xmrig | 48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140

Analysis

max time kernel
93s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/07/2024, 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
Size

1.7MB
MD5

cd51ac11994955d30efaa0b23b66c3b0
SHA1

774e7cbf3982e897b9ddb7b17f43810fccaa590b
SHA256

48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140
SHA512

0e34183c2a712bcad17016a6a115e271373bfbb14e4d57aaf68e07ebb96c3bcca87d135467f5e0d67c1e649ae273407210046606cb62f65c77730efbfa1c5529
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgsU5qTqOkDilK3uPpHbcMfOoZ:Lz071uv4BPMkFfdg6NsOkc2h

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/4860-424-0x00007FF661FB0000-0x00007FF6623A2000-memory.dmp	xmrig
behavioral2/memory/1232-425-0x00007FF7D31F0000-0x00007FF7D35E2000-memory.dmp	xmrig
behavioral2/memory/3896-486-0x00007FF68EBB0000-0x00007FF68EFA2000-memory.dmp	xmrig
behavioral2/memory/2124-492-0x00007FF78D8B0000-0x00007FF78DCA2000-memory.dmp	xmrig
behavioral2/memory/1276-496-0x00007FF7C8D60000-0x00007FF7C9152000-memory.dmp	xmrig
behavioral2/memory/1072-590-0x00007FF68E0A0000-0x00007FF68E492000-memory.dmp	xmrig
behavioral2/memory/4728-565-0x00007FF628DA0000-0x00007FF629192000-memory.dmp	xmrig
behavioral2/memory/868-495-0x00007FF753220000-0x00007FF753612000-memory.dmp	xmrig
behavioral2/memory/3016-494-0x00007FF7DF5B0000-0x00007FF7DF9A2000-memory.dmp	xmrig
behavioral2/memory/4868-493-0x00007FF749220000-0x00007FF749612000-memory.dmp	xmrig
behavioral2/memory/1640-491-0x00007FF75D190000-0x00007FF75D582000-memory.dmp	xmrig
behavioral2/memory/1764-490-0x00007FF64F3D0000-0x00007FF64F7C2000-memory.dmp	xmrig
behavioral2/memory/768-488-0x00007FF783600000-0x00007FF7839F2000-memory.dmp	xmrig
behavioral2/memory/1328-476-0x00007FF6A33E0000-0x00007FF6A37D2000-memory.dmp	xmrig
behavioral2/memory/2996-401-0x00007FF6FF830000-0x00007FF6FFC22000-memory.dmp	xmrig
behavioral2/memory/2992-344-0x00007FF704190000-0x00007FF704582000-memory.dmp	xmrig
behavioral2/memory/4588-286-0x00007FF7354D0000-0x00007FF7358C2000-memory.dmp	xmrig
behavioral2/memory/3892-265-0x00007FF6C1660000-0x00007FF6C1A52000-memory.dmp	xmrig
behavioral2/memory/3364-216-0x00007FF7D20B0000-0x00007FF7D24A2000-memory.dmp	xmrig
behavioral2/memory/2940-186-0x00007FF73B260000-0x00007FF73B652000-memory.dmp	xmrig
behavioral2/memory/736-150-0x00007FF71F7E0000-0x00007FF71FBD2000-memory.dmp	xmrig
behavioral2/memory/1128-15-0x00007FF76B430000-0x00007FF76B822000-memory.dmp	xmrig
behavioral2/memory/1128-3228-0x00007FF76B430000-0x00007FF76B822000-memory.dmp	xmrig
behavioral2/memory/736-3230-0x00007FF71F7E0000-0x00007FF71FBD2000-memory.dmp	xmrig
behavioral2/memory/4728-3232-0x00007FF628DA0000-0x00007FF629192000-memory.dmp	xmrig
behavioral2/memory/3364-3234-0x00007FF7D20B0000-0x00007FF7D24A2000-memory.dmp	xmrig
behavioral2/memory/2992-3236-0x00007FF704190000-0x00007FF704582000-memory.dmp	xmrig
behavioral2/memory/4588-3283-0x00007FF7354D0000-0x00007FF7358C2000-memory.dmp	xmrig
behavioral2/memory/2940-3275-0x00007FF73B260000-0x00007FF73B652000-memory.dmp	xmrig
behavioral2/memory/1328-3303-0x00007FF6A33E0000-0x00007FF6A37D2000-memory.dmp	xmrig
behavioral2/memory/3016-3307-0x00007FF7DF5B0000-0x00007FF7DF9A2000-memory.dmp	xmrig
behavioral2/memory/2124-3305-0x00007FF78D8B0000-0x00007FF78DCA2000-memory.dmp	xmrig
behavioral2/memory/1200-3311-0x00007FF729A90000-0x00007FF729E82000-memory.dmp	xmrig
behavioral2/memory/1764-3313-0x00007FF64F3D0000-0x00007FF64F7C2000-memory.dmp	xmrig
behavioral2/memory/768-3309-0x00007FF783600000-0x00007FF7839F2000-memory.dmp	xmrig
behavioral2/memory/3892-3301-0x00007FF6C1660000-0x00007FF6C1A52000-memory.dmp	xmrig
behavioral2/memory/1232-3299-0x00007FF7D31F0000-0x00007FF7D35E2000-memory.dmp	xmrig
behavioral2/memory/2996-3297-0x00007FF6FF830000-0x00007FF6FFC22000-memory.dmp	xmrig
behavioral2/memory/4868-3320-0x00007FF749220000-0x00007FF749612000-memory.dmp	xmrig
behavioral2/memory/1276-3327-0x00007FF7C8D60000-0x00007FF7C9152000-memory.dmp	xmrig
behavioral2/memory/3896-3331-0x00007FF68EBB0000-0x00007FF68EFA2000-memory.dmp	xmrig
behavioral2/memory/1072-3330-0x00007FF68E0A0000-0x00007FF68E492000-memory.dmp	xmrig
behavioral2/memory/868-3325-0x00007FF753220000-0x00007FF753612000-memory.dmp	xmrig
behavioral2/memory/1640-3323-0x00007FF75D190000-0x00007FF75D582000-memory.dmp	xmrig
behavioral2/memory/3940-3318-0x00007FF67F4F0000-0x00007FF67F8E2000-memory.dmp	xmrig
behavioral2/memory/4860-3315-0x00007FF661FB0000-0x00007FF6623A2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1292	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1128	tKhjarr.exe
4728	xTGhTml.exe
736	OkBsXTN.exe
2940	iESoAye.exe
3364	OOpMREC.exe
3892	YgvnCOJ.exe
4588	eOekSGG.exe
2992	kMPkoXm.exe
2996	rJNArwR.exe
4860	JlPuOLu.exe
1232	NgeJtoV.exe
1328	BCOdpDH.exe
3896	ooRJdka.exe
3940	PNBdzHe.exe
768	CajWuNS.exe
1200	vNKlWtF.exe
1764	ANcctmD.exe
1640	ZjtVUDm.exe
2124	BQHuVHJ.exe
4868	VdSmkKI.exe
3016	WAamkMd.exe
1072	qLAzfuc.exe
868	KspHbgY.exe
1276	sZfMfFh.exe
3952	McJSkLs.exe
2760	fzFYxpa.exe
5088	FunSFty.exe
3676	miAzIxZ.exe
4968	UAzrLzO.exe
4072	UhZMAVa.exe
4916	CQwiYJH.exe
2232	oYfVhBF.exe
1988	jWDXqoq.exe
4600	OQRMbPZ.exe
4080	cCPWJLW.exe
4928	wvNpVGE.exe
2972	YvgGtCU.exe
3208	MYZKOYB.exe
952	vbJIBsC.exe
2392	sFZlJhc.exe
2800	kpMlALf.exe
672	xqhrkKR.exe
1736	xAYpGXG.exe
1464	YFNqMHx.exe
2720	ZdkwrdV.exe
1080	EbaNqkA.exe
2764	rjOcZrI.exe
3280	CiKaLNf.exe
2380	FcfYhsD.exe
2368	VmjFpMz.exe
5072	hkjBYNM.exe
2868	iEiOcpm.exe
1708	gJGzbLX.exe
4980	kKhpbDU.exe
2508	zXhVTDb.exe
2244	hDNlrbb.exe
60	nqvgHhC.exe
3440	TufAFrs.exe
1320	XkyKwga.exe
4112	WqIxmTR.exe
1456	SPuCGvd.exe
1220	Jqxrcmv.exe
4304	BUCWBMJ.exe
3332	deBbkjn.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1096-0-0x00007FF7442A0000-0x00007FF744692000-memory.dmp	upx
behavioral2/files/0x00080000000233f0-5.dat	upx
behavioral2/files/0x00070000000233f5-8.dat	upx
behavioral2/files/0x00070000000233f4-18.dat	upx
behavioral2/files/0x0007000000023408-99.dat	upx
behavioral2/files/0x0007000000023402-133.dat	upx
behavioral2/files/0x0007000000023403-139.dat	upx
behavioral2/memory/4860-424-0x00007FF661FB0000-0x00007FF6623A2000-memory.dmp	upx
behavioral2/memory/1232-425-0x00007FF7D31F0000-0x00007FF7D35E2000-memory.dmp	upx
behavioral2/memory/3896-486-0x00007FF68EBB0000-0x00007FF68EFA2000-memory.dmp	upx
behavioral2/memory/1200-489-0x00007FF729A90000-0x00007FF729E82000-memory.dmp	upx
behavioral2/memory/2124-492-0x00007FF78D8B0000-0x00007FF78DCA2000-memory.dmp	upx
behavioral2/memory/1276-496-0x00007FF7C8D60000-0x00007FF7C9152000-memory.dmp	upx
behavioral2/memory/1072-590-0x00007FF68E0A0000-0x00007FF68E492000-memory.dmp	upx
behavioral2/memory/4728-565-0x00007FF628DA0000-0x00007FF629192000-memory.dmp	upx
behavioral2/memory/868-495-0x00007FF753220000-0x00007FF753612000-memory.dmp	upx
behavioral2/memory/3016-494-0x00007FF7DF5B0000-0x00007FF7DF9A2000-memory.dmp	upx
behavioral2/memory/4868-493-0x00007FF749220000-0x00007FF749612000-memory.dmp	upx
behavioral2/memory/1640-491-0x00007FF75D190000-0x00007FF75D582000-memory.dmp	upx
behavioral2/memory/1764-490-0x00007FF64F3D0000-0x00007FF64F7C2000-memory.dmp	upx
behavioral2/memory/768-488-0x00007FF783600000-0x00007FF7839F2000-memory.dmp	upx
behavioral2/memory/3940-487-0x00007FF67F4F0000-0x00007FF67F8E2000-memory.dmp	upx
behavioral2/memory/1328-476-0x00007FF6A33E0000-0x00007FF6A37D2000-memory.dmp	upx
behavioral2/memory/2996-401-0x00007FF6FF830000-0x00007FF6FFC22000-memory.dmp	upx
behavioral2/memory/2992-344-0x00007FF704190000-0x00007FF704582000-memory.dmp	upx
behavioral2/memory/4588-286-0x00007FF7354D0000-0x00007FF7358C2000-memory.dmp	upx
behavioral2/memory/3892-265-0x00007FF6C1660000-0x00007FF6C1A52000-memory.dmp	upx
behavioral2/memory/3364-216-0x00007FF7D20B0000-0x00007FF7D24A2000-memory.dmp	upx
behavioral2/memory/2940-186-0x00007FF73B260000-0x00007FF73B652000-memory.dmp	upx
behavioral2/files/0x000700000002340a-183.dat	upx
behavioral2/files/0x000700000002341a-182.dat	upx
behavioral2/files/0x0007000000023417-177.dat	upx
behavioral2/files/0x000700000002340c-175.dat	upx
behavioral2/files/0x0007000000023400-174.dat	upx
behavioral2/files/0x0007000000023415-164.dat	upx
behavioral2/files/0x0007000000023413-158.dat	upx
behavioral2/files/0x0007000000023412-157.dat	upx
behavioral2/files/0x0007000000023411-156.dat	upx
behavioral2/files/0x00070000000233fa-153.dat	upx
behavioral2/memory/736-150-0x00007FF71F7E0000-0x00007FF71FBD2000-memory.dmp	upx
behavioral2/files/0x0007000000023410-149.dat	upx
behavioral2/files/0x000700000002340b-148.dat	upx
behavioral2/files/0x0007000000023404-143.dat	upx
behavioral2/files/0x0007000000023409-179.dat	upx
behavioral2/files/0x000700000002340e-129.dat	upx
behavioral2/files/0x000700000002340d-128.dat	upx
