xmrig | e42210c7590c76cc791b41701d66460f4b27f99371a09e97f558ceca4d574f16

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 06:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
Size 1.7MB
Sample240614-hm8mlssgnl
SHA256 e42210c7590c76cc791b41701d66460f4b27f99371a09e97f558ceca4d574f16
MD5 aaa5c81fca8103acab86cc3a9be6b3d0
SHA1 558137312567b381c3616752c2d1fcd1252cc438
SHA512 d921b5ad7c860b60da74c441ca0c13602c716734ff2bd5bb2eb6d47f9c0279273b87d5297b91a927a686a946a4cfbb540d3aab3593a288f274858a71a325a1ec
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo53:NABS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral2/memory/4584-317-0x00007FF6DD9E0000-0x00007FF6DDDD2000-memory.dmp	xmrig
behavioral2/memory/4284-661-0x00007FF677FA0000-0x00007FF678392000-memory.dmp	xmrig
behavioral2/memory/1532-667-0x00007FF662940000-0x00007FF662D32000-memory.dmp	xmrig
behavioral2/memory/4772-671-0x00007FF70CAA0000-0x00007FF70CE92000-memory.dmp	xmrig
behavioral2/memory/324-677-0x00007FF6A2B90000-0x00007FF6A2F82000-memory.dmp	xmrig
behavioral2/memory/4104-678-0x00007FF6E4F10000-0x00007FF6E5302000-memory.dmp	xmrig
behavioral2/memory/4172-676-0x00007FF6B81E0000-0x00007FF6B85D2000-memory.dmp	xmrig
behavioral2/memory/1948-675-0x00007FF7F2110000-0x00007FF7F2502000-memory.dmp	xmrig
behavioral2/memory/1772-674-0x00007FF69BF40000-0x00007FF69C332000-memory.dmp	xmrig
behavioral2/memory/3244-673-0x00007FF6AE130000-0x00007FF6AE522000-memory.dmp	xmrig
behavioral2/memory/3152-672-0x00007FF6DDC00000-0x00007FF6DDFF2000-memory.dmp	xmrig
behavioral2/memory/3560-670-0x00007FF609400000-0x00007FF6097F2000-memory.dmp	xmrig
behavioral2/memory/760-669-0x00007FF6DF160000-0x00007FF6DF552000-memory.dmp	xmrig
behavioral2/memory/2972-668-0x00007FF63FA30000-0x00007FF63FE22000-memory.dmp	xmrig
behavioral2/memory/1968-666-0x00007FF69BDC0000-0x00007FF69C1B2000-memory.dmp	xmrig
behavioral2/memory/3844-665-0x00007FF621600000-0x00007FF6219F2000-memory.dmp	xmrig
behavioral2/memory/1960-664-0x00007FF6327D0000-0x00007FF632BC2000-memory.dmp	xmrig
behavioral2/memory/2656-663-0x00007FF774920000-0x00007FF774D12000-memory.dmp	xmrig
behavioral2/memory/2576-662-0x00007FF7E2600000-0x00007FF7E29F2000-memory.dmp	xmrig
behavioral2/memory/3928-374-0x00007FF6400D0000-0x00007FF6404C2000-memory.dmp	xmrig
behavioral2/memory/4088-265-0x00007FF70FEB0000-0x00007FF7102A2000-memory.dmp	xmrig
behavioral2/memory/4496-219-0x00007FF79F720000-0x00007FF79FB12000-memory.dmp	xmrig
behavioral2/memory/1732-209-0x00007FF715820000-0x00007FF715C12000-memory.dmp	xmrig
behavioral2/memory/4088-5278-0x00007FF70FEB0000-0x00007FF7102A2000-memory.dmp	xmrig
behavioral2/memory/1732-5286-0x00007FF715820000-0x00007FF715C12000-memory.dmp	xmrig
behavioral2/memory/4584-5297-0x00007FF6DD9E0000-0x00007FF6DDDD2000-memory.dmp	xmrig
behavioral2/memory/1968-5350-0x00007FF69BDC0000-0x00007FF69C1B2000-memory.dmp	xmrig
behavioral2/memory/1532-5376-0x00007FF662940000-0x00007FF662D32000-memory.dmp	xmrig
behavioral2/memory/4172-5434-0x00007FF6B81E0000-0x00007FF6B85D2000-memory.dmp	xmrig
behavioral2/memory/1772-5422-0x00007FF69BF40000-0x00007FF69C332000-memory.dmp	xmrig
behavioral2/memory/2972-5388-0x00007FF63FA30000-0x00007FF63FE22000-memory.dmp	xmrig
behavioral2/memory/3244-5382-0x00007FF6AE130000-0x00007FF6AE522000-memory.dmp	xmrig
behavioral2/memory/4772-5394-0x00007FF70CAA0000-0x00007FF70CE92000-memory.dmp	xmrig
behavioral2/memory/2656-5373-0x00007FF774920000-0x00007FF774D12000-memory.dmp	xmrig
behavioral2/memory/1948-5362-0x00007FF7F2110000-0x00007FF7F2502000-memory.dmp	xmrig
behavioral2/memory/4104-5354-0x00007FF6E4F10000-0x00007FF6E5302000-memory.dmp	xmrig
behavioral2/memory/3844-5348-0x00007FF621600000-0x00007FF6219F2000-memory.dmp	xmrig
behavioral2/memory/1960-5345-0x00007FF6327D0000-0x00007FF632BC2000-memory.dmp	xmrig
behavioral2/memory/3152-5357-0x00007FF6DDC00000-0x00007FF6DDFF2000-memory.dmp	xmrig
behavioral2/memory/324-5330-0x00007FF6A2B90000-0x00007FF6A2F82000-memory.dmp	xmrig
behavioral2/memory/4284-5326-0x00007FF677FA0000-0x00007FF678392000-memory.dmp	xmrig
behavioral2/memory/3928-5324-0x00007FF6400D0000-0x00007FF6404C2000-memory.dmp	xmrig
behavioral2/memory/760-5321-0x00007FF6DF160000-0x00007FF6DF552000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
432	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
640	AJXxEQs.exe
1732	dHPVlyG.exe
324	iZWclON.exe
4496	vomvJJI.exe
4088	WHbQupB.exe
4584	mMfvfXb.exe
3928	xufnyJn.exe
4284	bagcojU.exe
4104	vwWmbSs.exe
2576	GNgBTZN.exe
2656	GedwFyt.exe
1960	GRfFeMZ.exe
3844	EKmoWyd.exe
1968	fPAVapL.exe
1532	APQXHPD.exe
2972	WyiSVVr.exe
760	lqSGvBB.exe
3560	MfPezyp.exe
4772	nlaqMIU.exe
3152	vsScygL.exe
3244	qHmWYMh.exe
1772	AFNCHQT.exe
1948	bJXPepG.exe
4172	zxWaTPP.exe
4656	exekBuk.exe
3448	pevYJoE.exe
3644	VLMHNQl.exe
2412	fHgJUgT.exe
5116	bcEIvmt.exe
1212	fIzLVAc.exe
2540	IuVUgFe.exe
4316	TMgZzbQ.exe
3780	cDPhPVa.exe
4660	ACHbotU.exe
2456	iOGLdLE.exe
4776	BsmdBkK.exe
4824	bntSwKQ.exe
2240	fKTJfLc.exe
1508	VGCboew.exe
1376	wsmfMsx.exe
708	ZYEwjkD.exe
1488	IukqDeU.exe
2956	NsisdiB.exe
4420	SDgXwEI.exe
2056	PyDFDAy.exe
2200	jGrXNZV.exe
1856	aIBQAjc.exe
2372	bTexQEH.exe
1420	REjEUjs.exe
3600	hnYkbLk.exe
528	WgsLmrY.exe
1104	yJDBFtq.exe
3064	fzbpEHT.exe
2896	QDeKxhN.exe
2548	eeZNtAe.exe
4056	DgBOczh.exe
2676	zoHdoya.exe
1972	BjqoRRq.exe
3856	vWnppKb.exe
4796	UrkEiBA.exe
4728	iZtdkpk.exe
4564	kgMUhYU.exe
1992	fWfFINk.exe
4900	BlfhoBX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4204-0-0x00007FF6D17D0000-0x00007FF6D1BC2000-memory.dmp	upx
behavioral2/files/0x000c0000000233da-10.dat	upx
behavioral2/files/0x000700000002342d-178.dat	upx
behavioral2/memory/4584-317-0x00007FF6DD9E0000-0x00007FF6DDDD2000-memory.dmp	upx
behavioral2/memory/4284-661-0x00007FF677FA0000-0x00007FF678392000-memory.dmp	upx
behavioral2/memory/1532-667-0x00007FF662940000-0x00007FF662D32000-memory.dmp	upx
behavioral2/memory/4772-671-0x00007FF70CAA0000-0x00007FF70CE92000-memory.dmp	upx
behavioral2/memory/324-677-0x00007FF6A2B90000-0x00007FF6A2F82000-memory.dmp	upx
behavioral2/memory/4104-678-0x00007FF6E4F10000-0x00007FF6E5302000-memory.dmp	upx
behavioral2/memory/4172-676-0x00007FF6B81E0000-0x00007FF6B85D2000-memory.dmp	upx
behavioral2/memory/1948-675-0x00007FF7F2110000-0x00007FF7F2502000-memory.dmp	upx
behavioral2/memory/1772-674-0x00007FF69BF40000-0x00007FF69C332000-memory.dmp	upx
behavioral2/memory/3244-673-0x00007FF6AE130000-0x00007FF6AE522000-memory.dmp	upx
behavioral2/memory/3152-672-0x00007FF6DDC00000-0x00007FF6DDFF2000-memory.dmp	upx
behavioral2/memory/3560-670-0x00007FF609400000-0x00007FF6097F2000-memory.dmp	upx
behavioral2/memory/760-669-0x00007FF6DF160000-0x00007FF6DF552000-memory.dmp	upx
behavioral2/memory/2972-668-0x00007FF63FA30000-0x00007FF63FE22000-memory.dmp	upx
behavioral2/memory/1968-666-0x00007FF69BDC0000-0x00007FF69C1B2000-memory.dmp	upx
behavioral2/memory/3844-665-0x00007FF621600000-0x00007FF6219F2000-memory.dmp	upx
behavioral2/memory/1960-664-0x00007FF6327D0000-0x00007FF632BC2000-memory.dmp	upx
behavioral2/memory/2656-663-0x00007FF774920000-0x00007FF774D12000-memory.dmp	upx
behavioral2/memory/2576-662-0x00007FF7E2600000-0x00007FF7E29F2000-memory.dmp	upx
behavioral2/memory/3928-374-0x00007FF6400D0000-0x00007FF6404C2000-memory.dmp	upx
behavioral2/memory/4088-265-0x00007FF70FEB0000-0x00007FF7102A2000-memory.dmp	upx
behavioral2/memory/4496-219-0x00007FF79F720000-0x00007FF79FB12000-memory.dmp	upx
behavioral2/files/0x0007000000023448-210.dat	upx
behavioral2/memory/1732-209-0x00007FF715820000-0x00007FF715C12000-memory.dmp	upx
behavioral2/files/0x0007000000023442-203.dat	upx
behavioral2/files/0x0007000000023447-199.dat	upx
behavioral2/files/0x0007000000023440-192.dat	upx
behavioral2/files/0x0007000000023437-190.dat	upx
behavioral2/files/0x0007000000023446-189.dat	upx
behavioral2/files/0x0007000000023445-188.dat	upx
behavioral2/files/0x0007000000023434-182.dat	upx
behavioral2/files/0x0007000000023430-170.dat	upx
behavioral2/files/0x0007000000023439-159.dat	upx
behavioral2/files/0x0007000000023438-153.dat	upx
behavioral2/files/0x0007000000023433-148.dat	upx
behavioral2/files/0x0007000000023432-142.dat	upx
behavioral2/files/0x0007000000023431-138.dat	upx
behavioral2/files/0x0007000000023444-136.dat	upx
behavioral2/files/0x0007000000023443-131.dat	upx
behavioral2/files/0x0007000000023441-196.dat	upx
behavioral2/files/0x000700000002342e-123.dat	upx
behavioral2/files/0x000700000002343f-119.dat	upx
behavioral2/files/0x000700000002343e-117.dat	upx
behavioral2/files/0x0007000000023435-114.dat	upx
behavioral2/files/0x000700000002343d-111.dat	upx
behavioral2/files/0x000700000002343b-161.dat	upx
behavioral2/files/0x000700000002343c-110.dat	upx
behavioral2/files/0x000700000002343a-108.dat	upx
behavioral2/files/0x000700000002342c-99.dat	upx
behavioral2/files/0x0007000000023436-93.dat	upx
behavioral2/files/0x000700000002342b-82.dat	upx
behavioral2/files/0x000700000002342a-75.dat	upx
behavioral2/files/0x000700000002342f-64.dat	upx
behavioral2/files/0x0007000000023427-49.dat	upx
behavioral2/files/0x0008000000023423-40.dat	upx
behavioral2/files/0x0007000000023428-57.dat	upx
behavioral2/files/0x0007000000023429-37.dat	upx
behavioral2/memory/640-33-0x00007FF7C9870000-0x00007FF7C9C62000-memory.dmp	upx
behavioral2/memory/4088-5278-0x00007FF70FEB0000-0x00007FF7102A2000-memory.dmp	upx
behavioral2/memory/1732-5286-0x00007FF715820000-0x00007FF715C12000-memory.dmp	upx
behavioral2/memory/4584-5297-0x00007FF6DD9E0000-0x00007FF6DDDD2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AHPjWRn.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\cXsvLmX.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\rCQFFsK.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\KVOJzzM.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\VfPjmWl.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\yAQZvXX.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\eBAQoxX.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\ppzzkJu.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\xCRrZyA.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\JxkcQKY.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\OXMAYpx.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\pUjklwN.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\jOYcGed.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\EhxMwHe.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\puMnQjQ.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\XAxXJqA.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\MNZCQpy.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\RmGZosK.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZoxxVCN.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\TRIuPPd.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\rcFxVAy.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\yNPyCqo.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\rRVohDV.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\DBJgzGi.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\vCffBcB.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\YABqOLx.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZqAVQoL.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\dkdNYrT.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\rPeoqWI.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\wfOXdQU.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\kyjRevO.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\lUpBYDJ.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\qvxeOTP.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\WZwRNkb.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\DJoYLfd.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\UWKeCGZ.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\pXDBmwN.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\LKtTJUq.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\VsSSaMV.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\qGQxfSp.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\MpPOMSd.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\vwDIbgQ.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\fKaGEgD.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\PjVQfRK.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\dusdAzh.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\wqDOERG.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\hqtQJdM.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\YfvVviH.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\wSkVdhZ.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\mxhFzXJ.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\PMeEYKa.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\FYuoAPL.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\BSNlzXj.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\JAigwrY.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\WKBVmAa.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\aYOZrJE.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\jBWBcQj.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZetDCOm.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\AaCfRVP.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\aEKSyTi.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\sgOIdGW.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\vaxBcMI.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\lOdoOgb.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
File created	C:\Windows\System\BkIoVvJ.exe	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
432	powershell.exe
432	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	432	powershell.exe
Token: SeLockMemoryPrivilege	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 432	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	83
PID 4204 wrote to memory of 432	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	83
PID 4204 wrote to memory of 640	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	84
PID 4204 wrote to memory of 640	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	84
PID 4204 wrote to memory of 1732	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	85
PID 4204 wrote to memory of 1732	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	85
PID 4204 wrote to memory of 324	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	86
PID 4204 wrote to memory of 324	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	86
PID 4204 wrote to memory of 4496	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	87
PID 4204 wrote to memory of 4496	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	87
PID 4204 wrote to memory of 4088	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	88
PID 4204 wrote to memory of 4088	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	88
PID 4204 wrote to memory of 4584	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	89
PID 4204 wrote to memory of 4584	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	89
PID 4204 wrote to memory of 3928	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	90
PID 4204 wrote to memory of 3928	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	90
PID 4204 wrote to memory of 4284	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	91
PID 4204 wrote to memory of 4284	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	91
PID 4204 wrote to memory of 1532	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	92
PID 4204 wrote to memory of 1532	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	92
PID 4204 wrote to memory of 4104	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	93
PID 4204 wrote to memory of 4104	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	93
PID 4204 wrote to memory of 2576	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	94
PID 4204 wrote to memory of 2576	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	94
PID 4204 wrote to memory of 2656	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	95
PID 4204 wrote to memory of 2656	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	95
PID 4204 wrote to memory of 1960	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	96
PID 4204 wrote to memory of 1960	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	96
PID 4204 wrote to memory of 3844	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	97
PID 4204 wrote to memory of 3844	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	97
PID 4204 wrote to memory of 1968	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	98
PID 4204 wrote to memory of 1968	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	98
PID 4204 wrote to memory of 2972	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	99
PID 4204 wrote to memory of 2972	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	99
PID 4204 wrote to memory of 760	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	100
PID 4204 wrote to memory of 760	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	100
PID 4204 wrote to memory of 3560	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	101
PID 4204 wrote to memory of 3560	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	101
