrote to memory of 5112	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	96
PID 2916 wrote to memory of 3100	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	97
PID 2916 wrote to memory of 3100	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	97
PID 2916 wrote to memory of 4324	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	98
PID 2916 wrote to memory of 4324	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	98
PID 2916 wrote to memory of 1172	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	99
PID 2916 wrote to memory of 1172	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	99
PID 2916 wrote to memory of 4484	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	100
PID 2916 wrote to memory of 4484	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	100
PID 2916 wrote to memory of 4396	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	101
PID 2916 wrote to memory of 4396	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	101
PID 2916 wrote to memory of 3816	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	102
PID 2916 wrote to memory of 3816	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	102
PID 2916 wrote to memory of 348	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	103
PID 2916 wrote to memory of 348	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	103
PID 2916 wrote to memory of 4872	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	104
PID 2916 wrote to memory of 4872	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	104
PID 2916 wrote to memory of 1860	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	105
PID 2916 wrote to memory of 1860	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	105
PID 2916 wrote to memory of 4552	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	106
PID 2916 wrote to memory of 4552	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	106
PID 2916 wrote to memory of 2280	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	107
PID 2916 wrote to memory of 2280	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	107
PID 2916 wrote to memory of 4848	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	108
PID 2916 wrote to memory of 4848	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	108
PID 2916 wrote to memory of 5092	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	109
PID 2916 wrote to memory of 5092	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	109
PID 2916 wrote to memory of 956	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	110
PID 2916 wrote to memory of 956	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	110
PID 2916 wrote to memory of 4732	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	111
PID 2916 wrote to memory of 4732	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	111
PID 2916 wrote to memory of 2996	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	112
PID 2916 wrote to memory of 2996	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	112
PID 2916 wrote to memory of 3888	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	113
PID 2916 wrote to memory of 3888	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	113
PID 2916 wrote to memory of 4860	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	114
PID 2916 wrote to memory of 4860	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	114
PID 2916 wrote to memory of 5076	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	115
PID 2916 wrote to memory of 5076	2916	6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6a9b7b933ed09b8e2398757812360f30_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Windows\System\HyJrJzB.exe
  C:\Windows\System\HyJrJzB.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\EWQYZKx.exe
  C:\Windows\System\EWQYZKx.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\WsLwvUB.exe
  C:\Windows\System\WsLwvUB.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\LpjtCcv.exe
  C:\Windows\System\LpjtCcv.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\gHfGVfP.exe
  C:\Windows\System\gHfGVfP.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\nQKUAZj.exe
  C:\Windows\System\nQKUAZj.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\bGdJVJb.exe
  C:\Windows\System\bGdJVJb.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\RXDYSIf.exe
  C:\Windows\System\RXDYSIf.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\XKciiLV.exe
  C:\Windows\System\XKciiLV.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\tulCmwF.exe
  C:\Windows\System\tulCmwF.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\gciVENE.exe
  C:\Windows\System\gciVENE.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\JCyXSzW.exe
  C:\Windows\System\JCyXSzW.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\xoCusTJ.exe
  C:\Windows\System\xoCusTJ.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\cADQcil.exe
  C:\Windows\System\cADQcil.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\nYgAYSp.exe
  C:\Windows\System\nYgAYSp.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\bKLpkVW.exe
  C:\Windows\System\bKLpkVW.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\wQTfuHp.exe
  C:\Windows\System\wQTfuHp.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\wfCPDwA.exe
  C:\Windows\System\wfCPDwA.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\dgChxFt.exe
  C:\Windows\System\dgChxFt.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\hBodIVS.exe
  C:\Windows\System\hBodIVS.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\fWWCMLD.exe
  C:\Windows\System\fWWCMLD.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\gvqSapK.exe
  C:\Windows\System\gvqSapK.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\JghfOLj.exe
  C:\Windows\System\JghfOLj.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\gAKbDBx.exe
  C:\Windows\System\gAKbDBx.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\TaurMkG.exe
  C:\Windows\System\TaurMkG.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\TkuPPmO.exe
  C:\Windows\System\TkuPPmO.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\YYCvKjT.exe
  C:\Windows\System\YYCvKjT.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\jdGdlQr.exe
  C:\Windows\System\jdGdlQr.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\EmkoBdq.exe
  C:\Windows\System\EmkoBdq.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\aXUiHlU.exe
  C:\Windows\System\aXUiHlU.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\TlzCHNQ.exe
  C:\Windows\System\TlzCHNQ.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\rSjSVvg.exe
  C:\Windows\System\rSjSVvg.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\tFZcTfE.exe
  C:\Windows\System\tFZcTfE.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\vnZEkXh.exe
  C:\Windows\System\vnZEkXh.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\ffGDZmQ.exe
  C:\Windows\System\ffGDZmQ.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\xPlQtMP.exe
  C:\Windows\System\xPlQtMP.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\hMkXgpi.exe
  C:\Windows\System\hMkXgpi.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\zVtNwwy.exe
  C:\Windows\System\zVtNwwy.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\JhPoiAR.exe
  C:\Windows\System\JhPoiAR.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\beDxqUP.exe
  C:\Windows\System\beDxqUP.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\bxUCAgI.exe
  C:\Windows\System\bxUCAgI.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\ZRkmClK.exe
  C:\Windows\System\ZRkmClK.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\ppCcCJa.exe
  C:\Windows\System\ppCcCJa.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\qpCfZGg.exe
  C:\Windows\System\qpCfZGg.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\shlVRdi.exe
  C:\Windows\System\shlVRdi.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\wBkGaiU.exe
  C:\Windows\System\wBkGaiU.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\iNRAETy.exe
  C:\Windows\System\iNRAETy.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\KotzGYO.exe
  C:\Windows\System\KotzGYO.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\wfPfGbH.exe
  C:\Windows\System\wfPfGbH.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\ZngnBoG.exe
  C:\Windows\System\ZngnBoG.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\WARtHWm.exe
  C:\Windows\System\WARtHWm.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\eQwvXJa.exe
  C:\Windows\System\eQwvXJa.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\wRGiMLo.exe
  C:\Windows\System\wRGiMLo.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\CIsiJzb.exe
  C:\Windows\System\CIsiJzb.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\krDaFNO.exe
  C:\Windows\System\krDaFNO.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\sWZsSHC.exe
  C:\Windows\System\sWZsSHC.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\ukUASDw.exe
  C:\Windows\System\ukUASDw.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\mQROztJ.exe
  C:\Windows\System\mQROztJ.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\hDptIES.exe
  C:\Windows\System\hDptIES.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\CysGgkz.exe
  C:\Windows\System\CysGgkz.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\BrxfZiU.exe
  C:\Windows\System\BrxfZiU.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\UwvcDUJ.exe
  C:\Windows\System\UwvcDUJ.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\ZaJoSSC.exe
  C:\Windows\System\ZaJoSSC.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\jnNXfse.exe
  C:\Windows\System\jnNXfse.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\hGTdXXB.exe
  C:\Windows\System\hGTdXXB.exe
  2⤵
  PID:3520
- C:\Windows\System\xfrQiyQ.exe
  C:\Windows\System\xfrQiyQ.exe
  2⤵
  PID:3972
- C:\Windows\System\XOXoNpK.exe
  C:\Windows\System\XOXoNpK.exe
  2⤵
  PID:2556
- C:\Windows\System\xWpaqbR.exe
  C:\Windows\System\xWpaqbR.exe
  2⤵
  PID:4620
- C:\Windows\System\gviIaEN.exe
  C:\Windows\System\gviIaEN.exe
  2⤵
  PID:3484