behavioral2/files/0x0007000000023406-124.dat	upx
behavioral2/files/0x0007000000023407-172.dat	upx
behavioral2/files/0x0007000000023416-170.dat	upx
behavioral2/files/0x0007000000023405-163.dat	upx
behavioral2/files/0x00070000000233ff-161.dat	upx
behavioral2/files/0x00070000000233fe-118.dat	upx
behavioral2/files/0x0007000000023414-159.dat	upx
behavioral2/files/0x00070000000233fd-108.dat	upx
behavioral2/files/0x00070000000233fc-102.dat	upx
behavioral2/files/0x000700000002340f-147.dat	upx
behavioral2/files/0x0007000000023401-96.dat	upx
behavioral2/files/0x000700000002340c-126.dat	upx
behavioral2/files/0x00070000000233f8-63.dat	upx
behavioral2/files/0x00070000000233f9-52.dat	upx
behavioral2/files/0x00070000000233fb-47.dat	upx
behavioral2/files/0x00070000000233f6-32.dat	upx
behavioral2/files/0x00070000000233f7-56.dat	upx
behavioral2/files/0x00070000000233f9-29.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bxhGNdI.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\NSTDsNF.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\CTVSplG.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\DIbqJZW.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\jsoLHDe.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\wvNpVGE.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\aCfNzDC.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\VPYDSlE.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\svMReYa.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\mUzCoQM.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\VpniYdj.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\vNKlWtF.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\qYPlNej.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\QsqckXy.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\yFHBgMt.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\PjnaJpT.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\yiIpdnY.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\FgIgYvI.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\wlZkQGv.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\GYzonBl.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\WznTugI.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\MjyXfeF.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\crPjsej.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\cPTGWnl.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\iLdfboo.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\WhSMWdd.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\ZqxQCFQ.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\uEabsqF.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\ukhnjlN.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\pcnoLus.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\EGrBmSw.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\RpIRagU.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\lLnkzzh.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\gFSVUnx.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\BBLPANf.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\ZjbpHeJ.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\RbDJfJd.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\khUIKcV.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\KAuWDPQ.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\EuwsbOZ.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\fbNYBKg.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\MBbPpxI.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\NFZfDtB.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\ZzrJDxn.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\kgtCOkC.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\dJmyPBE.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\foGVNRh.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\OiMemWI.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\kIpbUXK.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\NomyzqW.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\lNycrrD.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\IASMLbn.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\SCswWyU.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\AkWkPOA.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\cVoSgmc.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\SFiUehM.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\mtymnvr.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\NtYhPda.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\QiizdYX.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\xTGhTml.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\FOmpfaF.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\iiMTkkz.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\rPfZNpB.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
File created	C:\Windows\System\jJquxLD.exe	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1292	powershell.exe
1292	powershell.exe
1292	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeLockMemoryPrivilege	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1292	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	82
PID 1096 wrote to memory of 1292	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	82
PID 1096 wrote to memory of 1128	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	83
PID 1096 wrote to memory of 1128	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	83
PID 1096 wrote to memory of 4728	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	84
PID 1096 wrote to memory of 4728	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	84
PID 1096 wrote to memory of 3364	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	85
PID 1096 wrote to memory of 3364	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	85
PID 1096 wrote to memory of 736	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	86
PID 1096 wrote to memory of 736	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	86
PID 1096 wrote to memory of 2940	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	87
PID 1096 wrote to memory of 2940	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	87
PID 1096 wrote to memory of 3892	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	88
PID 1096 wrote to memory of 3892	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	88
PID 1096 wrote to memory of 4588	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	89
PID 1096 wrote to memory of 4588	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	89
PID 1096 wrote to memory of 4860	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	90
PID 1096 wrote to memory of 4860	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	90
PID 1096 wrote to memory of 2992	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	91
PID 1096 wrote to memory of 2992	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	91
PID 1096 wrote to memory of 2996	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	92
PID 1096 wrote to memory of 2996	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	92
PID 1096 wrote to memory of 1232	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	93
PID 1096 wrote to memory of 1232	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	93
PID 1096 wrote to memory of 1328	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	94
PID 1096 wrote to memory of 1328	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	94
PID 1096 wrote to memory of 3896	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	95
PID 1096 wrote to memory of 3896	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	95
PID 1096 wrote to memory of 3940	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	96
PID 1096 wrote to memory of 3940	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	96
PID 1096 wrote to memory of 3016	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	97
PID 1096 wrote to memory of 3016	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	97
PID 1096 wrote to memory of 768	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	98
PID 1096 wrote to memory of 768	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	98
PID 1096 wrote to memory of 1200	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	99
PID 1096 wrote to memory of 1200	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	99
PID 1096 wrote to memory of 1764	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	100
PID 1096 wrote to memory of 1764	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	100
PID 1096 wrote to memory of 1640	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	101
PID 1096 wrote to memory of 1640	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	101