PID 4204 wrote to memory of 4772	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	102
PID 4204 wrote to memory of 4772	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	102
PID 4204 wrote to memory of 3152	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	103
PID 4204 wrote to memory of 3152	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	103
PID 4204 wrote to memory of 3244	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	104
PID 4204 wrote to memory of 3244	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	104
PID 4204 wrote to memory of 1772	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	105
PID 4204 wrote to memory of 1772	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	105
PID 4204 wrote to memory of 1948	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	106
PID 4204 wrote to memory of 1948	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	106
PID 4204 wrote to memory of 4172	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	107
PID 4204 wrote to memory of 4172	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	107
PID 4204 wrote to memory of 4656	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	108
PID 4204 wrote to memory of 4656	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	108
PID 4204 wrote to memory of 3448	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	109
PID 4204 wrote to memory of 3448	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	109
PID 4204 wrote to memory of 3644	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	110
PID 4204 wrote to memory of 3644	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	110
PID 4204 wrote to memory of 2412	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	111
PID 4204 wrote to memory of 2412	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	111
PID 4204 wrote to memory of 5116	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	112
PID 4204 wrote to memory of 5116	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	112
PID 4204 wrote to memory of 1212	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	113
PID 4204 wrote to memory of 1212	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	113
PID 4204 wrote to memory of 2540	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	114
PID 4204 wrote to memory of 2540	4204	aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\aaa5c81fca8103acab86cc3a9be6b3d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\System\AJXxEQs.exe
  C:\Windows\System\AJXxEQs.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\dHPVlyG.exe
  C:\Windows\System\dHPVlyG.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\iZWclON.exe
  C:\Windows\System\iZWclON.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\vomvJJI.exe
  C:\Windows\System\vomvJJI.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\WHbQupB.exe
  C:\Windows\System\WHbQupB.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\mMfvfXb.exe
  C:\Windows\System\mMfvfXb.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\xufnyJn.exe
  C:\Windows\System\xufnyJn.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\bagcojU.exe
  C:\Windows\System\bagcojU.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\APQXHPD.exe
  C:\Windows\System\APQXHPD.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\vwWmbSs.exe
  C:\Windows\System\vwWmbSs.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\GNgBTZN.exe
  C:\Windows\System\GNgBTZN.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\GedwFyt.exe
  C:\Windows\System\GedwFyt.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\GRfFeMZ.exe
  C:\Windows\System\GRfFeMZ.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\EKmoWyd.exe
  C:\Windows\System\EKmoWyd.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\fPAVapL.exe
  C:\Windows\System\fPAVapL.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\WyiSVVr.exe
  C:\Windows\System\WyiSVVr.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\lqSGvBB.exe
  C:\Windows\System\lqSGvBB.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\MfPezyp.exe
  C:\Windows\System\MfPezyp.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\nlaqMIU.exe
  C:\Windows\System\nlaqMIU.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\vsScygL.exe
  C:\Windows\System\vsScygL.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\qHmWYMh.exe
  C:\Windows\System\qHmWYMh.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\AFNCHQT.exe
  C:\Windows\System\AFNCHQT.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\bJXPepG.exe
  C:\Windows\System\bJXPepG.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\zxWaTPP.exe
  C:\Windows\System\zxWaTPP.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\exekBuk.exe
  C:\Windows\System\exekBuk.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\pevYJoE.exe
  C:\Windows\System\pevYJoE.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\VLMHNQl.exe
  C:\Windows\System\VLMHNQl.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\fHgJUgT.exe
  C:\Windows\System\fHgJUgT.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\bcEIvmt.exe
  C:\Windows\System\bcEIvmt.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\fIzLVAc.exe
  C:\Windows\System\fIzLVAc.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\IuVUgFe.exe
  C:\Windows\System\IuVUgFe.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\TMgZzbQ.exe
  C:\Windows\System\TMgZzbQ.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\cDPhPVa.exe
  C:\Windows\System\cDPhPVa.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\ACHbotU.exe
  C:\Windows\System\ACHbotU.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\iOGLdLE.exe
  C:\Windows\System\iOGLdLE.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\BsmdBkK.exe
  C:\Windows\System\BsmdBkK.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\bntSwKQ.exe
  C:\Windows\System\bntSwKQ.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\fKTJfLc.exe
  C:\Windows\System\fKTJfLc.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\VGCboew.exe
  C:\Windows\System\VGCboew.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\wsmfMsx.exe
  C:\Windows\System\wsmfMsx.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\ZYEwjkD.exe
  C:\Windows\System\ZYEwjkD.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\IukqDeU.exe
  C:\Windows\System\IukqDeU.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\NsisdiB.exe
  C:\Windows\System\NsisdiB.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\SDgXwEI.exe
  C:\Windows\System\SDgXwEI.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\PyDFDAy.exe
  C:\Windows\System\PyDFDAy.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\jGrXNZV.exe
  C:\Windows\System\jGrXNZV.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\aIBQAjc.exe
  C:\Windows\System\aIBQAjc.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\bTexQEH.exe
  C:\Windows\System\bTexQEH.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\REjEUjs.exe
  C:\Windows\System\REjEUjs.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\hnYkbLk.exe
  C:\Windows\System\hnYkbLk.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\WgsLmrY.exe
  C:\Windows\System\WgsLmrY.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\yJDBFtq.exe
  C:\Windows\System\yJDBFtq.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\fzbpEHT.exe
  C:\Windows\System\fzbpEHT.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\QDeKxhN.exe
  C:\Windows\System\QDeKxhN.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\eeZNtAe.exe
  C:\Windows\System\eeZNtAe.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\DgBOczh.exe
  C:\Windows\System\DgBOczh.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\zoHdoya.exe
  C:\Windows\System\zoHdoya.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\BjqoRRq.exe
  C:\Windows\System\BjqoRRq.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\vWnppKb.exe
  C:\Windows\System\vWnppKb.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\UrkEiBA.exe
  C:\Windows\System\UrkEiBA.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\iZtdkpk.exe
  C:\Windows\System\iZtdkpk.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\kgMUhYU.exe
  C:\Windows\System\kgMUhYU.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\fWfFINk.exe
  C:\Windows\System\fWfFINk.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\BlfhoBX.exe
  C:\Windows\System\BlfhoBX.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\ZhdOAVk.exe
  C:\Windows\System\ZhdOAVk.exe
  2⤵
  PID:2688
- C:\Windows\System\pUPnOol.exe
  C:\Windows\System\pUPnOol.exe
  2⤵
  PID:3564
- C:\Windows\System\XWhufAe.exe
  C:\Windows\System\XWhufAe.exe
  2⤵
  PID:3568
- C:\Windows\System\sYbneCm.exe
  C:\Windows\System\sYbneCm.exe
  2⤵
  PID:2644
- C:\Windows\System\UFWWLzB.exe
  C:\Windows\System\UFWWLzB.exe
  2⤵
  PID:3116
- C:\Windows\System\pYBwJaw.exe
  C:\Windows\System\pYBwJaw.exe
  2⤵
  PID:4504
- C:\Windows\System\xJziopH.exe
  C:\Windows\System\xJziopH.exe
  2⤵
  PID:1696
- C:\Windows\System\NnwjNWU.exe
  C:\Windows\System\NnwjNWU.exe
  2⤵
  PID:3240
- C:\Windows\System\XmTHjQX.exe
  C:\Windows\System\XmTHjQX.exe
  2⤵
  PID:220
- C:\Windows\System\XxGCidg.exe
  C:\Windows\System\XxGCidg.exe
  2⤵
  PID:3892
- C:\Windows\System\AxxUlYU.exe
  C:\Windows\System\AxxUlYU.exe
  2⤵
  PID:1628
- C:\Windows\System\GQxGEPl.exe
  C:\Windows\System\GQxGEPl.exe
  2⤵
  PID:2120
- C:\Windows\System\lxqvmSb.exe
  C:\Windows\System\lxqvmSb.exe
  2⤵
  PID:5004
- C:\Windows\System\cbvTWkl.exe
  C:\Windows\System\cbvTWkl.exe
  2⤵
  PID:4816
- C:\Windows\System\zfvxanW.exe
  C:\Windows\System\zfvxanW.exe
  2⤵
  PID:2484
- C:\Windows\System\gsWRHGP.exe
  C:\Windows\System\gsWRHGP.exe
  2⤵
  PID:2104
- C:\Windows\System\goENdSQ.exe
  C:\Windows\System\goENdSQ.exe
  2⤵
  PID:3484
- C:\Windows\System\OAmELnY.exe
  C:\Windows\System\OAmELnY.exe
  2⤵
  PID:4200
- C:\Windows\System\hAGKIav.exe
  C:\Windows\System\hAGKIav.exe
  2⤵
  PID:2916
- C:\Windows\System\owIsYnL.exe
  C:\Windows\System\owIsYnL.exe
  2⤵
  PID:5128
- C:\Windows\System\KrrfPoJ.exe
  C:\Windows\System\KrrfPoJ.exe
  2⤵
  PID:5152
- C:\Windows\System\MXzRfTo.exe
  C:\Windows\System\MXzRfTo.exe
  2⤵
  PID:5180
- C:\Windows\System\TLUJHGX.exe
  C:\Windows\System\TLUJHGX.exe
  2⤵
  PID:5204
- C:\Windows\System\QmiyKtz.exe
  C:\Windows\System\QmiyKtz.exe
  2⤵
  PID:5220
- C:\Windows\System\USpOdXp.exe
  C:\Windows\System\USpOdXp.exe
  2⤵
  PID:5244
- C:\Windows\System\ZjUdYLq.exe
  C:\Windows\System\ZjUdYLq.exe
  2⤵
  PID:5264
- C:\Windows\System\fZqEAWa.exe
  C:\Windows\System\fZqEAWa.exe
  2⤵
  PID:5308
- C:\Windows\System\PMrSiqk.exe
  C:\Windows\System\PMrSiqk.exe
  2⤵
  PID:5328
- C:\Windows\System\FMjLdaQ.exe
  C:\Windows\System\FMjLdaQ.exe
  2⤵
  PID:5348
- C:\Windows\System\WHRlZKm.exe
  C:\Windows\System\WHRlZKm.exe
  2⤵
  PID:5368
- C:\Windows\System\rfHyqbJ.exe
  C:\Windows\System\rfHyqbJ.exe
  2⤵
  PID:5388
- C:\Windows\System\bpPbbTM.exe
  C:\Windows\System\bpPbbTM.exe
  2⤵
  PID:5416
- C:\Windows\System\ggiHOMI.exe
  C:\Windows\System\ggiHOMI.exe
  2⤵
  PID:5432
- C:\Windows\System\jllrtSt.exe
  C:\Windows\System\jllrtSt.exe
  2⤵
  PID:5448
- C:\Windows\System\aJyzkcc.exe
  C:\Windows\System\aJyzkcc.exe
  2⤵
  PID:5464
- C:\Windows\System\gRjjZbd.exe
  C:\Windows\System\gRjjZbd.exe
  2⤵
  PID:5484
- C:\Windows\System\ihbgLpd.exe
  C:\Windows\System\ihbgLpd.exe
  2⤵
  PID:5508
- C:\Windows\System\wnysokX.exe
  C:\Windows\System\wnysokX.exe
  2⤵
  PID:5528
- C:\Windows\System\aEWdXdA.exe
  C:\Windows\System\aEWdXdA.exe
  2⤵
  PID:5548
- C:\Windows\System\iaQEJzY.exe
  C:\Windows\System\iaQEJzY.exe
  2⤵
  PID:5572
- C:\Windows\System\otCbxQj.exe
  C:\Windows\System\otCbxQj.exe
  2⤵
  PID:5588
- C:\Windows\System\RvASwHJ.exe
  C:\Windows\System\RvASwHJ.exe
  2⤵
  PID:5608
- C:\Windows\System\YhWfyeN.exe
  C:\Windows\System\YhWfyeN.exe
  2⤵
  PID:5624
- C:\Windows\System\vdqRwMg.exe
  C:\Windows\System\vdqRwMg.exe
  2⤵
  PID:5660
- C:\Windows\System\dbEdfNj.exe
  C:\Windows\System\dbEdfNj.exe
  2⤵
  PID:5680
- C:\Windows\System\PSndzOV.exe
  C:\Windows\System\PSndzOV.exe
  2⤵
  PID:5696
- C:\Windows\System\oxRNLzh.exe
  C:\Windows\System\oxRNLzh.exe
  2⤵
  PID:5724
- C:\Windows\System\PZeBprA.exe
  C:\Windows\System\PZeBprA.exe
  2⤵
  PID:5744
- C:\Windows\System\riyZqmt.exe
  C:\Windows\System\riyZqmt.exe
  2⤵
  PID:5768
- C:\Windows\System\HWJFjiS.exe
  C:\Windows\System\HWJFjiS.exe
  2⤵
  PID:5792
- C:\Windows\System\fpCeaEu.exe
  C:\Windows\System\fpCeaEu.exe
  2⤵
  PID:5820
- C:\Windows\System\uKyOiys.exe
  C:\Windows\System\uKyOiys.exe
  2⤵
  PID:5848
- C:\Windows\System\QMLKCsz.exe
  C:\Windows\System\QMLKCsz.exe
  2⤵
  PID:5864
- C:\Windows\System\vxArgmU.exe
  C:\Windows\System\vxArgmU.exe
  2⤵
  PID:5880
- C:\Windows\System\CWNeUED.exe
  C:\Windows\System\CWNeUED.exe
  2⤵
  PID:5924
- C:\Windows\System\DqjAjEt.exe
  C:\Windows\System\DqjAjEt.exe
  2⤵
  PID:5952
- C:\Windows\System\yoZvFvP.exe
  C:\Windows\System\yoZvFvP.exe
  2⤵
  PID:5968
- C:\Windows\System\pxDZHRM.exe
  C:\Windows\System\pxDZHRM.exe
  2⤵
  PID:6004
- C:\Windows\System\KwkqVtJ.exe
  C:\Windows\System\KwkqVtJ.exe
  2⤵
  PID:6044
- C:\Windows\System\MeCRRKc.exe
  C:\Windows\System\MeCRRKc.exe
  2⤵
  PID:6060
- C:\Windows\System\rPaiLcV.exe
  C:\Windows\System\rPaiLcV.exe
  2⤵
  PID:6084
- C:\Windows\System\jvsWGXB.exe
  C:\Windows\System\jvsWGXB.exe
  2⤵
  PID:6100
- C:\Windows\System\IZiMWkp.exe
  C:\Windows\System\IZiMWkp.exe
  2⤵
  PID:6124
- C:\Windows\System\qaizjVA.exe
  C:\Windows\System\qaizjVA.exe
  2⤵
  PID:5068
- C:\Windows\System\LfyymeP.exe
  C:\Windows\System\LfyymeP.exe
  2⤵
  PID:3692
- C:\Windows\System\TJVGvFp.exe
  C:\Windows\System\TJVGvFp.exe
  2⤵
  PID:716
- C:\Windows\System\TLrIigl.exe
  C:\Windows\System\TLrIigl.exe
  2⤵
  PID:1312
- C:\Windows\System\uCWnBUo.exe
  C:\Windows\System\uCWnBUo.exe
  2⤵
  PID:1780
- C:\Windows\System\JCfpUnf.exe
  C:\Windows\System\JCfpUnf.exe
  2⤵
  PID:2936
- C:\Windows\System\wGBRpNk.exe
  C:\Windows\System\wGBRpNk.exe
  2⤵
  PID:4232
- C:\Windows\System\eXNAQov.exe
  C:\Windows\System\eXNAQov.exe
  2⤵
  PID:2304
- C:\Windows\System\GDMXZzp.exe
  C:\Windows\System\GDMXZzp.exe
  2⤵
  PID:2892
- C:\Windows\System\jOomxRb.exe
  C:\Windows\System\jOomxRb.exe
  2⤵
  PID:1944
- C:\Windows\System\xVCjFre.exe
  C:\Windows\System\xVCjFre.exe
  2⤵
  PID:1100
- C:\Windows\System\ZaNgwQJ.exe
  C:\Windows\System\ZaNgwQJ.exe
  2⤵
  PID:1264
- C:\Windows\System\fIlQRUU.exe
  C:\Windows\System\fIlQRUU.exe
  2⤵
  PID:1736
- C:\Windows\System\HRJHeZO.exe
  C:\Windows\System\HRJHeZO.exe
  2⤵
  PID:4480
- C:\Windows\System\YLKFdNl.exe
  C:\Windows\System\YLKFdNl.exe
  2⤵
  PID:5188
- C:\Windows\System\QpPwAgk.exe
  C:\Windows\System\QpPwAgk.exe
  2⤵
  PID:4164
- C:\Windows\System\cyGBRSS.exe
  C:\Windows\System\cyGBRSS.exe
  2⤵
  PID:2356
- C:\Windows\System\UPUDKDI.exe
  C:\Windows\System\UPUDKDI.exe
  2⤵
  PID:5092
- C:\Windows\System\vppLfCR.exe
  C:\Windows\System\vppLfCR.exe
  2⤵
  PID:2432
- C:\Windows\System\tfirwHs.exe
  C:\Windows\System\tfirwHs.exe
  2⤵
  PID:5520
- C:\Windows\System\OeoToKu.exe
  C:\Windows\System\OeoToKu.exe
  2⤵
  PID:5564
- C:\Windows\System\FsMefuW.exe
  C:\Windows\System\FsMefuW.exe
  2⤵
  PID:1572
- C:\Windows\System\iaCcWGE.exe
  C:\Windows\System\iaCcWGE.exe
  2⤵
  PID:5736
- C:\Windows\System\bXWWbzz.exe
  C:\Windows\System\bXWWbzz.exe
  2⤵
  PID:6152
- C:\Windows\System\EqymKtl.exe
  C:\Windows\System\EqymKtl.exe
  2⤵
  PID:6180
- C:\Windows\System\PRaUTNy.exe
  C:\Windows\System\PRaUTNy.exe
  2⤵
  PID:6196
- C:\Windows\System\Wlkjbcc.exe
  C:\Windows\System\Wlkjbcc.exe
  2⤵
  PID:6220
- C:\Windows\System\cPDJWSg.exe
  C:\Windows\System\cPDJWSg.exe
  2⤵
  PID:6240
- C:\Windows\System\bOMabbB.exe
  C:\Windows\System\bOMabbB.exe
  2⤵
  PID:6260
- C:\Windows\System\xnCixls.exe
  C:\Windows\System\xnCixls.exe
  2⤵
  PID:6276
- C:\Windows\System\RhJWYxb.exe
  C:\Windows\System\RhJWYxb.exe
  2⤵
  PID:6296
- C:\Windows\System\erXyzUL.exe
  C:\Windows\System\erXyzUL.exe
  2⤵
  PID:6316
- C:\Windows\System\lWqWkIy.exe
  C:\Windows\System\lWqWkIy.exe
  2⤵
  PID:6332
- C:\Windows\System\sLndMXN.exe
  C:\Windows\System\sLndMXN.exe
  2⤵
  PID:6356
- C:\Windows\System\VYRgPJR.exe
  C:\Windows\System\VYRgPJR.exe
  2⤵
  PID:6384
- C:\Windows\System\tdCEbnB.exe
  C:\Windows\System\tdCEbnB.exe
  2⤵
  PID:6400
- C:\Windows\System\soPojbF.exe
  C:\Windows\System\soPojbF.exe
  2⤵
  PID:6440
- C:\Windows\System\QuZEzis.exe
  C:\Windows\System\QuZEzis.exe
  2⤵
  PID:6464
- C:\Windows\System\NWjuHtJ.exe
  C:\Windows\System\NWjuHtJ.exe
  2⤵
  PID:6480
- C:\Windows\System\DVvvFdg.exe
  C:\Windows\System\DVvvFdg.exe
  2⤵
  PID:6504
- C:\Windows\System\ONZXeLU.exe
  C:\Windows\System\ONZXeLU.exe
  2⤵
  PID:6524
- C:\Windows\System\MVZaJhT.exe
  C:\Windows\System\MVZaJhT.exe
  2⤵
  PID:6540
- C:\Windows\System\okQHypz.exe
  C:\Windows\System\okQHypz.exe
  2⤵
  PID:6564
- C:\Windows\System\Taubvvv.exe
  C:\Windows\System\Taubvvv.exe
  2⤵
  PID:6592
- C:\Windows\System\sgeGSRn.exe
  C:\Windows\System\sgeGSRn.exe
  2⤵
  PID:6608