- C:\Windows\System\KPFYiaX.exe
  C:\Windows\System\KPFYiaX.exe
  2⤵
  PID:64
- C:\Windows\System\dgbmBMR.exe
  C:\Windows\System\dgbmBMR.exe
  2⤵
  PID:2256
- C:\Windows\System\degqzQs.exe
  C:\Windows\System\degqzQs.exe
  2⤵
  PID:3980
- C:\Windows\System\LasOyGd.exe
  C:\Windows\System\LasOyGd.exe
  2⤵
  PID:1848
- C:\Windows\System\MTfxviP.exe
  C:\Windows\System\MTfxviP.exe
  2⤵
  PID:5032
- C:\Windows\System\BRczDJB.exe
  C:\Windows\System\BRczDJB.exe
  2⤵
  PID:3652
- C:\Windows\System\XkcVaGL.exe
  C:\Windows\System\XkcVaGL.exe
  2⤵
  PID:4316
- C:\Windows\System\titVlBm.exe
  C:\Windows\System\titVlBm.exe
  2⤵
  PID:4104
- C:\Windows\System\wHXkwyH.exe
  C:\Windows\System\wHXkwyH.exe
  2⤵
  PID:4920
- C:\Windows\System\hVuhxuO.exe
  C:\Windows\System\hVuhxuO.exe
  2⤵
  PID:4156
- C:\Windows\System\divrMSW.exe
  C:\Windows\System\divrMSW.exe
  2⤵
  PID:5132
- C:\Windows\System\FabNUXI.exe
  C:\Windows\System\FabNUXI.exe
  2⤵
  PID:5204
- C:\Windows\System\UsbmNrj.exe
  C:\Windows\System\UsbmNrj.exe
  2⤵
  PID:5224
- C:\Windows\System\sJIBOTQ.exe
  C:\Windows\System\sJIBOTQ.exe
  2⤵
  PID:5248
- C:\Windows\System\EKbzOue.exe
  C:\Windows\System\EKbzOue.exe
  2⤵
  PID:5268
- C:\Windows\System\eNmFAFg.exe
  C:\Windows\System\eNmFAFg.exe
  2⤵
  PID:5292
- C:\Windows\System\CwLygKR.exe
  C:\Windows\System\CwLygKR.exe
  2⤵
  PID:5312
- C:\Windows\System\bpTVXvJ.exe
  C:\Windows\System\bpTVXvJ.exe
  2⤵
  PID:5340
- C:\Windows\System\ATmPxcO.exe
  C:\Windows\System\ATmPxcO.exe
  2⤵
  PID:5372
- C:\Windows\System\fpvvOZr.exe
  C:\Windows\System\fpvvOZr.exe
  2⤵
  PID:5464
- C:\Windows\System\beRVZRp.exe
  C:\Windows\System\beRVZRp.exe
  2⤵
  PID:5484
- C:\Windows\System\CjAJGQF.exe
  C:\Windows\System\CjAJGQF.exe
  2⤵
  PID:5512
- C:\Windows\System\hFYXSUL.exe
  C:\Windows\System\hFYXSUL.exe
  2⤵
  PID:5540
- C:\Windows\System\fpaSieb.exe
  C:\Windows\System\fpaSieb.exe
  2⤵
  PID:5560
- C:\Windows\System\nVvvgRH.exe
  C:\Windows\System\nVvvgRH.exe
  2⤵
  PID:5660
- C:\Windows\System\pEVaoOz.exe
  C:\Windows\System\pEVaoOz.exe
  2⤵
  PID:5684
- C:\Windows\System\ciNtsGO.exe
  C:\Windows\System\ciNtsGO.exe
  2⤵
  PID:5700
- C:\Windows\System\jjvsqhM.exe
  C:\Windows\System\jjvsqhM.exe
  2⤵
  PID:5720
- C:\Windows\System\uLXXsem.exe
  C:\Windows\System\uLXXsem.exe
  2⤵
  PID:5736
- C:\Windows\System\akrWqnL.exe
  C:\Windows\System\akrWqnL.exe
  2⤵
  PID:5760
- C:\Windows\System\kGffjqe.exe
  C:\Windows\System\kGffjqe.exe
  2⤵
  PID:5776
- C:\Windows\System\RlchHTH.exe
  C:\Windows\System\RlchHTH.exe
  2⤵
  PID:5796
- C:\Windows\System\LKnnMnK.exe
  C:\Windows\System\LKnnMnK.exe
  2⤵
  PID:5820
- C:\Windows\System\WDXFnHS.exe
  C:\Windows\System\WDXFnHS.exe
  2⤵
  PID:5844
- C:\Windows\System\pTMyiwK.exe
  C:\Windows\System\pTMyiwK.exe
  2⤵
  PID:5860
- C:\Windows\System\eZqtcEq.exe
  C:\Windows\System\eZqtcEq.exe
  2⤵
  PID:5880
- C:\Windows\System\IeCunuc.exe
  C:\Windows\System\IeCunuc.exe
  2⤵
  PID:5908
- C:\Windows\System\KHqzqTr.exe
  C:\Windows\System\KHqzqTr.exe
  2⤵
  PID:5932
- C:\Windows\System\maZZJZD.exe
  C:\Windows\System\maZZJZD.exe
  2⤵
  PID:5956
- C:\Windows\System\BecHobc.exe
  C:\Windows\System\BecHobc.exe
  2⤵
  PID:6012
- C:\Windows\System\nfZjSGN.exe
  C:\Windows\System\nfZjSGN.exe
  2⤵
  PID:6028
- C:\Windows\System\pcjeXHC.exe
  C:\Windows\System\pcjeXHC.exe
  2⤵
  PID:6044
- C:\Windows\System\whgWCOR.exe
  C:\Windows\System\whgWCOR.exe
  2⤵
  PID:6060
- C:\Windows\System\yPLvmpq.exe
  C:\Windows\System\yPLvmpq.exe
  2⤵
  PID:6076
- C:\Windows\System\IHykeVq.exe
  C:\Windows\System\IHykeVq.exe
  2⤵
  PID:6092
- C:\Windows\System\LjvZOEi.exe
  C:\Windows\System\LjvZOEi.exe
  2⤵
  PID:6108
- C:\Windows\System\zmWIahS.exe
  C:\Windows\System\zmWIahS.exe
  2⤵
  PID:6124
- C:\Windows\System\vlNXhCH.exe
  C:\Windows\System\vlNXhCH.exe
  2⤵
  PID:380
- C:\Windows\System\VXlcVCm.exe
  C:\Windows\System\VXlcVCm.exe
  2⤵
  PID:2636
- C:\Windows\System\aETQyuv.exe
  C:\Windows\System\aETQyuv.exe
  2⤵
  PID:1104
- C:\Windows\System\mzdvfOY.exe
  C:\Windows\System\mzdvfOY.exe
  2⤵
  PID:3412
- C:\Windows\System\NjKwHxv.exe
  C:\Windows\System\NjKwHxv.exe
  2⤵
  PID:3836
- C:\Windows\System\SLXFBNu.exe
  C:\Windows\System\SLXFBNu.exe
  2⤵
  PID:5072
- C:\Windows\System\zqBkZSs.exe
  C:\Windows\System\zqBkZSs.exe
  2⤵
  PID:1712
- C:\Windows\System\UiSVRVH.exe
  C:\Windows\System\UiSVRVH.exe
  2⤵
  PID:3868
- C:\Windows\System\WMsQhOK.exe
  C:\Windows\System\WMsQhOK.exe
  2⤵
  PID:880
- C:\Windows\System\LRUFjJu.exe
  C:\Windows\System\LRUFjJu.exe
  2⤵
  PID:2388
- C:\Windows\System\ofyHlGm.exe
  C:\Windows\System\ofyHlGm.exe
  2⤵
  PID:4636
- C:\Windows\System\YniIvEz.exe
  C:\Windows\System\YniIvEz.exe
  2⤵
  PID:5300
- C:\Windows\System\QBMykTN.exe
  C:\Windows\System\QBMykTN.exe
  2⤵
  PID:2520
- C:\Windows\System\BdmjNIW.exe
  C:\Windows\System\BdmjNIW.exe
  2⤵
  PID:2720
- C:\Windows\System\vxkuByi.exe
  C:\Windows\System\vxkuByi.exe
  2⤵
  PID:1520
- C:\Windows\System\NGqnaoV.exe
  C:\Windows\System\NGqnaoV.exe
  2⤵
  PID:5320
- C:\Windows\System\YtMoNTi.exe
  C:\Windows\System\YtMoNTi.exe
  2⤵
  PID:5568
- C:\Windows\System\yGiAgzX.exe
  C:\Windows\System\yGiAgzX.exe
  2⤵
  PID:2076
- C:\Windows\System\BWYGWEP.exe
  C:\Windows\System\BWYGWEP.exe
  2⤵
  PID:4500
- C:\Windows\System\lGBNmfA.exe
  C:\Windows\System\lGBNmfA.exe
  2⤵
  PID:5164
- C:\Windows\System\gubFeXG.exe
  C:\Windows\System\gubFeXG.exe
  2⤵
  PID:5852
- C:\Windows\System\kVfatAQ.exe
  C:\Windows\System\kVfatAQ.exe
  2⤵
  PID:5388
- C:\Windows\System\pMqofBZ.exe
  C:\Windows\System\pMqofBZ.exe
  2⤵
  PID:5432
- C:\Windows\System\DwsbqiQ.exe
  C:\Windows\System\DwsbqiQ.exe
  2⤵
  PID:5456
- C:\Windows\System\cKxKLKl.exe
  C:\Windows\System\cKxKLKl.exe
  2⤵
  PID:5948
- C:\Windows\System\qCxZQKr.exe
  C:\Windows\System\qCxZQKr.exe
  2⤵
  PID:6152
- C:\Windows\System\dWgBGkv.exe
  C:\Windows\System\dWgBGkv.exe
  2⤵
  PID:6172
- C:\Windows\System\rDEnNCk.exe
  C:\Windows\System\rDEnNCk.exe
  2⤵
  PID:6192
- C:\Windows\System\PHzfFoY.exe
  C:\Windows\System\PHzfFoY.exe
  2⤵
  PID:6212
- C:\Windows\System\lztmUMx.exe
  C:\Windows\System\lztmUMx.exe
  2⤵
  PID:6240
- C:\Windows\System\iCiMABZ.exe
  C:\Windows\System\iCiMABZ.exe
  2⤵
  PID:6260
- C:\Windows\System\JaBqItb.exe
  C:\Windows\System\JaBqItb.exe
  2⤵
  PID:6336
- C:\Windows\System\EejjjGr.exe
  C:\Windows\System\EejjjGr.exe
  2⤵
  PID:6356
- C:\Windows\System\VFTGSsc.exe
  C:\Windows\System\VFTGSsc.exe
  2⤵
  PID:6380
- C:\Windows\System\bGsrBQs.exe
  C:\Windows\System\bGsrBQs.exe
  2⤵
  PID:6396
- C:\Windows\System\onnFgCV.exe
  C:\Windows\System\onnFgCV.exe
  2⤵
  PID:6420
- C:\Windows\System\pgVwKrg.exe
  C:\Windows\System\pgVwKrg.exe
  2⤵
  PID:6436
- C:\Windows\System\PategKS.exe
  C:\Windows\System\PategKS.exe
  2⤵
  PID:6556
- C:\Windows\System\XbiCgDW.exe
  C:\Windows\System\XbiCgDW.exe
  2⤵
  PID:6572
- C:\Windows\System\ecMyTZt.exe
  C:\Windows\System\ecMyTZt.exe
  2⤵
  PID:6588
- C:\Windows\System\idJFdae.exe
  C:\Windows\System\idJFdae.exe
  2⤵
  PID:6604
- C:\Windows\System\RqppEfz.exe
  C:\Windows\System\RqppEfz.exe
  2⤵
  PID:6620
- C:\Windows\System\RCVbtMn.exe
  C:\Windows\System\RCVbtMn.exe
  2⤵
  PID:6636
- C:\Windows\System\NftrMoS.exe
  C:\Windows\System\NftrMoS.exe
  2⤵
  PID:6652
- C:\Windows\System\PcTgVFo.exe
  C:\Windows\System\PcTgVFo.exe
  2⤵
  PID:6668
- C:\Windows\System\sDPouUh.exe
  C:\Windows\System\sDPouUh.exe
  2⤵
  PID:6684
- C:\Windows\System\geAXgTY.exe
  C:\Windows\System\geAXgTY.exe
  2⤵
  PID:6700
- C:\Windows\System\dYjdMZm.exe
  C:\Windows\System\dYjdMZm.exe
  2⤵
  PID:6716
- C:\Windows\System\hPOujIf.exe
  C:\Windows\System\hPOujIf.exe
  2⤵
  PID:6732
- C:\Windows\System\wHPwLPa.exe
  C:\Windows\System\wHPwLPa.exe
  2⤵
  PID:6748
- C:\Windows\System\pVamncL.exe
  C:\Windows\System\pVamncL.exe
  2⤵
  PID:6764
- C:\Windows\System\uWSEcan.exe
  C:\Windows\System\uWSEcan.exe
  2⤵
  PID:6780
- C:\Windows\System\aRqhIip.exe
  C:\Windows\System\aRqhIip.exe
  2⤵
  PID:6796
- C:\Windows\System\nFfhSNT.exe
  C:\Windows\System\nFfhSNT.exe
  2⤵
  PID:6812
- C:\Windows\System\OWjZzoO.exe
  C:\Windows\System\OWjZzoO.exe
  2⤵
  PID:6936
- C:\Windows\System\hWjPpma.exe
  C:\Windows\System\hWjPpma.exe
  2⤵
  PID:6956
- C:\Windows\System\lwMXSPt.exe
  C:\Windows\System\lwMXSPt.exe
  2⤵
  PID:6972
- C:\Windows\System\UdpzCjr.exe
  C:\Windows\System\UdpzCjr.exe
  2⤵
  PID:6992
- C:\Windows\System\eGINKrA.exe
  C:\Windows\System\eGINKrA.exe
  2⤵
  PID:7008
- C:\Windows\System\WjPPEcy.exe
  C:\Windows\System\WjPPEcy.exe
  2⤵
  PID:7024
- C:\Windows\System\BVOPRVK.exe
  C:\Windows\System\BVOPRVK.exe
  2⤵
  PID:7040
- C:\Windows\System\aMJAEKF.exe
  C:\Windows\System\aMJAEKF.exe
  2⤵
  PID:7056
- C:\Windows\System\rDxjvpR.exe
  C:\Windows\System\rDxjvpR.exe
  2⤵
  PID:7072
- C:\Windows\System\ZYPliLz.exe
  C:\Windows\System\ZYPliLz.exe
  2⤵
  PID:7088
- C:\Windows\System\CiQFllu.exe
  C:\Windows\System\CiQFllu.exe
  2⤵
  PID:7108
- C:\Windows\System\qNEeADW.exe
  C:\Windows\System\qNEeADW.exe
  2⤵
  PID:7128
- C:\Windows\System\MdViLbE.exe
  C:\Windows\System\MdViLbE.exe
  2⤵
  PID:7148
- C:\Windows\System\wSKkxTp.exe
  C:\Windows\System\wSKkxTp.exe
  2⤵
  PID:7164
- C:\Windows\System\ehBNEnC.exe
  C:\Windows\System\ehBNEnC.exe
  2⤵
  PID:5148
- C:\Windows\System\aXgfhkz.exe
  C:\Windows\System\aXgfhkz.exe
  2⤵
  PID:5636
- C:\Windows\System\kbryfTA.exe
  C:\Windows\System\kbryfTA.exe
  2⤵
  PID:5696
- C:\Windows\System\bgwQxfK.exe
  C:\Windows\System\bgwQxfK.exe
  2⤵
  PID:5868
- C:\Windows\System\PfrDuhj.exe
  C:\Windows\System\PfrDuhj.exe
  2⤵
  PID:5900
- C:\Windows\System\EOjHswI.exe
  C:\Windows\System\EOjHswI.exe
  2⤵
  PID:5968
- C:\Windows\System\kXZewWD.exe
  C:\Windows\System\kXZewWD.exe
  2⤵
  PID:6040
- C:\Windows\System\MhIOQEP.exe
  C:\Windows\System\MhIOQEP.exe
  2⤵
  PID:6056
- C:\Windows\System\UnAERZC.exe
  C:\Windows\System\UnAERZC.exe
  2⤵
  PID:6088
- C:\Windows\System\SZiHKCO.exe
  C:\Windows\System\SZiHKCO.exe
  2⤵
  PID:6120
- C:\Windows\System\AiuKnSF.exe