PID 1096 wrote to memory of 2124	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	102
PID 1096 wrote to memory of 2124	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	102
PID 1096 wrote to memory of 4868	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	103
PID 1096 wrote to memory of 4868	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	103
PID 1096 wrote to memory of 1072	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	104
PID 1096 wrote to memory of 1072	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	104
PID 1096 wrote to memory of 868	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	105
PID 1096 wrote to memory of 868	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	105
PID 1096 wrote to memory of 1276	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	106
PID 1096 wrote to memory of 1276	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	106
PID 1096 wrote to memory of 4968	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	107
PID 1096 wrote to memory of 4968	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	107
PID 1096 wrote to memory of 3952	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	108
PID 1096 wrote to memory of 3952	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	108
PID 1096 wrote to memory of 2760	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	109
PID 1096 wrote to memory of 2760	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	109
PID 1096 wrote to memory of 5088	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	110
PID 1096 wrote to memory of 5088	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	110
PID 1096 wrote to memory of 3676	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	111
PID 1096 wrote to memory of 3676	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	111
PID 1096 wrote to memory of 4072	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	112
PID 1096 wrote to memory of 4072	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	112
PID 1096 wrote to memory of 4916	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	113
PID 1096 wrote to memory of 4916	1096	48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\48473e63c22af3b061920fdf9bf429ebaa7109ae2210f4251fef829d04891140_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1292
- C:\Windows\System\tKhjarr.exe
  C:\Windows\System\tKhjarr.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\xTGhTml.exe
  C:\Windows\System\xTGhTml.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\OOpMREC.exe
  C:\Windows\System\OOpMREC.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\OkBsXTN.exe
  C:\Windows\System\OkBsXTN.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\iESoAye.exe
  C:\Windows\System\iESoAye.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\YgvnCOJ.exe
  C:\Windows\System\YgvnCOJ.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\eOekSGG.exe
  C:\Windows\System\eOekSGG.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\JlPuOLu.exe
  C:\Windows\System\JlPuOLu.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\kMPkoXm.exe
  C:\Windows\System\kMPkoXm.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\rJNArwR.exe
  C:\Windows\System\rJNArwR.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\NgeJtoV.exe
  C:\Windows\System\NgeJtoV.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\BCOdpDH.exe
  C:\Windows\System\BCOdpDH.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\ooRJdka.exe
  C:\Windows\System\ooRJdka.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\PNBdzHe.exe
  C:\Windows\System\PNBdzHe.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\WAamkMd.exe
  C:\Windows\System\WAamkMd.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\CajWuNS.exe
  C:\Windows\System\CajWuNS.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\vNKlWtF.exe
  C:\Windows\System\vNKlWtF.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\ANcctmD.exe
  C:\Windows\System\ANcctmD.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\ZjtVUDm.exe
  C:\Windows\System\ZjtVUDm.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\BQHuVHJ.exe
  C:\Windows\System\BQHuVHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\VdSmkKI.exe
  C:\Windows\System\VdSmkKI.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\qLAzfuc.exe
  C:\Windows\System\qLAzfuc.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\KspHbgY.exe
  C:\Windows\System\KspHbgY.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\sZfMfFh.exe
  C:\Windows\System\sZfMfFh.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\UAzrLzO.exe
  C:\Windows\System\UAzrLzO.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\McJSkLs.exe
  C:\Windows\System\McJSkLs.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\fzFYxpa.exe
  C:\Windows\System\fzFYxpa.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\FunSFty.exe
  C:\Windows\System\FunSFty.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\miAzIxZ.exe
  C:\Windows\System\miAzIxZ.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\UhZMAVa.exe
  C:\Windows\System\UhZMAVa.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\CQwiYJH.exe
  C:\Windows\System\CQwiYJH.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\oYfVhBF.exe
  C:\Windows\System\oYfVhBF.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\jWDXqoq.exe
  C:\Windows\System\jWDXqoq.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\OQRMbPZ.exe
  C:\Windows\System\OQRMbPZ.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\cCPWJLW.exe
  C:\Windows\System\cCPWJLW.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\wvNpVGE.exe
  C:\Windows\System\wvNpVGE.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\YvgGtCU.exe
  C:\Windows\System\YvgGtCU.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\xqhrkKR.exe
  C:\Windows\System\xqhrkKR.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\xAYpGXG.exe
  C:\Windows\System\xAYpGXG.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\MYZKOYB.exe
  C:\Windows\System\MYZKOYB.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\vbJIBsC.exe
  C:\Windows\System\vbJIBsC.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\sFZlJhc.exe
  C:\Windows\System\sFZlJhc.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\kpMlALf.exe
  C:\Windows\System\kpMlALf.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\YFNqMHx.exe
  C:\Windows\System\YFNqMHx.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\ZdkwrdV.exe
  C:\Windows\System\ZdkwrdV.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\XkyKwga.exe
  C:\Windows\System\XkyKwga.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\EbaNqkA.exe
  C:\Windows\System\EbaNqkA.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\rjOcZrI.exe
  C:\Windows\System\rjOcZrI.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\CiKaLNf.exe
  C:\Windows\System\CiKaLNf.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\FcfYhsD.exe
  C:\Windows\System\FcfYhsD.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\VmjFpMz.exe
  C:\Windows\System\VmjFpMz.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\hkjBYNM.exe
  C:\Windows\System\hkjBYNM.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\iEiOcpm.exe
  C:\Windows\System\iEiOcpm.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\zOowehz.exe
  C:\Windows\System\zOowehz.exe
  2⤵
  PID:4176
- C:\Windows\System\gJGzbLX.exe
  C:\Windows\System\gJGzbLX.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\kKhpbDU.exe
  C:\Windows\System\kKhpbDU.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\zXhVTDb.exe
  C:\Windows\System\zXhVTDb.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\UDbJhUC.exe
  C:\Windows\System\UDbJhUC.exe
  2⤵
  PID:3652
- C:\Windows\System\hDNlrbb.exe
  C:\Windows\System\hDNlrbb.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\nqvgHhC.exe
  C:\Windows\System\nqvgHhC.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\TufAFrs.exe
  C:\Windows\System\TufAFrs.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\WqIxmTR.exe
  C:\Windows\System\WqIxmTR.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\SPuCGvd.exe
  C:\Windows\System\SPuCGvd.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\Jqxrcmv.exe
  C:\Windows\System\Jqxrcmv.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\BUCWBMJ.exe
  C:\Windows\System\BUCWBMJ.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\deBbkjn.exe
  C:\Windows\System\deBbkjn.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\bsVQCho.exe
  C:\Windows\System\bsVQCho.exe
  2⤵
  PID:4412
- C:\Windows\System\lQIJJDa.exe
  C:\Windows\System\lQIJJDa.exe
  2⤵
  PID:3656
- C:\Windows\System\CAwWJQg.exe
  C:\Windows\System\CAwWJQg.exe
  2⤵