- C:\Windows\System\alZPIcl.exe
  C:\Windows\System\alZPIcl.exe
  2⤵
  PID:6628
- C:\Windows\System\btNbfsV.exe
  C:\Windows\System\btNbfsV.exe
  2⤵
  PID:6648
- C:\Windows\System\XMSBJOF.exe
  C:\Windows\System\XMSBJOF.exe
  2⤵
  PID:6672
- C:\Windows\System\grGhtcj.exe
  C:\Windows\System\grGhtcj.exe
  2⤵
  PID:6692
- C:\Windows\System\BnaUGpL.exe
  C:\Windows\System\BnaUGpL.exe
  2⤵
  PID:6720
- C:\Windows\System\HxJWEwa.exe
  C:\Windows\System\HxJWEwa.exe
  2⤵
  PID:6736
- C:\Windows\System\vPoVGkq.exe
  C:\Windows\System\vPoVGkq.exe
  2⤵
  PID:6760
- C:\Windows\System\GprfBwl.exe
  C:\Windows\System\GprfBwl.exe
  2⤵
  PID:6780
- C:\Windows\System\kQUJUGy.exe
  C:\Windows\System\kQUJUGy.exe
  2⤵
  PID:6800
- C:\Windows\System\nGMXuLu.exe
  C:\Windows\System\nGMXuLu.exe
  2⤵
  PID:6816
- C:\Windows\System\GqPXZFn.exe
  C:\Windows\System\GqPXZFn.exe
  2⤵
  PID:6864
- C:\Windows\System\uxknkPy.exe
  C:\Windows\System\uxknkPy.exe
  2⤵
  PID:6884
- C:\Windows\System\BaNgxBI.exe
  C:\Windows\System\BaNgxBI.exe
  2⤵
  PID:6912
- C:\Windows\System\cnrglPT.exe
  C:\Windows\System\cnrglPT.exe
  2⤵
  PID:6960
- C:\Windows\System\cSFEXKo.exe
  C:\Windows\System\cSFEXKo.exe
  2⤵
  PID:6980
- C:\Windows\System\sEidDQl.exe
  C:\Windows\System\sEidDQl.exe
  2⤵
  PID:7004
- C:\Windows\System\OdrIvxU.exe
  C:\Windows\System\OdrIvxU.exe
  2⤵
  PID:7020
- C:\Windows\System\DcjSLiy.exe
  C:\Windows\System\DcjSLiy.exe
  2⤵
  PID:7052
- C:\Windows\System\xJfOaTp.exe
  C:\Windows\System\xJfOaTp.exe
  2⤵
  PID:7068
- C:\Windows\System\xbJviPO.exe
  C:\Windows\System\xbJviPO.exe
  2⤵
  PID:7084
- C:\Windows\System\GnLdEXm.exe
  C:\Windows\System\GnLdEXm.exe
  2⤵
  PID:7100
- C:\Windows\System\YSsGwPr.exe
  C:\Windows\System\YSsGwPr.exe
  2⤵
  PID:7116
- C:\Windows\System\ZdwEyOh.exe
  C:\Windows\System\ZdwEyOh.exe
  2⤵
  PID:7132
- C:\Windows\System\sfStjtB.exe
  C:\Windows\System\sfStjtB.exe
  2⤵
  PID:7152
- C:\Windows\System\xYFJqND.exe
  C:\Windows\System\xYFJqND.exe
  2⤵
  PID:3496
- C:\Windows\System\oWOkMME.exe
  C:\Windows\System\oWOkMME.exe
  2⤵
  PID:5856
- C:\Windows\System\sidSDke.exe
  C:\Windows\System\sidSDke.exe
  2⤵
  PID:1884
- C:\Windows\System\SgvtjSh.exe
  C:\Windows\System\SgvtjSh.exe
  2⤵
  PID:4528
- C:\Windows\System\wxCPWer.exe
  C:\Windows\System\wxCPWer.exe
  2⤵
  PID:2780
- C:\Windows\System\yCJQRmU.exe
  C:\Windows\System\yCJQRmU.exe
  2⤵
  PID:6068
- C:\Windows\System\lThNvrE.exe
  C:\Windows\System\lThNvrE.exe
  2⤵
  PID:6108
- C:\Windows\System\xHTFMYg.exe
  C:\Windows\System\xHTFMYg.exe
  2⤵
  PID:5600
- C:\Windows\System\TNEnfHg.exe
  C:\Windows\System\TNEnfHg.exe
  2⤵
  PID:2420
- C:\Windows\System\MUnOHbJ.exe
  C:\Windows\System\MUnOHbJ.exe
  2⤵
  PID:4780
- C:\Windows\System\mtZZdZe.exe
  C:\Windows\System\mtZZdZe.exe
  2⤵
  PID:4456
- C:\Windows\System\XwOFdYV.exe
  C:\Windows\System\XwOFdYV.exe
  2⤵
  PID:1872
- C:\Windows\System\tVVMuYS.exe
  C:\Windows\System\tVVMuYS.exe
  2⤵
  PID:864
- C:\Windows\System\SmDnMbY.exe
  C:\Windows\System\SmDnMbY.exe
  2⤵
  PID:2000
- C:\Windows\System\kjeJIdO.exe
  C:\Windows\System\kjeJIdO.exe
  2⤵
  PID:5672
- C:\Windows\System\xyeKeGB.exe
  C:\Windows\System\xyeKeGB.exe
  2⤵
  PID:5172
- C:\Windows\System\yBstflh.exe
  C:\Windows\System\yBstflh.exe
  2⤵
  PID:5216
- C:\Windows\System\MsnhPxA.exe
  C:\Windows\System\MsnhPxA.exe
  2⤵
  PID:5048
- C:\Windows\System\khGdCbL.exe
  C:\Windows\System\khGdCbL.exe
  2⤵
  PID:1688
- C:\Windows\System\ijBIvPx.exe
  C:\Windows\System\ijBIvPx.exe
  2⤵
  PID:6408
- C:\Windows\System\jXJgIvT.exe
  C:\Windows\System\jXJgIvT.exe
  2⤵
  PID:5324
- C:\Windows\System\vfEqvnx.exe
  C:\Windows\System\vfEqvnx.exe
  2⤵
  PID:5444
- C:\Windows\System\LhzHmoY.exe
  C:\Windows\System\LhzHmoY.exe
  2⤵
  PID:5360
- C:\Windows\System\UHLhSFp.exe
  C:\Windows\System\UHLhSFp.exe
  2⤵
  PID:6456
- C:\Windows\System\YTJTBpR.exe
  C:\Windows\System\YTJTBpR.exe
  2⤵
  PID:6560
- C:\Windows\System\UVKueUz.exe
  C:\Windows\System\UVKueUz.exe
  2⤵
  PID:5652
- C:\Windows\System\ZsFizqR.exe
  C:\Windows\System\ZsFizqR.exe
  2⤵
  PID:7184
- C:\Windows\System\SjpilfV.exe
  C:\Windows\System\SjpilfV.exe
  2⤵
  PID:7204
- C:\Windows\System\pwCSBWy.exe
  C:\Windows\System\pwCSBWy.exe
  2⤵
  PID:7228
- C:\Windows\System\dvaXRXm.exe
  C:\Windows\System\dvaXRXm.exe
  2⤵
  PID:7252
- C:\Windows\System\DIlTfso.exe
  C:\Windows\System\DIlTfso.exe
  2⤵
  PID:7272
- C:\Windows\System\VaogJqQ.exe
  C:\Windows\System\VaogJqQ.exe
  2⤵
  PID:7292
- C:\Windows\System\hUyoLZx.exe
  C:\Windows\System\hUyoLZx.exe
  2⤵
  PID:7320
- C:\Windows\System\vXFXNKW.exe
  C:\Windows\System\vXFXNKW.exe
  2⤵
  PID:7336
- C:\Windows\System\VkJMJhn.exe
  C:\Windows\System\VkJMJhn.exe
  2⤵
  PID:7812
- C:\Windows\System\xMqvQZe.exe
  C:\Windows\System\xMqvQZe.exe
  2⤵
  PID:7968
- C:\Windows\System\dveLjmS.exe
  C:\Windows\System\dveLjmS.exe
  2⤵
  PID:7988
- C:\Windows\System\uprucej.exe
  C:\Windows\System\uprucej.exe
  2⤵
  PID:8012
- C:\Windows\System\UvSBkTn.exe
  C:\Windows\System\UvSBkTn.exe
  2⤵
  PID:8036
- C:\Windows\System\qVjPvWy.exe
  C:\Windows\System\qVjPvWy.exe
  2⤵
  PID:8056
- C:\Windows\System\dXqKtcJ.exe
  C:\Windows\System\dXqKtcJ.exe
  2⤵
  PID:8076
- C:\Windows\System\MVQPamh.exe
  C:\Windows\System\MVQPamh.exe
  2⤵
  PID:8100
- C:\Windows\System\flJllKh.exe
  C:\Windows\System\flJllKh.exe
  2⤵
  PID:8120
- C:\Windows\System\tNxinng.exe
  C:\Windows\System\tNxinng.exe
  2⤵
  PID:8140
- C:\Windows\System\FCImZwP.exe
  C:\Windows\System\FCImZwP.exe
  2⤵
  PID:8164
- C:\Windows\System\iAWhRAH.exe
  C:\Windows\System\iAWhRAH.exe
  2⤵
  PID:8184
- C:\Windows\System\pZpZDiz.exe
  C:\Windows\System\pZpZDiz.exe
  2⤵
  PID:6660
- C:\Windows\System\TiKrjRy.exe
  C:\Windows\System\TiKrjRy.exe
  2⤵
  PID:6700
- C:\Windows\System\bBAtyPS.exe
  C:\Windows\System\bBAtyPS.exe
  2⤵
  PID:5752
- C:\Windows\System\TwqWvxX.exe
  C:\Windows\System\TwqWvxX.exe
  2⤵
  PID:5828
- C:\Windows\System\zDFKlOn.exe
  C:\Windows\System\zDFKlOn.exe
  2⤵
  PID:5932
- C:\Windows\System\TwNMwco.exe
  C:\Windows\System\TwNMwco.exe
  2⤵
  PID:5964
- C:\Windows\System\BqyQfXw.exe
  C:\Windows\System\BqyQfXw.exe
  2⤵
  PID:4612
- C:\Windows\System\CtLPTPB.exe
  C:\Windows\System\CtLPTPB.exe
  2⤵
  PID:3440
- C:\Windows\System\xACHMZJ.exe
  C:\Windows\System\xACHMZJ.exe
  2⤵
  PID:1864
- C:\Windows\System\uYcEcKZ.exe
  C:\Windows\System\uYcEcKZ.exe
  2⤵
  PID:5212
- C:\Windows\System\RbzgPAs.exe
  C:\Windows\System\RbzgPAs.exe
  2⤵
  PID:1892
- C:\Windows\System\bnTKhpq.exe
  C:\Windows\System\bnTKhpq.exe
  2⤵
  PID:5504
- C:\Windows\System\nkxbJPl.exe
  C:\Windows\System\nkxbJPl.exe
  2⤵
  PID:5556
- C:\Windows\System\bUjzmwa.exe
  C:\Windows\System\bUjzmwa.exe
  2⤵
  PID:3764
- C:\Windows\System\SujfTIh.exe
  C:\Windows\System\SujfTIh.exe
  2⤵
  PID:1384
- C:\Windows\System\LHSfjwb.exe
  C:\Windows\System\LHSfjwb.exe
  2⤵
  PID:6188
- C:\Windows\System\afilCzG.exe
  C:\Windows\System\afilCzG.exe
  2⤵
  PID:6236
- C:\Windows\System\nhcrIry.exe
  C:\Windows\System\nhcrIry.exe
  2⤵
  PID:6272
- C:\Windows\System\rGmeVCR.exe
  C:\Windows\System\rGmeVCR.exe
  2⤵
  PID:6328
- C:\Windows\System\QYRvJbg.exe
  C:\Windows\System\QYRvJbg.exe
  2⤵
  PID:6376
- C:\Windows\System\aUnykop.exe
  C:\Windows\System\aUnykop.exe
  2⤵
  PID:6432
- C:\Windows\System\cVqrRUq.exe
  C:\Windows\System\cVqrRUq.exe
  2⤵
  PID:6532
- C:\Windows\System\xmGEebe.exe
  C:\Windows\System\xmGEebe.exe
  2⤵
  PID:6616
- C:\Windows\System\tTgTacl.exe
  C:\Windows\System\tTgTacl.exe
  2⤵
  PID:6772
- C:\Windows\System\QQobDgw.exe
  C:\Windows\System\QQobDgw.exe
  2⤵
  PID:6848
- C:\Windows\System\ArXEaBf.exe
  C:\Windows\System\ArXEaBf.exe
  2⤵
  PID:6948
- C:\Windows\System\ahaVhvi.exe
  C:\Windows\System\ahaVhvi.exe
  2⤵
  PID:7032
- C:\Windows\System\KYFDwdU.exe
  C:\Windows\System\KYFDwdU.exe
  2⤵
  PID:7112
- C:\Windows\System\ALtGhPo.exe
  C:\Windows\System\ALtGhPo.exe
  2⤵
  PID:5844
- C:\Windows\System\haBvsMH.exe
  C:\Windows\System\haBvsMH.exe
  2⤵
  PID:6056
- C:\Windows\System\blcIRWJ.exe
  C:\Windows\System\blcIRWJ.exe
  2⤵
  PID:5584
- C:\Windows\System\kXxFlaU.exe
  C:\Windows\System\kXxFlaU.exe
  2⤵
  PID:1712
- C:\Windows\System\aDFEpqK.exe
  C:\Windows\System\aDFEpqK.exe
  2⤵
  PID:4416
- C:\Windows\System\QsxvAmw.exe
  C:\Windows\System\QsxvAmw.exe
  2⤵
  PID:2760
- C:\Windows\System\OloGwfC.exe
  C:\Windows\System\OloGwfC.exe
  2⤵
  PID:4880
- C:\Windows\System\uAlNrpM.exe
  C:\Windows\System\uAlNrpM.exe
  2⤵
  PID:5424
- C:\Windows\System\hysBPAz.exe
  C:\Windows\System\hysBPAz.exe
  2⤵
  PID:7196
- C:\Windows\System\LwYHwjW.exe
  C:\Windows\System\LwYHwjW.exe
  2⤵
  PID:7268
- C:\Windows\System\XiZgLFD.exe
  C:\Windows\System\XiZgLFD.exe
  2⤵
  PID:7344
- C:\Windows\System\alkbksD.exe
  C:\Windows\System\alkbksD.exe
  2⤵
  PID:7328
- C:\Windows\System\SzcjudS.exe
  C:\Windows\System\SzcjudS.exe
  2⤵
  PID:7240
- C:\Windows\System\JyUEcTN.exe
  C:\Windows\System\JyUEcTN.exe
  2⤵
  PID:1520
- C:\Windows\System\dQTduTV.exe
  C:\Windows\System\dQTduTV.exe
  2⤵
  PID:4632
- C:\Windows\System\ZghNyvr.exe
  C:\Windows\System\ZghNyvr.exe
  2⤵
  PID:3760
- C:\Windows\System\mUstRTT.exe
  C:\Windows\System\mUstRTT.exe
  2⤵
  PID:6092
- C:\Windows\System\RcPHbNq.exe
  C:\Windows\System\RcPHbNq.exe
  2⤵
  PID:4644
- C:\Windows\System\fwSFcRK.exe
  C:\Windows\System\fwSFcRK.exe
  2⤵
  PID:7092
- C:\Windows\System\LGGmzys.exe
  C:\Windows\System\LGGmzys.exe
  2⤵
  PID:6972
- C:\Windows\System\LcRqjnM.exe
  C:\Windows\System\LcRqjnM.exe
  2⤵
  PID:3736
- C:\Windows\System\WlPrZKe.exe
  C:\Windows\System\WlPrZKe.exe
  2⤵
  PID:1032
- C:\Windows\System\JaLCQrn.exe
  C:\Windows\System\JaLCQrn.exe
  2⤵
  PID:4928
- C:\Windows\System\GOkHyLI.exe
  C:\Windows\System\GOkHyLI.exe
  2⤵
  PID:2328
- C:\Windows\System\EEdAYdO.exe
  C:\Windows\System\EEdAYdO.exe
  2⤵
  PID:3296
- C:\Windows\System\DnPwOOu.exe
  C:\Windows\System\DnPwOOu.exe
  2⤵
  PID:3520
- C:\Windows\System\bzBXUHd.exe
  C:\Windows\System\bzBXUHd.exe
  2⤵
  PID:1056
- C:\Windows\System\LCJJDoY.exe
  C:\Windows\System\LCJJDoY.exe
  2⤵
  PID:2124
- C:\Windows\System\AotkLxM.exe
  C:\Windows\System\AotkLxM.exe
  2⤵
  PID:944
- C:\Windows\System\dJtmfDZ.exe
  C:\Windows\System\dJtmfDZ.exe
  2⤵
  PID:3548
- C:\Windows\System\YSCvPjX.exe
  C:\Windows\System\YSCvPjX.exe
  2⤵
  PID:5108
- C:\Windows\System\BsqbQsY.exe
  C:\Windows\System\BsqbQsY.exe
  2⤵
  PID:7860
- C:\Windows\System\kQWPopo.exe
  C:\Windows\System\kQWPopo.exe
  2⤵
  PID:7888
- C:\Windows\System\gXslNUm.exe
  C:\Windows\System\gXslNUm.exe
  2⤵
  PID:1768
- C:\Windows\System\ojskjIP.exe
  C:\Windows\System\ojskjIP.exe
  2⤵
  PID:8032
- C:\Windows\System\jvmRKLi.exe
  C:\Windows\System\jvmRKLi.exe
  2⤵
  PID:8072
- C:\Windows\System\eWOfMyi.exe
  C:\Windows\System\eWOfMyi.exe
  2⤵
  PID:8156
- C:\Windows\System\QNyiUDj.exe
  C:\Windows\System\QNyiUDj.exe
  2⤵
  PID:8176
- C:\Windows\System\YqUuJir.exe
  C:\Windows\System\YqUuJir.exe
  2⤵
  PID:8204
- C:\Windows\System\MJNgPeh.exe
  C:\Windows\System\MJNgPeh.exe
  2⤵
  PID:8228
- C:\Windows\System\dGOBUzr.exe
  C:\Windows\System\dGOBUzr.exe
  2⤵
  PID:8248
- C:\Windows\System\oDqtePI.exe
  C:\Windows\System\oDqtePI.exe
  2⤵
  PID:8268
- C:\Windows\System\mtpfwNk.exe
  C:\Windows\System\mtpfwNk.exe
  2⤵
  PID:8292
- C:\Windows\System\THPoWur.exe
  C:\Windows\System\THPoWur.exe
  2⤵
  PID:8316
- C:\Windows\System\VSGvXzP.exe
  C:\Windows\System\VSGvXzP.exe
  2⤵
  PID:8340
- C:\Windows\System\bafmHEF.exe
  C:\Windows\System\bafmHEF.exe
  2⤵
  PID:8356
- C:\Windows\System\ZVngQGS.exe
  C:\Windows\System\ZVngQGS.exe
  2⤵
  PID:8380
- C:\Windows\System\LgIwzMe.exe
  C:\Windows\System\LgIwzMe.exe
  2⤵
  PID:8400
- C:\Windows\System\xNdvzrc.exe
  C:\Windows\System\xNdvzrc.exe
  2⤵
  PID:8424
- C:\Windows\System\AuZhWGo.exe
  C:\Windows\System\AuZhWGo.exe
  2⤵
  PID:8440
- C:\Windows\System\uKkYaSj.exe
  C:\Windows\System\uKkYaSj.exe
  2⤵
  PID:8476
- C:\Windows\System\ZIIxGbA.exe
  C:\Windows\System\ZIIxGbA.exe
  2⤵
  PID:8492
- C:\Windows\System\JpWDrpC.exe
  C:\Windows\System\JpWDrpC.exe
  2⤵
  PID:8516
- C:\Windows\System\DykQDwO.exe
  C:\Windows\System\DykQDwO.exe
  2⤵
  PID:8540
- C:\Windows\System\oYzRAoY.exe
  C:\Windows\System\oYzRAoY.exe
  2⤵
  PID:8560
- C:\Windows\System\BUWRNPL.exe
  C:\Windows\System\BUWRNPL.exe
  2⤵
  PID:8584
- C:\Windows\System\VwqRBQg.exe
  C:\Windows\System\VwqRBQg.exe
  2⤵
  PID:8608
- C:\Windows\System\tepvDYU.exe
  C:\Windows\System\tepvDYU.exe
  2⤵
  PID:8628
- C:\Windows\System\ftYAJUx.exe
  C:\Windows\System\ftYAJUx.exe
  2⤵
  PID:8652
- C:\Windows\System\EUvYnwf.exe
  C:\Windows\System\EUvYnwf.exe
  2⤵
  PID:8672
- C:\Windows\System\dVAfPuu.exe
  C:\Windows\System\dVAfPuu.exe
  2⤵
  PID:8696
- C:\Windows\System\eyZLnGp.exe
  C:\Windows\System\eyZLnGp.exe
  2⤵
  PID:8716
- C:\Windows\System\jFYwnVT.exe
  C:\Windows\System\jFYwnVT.exe
  2⤵
  PID:8736
- C:\Windows\System\TCNKnIb.exe
  C:\Windows\System\TCNKnIb.exe
  2⤵
  PID:8760
- C:\Windows\System\rgXvXJy.exe
  C:\Windows\System\rgXvXJy.exe
  2⤵
  PID:8776
- C:\Windows\System\yQUiVue.exe
  C:\Windows\System\yQUiVue.exe
  2⤵
  PID:8800
- C:\Windows\System\NDsDKTb.exe
  C:\Windows\System\NDsDKTb.exe
  2⤵
  PID:8824
- C:\Windows\System\lInnUPm.exe
  C:\Windows\System\lInnUPm.exe
  2⤵
  PID:8844
- C:\Windows\System\aTkgPJc.exe
  C:\Windows\System\aTkgPJc.exe
  2⤵
  PID:8864
- C:\Windows\System\cEKYYRG.exe
  C:\Windows\System\cEKYYRG.exe
  2⤵
  PID:8904
- C:\Windows\System\VikjebR.exe
  C:\Windows\System\VikjebR.exe
  2⤵
  PID:8920
- C:\Windows\System\SNVRyYf.exe
  C:\Windows\System\SNVRyYf.exe
  2⤵
  PID:8944
- C:\Windows\System\nwAvPJH.exe
  C:\Windows\System\nwAvPJH.exe
  2⤵
  PID:8960
- C:\Windows\System\mJnjWll.exe
  C:\Windows\System\mJnjWll.exe
  2⤵
  PID:8984
- C:\Windows\System\YvzztIH.exe
  C:\Windows\System\YvzztIH.exe
  2⤵
  PID:9004
- C:\Windows\System\QnnAFXC.exe
  C:\Windows\System\QnnAFXC.exe
  2⤵
  PID:9020
- C:\Windows\System\mxMLnzZ.exe
  C:\Windows\System\mxMLnzZ.exe
  2⤵
  PID:9040
- C:\Windows\System\oQdypZQ.exe
  C:\Windows\System\oQdypZQ.exe
  2⤵
  PID:9056
- C:\Windows\System\lgdwrwZ.exe
  C:\Windows\System\lgdwrwZ.exe
  2⤵
  PID:9072
- C:\Windows\System\aEljleH.exe
  C:\Windows\System\aEljleH.exe
  2⤵
  PID:9096
- C:\Windows\System\KaZXuFQ.exe
  C:\Windows\System\KaZXuFQ.exe
  2⤵
  PID:9116
- C:\Windows\System\UVVtOZs.exe
  C:\Windows\System\UVVtOZs.exe
  2⤵
  PID:9136
- C:\Windows\System\VFoIdNm.exe
  C:\Windows\System\VFoIdNm.exe
  2⤵
  PID:9160
- C:\Windows\System\BJZbOgk.exe
  C:\Windows\System\BJZbOgk.exe
  2⤵
  PID:9180
- C:\Windows\System\iEXSAFb.exe
  C:\Windows\System\iEXSAFb.exe
  2⤵
  PID:9204
- C:\Windows\System\sfjRnqF.exe
  C:\Windows\System\sfjRnqF.exe
  2⤵
  PID:5788
- C:\Windows\System\bwgpKar.exe
  C:\Windows\System\bwgpKar.exe
  2⤵
  PID:6040
- C:\Windows\System\CvyLZtd.exe
  C:\Windows\System\CvyLZtd.exe
  2⤵
  PID:5688
- C:\Windows\System\DrXrOJs.exe
  C:\Windows\System\DrXrOJs.exe
  2⤵
  PID:4936
- C:\Windows\System\DSMWFRY.exe
  C:\Windows\System\DSMWFRY.exe
  2⤵
  PID:3212
- C:\Windows\System\lhlXEhA.exe
  C:\Windows\System\lhlXEhA.exe
  2⤵
  PID:8048
- C:\Windows\System\rngaXBv.exe
  C:\Windows\System\rngaXBv.exe
  2⤵
  PID:6492
- C:\Windows\System\KpgsVFy.exe
  C:\Windows\System\KpgsVFy.exe
  2⤵
  PID:8132
- C:\Windows\System\gDuotsI.exe
  C:\Windows\System\gDuotsI.exe
  2⤵
  PID:6644
- C:\Windows\System\UIaAJQS.exe
  C:\Windows\System\UIaAJQS.exe
  2⤵
  PID:9236
- C:\Windows\System\QlUGEjH.exe
  C:\Windows\System\QlUGEjH.exe
  2⤵
  PID:9268
- C:\Windows\System\piApCBo.exe
  C:\Windows\System\piApCBo.exe
  2⤵
  PID:9292
- C:\Windows\System\GpboQLG.exe
  C:\Windows\System\GpboQLG.exe
  2⤵
  PID:9312
- C:\Windows\System\BmZtgLf.exe
  C:\Windows\System\BmZtgLf.exe
  2⤵
  PID:9332
- C:\Windows\System\DrtSBzC.exe
  C:\Windows\System\DrtSBzC.exe
  2⤵
  PID:9352
- C:\Windows\System\OQiWqUX.exe
  C:\Windows\System\OQiWqUX.exe
  2⤵
  PID:9376
- C:\Windows\System\OiAgLdz.exe
  C:\Windows\System\OiAgLdz.exe
  2⤵
  PID:9400
- C:\Windows\System\oPXNpvW.exe
  C:\Windows\System\oPXNpvW.exe
  2⤵
  PID:9424
- C:\Windows\System\WIhBBnG.exe
  C:\Windows\System\WIhBBnG.exe
  2⤵
  PID:9444
- C:\Windows\System\zzADdUD.exe
  C:\Windows\System\zzADdUD.exe
  2⤵
  PID:9472
- C:\Windows\System\aqOTgIm.exe
  C:\Windows\System\aqOTgIm.exe
  2⤵
  PID:9492
- C:\Windows\System\vSeyzIw.exe
  C:\Windows\System\vSeyzIw.exe
  2⤵
  PID:9516
- C:\Windows\System\GFqammY.exe
  C:\Windows\System\GFqammY.exe
  2⤵
  PID:9536
- C:\Windows\System\XYeAGST.exe
  C:\Windows\System\XYeAGST.exe
  2⤵
  PID:9560
- C:\Windows\System\CvwrBaI.exe
  C:\Windows\System\CvwrBaI.exe
  2⤵
  PID:9584
- C:\Windows\System\lHnGGZe.exe
  C:\Windows\System\lHnGGZe.exe
  2⤵
  PID:9604
- C:\Windows\System\dYICjfm.exe
  C:\Windows\System\dYICjfm.exe
  2⤵
  PID:9624
- C:\Windows\System\BoHbLWP.exe
  C:\Windows\System\BoHbLWP.exe
  2⤵
  PID:9644
- C:\Windows\System\EPKQrPT.exe
  C:\Windows\System\EPKQrPT.exe
  2⤵
  PID:9664
- C:\Windows\System\SRTdfbV.exe
  C:\Windows\System\SRTdfbV.exe
  2⤵
  PID:9684
- C:\Windows\System\Oltoxjj.exe