  C:\Windows\System\AiuKnSF.exe
  2⤵
  PID:4652
- C:\Windows\System\LyOnBGl.exe
  C:\Windows\System\LyOnBGl.exe
  2⤵
  PID:2304
- C:\Windows\System\vTAGKll.exe
  C:\Windows\System\vTAGKll.exe
  2⤵
  PID:4364
- C:\Windows\System\sIKsSWL.exe
  C:\Windows\System\sIKsSWL.exe
  2⤵
  PID:1472
- C:\Windows\System\GnEDdJL.exe
  C:\Windows\System\GnEDdJL.exe
  2⤵
  PID:4432
- C:\Windows\System\gnDjzxD.exe
  C:\Windows\System\gnDjzxD.exe
  2⤵
  PID:1364
- C:\Windows\System\bhJphZP.exe
  C:\Windows\System\bhJphZP.exe
  2⤵
  PID:5472
- C:\Windows\System\aUPugVT.exe
  C:\Windows\System\aUPugVT.exe
  2⤵
  PID:5188
- C:\Windows\System\lbejJbo.exe
  C:\Windows\System\lbejJbo.exe
  2⤵
  PID:5892
- C:\Windows\System\sXzNpre.exe
  C:\Windows\System\sXzNpre.exe
  2⤵
  PID:6272
- C:\Windows\System\miZKXiz.exe
  C:\Windows\System\miZKXiz.exe
  2⤵
  PID:6404
- C:\Windows\System\lrqqTQH.exe
  C:\Windows\System\lrqqTQH.exe
  2⤵
  PID:2672
- C:\Windows\System\PZMWPLA.exe
  C:\Windows\System\PZMWPLA.exe
  2⤵
  PID:5556
- C:\Windows\System\Jiuikdp.exe
  C:\Windows\System\Jiuikdp.exe
  2⤵
  PID:6188
- C:\Windows\System\PPxQBqA.exe
  C:\Windows\System\PPxQBqA.exe
  2⤵
  PID:6252
- C:\Windows\System\hqAxNwN.exe
  C:\Windows\System\hqAxNwN.exe
  2⤵
  PID:6364
- C:\Windows\System\IhYloOe.exe
  C:\Windows\System\IhYloOe.exe
  2⤵
  PID:6428
- C:\Windows\System\gZBFdRc.exe
  C:\Windows\System\gZBFdRc.exe
  2⤵
  PID:7180
- C:\Windows\System\HLdKTTB.exe
  C:\Windows\System\HLdKTTB.exe
  2⤵
  PID:7204
- C:\Windows\System\OdtSgTU.exe
  C:\Windows\System\OdtSgTU.exe
  2⤵
  PID:7220
- C:\Windows\System\Jhkltrv.exe
  C:\Windows\System\Jhkltrv.exe
  2⤵
  PID:7240
- C:\Windows\System\jBEpZzP.exe
  C:\Windows\System\jBEpZzP.exe
  2⤵
  PID:7256
- C:\Windows\System\VyGkbqF.exe
  C:\Windows\System\VyGkbqF.exe
  2⤵
  PID:7272
- C:\Windows\System\bGRlJLh.exe
  C:\Windows\System\bGRlJLh.exe
  2⤵
  PID:7288
- C:\Windows\System\UQCwfNx.exe
  C:\Windows\System\UQCwfNx.exe
  2⤵
  PID:7532
- C:\Windows\System\bqbhnoj.exe
  C:\Windows\System\bqbhnoj.exe
  2⤵
  PID:7548
- C:\Windows\System\gSpzxEw.exe
  C:\Windows\System\gSpzxEw.exe
  2⤵
  PID:7564
- C:\Windows\System\IyqnJiL.exe
  C:\Windows\System\IyqnJiL.exe
  2⤵
  PID:7580
- C:\Windows\System\iknjKbM.exe
  C:\Windows\System\iknjKbM.exe
  2⤵
  PID:7596
- C:\Windows\System\SthXzoi.exe
  C:\Windows\System\SthXzoi.exe
  2⤵
  PID:7612
- C:\Windows\System\oMSYAhK.exe
  C:\Windows\System\oMSYAhK.exe
  2⤵
  PID:7632
- C:\Windows\System\OZHTNyn.exe
  C:\Windows\System\OZHTNyn.exe
  2⤵
  PID:7648
- C:\Windows\System\SZmLtvk.exe
  C:\Windows\System\SZmLtvk.exe
  2⤵
  PID:7680
- C:\Windows\System\XcSsxyi.exe
  C:\Windows\System\XcSsxyi.exe
  2⤵
  PID:7696
- C:\Windows\System\UpwhEQp.exe
  C:\Windows\System\UpwhEQp.exe
  2⤵
  PID:7712
- C:\Windows\System\yqGXDtP.exe
  C:\Windows\System\yqGXDtP.exe
  2⤵
  PID:7728
- C:\Windows\System\BJTnmlQ.exe
  C:\Windows\System\BJTnmlQ.exe
  2⤵
  PID:7748
- C:\Windows\System\HpcNnED.exe
  C:\Windows\System\HpcNnED.exe
  2⤵
  PID:7768
- C:\Windows\System\ovBJLMN.exe
  C:\Windows\System\ovBJLMN.exe
  2⤵
  PID:7792
- C:\Windows\System\ygqBrvi.exe
  C:\Windows\System\ygqBrvi.exe
  2⤵
  PID:7808
- C:\Windows\System\aTpBKgA.exe
  C:\Windows\System\aTpBKgA.exe
  2⤵
  PID:7824
- C:\Windows\System\dhAlUID.exe
  C:\Windows\System\dhAlUID.exe
  2⤵
  PID:7844
- C:\Windows\System\mUJKBHc.exe
  C:\Windows\System\mUJKBHc.exe
  2⤵
  PID:7860
- C:\Windows\System\uKvYtRN.exe
  C:\Windows\System\uKvYtRN.exe
  2⤵
  PID:7876
- C:\Windows\System\cDLQYFp.exe
  C:\Windows\System\cDLQYFp.exe
  2⤵
  PID:7896
- C:\Windows\System\LuAbIcO.exe
  C:\Windows\System\LuAbIcO.exe
  2⤵
  PID:7912
- C:\Windows\System\GbwDzlG.exe
  C:\Windows\System\GbwDzlG.exe
  2⤵
  PID:7928
- C:\Windows\System\oSImQGC.exe
  C:\Windows\System\oSImQGC.exe
  2⤵
  PID:7944
- C:\Windows\System\KAwvKSz.exe
  C:\Windows\System\KAwvKSz.exe
  2⤵
  PID:7968
- C:\Windows\System\IEiOFtN.exe
  C:\Windows\System\IEiOFtN.exe
  2⤵
  PID:7984
- C:\Windows\System\kAcyKrP.exe
  C:\Windows\System\kAcyKrP.exe
  2⤵
  PID:8000
- C:\Windows\System\AHuMUNq.exe
  C:\Windows\System\AHuMUNq.exe
  2⤵
  PID:8020
- C:\Windows\System\dQKwAGx.exe
  C:\Windows\System\dQKwAGx.exe
  2⤵
  PID:8036
- C:\Windows\System\JewskkM.exe
  C:\Windows\System\JewskkM.exe
  2⤵
  PID:8052
- C:\Windows\System\VWoiQTm.exe
  C:\Windows\System\VWoiQTm.exe
  2⤵
  PID:8072
- C:\Windows\System\VMrDvyq.exe
  C:\Windows\System\VMrDvyq.exe
  2⤵
  PID:7036
- C:\Windows\System\BRwJTLm.exe
  C:\Windows\System\BRwJTLm.exe
  2⤵
  PID:7124
- C:\Windows\System\zGgXBKT.exe
  C:\Windows\System\zGgXBKT.exe
  2⤵
  PID:5128
- C:\Windows\System\jmTceUK.exe
  C:\Windows\System\jmTceUK.exe
  2⤵
  PID:5628
- C:\Windows\System\WmxpMjv.exe
  C:\Windows\System\WmxpMjv.exe
  2⤵
  PID:5728
- C:\Windows\System\uZPwukk.exe
  C:\Windows\System\uZPwukk.exe
  2⤵
  PID:6052
- C:\Windows\System\Rrabryy.exe
  C:\Windows\System\Rrabryy.exe
  2⤵
  PID:3480
- C:\Windows\System\TFayygA.exe
  C:\Windows\System\TFayygA.exe
  2⤵
  PID:1252
- C:\Windows\System\hNCZAbB.exe
  C:\Windows\System\hNCZAbB.exe
  2⤵
  PID:5260
- C:\Windows\System\TfExSdu.exe
  C:\Windows\System\TfExSdu.exe
  2⤵
  PID:5448
- C:\Windows\System\OMgMMFS.exe
  C:\Windows\System\OMgMMFS.exe
  2⤵
  PID:7032
- C:\Windows\System\SOwSgrf.exe
  C:\Windows\System\SOwSgrf.exe
  2⤵
  PID:7588
- C:\Windows\System\vxYEXGV.exe
  C:\Windows\System\vxYEXGV.exe
  2⤵
  PID:7980
- C:\Windows\System\RnbARIn.exe
  C:\Windows\System\RnbARIn.exe
  2⤵
  PID:7644
- C:\Windows\System\vxuPFfc.exe
  C:\Windows\System\vxuPFfc.exe
  2⤵
  PID:7216
- C:\Windows\System\sLVIVbp.exe
  C:\Windows\System\sLVIVbp.exe
  2⤵
  PID:8060
- C:\Windows\System\xZITxVM.exe
  C:\Windows\System\xZITxVM.exe
  2⤵
  PID:7420
- C:\Windows\System\BwdMRde.exe
  C:\Windows\System\BwdMRde.exe
  2⤵
  PID:7448
- C:\Windows\System\bihLMKZ.exe
  C:\Windows\System\bihLMKZ.exe
  2⤵
  PID:7480
- C:\Windows\System\UAmPxxo.exe
  C:\Windows\System\UAmPxxo.exe
  2⤵
  PID:7576
- C:\Windows\System\eQKLyTb.exe
  C:\Windows\System\eQKLyTb.exe
  2⤵
  PID:7280
- C:\Windows\System\OwiXfTr.exe
  C:\Windows\System\OwiXfTr.exe
  2⤵
  PID:8200
- C:\Windows\System\iWAGEfI.exe
  C:\Windows\System\iWAGEfI.exe
  2⤵
  PID:8224
- C:\Windows\System\heOaKap.exe
  C:\Windows\System\heOaKap.exe
  2⤵
  PID:8252
- C:\Windows\System\APkmIwY.exe
  C:\Windows\System\APkmIwY.exe
  2⤵
  PID:8272
- C:\Windows\System\WFvMedR.exe
  C:\Windows\System\WFvMedR.exe
  2⤵
  PID:8296
- C:\Windows\System\BzwIRXi.exe
  C:\Windows\System\BzwIRXi.exe
  2⤵
  PID:8320
- C:\Windows\System\ByDQdyJ.exe
  C:\Windows\System\ByDQdyJ.exe
  2⤵
  PID:8348
- C:\Windows\System\hbWuRIY.exe
  C:\Windows\System\hbWuRIY.exe
  2⤵
  PID:8380
- C:\Windows\System\owezqOz.exe
  C:\Windows\System\owezqOz.exe
  2⤵
  PID:8396
- C:\Windows\System\qDWovfU.exe
  C:\Windows\System\qDWovfU.exe
  2⤵
  PID:8416
- C:\Windows\System\mTqRnav.exe
  C:\Windows\System\mTqRnav.exe
  2⤵
  PID:8440
- C:\Windows\System\SEyasDo.exe
  C:\Windows\System\SEyasDo.exe
  2⤵
  PID:8460
- C:\Windows\System\paqJUDH.exe
  C:\Windows\System\paqJUDH.exe
  2⤵
  PID:8484
- C:\Windows\System\jskZXcK.exe
  C:\Windows\System\jskZXcK.exe
  2⤵
  PID:8508
- C:\Windows\System\LMZncPc.exe
  C:\Windows\System\LMZncPc.exe
  2⤵
  PID:8528
- C:\Windows\System\uuJhQrw.exe
  C:\Windows\System\uuJhQrw.exe
  2⤵
  PID:8544
- C:\Windows\System\IURoici.exe
  C:\Windows\System\IURoici.exe
  2⤵
  PID:8568
- C:\Windows\System\acNMTIQ.exe
  C:\Windows\System\acNMTIQ.exe
  2⤵
  PID:8588
- C:\Windows\System\sffMyyU.exe
  C:\Windows\System\sffMyyU.exe
  2⤵
  PID:8608
- C:\Windows\System\jQoRKWr.exe
  C:\Windows\System\jQoRKWr.exe
  2⤵
  PID:8628
- C:\Windows\System\TdwwjhD.exe
  C:\Windows\System\TdwwjhD.exe
  2⤵
  PID:8652
- C:\Windows\System\TMrfevn.exe
  C:\Windows\System\TMrfevn.exe
  2⤵
  PID:8672
- C:\Windows\System\LdOeTTK.exe
  C:\Windows\System\LdOeTTK.exe
  2⤵
  PID:8692
- C:\Windows\System\LJgpiLx.exe
  C:\Windows\System\LJgpiLx.exe
  2⤵
  PID:8712
- C:\Windows\System\mlDYRkq.exe
  C:\Windows\System\mlDYRkq.exe
  2⤵
  PID:8740
- C:\Windows\System\AyzgEhp.exe
  C:\Windows\System\AyzgEhp.exe
  2⤵
  PID:8756
- C:\Windows\System\MVTcGvV.exe
  C:\Windows\System\MVTcGvV.exe
  2⤵
  PID:8784
- C:\Windows\System\UZRoktH.exe
  C:\Windows\System\UZRoktH.exe
  2⤵
  PID:8808
- C:\Windows\System\SgbbWTl.exe
  C:\Windows\System\SgbbWTl.exe
  2⤵
  PID:8832
- C:\Windows\System\TrPLvmU.exe
  C:\Windows\System\TrPLvmU.exe
  2⤵
  PID:8856
- C:\Windows\System\eMGCduX.exe
  C:\Windows\System\eMGCduX.exe
  2⤵
  PID:8876
- C:\Windows\System\iPshfVQ.exe
  C:\Windows\System\iPshfVQ.exe
  2⤵
  PID:8892
- C:\Windows\System\cnlbuPo.exe
  C:\Windows\System\cnlbuPo.exe
  2⤵
  PID:8928
- C:\Windows\System\ImksFUd.exe
  C:\Windows\System\ImksFUd.exe
  2⤵
  PID:8944
- C:\Windows\System\hYEPtzL.exe
  C:\Windows\System\hYEPtzL.exe
  2⤵
  PID:8960
- C:\Windows\System\xJkWZJm.exe
  C:\Windows\System\xJkWZJm.exe
  2⤵
  PID:8976
- C:\Windows\System\uvzFaBr.exe
  C:\Windows\System\uvzFaBr.exe
  2⤵
  PID:8996
- C:\Windows\System\awtHPhr.exe
  C:\Windows\System\awtHPhr.exe
  2⤵
  PID:9012
- C:\Windows\System\dIdgswn.exe
  C:\Windows\System\dIdgswn.exe
  2⤵
  PID:9028
- C:\Windows\System\fDWuGsD.exe
  C:\Windows\System\fDWuGsD.exe
  2⤵
  PID:9044
- C:\Windows\System\XSxCsWQ.exe
  C:\Windows\System\XSxCsWQ.exe
  2⤵
  PID:9060
- C:\Windows\System\eAOpyYD.exe
  C:\Windows\System\eAOpyYD.exe
  2⤵
  PID:9084
- C:\Windows\System\RvJzEDG.exe
  C:\Windows\System\RvJzEDG.exe
  2⤵
  PID:9108
- C:\Windows\System\pCKNrUv.exe
  C:\Windows\System\pCKNrUv.exe
  2⤵
  PID:9132
- C:\Windows\System\xLHDxSM.exe
  C:\Windows\System\xLHDxSM.exe
  2⤵
  PID:9148
- C:\Windows\System\unraZmM.exe
  C:\Windows\System\unraZmM.exe
  2⤵
  PID:9172
- C:\Windows\System\fHXfnZc.exe
  C:\Windows\System\fHXfnZc.exe
  2⤵
  PID:6952
- C:\Windows\System\nRqXDAS.exe
  C:\Windows\System\nRqXDAS.exe
  2⤵
  PID:7776
- C:\Windows\System\xvsXUfm.exe
  C:\Windows\System\xvsXUfm.exe
  2⤵
  PID:3736
- C:\Windows\System\pWBqQPb.exe
  C:\Windows\System\pWBqQPb.exe
  2⤵