  PID:1176
- C:\Windows\System\kKIKcBs.exe
  C:\Windows\System\kKIKcBs.exe
  2⤵
  PID:1272
- C:\Windows\System\XzjQnOB.exe
  C:\Windows\System\XzjQnOB.exe
  2⤵
  PID:3352
- C:\Windows\System\vDVcsCs.exe
  C:\Windows\System\vDVcsCs.exe
  2⤵
  PID:2300
- C:\Windows\System\GZtUFhy.exe
  C:\Windows\System\GZtUFhy.exe
  2⤵
  PID:1392
- C:\Windows\System\gJuXQhD.exe
  C:\Windows\System\gJuXQhD.exe
  2⤵
  PID:464
- C:\Windows\System\vLQrydW.exe
  C:\Windows\System\vLQrydW.exe
  2⤵
  PID:2028
- C:\Windows\System\OyBkDRt.exe
  C:\Windows\System\OyBkDRt.exe
  2⤵
  PID:2396
- C:\Windows\System\fkvzRpu.exe
  C:\Windows\System\fkvzRpu.exe
  2⤵
  PID:3256
- C:\Windows\System\ohWsxyO.exe
  C:\Windows\System\ohWsxyO.exe
  2⤵
  PID:656
- C:\Windows\System\khStIoo.exe
  C:\Windows\System\khStIoo.exe
  2⤵
  PID:1816
- C:\Windows\System\vUZcCKV.exe
  C:\Windows\System\vUZcCKV.exe
  2⤵
  PID:1164
- C:\Windows\System\HbdUQGr.exe
  C:\Windows\System\HbdUQGr.exe
  2⤵
  PID:4344
- C:\Windows\System\CIbrUzJ.exe
  C:\Windows\System\CIbrUzJ.exe
  2⤵
  PID:2284
- C:\Windows\System\oinMVSV.exe
  C:\Windows\System\oinMVSV.exe
  2⤵
  PID:3592
- C:\Windows\System\GlvJzoJ.exe
  C:\Windows\System\GlvJzoJ.exe
  2⤵
  PID:996
- C:\Windows\System\CbsLCzA.exe
  C:\Windows\System\CbsLCzA.exe
  2⤵
  PID:4724
- C:\Windows\System\SIsaIxo.exe
  C:\Windows\System\SIsaIxo.exe
  2⤵
  PID:2256
- C:\Windows\System\dBCErBw.exe
  C:\Windows\System\dBCErBw.exe
  2⤵
  PID:4440
- C:\Windows\System\RCfPjgu.exe
  C:\Windows\System\RCfPjgu.exe
  2⤵
  PID:4596
- C:\Windows\System\MwshjhH.exe
  C:\Windows\System\MwshjhH.exe
  2⤵
  PID:4300
- C:\Windows\System\pUAvYQC.exe
  C:\Windows\System\pUAvYQC.exe
  2⤵
  PID:4392
- C:\Windows\System\FTtEVgT.exe
  C:\Windows\System\FTtEVgT.exe
  2⤵
  PID:4856
- C:\Windows\System\LiGbMoT.exe
  C:\Windows\System\LiGbMoT.exe
  2⤵
  PID:448
- C:\Windows\System\weIrtXc.exe
  C:\Windows\System\weIrtXc.exe
  2⤵
  PID:1692
- C:\Windows\System\etBhmoQ.exe
  C:\Windows\System\etBhmoQ.exe
  2⤵
  PID:1676
- C:\Windows\System\YpahKoX.exe
  C:\Windows\System\YpahKoX.exe
  2⤵
  PID:5144
- C:\Windows\System\rVtcqGf.exe
  C:\Windows\System\rVtcqGf.exe
  2⤵
  PID:5160
- C:\Windows\System\qYPlNej.exe
  C:\Windows\System\qYPlNej.exe
  2⤵
  PID:5188
- C:\Windows\System\VsQadfc.exe
  C:\Windows\System\VsQadfc.exe
  2⤵
  PID:5204
- C:\Windows\System\lJqKoKw.exe
  C:\Windows\System\lJqKoKw.exe
  2⤵
  PID:5224
- C:\Windows\System\mEsgffd.exe
  C:\Windows\System\mEsgffd.exe
  2⤵
  PID:5244
- C:\Windows\System\RKUAxsp.exe
  C:\Windows\System\RKUAxsp.exe
  2⤵
  PID:5260
- C:\Windows\System\vJBpCSX.exe
  C:\Windows\System\vJBpCSX.exe
  2⤵
  PID:5280
- C:\Windows\System\EnSWtXK.exe
  C:\Windows\System\EnSWtXK.exe
  2⤵
  PID:5300
- C:\Windows\System\qXvcghI.exe
  C:\Windows\System\qXvcghI.exe
  2⤵
  PID:5324
- C:\Windows\System\BmItzdv.exe
  C:\Windows\System\BmItzdv.exe
  2⤵
  PID:5344
- C:\Windows\System\bgouxZZ.exe
  C:\Windows\System\bgouxZZ.exe
  2⤵
  PID:5368
- C:\Windows\System\PEHNwtW.exe
  C:\Windows\System\PEHNwtW.exe
  2⤵
  PID:5388
- C:\Windows\System\ZcahUsN.exe
  C:\Windows\System\ZcahUsN.exe
  2⤵
  PID:5404
- C:\Windows\System\AbbHMJC.exe
  C:\Windows\System\AbbHMJC.exe
  2⤵
  PID:5428
- C:\Windows\System\cVoSgmc.exe
  C:\Windows\System\cVoSgmc.exe
  2⤵
  PID:5444
- C:\Windows\System\kgtCOkC.exe
  C:\Windows\System\kgtCOkC.exe
  2⤵
  PID:5464
- C:\Windows\System\aYmVoVu.exe
  C:\Windows\System\aYmVoVu.exe
  2⤵
  PID:5484
- C:\Windows\System\VcUMFXO.exe
  C:\Windows\System\VcUMFXO.exe
  2⤵
  PID:5500
- C:\Windows\System\zQKXUIr.exe
  C:\Windows\System\zQKXUIr.exe
  2⤵
  PID:5528
- C:\Windows\System\jaqwnqf.exe
  C:\Windows\System\jaqwnqf.exe
  2⤵
  PID:5544
- C:\Windows\System\diSjeUk.exe
  C:\Windows\System\diSjeUk.exe
  2⤵
  PID:5564
- C:\Windows\System\dtmtYyF.exe
  C:\Windows\System\dtmtYyF.exe
  2⤵
  PID:5588
- C:\Windows\System\eXzOCdC.exe
  C:\Windows\System\eXzOCdC.exe
  2⤵
  PID:5612
- C:\Windows\System\HxgNlQq.exe
  C:\Windows\System\HxgNlQq.exe
  2⤵
  PID:5636
- C:\Windows\System\FlxUDtP.exe
  C:\Windows\System\FlxUDtP.exe
  2⤵
  PID:5668
- C:\Windows\System\nfQrZND.exe
  C:\Windows\System\nfQrZND.exe
  2⤵
  PID:5684
- C:\Windows\System\WjIYbCI.exe
  C:\Windows\System\WjIYbCI.exe
  2⤵
  PID:5708
- C:\Windows\System\FLWLdZf.exe
  C:\Windows\System\FLWLdZf.exe
  2⤵
  PID:5732
- C:\Windows\System\aVrizSA.exe
  C:\Windows\System\aVrizSA.exe
  2⤵
  PID:5908
- C:\Windows\System\lLnkzzh.exe
  C:\Windows\System\lLnkzzh.exe
  2⤵
  PID:5924
- C:\Windows\System\IAOnCSh.exe
  C:\Windows\System\IAOnCSh.exe
  2⤵
  PID:5952
- C:\Windows\System\KowokwA.exe
  C:\Windows\System\KowokwA.exe
  2⤵
  PID:5968
- C:\Windows\System\dKJnrLI.exe
  C:\Windows\System\dKJnrLI.exe
  2⤵
  PID:5996
- C:\Windows\System\GXZDDDe.exe
  C:\Windows\System\GXZDDDe.exe
  2⤵
  PID:6012
- C:\Windows\System\MMHpSSc.exe
  C:\Windows\System\MMHpSSc.exe
  2⤵
  PID:6092
- C:\Windows\System\cEcrVXn.exe
  C:\Windows\System\cEcrVXn.exe
  2⤵
  PID:6112
- C:\Windows\System\elBneZL.exe
  C:\Windows\System\elBneZL.exe
  2⤵
  PID:6136
- C:\Windows\System\JyyCHzg.exe
  C:\Windows\System\JyyCHzg.exe
  2⤵
  PID:4100
- C:\Windows\System\xxnHdOP.exe
  C:\Windows\System\xxnHdOP.exe
  2⤵
  PID:1412
- C:\Windows\System\CdZiziP.exe
  C:\Windows\System\CdZiziP.exe
  2⤵
  PID:2400
- C:\Windows\System\BXwOvqw.exe
  C:\Windows\System\BXwOvqw.exe
  2⤵
  PID:336
- C:\Windows\System\FmVCotK.exe
  C:\Windows\System\FmVCotK.exe
  2⤵
  PID:2860
- C:\Windows\System\AjPKDGD.exe
  C:\Windows\System\AjPKDGD.exe
  2⤵
  PID:4568
- C:\Windows\System\UGFpFPQ.exe
  C:\Windows\System\UGFpFPQ.exe
  2⤵
  PID:4832
- C:\Windows\System\vyzJBlk.exe
  C:\Windows\System\vyzJBlk.exe
  2⤵
  PID:4944
- C:\Windows\System\KAuWDPQ.exe
  C:\Windows\System\KAuWDPQ.exe
  2⤵
  PID:4308
- C:\Windows\System\VBhAyfK.exe
  C:\Windows\System\VBhAyfK.exe
  2⤵
  PID:2024
- C:\Windows\System\moMtPyC.exe
  C:\Windows\System\moMtPyC.exe
  2⤵
  PID:792
- C:\Windows\System\XcMejom.exe
  C:\Windows\System\XcMejom.exe
  2⤵
  PID:5424
- C:\Windows\System\QZXlFBi.exe
  C:\Windows\System\QZXlFBi.exe
  2⤵
  PID:5624
- C:\Windows\System\QVjVved.exe
  C:\Windows\System\QVjVved.exe
  2⤵
  PID:1144
- C:\Windows\System\NomyzqW.exe
  C:\Windows\System\NomyzqW.exe
  2⤵
  PID:5872
- C:\Windows\System\hTQGtIV.exe
  C:\Windows\System\hTQGtIV.exe
  2⤵
  PID:5916
- C:\Windows\System\vAWUcGa.exe
  C:\Windows\System\vAWUcGa.exe
  2⤵
  PID:1092
- C:\Windows\System\jKdPcWj.exe
  C:\Windows\System\jKdPcWj.exe
  2⤵
  PID:5180
- C:\Windows\System\qTcXSKs.exe
  C:\Windows\System\qTcXSKs.exe
  2⤵
  PID:5048
- C:\Windows\System\GuHdbgO.exe
  C:\Windows\System\GuHdbgO.exe
  2⤵
  PID:4924
- C:\Windows\System\EuwsbOZ.exe
  C:\Windows\System\EuwsbOZ.exe
  2⤵
  PID:6108
- C:\Windows\System\ALnAxaP.exe
  C:\Windows\System\ALnAxaP.exe
  2⤵
  PID:6032
- C:\Windows\System\zmEoznq.exe
  C:\Windows\System\zmEoznq.exe
  2⤵
  PID:5984
- C:\Windows\System\tzfRBNn.exe
  C:\Windows\System\tzfRBNn.exe
  2⤵
  PID:5840
- C:\Windows\System\RhDSYda.exe
  C:\Windows\System\RhDSYda.exe
  2⤵
  PID:5792
- C:\Windows\System\tZXLrey.exe
  C:\Windows\System\tZXLrey.exe
  2⤵
  PID:5700
- C:\Windows\System\LuDKkey.exe
  C:\Windows\System\LuDKkey.exe
  2⤵
  PID:2728
- C:\Windows\System\xsQSXzS.exe
  C:\Windows\System\xsQSXzS.exe
  2⤵
  PID:2524
- C:\Windows\System\JQZhrTl.exe
  C:\Windows\System\JQZhrTl.exe
  2⤵
  PID:6164
- C:\Windows\System\ojucwTq.exe
  C:\Windows\System\ojucwTq.exe
  2⤵
  PID:6180
- C:\Windows\System\FOmpfaF.exe
  C:\Windows\System\FOmpfaF.exe
  2⤵
  PID:6204
- C:\Windows\System\tpEJHSi.exe
  C:\Windows\System\tpEJHSi.exe
  2⤵
  PID:6224
- C:\Windows\System\tXcjeDA.exe
  C:\Windows\System\tXcjeDA.exe
  2⤵
  PID:6244
- C:\Windows\System\aonQztm.exe
  C:\Windows\System\aonQztm.exe
  2⤵
  PID:6260
- C:\Windows\System\vMqcOiT.exe
  C:\Windows\System\vMqcOiT.exe
  2⤵
  PID:6276
- C:\Windows\System\gFSVUnx.exe
  C:\Windows\System\gFSVUnx.exe
  2⤵
  PID:6300
- C:\Windows\System\VVpzYZt.exe
  C:\Windows\System\VVpzYZt.exe
  2⤵
  PID:6336
- C:\Windows\System\MuTrPXt.exe
  C:\Windows\System\MuTrPXt.exe
  2⤵
  PID:6356
- C:\Windows\System\edPUtXw.exe
  C:\Windows\System\edPUtXw.exe
  2⤵
  PID:6372
- C:\Windows\System\UKkHnjC.exe
  C:\Windows\System\UKkHnjC.exe
  2⤵
  PID:6488
- C:\Windows\System\aXNZuhN.exe
  C:\Windows\System\aXNZuhN.exe
  2⤵
  PID:6516
- C:\Windows\System\foIPLnO.exe
  C:\Windows\System\foIPLnO.exe
  2⤵
  PID:6532
- C:\Windows\System\GzKeQch.exe
  C:\Windows\System\GzKeQch.exe
  2⤵
  PID:6556
- C:\Windows\System\sojZsfS.exe
  C:\Windows\System\sojZsfS.exe
  2⤵
  PID:6572
- C:\Windows\System\FKpIhkE.exe
  C:\Windows\System\FKpIhkE.exe
  2⤵
  PID:6592
- C:\Windows\System\YfiCNpE.exe
  C:\Windows\System\YfiCNpE.exe