  C:\Windows\System\Oltoxjj.exe
  2⤵
  PID:9704
- C:\Windows\System\EDryMqr.exe
  C:\Windows\System\EDryMqr.exe
  2⤵
  PID:9724
- C:\Windows\System\bxRzxaC.exe
  C:\Windows\System\bxRzxaC.exe
  2⤵
  PID:9744
- C:\Windows\System\TqnwYtA.exe
  C:\Windows\System\TqnwYtA.exe
  2⤵
  PID:9764
- C:\Windows\System\XnwWsKq.exe
  C:\Windows\System\XnwWsKq.exe
  2⤵
  PID:9784
- C:\Windows\System\JmWMTsq.exe
  C:\Windows\System\JmWMTsq.exe
  2⤵
  PID:9808
- C:\Windows\System\UrXrLNw.exe
  C:\Windows\System\UrXrLNw.exe
  2⤵
  PID:9836
- C:\Windows\System\tiXzmBD.exe
  C:\Windows\System\tiXzmBD.exe
  2⤵
  PID:9856
- C:\Windows\System\olFVNmj.exe
  C:\Windows\System\olFVNmj.exe
  2⤵
  PID:9888
- C:\Windows\System\hTyPNLZ.exe
  C:\Windows\System\hTyPNLZ.exe
  2⤵
  PID:9916
- C:\Windows\System\izghfnE.exe
  C:\Windows\System\izghfnE.exe
  2⤵
  PID:9944
- C:\Windows\System\DFWYmxR.exe
  C:\Windows\System\DFWYmxR.exe
  2⤵
  PID:9960
- C:\Windows\System\iOvxNGm.exe
  C:\Windows\System\iOvxNGm.exe
  2⤵
  PID:9984
- C:\Windows\System\yCmuIjC.exe
  C:\Windows\System\yCmuIjC.exe
  2⤵
  PID:10008
- C:\Windows\System\ZrGKKSH.exe
  C:\Windows\System\ZrGKKSH.exe
  2⤵
  PID:10024
- C:\Windows\System\ADaZpVV.exe
  C:\Windows\System\ADaZpVV.exe
  2⤵
  PID:10048
- C:\Windows\System\RmcDqiB.exe
  C:\Windows\System\RmcDqiB.exe
  2⤵
  PID:10076
- C:\Windows\System\ZreNyWP.exe
  C:\Windows\System\ZreNyWP.exe
  2⤵
  PID:10096
- C:\Windows\System\EeJHqBk.exe
  C:\Windows\System\EeJHqBk.exe
  2⤵
  PID:10124
- C:\Windows\System\OvXmwax.exe
  C:\Windows\System\OvXmwax.exe
  2⤵
  PID:10144
- C:\Windows\System\ZhywzsS.exe
  C:\Windows\System\ZhywzsS.exe
  2⤵
  PID:10172
- C:\Windows\System\SYhsZCK.exe
  C:\Windows\System\SYhsZCK.exe
  2⤵
  PID:10192
- C:\Windows\System\gmxkEpC.exe
  C:\Windows\System\gmxkEpC.exe
  2⤵
  PID:10212
- C:\Windows\System\mvqBSOe.exe
  C:\Windows\System\mvqBSOe.exe
  2⤵
  PID:10236
- C:\Windows\System\odqWLpA.exe
  C:\Windows\System\odqWLpA.exe
  2⤵
  PID:1848
- C:\Windows\System\yfzxIkC.exe
  C:\Windows\System\yfzxIkC.exe
  2⤵
  PID:7836
- C:\Windows\System\uPJqkjY.exe
  C:\Windows\System\uPJqkjY.exe
  2⤵
  PID:8028
- C:\Windows\System\YMaEBnk.exe
  C:\Windows\System\YMaEBnk.exe
  2⤵
  PID:8236
- C:\Windows\System\AXjximr.exe
  C:\Windows\System\AXjximr.exe
  2⤵
  PID:6684
- C:\Windows\System\oiYsVbB.exe
  C:\Windows\System\oiYsVbB.exe
  2⤵
  PID:7916
- C:\Windows\System\YjGZRyc.exe
  C:\Windows\System\YjGZRyc.exe
  2⤵
  PID:3272
- C:\Windows\System\AJwqaYO.exe
  C:\Windows\System\AJwqaYO.exe
  2⤵
  PID:8604
- C:\Windows\System\tEMRKIC.exe
  C:\Windows\System\tEMRKIC.exe
  2⤵
  PID:8684
- C:\Windows\System\LwNIaUe.exe
  C:\Windows\System\LwNIaUe.exe
  2⤵
  PID:8732
- C:\Windows\System\fDJXQFi.exe
  C:\Windows\System\fDJXQFi.exe
  2⤵
  PID:8792
- C:\Windows\System\AmQJAgk.exe
  C:\Windows\System\AmQJAgk.exe
  2⤵
  PID:8832
- C:\Windows\System\OXttbfe.exe
  C:\Windows\System\OXttbfe.exe
  2⤵
  PID:10768
- C:\Windows\System\fsrpSRa.exe
  C:\Windows\System\fsrpSRa.exe
  2⤵
  PID:10788
- C:\Windows\System\OtEmgxL.exe
  C:\Windows\System\OtEmgxL.exe
  2⤵
  PID:10808
- C:\Windows\System\UBPyeeD.exe
  C:\Windows\System\UBPyeeD.exe
  2⤵
  PID:10840
- C:\Windows\System\xcykncw.exe
  C:\Windows\System\xcykncw.exe
  2⤵
  PID:10872
- C:\Windows\System\QSCdBPi.exe
  C:\Windows\System\QSCdBPi.exe
  2⤵
  PID:10888
- C:\Windows\System\czwuaRi.exe
  C:\Windows\System\czwuaRi.exe
  2⤵
  PID:10912
- C:\Windows\System\sKxisAD.exe
  C:\Windows\System\sKxisAD.exe
  2⤵
  PID:10940
- C:\Windows\System\iEZRrVd.exe
  C:\Windows\System\iEZRrVd.exe
  2⤵
  PID:10960
- C:\Windows\System\CdEiGRO.exe
  C:\Windows\System\CdEiGRO.exe
  2⤵
  PID:10980
- C:\Windows\System\GkpBLAY.exe
  C:\Windows\System\GkpBLAY.exe
  2⤵
  PID:10996
- C:\Windows\System\CToFizH.exe
  C:\Windows\System\CToFizH.exe
  2⤵
  PID:11012
- C:\Windows\System\iacgMdN.exe
  C:\Windows\System\iacgMdN.exe
  2⤵
  PID:11040
- C:\Windows\System\kqbKVcd.exe
  C:\Windows\System\kqbKVcd.exe
  2⤵
  PID:11064
- C:\Windows\System\lRzVlTe.exe
  C:\Windows\System\lRzVlTe.exe
  2⤵
  PID:11084
- C:\Windows\System\ugOUqKX.exe
  C:\Windows\System\ugOUqKX.exe
  2⤵
  PID:11104
- C:\Windows\System\MdMFdhG.exe
  C:\Windows\System\MdMFdhG.exe
  2⤵
  PID:11128
- C:\Windows\System\ujEnVRl.exe
  C:\Windows\System\ujEnVRl.exe
  2⤵
  PID:11152
- C:\Windows\System\oRufPgG.exe
  C:\Windows\System\oRufPgG.exe
  2⤵
  PID:11172
- C:\Windows\System\hUkbtuP.exe
  C:\Windows\System\hUkbtuP.exe
  2⤵
  PID:11196
- C:\Windows\System\oLBpWAO.exe
  C:\Windows\System\oLBpWAO.exe
  2⤵
  PID:11216
- C:\Windows\System\nfNyBAJ.exe
  C:\Windows\System\nfNyBAJ.exe
  2⤵
  PID:11240
- C:\Windows\System\NVSvhMT.exe
  C:\Windows\System\NVSvhMT.exe
  2⤵
  PID:11260
- C:\Windows\System\XiacMbz.exe
  C:\Windows\System\XiacMbz.exe
  2⤵
  PID:5712
- C:\Windows\System\jxUXGnF.exe
  C:\Windows\System\jxUXGnF.exe
  2⤵
  PID:404
- C:\Windows\System\AVuBOea.exe
  C:\Windows\System\AVuBOea.exe
  2⤵
  PID:2348
- C:\Windows\System\GEfEoaI.exe
  C:\Windows\System\GEfEoaI.exe
  2⤵
  PID:3744
- C:\Windows\System\jarxGJG.exe
  C:\Windows\System\jarxGJG.exe
  2⤵
  PID:9484
- C:\Windows\System\FnmVRuk.exe
  C:\Windows\System\FnmVRuk.exe
  2⤵
  PID:8276
- C:\Windows\System\gZHSKcJ.exe
  C:\Windows\System\gZHSKcJ.exe
  2⤵
  PID:8332
- C:\Windows\System\cCUWKQC.exe
  C:\Windows\System\cCUWKQC.exe
  2⤵
  PID:1388
- C:\Windows\System\hoPBVsy.exe
  C:\Windows\System\hoPBVsy.exe
  2⤵
  PID:9756
- C:\Windows\System\tXEqNSY.exe
  C:\Windows\System\tXEqNSY.exe
  2⤵
  PID:4520
- C:\Windows\System\JKBupoA.exe
  C:\Windows\System\JKBupoA.exe
  2⤵
  PID:6324
- C:\Windows\System\KAdBOJO.exe
  C:\Windows\System\KAdBOJO.exe
  2⤵
  PID:6216
- C:\Windows\System\wtXqpjm.exe
  C:\Windows\System\wtXqpjm.exe
  2⤵
  PID:8616
- C:\Windows\System\wyOfsOt.exe
  C:\Windows\System\wyOfsOt.exe
  2⤵
  PID:10164
- C:\Windows\System\bstdiXu.exe
  C:\Windows\System\bstdiXu.exe
  2⤵
  PID:4148
- C:\Windows\System\qWtqpsx.exe
  C:\Windows\System\qWtqpsx.exe
  2⤵
  PID:6600
- C:\Windows\System\myHlNsN.exe
  C:\Windows\System\myHlNsN.exe
  2⤵
  PID:6808
- C:\Windows\System\xsOaxss.exe
  C:\Windows\System\xsOaxss.exe
  2⤵
  PID:7064
- C:\Windows\System\yTHEkln.exe
  C:\Windows\System\yTHEkln.exe
  2⤵
  PID:8812
- C:\Windows\System\yJIwANZ.exe
  C:\Windows\System\yJIwANZ.exe
  2⤵
  PID:7236
- C:\Windows\System\PNCTfqK.exe
  C:\Windows\System\PNCTfqK.exe
  2⤵
  PID:9064
- C:\Windows\System\HrRzCAm.exe
  C:\Windows\System\HrRzCAm.exe
  2⤵
  PID:6052
- C:\Windows\System\abgANpw.exe
  C:\Windows\System\abgANpw.exe
  2⤵
  PID:6640
- C:\Windows\System\lnFeHRq.exe
  C:\Windows\System\lnFeHRq.exe
  2⤵
  PID:116
- C:\Windows\System\BBSKeKK.exe
  C:\Windows\System\BBSKeKK.exe
  2⤵
  PID:1436
- C:\Windows\System\uUmuHjk.exe
  C:\Windows\System\uUmuHjk.exe
  2⤵
  PID:8136
- C:\Windows\System\hDzZWQB.exe
  C:\Windows\System\hDzZWQB.exe
  2⤵
  PID:8212
- C:\Windows\System\JfXmbYc.exe
  C:\Windows\System\JfXmbYc.exe
  2⤵
  PID:9620
- C:\Windows\System\kVAClox.exe
  C:\Windows\System\kVAClox.exe
  2⤵
  PID:9672
- C:\Windows\System\cnxaiEX.exe
  C:\Windows\System\cnxaiEX.exe
  2⤵
  PID:9804
- C:\Windows\System\kqLMqmo.exe
  C:\Windows\System\kqLMqmo.exe
  2⤵
  PID:8436
- C:\Windows\System\SAGqeNC.exe
  C:\Windows\System\SAGqeNC.exe
  2⤵
  PID:9980
- C:\Windows\System\tFDmbzc.exe
  C:\Windows\System\tFDmbzc.exe
  2⤵
  PID:10020
- C:\Windows\System\ePPFWBG.exe
  C:\Windows\System\ePPFWBG.exe
  2⤵
  PID:10088
- C:\Windows\System\KsMsoNB.exe
  C:\Windows\System\KsMsoNB.exe
  2⤵
  PID:10108
- C:\Windows\System\UkPxxaS.exe
  C:\Windows\System\UkPxxaS.exe
  2⤵
  PID:11276
- C:\Windows\System\YDxwBoR.exe
  C:\Windows\System\YDxwBoR.exe
  2⤵
  PID:11300
- C:\Windows\System\UsDoPCV.exe
  C:\Windows\System\UsDoPCV.exe
  2⤵
  PID:11320
- C:\Windows\System\vcbLwKU.exe
  C:\Windows\System\vcbLwKU.exe
  2⤵
  PID:11344
- C:\Windows\System\CpNnwxk.exe
  C:\Windows\System\CpNnwxk.exe
  2⤵
  PID:11372
- C:\Windows\System\XQoyPsj.exe
  C:\Windows\System\XQoyPsj.exe
  2⤵
  PID:11400
- C:\Windows\System\qglrAEq.exe
  C:\Windows\System\qglrAEq.exe
  2⤵
  PID:11420
- C:\Windows\System\bHwWVZg.exe
  C:\Windows\System\bHwWVZg.exe
  2⤵
  PID:11440
- C:\Windows\System\vQvmFgv.exe
  C:\Windows\System\vQvmFgv.exe
  2⤵
  PID:11464
- C:\Windows\System\vrHgXgo.exe
  C:\Windows\System\vrHgXgo.exe
  2⤵
  PID:11560
- C:\Windows\System\hZfbotC.exe
  C:\Windows\System\hZfbotC.exe
  2⤵
  PID:11588
- C:\Windows\System\HgRnlvM.exe
  C:\Windows\System\HgRnlvM.exe
  2⤵
  PID:11608
- C:\Windows\System\ZgfTBiL.exe
  C:\Windows\System\ZgfTBiL.exe
  2⤵
  PID:11636
- C:\Windows\System\ihIaspK.exe
  C:\Windows\System\ihIaspK.exe
  2⤵
  PID:11660
- C:\Windows\System\Khvyxgj.exe
  C:\Windows\System\Khvyxgj.exe
  2⤵
  PID:11680
- C:\Windows\System\VHWpVFF.exe
  C:\Windows\System\VHWpVFF.exe
  2⤵
  PID:11704
- C:\Windows\System\NarHrkf.exe
  C:\Windows\System\NarHrkf.exe
  2⤵
  PID:11720
- C:\Windows\System\USFksDm.exe
  C:\Windows\System\USFksDm.exe
  2⤵
  PID:11736
- C:\Windows\System\zSvMzKE.exe
  C:\Windows\System\zSvMzKE.exe
  2⤵
  PID:11756
- C:\Windows\System\llebJyB.exe
  C:\Windows\System\llebJyB.exe
  2⤵
  PID:11772
- C:\Windows\System\sDcWmpe.exe
  C:\Windows\System\sDcWmpe.exe
  2⤵
  PID:11792
- C:\Windows\System\rxFAXES.exe
  C:\Windows\System\rxFAXES.exe
  2⤵
  PID:11808
- C:\Windows\System\XIEhQDK.exe
  C:\Windows\System\XIEhQDK.exe
  2⤵
  PID:11824
- C:\Windows\System\yxCUrCg.exe
  C:\Windows\System\yxCUrCg.exe
  2⤵
  PID:11840
- C:\Windows\System\YoKwuxb.exe
  C:\Windows\System\YoKwuxb.exe
  2⤵
  PID:11868
- C:\Windows\System\oxggqBC.exe
  C:\Windows\System\oxggqBC.exe
  2⤵
  PID:11888
- C:\Windows\System\wxLlLZe.exe
  C:\Windows\System\wxLlLZe.exe
  2⤵
  PID:11912
- C:\Windows\System\fNMCacE.exe
  C:\Windows\System\fNMCacE.exe
  2⤵
  PID:11936
- C:\Windows\System\RdWzoyW.exe
  C:\Windows\System\RdWzoyW.exe
  2⤵
  PID:11964
- C:\Windows\System\csVsfPu.exe
  C:\Windows\System\csVsfPu.exe
  2⤵
  PID:11980
- C:\Windows\System\RtrTfCk.exe
  C:\Windows\System\RtrTfCk.exe
  2⤵
  PID:11996
- C:\Windows\System\VsTXPSA.exe
  C:\Windows\System\VsTXPSA.exe
  2⤵
  PID:12016
- C:\Windows\System\eWEVOzm.exe
  C:\Windows\System\eWEVOzm.exe
  2⤵
  PID:12044
- C:\Windows\System\Fcxbsjr.exe
  C:\Windows\System\Fcxbsjr.exe
  2⤵
  PID:12068
- C:\Windows\System\jYDCqEO.exe
  C:\Windows\System\jYDCqEO.exe
  2⤵
  PID:12088
- C:\Windows\System\wnXrQtG.exe
  C:\Windows\System\wnXrQtG.exe
  2⤵
  PID:12108
- C:\Windows\System\ZZItpyx.exe
  C:\Windows\System\ZZItpyx.exe
  2⤵
  PID:12128
- C:\Windows\System\iCGbGgi.exe
  C:\Windows\System\iCGbGgi.exe
  2⤵
  PID:12152
- C:\Windows\System\cypNlKq.exe
  C:\Windows\System\cypNlKq.exe
  2⤵
  PID:12176
- C:\Windows\System\BEMypch.exe
  C:\Windows\System\BEMypch.exe
  2⤵
  PID:12196
- C:\Windows\System\PhToDPm.exe
  C:\Windows\System\PhToDPm.exe
  2⤵
  PID:12216
- C:\Windows\System\kbqLUAj.exe
  C:\Windows\System\kbqLUAj.exe
  2⤵
  PID:12240
- C:\Windows\System\WcUzTAI.exe
  C:\Windows\System\WcUzTAI.exe
  2⤵
  PID:12256
- C:\Windows\System\EJmzJAJ.exe
  C:\Windows\System\EJmzJAJ.exe
  2⤵
  PID:12280
- C:\Windows\System\PHXnCOv.exe
  C:\Windows\System\PHXnCOv.exe
  2⤵
  PID:10208
- C:\Windows\System\XyIbtwa.exe
  C:\Windows\System\XyIbtwa.exe
  2⤵
  PID:8884
- C:\Windows\System\FUDvYHu.exe
  C:\Windows\System\FUDvYHu.exe
  2⤵
  PID:8952
- C:\Windows\System\yJBKCnr.exe
  C:\Windows\System\yJBKCnr.exe
  2⤵
  PID:8992
- C:\Windows\System\HsCKeBx.exe
  C:\Windows\System\HsCKeBx.exe
  2⤵
  PID:5036
- C:\Windows\System\Hqbvscr.exe
  C:\Windows\System\Hqbvscr.exe
  2⤵
  PID:9036
- C:\Windows\System\fFCpSkE.exe
  C:\Windows\System\fFCpSkE.exe
  2⤵
  PID:10716
- C:\Windows\System\SHmDRaH.exe
  C:\Windows\System\SHmDRaH.exe
  2⤵
  PID:6576
- C:\Windows\System\bRXETJX.exe
  C:\Windows\System\bRXETJX.exe
  2⤵
  PID:9212
- C:\Windows\System\MCALeYC.exe
  C:\Windows\System\MCALeYC.exe
  2⤵
  PID:1096
- C:\Windows\System\rMSLyHK.exe
  C:\Windows\System\rMSLyHK.exe
  2⤵
  PID:6988
- C:\Windows\System\xMsIeVr.exe
  C:\Windows\System\xMsIeVr.exe
  2⤵
  PID:10864
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 10864 -s 28
    3⤵
    PID:7832
- C:\Windows\System\cxMdLgU.exe
  C:\Windows\System\cxMdLgU.exe
  2⤵
  PID:10896
- C:\Windows\System\PxuCbfI.exe
  C:\Windows\System\PxuCbfI.exe
  2⤵
  PID:10948
- C:\Windows\System\txjXZKX.exe
  C:\Windows\System\txjXZKX.exe
  2⤵
  PID:10968
- C:\Windows\System\QwJAMbc.exe
  C:\Windows\System\QwJAMbc.exe
  2⤵
  PID:9408
- C:\Windows\System\qYNZizR.exe
  C:\Windows\System\qYNZizR.exe
  2⤵
  PID:11052
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 11052 -s 28
    3⤵
    PID:12272
- C:\Windows\System\dxoQHqm.exe
  C:\Windows\System\dxoQHqm.exe
  2⤵
  PID:11124
- C:\Windows\System\pSYdBVg.exe
  C:\Windows\System\pSYdBVg.exe
  2⤵
  PID:11168
- C:\Windows\System\BQGTkfC.exe
  C:\Windows\System\BQGTkfC.exe
  2⤵
  PID:11224
- C:\Windows\System\OmkfNYl.exe
  C:\Windows\System\OmkfNYl.exe
  2⤵
  PID:9344
- C:\Windows\System\YzDoOkc.exe
  C:\Windows\System\YzDoOkc.exe
  2⤵
  PID:4548
- C:\Windows\System\BomAEaO.exe
  C:\Windows\System\BomAEaO.exe
  2⤵
  PID:9792
- C:\Windows\System\GlpXnif.exe
  C:\Windows\System\GlpXnif.exe
  2⤵
  PID:8512
- C:\Windows\System\ulmPziZ.exe
  C:\Windows\System\ulmPziZ.exe
  2⤵
  PID:9676
- C:\Windows\System\ZnnlGGw.exe
  C:\Windows\System\ZnnlGGw.exe
  2⤵
  PID:12300
- C:\Windows\System\XYMUPWC.exe
  C:\Windows\System\XYMUPWC.exe
  2⤵
  PID:12324
- C:\Windows\System\oVPOCxd.exe
  C:\Windows\System\oVPOCxd.exe
  2⤵
  PID:12348
- C:\Windows\System\voPAFRO.exe
  C:\Windows\System\voPAFRO.exe
  2⤵
  PID:12368
- C:\Windows\System\PMgJPhK.exe
  C:\Windows\System\PMgJPhK.exe
  2⤵
  PID:12396
- C:\Windows\System\drEfNle.exe
  C:\Windows\System\drEfNle.exe
  2⤵
  PID:12416
- C:\Windows\System\dBmmuRw.exe
  C:\Windows\System\dBmmuRw.exe
  2⤵
  PID:12444
- C:\Windows\System\mhpKjLt.exe
  C:\Windows\System\mhpKjLt.exe
  2⤵
  PID:12464
- C:\Windows\System\KvybMYa.exe
  C:\Windows\System\KvybMYa.exe
  2⤵
  PID:12484
- C:\Windows\System\CVfCxOV.exe
  C:\Windows\System\CVfCxOV.exe
  2⤵
  PID:12508
- C:\Windows\System\jztQSVX.exe
  C:\Windows\System\jztQSVX.exe
  2⤵
  PID:12528
- C:\Windows\System\nRFOUlP.exe
  C:\Windows\System\nRFOUlP.exe
  2⤵
  PID:12548
- C:\Windows\System\acDaIrN.exe
  C:\Windows\System\acDaIrN.exe
  2⤵
  PID:12564
- C:\Windows\System\fthkItK.exe
  C:\Windows\System\fthkItK.exe
  2⤵
  PID:12580
- C:\Windows\System\IvGNNKu.exe
  C:\Windows\System\IvGNNKu.exe
  2⤵
  PID:12596
- C:\Windows\System\wyPllvN.exe
  C:\Windows\System\wyPllvN.exe
  2⤵
  PID:12612
- C:\Windows\System\zXLWgTa.exe
  C:\Windows\System\zXLWgTa.exe
  2⤵
  PID:12628
- C:\Windows\System\KWGzmpG.exe
  C:\Windows\System\KWGzmpG.exe
  2⤵
  PID:12644
- C:\Windows\System\iEJPkIC.exe
  C:\Windows\System\iEJPkIC.exe
  2⤵
  PID:12660
- C:\Windows\System\bIJSmJZ.exe
  C:\Windows\System\bIJSmJZ.exe
  2⤵
  PID:12676
- C:\Windows\System\PYaMpPw.exe
  C:\Windows\System\PYaMpPw.exe
  2⤵
  PID:12692
- C:\Windows\System\vMRTxEX.exe
  C:\Windows\System\vMRTxEX.exe
  2⤵
  PID:12708
- C:\Windows\System\RoTqOWF.exe
  C:\Windows\System\RoTqOWF.exe
  2⤵
  PID:12724
- C:\Windows\System\lswWqBo.exe
  C:\Windows\System\lswWqBo.exe
  2⤵
  PID:12740
- C:\Windows\System\vLolitj.exe
  C:\Windows\System\vLolitj.exe
  2⤵
  PID:12760
- C:\Windows\System\lrTiDWD.exe
  C:\Windows\System\lrTiDWD.exe
  2⤵
  PID:12784
- C:\Windows\System\GlqobrS.exe
  C:\Windows\System\GlqobrS.exe
  2⤵
  PID:12800
- C:\Windows\System\ZYJDxqL.exe
  C:\Windows\System\ZYJDxqL.exe
  2⤵
  PID:12824
- C:\Windows\System\QtYdRJM.exe
  C:\Windows\System\QtYdRJM.exe
  2⤵
  PID:12844
- C:\Windows\System\Uenhofy.exe
  C:\Windows\System\Uenhofy.exe
  2⤵
  PID:12864
- C:\Windows\System\WtuOUwH.exe
  C:\Windows\System\WtuOUwH.exe
  2⤵
  PID:12884
- C:\Windows\System\gjmlqTB.exe
  C:\Windows\System\gjmlqTB.exe
  2⤵
  PID:10820
- C:\Windows\System\qiFdxWI.exe
  C:\Windows\System\qiFdxWI.exe
  2⤵
  PID:10668
- C:\Windows\System\qXmiASv.exe
  C:\Windows\System\qXmiASv.exe
  2⤵
  PID:4140
- C:\Windows\System\zKopMGk.exe
  C:\Windows\System\zKopMGk.exe
  2⤵
  PID:12716
- C:\Windows\System\yavlWhl.exe
  C:\Windows\System\yavlWhl.exe
  2⤵
  PID:11380
- C:\Windows\System\xpwbibh.exe
  C:\Windows\System\xpwbibh.exe
  2⤵
  PID:11472
- C:\Windows\System\yYZxneP.exe
  C:\Windows\System\yYZxneP.exe
  2⤵
  PID:13072
- C:\Windows\System\oDyBAsl.exe
  C:\Windows\System\oDyBAsl.exe
  2⤵
  PID:11552
- C:\Windows\System\RAMYnJI.exe
  C:\Windows\System\RAMYnJI.exe
  2⤵
  PID:11712
- C:\Windows\System\QDPCKcc.exe
  C:\Windows\System\QDPCKcc.exe
  2⤵
  PID:11752
- C:\Windows\System\lthLteY.exe
  C:\Windows\System\lthLteY.exe
  2⤵
  PID:11816
- C:\Windows\System\gpcCgHJ.exe
  C:\Windows\System\gpcCgHJ.exe
  2⤵
  PID:11920
- C:\Windows\System\TAtwQaB.exe
  C:\Windows\System\TAtwQaB.exe
  2⤵
  PID:11972
- C:\Windows\System\HvBxIZd.exe
  C:\Windows\System\HvBxIZd.exe
  2⤵
  PID:12004
- C:\Windows\System\QwkRCHW.exe
  C:\Windows\System\QwkRCHW.exe
  2⤵
  PID:12056
- C:\Windows\System\SudtDty.exe
  C:\Windows\System\SudtDty.exe
  2⤵
  PID:12084