  PID:5280
- C:\Windows\System\nhnouYS.exe
  C:\Windows\System\nhnouYS.exe
  2⤵
  PID:7832
- C:\Windows\System\xTDigPb.exe
  C:\Windows\System\xTDigPb.exe
  2⤵
  PID:7888
- C:\Windows\System\aCCRvrG.exe
  C:\Windows\System\aCCRvrG.exe
  2⤵
  PID:7924
- C:\Windows\System\OWZtzFz.exe
  C:\Windows\System\OWZtzFz.exe
  2⤵
  PID:9224
- C:\Windows\System\hbdIsYX.exe
  C:\Windows\System\hbdIsYX.exe
  2⤵
  PID:9248
- C:\Windows\System\YpSQLAL.exe
  C:\Windows\System\YpSQLAL.exe
  2⤵
  PID:9264
- C:\Windows\System\VeQNMLb.exe
  C:\Windows\System\VeQNMLb.exe
  2⤵
  PID:9316
- C:\Windows\System\aVtpEzU.exe
  C:\Windows\System\aVtpEzU.exe
  2⤵
  PID:9348
- C:\Windows\System\boYcffY.exe
  C:\Windows\System\boYcffY.exe
  2⤵
  PID:9364
- C:\Windows\System\HqpDcMt.exe
  C:\Windows\System\HqpDcMt.exe
  2⤵
  PID:9380
- C:\Windows\System\JaWfCau.exe
  C:\Windows\System\JaWfCau.exe
  2⤵
  PID:9396
- C:\Windows\System\swxlXZo.exe
  C:\Windows\System\swxlXZo.exe
  2⤵
  PID:9412
- C:\Windows\System\uvIHdck.exe
  C:\Windows\System\uvIHdck.exe
  2⤵
  PID:9440
- C:\Windows\System\ZDAQIvV.exe
  C:\Windows\System\ZDAQIvV.exe
  2⤵
  PID:9456
- C:\Windows\System\PKwwjcK.exe
  C:\Windows\System\PKwwjcK.exe
  2⤵
  PID:9476
- C:\Windows\System\vXjMXoO.exe
  C:\Windows\System\vXjMXoO.exe
  2⤵
  PID:9496
- C:\Windows\System\doylKKm.exe
  C:\Windows\System\doylKKm.exe
  2⤵
  PID:9520
- C:\Windows\System\HBsFAfV.exe
  C:\Windows\System\HBsFAfV.exe
  2⤵
  PID:9540
- C:\Windows\System\nmHlJoe.exe
  C:\Windows\System\nmHlJoe.exe
  2⤵
  PID:9560
- C:\Windows\System\bEVfmJd.exe
  C:\Windows\System\bEVfmJd.exe
  2⤵
  PID:9576
- C:\Windows\System\qSmHgtU.exe
  C:\Windows\System\qSmHgtU.exe
  2⤵
  PID:9600
- C:\Windows\System\upavddZ.exe
  C:\Windows\System\upavddZ.exe
  2⤵
  PID:9620
- C:\Windows\System\ZqzFOHQ.exe
  C:\Windows\System\ZqzFOHQ.exe
  2⤵
  PID:9636
- C:\Windows\System\VfkUvCU.exe
  C:\Windows\System\VfkUvCU.exe
  2⤵
  PID:9656
- C:\Windows\System\BzFCzrG.exe
  C:\Windows\System\BzFCzrG.exe
  2⤵
  PID:9676
- C:\Windows\System\JiPhwhF.exe
  C:\Windows\System\JiPhwhF.exe
  2⤵
  PID:9700
- C:\Windows\System\uJqzfTQ.exe
  C:\Windows\System\uJqzfTQ.exe
  2⤵
  PID:9720
- C:\Windows\System\kcIkboF.exe
  C:\Windows\System\kcIkboF.exe
  2⤵
  PID:9740
- C:\Windows\System\MTWSHcH.exe
  C:\Windows\System\MTWSHcH.exe
  2⤵
  PID:9760
- C:\Windows\System\pALbIcF.exe
  C:\Windows\System\pALbIcF.exe
  2⤵
  PID:9880
- C:\Windows\System\VsIZBFQ.exe
  C:\Windows\System\VsIZBFQ.exe
  2⤵
  PID:9896
- C:\Windows\System\mAiIcrc.exe
  C:\Windows\System\mAiIcrc.exe
  2⤵
  PID:9912
- C:\Windows\System\IJbwUpe.exe
  C:\Windows\System\IJbwUpe.exe
  2⤵
  PID:9928
- C:\Windows\System\NERslhq.exe
  C:\Windows\System\NERslhq.exe
  2⤵
  PID:9944
- C:\Windows\System\YqLIybk.exe
  C:\Windows\System\YqLIybk.exe
  2⤵
  PID:9964
- C:\Windows\System\AwAyOed.exe
  C:\Windows\System\AwAyOed.exe
  2⤵
  PID:9984
- C:\Windows\System\BzZWQJC.exe
  C:\Windows\System\BzZWQJC.exe
  2⤵
  PID:10012
- C:\Windows\System\JWpbsPb.exe
  C:\Windows\System\JWpbsPb.exe
  2⤵
  PID:10040
- C:\Windows\System\WHRlIgZ.exe
  C:\Windows\System\WHRlIgZ.exe
  2⤵
  PID:10060
- C:\Windows\System\lcnhWxr.exe
  C:\Windows\System\lcnhWxr.exe
  2⤵
  PID:10092
- C:\Windows\System\NyTotoK.exe
  C:\Windows\System\NyTotoK.exe
  2⤵
  PID:10112
- C:\Windows\System\eLMssVe.exe
  C:\Windows\System\eLMssVe.exe
  2⤵
  PID:10148
- C:\Windows\System\hruDIZM.exe
  C:\Windows\System\hruDIZM.exe
  2⤵
  PID:10164
- C:\Windows\System\CMtBBqB.exe
  C:\Windows\System\CMtBBqB.exe
  2⤵
  PID:10180
- C:\Windows\System\auMlvYn.exe
  C:\Windows\System\auMlvYn.exe
  2⤵
  PID:10196
- C:\Windows\System\HCDieis.exe
  C:\Windows\System\HCDieis.exe
  2⤵
  PID:10216
- C:\Windows\System\iTyqQrn.exe
  C:\Windows\System\iTyqQrn.exe
  2⤵
  PID:10232
- C:\Windows\System\VfewwTq.exe
  C:\Windows\System\VfewwTq.exe
  2⤵
  PID:8264
- C:\Windows\System\hgPXrGd.exe
  C:\Windows\System\hgPXrGd.exe
  2⤵
  PID:8732
- C:\Windows\System\OqcEwQh.exe
  C:\Windows\System\OqcEwQh.exe
  2⤵
  PID:8764
- C:\Windows\System\JKfhsUO.exe
  C:\Windows\System\JKfhsUO.exe
  2⤵
  PID:5620
- C:\Windows\System\YXxkVaC.exe
  C:\Windows\System\YXxkVaC.exe
  2⤵
  PID:8872
- C:\Windows\System\TESFoQB.exe
  C:\Windows\System\TESFoQB.exe
  2⤵
  PID:8600
- C:\Windows\System\FSpEBUo.exe
  C:\Windows\System\FSpEBUo.exe
  2⤵
  PID:8624
- C:\Windows\System\nUjAPIz.exe
  C:\Windows\System\nUjAPIz.exe
  2⤵
  PID:8664
- C:\Windows\System\GykdgXb.exe
  C:\Windows\System\GykdgXb.exe
  2⤵
  PID:8668
- C:\Windows\System\SeJgAdT.exe
  C:\Windows\System\SeJgAdT.exe
  2⤵
  PID:9992
- C:\Windows\System\TBCNAYE.exe
  C:\Windows\System\TBCNAYE.exe
  2⤵
  PID:9516
- C:\Windows\System\eHBuBoo.exe
  C:\Windows\System\eHBuBoo.exe
  2⤵
  PID:8828
- C:\Windows\System\pPUOozt.exe
  C:\Windows\System\pPUOozt.exe
  2⤵
  PID:8868
- C:\Windows\System\DZwwJWA.exe
  C:\Windows\System\DZwwJWA.exe
  2⤵
  PID:8936
- C:\Windows\System\gjxBCmG.exe
  C:\Windows\System\gjxBCmG.exe
  2⤵
  PID:8968
- C:\Windows\System\CFDWBPk.exe
  C:\Windows\System\CFDWBPk.exe
  2⤵
  PID:9008
- C:\Windows\System\snFbaUb.exe
  C:\Windows\System\snFbaUb.exe
  2⤵
  PID:9068
- C:\Windows\System\oBCHaNh.exe
  C:\Windows\System\oBCHaNh.exe
  2⤵
  PID:9168
- C:\Windows\System\sFJRdCX.exe
  C:\Windows\System\sFJRdCX.exe
  2⤵
  PID:2988
- C:\Windows\System\JWeMBNB.exe
  C:\Windows\System\JWeMBNB.exe
  2⤵
  PID:3448
- C:\Windows\System\hyoKBaZ.exe
  C:\Windows\System\hyoKBaZ.exe
  2⤵
  PID:7852
- C:\Windows\System\fpaUiPS.exe
  C:\Windows\System\fpaUiPS.exe
  2⤵
  PID:7920
- C:\Windows\System\PAVVsWh.exe
  C:\Windows\System\PAVVsWh.exe
  2⤵
  PID:9232
- C:\Windows\System\bsgDjvw.exe
  C:\Windows\System\bsgDjvw.exe
  2⤵
  PID:9272
- C:\Windows\System\YNNNybe.exe
  C:\Windows\System\YNNNybe.exe
  2⤵
  PID:9344
- C:\Windows\System\LpBIGMD.exe
  C:\Windows\System\LpBIGMD.exe
  2⤵
  PID:9372
- C:\Windows\System\kRLstSb.exe
  C:\Windows\System\kRLstSb.exe
  2⤵
  PID:9408
- C:\Windows\System\MmvEVOU.exe
  C:\Windows\System\MmvEVOU.exe
  2⤵
  PID:9452
- C:\Windows\System\GREMFyM.exe
  C:\Windows\System\GREMFyM.exe
  2⤵
  PID:9996
- C:\Windows\System\wXWZepu.exe
  C:\Windows\System\wXWZepu.exe
  2⤵
  PID:10124
- C:\Windows\System\RyVdjwu.exe
  C:\Windows\System\RyVdjwu.exe
  2⤵
  PID:8028
- C:\Windows\System\JjLNSfR.exe
  C:\Windows\System\JjLNSfR.exe
  2⤵
  PID:6616
- C:\Windows\System\fULRWYK.exe
  C:\Windows\System\fULRWYK.exe
  2⤵
  PID:9960
- C:\Windows\System\SKgjSjw.exe
  C:\Windows\System\SKgjSjw.exe
  2⤵
  PID:10028
- C:\Windows\System\ecNmSdp.exe
  C:\Windows\System\ecNmSdp.exe
  2⤵
  PID:9568
- C:\Windows\System\wYPsyOa.exe
  C:\Windows\System\wYPsyOa.exe
  2⤵
  PID:10248
- C:\Windows\System\qRhOiMA.exe
  C:\Windows\System\qRhOiMA.exe
  2⤵
  PID:10264
- C:\Windows\System\XrCJhmO.exe
  C:\Windows\System\XrCJhmO.exe
  2⤵
  PID:10288
- C:\Windows\System\cKgTqgn.exe
  C:\Windows\System\cKgTqgn.exe
  2⤵
  PID:10320
- C:\Windows\System\HXWDltB.exe
  C:\Windows\System\HXWDltB.exe
  2⤵
  PID:10660
- C:\Windows\System\XMvnxNC.exe
  C:\Windows\System\XMvnxNC.exe
  2⤵
  PID:10676
- C:\Windows\System\JKCnamN.exe
  C:\Windows\System\JKCnamN.exe
  2⤵
  PID:10692
- C:\Windows\System\AWeeiPc.exe
  C:\Windows\System\AWeeiPc.exe
  2⤵
  PID:10712
- C:\Windows\System\ONYoLzX.exe
  C:\Windows\System\ONYoLzX.exe
  2⤵
  PID:10728
- C:\Windows\System\yUDPiad.exe
  C:\Windows\System\yUDPiad.exe
  2⤵
  PID:10744
- C:\Windows\System\CkTCFoJ.exe
  C:\Windows\System\CkTCFoJ.exe
  2⤵
  PID:10772
- C:\Windows\System\RezJrDb.exe
  C:\Windows\System\RezJrDb.exe
  2⤵
  PID:10788
- C:\Windows\System\fKjuxke.exe
  C:\Windows\System\fKjuxke.exe
  2⤵
  PID:10812
- C:\Windows\System\pBAfPRX.exe
  C:\Windows\System\pBAfPRX.exe
  2⤵
  PID:10836
- C:\Windows\System\TaaEGRh.exe
  C:\Windows\System\TaaEGRh.exe
  2⤵
  PID:10856
- C:\Windows\System\BVjqlsY.exe
  C:\Windows\System\BVjqlsY.exe
  2⤵
  PID:10880
- C:\Windows\System\JIKSXYo.exe
  C:\Windows\System\JIKSXYo.exe
  2⤵
  PID:10904
- C:\Windows\System\PiyhuZT.exe
  C:\Windows\System\PiyhuZT.exe
  2⤵
  PID:10928
- C:\Windows\System\LJxHyHU.exe
  C:\Windows\System\LJxHyHU.exe
  2⤵
  PID:10968
- C:\Windows\System\MzAFGoW.exe
  C:\Windows\System\MzAFGoW.exe
  2⤵
  PID:10984
- C:\Windows\System\ademTNZ.exe
  C:\Windows\System\ademTNZ.exe
  2⤵
  PID:11008
- C:\Windows\System\ZTXYStu.exe
  C:\Windows\System\ZTXYStu.exe
  2⤵
  PID:11028
- C:\Windows\System\QuegPdY.exe
  C:\Windows\System\QuegPdY.exe
  2⤵
  PID:11052
- C:\Windows\System\rmxXRJY.exe
  C:\Windows\System\rmxXRJY.exe
  2⤵
  PID:11076
- C:\Windows\System\IPFJEDO.exe
  C:\Windows\System\IPFJEDO.exe
  2⤵
  PID:11092
- C:\Windows\System\LpJYPEX.exe
  C:\Windows\System\LpJYPEX.exe
  2⤵
  PID:11116
- C:\Windows\System\ZQvuntP.exe
  C:\Windows\System\ZQvuntP.exe
  2⤵
  PID:11136
- C:\Windows\System\eAhjDPI.exe
  C:\Windows\System\eAhjDPI.exe
  2⤵
  PID:11156
- C:\Windows\System\NlRJBcn.exe
  C:\Windows\System\NlRJBcn.exe
  2⤵
  PID:11172
- C:\Windows\System\dikZpMG.exe
  C:\Windows\System\dikZpMG.exe
  2⤵
  PID:11192
- C:\Windows\System\HjwIhCD.exe
  C:\Windows\System\HjwIhCD.exe
  2⤵
  PID:11212
- C:\Windows\System\PrJsBxa.exe
  C:\Windows\System\PrJsBxa.exe
  2⤵
  PID:11228
- C:\Windows\System\nvoDYhE.exe
  C:\Windows\System\nvoDYhE.exe
  2⤵
  PID:11248
- C:\Windows\System\JxJNrAh.exe
  C:\Windows\System\JxJNrAh.exe
  2⤵
  PID:9696
- C:\Windows\System\cuAsqLm.exe
  C:\Windows\System\cuAsqLm.exe
  2⤵
  PID:9104
- C:\Windows\System\ExbrzBy.exe
  C:\Windows\System\ExbrzBy.exe
  2⤵
  PID:3628
- C:\Windows\System\YsASfqO.exe
  C:\Windows\System\YsASfqO.exe
  2⤵
  PID:9848
- C:\Windows\System\aRMeVBT.exe
  C:\Windows\System\aRMeVBT.exe
  2⤵
  PID:9924
- C:\Windows\System\SRQVLsF.exe
  C:\Windows\System\SRQVLsF.exe
  2⤵
  PID:8884
- C:\Windows\System\eGiXWYS.exe
  C:\Windows\System\eGiXWYS.exe
  2⤵
  PID:9052
- C:\Windows\System\ekxQmtS.exe
  C:\Windows\System\ekxQmtS.exe
  2⤵
  PID:6808
- C:\Windows\System\PaYpPBk.exe
  C:\Windows\System\PaYpPBk.exe
  2⤵
  PID:9308
- C:\Windows\System\iEOweeH.exe
  C:\Windows\System\iEOweeH.exe