  2⤵
  PID:6612
- C:\Windows\System\oqoyWgK.exe
  C:\Windows\System\oqoyWgK.exe
  2⤵
  PID:6632
- C:\Windows\System\WQSWMZg.exe
  C:\Windows\System\WQSWMZg.exe
  2⤵
  PID:6648
- C:\Windows\System\vGKQWVP.exe
  C:\Windows\System\vGKQWVP.exe
  2⤵
  PID:6672
- C:\Windows\System\aSzCuEG.exe
  C:\Windows\System\aSzCuEG.exe
  2⤵
  PID:6696
- C:\Windows\System\UVrhafg.exe
  C:\Windows\System\UVrhafg.exe
  2⤵
  PID:6712
- C:\Windows\System\RWkCYzX.exe
  C:\Windows\System\RWkCYzX.exe
  2⤵
  PID:6736
- C:\Windows\System\DblXRFu.exe
  C:\Windows\System\DblXRFu.exe
  2⤵
  PID:6760
- C:\Windows\System\DFNCfhc.exe
  C:\Windows\System\DFNCfhc.exe
  2⤵
  PID:6780
- C:\Windows\System\LBwdNRl.exe
  C:\Windows\System\LBwdNRl.exe
  2⤵
  PID:6808
- C:\Windows\System\psawybr.exe
  C:\Windows\System\psawybr.exe
  2⤵
  PID:6824
- C:\Windows\System\Vzqrnon.exe
  C:\Windows\System\Vzqrnon.exe
  2⤵
  PID:6844
- C:\Windows\System\obRWVzV.exe
  C:\Windows\System\obRWVzV.exe
  2⤵
  PID:6860
- C:\Windows\System\ICDcVfE.exe
  C:\Windows\System\ICDcVfE.exe
  2⤵
  PID:6884
- C:\Windows\System\ZgqTHZW.exe
  C:\Windows\System\ZgqTHZW.exe
  2⤵
  PID:6908
- C:\Windows\System\YLLSNiI.exe
  C:\Windows\System\YLLSNiI.exe
  2⤵
  PID:6924
- C:\Windows\System\JkimGIb.exe
  C:\Windows\System\JkimGIb.exe
  2⤵
  PID:6948
- C:\Windows\System\YHgyFtB.exe
  C:\Windows\System\YHgyFtB.exe
  2⤵
  PID:6972
- C:\Windows\System\bXAPWWw.exe
  C:\Windows\System\bXAPWWw.exe
  2⤵
  PID:6996
- C:\Windows\System\LbYyfaV.exe
  C:\Windows\System\LbYyfaV.exe
  2⤵
  PID:7028
- C:\Windows\System\nAQVyyu.exe
  C:\Windows\System\nAQVyyu.exe
  2⤵
  PID:7136
- C:\Windows\System\mnLpysR.exe
  C:\Windows\System\mnLpysR.exe
  2⤵
  PID:7152
- C:\Windows\System\uWHTMSa.exe
  C:\Windows\System\uWHTMSa.exe
  2⤵
  PID:6200
- C:\Windows\System\NYcdTMa.exe
  C:\Windows\System\NYcdTMa.exe
  2⤵
  PID:6292
- C:\Windows\System\PsslXcK.exe
  C:\Windows\System\PsslXcK.exe
  2⤵
  PID:684
- C:\Windows\System\BDTnhON.exe
  C:\Windows\System\BDTnhON.exe
  2⤵
  PID:3996
- C:\Windows\System\KsrPCEL.exe
  C:\Windows\System\KsrPCEL.exe
  2⤵
  PID:3832
- C:\Windows\System\jyZsluU.exe
  C:\Windows\System\jyZsluU.exe
  2⤵
  PID:3128
- C:\Windows\System\cOOvLuL.exe
  C:\Windows\System\cOOvLuL.exe
  2⤵
  PID:6876
- C:\Windows\System\iaIMVWd.exe
  C:\Windows\System\iaIMVWd.exe
  2⤵
  PID:6916
- C:\Windows\System\jTisZXB.exe
  C:\Windows\System\jTisZXB.exe
  2⤵
  PID:6960
- C:\Windows\System\zUPgZzs.exe
  C:\Windows\System\zUPgZzs.exe
  2⤵
  PID:7004
- C:\Windows\System\cNzoshU.exe
  C:\Windows\System\cNzoshU.exe
  2⤵
  PID:5556
- C:\Windows\System\uExTyXB.exe
  C:\Windows\System\uExTyXB.exe
  2⤵
  PID:1208
- C:\Windows\System\ceUgGKZ.exe
  C:\Windows\System\ceUgGKZ.exe
  2⤵
  PID:3836
- C:\Windows\System\WPMMYsD.exe
  C:\Windows\System\WPMMYsD.exe
  2⤵
  PID:2120
- C:\Windows\System\FBJqYyn.exe
  C:\Windows\System\FBJqYyn.exe
  2⤵
  PID:6020
- C:\Windows\System\LGRoBUd.exe
  C:\Windows\System\LGRoBUd.exe
  2⤵
  PID:5808
- C:\Windows\System\VpCnJNo.exe
  C:\Windows\System\VpCnJNo.exe
  2⤵
  PID:5680
- C:\Windows\System\hcONtdr.exe
  C:\Windows\System\hcONtdr.exe
  2⤵
  PID:1648
- C:\Windows\System\DhWEwxy.exe
  C:\Windows\System\DhWEwxy.exe
  2⤵
  PID:6196
- C:\Windows\System\TYoDFrH.exe
  C:\Windows\System\TYoDFrH.exe
  2⤵
  PID:6328
- C:\Windows\System\FsToaEo.exe
  C:\Windows\System\FsToaEo.exe
  2⤵
  PID:7188
- C:\Windows\System\hnjRsQd.exe
  C:\Windows\System\hnjRsQd.exe
  2⤵
  PID:7212
- C:\Windows\System\JGUPEKM.exe
  C:\Windows\System\JGUPEKM.exe
  2⤵
  PID:7236
- C:\Windows\System\PghpVmi.exe
  C:\Windows\System\PghpVmi.exe
  2⤵
  PID:7252
- C:\Windows\System\qVaXFtg.exe
  C:\Windows\System\qVaXFtg.exe
  2⤵
  PID:7284
- C:\Windows\System\qgGqwTX.exe
  C:\Windows\System\qgGqwTX.exe
  2⤵
  PID:7308
- C:\Windows\System\dMBVAFa.exe
  C:\Windows\System\dMBVAFa.exe
  2⤵
  PID:7328
- C:\Windows\System\RfarATj.exe
  C:\Windows\System\RfarATj.exe
  2⤵
  PID:7348
- C:\Windows\System\dnmsncD.exe
  C:\Windows\System\dnmsncD.exe
  2⤵
  PID:7372
- C:\Windows\System\hgkhojJ.exe
  C:\Windows\System\hgkhojJ.exe
  2⤵
  PID:7392
- C:\Windows\System\XzzhXzp.exe
  C:\Windows\System\XzzhXzp.exe
  2⤵
  PID:7412
- C:\Windows\System\gIEcGvT.exe
  C:\Windows\System\gIEcGvT.exe
  2⤵
  PID:7436
- C:\Windows\System\gBNetCU.exe
  C:\Windows\System\gBNetCU.exe
  2⤵
  PID:7452
- C:\Windows\System\VGtfQTr.exe
  C:\Windows\System\VGtfQTr.exe
  2⤵
  PID:7556
- C:\Windows\System\UmGDNVe.exe
  C:\Windows\System\UmGDNVe.exe
  2⤵
  PID:7572
- C:\Windows\System\gCScYSn.exe
  C:\Windows\System\gCScYSn.exe
  2⤵
  PID:7596
- C:\Windows\System\HqRSCiH.exe
  C:\Windows\System\HqRSCiH.exe
  2⤵
  PID:7616
- C:\Windows\System\zHYjJSW.exe
  C:\Windows\System\zHYjJSW.exe
  2⤵
  PID:7636
- C:\Windows\System\GTSuRWw.exe
  C:\Windows\System\GTSuRWw.exe
  2⤵
  PID:7660
- C:\Windows\System\AGBbiOk.exe
  C:\Windows\System\AGBbiOk.exe
  2⤵
  PID:7680
- C:\Windows\System\xSvQszU.exe
  C:\Windows\System\xSvQszU.exe
  2⤵
  PID:7708
- C:\Windows\System\iBUuBPj.exe
  C:\Windows\System\iBUuBPj.exe
  2⤵
  PID:7724
- C:\Windows\System\QIukKus.exe
  C:\Windows\System\QIukKus.exe
  2⤵
  PID:7744
- C:\Windows\System\IfPfyDq.exe
  C:\Windows\System\IfPfyDq.exe
  2⤵
  PID:7764
- C:\Windows\System\EPhvUdM.exe
  C:\Windows\System\EPhvUdM.exe
  2⤵
  PID:7780
- C:\Windows\System\cEqGUAi.exe
  C:\Windows\System\cEqGUAi.exe
  2⤵
  PID:7800
- C:\Windows\System\CRisJNm.exe
  C:\Windows\System\CRisJNm.exe
  2⤵
  PID:7816
- C:\Windows\System\uOVzPpX.exe
  C:\Windows\System\uOVzPpX.exe
  2⤵
  PID:7832
- C:\Windows\System\oWwoOqy.exe
  C:\Windows\System\oWwoOqy.exe
  2⤵
  PID:7856
- C:\Windows\System\VrMRhYO.exe
  C:\Windows\System\VrMRhYO.exe
  2⤵
  PID:7872
- C:\Windows\System\LqqFIMW.exe
  C:\Windows\System\LqqFIMW.exe
  2⤵
  PID:7896
- C:\Windows\System\xeJOKVV.exe
  C:\Windows\System\xeJOKVV.exe
  2⤵
  PID:7924
- C:\Windows\System\Cvqdwui.exe
  C:\Windows\System\Cvqdwui.exe
  2⤵
  PID:7944
- C:\Windows\System\huWhHKc.exe
  C:\Windows\System\huWhHKc.exe
  2⤵
  PID:7968
- C:\Windows\System\dyfWDjG.exe
  C:\Windows\System\dyfWDjG.exe
  2⤵
  PID:7988
- C:\Windows\System\aoFtGsY.exe
  C:\Windows\System\aoFtGsY.exe
  2⤵
  PID:8008
- C:\Windows\System\QxKCYjz.exe
  C:\Windows\System\QxKCYjz.exe
  2⤵
  PID:8032
- C:\Windows\System\DbSqtfh.exe
  C:\Windows\System\DbSqtfh.exe
  2⤵
  PID:8048
- C:\Windows\System\iLdfboo.exe
  C:\Windows\System\iLdfboo.exe
  2⤵
  PID:8072
- C:\Windows\System\XJIovcw.exe
  C:\Windows\System\XJIovcw.exe
  2⤵
  PID:8104
- C:\Windows\System\qRdAiNR.exe
  C:\Windows\System\qRdAiNR.exe
  2⤵
  PID:8124
- C:\Windows\System\UGOiIaB.exe
  C:\Windows\System\UGOiIaB.exe
  2⤵
  PID:8152
- C:\Windows\System\adzJdpB.exe
  C:\Windows\System\adzJdpB.exe
  2⤵
  PID:8180
- C:\Windows\System\DriiQFI.exe
  C:\Windows\System\DriiQFI.exe
  2⤵
  PID:6932
- C:\Windows\System\aUifZXj.exe
  C:\Windows\System\aUifZXj.exe
  2⤵
  PID:6456
- C:\Windows\System\CfQycyS.exe
  C:\Windows\System\CfQycyS.exe
  2⤵
  PID:6508
- C:\Windows\System\hrNLMmW.exe
  C:\Windows\System\hrNLMmW.exe
  2⤵
  PID:6568
- C:\Windows\System\ZqxQCFQ.exe
  C:\Windows\System\ZqxQCFQ.exe
  2⤵
  PID:6604
- C:\Windows\System\CigXata.exe
  C:\Windows\System\CigXata.exe
  2⤵
  PID:6644
- C:\Windows\System\AyUFNqO.exe
  C:\Windows\System\AyUFNqO.exe
  2⤵
  PID:6692
- C:\Windows\System\YzZTHtD.exe
  C:\Windows\System\YzZTHtD.exe
  2⤵
  PID:7384
- C:\Windows\System\XqCLems.exe
  C:\Windows\System\XqCLems.exe
  2⤵
  PID:7428
- C:\Windows\System\dJNpNKX.exe
  C:\Windows\System\dJNpNKX.exe
  2⤵
  PID:7020
- C:\Windows\System\zvBMBUb.exe
  C:\Windows\System\zvBMBUb.exe
  2⤵
  PID:7100
- C:\Windows\System\EEXxysM.exe
  C:\Windows\System\EEXxysM.exe
  2⤵
  PID:8208
- C:\Windows\System\ybQRrYf.exe
  C:\Windows\System\ybQRrYf.exe
  2⤵
  PID:8232
- C:\Windows\System\thOAaQV.exe
  C:\Windows\System\thOAaQV.exe
  2⤵
  PID:8256
- C:\Windows\System\ttqcxgB.exe
  C:\Windows\System\ttqcxgB.exe
  2⤵
  PID:8280
- C:\Windows\System\psufCoj.exe
  C:\Windows\System\psufCoj.exe
  2⤵
  PID:8300
- C:\Windows\System\ddEebJl.exe
  C:\Windows\System\ddEebJl.exe
  2⤵
  PID:8324
- C:\Windows\System\wuKYkub.exe
  C:\Windows\System\wuKYkub.exe
  2⤵
  PID:8352
- C:\Windows\System\IDmjCMx.exe
  C:\Windows\System\IDmjCMx.exe
  2⤵
  PID:8368
- C:\Windows\System\xNJUDhj.exe
  C:\Windows\System\xNJUDhj.exe
  2⤵
  PID:8392
- C:\Windows\System\ygMmwHn.exe
  C:\Windows\System\ygMmwHn.exe
  2⤵
  PID:8416
- C:\Windows\System\nWUGCmF.exe
  C:\Windows\System\nWUGCmF.exe
  2⤵
  PID:8436
- C:\Windows\System\RTvARUP.exe
  C:\Windows\System\RTvARUP.exe
  2⤵
  PID:8452
- C:\Windows\System\LHTQbde.exe
  C:\Windows\System\LHTQbde.exe
  2⤵
  PID:8480
- C:\Windows\System\lDCBMZO.exe