- C:\Windows\System\qsgRxJQ.exe
  C:\Windows\System\qsgRxJQ.exe
  2⤵
  PID:12140
- C:\Windows\System\xEqimtA.exe
  C:\Windows\System\xEqimtA.exe
  2⤵
  PID:10536
- C:\Windows\System\thOMyCK.exe
  C:\Windows\System\thOMyCK.exe
  2⤵
  PID:13260
- C:\Windows\System\aiBnPNA.exe
  C:\Windows\System\aiBnPNA.exe
  2⤵
  PID:9128
- C:\Windows\System\lwYbQod.exe
  C:\Windows\System\lwYbQod.exe
  2⤵
  PID:7264
- C:\Windows\System\mjyxCCc.exe
  C:\Windows\System\mjyxCCc.exe
  2⤵
  PID:10936
- C:\Windows\System\XdMROrd.exe
  C:\Windows\System\XdMROrd.exe
  2⤵
  PID:13288
- C:\Windows\System\HACIKrr.exe
  C:\Windows\System\HACIKrr.exe
  2⤵
  PID:13304
- C:\Windows\System\CRSPSeO.exe
  C:\Windows\System\CRSPSeO.exe
  2⤵
  PID:12516
- C:\Windows\System\grNbBlV.exe
  C:\Windows\System\grNbBlV.exe
  2⤵
  PID:12876
- C:\Windows\System\BMjtvgz.exe
  C:\Windows\System\BMjtvgz.exe
  2⤵
  PID:13000
- C:\Windows\System\gDThDmi.exe
  C:\Windows\System\gDThDmi.exe
  2⤵
  PID:13032
- C:\Windows\System\BdDNbyO.exe
  C:\Windows\System\BdDNbyO.exe
  2⤵
  PID:13080
- C:\Windows\System\lwjYsxB.exe
  C:\Windows\System\lwjYsxB.exe
  2⤵
  PID:13128
- C:\Windows\System\dqwNwvD.exe
  C:\Windows\System\dqwNwvD.exe
  2⤵
  PID:10040
- C:\Windows\System\sPoWhIA.exe
  C:\Windows\System\sPoWhIA.exe
  2⤵
  PID:1112
- C:\Windows\System\bFxOSXG.exe
  C:\Windows\System\bFxOSXG.exe
  2⤵
  PID:12924
- C:\Windows\System\WlfjUot.exe
  C:\Windows\System\WlfjUot.exe
  2⤵
  PID:11100
- C:\Windows\System\WhmfsVN.exe
  C:\Windows\System\WhmfsVN.exe
  2⤵
  PID:10140
- C:\Windows\System\KTxtJTi.exe
  C:\Windows\System\KTxtJTi.exe
  2⤵
  PID:12536
- C:\Windows\System\ADHEBCE.exe
  C:\Windows\System\ADHEBCE.exe
  2⤵
  PID:12668
- C:\Windows\System\rOSdcMZ.exe
  C:\Windows\System\rOSdcMZ.exe
  2⤵
  PID:7880
- C:\Windows\System\BkchHwX.exe
  C:\Windows\System\BkchHwX.exe
  2⤵
  PID:11624
- C:\Windows\System\GYOJsuI.exe
  C:\Windows\System\GYOJsuI.exe
  2⤵
  PID:12688
- C:\Windows\System\DvGgugU.exe
  C:\Windows\System\DvGgugU.exe
  2⤵
  PID:11900
- C:\Windows\System\mcHWqne.exe
  C:\Windows\System\mcHWqne.exe
  2⤵
  PID:12080
- C:\Windows\System\kRdGwhj.exe
  C:\Windows\System\kRdGwhj.exe
  2⤵
  PID:12840
- C:\Windows\System\iegljZY.exe
  C:\Windows\System\iegljZY.exe
  2⤵
  PID:13112
- C:\Windows\System\CgsdZhl.exe
  C:\Windows\System\CgsdZhl.exe
  2⤵
  PID:12036
- C:\Windows\System\qiAGYMw.exe
  C:\Windows\System\qiAGYMw.exe
  2⤵
  PID:8576
- C:\Windows\System\ugZPAuL.exe
  C:\Windows\System\ugZPAuL.exe
  2⤵
  PID:2092
- C:\Windows\System\uepuUrb.exe
  C:\Windows\System\uepuUrb.exe
  2⤵
  PID:7148
- C:\Windows\System\MNPnPWX.exe
  C:\Windows\System\MNPnPWX.exe
  2⤵
  PID:7304
- C:\Windows\System\zpzIBho.exe
  C:\Windows\System\zpzIBho.exe
  2⤵
  PID:8348
- C:\Windows\System\dKoIoMj.exe
  C:\Windows\System\dKoIoMj.exe
  2⤵
  PID:12952
- C:\Windows\System\shggeRV.exe
  C:\Windows\System\shggeRV.exe
  2⤵
  PID:12236
- C:\Windows\System\fhZaQra.exe
  C:\Windows\System\fhZaQra.exe
  2⤵
  PID:12024
- C:\Windows\System\wFdFpgC.exe
  C:\Windows\System\wFdFpgC.exe
  2⤵
  PID:11748
- C:\Windows\System\yqpRINh.exe
  C:\Windows\System\yqpRINh.exe
  2⤵
  PID:7932
- C:\Windows\System\ciIrHzp.exe
  C:\Windows\System\ciIrHzp.exe
  2⤵
  PID:6136
- C:\Windows\System\Yeclari.exe
  C:\Windows\System\Yeclari.exe
  2⤵
  PID:13268
- C:\Windows\System\lkuYHgd.exe
  C:\Windows\System\lkuYHgd.exe
  2⤵
  PID:7564
- C:\Windows\System\BcsUksO.exe
  C:\Windows\System\BcsUksO.exe
  2⤵
  PID:11328
- C:\Windows\System\HcpGVFm.exe
  C:\Windows\System\HcpGVFm.exe
  2⤵
  PID:12192
- C:\Windows\System\FZWoVGi.exe
  C:\Windows\System\FZWoVGi.exe
  2⤵
  PID:10920
- C:\Windows\System\VReLakY.exe
  C:\Windows\System\VReLakY.exe
  2⤵
  PID:12904
- C:\Windows\System\BAeTpxy.exe
  C:\Windows\System\BAeTpxy.exe
  2⤵
  PID:11568
- C:\Windows\System\LondiAY.exe
  C:\Windows\System\LondiAY.exe
  2⤵
  PID:11364
- C:\Windows\System\BwTRUdM.exe
  C:\Windows\System\BwTRUdM.exe
  2⤵
  PID:12592
- C:\Windows\System\wjtRKKq.exe
  C:\Windows\System\wjtRKKq.exe
  2⤵
  PID:13104
- C:\Windows\System\CGCYeDl.exe
  C:\Windows\System\CGCYeDl.exe
  2⤵
  PID:12936
- C:\Windows\System\OaJsmCi.exe
  C:\Windows\System\OaJsmCi.exe
  2⤵
  PID:3664
- C:\Windows\System\tfsXKbR.exe
  C:\Windows\System\tfsXKbR.exe
  2⤵
  PID:4808
- C:\Windows\System\VCthuth.exe
  C:\Windows\System\VCthuth.exe
  2⤵
  PID:9656
- C:\Windows\System\WrznCXO.exe
  C:\Windows\System\WrznCXO.exe
  2⤵
  PID:7576
- C:\Windows\System\ZChtfPV.exe
  C:\Windows\System\ZChtfPV.exe
  2⤵
  PID:5980
- C:\Windows\System\JWsnGLK.exe
  C:\Windows\System\JWsnGLK.exe
  2⤵
  PID:8172
- C:\Windows\System\DsvTHpQ.exe
  C:\Windows\System\DsvTHpQ.exe
  2⤵
  PID:10404
- C:\Windows\System\dEVwsAW.exe
  C:\Windows\System\dEVwsAW.exe
  2⤵
  PID:10004
- C:\Windows\System\Mmwyokw.exe
  C:\Windows\System\Mmwyokw.exe
  2⤵
  PID:12916
- C:\Windows\System\qnyUpGu.exe
  C:\Windows\System\qnyUpGu.exe
  2⤵
  PID:12704
- C:\Windows\System\ynnjZrT.exe
  C:\Windows\System\ynnjZrT.exe
  2⤵
  PID:7832
- C:\Windows\System\pyBDPdT.exe
  C:\Windows\System\pyBDPdT.exe
  2⤵
  PID:4800
- C:\Windows\System\zXLPFTS.exe
  C:\Windows\System\zXLPFTS.exe
  2⤵
  PID:9848
- C:\Windows\System\abeWSmI.exe
  C:\Windows\System\abeWSmI.exe
  2⤵
  PID:13024
- C:\Windows\System\FJKbXPB.exe
  C:\Windows\System\FJKbXPB.exe
  2⤵
  PID:12336
- C:\Windows\System\iYmfaug.exe
  C:\Windows\System\iYmfaug.exe
  2⤵
  PID:7568
- C:\Windows\System\ShjRMys.exe
  C:\Windows\System\ShjRMys.exe
  2⤵
  PID:7560
- C:\Windows\System\kFTeYCI.exe
  C:\Windows\System\kFTeYCI.exe
  2⤵
  PID:12272
- C:\Windows\System\bKdlmCJ.exe
  C:\Windows\System\bKdlmCJ.exe
  2⤵
  PID:9828
- C:\Windows\System\tHnzorH.exe
  C:\Windows\System\tHnzorH.exe
  2⤵
  PID:9144
- C:\Windows\System\DNfmRdp.exe
  C:\Windows\System\DNfmRdp.exe
  2⤵
  PID:12476
- C:\Windows\System\tKRRJpe.exe
  C:\Windows\System\tKRRJpe.exe
  2⤵
  PID:7520
- C:\Windows\System\yzuZJrb.exe
  C:\Windows\System\yzuZJrb.exe
  2⤵
  PID:9700
- C:\Windows\System\dOUDdqr.exe
  C:\Windows\System\dOUDdqr.exe
  2⤵
  PID:6796
- C:\Windows\System\nJqlbQl.exe
  C:\Windows\System\nJqlbQl.exe
  2⤵
  PID:12332
- C:\Windows\System\XMZEeIz.exe
  C:\Windows\System\XMZEeIz.exe
  2⤵
  PID:6976
- C:\Windows\System\lefHuEa.exe
  C:\Windows\System\lefHuEa.exe
  2⤵
  PID:8488
- C:\Windows\System\dXJkmWm.exe
  C:\Windows\System\dXJkmWm.exe
  2⤵
  PID:8264
- C:\Windows\System\ZxMWKfS.exe
  C:\Windows\System\ZxMWKfS.exe
  2⤵
  PID:4100
- C:\Windows\System\lxDvcim.exe
  C:\Windows\System\lxDvcim.exe
  2⤵
  PID:10044
- C:\Windows\System\QLlznop.exe
  C:\Windows\System\QLlznop.exe
  2⤵
  PID:12500
- C:\Windows\System\bJbBAwe.exe
  C:\Windows\System\bJbBAwe.exe
  2⤵
  PID:12496
- C:\Windows\System\oDDipYL.exe
  C:\Windows\System\oDDipYL.exe
  2⤵
  PID:9224
- C:\Windows\System\MUtIIGJ.exe
  C:\Windows\System\MUtIIGJ.exe
  2⤵
  PID:232
- C:\Windows\System\cPEjESu.exe
  C:\Windows\System\cPEjESu.exe
  2⤵
  PID:3648
- C:\Windows\System\OGxGTlC.exe
  C:\Windows\System\OGxGTlC.exe
  2⤵
  PID:13680
- C:\Windows\System\wmPBQVf.exe
  C:\Windows\System\wmPBQVf.exe
  2⤵
  PID:13700
- C:\Windows\System\PGtGVoV.exe
  C:\Windows\System\PGtGVoV.exe
  2⤵
  PID:13720
- C:\Windows\System\KgvbMwL.exe
  C:\Windows\System\KgvbMwL.exe
  2⤵
  PID:13744
- C:\Windows\System\caqMuzh.exe
  C:\Windows\System\caqMuzh.exe
  2⤵
  PID:13760
- C:\Windows\System\YDbPxhe.exe
  C:\Windows\System\YDbPxhe.exe
  2⤵
  PID:13780
- C:\Windows\System\iGdjhDx.exe
  C:\Windows\System\iGdjhDx.exe
  2⤵
  PID:14052
- C:\Windows\System\RtSbrKA.exe
  C:\Windows\System\RtSbrKA.exe
  2⤵
  PID:14076
- C:\Windows\System\PCmEsyQ.exe
  C:\Windows\System\PCmEsyQ.exe
  2⤵
  PID:14100
- C:\Windows\System\ppNafdO.exe
  C:\Windows\System\ppNafdO.exe
  2⤵
  PID:7688
- C:\Windows\System\NrCSPbI.exe
  C:\Windows\System\NrCSPbI.exe
  2⤵
  PID:7704
- C:\Windows\System\MQmFKWm.exe
  C:\Windows\System\MQmFKWm.exe
  2⤵
  PID:13972
- C:\Windows\System\ksGdtsw.exe
  C:\Windows\System\ksGdtsw.exe
  2⤵
  PID:13980
- C:\Windows\System\nrCAaAG.exe
  C:\Windows\System\nrCAaAG.exe
  2⤵
  PID:3720
- C:\Windows\System\ujIwUwk.exe
  C:\Windows\System\ujIwUwk.exe
  2⤵
  PID:14028
- C:\Windows\System\QSyybrk.exe
  C:\Windows\System\QSyybrk.exe
  2⤵
  PID:2008
- C:\Windows\System\NdSTWGU.exe
  C:\Windows\System\NdSTWGU.exe
  2⤵
  PID:14216
- C:\Windows\System\PPnuAXP.exe
  C:\Windows\System\PPnuAXP.exe
  2⤵
  PID:14252
- C:\Windows\System\jLRkSoy.exe
  C:\Windows\System\jLRkSoy.exe
  2⤵
  PID:14312
- C:\Windows\System\EnRQoLp.exe
  C:\Windows\System\EnRQoLp.exe
  2⤵
  PID:13400
- C:\Windows\System\lLmtEQA.exe
  C:\Windows\System\lLmtEQA.exe
  2⤵
  PID:13440
- C:\Windows\System\PhHvGGI.exe
  C:\Windows\System\PhHvGGI.exe
  2⤵
  PID:13456
- C:\Windows\System\gxsIjNa.exe
  C:\Windows\System\gxsIjNa.exe
  2⤵
  PID:13452
- C:\Windows\System\qvtdCZD.exe
  C:\Windows\System\qvtdCZD.exe
  2⤵
  PID:3320
- C:\Windows\System\dsKjEFR.exe
  C:\Windows\System\dsKjEFR.exe
  2⤵
  PID:3388
- C:\Windows\System\dOBBCZa.exe
  C:\Windows\System\dOBBCZa.exe
  2⤵
  PID:2924
- C:\Windows\System\hjREJuQ.exe
  C:\Windows\System\hjREJuQ.exe
  2⤵
  PID:1880
- C:\Windows\System\IBVkNTH.exe
  C:\Windows\System\IBVkNTH.exe
  2⤵
  PID:13504
- C:\Windows\System\QVoVrgU.exe
  C:\Windows\System\QVoVrgU.exe
  2⤵
  PID:14160
- C:\Windows\System\bichLSa.exe
  C:\Windows\System\bichLSa.exe
  2⤵
  PID:13500
- C:\Windows\System\rgHHlPH.exe
  C:\Windows\System\rgHHlPH.exe
  2⤵
  PID:13620
- C:\Windows\System\BTCKbsC.exe
  C:\Windows\System\BTCKbsC.exe
  2⤵
  PID:1132
- C:\Windows\System\djuRWgw.exe
  C:\Windows\System\djuRWgw.exe
  2⤵
  PID:1128
- C:\Windows\System\uRMLzFU.exe
  C:\Windows\System\uRMLzFU.exe
  2⤵
  PID:13708
- C:\Windows\System\pDvtFsM.exe
  C:\Windows\System\pDvtFsM.exe
  2⤵
  PID:13752
- C:\Windows\System\OoMnKEx.exe
  C:\Windows\System\OoMnKEx.exe
  2⤵
  PID:13832
- C:\Windows\System\vkeXvqK.exe
  C:\Windows\System\vkeXvqK.exe
  2⤵
  PID:13860
- C:\Windows\System\MQggULo.exe
  C:\Windows\System\MQggULo.exe
  2⤵
  PID:13892
- C:\Windows\System\cJOQFey.exe
  C:\Windows\System\cJOQFey.exe
  2⤵
  PID:14088
- C:\Windows\System\uGucfYj.exe
  C:\Windows\System\uGucfYj.exe
  2⤵
  PID:13948
- C:\Windows\System\NJFqdmz.exe
  C:\Windows\System\NJFqdmz.exe
  2⤵
  PID:13968
- C:\Windows\System\RjESARm.exe
  C:\Windows\System\RjESARm.exe
  2⤵
  PID:1196
- C:\Windows\System\gdCLfId.exe
  C:\Windows\System\gdCLfId.exe
  2⤵
  PID:7796
- C:\Windows\System\zbvaqZy.exe
  C:\Windows\System\zbvaqZy.exe
  2⤵
  PID:840
- C:\Windows\System\KvsPXZZ.exe
  C:\Windows\System\KvsPXZZ.exe
  2⤵
  PID:3260
- C:\Windows\System\zFqkWdc.exe
  C:\Windows\System\zFqkWdc.exe
  2⤵
  PID:4460
- C:\Windows\System\UxABOLN.exe
  C:\Windows\System\UxABOLN.exe
  2⤵
  PID:14300
- C:\Windows\System\ORTLAXn.exe
  C:\Windows\System\ORTLAXn.exe
  2⤵
  PID:448
- C:\Windows\System\PZhVUyG.exe
  C:\Windows\System\PZhVUyG.exe
  2⤵
  PID:3380
- C:\Windows\System\UtwwvdK.exe
  C:\Windows\System\UtwwvdK.exe
  2⤵
  PID:14248
- C:\Windows\System\QBfOSXD.exe
  C:\Windows\System\QBfOSXD.exe
  2⤵
  PID:1460
- C:\Windows\System\uuOVGFN.exe
  C:\Windows\System\uuOVGFN.exe
  2⤵
  PID:1924
- C:\Windows\System\VbcTAoc.exe
  C:\Windows\System\VbcTAoc.exe
  2⤵
  PID:4748
- C:\Windows\System\kkuHaJg.exe
  C:\Windows\System\kkuHaJg.exe
  2⤵
  PID:13552
- C:\Windows\System\dYbWnER.exe
  C:\Windows\System\dYbWnER.exe
  2⤵
  PID:13524
- C:\Windows\System\TmdAzXe.exe
  C:\Windows\System\TmdAzXe.exe
  2⤵
  PID:13884
- C:\Windows\System\HdzNywK.exe
  C:\Windows\System\HdzNywK.exe
  2⤵
  PID:13912
- C:\Windows\System\QvqXYny.exe
  C:\Windows\System\QvqXYny.exe
  2⤵
  PID:1332
- C:\Windows\System\PwRBGHj.exe
  C:\Windows\System\PwRBGHj.exe
  2⤵
  PID:7792
- C:\Windows\System\IiynAgw.exe
  C:\Windows\System\IiynAgw.exe
  2⤵
  PID:3236
- C:\Windows\System\poIUKLb.exe
  C:\Windows\System\poIUKLb.exe
  2⤵
  PID:2064
- C:\Windows\System\giHYqzY.exe
  C:\Windows\System\giHYqzY.exe
  2⤵
  PID:7776
- C:\Windows\System\GbiMwHF.exe
  C:\Windows\System\GbiMwHF.exe
  2⤵
  PID:3144
- C:\Windows\System\GrNLXEO.exe
  C:\Windows\System\GrNLXEO.exe
  2⤵
  PID:14004
- C:\Windows\System\BSZonHI.exe
  C:\Windows\System\BSZonHI.exe
  2⤵
  PID:5412
- C:\Windows\System\YBizCYd.exe
  C:\Windows\System\YBizCYd.exe
  2⤵
  PID:5720
- C:\Windows\System\BYgEYKU.exe
  C:\Windows\System\BYgEYKU.exe
  2⤵
  PID:5804
- C:\Windows\System\kOWDhlW.exe
  C:\Windows\System\kOWDhlW.exe
  2⤵
  PID:14284
- C:\Windows\System\DWDRZtT.exe
  C:\Windows\System\DWDRZtT.exe
  2⤵
  PID:1236
- C:\Windows\System\XXfeGbD.exe
  C:\Windows\System\XXfeGbD.exe
  2⤵
  PID:14196
- C:\Windows\System\FFLvKsb.exe
  C:\Windows\System\FFLvKsb.exe
  2⤵
  PID:13624
- C:\Windows\System\OFhxjNX.exe
  C:\Windows\System\OFhxjNX.exe
  2⤵
  PID:13604
- C:\Windows\System\OdMlbQt.exe
  C:\Windows\System\OdMlbQt.exe
  2⤵
  PID:4944
- C:\Windows\System\lBOtPih.exe
  C:\Windows\System\lBOtPih.exe
  2⤵
  PID:13596
- C:\Windows\System\qEebMdn.exe
  C:\Windows\System\qEebMdn.exe
  2⤵
  PID:3540
- C:\Windows\System\UTunkGz.exe
  C:\Windows\System\UTunkGz.exe
  2⤵
  PID:14192
- C:\Windows\System\GBxzGjg.exe
  C:\Windows\System\GBxzGjg.exe
  2⤵
  PID:5984
- C:\Windows\System\kGAolMa.exe
  C:\Windows\System\kGAolMa.exe
  2⤵
  PID:6420
- C:\Windows\System\ZpdpaRz.exe
  C:\Windows\System\ZpdpaRz.exe
  2⤵
  PID:6836
- C:\Windows\System\gDJkbqT.exe
  C:\Windows\System\gDJkbqT.exe
  2⤵
  PID:5636
- C:\Windows\System\tFvddVt.exe
  C:\Windows\System\tFvddVt.exe
  2⤵
  PID:5668
- C:\Windows\System\UeCvgSk.exe
  C:\Windows\System\UeCvgSk.exe
  2⤵
  PID:3544
- C:\Windows\System\ZamFJVU.exe
  C:\Windows\System\ZamFJVU.exe
  2⤵
  PID:3008
- C:\Windows\System\cgJYdue.exe
  C:\Windows\System\cgJYdue.exe
  2⤵
  PID:6168
- C:\Windows\System\LaMVRUc.exe
  C:\Windows\System\LaMVRUc.exe
  2⤵
  PID:6072
- C:\Windows\System\ZgJMGzc.exe
  C:\Windows\System\ZgJMGzc.exe
  2⤵
  PID:13576
- C:\Windows\System\EHxvnDt.exe
  C:\Windows\System\EHxvnDt.exe
  2⤵
  PID:7048
- C:\Windows\System\VTNcJTc.exe
  C:\Windows\System\VTNcJTc.exe
  2⤵
  PID:13476
- C:\Windows\System\PhkTBvN.exe
  C:\Windows\System\PhkTBvN.exe
  2⤵
  PID:4980
- C:\Windows\System\SaJXpNl.exe
  C:\Windows\System\SaJXpNl.exe
  2⤵
  PID:6248
- C:\Windows\System\dEPwTJC.exe
  C:\Windows\System\dEPwTJC.exe
  2⤵
  PID:6344
- C:\Windows\System\dyOGdQC.exe
  C:\Windows\System\dyOGdQC.exe
  2⤵
  PID:13592
- C:\Windows\System\PeJorLA.exe
  C:\Windows\System\PeJorLA.exe
  2⤵
  PID:1248
- C:\Windows\System\klGpEsd.exe
  C:\Windows\System\klGpEsd.exe
  2⤵
  PID:5740
- C:\Windows\System\aWaaPRp.exe
  C:\Windows\System\aWaaPRp.exe
  2⤵
  PID:3528
- C:\Windows\System\lfSyQoJ.exe
  C:\Windows\System\lfSyQoJ.exe
  2⤵
  PID:3524
- C:\Windows\System\rzQryHH.exe
  C:\Windows\System\rzQryHH.exe
  2⤵
  PID:13904
- C:\Windows\System\lhfzboK.exe
  C:\Windows\System\lhfzboK.exe
  2⤵
  PID:6000
- C:\Windows\System\hKUJXjn.exe
  C:\Windows\System\hKUJXjn.exe
  2⤵
  PID:7312
- C:\Windows\System\cyVMrTQ.exe
  C:\Windows\System\cyVMrTQ.exe
  2⤵
  PID:4904
- C:\Windows\System\sOygDNr.exe
  C:\Windows\System\sOygDNr.exe
  2⤵
  PID:6908
- C:\Windows\System\hNZgdat.exe
  C:\Windows\System\hNZgdat.exe
  2⤵
  PID:6776
- C:\Windows\System\ZYwXxSt.exe
  C:\Windows\System\ZYwXxSt.exe
  2⤵
  PID:5404
- C:\Windows\System\WIEEYxa.exe
  C:\Windows\System\WIEEYxa.exe
  2⤵
  PID:1912
- C:\Windows\System\kFhDNge.exe
  C:\Windows\System\kFhDNge.exe
  2⤵
  PID:6832
- C:\Windows\System\dGuUaTo.exe
  C:\Windows\System\dGuUaTo.exe
  2⤵
  PID:13572
- C:\Windows\System\qjqEgRK.exe
  C:\Windows\System\qjqEgRK.exe
  2⤵
  PID:13396
- C:\Windows\System\ldUxPYi.exe
  C:\Windows\System\ldUxPYi.exe
  2⤵
  PID:12588
- C:\Windows\System\oOUqHSv.exe
  C:\Windows\System\oOUqHSv.exe
  2⤵
  PID:7984
- C:\Windows\System\KNzvDsi.exe
  C:\Windows\System\KNzvDsi.exe
  2⤵
  PID:12756
- C:\Windows\System\XpwctdH.exe
  C:\Windows\System\XpwctdH.exe
  2⤵
  PID:7400
- C:\Windows\System\vFMGnyA.exe
  C:\Windows\System\vFMGnyA.exe
  2⤵
  PID:2900
- C:\Windows\System\SkdxcjU.exe
  C:\Windows\System\SkdxcjU.exe
  2⤵
  PID:5232
- C:\Windows\System\OmrIFUq.exe
  C:\Windows\System\OmrIFUq.exe
  2⤵
  PID:7408
- C:\Windows\System\mGqnBPG.exe
  C:\Windows\System\mGqnBPG.exe
  2⤵
  PID:7040
- C:\Windows\System\lhjcWXn.exe
  C:\Windows\System\lhjcWXn.exe
  2⤵
  PID:5364
- C:\Windows\System\kTZTgrP.exe
  C:\Windows\System\kTZTgrP.exe
  2⤵
  PID:4724
- C:\Windows\System\MHiSASC.exe
  C:\Windows\System\MHiSASC.exe
  2⤵
  PID:3328
- C:\Windows\System\FqwdSpj.exe
  C:\Windows\System\FqwdSpj.exe
  2⤵
  PID:13564
- C:\Windows\System\nJVnPxq.exe
  C:\Windows\System\nJVnPxq.exe
  2⤵
  PID:5568
- C:\Windows\System\tVekIDc.exe
  C:\Windows\System\tVekIDc.exe
  2⤵
  PID:5380
- C:\Windows\System\NjEBcQg.exe
  C:\Windows\System\NjEBcQg.exe
  2⤵
  PID:916
- C:\Windows\System\bSDYyUp.exe
  C:\Windows\System\bSDYyUp.exe
  2⤵
  PID:6856
- C:\Windows\System\KUxKGTW.exe
  C:\Windows\System\KUxKGTW.exe
  2⤵
  PID:5996
- C:\Windows\System\pPvFYXJ.exe
  C:\Windows\System\pPvFYXJ.exe
  2⤵
  PID:13384
- C:\Windows\System\RPizMEq.exe
  C:\Windows\System\RPizMEq.exe
  2⤵
  PID:512