  2⤵
  PID:9936
- C:\Windows\System\EsHrNJW.exe
  C:\Windows\System\EsHrNJW.exe
  2⤵
  PID:10072
- C:\Windows\System\ZFFdPML.exe
  C:\Windows\System\ZFFdPML.exe
  2⤵
  PID:11292
- C:\Windows\System\MdxeaPO.exe
  C:\Windows\System\MdxeaPO.exe
  2⤵
  PID:11308
- C:\Windows\System\McItdkk.exe
  C:\Windows\System\McItdkk.exe
  2⤵
  PID:11332
- C:\Windows\System\mdLJIUa.exe
  C:\Windows\System\mdLJIUa.exe
  2⤵
  PID:11348
- C:\Windows\System\seFNpNi.exe
  C:\Windows\System\seFNpNi.exe
  2⤵
  PID:11372
- C:\Windows\System\hCuoakA.exe
  C:\Windows\System\hCuoakA.exe
  2⤵
  PID:11388
- C:\Windows\System\BrwXFiw.exe
  C:\Windows\System\BrwXFiw.exe
  2⤵
  PID:11404
- C:\Windows\System\jTcdYFo.exe
  C:\Windows\System\jTcdYFo.exe
  2⤵
  PID:11424
- C:\Windows\System\XSSgJNO.exe
  C:\Windows\System\XSSgJNO.exe
  2⤵
  PID:11440
- C:\Windows\System\SvJnYSr.exe
  C:\Windows\System\SvJnYSr.exe
  2⤵
  PID:11456
- C:\Windows\System\QwxIgXD.exe
  C:\Windows\System\QwxIgXD.exe
  2⤵
  PID:11472
- C:\Windows\System\iwlQPXB.exe
  C:\Windows\System\iwlQPXB.exe
  2⤵
  PID:11488
- C:\Windows\System\LWJzdlh.exe
  C:\Windows\System\LWJzdlh.exe
  2⤵
  PID:11508
- C:\Windows\System\CFGePTc.exe
  C:\Windows\System\CFGePTc.exe
  2⤵
  PID:11528
- C:\Windows\System\psxZQCm.exe
  C:\Windows\System\psxZQCm.exe
  2⤵
  PID:11560
- C:\Windows\System\nUIacvp.exe
  C:\Windows\System\nUIacvp.exe
  2⤵
  PID:11576
- C:\Windows\System\efyCpSx.exe
  C:\Windows\System\efyCpSx.exe
  2⤵
  PID:11600
- C:\Windows\System\PEfAIQJ.exe
  C:\Windows\System\PEfAIQJ.exe
  2⤵
  PID:11616
- C:\Windows\System\IWAZhun.exe
  C:\Windows\System\IWAZhun.exe
  2⤵
  PID:11636
- C:\Windows\System\hECWqGI.exe
  C:\Windows\System\hECWqGI.exe
  2⤵
  PID:11656
- C:\Windows\System\gLlSUsF.exe
  C:\Windows\System\gLlSUsF.exe
  2⤵
  PID:11680
- C:\Windows\System\AoEhFZv.exe
  C:\Windows\System\AoEhFZv.exe
  2⤵
  PID:11704
- C:\Windows\System\oxyNgbi.exe
  C:\Windows\System\oxyNgbi.exe
  2⤵
  PID:11720
- C:\Windows\System\IPxLhPZ.exe
  C:\Windows\System\IPxLhPZ.exe
  2⤵
  PID:11748
- C:\Windows\System\gPwxYTT.exe
  C:\Windows\System\gPwxYTT.exe
  2⤵
  PID:11764
- C:\Windows\System\FKCDYCH.exe
  C:\Windows\System\FKCDYCH.exe
  2⤵
  PID:11824
- C:\Windows\System\TUKkBpJ.exe
  C:\Windows\System\TUKkBpJ.exe
  2⤵
  PID:11844
- C:\Windows\System\CPspBkS.exe
  C:\Windows\System\CPspBkS.exe
  2⤵
  PID:11868
- C:\Windows\System\tDGLtut.exe
  C:\Windows\System\tDGLtut.exe
  2⤵
  PID:11884
- C:\Windows\System\rHkLNdK.exe
  C:\Windows\System\rHkLNdK.exe
  2⤵
  PID:11904
- C:\Windows\System\bBxRIrO.exe
  C:\Windows\System\bBxRIrO.exe
  2⤵
  PID:11920
- C:\Windows\System\kbjPhmC.exe
  C:\Windows\System\kbjPhmC.exe
  2⤵
  PID:11940
- C:\Windows\System\ywQXkwJ.exe
  C:\Windows\System\ywQXkwJ.exe
  2⤵
  PID:11980
- C:\Windows\System\QrGPsWJ.exe
  C:\Windows\System\QrGPsWJ.exe
  2⤵
  PID:11996
- C:\Windows\System\DGjtzGV.exe
  C:\Windows\System\DGjtzGV.exe
  2⤵
  PID:12012
- C:\Windows\System\KAFCTSE.exe
  C:\Windows\System\KAFCTSE.exe
  2⤵
  PID:12032
- C:\Windows\System\OEjamIP.exe
  C:\Windows\System\OEjamIP.exe
  2⤵
  PID:12052
- C:\Windows\System\MrUFCei.exe
  C:\Windows\System\MrUFCei.exe
  2⤵
  PID:12072
- C:\Windows\System\JEdzeDV.exe
  C:\Windows\System\JEdzeDV.exe
  2⤵
  PID:12092
- C:\Windows\System\hHNUYSF.exe
  C:\Windows\System\hHNUYSF.exe
  2⤵
  PID:12112
- C:\Windows\System\RuWIdrV.exe
  C:\Windows\System\RuWIdrV.exe
  2⤵
  PID:12140
- C:\Windows\System\REDNczR.exe
  C:\Windows\System\REDNczR.exe
  2⤵
  PID:12156
- C:\Windows\System\cBXhZwu.exe
  C:\Windows\System\cBXhZwu.exe
  2⤵
  PID:12176
- C:\Windows\System\ULhYsEV.exe
  C:\Windows\System\ULhYsEV.exe
  2⤵
  PID:12196
- C:\Windows\System\HbleRQb.exe
  C:\Windows\System\HbleRQb.exe
  2⤵
  PID:12216
- C:\Windows\System\SkQeRaO.exe
  C:\Windows\System\SkQeRaO.exe
  2⤵
  PID:12236
- C:\Windows\System\AoCphVJ.exe
  C:\Windows\System\AoCphVJ.exe
  2⤵
  PID:12256
- C:\Windows\System\fKKxNup.exe
  C:\Windows\System\fKKxNup.exe
  2⤵
  PID:12272
- C:\Windows\System\enykmeP.exe
  C:\Windows\System\enykmeP.exe
  2⤵
  PID:9612
- C:\Windows\System\dGalftF.exe
  C:\Windows\System\dGalftF.exe
  2⤵
  PID:10108
- C:\Windows\System\itIUubm.exe
  C:\Windows\System\itIUubm.exe
  2⤵
  PID:10144
- C:\Windows\System\vyDTfyG.exe
  C:\Windows\System\vyDTfyG.exe
  2⤵
  PID:976
- C:\Windows\System\iMZcBqI.exe
  C:\Windows\System\iMZcBqI.exe
  2⤵
  PID:1784
- C:\Windows\System\TWLuRHm.exe
  C:\Windows\System\TWLuRHm.exe
  2⤵
  PID:8724
- C:\Windows\System\AwHdZpG.exe
  C:\Windows\System\AwHdZpG.exe
  2⤵
  PID:8852
- C:\Windows\System\sfbNJLV.exe
  C:\Windows\System\sfbNJLV.exe
  2⤵
  PID:640
- C:\Windows\System\HcnJOtD.exe
  C:\Windows\System\HcnJOtD.exe
  2⤵
  PID:10876
- C:\Windows\System\KCwmzap.exe
  C:\Windows\System\KCwmzap.exe
  2⤵
  PID:10900
- C:\Windows\System\uTxOOQj.exe
  C:\Windows\System\uTxOOQj.exe
  2⤵
  PID:8500
- C:\Windows\System\ALDkOSA.exe
  C:\Windows\System\ALDkOSA.exe
  2⤵
  PID:5100
- C:\Windows\System\luZMAFI.exe
  C:\Windows\System\luZMAFI.exe
  2⤵
  PID:7192
- C:\Windows\System\mdjleRL.exe
  C:\Windows\System\mdjleRL.exe
  2⤵
  PID:11144
- C:\Windows\System\ZIwpndl.exe
  C:\Windows\System\ZIwpndl.exe
  2⤵
  PID:11168
- C:\Windows\System\ddndwpf.exe
  C:\Windows\System\ddndwpf.exe
  2⤵
  PID:7468
- C:\Windows\System\OYBVnKy.exe
  C:\Windows\System\OYBVnKy.exe
  2⤵
  PID:9628
- C:\Windows\System\vsloUKf.exe
  C:\Windows\System\vsloUKf.exe
  2⤵
  PID:9004
- C:\Windows\System\gaJYcrk.exe
  C:\Windows\System\gaJYcrk.exe
  2⤵
  PID:10172
- C:\Windows\System\UaKchhM.exe
  C:\Windows\System\UaKchhM.exe
  2⤵
  PID:9532
- C:\Windows\System\OgOsTVi.exe
  C:\Windows\System\OgOsTVi.exe
  2⤵
  PID:11340
- C:\Windows\System\OpbZIoP.exe
  C:\Windows\System\OpbZIoP.exe
  2⤵
  PID:11368
- C:\Windows\System\TvTHCwA.exe
  C:\Windows\System\TvTHCwA.exe
  2⤵
  PID:11436
- C:\Windows\System\pEtmMuo.exe
  C:\Windows\System\pEtmMuo.exe
  2⤵
  PID:12296
- C:\Windows\System\AmbGrMx.exe
  C:\Windows\System\AmbGrMx.exe
  2⤵
  PID:12316
- C:\Windows\System\QSKTlMD.exe
  C:\Windows\System\QSKTlMD.exe
  2⤵
  PID:12344
- C:\Windows\System\gLUxeuk.exe
  C:\Windows\System\gLUxeuk.exe
  2⤵
  PID:12364
- C:\Windows\System\fhZOyoh.exe
  C:\Windows\System\fhZOyoh.exe
  2⤵
  PID:12384
- C:\Windows\System\JzjtIrR.exe
  C:\Windows\System\JzjtIrR.exe
  2⤵
  PID:12404
- C:\Windows\System\bAyFRSV.exe
  C:\Windows\System\bAyFRSV.exe
  2⤵
  PID:12448
- C:\Windows\System\qvBvJBm.exe
  C:\Windows\System\qvBvJBm.exe
  2⤵
  PID:12464
- C:\Windows\System\aaqEuOE.exe
  C:\Windows\System\aaqEuOE.exe
  2⤵
  PID:12484
- C:\Windows\System\HiDPcPa.exe
  C:\Windows\System\HiDPcPa.exe
  2⤵
  PID:12500
- C:\Windows\System\HIElDKT.exe
  C:\Windows\System\HIElDKT.exe
  2⤵
  PID:12524
- C:\Windows\System\EacgIeu.exe
  C:\Windows\System\EacgIeu.exe
  2⤵
  PID:12540
- C:\Windows\System\TVsvDiJ.exe
  C:\Windows\System\TVsvDiJ.exe
  2⤵
  PID:12564
- C:\Windows\System\gjChAYL.exe
  C:\Windows\System\gjChAYL.exe
  2⤵
  PID:12584
- C:\Windows\System\DbZcZXM.exe
  C:\Windows\System\DbZcZXM.exe
  2⤵
  PID:12604
- C:\Windows\System\RcvTcfF.exe
  C:\Windows\System\RcvTcfF.exe
  2⤵
  PID:12624
- C:\Windows\System\pitElUs.exe
  C:\Windows\System\pitElUs.exe
  2⤵
  PID:12640
- C:\Windows\System\VWtczLu.exe
  C:\Windows\System\VWtczLu.exe
  2⤵
  PID:12660
- C:\Windows\System\qFvOtLC.exe
  C:\Windows\System\qFvOtLC.exe
  2⤵
  PID:12704
- C:\Windows\System\zNkKoqS.exe
  C:\Windows\System\zNkKoqS.exe
  2⤵
  PID:12724
- C:\Windows\System\AlETyxH.exe
  C:\Windows\System\AlETyxH.exe
  2⤵
  PID:12744
- C:\Windows\System\RGIgEQO.exe
  C:\Windows\System\RGIgEQO.exe
  2⤵
  PID:12760
- C:\Windows\System\MEsGThn.exe
  C:\Windows\System\MEsGThn.exe
  2⤵
  PID:12780
- C:\Windows\System\fIIZUqo.exe
  C:\Windows\System\fIIZUqo.exe
  2⤵
  PID:12800
- C:\Windows\System\zzAWgXN.exe
  C:\Windows\System\zzAWgXN.exe
  2⤵
  PID:12824
- C:\Windows\System\fxYJelJ.exe
  C:\Windows\System\fxYJelJ.exe
  2⤵
  PID:12848
- C:\Windows\System\bDyBmbO.exe
  C:\Windows\System\bDyBmbO.exe
  2⤵
  PID:12876
- C:\Windows\System\YqLBoMa.exe
  C:\Windows\System\YqLBoMa.exe
  2⤵
  PID:12896
- C:\Windows\System\SbQAzzX.exe
  C:\Windows\System\SbQAzzX.exe
  2⤵
  PID:12916
- C:\Windows\System\qcvsbPo.exe
  C:\Windows\System\qcvsbPo.exe
  2⤵
  PID:12936
- C:\Windows\System\qUIMBEC.exe
  C:\Windows\System\qUIMBEC.exe
  2⤵
  PID:12960
- C:\Windows\System\ClSYsXp.exe
  C:\Windows\System\ClSYsXp.exe
  2⤵
  PID:12980
- C:\Windows\System\wCSDmRF.exe
  C:\Windows\System\wCSDmRF.exe
  2⤵
  PID:13000
- C:\Windows\System\ByMpvmx.exe
  C:\Windows\System\ByMpvmx.exe
  2⤵
  PID:13016
- C:\Windows\System\MRBlPdi.exe
  C:\Windows\System\MRBlPdi.exe
  2⤵
  PID:13036
- C:\Windows\System\LLHNCYx.exe
  C:\Windows\System\LLHNCYx.exe
  2⤵
  PID:13052
- C:\Windows\System\VYzzRqd.exe
  C:\Windows\System\VYzzRqd.exe
  2⤵
  PID:13076
- C:\Windows\System\JRysQDC.exe
  C:\Windows\System\JRysQDC.exe
  2⤵
  PID:13092
- C:\Windows\System\GniNPZV.exe
  C:\Windows\System\GniNPZV.exe
  2⤵
  PID:13112
- C:\Windows\System\aFqqsgx.exe
  C:\Windows\System\aFqqsgx.exe
  2⤵
  PID:13132
- C:\Windows\System\hnZCGOS.exe
  C:\Windows\System\hnZCGOS.exe
  2⤵
  PID:13152
- C:\Windows\System\VLHPWtM.exe
  C:\Windows\System\VLHPWtM.exe
  2⤵
  PID:13172
- C:\Windows\System\pGtDPCe.exe
  C:\Windows\System\pGtDPCe.exe
  2⤵
  PID:13196
- C:\Windows\System\POPFPKW.exe
  C:\Windows\System\POPFPKW.exe
  2⤵
  PID:13216
- C:\Windows\System\bVhjndg.exe
  C:\Windows\System\bVhjndg.exe
  2⤵
  PID:13236
- C:\Windows\System\wHnSQuW.exe
  C:\Windows\System\wHnSQuW.exe
  2⤵
  PID:13256
- C:\Windows\System\DvvQKIi.exe
  C:\Windows\System\DvvQKIi.exe
  2⤵
  PID:13276
- C:\Windows\System\lICMfHU.exe
  C:\Windows\System\lICMfHU.exe
  2⤵
  PID:13304
- C:\Windows\System\XASQKng.exe
  C:\Windows\System\XASQKng.exe
  2⤵
  PID:9076
- C:\Windows\System\njdfNaY.exe
  C:\Windows\System\njdfNaY.exe
  2⤵
  PID:6724
- C:\Windows\System\xnkArGy.exe
  C:\Windows\System\xnkArGy.exe
  2⤵
  PID:11588
- C:\Windows\System\JwUvoZK.exe
  C:\Windows\System\JwUvoZK.exe