  C:\Windows\System\lDCBMZO.exe
  2⤵
  PID:8496
- C:\Windows\System\LiFBNzE.exe
  C:\Windows\System\LiFBNzE.exe
  2⤵
  PID:8512
- C:\Windows\System\cskRMNw.exe
  C:\Windows\System\cskRMNw.exe
  2⤵
  PID:8532
- C:\Windows\System\VlEpVKN.exe
  C:\Windows\System\VlEpVKN.exe
  2⤵
  PID:8556
- C:\Windows\System\nJKtacw.exe
  C:\Windows\System\nJKtacw.exe
  2⤵
  PID:8576
- C:\Windows\System\SFiUehM.exe
  C:\Windows\System\SFiUehM.exe
  2⤵
  PID:8596
- C:\Windows\System\vyoffMI.exe
  C:\Windows\System\vyoffMI.exe
  2⤵
  PID:8620
- C:\Windows\System\dkdcirQ.exe
  C:\Windows\System\dkdcirQ.exe
  2⤵
  PID:8636
- C:\Windows\System\FeISarM.exe
  C:\Windows\System\FeISarM.exe
  2⤵
  PID:8652
- C:\Windows\System\YwMyPNi.exe
  C:\Windows\System\YwMyPNi.exe
  2⤵
  PID:8672
- C:\Windows\System\PHKxvwh.exe
  C:\Windows\System\PHKxvwh.exe
  2⤵
  PID:8696
- C:\Windows\System\ggVLJXu.exe
  C:\Windows\System\ggVLJXu.exe
  2⤵
  PID:8724
- C:\Windows\System\uEabsqF.exe
  C:\Windows\System\uEabsqF.exe
  2⤵
  PID:8748
- C:\Windows\System\XqYePDg.exe
  C:\Windows\System\XqYePDg.exe
  2⤵
  PID:8772
- C:\Windows\System\zcbcNUp.exe
  C:\Windows\System\zcbcNUp.exe
  2⤵
  PID:8792
- C:\Windows\System\brGrXoH.exe
  C:\Windows\System\brGrXoH.exe
  2⤵
  PID:8812
- C:\Windows\System\wKOxOmT.exe
  C:\Windows\System\wKOxOmT.exe
  2⤵
  PID:8836
- C:\Windows\System\xjkPuyt.exe
  C:\Windows\System\xjkPuyt.exe
  2⤵
  PID:8852
- C:\Windows\System\YthFAJW.exe
  C:\Windows\System\YthFAJW.exe
  2⤵
  PID:8876
- C:\Windows\System\LkmFpsJ.exe
  C:\Windows\System\LkmFpsJ.exe
  2⤵
  PID:8896
- C:\Windows\System\zwDsviY.exe
  C:\Windows\System\zwDsviY.exe
  2⤵
  PID:8920
- C:\Windows\System\bvSewTt.exe
  C:\Windows\System\bvSewTt.exe
  2⤵
  PID:8936
- C:\Windows\System\dSbrsvo.exe
  C:\Windows\System\dSbrsvo.exe
  2⤵
  PID:8952
- C:\Windows\System\kcvvHhS.exe
  C:\Windows\System\kcvvHhS.exe
  2⤵
  PID:8972
- C:\Windows\System\RQpimyx.exe
  C:\Windows\System\RQpimyx.exe
  2⤵
  PID:9000
- C:\Windows\System\uYQRxVD.exe
  C:\Windows\System\uYQRxVD.exe
  2⤵
  PID:9016
- C:\Windows\System\xoJUkJC.exe
  C:\Windows\System\xoJUkJC.exe
  2⤵
  PID:9040
- C:\Windows\System\jlPCmYK.exe
  C:\Windows\System\jlPCmYK.exe
  2⤵
  PID:9064
- C:\Windows\System\mNbLoOH.exe
  C:\Windows\System\mNbLoOH.exe
  2⤵
  PID:9084
- C:\Windows\System\sIoLeLl.exe
  C:\Windows\System\sIoLeLl.exe
  2⤵
  PID:9108
- C:\Windows\System\QsqckXy.exe
  C:\Windows\System\QsqckXy.exe
  2⤵
  PID:9132
- C:\Windows\System\PSjoENm.exe
  C:\Windows\System\PSjoENm.exe
  2⤵
  PID:9152
- C:\Windows\System\WXRIpwU.exe
  C:\Windows\System\WXRIpwU.exe
  2⤵
  PID:9172
- C:\Windows\System\CkniuSS.exe
  C:\Windows\System\CkniuSS.exe
  2⤵
  PID:9188
- C:\Windows\System\gssrlqj.exe
  C:\Windows\System\gssrlqj.exe
  2⤵
  PID:9204
- C:\Windows\System\qtYsEAT.exe
  C:\Windows\System\qtYsEAT.exe
  2⤵
  PID:7964
- C:\Windows\System\tRYyNrm.exe
  C:\Windows\System\tRYyNrm.exe
  2⤵
  PID:8024
- C:\Windows\System\hrhLIjr.exe
  C:\Windows\System\hrhLIjr.exe
  2⤵
  PID:8064
- C:\Windows\System\cwFCuzY.exe
  C:\Windows\System\cwFCuzY.exe
  2⤵
  PID:7144
- C:\Windows\System\qVBHILA.exe
  C:\Windows\System\qVBHILA.exe
  2⤵
  PID:6216
- C:\Windows\System\mCnQVMX.exe
  C:\Windows\System\mCnQVMX.exe
  2⤵
  PID:8160
- C:\Windows\System\FwhEQdR.exe
  C:\Windows\System\FwhEQdR.exe
  2⤵
  PID:7368
- C:\Windows\System\hSDplWi.exe
  C:\Windows\System\hSDplWi.exe
  2⤵
  PID:7380
- C:\Windows\System\WhSMWdd.exe
  C:\Windows\System\WhSMWdd.exe
  2⤵
  PID:7404
- C:\Windows\System\rAHdIpd.exe
  C:\Windows\System\rAHdIpd.exe
  2⤵
  PID:7444
- C:\Windows\System\LgwsZdJ.exe
  C:\Windows\System\LgwsZdJ.exe
  2⤵
  PID:6600
- C:\Windows\System\cFrDaiG.exe
  C:\Windows\System\cFrDaiG.exe
  2⤵
  PID:7464
- C:\Windows\System\NliEhuD.exe
  C:\Windows\System\NliEhuD.exe
  2⤵
  PID:6896
- C:\Windows\System\GSaJuzH.exe
  C:\Windows\System\GSaJuzH.exe
  2⤵
  PID:6956
- C:\Windows\System\zxQKJmq.exe
  C:\Windows\System\zxQKJmq.exe
  2⤵
  PID:5540
- C:\Windows\System\LnFGnTK.exe
  C:\Windows\System\LnFGnTK.exe
  2⤵
  PID:4788
- C:\Windows\System\XpHrNpv.exe
  C:\Windows\System\XpHrNpv.exe
  2⤵
  PID:6120
- C:\Windows\System\BZvWBNG.exe
  C:\Windows\System\BZvWBNG.exe
  2⤵
  PID:5892
- C:\Windows\System\HRiNqHy.exe
  C:\Windows\System\HRiNqHy.exe
  2⤵
  PID:6148
- C:\Windows\System\bGALwPi.exe
  C:\Windows\System\bGALwPi.exe
  2⤵
  PID:6268
- C:\Windows\System\ZMipDJI.exe
  C:\Windows\System\ZMipDJI.exe
  2⤵
  PID:7184
- C:\Windows\System\ZplWctW.exe
  C:\Windows\System\ZplWctW.exe
  2⤵
  PID:7232
- C:\Windows\System\eWWSYAN.exe
  C:\Windows\System\eWWSYAN.exe
  2⤵
  PID:8216
- C:\Windows\System\keUbncv.exe
  C:\Windows\System\keUbncv.exe
  2⤵
  PID:8004
- C:\Windows\System\eboMMFn.exe
  C:\Windows\System\eboMMFn.exe
  2⤵
  PID:8384
- C:\Windows\System\dPcZVsc.exe
  C:\Windows\System\dPcZVsc.exe
  2⤵
  PID:8132
- C:\Windows\System\hBsUhnC.exe
  C:\Windows\System\hBsUhnC.exe
  2⤵
  PID:7420
- C:\Windows\System\nJjKrkW.exe
  C:\Windows\System\nJjKrkW.exe
  2⤵
  PID:9228
- C:\Windows\System\xuEXuDV.exe
  C:\Windows\System\xuEXuDV.exe
  2⤵
  PID:9248
- C:\Windows\System\TaxvfqS.exe
  C:\Windows\System\TaxvfqS.exe
  2⤵
  PID:9268
- C:\Windows\System\qxcFyLq.exe
  C:\Windows\System\qxcFyLq.exe
  2⤵
  PID:9284
- C:\Windows\System\TKlNjSe.exe
  C:\Windows\System\TKlNjSe.exe
  2⤵
  PID:9300
- C:\Windows\System\RDnaAdt.exe
  C:\Windows\System\RDnaAdt.exe
  2⤵
  PID:9360
- C:\Windows\System\ZzvLRGT.exe
  C:\Windows\System\ZzvLRGT.exe
  2⤵
  PID:9384
- C:\Windows\System\QIRqIcd.exe
  C:\Windows\System\QIRqIcd.exe
  2⤵
  PID:9404
- C:\Windows\System\VcUUgRZ.exe
  C:\Windows\System\VcUUgRZ.exe
  2⤵
  PID:9424
- C:\Windows\System\QFWpYJc.exe
  C:\Windows\System\QFWpYJc.exe
  2⤵
  PID:9452
- C:\Windows\System\IUDlEyJ.exe
  C:\Windows\System\IUDlEyJ.exe
  2⤵
  PID:9468
- C:\Windows\System\iJHziVd.exe
  C:\Windows\System\iJHziVd.exe
  2⤵
  PID:9488
- C:\Windows\System\OwWtijX.exe
  C:\Windows\System\OwWtijX.exe
  2⤵
  PID:9516
- C:\Windows\System\nOlrdSY.exe
  C:\Windows\System\nOlrdSY.exe
  2⤵
  PID:9536
- C:\Windows\System\SKmxkuF.exe
  C:\Windows\System\SKmxkuF.exe
  2⤵
  PID:9556
- C:\Windows\System\ZjNVYqt.exe
  C:\Windows\System\ZjNVYqt.exe
  2⤵
  PID:9572
- C:\Windows\System\adqVavW.exe
  C:\Windows\System\adqVavW.exe
  2⤵
  PID:9588
- C:\Windows\System\wfpyvUB.exe
  C:\Windows\System\wfpyvUB.exe
  2⤵
  PID:9608
- C:\Windows\System\ZmWOata.exe
  C:\Windows\System\ZmWOata.exe
  2⤵
  PID:9624
- C:\Windows\System\gzVepnf.exe
  C:\Windows\System\gzVepnf.exe
  2⤵
  PID:9640
- C:\Windows\System\wmUCmmg.exe
  C:\Windows\System\wmUCmmg.exe
  2⤵
  PID:9664
- C:\Windows\System\eiefYbl.exe
  C:\Windows\System\eiefYbl.exe
  2⤵
  PID:9688
- C:\Windows\System\anipRqR.exe
  C:\Windows\System\anipRqR.exe
  2⤵
  PID:9708
- C:\Windows\System\QTNSbkt.exe
  C:\Windows\System\QTNSbkt.exe
  2⤵
  PID:9732
- C:\Windows\System\IOvwJsb.exe
  C:\Windows\System\IOvwJsb.exe
  2⤵
  PID:9756
- C:\Windows\System\cURkgzH.exe
  C:\Windows\System\cURkgzH.exe
  2⤵
  PID:9776
- C:\Windows\System\BCTmsxo.exe
  C:\Windows\System\BCTmsxo.exe
  2⤵
  PID:9800
- C:\Windows\System\wudiWVS.exe
  C:\Windows\System\wudiWVS.exe
  2⤵
  PID:9820
- C:\Windows\System\FuEYStH.exe
  C:\Windows\System\FuEYStH.exe
  2⤵
  PID:9840
- C:\Windows\System\xrQgdUd.exe
  C:\Windows\System\xrQgdUd.exe
  2⤵
  PID:9864
- C:\Windows\System\GAJXLjU.exe
  C:\Windows\System\GAJXLjU.exe
  2⤵
  PID:9880
- C:\Windows\System\yFJnOvk.exe
  C:\Windows\System\yFJnOvk.exe
  2⤵
  PID:9904
- C:\Windows\System\WgWSvKT.exe
  C:\Windows\System\WgWSvKT.exe
  2⤵
  PID:9940
- C:\Windows\System\uXVoQqb.exe
  C:\Windows\System\uXVoQqb.exe
  2⤵
  PID:9960
- C:\Windows\System\HfXZEfI.exe
  C:\Windows\System\HfXZEfI.exe
  2⤵
  PID:9984
- C:\Windows\System\nzAApVX.exe
  C:\Windows\System\nzAApVX.exe
  2⤵
  PID:10008
- C:\Windows\System\OyUCgkl.exe
  C:\Windows\System\OyUCgkl.exe
  2⤵
  PID:10024
- C:\Windows\System\JlPcPJJ.exe
  C:\Windows\System\JlPcPJJ.exe
  2⤵
  PID:10044
- C:\Windows\System\SHtQsDy.exe
  C:\Windows\System\SHtQsDy.exe
  2⤵
  PID:10064
- C:\Windows\System\GXbgWcw.exe
  C:\Windows\System\GXbgWcw.exe
  2⤵
  PID:10080
- C:\Windows\System\nhXRxRE.exe
  C:\Windows\System\nhXRxRE.exe
  2⤵
  PID:10100
- C:\Windows\System\sDIGSXr.exe
  C:\Windows\System\sDIGSXr.exe
  2⤵
  PID:10204
- C:\Windows\System\BrzVFiW.exe
  C:\Windows\System\BrzVFiW.exe
  2⤵
  PID:10224
- C:\Windows\System\rnUgDTG.exe
  C:\Windows\System\rnUgDTG.exe
  2⤵
  PID:9148
- C:\Windows\System\AesFFxm.exe
  C:\Windows\System\AesFFxm.exe
  2⤵
  PID:8312
- C:\Windows\System\GOgCOsC.exe
  C:\Windows\System\GOgCOsC.exe
  2⤵
  PID:7920
- C:\Windows\System\lFdpUZs.exe
  C:\Windows\System\lFdpUZs.exe
  2⤵