- C:\Windows\System\WdnGian.exe
  C:\Windows\System\WdnGian.exe
  2⤵
  PID:12700
- C:\Windows\System\WzFPEQA.exe
  C:\Windows\System\WzFPEQA.exe
  2⤵
  PID:7436
- C:\Windows\System\MRyufcd.exe
  C:\Windows\System\MRyufcd.exe
  2⤵
  PID:10556
- C:\Windows\System\fdlWrLB.exe
  C:\Windows\System\fdlWrLB.exe
  2⤵
  PID:13788
- C:\Windows\System\BmJAPwe.exe
  C:\Windows\System\BmJAPwe.exe
  2⤵
  PID:3784
- C:\Windows\System\lxFUHEm.exe
  C:\Windows\System\lxFUHEm.exe
  2⤵
  PID:2544
- C:\Windows\System\RJxOJYD.exe
  C:\Windows\System\RJxOJYD.exe
  2⤵
  PID:6968
- C:\Windows\System\DianATw.exe
  C:\Windows\System\DianATw.exe
  2⤵
  PID:3584
- C:\Windows\System\NAbIwPv.exe
  C:\Windows\System\NAbIwPv.exe
  2⤵
  PID:4616
- C:\Windows\System\JstGdKH.exe
  C:\Windows\System\JstGdKH.exe
  2⤵
  PID:3332
- C:\Windows\System\axkEjQw.exe
  C:\Windows\System\axkEjQw.exe
  2⤵
  PID:7388
- C:\Windows\System\bgOpCGE.exe
  C:\Windows\System\bgOpCGE.exe
  2⤵
  PID:7788
- C:\Windows\System\dpUrkUB.exe
  C:\Windows\System\dpUrkUB.exe
  2⤵
  PID:3304
- C:\Windows\System\TIMTzdl.exe
  C:\Windows\System\TIMTzdl.exe
  2⤵
  PID:7924
- C:\Windows\System\grBDjQm.exe
  C:\Windows\System\grBDjQm.exe
  2⤵
  PID:6380
- C:\Windows\System\lJjzyGW.exe
  C:\Windows\System\lJjzyGW.exe
  2⤵
  PID:7648
- C:\Windows\System\aqJgPKn.exe
  C:\Windows\System\aqJgPKn.exe
  2⤵
  PID:7724
- C:\Windows\System\acSgfxN.exe
  C:\Windows\System\acSgfxN.exe
  2⤵
  PID:3716
- C:\Windows\System\eittlsT.exe
  C:\Windows\System\eittlsT.exe
  2⤵
  PID:7592
- C:\Windows\System\KUlppsD.exe
  C:\Windows\System\KUlppsD.exe
  2⤵
  PID:7484
- C:\Windows\System\CTaxesI.exe
  C:\Windows\System\CTaxesI.exe
  2⤵
  PID:7748
- C:\Windows\System\dxHUnUx.exe
  C:\Windows\System\dxHUnUx.exe
  2⤵
  PID:7936
- C:\Windows\System\lggZUSJ.exe
  C:\Windows\System\lggZUSJ.exe
  2⤵
  PID:7948
- C:\Windows\System\fCSPUpt.exe
  C:\Windows\System\fCSPUpt.exe
  2⤵
  PID:8000
- C:\Windows\System\DWNThXU.exe
  C:\Windows\System\DWNThXU.exe
  2⤵
  PID:7960
- C:\Windows\System\XOhyDzs.exe
  C:\Windows\System\XOhyDzs.exe
  2⤵
  PID:7760
- C:\Windows\System\ZrXpbGV.exe
  C:\Windows\System\ZrXpbGV.exe
  2⤵
  PID:13772
- C:\Windows\System\jGGBGwk.exe
  C:\Windows\System\jGGBGwk.exe
  2⤵
  PID:7348
- C:\Windows\System\GdBptkW.exe
  C:\Windows\System\GdBptkW.exe
  2⤵
  PID:6496
- C:\Windows\System\MeDKYXi.exe
  C:\Windows\System\MeDKYXi.exe
  2⤵
  PID:14344
- C:\Windows\System\JlKXzLV.exe
  C:\Windows\System\JlKXzLV.exe
  2⤵
  PID:14360
- C:\Windows\System\JsSdhRh.exe
  C:\Windows\System\JsSdhRh.exe
  2⤵
  PID:14568
- C:\Windows\System\XJOyejB.exe
  C:\Windows\System\XJOyejB.exe
  2⤵
  PID:14768
- C:\Windows\System\tEabDQT.exe
  C:\Windows\System\tEabDQT.exe
  2⤵
  PID:14788
- C:\Windows\System\gxhNFbH.exe
  C:\Windows\System\gxhNFbH.exe
  2⤵
  PID:14812
- C:\Windows\System\norexPL.exe
  C:\Windows\System\norexPL.exe
  2⤵
  PID:14844
- C:\Windows\System\bahlBJr.exe
  C:\Windows\System\bahlBJr.exe
  2⤵
  PID:14892
- C:\Windows\System\VHPnqCZ.exe
  C:\Windows\System\VHPnqCZ.exe
  2⤵
  PID:14920
- C:\Windows\System\xLviYYU.exe
  C:\Windows\System\xLviYYU.exe
  2⤵
  PID:14936
- C:\Windows\System\iVuCsaC.exe
  C:\Windows\System\iVuCsaC.exe
  2⤵
  PID:14964
- C:\Windows\System\KcIvKha.exe
  C:\Windows\System\KcIvKha.exe
  2⤵
  PID:14980
- C:\Windows\System\FercnoR.exe
  C:\Windows\System\FercnoR.exe
  2⤵
  PID:14996
- C:\Windows\System\codoRFS.exe
  C:\Windows\System\codoRFS.exe
  2⤵
  PID:15024
- C:\Windows\System\FAgvVEK.exe
  C:\Windows\System\FAgvVEK.exe
  2⤵
  PID:15056
- C:\Windows\System\jbZgglB.exe
  C:\Windows\System\jbZgglB.exe
  2⤵
  PID:15076
- C:\Windows\System\InhWlQG.exe
  C:\Windows\System\InhWlQG.exe
  2⤵
  PID:15100
- C:\Windows\System\wiTjAYP.exe
  C:\Windows\System\wiTjAYP.exe
  2⤵
  PID:15120
- C:\Windows\System\YRSOUkJ.exe
  C:\Windows\System\YRSOUkJ.exe
  2⤵
  PID:15156
- C:\Windows\System\fDoCxdh.exe
  C:\Windows\System\fDoCxdh.exe
  2⤵
  PID:15184
- C:\Windows\System\KcekVLG.exe
  C:\Windows\System\KcekVLG.exe
  2⤵
  PID:15216
- C:\Windows\System\OdWVEKW.exe
  C:\Windows\System\OdWVEKW.exe
  2⤵
  PID:15240
- C:\Windows\System\jStGzRk.exe
  C:\Windows\System\jStGzRk.exe
  2⤵
  PID:15324
- C:\Windows\System\WDdCMpi.exe
  C:\Windows\System\WDdCMpi.exe
  2⤵
  PID:15352
- C:\Windows\System\ZUYzAEj.exe
  C:\Windows\System\ZUYzAEj.exe
  2⤵
  PID:7516
- C:\Windows\System\ApYcQbl.exe
  C:\Windows\System\ApYcQbl.exe
  2⤵
  PID:7912
- C:\Windows\System\nbTwEbB.exe
  C:\Windows\System\nbTwEbB.exe
  2⤵
  PID:8312
- C:\Windows\System\dNdioUh.exe
  C:\Windows\System\dNdioUh.exe
  2⤵
  PID:8064
- C:\Windows\System\FAvxruE.exe
  C:\Windows\System\FAvxruE.exe
  2⤵
  PID:14500
- C:\Windows\System\axLrXUL.exe
  C:\Windows\System\axLrXUL.exe
  2⤵
  PID:7220
- C:\Windows\System\IjDsCDD.exe
  C:\Windows\System\IjDsCDD.exe
  2⤵
  PID:14440
- C:\Windows\System\mGTuSmn.exe
  C:\Windows\System\mGTuSmn.exe
  2⤵
  PID:8152
- C:\Windows\System\iHXNjPV.exe
  C:\Windows\System\iHXNjPV.exe
  2⤵
  PID:14376
- C:\Windows\System\zVQGrGj.exe
  C:\Windows\System\zVQGrGj.exe
  2⤵
  PID:14540
- C:\Windows\System\HTGFEVn.exe
  C:\Windows\System\HTGFEVn.exe
  2⤵
  PID:14428
- C:\Windows\System\QwfvpLA.exe
  C:\Windows\System\QwfvpLA.exe
  2⤵
  PID:14464
- C:\Windows\System\uppUDcP.exe
  C:\Windows\System\uppUDcP.exe
  2⤵
  PID:14480
- C:\Windows\System\teGmpDX.exe
  C:\Windows\System\teGmpDX.exe
  2⤵
  PID:14680
- C:\Windows\System\FyZfwKX.exe
  C:\Windows\System\FyZfwKX.exe
  2⤵
  PID:14524
- C:\Windows\System\DVZikBr.exe
  C:\Windows\System\DVZikBr.exe
  2⤵
  PID:6292
- C:\Windows\System\YXnjHMW.exe
  C:\Windows\System\YXnjHMW.exe
  2⤵
  PID:14700
- C:\Windows\System\sNFAlCc.exe
  C:\Windows\System\sNFAlCc.exe
  2⤵
  PID:7584
- C:\Windows\System\OZPdsmk.exe
  C:\Windows\System\OZPdsmk.exe
  2⤵
  PID:14704
- C:\Windows\System\Vhfzwfj.exe
  C:\Windows\System\Vhfzwfj.exe
  2⤵
  PID:6844
- C:\Windows\System\pFKXFRD.exe
  C:\Windows\System\pFKXFRD.exe
  2⤵
  PID:14652
- C:\Windows\System\SnTQssX.exe
  C:\Windows\System\SnTQssX.exe
  2⤵
  PID:7280
- C:\Windows\System\qAeORBt.exe
  C:\Windows\System\qAeORBt.exe
  2⤵
  PID:7288
- C:\Windows\System\ZdXefDB.exe
  C:\Windows\System\ZdXefDB.exe
  2⤵
  PID:8216
- C:\Windows\System\jTEbPmr.exe
  C:\Windows\System\jTEbPmr.exe
  2⤵
  PID:8504
- C:\Windows\System\xeRPvAH.exe
  C:\Windows\System\xeRPvAH.exe
  2⤵
  PID:10092
- C:\Windows\System\BWcQsVq.exe
  C:\Windows\System\BWcQsVq.exe
  2⤵
  PID:14584
- C:\Windows\System\yPtyifx.exe
  C:\Windows\System\yPtyifx.exe
  2⤵
  PID:14448
- C:\Windows\System\YkMMMOe.exe
  C:\Windows\System\YkMMMOe.exe
  2⤵
  PID:8936
- C:\Windows\System\WCCztlW.exe
  C:\Windows\System\WCCztlW.exe
  2⤵
  PID:14496
- C:\Windows\System\SrhuMvg.exe
  C:\Windows\System\SrhuMvg.exe
  2⤵
  PID:8928
- C:\Windows\System\vhskHcB.exe
  C:\Windows\System\vhskHcB.exe
  2⤵
  PID:11208
- C:\Windows\System\AcKcoHa.exe
  C:\Windows\System\AcKcoHa.exe
  2⤵
  PID:14592
- C:\Windows\System\LsWZSoB.exe
  C:\Windows\System\LsWZSoB.exe
  2⤵
  PID:9244
- C:\Windows\System\rAkaiAM.exe
  C:\Windows\System\rAkaiAM.exe
  2⤵
  PID:9124
- C:\Windows\System\tOMvEHT.exe
  C:\Windows\System\tOMvEHT.exe
  2⤵
  PID:14860
- C:\Windows\System\ODLGGiu.exe
  C:\Windows\System\ODLGGiu.exe
  2⤵
  PID:14408
- C:\Windows\System\bwxYyFf.exe
  C:\Windows\System\bwxYyFf.exe
  2⤵
  PID:14888
- C:\Windows\System\MofcQMN.exe
  C:\Windows\System\MofcQMN.exe
  2⤵
  PID:7140
- C:\Windows\System\UFaDFQI.exe
  C:\Windows\System\UFaDFQI.exe
  2⤵
  PID:9192
- C:\Windows\System\xeUnqMG.exe
  C:\Windows\System\xeUnqMG.exe
  2⤵
  PID:7016
- C:\Windows\System\MkYYQjk.exe
  C:\Windows\System\MkYYQjk.exe
  2⤵
  PID:9248
- C:\Windows\System\AnpSpTU.exe
  C:\Windows\System\AnpSpTU.exe
  2⤵
  PID:11988
- C:\Windows\System\DbFcFeG.exe
  C:\Windows\System\DbFcFeG.exe
  2⤵
  PID:14560
- C:\Windows\System\jxsVRxF.exe
  C:\Windows\System\jxsVRxF.exe
  2⤵
  PID:14688
- C:\Windows\System\YmIrmMF.exe
  C:\Windows\System\YmIrmMF.exe
  2⤵
  PID:9148
- C:\Windows\System\fMHzgIR.exe
  C:\Windows\System\fMHzgIR.exe
  2⤵
  PID:9364
- C:\Windows\System\cGaCawv.exe
  C:\Windows\System\cGaCawv.exe
  2⤵
  PID:15236
- C:\Windows\System\TMkMWrb.exe
  C:\Windows\System\TMkMWrb.exe
  2⤵
  PID:15072
- C:\Windows\System\GrUtPnz.exe
  C:\Windows\System\GrUtPnz.exe
  2⤵
  PID:3772
- C:\Windows\System\cNpJDRE.exe
  C:\Windows\System\cNpJDRE.exe
  2⤵
  PID:9912
- C:\Windows\System\URXQuTH.exe
  C:\Windows\System\URXQuTH.exe
  2⤵
  PID:9092
- C:\Windows\System\PVIFcDo.exe
  C:\Windows\System\PVIFcDo.exe
  2⤵
  PID:15144
- C:\Windows\System\dxXoZvd.exe
  C:\Windows\System\dxXoZvd.exe
  2⤵
  PID:8256
- C:\Windows\System\KpEVHQS.exe
  C:\Windows\System\KpEVHQS.exe
  2⤵
  PID:9732
- C:\Windows\System\xwccuEj.exe
  C:\Windows\System\xwccuEj.exe
  2⤵
  PID:10168
- C:\Windows\System\cZAXhxg.exe
  C:\Windows\System\cZAXhxg.exe
  2⤵
  PID:9772
- C:\Windows\System\dCVVCVP.exe
  C:\Windows\System\dCVVCVP.exe
  2⤵
  PID:3180
- C:\Windows\System\hcSPUNg.exe
  C:\Windows\System\hcSPUNg.exe
  2⤵
  PID:15208
- C:\Windows\System\RHttRqv.exe
  C:\Windows\System\RHttRqv.exe
  2⤵
  PID:9320
- C:\Windows\System\qCESHwu.exe
  C:\Windows\System\qCESHwu.exe
  2⤵
  PID:14476
- C:\Windows\System\hwdYnzc.exe
  C:\Windows\System\hwdYnzc.exe
  2⤵
  PID:10132
- C:\Windows\System\JMiAPxL.exe
  C:\Windows\System\JMiAPxL.exe
  2⤵
  PID:10232
- C:\Windows\System\PSfcvmT.exe
  C:\Windows\System\PSfcvmT.exe
  2⤵
  PID:6748
- C:\Windows\System\uWxJZmj.exe
  C:\Windows\System\uWxJZmj.exe
  2⤵
  PID:15336
- C:\Windows\System\ATrCfhR.exe
  C:\Windows\System\ATrCfhR.exe
  2⤵
  PID:5692
- C:\Windows\System\UWBWbPX.exe
  C:\Windows\System\UWBWbPX.exe
  2⤵
  PID:6584
- C:\Windows\System\ESQlBmE.exe
  C:\Windows\System\ESQlBmE.exe
  2⤵
  PID:5544
- C:\Windows\System\cDsowLk.exe
  C:\Windows\System\cDsowLk.exe
  2⤵
  PID:8260
- C:\Windows\System\WSdLytY.exe
  C:\Windows\System\WSdLytY.exe
  2⤵
  PID:10744
- C:\Windows\System\UTeXTMP.exe
  C:\Windows\System\UTeXTMP.exe
  2⤵
  PID:5992
- C:\Windows\System\WxFGkTL.exe
  C:\Windows\System\WxFGkTL.exe
  2⤵
  PID:8096
- C:\Windows\System\puCoHcE.exe
  C:\Windows\System\puCoHcE.exe
  2⤵
  PID:14900
- C:\Windows\System\onIfvxy.exe
  C:\Windows\System\onIfvxy.exe
  2⤵
  PID:7572
- C:\Windows\System\ObDSymA.exe
  C:\Windows\System\ObDSymA.exe
  2⤵
  PID:5976
- C:\Windows\System\opWEpyW.exe
  C:\Windows\System\opWEpyW.exe
  2⤵
  PID:8888
- C:\Windows\System\oeMvhNW.exe
  C:\Windows\System\oeMvhNW.exe
  2⤵
  PID:10316
- C:\Windows\System\OuBVyeK.exe
  C:\Windows\System\OuBVyeK.exe
  2⤵
  PID:10368
- C:\Windows\System\bfloves.exe
  C:\Windows\System\bfloves.exe
  2⤵
  PID:10272
- C:\Windows\System\xWSVRUn.exe
  C:\Windows\System\xWSVRUn.exe
  2⤵
  PID:5732
- C:\Windows\System\QpNHVjz.exe
  C:\Windows\System\QpNHVjz.exe
  2⤵
  PID:10280
- C:\Windows\System\BzoDcLq.exe
  C:\Windows\System\BzoDcLq.exe
  2⤵
  PID:9360
- C:\Windows\System\cqsPsVf.exe
  C:\Windows\System\cqsPsVf.exe
  2⤵
  PID:10448
- C:\Windows\System\SqKXSBf.exe
  C:\Windows\System\SqKXSBf.exe
  2⤵
  PID:4784
- C:\Windows\System\CuWnmTo.exe
  C:\Windows\System\CuWnmTo.exe
  2⤵
  PID:8352
- C:\Windows\System\oDxdTue.exe
  C:\Windows\System\oDxdTue.exe
  2⤵
  PID:11556
- C:\Windows\System\rottvjA.exe
  C:\Windows\System\rottvjA.exe
  2⤵
  PID:14484
- C:\Windows\System\IBnlbPM.exe
  C:\Windows\System\IBnlbPM.exe
  2⤵
  PID:10252
- C:\Windows\System\DmXjnEs.exe
  C:\Windows\System\DmXjnEs.exe
  2⤵
  PID:10204
- C:\Windows\System\lnZWUzy.exe
  C:\Windows\System\lnZWUzy.exe
  2⤵
  PID:8008
- C:\Windows\System\SzCSDyr.exe
  C:\Windows\System\SzCSDyr.exe
  2⤵
  PID:15052
- C:\Windows\System\vLmeVSw.exe
  C:\Windows\System\vLmeVSw.exe
  2⤵
  PID:11524
- C:\Windows\System\xPXQUVM.exe
  C:\Windows\System\xPXQUVM.exe
  2⤵
  PID:6212
- C:\Windows\System\UweCvJO.exe
  C:\Windows\System\UweCvJO.exe
  2⤵
  PID:9068
- C:\Windows\System\LvrQfUi.exe
  C:\Windows\System\LvrQfUi.exe
  2⤵
  PID:5272
- C:\Windows\System\HtryELZ.exe
  C:\Windows\System\HtryELZ.exe
  2⤵
  PID:9692
- C:\Windows\System\RibdELR.exe
  C:\Windows\System\RibdELR.exe
  2⤵
  PID:7656
- C:\Windows\System\BEuCZdM.exe
  C:\Windows\System\BEuCZdM.exe
  2⤵
  PID:5912
- C:\Windows\System\JkRudRA.exe
  C:\Windows\System\JkRudRA.exe
  2⤵
  PID:4184
- C:\Windows\System\ZkxnXLs.exe
  C:\Windows\System\ZkxnXLs.exe
  2⤵
  PID:14856
- C:\Windows\System\CaShgnJ.exe
  C:\Windows\System\CaShgnJ.exe
  2⤵
  PID:13828
- C:\Windows\System\FKnIFsf.exe
  C:\Windows\System\FKnIFsf.exe
  2⤵
  PID:11184
- C:\Windows\System\HoDiskK.exe
  C:\Windows\System\HoDiskK.exe
  2⤵
  PID:11144
- C:\Windows\System\UfknGrm.exe
  C:\Windows\System\UfknGrm.exe
  2⤵
  PID:10056
- C:\Windows\System\xKSHxFS.exe
  C:\Windows\System\xKSHxFS.exe
  2⤵
  PID:7180
- C:\Windows\System\cOdHtch.exe
  C:\Windows\System\cOdHtch.exe
  2⤵
  PID:10116
- C:\Windows\System\nPXkwrc.exe
  C:\Windows\System\nPXkwrc.exe
  2⤵
  PID:12320
- C:\Windows\System\JeuMJow.exe
  C:\Windows\System\JeuMJow.exe
  2⤵
  PID:11604
- C:\Windows\System\PNQIyfz.exe
  C:\Windows\System\PNQIyfz.exe
  2⤵
  PID:7772
- C:\Windows\System\idyybWu.exe
  C:\Windows\System\idyybWu.exe
  2⤵
  PID:12412
- C:\Windows\System\zhStIbn.exe
  C:\Windows\System\zhStIbn.exe
  2⤵
  PID:12424
- C:\Windows\System\yCNqoUK.exe
  C:\Windows\System\yCNqoUK.exe
  2⤵
  PID:10652
- C:\Windows\System\kGsrBgO.exe
  C:\Windows\System\kGsrBgO.exe
  2⤵
  PID:12472
- C:\Windows\System\pTbTRzz.exe
  C:\Windows\System\pTbTRzz.exe
  2⤵
  PID:14944
- C:\Windows\System\swqGzqf.exe
  C:\Windows\System\swqGzqf.exe
  2⤵
  PID:11340
- C:\Windows\System\wRnbIlx.exe
  C:\Windows\System\wRnbIlx.exe
  2⤵
  PID:10736
- C:\Windows\System\yubqHLe.exe
  C:\Windows\System\yubqHLe.exe
  2⤵
  PID:11292
- C:\Windows\System\xGpwzRf.exe
  C:\Windows\System\xGpwzRf.exe
  2⤵
  PID:9568
- C:\Windows\System\aUSTzbo.exe
  C:\Windows\System\aUSTzbo.exe
  2⤵
  PID:5764
- C:\Windows\System\LCxxDwe.exe
  C:\Windows\System\LCxxDwe.exe
  2⤵
  PID:11448
- C:\Windows\System\HGfUxCf.exe
  C:\Windows\System\HGfUxCf.exe
  2⤵
  PID:14444
- C:\Windows\System\LlSJend.exe
  C:\Windows\System\LlSJend.exe
  2⤵
  PID:9832
- C:\Windows\System\gdazFqf.exe
  C:\Windows\System\gdazFqf.exe
  2⤵
  PID:12012
- C:\Windows\System\nvYPPeB.exe
  C:\Windows\System\nvYPPeB.exe
  2⤵
  PID:9972
- C:\Windows\System\sLkWwOP.exe
  C:\Windows\System\sLkWwOP.exe
  2⤵
  PID:15260
- C:\Windows\System\KfpzJhl.exe
  C:\Windows\System\KfpzJhl.exe
  2⤵
  PID:11536
- C:\Windows\System\fyJwTpr.exe
  C:\Windows\System\fyJwTpr.exe
  2⤵
  PID:9612
- C:\Windows\System\lmhFAqw.exe
  C:\Windows\System\lmhFAqw.exe
  2⤵
  PID:8704
- C:\Windows\System\Zzookix.exe
  C:\Windows\System\Zzookix.exe
  2⤵
  PID:12032
- C:\Windows\System\lQLayvz.exe
  C:\Windows\System\lQLayvz.exe
  2⤵
  PID:9468
- C:\Windows\System\JLtCPbg.exe
  C:\Windows\System\JLtCPbg.exe
  2⤵
  PID:10220
- C:\Windows\System\QeKQYAS.exe
  C:\Windows\System\QeKQYAS.exe
  2⤵
  PID:11048
- C:\Windows\System\MDJVyKX.exe
  C:\Windows\System\MDJVyKX.exe
  2⤵
  PID:10268
- C:\Windows\System\yrdlnJX.exe
  C:\Windows\System\yrdlnJX.exe
  2⤵
  PID:14880
- C:\Windows\System\CbNFTtI.exe
  C:\Windows\System\CbNFTtI.exe
  2⤵
  PID:10380
- C:\Windows\System\jSkTSuL.exe
  C:\Windows\System\jSkTSuL.exe
  2⤵
  PID:10692
- C:\Windows\System\JIkgiPV.exe
  C:\Windows\System\JIkgiPV.exe
  2⤵
  PID:14396
- C:\Windows\System\NwSbBOF.exe
  C:\Windows\System\NwSbBOF.exe
  2⤵
  PID:13088
- C:\Windows\System\zvguXDO.exe
  C:\Windows\System\zvguXDO.exe
  2⤵
  PID:6876
- C:\Windows\System\wzRiQwf.exe
  C:\Windows\System\wzRiQwf.exe
  2⤵
  PID:8484
- C:\Windows\System\NGJIAyT.exe
  C:\Windows\System\NGJIAyT.exe
  2⤵
  PID:13308
- C:\Windows\System\sTsXkmB.exe
  C:\Windows\System\sTsXkmB.exe
  2⤵
  PID:11492
- C:\Windows\System\IOirtEY.exe
  C:\Windows\System\IOirtEY.exe
  2⤵
  PID:10392
- C:\Windows\System\VfAhqZz.exe
  C:\Windows\System\VfAhqZz.exe
  2⤵
  PID:15128
- C:\Windows\System\qjTMiZx.exe
  C:\Windows\System\qjTMiZx.exe
  2⤵
  PID:10372
- C:\Windows\System\GKikJkx.exe
  C:\Windows\System\GKikJkx.exe
  2⤵
  PID:13068
- C:\Windows\System\UzuoMNr.exe
  C:\Windows\System\UzuoMNr.exe
  2⤵
  PID:14916
- C:\Windows\System\iMTVUGn.exe
  C:\Windows\System\iMTVUGn.exe
  2⤵
  PID:11256
- C:\Windows\System\TywfdrO.exe
  C:\Windows\System\TywfdrO.exe
  2⤵
  PID:4276
- C:\Windows\System\GEtEtwU.exe
  C:\Windows\System\GEtEtwU.exe
  2⤵
  PID:10784
- C:\Windows\System\BzybWrp.exe
  C:\Windows\System\BzybWrp.exe
  2⤵
  PID:9824
- C:\Windows\System\mOGLZWS.exe
  C:\Windows\System\mOGLZWS.exe
  2⤵
  PID:9220
- C:\Windows\System\JgeIYMJ.exe
  C:\Windows\System\JgeIYMJ.exe
  2⤵
  PID:11072
- C:\Windows\System\fMzjaMf.exe
  C:\Windows\System\fMzjaMf.exe
  2⤵
  PID:11252
- C:\Windows\System\HExXXYx.exe
  C:\Windows\System\HExXXYx.exe
  2⤵
  PID:8532
- C:\Windows\System\rGuOaKh.exe
  C:\Windows\System\rGuOaKh.exe
  2⤵
  PID:8396
- C:\Windows\System\XuEBDDn.exe
  C:\Windows\System\XuEBDDn.exe
  2⤵
  PID:12120
- C:\Windows\System\RwOlaqB.exe
  C:\Windows\System\RwOlaqB.exe
  2⤵
  PID:11356
- C:\Windows\System\liwlhnE.exe
  C:\Windows\System\liwlhnE.exe
  2⤵
  PID:13852