  2⤵
  PID:11816
- C:\Windows\System\BKNGMIY.exe
  C:\Windows\System\BKNGMIY.exe
  2⤵
  PID:11876
- C:\Windows\System\kpiCBhz.exe
  C:\Windows\System\kpiCBhz.exe
  2⤵
  PID:8404
- C:\Windows\System\fCowgie.exe
  C:\Windows\System\fCowgie.exe
  2⤵
  PID:10892
- C:\Windows\System\ftPFDXR.exe
  C:\Windows\System\ftPFDXR.exe
  2⤵
  PID:10924
- C:\Windows\System\vYGsGjc.exe
  C:\Windows\System\vYGsGjc.exe
  2⤵
  PID:8644
- C:\Windows\System\cjUMYez.exe
  C:\Windows\System\cjUMYez.exe
  2⤵
  PID:9940
- C:\Windows\System\OZQsFYS.exe
  C:\Windows\System\OZQsFYS.exe
  2⤵
  PID:10956
- C:\Windows\System\HRkjuck.exe
  C:\Windows\System\HRkjuck.exe
  2⤵
  PID:11000
- C:\Windows\System\wPoeXNR.exe
  C:\Windows\System\wPoeXNR.exe
  2⤵
  PID:11048
- C:\Windows\System\nxldfqo.exe
  C:\Windows\System\nxldfqo.exe
  2⤵
  PID:12004
- C:\Windows\System\plaOUit.exe
  C:\Windows\System\plaOUit.exe
  2⤵
  PID:12884
- C:\Windows\System\jxSueyi.exe
  C:\Windows\System\jxSueyi.exe
  2⤵
  PID:12952
- C:\Windows\System\guycnba.exe
  C:\Windows\System\guycnba.exe
  2⤵
  PID:12996
- C:\Windows\System\dNPXlfB.exe
  C:\Windows\System\dNPXlfB.exe
  2⤵
  PID:9716
- C:\Windows\System\YVyLOdu.exe
  C:\Windows\System\YVyLOdu.exe
  2⤵
  PID:9188
- C:\Windows\System\kcNzikv.exe
  C:\Windows\System\kcNzikv.exe
  2⤵
  PID:2736
- C:\Windows\System\hdngIpa.exe
  C:\Windows\System\hdngIpa.exe
  2⤵
  PID:8364
- C:\Windows\System\EfmgEBB.exe
  C:\Windows\System\EfmgEBB.exe
  2⤵
  PID:11932
- C:\Windows\System\RdVsCJk.exe
  C:\Windows\System\RdVsCJk.exe
  2⤵
  PID:11300
- C:\Windows\System\uokbIXv.exe
  C:\Windows\System\uokbIXv.exe
  2⤵
  PID:5104
- C:\Windows\System\yxJLyvV.exe
  C:\Windows\System\yxJLyvV.exe
  2⤵
  PID:6644
- C:\Windows\System\yvGCTip.exe
  C:\Windows\System\yvGCTip.exe
  2⤵
  PID:11416
- C:\Windows\System\fvKEcFL.exe
  C:\Windows\System\fvKEcFL.exe
  2⤵
  PID:11536
- C:\Windows\System\twElkSP.exe
  C:\Windows\System\twElkSP.exe
  2⤵
  PID:11572
- C:\Windows\System\fFoxTfw.exe
  C:\Windows\System\fFoxTfw.exe
  2⤵
  PID:4480
- C:\Windows\System\behwINP.exe
  C:\Windows\System\behwINP.exe
  2⤵
  PID:11648
- C:\Windows\System\ecSyklV.exe
  C:\Windows\System\ecSyklV.exe
  2⤵
  PID:11676
- C:\Windows\System\SJOmqfa.exe
  C:\Windows\System\SJOmqfa.exe
  2⤵
  PID:11716
- C:\Windows\System\NHwTGKw.exe
  C:\Windows\System\NHwTGKw.exe
  2⤵
  PID:11756
- C:\Windows\System\ehWYVLj.exe
  C:\Windows\System\ehWYVLj.exe
  2⤵
  PID:11780
- C:\Windows\System\zRluFdU.exe
  C:\Windows\System\zRluFdU.exe
  2⤵
  PID:11796
- C:\Windows\System\UzfoSMe.exe
  C:\Windows\System\UzfoSMe.exe
  2⤵
  PID:11900
- C:\Windows\System\eOSYeRh.exe
  C:\Windows\System\eOSYeRh.exe
  2⤵
  PID:3636
- C:\Windows\System\ecSguQc.exe
  C:\Windows\System\ecSguQc.exe
  2⤵
  PID:12084
- C:\Windows\System\HrlXWeR.exe
  C:\Windows\System\HrlXWeR.exe
  2⤵
  PID:12192
- C:\Windows\System\ZivwKzR.exe
  C:\Windows\System\ZivwKzR.exe
  2⤵
  PID:12264
- C:\Windows\System\CDXJWbd.exe
  C:\Windows\System\CDXJWbd.exe
  2⤵
  PID:10468
- C:\Windows\System\AeLyLAv.exe
  C:\Windows\System\AeLyLAv.exe
  2⤵
  PID:8032
- C:\Windows\System\yAzyBVx.exe
  C:\Windows\System\yAzyBVx.exe
  2⤵
  PID:12792
- C:\Windows\System\yghOstx.exe
  C:\Windows\System\yghOstx.exe
  2⤵
  PID:3604
- C:\Windows\System\MlClJmD.exe
  C:\Windows\System\MlClJmD.exe
  2⤵
  PID:11020
- C:\Windows\System\SMeoWOu.exe
  C:\Windows\System\SMeoWOu.exe
  2⤵
  PID:12912
- C:\Windows\System\vBbjolD.exe
  C:\Windows\System\vBbjolD.exe
  2⤵
  PID:11256
- C:\Windows\System\PLaZjcI.exe
  C:\Windows\System\PLaZjcI.exe
  2⤵
  PID:10296
- C:\Windows\System\psCZtIm.exe
  C:\Windows\System\psCZtIm.exe
  2⤵
  PID:11412
- C:\Windows\System\OVVGOZY.exe
  C:\Windows\System\OVVGOZY.exe
  2⤵
  PID:2400
- C:\Windows\System\CaqVXKS.exe
  C:\Windows\System\CaqVXKS.exe
  2⤵
  PID:2676
- C:\Windows\System\ZwVRAyf.exe
  C:\Windows\System\ZwVRAyf.exe
  2⤵
  PID:12064
- C:\Windows\System\KfWtvwW.exe
  C:\Windows\System\KfWtvwW.exe
  2⤵
  PID:10176
- C:\Windows\System\oIHuqLV.exe
  C:\Windows\System\oIHuqLV.exe
  2⤵
  PID:11892
- C:\Windows\System\EjCtaJC.exe
  C:\Windows\System\EjCtaJC.exe
  2⤵
  PID:8160
- C:\Windows\System\XkndbFh.exe
  C:\Windows\System\XkndbFh.exe
  2⤵
  PID:10000
- C:\Windows\System\RTFeieG.exe
  C:\Windows\System\RTFeieG.exe
  2⤵
  PID:9672
- C:\Windows\System\SACTlcL.exe
  C:\Windows\System\SACTlcL.exe
  2⤵
  PID:10204
- C:\Windows\System\kPMvXQk.exe
  C:\Windows\System\kPMvXQk.exe
  2⤵
  PID:9360
- C:\Windows\System\pxrdfgi.exe
  C:\Windows\System\pxrdfgi.exe
  2⤵
  PID:3764
- C:\Windows\System\xrOBPKZ.exe
  C:\Windows\System\xrOBPKZ.exe
  2⤵
  PID:1404
- C:\Windows\System\xVZyciL.exe
  C:\Windows\System\xVZyciL.exe
  2⤵
  PID:3356
- C:\Windows\System\wmQqZHH.exe
  C:\Windows\System\wmQqZHH.exe
  2⤵
  PID:12648
- C:\Windows\System\mxXHAHv.exe
  C:\Windows\System\mxXHAHv.exe
  2⤵
  PID:12808
- C:\Windows\System\RXMCnSS.exe
  C:\Windows\System\RXMCnSS.exe
  2⤵
  PID:8424
- C:\Windows\System\isqFtpi.exe
  C:\Windows\System\isqFtpi.exe
  2⤵
  PID:6892
- C:\Windows\System\vEiHftc.exe
  C:\Windows\System\vEiHftc.exe
  2⤵
  PID:11124
- C:\Windows\System\dzrpCOE.exe
  C:\Windows\System\dzrpCOE.exe
  2⤵
  PID:12548
- C:\Windows\System\RDQchgW.exe
  C:\Windows\System\RDQchgW.exe
  2⤵
  PID:11584
- C:\Windows\System\dZlKqCY.exe
  C:\Windows\System\dZlKqCY.exe
  2⤵
  PID:11208
- C:\Windows\System\fGJwtAx.exe
  C:\Windows\System\fGJwtAx.exe
  2⤵
  PID:11700
- C:\Windows\System\PDABfEK.exe
  C:\Windows\System\PDABfEK.exe
  2⤵
  PID:10052
- C:\Windows\System\qNdYdUo.exe
  C:\Windows\System\qNdYdUo.exe
  2⤵
  PID:12372
- C:\Windows\System\xLJslyV.exe
  C:\Windows\System\xLJslyV.exe
  2⤵
  PID:10800
- C:\Windows\System\NeBubKi.exe
  C:\Windows\System\NeBubKi.exe
  2⤵
  PID:13088
- C:\Windows\System\wFYHVYV.exe
  C:\Windows\System\wFYHVYV.exe
  2⤵
  PID:12580
- C:\Windows\System\xcmMHoF.exe
  C:\Windows\System\xcmMHoF.exe
  2⤵
  PID:11948
- C:\Windows\System\HHFgIdF.exe
  C:\Windows\System\HHFgIdF.exe
  2⤵
  PID:12840
- C:\Windows\System\ApGGVHr.exe
  C:\Windows\System\ApGGVHr.exe
  2⤵
  PID:12020
- C:\Windows\System\VJRlJub.exe
  C:\Windows\System\VJRlJub.exe
  2⤵
  PID:764
- C:\Windows\System\hieMjly.exe
  C:\Windows\System\hieMjly.exe
  2⤵
  PID:10104
- C:\Windows\System\fMdUTrc.exe
  C:\Windows\System\fMdUTrc.exe
  2⤵
  PID:11712
- C:\Windows\System\ucSzoZu.exe
  C:\Windows\System\ucSzoZu.exe
  2⤵
  PID:10476
- C:\Windows\System\UKgoIel.exe
  C:\Windows\System\UKgoIel.exe
  2⤵
  PID:10564
- C:\Windows\System\KYPtmLe.exe
  C:\Windows\System\KYPtmLe.exe
  2⤵
  PID:3612
- C:\Windows\System\xmmWImJ.exe
  C:\Windows\System\xmmWImJ.exe
  2⤵
  PID:4708
- C:\Windows\System\jgZfEhW.exe
  C:\Windows\System\jgZfEhW.exe
  2⤵
  PID:10580
- C:\Windows\System\BPGYYth.exe
  C:\Windows\System\BPGYYth.exe
  2⤵
  PID:10592
- C:\Windows\System\jmIpbBt.exe
  C:\Windows\System\jmIpbBt.exe
  2⤵
  PID:8100
- C:\Windows\System\OSBcgmp.exe
  C:\Windows\System\OSBcgmp.exe
  2⤵
  PID:860
- C:\Windows\System\fmPYvLs.exe
  C:\Windows\System\fmPYvLs.exe
  2⤵
  PID:10644
- C:\Windows\System\aHgXquv.exe
  C:\Windows\System\aHgXquv.exe
  2⤵
  PID:9256
- C:\Windows\System\heOfbPW.exe
  C:\Windows\System\heOfbPW.exe
  2⤵
  PID:10648
- C:\Windows\System\jvrMBOL.exe
  C:\Windows\System\jvrMBOL.exe
  2⤵
  PID:8684
- C:\Windows\System\hNOGDKH.exe
  C:\Windows\System\hNOGDKH.exe
  2⤵
  PID:10720
- C:\Windows\System\dHdlrYL.exe
  C:\Windows\System\dHdlrYL.exe
  2⤵
  PID:10808
- C:\Windows\System\IbMGsXb.exe
  C:\Windows\System\IbMGsXb.exe
  2⤵
  PID:13012
- C:\Windows\System\kFHJJlU.exe
  C:\Windows\System\kFHJJlU.exe
  2⤵
  PID:4248
- C:\Windows\System\ctlNiOH.exe
  C:\Windows\System\ctlNiOH.exe
  2⤵
  PID:13108
- C:\Windows\System\zubrexx.exe
  C:\Windows\System\zubrexx.exe
  2⤵
  PID:13380
- C:\Windows\System\hMKEvhp.exe
  C:\Windows\System\hMKEvhp.exe
  2⤵
  PID:13604
- C:\Windows\System\FqDFzgy.exe
  C:\Windows\System\FqDFzgy.exe
  2⤵
  PID:13632
- C:\Windows\System\tNqLsll.exe
  C:\Windows\System\tNqLsll.exe
  2⤵
  PID:13732
- C:\Windows\System\UvTtRic.exe
  C:\Windows\System\UvTtRic.exe
  2⤵
  PID:13788
- C:\Windows\System\kHFOjkB.exe
  C:\Windows\System\kHFOjkB.exe
  2⤵
  PID:13820
- C:\Windows\System\xuSNtlX.exe
  C:\Windows\System\xuSNtlX.exe
  2⤵
  PID:13836
- C:\Windows\System\XeLESyC.exe
  C:\Windows\System\XeLESyC.exe
  2⤵
  PID:13872
- C:\Windows\System\VQSMwEO.exe
  C:\Windows\System\VQSMwEO.exe
  2⤵
  PID:13896
- C:\Windows\System\xukKUKA.exe
  C:\Windows\System\xukKUKA.exe
  2⤵
  PID:13980
- C:\Windows\System\HFzjmLa.exe
  C:\Windows\System\HFzjmLa.exe
  2⤵
  PID:14016
- C:\Windows\System\sRzXjYz.exe
  C:\Windows\System\sRzXjYz.exe
  2⤵
  PID:14064
- C:\Windows\System\mBAujQa.exe
  C:\Windows\System\mBAujQa.exe
  2⤵
  PID:14092
- C:\Windows\System\vTuPOtc.exe
  C:\Windows\System\vTuPOtc.exe
  2⤵
  PID:14116
- C:\Windows\System\cApgUSH.exe
  C:\Windows\System\cApgUSH.exe
  2⤵
  PID:14140
- C:\Windows\System\DxQFYpQ.exe
  C:\Windows\System\DxQFYpQ.exe
  2⤵
  PID:14164
- C:\Windows\System\HkBEjxW.exe
  C:\Windows\System\HkBEjxW.exe
  2⤵
  PID:14212
- C:\Windows\System\vYyOFJD.exe
  C:\Windows\System\vYyOFJD.exe
  2⤵
  PID:14240
- C:\Windows\System\NjAYvEm.exe
  C:\Windows\System\NjAYvEm.exe
  2⤵
  PID:14260
- C:\Windows\System\snHhwmx.exe
  C:\Windows\System\snHhwmx.exe
  2⤵
  PID:14280
- C:\Windows\System\PQkAImE.exe
  C:\Windows\System\PQkAImE.exe
  2⤵
  PID:9752
- C:\Windows\System\HkQPHiV.exe
  C:\Windows\System\HkQPHiV.exe
  2⤵
  PID:10936
- C:\Windows\System\yxQIjNy.exe
  C:\Windows\System\yxQIjNy.exe
  2⤵
  PID:13168
- C:\Windows\System\xCIBlOp.exe
  C:\Windows\System\xCIBlOp.exe
  2⤵
  PID:13588
- C:\Windows\System\AZSqzCr.exe
  C:\Windows\System\AZSqzCr.exe
  2⤵
  PID:13472
- C:\Windows\System\NQZgiKN.exe
  C:\Windows\System\NQZgiKN.exe
  2⤵
  PID:12612
- C:\Windows\System\PBwSTZv.exe
  C:\Windows\System\PBwSTZv.exe
  2⤵
  PID:13712
- C:\Windows\System\HMaFFds.exe
  C:\Windows\System\HMaFFds.exe
  2⤵
  PID:13524
- C:\Windows\System\sNgxrIC.exe
  C:\Windows\System\sNgxrIC.exe
  2⤵
  PID:13684