  PID:7880
- C:\Windows\System\hnTjDwA.exe
  C:\Windows\System\hnTjDwA.exe
  2⤵
  PID:7848
- C:\Windows\System\DTCIDfE.exe
  C:\Windows\System\DTCIDfE.exe
  2⤵
  PID:7760
- C:\Windows\System\komfzGo.exe
  C:\Windows\System\komfzGo.exe
  2⤵
  PID:7716
- C:\Windows\System\xDlUKYe.exe
  C:\Windows\System\xDlUKYe.exe
  2⤵
  PID:7644
- C:\Windows\System\wwPPDbc.exe
  C:\Windows\System\wwPPDbc.exe
  2⤵
  PID:7592
- C:\Windows\System\NcPCFVx.exe
  C:\Windows\System\NcPCFVx.exe
  2⤵
  PID:7532
- C:\Windows\System\khrQOOg.exe
  C:\Windows\System\khrQOOg.exe
  2⤵
  PID:7292
- C:\Windows\System\XWPCvEw.exe
  C:\Windows\System\XWPCvEw.exe
  2⤵
  PID:6668
- C:\Windows\System\CJkQgKa.exe
  C:\Windows\System\CJkQgKa.exe
  2⤵
  PID:8756
- C:\Windows\System\IhTaTUB.exe
  C:\Windows\System\IhTaTUB.exe
  2⤵
  PID:8800
- C:\Windows\System\XpQoYNo.exe
  C:\Windows\System\XpQoYNo.exe
  2⤵
  PID:8844
- C:\Windows\System\iiMTkkz.exe
  C:\Windows\System\iiMTkkz.exe
  2⤵
  PID:8888
- C:\Windows\System\TIPeVuy.exe
  C:\Windows\System\TIPeVuy.exe
  2⤵
  PID:8932
- C:\Windows\System\YDpcrAJ.exe
  C:\Windows\System\YDpcrAJ.exe
  2⤵
  PID:8968
- C:\Windows\System\mxsblKE.exe
  C:\Windows\System\mxsblKE.exe
  2⤵
  PID:8112
- C:\Windows\System\nUgfOGU.exe
  C:\Windows\System\nUgfOGU.exe
  2⤵
  PID:9048
- C:\Windows\System\Ykxhbjz.exe
  C:\Windows\System\Ykxhbjz.exe
  2⤵
  PID:6788
- C:\Windows\System\VPYDSlE.exe
  C:\Windows\System\VPYDSlE.exe
  2⤵
  PID:2216
- C:\Windows\System\lNycrrD.exe
  C:\Windows\System\lNycrrD.exe
  2⤵
  PID:4712
- C:\Windows\System\DmeeKzO.exe
  C:\Windows\System\DmeeKzO.exe
  2⤵
  PID:7364
- C:\Windows\System\xujGcau.exe
  C:\Windows\System\xujGcau.exe
  2⤵
  PID:7076
- C:\Windows\System\rsMDqxs.exe
  C:\Windows\System\rsMDqxs.exe
  2⤵
  PID:8444
- C:\Windows\System\kZSuHQD.exe
  C:\Windows\System\kZSuHQD.exe
  2⤵
  PID:10252
- C:\Windows\System\ynPxpkk.exe
  C:\Windows\System\ynPxpkk.exe
  2⤵
  PID:10276
- C:\Windows\System\bsWpJab.exe
  C:\Windows\System\bsWpJab.exe
  2⤵
  PID:10296
- C:\Windows\System\OMBpVzA.exe
  C:\Windows\System\OMBpVzA.exe
  2⤵
  PID:10324
- C:\Windows\System\PvIzlDD.exe
  C:\Windows\System\PvIzlDD.exe
  2⤵
  PID:10340
- C:\Windows\System\gyjWWfy.exe
  C:\Windows\System\gyjWWfy.exe
  2⤵
  PID:10360
- C:\Windows\System\sVPGnur.exe
  C:\Windows\System\sVPGnur.exe
  2⤵
  PID:10380
- C:\Windows\System\WHoKvFF.exe
  C:\Windows\System\WHoKvFF.exe
  2⤵
  PID:10404
- C:\Windows\System\YaQCreY.exe
  C:\Windows\System\YaQCreY.exe
  2⤵
  PID:10420
- C:\Windows\System\FyOjGzr.exe
  C:\Windows\System\FyOjGzr.exe
  2⤵
  PID:10444
- C:\Windows\System\gQotoAa.exe
  C:\Windows\System\gQotoAa.exe
  2⤵
  PID:10460
- C:\Windows\System\hwWuFmV.exe
  C:\Windows\System\hwWuFmV.exe
  2⤵
  PID:10484
- C:\Windows\System\rIdZyjk.exe
  C:\Windows\System\rIdZyjk.exe
  2⤵
  PID:10504
- C:\Windows\System\GfjbNLB.exe
  C:\Windows\System\GfjbNLB.exe
  2⤵
  PID:10532
- C:\Windows\System\TROZizQ.exe
  C:\Windows\System\TROZizQ.exe
  2⤵
  PID:10552
- C:\Windows\System\wLyYLRb.exe
  C:\Windows\System\wLyYLRb.exe
  2⤵
  PID:10584
- C:\Windows\System\zoCLlOP.exe
  C:\Windows\System\zoCLlOP.exe
  2⤵
  PID:10604
- C:\Windows\System\fpdNUfb.exe
  C:\Windows\System\fpdNUfb.exe
  2⤵
  PID:10624
- C:\Windows\System\xEDYdEy.exe
  C:\Windows\System\xEDYdEy.exe
  2⤵
  PID:10648
- C:\Windows\System\HQQtrlJ.exe
  C:\Windows\System\HQQtrlJ.exe
  2⤵
  PID:10664
- C:\Windows\System\otSGwsP.exe
  C:\Windows\System\otSGwsP.exe
  2⤵
  PID:10688
- C:\Windows\System\OZDZODv.exe
  C:\Windows\System\OZDZODv.exe
  2⤵
  PID:10716
- C:\Windows\System\ItRrzSf.exe
  C:\Windows\System\ItRrzSf.exe
  2⤵
  PID:10736
- C:\Windows\System\eIyHIID.exe
  C:\Windows\System\eIyHIID.exe
  2⤵
  PID:10764
- C:\Windows\System\foGVNRh.exe
  C:\Windows\System\foGVNRh.exe
  2⤵
  PID:10784
- C:\Windows\System\KcTATtn.exe
  C:\Windows\System\KcTATtn.exe
  2⤵
  PID:10804
- C:\Windows\System\SCswWyU.exe
  C:\Windows\System\SCswWyU.exe
  2⤵
  PID:10828
- C:\Windows\System\gfvTHdW.exe
  C:\Windows\System\gfvTHdW.exe
  2⤵
  PID:10852
- C:\Windows\System\CYJNnuL.exe
  C:\Windows\System\CYJNnuL.exe
  2⤵
  PID:10868
- C:\Windows\System\dbLnlNw.exe
  C:\Windows\System\dbLnlNw.exe
  2⤵
  PID:10896
- C:\Windows\System\PvBnySb.exe
  C:\Windows\System\PvBnySb.exe
  2⤵
  PID:10920
- C:\Windows\System\MomXtpT.exe
  C:\Windows\System\MomXtpT.exe
  2⤵
  PID:10940
- C:\Windows\System\AkWkPOA.exe
  C:\Windows\System\AkWkPOA.exe
  2⤵
  PID:10972
- C:\Windows\System\DhxhpIp.exe
  C:\Windows\System\DhxhpIp.exe
  2⤵
  PID:10996
- C:\Windows\System\QTGWKfm.exe
  C:\Windows\System\QTGWKfm.exe
  2⤵
  PID:11016
- C:\Windows\System\VsmEdXe.exe
  C:\Windows\System\VsmEdXe.exe
  2⤵
  PID:11048
- C:\Windows\System\idebjpn.exe
  C:\Windows\System\idebjpn.exe
  2⤵
  PID:11064
- C:\Windows\System\mIsiEuV.exe
  C:\Windows\System\mIsiEuV.exe
  2⤵
  PID:11092
- C:\Windows\System\hcnnEyx.exe
  C:\Windows\System\hcnnEyx.exe
  2⤵
  PID:11124
- C:\Windows\System\RyTvEiK.exe
  C:\Windows\System\RyTvEiK.exe
  2⤵
  PID:11140
- C:\Windows\System\CVpPqAN.exe
  C:\Windows\System\CVpPqAN.exe
  2⤵
  PID:11164
- C:\Windows\System\GNHVQSB.exe
  C:\Windows\System\GNHVQSB.exe
  2⤵
  PID:11196
- C:\Windows\System\gLPgtiz.exe
  C:\Windows\System\gLPgtiz.exe
  2⤵
  PID:11216
- C:\Windows\System\xnxQisB.exe
  C:\Windows\System\xnxQisB.exe
  2⤵
  PID:11236
- C:\Windows\System\nbjQAYV.exe
  C:\Windows\System\nbjQAYV.exe
  2⤵
  PID:11252
- C:\Windows\System\tItcAXt.exe
  C:\Windows\System\tItcAXt.exe
  2⤵
  PID:9460
- C:\Windows\System\glCXysg.exe
  C:\Windows\System\glCXysg.exe
  2⤵
  PID:9532
- C:\Windows\System\stofxNQ.exe
  C:\Windows\System\stofxNQ.exe
  2⤵
  PID:10092
- C:\Windows\System\KTvNnbL.exe
  C:\Windows\System\KTvNnbL.exe
  2⤵
  PID:8504
- C:\Windows\System\UFOafHf.exe
  C:\Windows\System\UFOafHf.exe
  2⤵
  PID:8684
- C:\Windows\System\yWghdfj.exe
  C:\Windows\System\yWghdfj.exe
  2⤵
  PID:8644
- C:\Windows\System\EnFVLVS.exe
  C:\Windows\System\EnFVLVS.exe
  2⤵
  PID:8608
- C:\Windows\System\CCUNYsU.exe
  C:\Windows\System\CCUNYsU.exe
  2⤵
  PID:8572
- C:\Windows\System\fDRaPpM.exe
  C:\Windows\System\fDRaPpM.exe
  2⤵
  PID:8528
- C:\Windows\System\fVXXDxQ.exe
  C:\Windows\System\fVXXDxQ.exe
  2⤵
  PID:8740
- C:\Windows\System\ebjwxik.exe
  C:\Windows\System\ebjwxik.exe
  2⤵
  PID:9116
- C:\Windows\System\NhDWAPM.exe
  C:\Windows\System\NhDWAPM.exe
  2⤵
  PID:7864
- C:\Windows\System\DsQZlwd.exe
  C:\Windows\System\DsQZlwd.exe
  2⤵
  PID:7980
- C:\Windows\System\xkBbMJx.exe
  C:\Windows\System\xkBbMJx.exe
  2⤵
  PID:7132
- C:\Windows\System\KPAhizQ.exe
  C:\Windows\System\KPAhizQ.exe
  2⤵
  PID:8172
- C:\Windows\System\xUEekOe.exe
  C:\Windows\System\xUEekOe.exe
  2⤵
  PID:6548
- C:\Windows\System\XWBDHRS.exe
  C:\Windows\System\XWBDHRS.exe
  2⤵
  PID:1724
- C:\Windows\System\zayevjU.exe
  C:\Windows\System\zayevjU.exe
  2⤵
  PID:3396
- C:\Windows\System\hCdHTIy.exe
  C:\Windows\System\hCdHTIy.exe
  2⤵
  PID:1068
- C:\Windows\System\NZSdgXI.exe
  C:\Windows\System\NZSdgXI.exe
  2⤵
  PID:5704
- C:\Windows\System\CFLKmnT.exe
  C:\Windows\System\CFLKmnT.exe
  2⤵
  PID:7180
- C:\Windows\System\oUFqtDI.exe
  C:\Windows\System\oUFqtDI.exe
  2⤵
  PID:10332
- C:\Windows\System\mqGWctG.exe
  C:\Windows\System\mqGWctG.exe
  2⤵
  PID:9616
- C:\Windows\System\ZtZuKDm.exe
  C:\Windows\System\ZtZuKDm.exe
  2⤵
  PID:9676
- C:\Windows\System\BqiFHPv.exe
  C:\Windows\System\BqiFHPv.exe
  2⤵
  PID:9812
- C:\Windows\System\NgaeMfH.exe
  C:\Windows\System\NgaeMfH.exe
  2⤵
  PID:9872
- C:\Windows\System\jNAkoig.exe
  C:\Windows\System\jNAkoig.exe
  2⤵
  PID:10728
- C:\Windows\System\NBYFWvK.exe
  C:\Windows\System\NBYFWvK.exe
  2⤵
  PID:9956
- C:\Windows\System\gdCJVsU.exe
  C:\Windows\System\gdCJVsU.exe
  2⤵
  PID:10016
- C:\Windows\System\bXuWjRw.exe
  C:\Windows\System\bXuWjRw.exe
  2⤵
  PID:11284
- C:\Windows\System\KGFuopT.exe
  C:\Windows\System\KGFuopT.exe
  2⤵
  PID:11308
- C:\Windows\System\jKUHhMC.exe
  C:\Windows\System\jKUHhMC.exe
  2⤵
  PID:11332
- C:\Windows\System\xBXbnLM.exe
  C:\Windows\System\xBXbnLM.exe
  2⤵
  PID:11352
- C:\Windows\System\EKTvzJL.exe
  C:\Windows\System\EKTvzJL.exe
  2⤵
  PID:11372
- C:\Windows\System\mMlMfyH.exe
  C:\Windows\System\mMlMfyH.exe
  2⤵
  PID:11396
- C:\Windows\System\ormgnqf.exe
  C:\Windows\System\ormgnqf.exe
  2⤵
  PID:11416
- C:\Windows\System\IlBRgwI.exe
  C:\Windows\System\IlBRgwI.exe
  2⤵
  PID:11436
- C:\Windows\System\stSvmCK.exe
  C:\Windows\System\stSvmCK.exe
  2⤵
  PID:11460
- C:\Windows\System\tKIeBqh.exe
  C:\Windows\System\tKIeBqh.exe
  2⤵
  PID:11484
- C:\Windows\System\xvaSTkg.exe
  C:\Windows\System\xvaSTkg.exe
  2⤵
  PID:11500
- C:\Windows\System\JIJFezm.exe
  C:\Windows\System\JIJFezm.exe