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 600 -p 6324 -ip 6324
1⤵
PID:13104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_2ob5saqh.xph.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ob5saqh.xph.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ACHbotU.exe

Path C:\Windows\System\ACHbotU.exe
Size 1.7MB
SHA256 d6668a094ba0001f3971cf2b95bbf3eb9076d905d45791751481556d565a9c8c
MD5 ffc95f49298cbb87a2a3d7df8b29aa18
SHA1 b43959a82fcc6e593d7626058d9c54f8ac4913a3
SHA512 123890bce129f89da3750d5786cc05a35b613b687c1233393443774e1a2e624e40c732d9c9bfc348841e3c4a88faa8c8bd2a146b00475b50c1d484904e3cc269
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5Dv:NABs
MD5 SHA1 SHA512 SSDEEP

Submit Download

AFNCHQT.exe

Path C:\Windows\System\AFNCHQT.exe
Size 1.7MB
SHA256 e84c68588a02b65f6e9bb1f329d33c64bbcd8875086130b58b905001faec59db
MD5 e05d68689c458e2ad8e3865e91f464ef
SHA1 f0db246c1e087376f99afc2a2a6285374307c4ce
SHA512 89ed079f6010a9bbba5f9bff8107cd7690db5525869485ed1bf58e740459bba473b9a2403319c38bac10261e3795484ef3343d311ce085bbf9f229542a22d96c
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5R:NABK
MD5 SHA1 SHA512 SSDEEP

Submit Download

AJXxEQs.exe

Path C:\Windows\System\AJXxEQs.exe
Size 1.7MB
SHA256 8781ba0f74bb18d882fe92958c66d13b31bde56dad3717269f4753d9720c2a16
MD5 a2dc0c175982e89a47071979df269094
SHA1 b1a2a6ee6d56e0fd887a1e8ec4e80a2dbf0c6848
SHA512 3841976193cc709068f1a8bcd64a00d76afd6873723cb2eb9281522c00d0cf9cb43a8db5b1a0a3c529ba2d9699cf2e938dac57039e517ffecfd9557a636cc59b
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5Y:NABV
MD5 SHA1 SHA512 SSDEEP

Submit Download

APQXHPD.exe

Path C:\Windows\System\APQXHPD.exe
Size 1.7MB
SHA256 6e28c58e48caf866761e307f55226cb3a98ae17b058e21c2d13e8aa64742bf11
MD5 b3adf05930339a2d05c747dc9ef26ced
SHA1 ba37f870c46a3eb4a8c48b70b38d28dd388a97af
SHA512 b29d0b8db27d3ddb9dd246accdf27f199a28b91ce431d6a3848144f4bbee024580cbaff1696dcde634bd8d68a1ecfb89c6db792417c1f0aee6beb5d3640977c2
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5n:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

BsmdBkK.exe

Path C:\Windows\System\BsmdBkK.exe
Size 1.7MB
SHA256 223b503ad0429abd98372e0a92bd892ce02a3a5591cc543c956a56f6163f2ac0
MD5 8433c761fb51dfbee78ec98311ba244b
SHA1 a323eb1dea16d1aaab264c755adc73424cdb75a6
SHA512 e42cff38fbbbfc1008e1bb2ba3b4e7f2a7c8243d6a9c6673a4bd640de92e2a82a9bf2c47726ce8f74c870fe0ab4eccce28dff8dc6074d051ff38db2a49a42105
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5w:NABn
MD5 SHA1 SHA512 SSDEEP

Submit Download

EKmoWyd.exe

Path C:\Windows\System\EKmoWyd.exe
Size 1.7MB
SHA256 dddf7f4c1e3ef22990d4d2ae7237845f7056e8628f346e39f4f1a855757584b2
MD5 006d0c3a8c5b344fa7adf75061482843
SHA1 5beaa6fb5f4a7ff7e5ae0a7ec32ef7cafc07141a
SHA512 6f44803b10e7599ae139a2072614c485f2106aefce09bcb55429516290f8c9351816a552938ff69292d6cb084737ffc639989bb8eabe6263344008f1a09b4d42
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5p:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

GNgBTZN.exe

Path C:\Windows\System\GNgBTZN.exe
Size 1.7MB
SHA256 f429be2dc39621302df0528b5e968e88d707c7615944d83495217e818c8062ca
MD5 9011ca2190b6dd9990f9b781cf14baa1
SHA1 0cc52b6c59b33ef9a92e5681b56589ee5d37cf98
SHA512 748622774a6ba4ff6f8d899bf95bc0d3a66f157a85f30d4ab1384a8ac6a7c450d7eb5920fd8da7c4cfcfd93460bf1c4eae2882b9d4a7db4901a045844f7ec0b3
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo56:NABX
MD5 SHA1 SHA512 SSDEEP

Submit Download

GRfFeMZ.exe

Path C:\Windows\System\GRfFeMZ.exe
Size 1.7MB
SHA256 870ce5361c822852727a81597c10a1bef12f2bd2940273c5928516d4729f0db1
MD5 2b4a15d3d08753057214b803522f456f
SHA1 b18c4fed5b2e1ecefe89067979f6beda63a98a20
SHA512 a1c6df8bcfaa1be11535cd4c3b8edf355235a00f9baedd34d73798b40b4b73872ebbffc91762d9a73a5ffbec68202290e53ec88c4dc9b0fedb1d3fe04be963ba
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5a:NABX
MD5 SHA1 SHA512 SSDEEP

Submit Download

GedwFyt.exe

Path C:\Windows\System\GedwFyt.exe
Size 1.7MB
SHA256 1b31e0ecce4f907c183cfff0681f6fa4e643d6b9b5a9ed8fb25fd6711287ace7
MD5 342920482413bf9463fedaa8ae374216
SHA1 a66a88a46949526b54a43862eedf134fae97ceee
SHA512 ef3b955a226cb69b01527468bd667140586824358b613b000899aa65f3dc93f3a57313c4a819cc8c78a7175bcf5c8928c748e61daf5574cd7a9b9eb53f0e5001
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5z:NABI
MD5 SHA1 SHA512 SSDEEP

Submit Download

IuVUgFe.exe

Path C:\Windows\System\IuVUgFe.exe
Size 1.7MB
SHA256 0e194242d5dbc6d3c761ace708a9c1ee82a704e1bb7e6f17eb85f54c00009577
MD5 0883451caf259d67af969237a3ed5eae
SHA1 f78b4aad7465500ac80e0449484b9c22fdc2e38e
SHA512 ce7757ac94c6563a36dea7b93263e2b4f191cb461c97355873893f9f47d3006969b7737f81604f3c202e8615fafbce9faf79bd822c8aaaa0608f7115d53c8c16
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5L:NABK
MD5 SHA1 SHA512 SSDEEP

Submit Download

MfPezyp.exe

Path C:\Windows\System\MfPezyp.exe
Size 1.7MB
SHA256 8ed97aeceade384a0c5102035b54b513f44610f177eac4cc1635fab7bcd78730
MD5 5e45357524fbc48b296bce05bf6ecaf0
SHA1 313095e5b05572496e488b1b9e2d337530536809
SHA512 ab30db16200d02c1c6f1e19ca2f703e1bf8695e6eea6dae7d82c3c6f30d2475cee856b1e846173c5961053f7254674f5a326141baf3cfc2d8076af8e95bf463c
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5h:NABm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OAlTaoU.exe

Path C:\Windows\System\OAlTaoU.exe
Size 18B
SHA256 f8c5117cf04ef6c3849f578ba883acb00d6fab25d894c2f07a4938751d03a1f5
MD5 c2973223ab0ccf86540a7cb26f742af1
SHA1 e8bae7ab9e5c02bd86213b809eaea0d5c0e6761d
SHA512 1977a975fcb82b5509f77849d2d035d94f85900a291b5657381fc2141a1b865cdf93b4028b32b3aaa06290592d2975a998d0cd8db14d2181f3f24fc21f632072
MD5 SHA1 SHA512