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 648 -p 4356 -ip 4356
1⤵
PID:8684

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 764 -p 12624 -ip 12624
1⤵
PID:9752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ar424mni.sva.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EWQYZKx.exe

Filesize
1.6MB

MD5
2c6f207b07d5bb7bd5edd51439326e0f

SHA1
f9e1b7f57599ee34eaa1d815a9024479b4cb26f6

SHA256
ceff93483fa634cdc8a6a2a8c32b62763ade0167c999ee6578210f0a8fb764e1

SHA512
7e1cebdafdbca5c1f21f0c5342fd157bbafdd83b7ecbd45e7d8163e14aec56e6776eb4295c9c59a66813d1d296462679e8768a56306a311b0eac32a20543ac30

Download Submit
C:\Windows\System\EmkoBdq.exe

Filesize
1.6MB

MD5
65274eaa48f9cba7bbbcf5eee0fa71fd

SHA1
6aa0a41ec26f77263e095a9b10d6f1e98162a97b

SHA256
88f3650d195a3ff08bcad5aada69bc0e993e100444d71390ae9de24db12a7901

SHA512
26aaafeb2e0159c2fae3b5b8b1b89e83d6b7ca864588fa75d6d024c94a5b83c998068019cb916f7a23361d31c2e776e7f2c37a701812f53f9e56885fa5af0b7d

Download Submit
C:\Windows\System\HyJrJzB.exe

Filesize
1.6MB

MD5
59a46f46804a104c3e091dcffd62c85e

SHA1
4833c7fe2d2015fc07854a6666617be1c84d43ca

SHA256
cd1db57eae936f97a5d95fd59433468b2713fbb0eb59727e6d18563c80af3bf4

SHA512
d9a6a510f08f0dc4bb5f045da3123c872aa851ae8c01bb36d61835f71ab39e89ff952f1f9c6c8986b837fa76365d3ed7cd56b335a8194e2167e766c4e99976ae

Download Submit
C:\Windows\System\JCyXSzW.exe

Filesize
1.6MB

MD5
dfcab85350e897ea9fddd9632d91963e

SHA1
e9ce6ae385b25ab1eaaf04c0939d093cf342314e

SHA256
1b194d6f602eb6763fa14c8572646f5eb864973e44364078c35ada2944a8d07f

SHA512
2c0f053d1bbfc209e17640c22b3e03524ed1ef71ea27c8d86c711986c44a5a85c65f2eaf1565aeb1528ed252dd7969ef79c5f07db9c0ddd292da89dbb5efa61f

Download Submit
C:\Windows\System\JghfOLj.exe

Filesize
1.6MB

MD5
ea5b090e54378d288bab94ca687ab371

SHA1
29235088aeac7d58afeebfe4067256afdb541690

SHA256
c035d8a6e6dd003aa639feb277ec593b86d839b552477059cf0098c34bc1452d

SHA512
a6c2199074a66d1c8dc6883a87a71a6f2040766fb68fc972687817273c63dac1a834fdc3975b3857dd4e25643f7e96068a9b8888ecb88c04e80b51cdb3dcd29d

Download Submit
C:\Windows\System\LpjtCcv.exe

Filesize
1.6MB

MD5
08ef397707c6cb37b6e6aed5ade7dce7

SHA1
013499561bd314f9650c2e737d3fa9a8e708b883

SHA256
eb58e993637d76734ad403dbc06f3eb97e3566a218f25a59c0730203a43a4616

SHA512
a2bcd25abc04e41cbc9b8d871d321e06df82a60fea70c1051d144380d4deb7a677c60a8087630bddfe1b134a7e6449d054906d2767c868088b669cbe8c2e321f

Download Submit
C:\Windows\System\RXDYSIf.exe

Filesize
1.6MB

MD5
3fdb1cc2cf08362c03c3ad2f888848f5

SHA1
07e6ceb5f6bffaa800096fd4a4c4a56b23eec10a

SHA256
91f2a5cffc72795ae4dfddaf77dd359f9b84bdc5180662e89819fece4b3323e9

SHA512
b71557911ac44baab0bede51e26d7a4b02e33bf9b972f726b9a2e6c652aeb236ce06429468b21e4840426362f2d4d9141a3a16fbc2bc2db989d9a0f7ae0dfde9

Download Submit
C:\Windows\System\SJnAOVc.exe

Filesize
8B

MD5
f691a081f3fbc76f4d31ef7de17a6701

SHA1
c2f76e341f16e6acb16a6ddc45ff81004b3276d6

SHA256
450bfe715b4ccd0a120f80318a52bca1da767f73da444842c593d2dc3aa52f90

SHA512
f6ca059bd1fe81cd2b89f4a60769b80b184c327ad9125f03a3fb647cc5bd867822450e2063331cf912047a4388326ba03f9c0aa4adbfe96890a979115d876404

Download Submit
C:\Windows\System\TaurMkG.exe

Filesize
1.6MB

MD5
73131c9a21db976ede8aad6f31475ea6

SHA1
00a558eef53845d90632f4631d51b96f88aab3d1

SHA256
11b3e9de27ab0d0eba3b57f6de112845d527ba31f447df11ca3d431b9201a059

SHA512
1e21054b12ba65b759e82f07fc1ac717ffdfe6287ffe4f3e54035a82407450225dfadaa830bc80d5416792c8ed7ec2de19629bf5a8de60271273e77727affe58

Download Submit
C:\Windows\System\TkuPPmO.exe

Filesize
1.6MB

MD5
64e789274e5332adbed3b8384910f16f

SHA1
4c2e7d73e6c7670345361a0889a4e04233074ec4

SHA256
ad3ff0c74fc463f40fe7f4611fbad3ba63a698843ae66be20b4afcffd602a636

SHA512
d12b8109eac535a826589a7595980a06d32abf546d2874f9275c319b8fd3f6d5042d8b6704e83039c082514ef2da3c853a269351ad392a9e479fef5274e5e153

Download Submit
C:\Windows\System\TlzCHNQ.exe

Filesize
1.6MB

MD5
8739f05ec7d30bc1071666e724f89282

SHA1
9de48288825aee0db9c948baf2238814894370b1

SHA256
ac2b60591847821ca047ef2f7b4fb79f9474516ac72e5510a3d9c80deb90f8c7

SHA512
42e70cf03dad74cd9f33bbec2e17908cb22708f54392d0dcd5024d38ae03dad41a2a7fe0c918fc1b10124cb02903fa6ba3a031bcb359f074f3e3397d880d0837

Download Submit
C:\Windows\System\WsLwvUB.exe

Filesize
1.6MB

MD5
4ff5ae55fcfb72d2cafd49bcc2b97a96

SHA1
86ec1406d50dc1a51b901aad2b0a4f7e1b3c124a

SHA256
c4e0d210286d7d2b2ce0ae64bcb3bde776f1e5add00243befd428a94c6ca152d

SHA512
99707374ca15893a28afc7d181d6181706e85c40eeeeec104b21999029bcba37b1337c1842fe8af3da88c11efc9ac88b04246cd5a6ccf3db5b9854d2e5675651

Download Submit
C:\Windows\System\XKciiLV.exe

Filesize
1.6MB

MD5
5f0d2b45a466ec0e33d65b9cfbf27d17

SHA1
401da114f7b78c63d05009b12683b2b355710ee7

SHA256
bfa82bb84110af19eccab92d5336f731260de849a1fa76caf71eefd9bd1cc17b

SHA512
0702dd0b8addfdf36cd15abe4af578ad4f6baded9b4316229105015bf455a7b3948ac7bd70e4f5652aa66e0fd6b62b55785724aed166e13e0dee4b28707b3827

Download Submit
C:\Windows\System\YYCvKjT.exe

Filesize
1.6MB

MD5
44893e54e7aac27535c754c4a4f05eb7

SHA1
0345b4d160c47bf4c1437c7424d9fe6efa815ff3

SHA256
4ee91ad6c2026204c27a30c12ef925b26f2f4d15f8b902f9abbfcb01fc39b3c3

SHA512
05ad3627f95db9923b2d87f153f73fb55d0c65a6c715023deb9d217a83cc3f1a5817ab5550027afaea861936aa9b8632974b53ef9f598d9615bfdcdc8cdb1726

Download Submit
C:\Windows\System\aXUiHlU.exe

Filesize
1.6MB

MD5
91f43a5b6fcbcb59b80a8e84fa1ea882

SHA1
f9b2ffc38becd157436f3dde001e3341ac1942d2

SHA256
56159e331e217013963723529bb29356fd90bba58da1bed7cc0e01331c89cbd9

SHA512
3172d67083f44984ced9f026978824f090d880bfb0be00aa6e5443c28a19d01b71543ff4a900b0bab112f49c51b06ddf89f36093cc1a11516ebd3b3ab0f8f27f

Download Submit
C:\Windows\System\bGdJVJb.exe

Filesize
1.6MB

MD5
632d3fcd5fc16ef91eabe6df560c4c81

SHA1
6a00f24f84258f38f8c7aa412cc0c80b87cd96b3

SHA256
713f3ef4dbe34ca8d969de869c1fb7bc2613a3c2ec434d9118d678a1f430feaf

SHA512
b92a9fd994847cfbc583afe774a4d7a3c9ef1b0765a217512bffc5dffcb8ad1c767d152476be484f33e536b219fdaa3ebb31ed6a4a4127dfa5bd3b8febf76189

Download Submit
C:\Windows\System\bKLpkVW.exe

Filesize
1.6MB

MD5
4d9ff65a216930f670ed30434b6360b8

SHA1
3e4e5e26d3b45823de3af650f05e862c6c7a5022

SHA256
c37b20442b003010bc994e097364c6b5808efbc870698ab2e68b21ac82fe48bd

SHA512
287164b3f88f0cdbdccb60a57d730463c4e3e97c9736706e057faf863f8d85f39db333c7339126c6f991f71a73cd58adcd976785ab80b865d1d2a80d6803534f

Download Submit
C:\Windows\System\cADQcil.exe

Filesize
1.6MB

MD5
88563b9934c95a0609c14e27088571d0

SHA1
96034b42260631b72040418df83f18f7c4a47639

SHA256
c6fbe5872fdd981339c07d3e1e6e58037f7dd1cb5de58fdf7afd5f6331a725c7

SHA512
0ce00eb5f90590b36e2f39c7307b7bdd48cad21cd4bd476a4d4a15afa84e658b98e5520e4256da97512842248632d4c40aa52b70298e7b11d3ef87144b8af383

Download Submit
C:\Windows\System\dgChxFt.exe

Filesize
1.6MB

MD5
2bbd7479d3f009dd323154ee17a14ca3

SHA1
d271f481c2cc7a2777a429d07fe08d262cc272d5

SHA256
9f1eff0635a7c6ce5f29180d6d97c823c76b480d876008f1437315fe60da7c31

SHA512
86f05c07e7a3a3ad57e71748f61936540b6ea47fa309534ac956ea8340ab75db17f0a1f9a4494143977901d39e9f7ecff9210820c9768cd21a107b7a3a29d409

Download Submit
C:\Windows\System\fWWCMLD.exe

Filesize
1.6MB

MD5
ab2e836ddab16c67973a967da5e0d9d9

SHA1
be121584c6edd97276a0f749cf4aa53bb830ae8a

SHA256
4fa5816f36914569f9a330bcf1d5e92ea2eaf181a7df7dc344f0a6c780ca6dd0

SHA512
dd5afed8393e5e567f1338b36e79d14a04703247157460b480f7b8239ccb5df1057cc196e576666b0445b04375efb731c8bc20fbcfd2a3d677a5c008eb044d77

Download Submit
C:\Windows\System\gAKbDBx.exe

Filesize
1.6MB

MD5
2d55aeb33a571cb988916c46cee1993c

SHA1
fac4b5b9106f6f8690e074152c69252fed6e927a

SHA256
74fee1ba30cec30706376ceb7abc4375cd42115184646725471564c1eb1ac4ca

SHA512
2e93a3a36d732c17adc8822f2f7c1d4cb4f404bed140fcfec0160373814e2af46117a5709bc62e8a18e1c1d7eb6e012aa0e262afb7870a55b10a235d12710e14

Download Submit
C:\Windows\System\gHfGVfP.exe

Filesize
1.6MB

MD5
405aec2d1216877c45f5ccc7e208dd74

SHA1
fd9e99dac0236b62f441fb93e126bbff2f20d3d5

SHA256
702425cbddd10f70251f4b4acb876268ab6d3e1ea4c9a3a8f8e72b3d1313c011

SHA512
7e7d208b323178cda9848118e58dd00deff09c939366114150c173979b38900df75eb8226ed02ea37315defb989b8f549180fe5466b69b7cc0de3d9b687f5441

Download Submit
C:\Windows\System\gciVENE.exe

Filesize
1.6MB

MD5
a43e8fb4b023a792df3a0a4000591dea

SHA1
772f819d058d184f2df1576d572bb6948761db14

SHA256
e5de3bcc0efb8621b39e6f46d135a4389435a426e1c2572665b3a012a9e3cb75

SHA512
4733701f7616816e92f09b42fa3608cfd78e71dab715605c6a5bd9bde42b3ff2c689484e123cf2e41b0a7308aa103643da70d6e22ff2e13cb6a97b49dc6e1bb0

Download Submit
C:\Windows\System\gvqSapK.exe

Filesize
1.6MB

MD5
ee264161c37fd5141e70992f6d16ef58

SHA1
4024bc9413a48615f8e1f29c4a3c1c6c6329f068

SHA256
d114e8dc4452511251cd9783551b7f64f78a11a25bfb8e9478de2b075178b983

SHA512
758937d0e78701d0e8584f3758ca45c210a32fa41e15783862f00fc6178c9b3a1777709fa36d52c0493318d6d11801c0181bdf647397274fad9dd2229ea3b0d8