Submit Download

TMgZzbQ.exe

Path C:\Windows\System\TMgZzbQ.exe
Size 1.7MB
SHA256 7bf14d68bb0f048815d7d766e5174ee14e05be4482b1fc97cb21a5e5a089430b
MD5 c63865fc7e7b75f04271985e51eff7f2
SHA1 7d4498981c74a0bcee3b44e0ca80264be02fd782
SHA512 4b58e6d80bbb95125216b739e0ec0b3337742c3b371ba0b4147492da1aeffd20b6c8777683f2834d87cb7f716691061e7bc468ceac5b476d9ea8367f5acab866
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5R:NAB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

VLMHNQl.exe

Path C:\Windows\System\VLMHNQl.exe
Size 1.7MB
SHA256 78508cbd77f4c99c22f1574a7996458eb6ce77cfeda5fb7e9a1956ba9b2afed8
MD5 cdff9cdaf62c42dd949e2acaa61c0a5d
SHA1 97341ff949f98d380125f28c1a96331e413e93c2
SHA512 a394951c6941af13c6650de2e69badede5915c1829ac081498c6d2807508f22825cfec082b2260fd9b852bf24b0b1a562eb11bdd70cd096dec0d291e1d72dcc1
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5S:NAB/
MD5 SHA1 SHA512 SSDEEP

Submit Download

WHbQupB.exe

Path C:\Windows\System\WHbQupB.exe
Size 1.7MB
SHA256 9e6371d239595ca3cd49b8f4f444606bb5b52a9013b38e4c2ef8f43f538ba51d
MD5 95f83c886ed57ef8a8d4629f1ee9283d
SHA1 9a620bd044d48aac541834cbe8ee8c5e83e4bb79
SHA512 fb5173429a3afc5dbb87945e100e68d1b2d3f17715ccfa15f10e50c642b6212ef553774d1ec8b1d3ddc8c183cdcbcde7f4d38f447f54c638c15df5863a9c3701
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo50:NABl
MD5 SHA1 SHA512 SSDEEP

Submit Download

WyiSVVr.exe

Path C:\Windows\System\WyiSVVr.exe
Size 1.7MB
SHA256 8a27e55abd06defc8286bb4c5ee9152aa3014ad5c5ba8ee5de19230e00f98d1c
MD5 5923cb5337da493ae7d021ef84051394
SHA1 94ab009a47f438a46c82ab75163dc871ae3cf29c
SHA512 e23012a83fe65337309a95b0e198d2963d1b1f46898dac53e373275b6556d03a4b2a488e610eb50c1bba7c488f1ee41fefc2919f70177f23820229f183d1441d
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo57:NAB8
MD5 SHA1 SHA512 SSDEEP

Submit Download

bJXPepG.exe

Path C:\Windows\System\bJXPepG.exe
Size 1.7MB
SHA256 3634fa3b6231b9852ccc49f7fcb1e894db680aaff336029137c9182c3b4e904e
MD5 09dd15a448b60f227f0a2890eb30a6b5
SHA1 38106df84375ec734dd2396af8731f898280afbd
SHA512 1e910022a85856ae647d90f16a1acaea794683df98bb3ea26cc8df5d48c2fb770827b4277bb39d3542c4c0433676436039fd42d841a9ee9c3b59b10a1f56cb52
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5F:NAB4
MD5 SHA1 SHA512 SSDEEP

Submit Download

bagcojU.exe

Path C:\Windows\System\bagcojU.exe
Size 1.7MB
SHA256 ef081c97f361008e26659c384a72c4a5b3a47610a41976247f3810c53ee18c1c
MD5 729681a7f04fbc690d9dff75c93b0cef
SHA1 815c33f25c81f10350634df8941e05042597b004
SHA512 899a4be94a2eaddcd6552aee322473ce9bc6428165214971cdec3ce567e8977b161e4959b8875927d3a9540c05a8532e7273807bf5937c78182dc4631ae4b0e2
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5k:NABT
MD5 SHA1 SHA512 SSDEEP

Submit Download

bcEIvmt.exe

Path C:\Windows\System\bcEIvmt.exe
Size 1.7MB
SHA256 1bd29b56b8a314c36820e832197d81011d0fe9290f2a815f14566f38c539eb59
MD5 7d5476fc86b5d8809b205f157c293ed7
SHA1 ffe2b5b6656ce59145e5b058bb5ae296a80f1920
SHA512 c4be7716fe002fa35a7fdfa7bb6004a3e70a1f46861508ffe939e8fc2b30c323c94b706754897b2b8e5cec73f666e58e46a1197ef35acb17d73fe8556cb4e3a5
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo55:NABc
MD5 SHA1 SHA512 SSDEEP

Submit Download

cDPhPVa.exe

Path C:\Windows\System\cDPhPVa.exe
Size 1.7MB
SHA256 9e2b8e4cc13ea6e3769be3fa91ccce0b89dedb4d2f4c0c7f92b74535b97c2e63
MD5 ad0062f5707e17c4004853d871c48cdb
SHA1 3e741a6b7f39a1d8d05dc532aacdac1106f05422
SHA512 25f51b7da0bed26387ffe77cf25c0f3c4392e9285af64abd0629c20b89d1cc9abd0955ee229319909d72936fe22f07fb8cb4daab87dc24351439fc3e0aa185f4
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5c:NAB1
MD5 SHA1 SHA512 SSDEEP

Submit Download

dHPVlyG.exe

Path C:\Windows\System\dHPVlyG.exe
Size 1.7MB
SHA256 8f59915c12be7d112b942a33f2914f68fda62f90d2da6ed79204ebb8dfb025c9
MD5 d19dcb651690b62f0931adf99d085680
SHA1 2ae1ec4d79e843b919e772aef02e80fb56a3b297
SHA512 ee8c970e05b9c37efa1a95de87f1dcce3543294f4573b0e7bc367ea10eaa2a541f9e050027ea0f87e11b501b8be426ed793bee9fde4dcc798bd2b8dfb6ede6e9
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5i:NABx
MD5 SHA1 SHA512 SSDEEP

Submit Download

exekBuk.exe

Path C:\Windows\System\exekBuk.exe
Size 1.7MB
SHA256 5051952adc5493be36c71822fb2bf912dfdde7fc374bb509c3ae2935f1c75873
MD5 f922ce2a9b5c704dda85265b65646c64
SHA1 af937f4d1ac41da5728221052a95283932708994
SHA512 dea77a77db17d3019be3ab80953f1393bfe7dd8bb21b40233ce9987779ac59cb279003e4a82631b37c048da25dbe6a26c83a92fc1a357edcc27a3aa03a4ee667
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5s:NAB9
MD5 SHA1 SHA512 SSDEEP

Submit Download

fHgJUgT.exe

Path C:\Windows\System\fHgJUgT.exe
Size 1.7MB
SHA256 afd4be74137735c51c103c10b01b4b8f14d7026c694926eb0f740efb0df340d3
MD5 bd0f5759861b78b4270f2cec1057ce6a
SHA1 4245413d9d0bd2bc8132852fb24f3beae7642b2a
SHA512 318dc99618b0e9e991668494bd63a9f3b3c60dd358ef47635b22b4b4e3eccf79414205a3d80f5d8431828efa77e5ffcc75b47f9133fc0e01e722943a44e9562f
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5T:NABo
MD5 SHA1 SHA512 SSDEEP

Submit Download

fIzLVAc.exe

Path C:\Windows\System\fIzLVAc.exe
Size 1.7MB
SHA256 fdf468d91ffdb61361ce09f544e5207168c8b26d50b9e63edaf2e77dcfe79915
MD5 71bec2b215579eb8437717f639623830
SHA1 8ada0455dccb219b84155a1954a6616fa0c96fb3
SHA512 d2011b8976119657d1a14d9d0e10b1381496c82e44cfbceb2ff31b2cd239eac6ceba6a76420942a72a929cc0eae01338619329faaee19f33e41d2b224fd49ce8
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5j:NABo
MD5 SHA1 SHA512 SSDEEP

Submit Download

fPAVapL.exe

Path C:\Windows\System\fPAVapL.exe
Size 1.7MB
SHA256 87ce191632ae1b44b88c1e9d0bf4eea70cf038039d72ecfe2ccc8fdb58330e54
MD5 934dcb9869b23278fe36d8f6658631fa
SHA1 105b02aeb11377bed827935730a5a6617e6e07c2
SHA512 6fc36fc448d0fd240f950fc77067ec5c7b7d078f69b124482de45904b9c8dd6cf5fdd00e25125d7c0c67751427abd0789ce1633df35959f586f351af890f22dd
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5b:NABq
MD5 SHA1 SHA512 SSDEEP

Submit Download

iOGLdLE.exe

Path C:\Windows\System\iOGLdLE.exe
Size 1.7MB
SHA256 0ded77fd08c8b7ba37c463ea620fbe6709d97724ba2f83774b3e7632527c2cde
MD5 4d5d831261dfaf187733f48c3b1e90eb
SHA1 f5a2c752308402bd42a4a3216c9b882a9418a04d
SHA512 1b2fd60a3981f725d9a4af961d41ac5fd04b38d08afaaba54689086f683dab7b5f9b87f7fa7fa2424a2d1765d18fa81637ce01ffd571609bef5e9f857bfca64f
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5m:NABP
MD5 SHA1 SHA512 SSDEEP

Submit Download

iZWclON.exe

Path C:\Windows\System\iZWclON.exe
Size 1.7MB
SHA256 a209b082aee6494cd31c84c612e6c9e4e206b8aa5175c008378983b408b0027a
MD5 c390d1bbb49a61e169c4193c7d0205bc
SHA1 a0726fe7b86edc131efaa5785f4aa45b9524b396
SHA512 a82731a734700b358ab7a47453b9d474b32a8741763c9c3160189fda15583ed3e697bdd799cdbad79acec18baa0a77bac22c426e8dc2e79750fd7aa69fd2825b
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5w:NABp
MD5 SHA1 SHA512 SSDEEP

Submit Download

lqSGvBB.exe

Path C:\Windows\System\lqSGvBB.exe
Size 1.7MB
SHA256 2404ecbd61c52642c3a289f7a9969c3c3b492257b50e14eb22abf96c95ae1b07
MD5 d8edd2e1a979dd6704b4aa67185cabce
SHA1 d15047954f3169b5d2b22132ee025b0a353cabd6
SHA512 98196b1a156bcaf7129e6eae0a6231861984f096c64d03bedceaa6006448503092e65b269d6bcc99f08d4e04f42d2b97ddb2d8f92186268e265f0b2d329c5383
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5j:NABe
MD5 SHA1 SHA512 SSDEEP

Submit Download

mMfvfXb.exe

Path C:\Windows\System\mMfvfXb.exe
Size 1.7MB
SHA256 da2e337fc72a8724999fd0caffdf31f3fbc13739ae91c664fb1e68a5fb0d2a0f
MD5 93f45641076e7aa3ee0901d8f51acc27
SHA1 71b9a519d67a7899a6c90af662853d8e3b9bb5b4
SHA512 9311c1cbe505643c40761a1e9a5d5be42e93a7a5ddfd1014e6c6a1d2b0aeb05638b44c0850ae2f300d84a5162989c436877aecea10750107b2dde3cb85effcdf
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5U:NAB/
MD5 SHA1 SHA512 SSDEEP

Submit Download

nlaqMIU.exe

Path C:\Windows\System\nlaqMIU.exe
Size 1.7MB
SHA256 feae16e065bb351726f65f8879ad2b085818ef27c11c7ef86a14fcb788a352ef
MD5 b245e18b52198df93ad04e6b37aaeb24
SHA1 e4291d84b7d9b4902ac3ce4ee3af55e55396e44a
SHA512 333cd573af0c2555a6c1d1c166accddd727352c8ee6996baff8a7e0e401325b17cc6799ecc5ad4148be9f9771c0ca0b94bb961a6d295350d912f2c8291c2bd81
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo53:NABW
MD5 SHA1 SHA512 SSDEEP

Submit Download

nvRXnkN.exe

Path C:\Windows\System\nvRXnkN.exe
Size 8B
SHA256 31ac44af890d5f8ef25c77d900addd0883942455928fb6a81946a9632dc88f2c
MD5 30f490ff6f09dabaea157ddc60f4ca75
SHA1 7a66b29904239df573a1b24ea58b8d14b51b76bc
SHA512 c04cac64c41108a53de7da78683f7369c8de23198f01c0efd984bbf01a15908d1b12c24281bf71220830c73671270e9a14e7ccbe6fd14f9a4e73930fa638e231
MD5 SHA1 SHA512

Submit Download

pevYJoE.exe

Path C:\Windows\System\pevYJoE.exe
Size 1.7MB
SHA256 18e24cc2c29db8977096e2478efc73a01ffeeab5f72ad6f494c957b8fffa5f27
MD5 7e9b20e8a4c098a51201f6b09fc636c0
SHA1 3caedf487fd6fb890801e30c35c92f4b61e39d62
SHA512 652c77fbd32fcee4295a1a7f5f781bb22c8189bc4a5241dfb041fe8b603b9e36c9c718262ff3382579b8c98279d2ae4240b0e2bbca128f68c07672fc255e1027
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5S:NABJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

qHmWYMh.exe

Path C:\Windows\System\qHmWYMh.exe
Size 1.7MB
SHA256 461794aba6981c93d4ad74145f8834181e98fdf73ec82442f00622a2d6c2a1df
MD5 800247a8e17ac6f757d8f0f724eace9b
SHA1 ada0b0ae4b0532d74ee9fc8e78b696a929b584cd
SHA512 59a978b5fec09df60d5e3f269780cd92972e2414531227479e028b6d3fec42312275edf6cdb4b8c986bbe99b5446e7a2533fe9722ed891fd2c385842b5a8002c
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo58:NABh
MD5 SHA1 SHA512 SSDEEP

Submit Download

vomvJJI.exe

Path C:\Windows\System\vomvJJI.exe
Size 1.7MB
SHA256 38b07c2c2c87692ca35f0b90f00916cfd1511f4ffd766d214755f1bb28a6b78a
MD5 4b991b7e1d3dce10cce807387e2ccf88
SHA1 e69688122f09d511bd477d31f08f57cce70d89bf
SHA512 0c0af82e229e21b48283f1ba8225eede712e4c389758bd2b5ec9d7c43c5cb0631a816a031161e70a1b8e736c92e4322e09308000cea1dafa8b4985fd55c72551
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo57:NABs
MD5 SHA1 SHA512 SSDEEP

Submit Download

vsScygL.exe

Path C:\Windows\System\vsScygL.exe
Size 1.7MB
SHA256 564f23de7a923b9650968507a931d63b57f0b3c82933a81039bf74b0a69929fa
MD5 1d5714e9d8f55c283f44bf5b09a18a20
SHA1 7e251d5201c634ad5046b14edc72609143c5b63f
SHA512 9280e11baa15928feada59948846dcf9988f8f36b2a3a6f71d207c8068fd2e40c0f8838f5e2c36e610ca0a84ddeffcd1b2081046d4bce24963c7a58e33554cd9
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5Y:NABP
MD5 SHA1 SHA512 SSDEEP

Submit Download

vwWmbSs.exe

Path C:\Windows\System\vwWmbSs.exe
Size 1.7MB
SHA256 44565667ac6721df79a2bcac8103714b9665925187523f0e79f70963a6777b36
MD5 c4b62e4f90a2217f960c35668d6401cc
SHA1 b9f8c41873dcc1721baa8615abc76e897186563c
SHA512 36bd8fc182840e23aad95df2a54daaa4ef3ccf35c3f1f904f5a7ac18a027293a019d93184382782eabf40dd9406ebe8abcaf812eae778ffdb7c9bd52e5957cd3
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5n:NABk
MD5 SHA1 SHA512 SSDEEP

Submit Download

xufnyJn.exe

Path C:\Windows\System\xufnyJn.exe
Size 1.7MB
SHA256 d632c568c3326b42b8fd4bc7aac8c4bc45ba5c92d1e79c0c5a65c2e15dedaa9f
MD5 c32709b21d1fe90c7094a8a47be16d37
SHA1 9a01bcef69a3e25125edc4d617825f9fedb8b9a9
SHA512 80865634d3c3bb1d4ef260111ccc5076541479e16f814c1a3663c52ce336ccce0782dd0d85d81ea06b111384f7181ddd5493564309a7f59ccc53893f311c799e
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5D:NABu
MD5 SHA1 SHA512 SSDEEP

Submit Download

zxWaTPP.exe

Path C:\Windows\System\zxWaTPP.exe
Size 1.7MB
SHA256 a5bd05ffdca3d706554f3073fe357ce1f11a8f856e06fb871d570dfd26193169
MD5 708189449e0a82f532690f34c65c94a0
SHA1 a4d99495a6a1191543a00e4f271130b196f7211b
SHA512 bd21ad7eafad173c38948cab4ead5a81084fdb53497a7601ea377ccbdb868be6bde0524e5fdfbfa691728049028771a7d9f74e233eba33093dc1987c9de40d3c
SSDEEP 49152:Lz071uv4BPMkHC0INx29L5KQ2uIbQHlo5c:NABD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/324-5330-0x00007FF6A2B90000-0x00007FF6A2F82000-memory.dmp

Download

memory/324-677-0x00007FF6A2B90000-0x00007FF6A2F82000-memory.dmp

Download

memory/432-566-0x00007FFA2B190000-0x00007FFA2BC51000-memory.dmp

Download

memory/432-34-0x00007FFA2B193000-0x00007FFA2B195000-memory.dmp

Download

memory/432-456-0x000001FD33B40000-0x000001FD33B62000-memory.dmp

Download

memory/432-134-0x00007FFA2B190000-0x00007FFA2BC51000-memory.dmp

Download

memory/640-33-0x00007FF7C9870000-0x00007FF7C9C62000-memory.dmp

Download

memory/760-669-0x00007FF6DF160000-0x00007FF6DF552000-memory.dmp

Download

memory/760-5321-0x00007FF6DF160000-0x00007FF6DF552000-memory.dmp

Download

memory/1532-667-0x00007FF662940000-0x00007FF662D32000-memory.dmp

Download

memory/1532-5376-0x00007FF662940000-0x00007FF662D32000-memory.dmp

Download

memory/1732-209-0x00007FF715820000-0x00007FF715C12000-memory.dmp

Download

memory/1732-5286-0x00007FF715820000-0x00007FF715C12000-memory.dmp

Download

memory/1772-674-0x00007FF69BF40000-0x00007FF69C332000-memory.dmp

Download

memory/1772-5422-0x00007FF69BF40000-0x00007FF69C332000-memory.dmp

Download

memory/1948-5362-0x00007FF7F2110000-0x00007FF7F2502000-memory.dmp

Download

memory/1948-675-0x00007FF7F2110000-0x00007FF7F2502000-memory.dmp

Download

memory/1960-664-0x00007FF6327D0000-0x00007FF632BC2000-memory.dmp

Download

memory/1960-5345-0x00007FF6327D0000-0x00007FF632BC2000-memory.dmp

Download

memory/1968-5350-0x00007FF69BDC0000-0x00007FF69C1B2000-memory.dmp

Download

memory/1968-666-0x00007FF69BDC0000-0x00007FF69C1B2000-memory.dmp

Download

memory/2576-662-0x00007FF7E2600000-0x00007FF7E29F2000-memory.dmp

Download

memory/2656-5373-0x00007FF774920000-0x00007FF774D12000-memory.dmp

Download

memory/2656-663-0x00007FF774920000-0x00007FF774D12000-memory.dmp

Download

memory/2972-5388-0x00007FF63FA30000-0x00007FF63FE22000-memory.dmp

Download

memory/2972-668-0x00007FF63FA30000-0x00007FF63FE22000-memory.dmp

Download

memory/3152-5357-0x00007FF6DDC00000-0x00007FF6DDFF2000-memory.dmp

Download

memory/3152-672-0x00007FF6DDC00000-0x00007FF6DDFF2000-memory.dmp

Download

memory/3244-673-0x00007FF6AE130000-0x00007FF6AE522000-memory.dmp

Download

memory/3244-5382-0x00007FF6AE130000-0x00007FF6AE522000-memory.dmp

Download

memory/3560-670-0x00007FF609400000-0x00007FF6097F2000-memory.dmp

Download

memory/3844-5348-0x00007FF621600000-0x00007FF6219F2000-memory.dmp

Download

memory/3844-665-0x00007FF621600000-0x00007FF6219F2000-memory.dmp

Download

memory/3928-374-0x00007FF6400D0000-0x00007FF6404C2000-memory.dmp

Download

memory/3928-5324-0x00007FF6400D0000-0x00007FF6404C2000-memory.dmp

Download

memory/4088-5278-0x00007FF70FEB0000-0x00007FF7102A2000-memory.dmp

Download

memory/4088-265-0x00007FF70FEB0000-0x00007FF7102A2000-memory.dmp

Download

memory/4104-5354-0x00007FF6E4F10000-0x00007FF6E5302000-memory.dmp

Download

memory/4104-678-0x00007FF6E4F10000-0x00007FF6E5302000-memory.dmp

Download

memory/4172-676-0x00007FF6B81E0000-0x00007FF6B85D2000-memory.dmp

Download

memory/4172-5434-0x00007FF6B81E0000-0x00007FF6B85D2000-memory.dmp

Download

memory/4204-0-0x00007FF6D17D0000-0x00007FF6D1BC2000-memory.dmp

Download

memory/4204-1-0x00000230D1ED0000-0x00000230D1EE0000-memory.dmp

Download

memory/4284-661-0x00007FF677FA0000-0x00007FF678392000-memory.dmp

Download

memory/4284-5326-0x00007FF677FA0000-0x00007FF678392000-memory.dmp

Download

memory/4496-219-0x00007FF79F720000-0x00007FF79FB12000-memory.dmp

Download

memory/4584-317-0x00007FF6DD9E0000-0x00007FF6DDDD2000-memory.dmp

Download

memory/4584-5297-0x00007FF6DD9E0000-0x00007FF6DDDD2000-memory.dmp

Download

memory/4772-5394-0x00007FF70CAA0000-0x00007FF70CE92000-memory.dmp

Download

memory/4772-671-0x00007FF70CAA0000-0x00007FF70CE92000-memory.dmp

Download