Download Submit
C:\Windows\System\hBodIVS.exe

Filesize
1.6MB

MD5
f8bcf0b2798f52b3aa8254d1fa077aef

SHA1
f2480066e7af2fe002de4e5b08c37c3d8d04bc19

SHA256
fa50ba3620c4d060ffce090f712c37fe1cb0008b9f877575b1ffd6f4b1c30bce

SHA512
006574168cb7cedba8c6b31710945aad007bebc4150631b7782bcedd79bf81a5385a102f2251480531dc2fa00e6880ccd5f9ab95aa10874ba4906ea7b475af94

Download Submit
C:\Windows\System\hMkXgpi.exe

Filesize
1.6MB

MD5
0ae9862c3ba19209517087f6da9e0ed2

SHA1
84b7a0d64e1da2bb7c528f92d7bb3c4e406848c3

SHA256
0accaea0b8e981c16082370b4b53e732300111a471eb0e0b994b4dfbff34e513

SHA512
3500199f29bfdfc778cbf1cc09117e26cb95894b76de1e2eec1e61ad148474f0c80434feff3aad6e50c41ab2803a2e184ce9e3af76564538a072555c27314ec6

Download Submit
C:\Windows\System\jdGdlQr.exe

Filesize
1.6MB

MD5
a3f5289e409bbe86315a575a53bec0da

SHA1
6a78f9c3720b9177118c1aa1054ee0f1e54b4ceb

SHA256
74b47d58fbf68d48163fd1e0c56c53803bb4c3adcbffaec32279092e0f700af2

SHA512
8ceac0d0f3b0fcfe14a476929a0c50e5a63ae0e992763b99e4cd490382f736b287a1d4df36033c6a08645962cda501db92b71311a6d6f17f82bafda13401ace4

Download Submit
C:\Windows\System\nQKUAZj.exe

Filesize
1.6MB

MD5
e1242389316a4aa7942c3148db88feb0

SHA1
21c2569c285eb30942891dc8e8ac3ae121a54067

SHA256
88ccbdc033dbfaea65acd47d25a2a8974394288e9ac56e8296fcba33d86941c3

SHA512
d4a7547ec516a280d2a65b4084ecab3c34ed4c6a8ee995fdb61383d45c009cc04a22efdc49946344134c3e720e3e1c65cf562981276a15c3b1aa7155582f55c4

Download Submit
C:\Windows\System\nYgAYSp.exe

Filesize
1.6MB

MD5
38892d328d648fbc5d42760a4cfae793

SHA1
fc2d6a09d2d1bfe7c765da52442ed05bc88aae7e

SHA256
e00582e1c4fe75a4b605316f33e6a7f1646c6c72bd1ab873756152c54e0f2d66

SHA512
2d471f63ebd531a32eff8c37663e71ca07ec76315cfd052fa278d3e7505d538a04b68c8eeacd19ea026fb9e9efe803bc140702b3c0e2d24911b041cad510dabc

Download Submit
C:\Windows\System\rSjSVvg.exe

Filesize
1.6MB

MD5
cf10339ac2a80210c85dee06529a24fb

SHA1
8fe001a9f5329e2a2a75799e70c84c5cf62b91c8

SHA256
f4f7f94dc375e3ad1197262f109e170cb18c3f27dd20b666d24f32da72a5aa59

SHA512
9624ade87e87a85400e374c6838e031d287d9d26ba00fadd536a75ad1c17aa06405a3ab203db7162a13c91f72548e905e06c4667befc779f5bd74387c951f375

Download Submit
C:\Windows\System\tFZcTfE.exe

Filesize
1.6MB

MD5
b03e1444b8e7b31334000a3b6b965444

SHA1
142a595b3bee5f1431d7a5adaf372dcd3c37e00d

SHA256
a91f226a9e1e06ab51ee218452b57c44d3c37f541e641b7b5e74a6293ebdf961

SHA512
b921021649b0d0dd2cd883b04d64d7f8cb47403647c257e6c9ebb2e3e5a5450f00cf7d4f71a7f17f3a585856cb2b6d6f7d95f5ec9a9b985941f344ff997fc188

Download Submit
C:\Windows\System\tulCmwF.exe

Filesize
1.6MB

MD5
e6f90aaa5aab96af476f08c40139160e

SHA1
c519553f88be4fa4ea4ce15958748949ec0db968

SHA256
d82a4197ecbb8cab3a468586b230f01cdd71093b49b61369f713f1c500efd0c2

SHA512
39a9a925be54aace35129d39a534b4383446cc454c602b1943c15e986768feaef3258716942e62a4390cdc4b61d156e76e13d526045036a7adf34fe292cb4bf3

Download Submit
C:\Windows\System\vnZEkXh.exe

Filesize
1.6MB

MD5
6d9176fef39c1c2aee0ef78cdd30afdc

SHA1
685983ffeb516d3eb5d91724029ee14baa12913d

SHA256
c1f4e6fa14080c6645cf09e0e7deb71ab57482301fb89f13c45f0e97a32cb5ee

SHA512
2227c7a206eb3d92d14a87dc840fe794bad3a2be8f19c41e0f44e268bc9cbb1860b365ccf4e78f463f9ae7ba59e5ad539e1081e5756f74f8f2ee99f75252677b

Download Submit
C:\Windows\System\wQTfuHp.exe

Filesize
1.6MB

MD5
a03bb80ba31b45c5f6ff165d26765f73

SHA1
55dd7731f38a1e6312343611c5e5dc9daa5cfb56

SHA256
30979ac5375f02d3d221a63332365ddbf4ff99c8c1b720b18a57d9ad583b27b7

SHA512
6ca3b894cae0eecb29a94d29860ec40f424aae7502963d207350d9f5f23543863c9084481ceb6eb5bee19c7a19bb97d9ffe8ac4f4d17f279d8ffeb598d85f391

Download Submit
C:\Windows\System\wfCPDwA.exe

Filesize
1.6MB

MD5
43b996d200b107d9b22837c504cc78f2

SHA1
4d839fe849d0481ebd481028dd749edad675a6e1

SHA256
3c280c3ccb0c837877f915152805341bb6f5077fd881b07011ea65eae0c82d95

SHA512
d27ba7b84d914e8f8971f54d05a2aa5cd44d882dcd0f303c86e0f973c2c056f1ee7593681d643bceb249627f67cb5ac6e3a92612e5a90e6df2e3f68cef572fbb

Download Submit
C:\Windows\System\xPlQtMP.exe

Filesize
1.6MB

MD5
00da515f1e04428b8f62c985e12e475d

SHA1
06e3dd9419ea45d46b23ab1c2cd7a2b424215a5f

SHA256
d2012af6fdbea5b0d40019b5e164d30e865825a314535edf6ae4a3ff7d285809

SHA512
45af08c759c37771e3869e958060932986c8d34d3ab7e18d0ac9311605f50e8d02bc8310dc32b525f5ceac569f82fb341f0725c08e8c8f05eac984088be726cc

Download Submit
C:\Windows\System\xoCusTJ.exe

Filesize
1.6MB

MD5
2c4d2d3253f25babc895c40c98f41903

SHA1
d39a8c909f44d4e8121dafede8d21c5ce115bbfb

SHA256
cac5576fe4b0a5b837fcc12c7f648735b9ab7dcebf2fb5923d33b89e4a376c54

SHA512
fd9d2f4b2a5da301ad949fde765ea3430c603fa903bd0ce7938f555c59131f294e9c6385eeeaf0e3473ca87d824eb653a5fec10c91ee3e5071cddfea79026b5a

Download Submit
C:\Windows\System\zVtNwwy.exe

Filesize
1.6MB

MD5
30d1b27ce0897e012cc5b17aaa66708c

SHA1
19bbbba48429b68ba5aada1218ed0d78c02b6379

SHA256
b45b0076e732eb1be735dc0735e96ecb0e410d91f27603427ba488305bd08bc1

SHA512
607de0652d6b1943d8b5524afb745e6766d78c14455cc061c7dd2f09331bdccba18ac018c75022892b5a85e0fbe559545db1cdde1573a52c2ec4dc5e3d1b37a6

Download Submit
memory/348-504-0x00007FF7A72C0000-0x00007FF7A76B2000-memory.dmp

Filesize
3.9MB

Download
memory/348-3805-0x00007FF7A72C0000-0x00007FF7A76B2000-memory.dmp

Filesize
3.9MB

Download
memory/532-3819-0x00007FF69F170000-0x00007FF69F562000-memory.dmp

Filesize
3.9MB

Download
memory/532-302-0x00007FF69F170000-0x00007FF69F562000-memory.dmp

Filesize
3.9MB

Download
memory/760-3813-0x00007FF7B99A0000-0x00007FF7B9D92000-memory.dmp

Filesize
3.9MB

Download
memory/760-259-0x00007FF7B99A0000-0x00007FF7B9D92000-memory.dmp

Filesize
3.9MB

Download
memory/1172-3809-0x00007FF6DCE50000-0x00007FF6DD242000-memory.dmp

Filesize
3.9MB

Download
memory/1172-454-0x00007FF6DCE50000-0x00007FF6DD242000-memory.dmp

Filesize
3.9MB

Download
memory/1308-3782-0x00007FF7FAEA0000-0x00007FF7FB292000-memory.dmp

Filesize
3.9MB

Download
memory/1308-513-0x00007FF7FAEA0000-0x00007FF7FB292000-memory.dmp

Filesize
3.9MB

Download
memory/1860-3802-0x00007FF6BA930000-0x00007FF6BAD22000-memory.dmp

Filesize
3.9MB

Download
memory/1860-506-0x00007FF6BA930000-0x00007FF6BAD22000-memory.dmp

Filesize
3.9MB

Download
memory/2080-3750-0x00007FF787140000-0x00007FF787532000-memory.dmp

Filesize
3.9MB

Download
memory/2080-3772-0x00007FF787140000-0x00007FF787532000-memory.dmp

Filesize
3.9MB

Download
memory/2080-26-0x00007FF787140000-0x00007FF787532000-memory.dmp

Filesize
3.9MB

Download
memory/2232-283-0x00007FF6FFF00000-0x00007FF7002F2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-3777-0x00007FF6FFF00000-0x00007FF7002F2000-memory.dmp

Filesize
3.9MB

Download
memory/2280-3798-0x00007FF6912A0000-0x00007FF691692000-memory.dmp

Filesize
3.9MB

Download
memory/2280-508-0x00007FF6912A0000-0x00007FF691692000-memory.dmp

Filesize
3.9MB

Download
memory/2504-3768-0x00007FF650FC0000-0x00007FF6513B2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-21-0x00007FF650FC0000-0x00007FF6513B2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-1-0x0000024FD97F0000-0x0000024FD9800000-memory.dmp

Filesize
64KB

Download
memory/2916-0-0x00007FF775370000-0x00007FF775762000-memory.dmp

Filesize
3.9MB

Download
memory/3100-355-0x00007FF73F6F0000-0x00007FF73FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/3100-3811-0x00007FF73F6F0000-0x00007FF73FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/3816-3825-0x00007FF744330000-0x00007FF744722000-memory.dmp

Filesize
3.9MB

Download
memory/3816-503-0x00007FF744330000-0x00007FF744722000-memory.dmp

Filesize
3.9MB

Download
memory/4324-3784-0x00007FF7B9D50000-0x00007FF7BA142000-memory.dmp

Filesize
3.9MB

Download
memory/4324-418-0x00007FF7B9D50000-0x00007FF7BA142000-memory.dmp

Filesize
3.9MB

Download
memory/4356-41-0x00007FFBBBDC3000-0x00007FFBBBDC5000-memory.dmp

Filesize
8KB

Download
memory/4356-511-0x00007FFBBBDC0000-0x00007FFBBC881000-memory.dmp

Filesize
10.8MB

Download
memory/4356-139-0x00007FFBBBDC0000-0x00007FFBBC881000-memory.dmp

Filesize
10.8MB

Download
memory/4356-291-0x00000238FC5C0000-0x00000238FC5E2000-memory.dmp

Filesize
136KB

Download
memory/4396-502-0x00007FF6EF8A0000-0x00007FF6EFC92000-memory.dmp

Filesize
3.9MB

Download
memory/4396-3807-0x00007FF6EF8A0000-0x00007FF6EFC92000-memory.dmp

Filesize
3.9MB

Download
memory/4428-3770-0x00007FF6195A0000-0x00007FF619992000-memory.dmp

Filesize
3.9MB

Download
memory/4428-510-0x00007FF6195A0000-0x00007FF619992000-memory.dmp

Filesize
3.9MB

Download
memory/4484-483-0x00007FF72A0F0000-0x00007FF72A4E2000-memory.dmp

Filesize
3.9MB

Download
memory/4484-3794-0x00007FF72A0F0000-0x00007FF72A4E2000-memory.dmp

Filesize
3.9MB

Download
memory/4552-3800-0x00007FF7570E0000-0x00007FF7574D2000-memory.dmp

Filesize
3.9MB

Download
memory/4552-507-0x00007FF7570E0000-0x00007FF7574D2000-memory.dmp

Filesize
3.9MB

Download
memory/4632-3774-0x00007FF6B3C30000-0x00007FF6B4022000-memory.dmp

Filesize
3.9MB

Download
memory/4632-512-0x00007FF6B3C30000-0x00007FF6B4022000-memory.dmp

Filesize
3.9MB

Download
memory/4784-3752-0x00007FF6021A0000-0x00007FF602592000-memory.dmp

Filesize
3.9MB

Download
memory/4784-40-0x00007FF6021A0000-0x00007FF602592000-memory.dmp

Filesize
3.9MB

Download
memory/4784-3780-0x00007FF6021A0000-0x00007FF602592000-memory.dmp

Filesize
3.9MB

Download
memory/4840-3778-0x00007FF732340000-0x00007FF732732000-memory.dmp

Filesize
3.9MB

Download
memory/4840-184-0x00007FF732340000-0x00007FF732732000-memory.dmp

Filesize
3.9MB

Download
memory/4848-509-0x00007FF6F4630000-0x00007FF6F4A22000-memory.dmp

Filesize
3.9MB

Download
memory/4848-3796-0x00007FF6F4630000-0x00007FF6F4A22000-memory.dmp

Filesize
3.9MB

Download
memory/4872-3792-0x00007FF7A70C0000-0x00007FF7A74B2000-memory.dmp

Filesize
3.9MB

Download
memory/4872-505-0x00007FF7A70C0000-0x00007FF7A74B2000-memory.dmp

Filesize
3.9MB

Download
memory/5040-237-0x00007FF734890000-0x00007FF734C82000-memory.dmp

Filesize
3.9MB

Download
memory/5040-3786-0x00007FF734890000-0x00007FF734C82000-memory.dmp

Filesize
3.9MB

Download
memory/5112-331-0x00007FF611260000-0x00007FF611652000-memory.dmp

Filesize
3.9MB

Download
memory/5112-3815-0x00007FF611260000-0x00007FF611652000-memory.dmp

Filesize
3.9MB

Download