  2⤵
  PID:11528
- C:\Windows\System\cctjWPX.exe
  C:\Windows\System\cctjWPX.exe
  2⤵
  PID:11548
- C:\Windows\System\dvBHoNP.exe
  C:\Windows\System\dvBHoNP.exe
  2⤵
  PID:11576
- C:\Windows\System\MTLqSvw.exe
  C:\Windows\System\MTLqSvw.exe
  2⤵
  PID:11596
- C:\Windows\System\MkyfUvv.exe
  C:\Windows\System\MkyfUvv.exe
  2⤵
  PID:11616
- C:\Windows\System\IYNvdTP.exe
  C:\Windows\System\IYNvdTP.exe
  2⤵
  PID:11640
- C:\Windows\System\UIjEcxH.exe
  C:\Windows\System\UIjEcxH.exe
  2⤵
  PID:11664
- C:\Windows\System\XJnFuUk.exe
  C:\Windows\System\XJnFuUk.exe
  2⤵
  PID:11680
- C:\Windows\System\dXNDGtw.exe
  C:\Windows\System\dXNDGtw.exe
  2⤵
  PID:11704
- C:\Windows\System\fDuhnag.exe
  C:\Windows\System\fDuhnag.exe
  2⤵
  PID:11724
- C:\Windows\System\MrOOKFZ.exe
  C:\Windows\System\MrOOKFZ.exe
  2⤵
  PID:11744
- C:\Windows\System\dddDRIi.exe
  C:\Windows\System\dddDRIi.exe
  2⤵
  PID:11768
- C:\Windows\System\SRyOrep.exe
  C:\Windows\System\SRyOrep.exe
  2⤵
  PID:11792
- C:\Windows\System\HjIGiZX.exe
  C:\Windows\System\HjIGiZX.exe
  2⤵
  PID:11812
- C:\Windows\System\PCQemhL.exe
  C:\Windows\System\PCQemhL.exe
  2⤵
  PID:11836
- C:\Windows\System\iLxBbbK.exe
  C:\Windows\System\iLxBbbK.exe
  2⤵
  PID:11860
- C:\Windows\System\fpwWHlU.exe
  C:\Windows\System\fpwWHlU.exe
  2⤵
  PID:11880
- C:\Windows\System\BonyWyN.exe
  C:\Windows\System\BonyWyN.exe
  2⤵
  PID:11900
- C:\Windows\System\XQkumSD.exe
  C:\Windows\System\XQkumSD.exe
  2⤵
  PID:11920
- C:\Windows\System\cXzYElu.exe
  C:\Windows\System\cXzYElu.exe
  2⤵
  PID:11964
- C:\Windows\System\GDNFyEc.exe
  C:\Windows\System\GDNFyEc.exe
  2⤵
  PID:11984
- C:\Windows\System\xfBmxOD.exe
  C:\Windows\System\xfBmxOD.exe
  2⤵
  PID:12004
- C:\Windows\System\iuZoXCX.exe
  C:\Windows\System\iuZoXCX.exe
  2⤵
  PID:12020
- C:\Windows\System\IzLndxF.exe
  C:\Windows\System\IzLndxF.exe
  2⤵
  PID:12044
- C:\Windows\System\HWgrGlV.exe
  C:\Windows\System\HWgrGlV.exe
  2⤵
  PID:12068
- C:\Windows\System\vJBrKOF.exe
  C:\Windows\System\vJBrKOF.exe
  2⤵
  PID:12084
- C:\Windows\System\UjGSdIf.exe
  C:\Windows\System\UjGSdIf.exe
  2⤵
  PID:12104
- C:\Windows\System\uYTxBFc.exe
  C:\Windows\System\uYTxBFc.exe
  2⤵
  PID:12124
- C:\Windows\System\sOJKcSV.exe
  C:\Windows\System\sOJKcSV.exe
  2⤵
  PID:12140
- C:\Windows\System\PcXTyWk.exe
  C:\Windows\System\PcXTyWk.exe
  2⤵
  PID:12160
- C:\Windows\System\oAovBPV.exe
  C:\Windows\System\oAovBPV.exe
  2⤵
  PID:12176
- C:\Windows\System\GYzonBl.exe
  C:\Windows\System\GYzonBl.exe
  2⤵
  PID:12192
- C:\Windows\System\aVMDVFV.exe
  C:\Windows\System\aVMDVFV.exe
  2⤵
  PID:12212
- C:\Windows\System\zlIDmpc.exe
  C:\Windows\System\zlIDmpc.exe
  2⤵
  PID:12228
- C:\Windows\System\ZVgBrnW.exe
  C:\Windows\System\ZVgBrnW.exe
  2⤵
  PID:12252
- C:\Windows\System\bfzcgNd.exe
  C:\Windows\System\bfzcgNd.exe
  2⤵
  PID:12272
- C:\Windows\System\nPIXpzN.exe
  C:\Windows\System\nPIXpzN.exe
  2⤵
  PID:10056
- C:\Windows\System\WszjsdO.exe
  C:\Windows\System\WszjsdO.exe
  2⤵
  PID:10888
- C:\Windows\System\WugyQlm.exe
  C:\Windows\System\WugyQlm.exe
  2⤵
  PID:10132
- C:\Windows\System\nMvWELp.exe
  C:\Windows\System\nMvWELp.exe
  2⤵
  PID:11036
- C:\Windows\System\FTqCfrv.exe
  C:\Windows\System\FTqCfrv.exe
  2⤵
  PID:7892
- C:\Windows\System\EBNavAV.exe
  C:\Windows\System\EBNavAV.exe
  2⤵
  PID:9244
- C:\Windows\System\zRYcYId.exe
  C:\Windows\System\zRYcYId.exe
  2⤵
  PID:9280
- C:\Windows\System\uwZxOsm.exe
  C:\Windows\System\uwZxOsm.exe
  2⤵
  PID:4036
- C:\Windows\System\hjIvUnB.exe
  C:\Windows\System\hjIvUnB.exe
  2⤵
  PID:9368
- C:\Windows\System\FJtZxKS.exe
  C:\Windows\System\FJtZxKS.exe
  2⤵
  PID:9420
- C:\Windows\System\hIqaYwB.exe
  C:\Windows\System\hIqaYwB.exe
  2⤵
  PID:9552
- C:\Windows\System\jkocRlq.exe
  C:\Windows\System\jkocRlq.exe
  2⤵
  PID:9580
- C:\Windows\System\jejBTBM.exe
  C:\Windows\System\jejBTBM.exe
  2⤵
  PID:9164
- C:\Windows\System\JJpxndt.exe
  C:\Windows\System\JJpxndt.exe
  2⤵
  PID:12304
- C:\Windows\System\qdutIGa.exe
  C:\Windows\System\qdutIGa.exe
  2⤵
  PID:12324
- C:\Windows\System\VSTzCgW.exe
  C:\Windows\System\VSTzCgW.exe
  2⤵
  PID:12348
- C:\Windows\System\uOXzNOO.exe
  C:\Windows\System\uOXzNOO.exe
  2⤵
  PID:12372
- C:\Windows\System\gVRhNgN.exe
  C:\Windows\System\gVRhNgN.exe
  2⤵
  PID:12400
- C:\Windows\System\HqFqleK.exe
  C:\Windows\System\HqFqleK.exe
  2⤵
  PID:12420
- C:\Windows\System\sgdqDZx.exe
  C:\Windows\System\sgdqDZx.exe
  2⤵
  PID:12440
- C:\Windows\System\JjBIMWI.exe
  C:\Windows\System\JjBIMWI.exe
  2⤵
  PID:12464
- C:\Windows\System\Jxogdns.exe
  C:\Windows\System\Jxogdns.exe
  2⤵
  PID:12484
- C:\Windows\System\MDzufHS.exe
  C:\Windows\System\MDzufHS.exe
  2⤵
  PID:12508
- C:\Windows\System\HmPUyCp.exe
  C:\Windows\System\HmPUyCp.exe
  2⤵
  PID:12532
- C:\Windows\System\swMVOuf.exe
  C:\Windows\System\swMVOuf.exe
  2⤵
  PID:12552
- C:\Windows\System\EvjUGnP.exe
  C:\Windows\System\EvjUGnP.exe
  2⤵
  PID:12572
- C:\Windows\System\ROhOqAj.exe
  C:\Windows\System\ROhOqAj.exe
  2⤵
  PID:12600
- C:\Windows\System\UJLACuU.exe
  C:\Windows\System\UJLACuU.exe
  2⤵
  PID:12616
- C:\Windows\System\EMdSKKZ.exe
  C:\Windows\System\EMdSKKZ.exe
  2⤵
  PID:12644
- C:\Windows\System\DtmTmtQ.exe
  C:\Windows\System\DtmTmtQ.exe
  2⤵
  PID:12668
- C:\Windows\System\cnHpnlc.exe
  C:\Windows\System\cnHpnlc.exe
  2⤵
  PID:12684
- C:\Windows\System\bxhGNdI.exe
  C:\Windows\System\bxhGNdI.exe
  2⤵
  PID:12704
- C:\Windows\System\NSErLPO.exe
  C:\Windows\System\NSErLPO.exe
  2⤵
  PID:12728
- C:\Windows\System\qzwLmXD.exe
  C:\Windows\System\qzwLmXD.exe
  2⤵
  PID:12748
- C:\Windows\System\UoMlSyK.exe
  C:\Windows\System\UoMlSyK.exe
  2⤵
  PID:12784
- C:\Windows\System\VkHFfdh.exe
  C:\Windows\System\VkHFfdh.exe
  2⤵
  PID:12816
- C:\Windows\System\pVNIqrh.exe
  C:\Windows\System\pVNIqrh.exe
  2⤵
  PID:12832
- C:\Windows\System\RpUuaQT.exe
  C:\Windows\System\RpUuaQT.exe
  2⤵
  PID:12868
- C:\Windows\System\hyoGvTk.exe
  C:\Windows\System\hyoGvTk.exe
  2⤵
  PID:12884
- C:\Windows\System\dptiPjm.exe
  C:\Windows\System\dptiPjm.exe
  2⤵
  PID:12908
- C:\Windows\System\yZluKiF.exe
  C:\Windows\System\yZluKiF.exe
  2⤵
  PID:8148
- C:\Windows\System\lMYDtQg.exe
  C:\Windows\System\lMYDtQg.exe
  2⤵
  PID:10904
- C:\Windows\System\VAMjUyy.exe
  C:\Windows\System\VAMjUyy.exe
  2⤵
  PID:11588
- C:\Windows\System\CGPqbSz.exe
  C:\Windows\System\CGPqbSz.exe
  2⤵
  PID:7500
- C:\Windows\System\KfIOjrH.exe
  C:\Windows\System\KfIOjrH.exe
  2⤵
  PID:12112
- C:\Windows\System\osZvqzQ.exe
  C:\Windows\System\osZvqzQ.exe
  2⤵
  PID:12244
- C:\Windows\System\ZklSwup.exe
  C:\Windows\System\ZklSwup.exe
  2⤵
  PID:12284
- C:\Windows\System\lbaCaup.exe
  C:\Windows\System\lbaCaup.exe
  2⤵
  PID:7808
- C:\Windows\System\EKHQDRD.exe
  C:\Windows\System\EKHQDRD.exe
  2⤵
  PID:7736
- C:\Windows\System\YpYxzOb.exe
  C:\Windows\System\YpYxzOb.exe
  2⤵
  PID:7656
- C:\Windows\System\efzPlhZ.exe
  C:\Windows\System\efzPlhZ.exe
  2⤵
  PID:7604
- C:\Windows\System\sZmGCDX.exe
  C:\Windows\System\sZmGCDX.exe
  2⤵
  PID:7516
- C:\Windows\System\WznTugI.exe
  C:\Windows\System\WznTugI.exe
  2⤵
  PID:8488
- C:\Windows\System\WyvuoWi.exe
  C:\Windows\System\WyvuoWi.exe
  2⤵
  PID:8460
- C:\Windows\System\fQRYBVl.exe
  C:\Windows\System\fQRYBVl.exe
  2⤵
  PID:11472
- C:\Windows\System\fbNYBKg.exe
  C:\Windows\System\fbNYBKg.exe
  2⤵
  PID:13080
- C:\Windows\System\GogrEdW.exe
  C:\Windows\System\GogrEdW.exe
  2⤵
  PID:11828
- C:\Windows\System\WHnFLbD.exe
  C:\Windows\System\WHnFLbD.exe
  2⤵
  PID:11208
- C:\Windows\System\ZhDDkNm.exe
  C:\Windows\System\ZhDDkNm.exe
  2⤵
  PID:1212
- C:\Windows\System\LVlPiDN.exe
  C:\Windows\System\LVlPiDN.exe
  2⤵
  PID:13196
- C:\Windows\System\NtYhPda.exe
  C:\Windows\System\NtYhPda.exe
  2⤵
  PID:13232
- C:\Windows\System\mcgEfkN.exe
  C:\Windows\System\mcgEfkN.exe
  2⤵
  PID:13284
- C:\Windows\System\gouxOVm.exe
  C:\Windows\System\gouxOVm.exe
  2⤵
  PID:10148
- C:\Windows\System\bPxKHXF.exe
  C:\Windows\System\bPxKHXF.exe
  2⤵
  PID:8668
- C:\Windows\System\MtWHahF.exe
  C:\Windows\System\MtWHahF.exe
  2⤵
  PID:12220
- C:\Windows\System\UZvDLLR.exe
  C:\Windows\System\UZvDLLR.exe
  2⤵
  PID:11992
- C:\Windows\System\mTCtRqW.exe
  C:\Windows\System\mTCtRqW.exe
  2⤵
  PID:10184
- C:\Windows\System\lmQiwRs.exe
  C:\Windows\System\lmQiwRs.exe
  2⤵
  PID:8472
- C:\Windows\System\YGWrWFz.exe
  C:\Windows\System\YGWrWFz.exe
  2⤵
  PID:9260
- C:\Windows\System\NjYjwRn.exe
  C:\Windows\System\NjYjwRn.exe
  2⤵
  PID:12340
- C:\Windows\System\YFmmFYT.exe
  C:\Windows\System\YFmmFYT.exe
  2⤵
  PID:12408
- C:\Windows\System\hOIaFkO.exe
  C:\Windows\System\hOIaFkO.exe
  2⤵
  PID:12452
- C:\Windows\System\dYllbvq.exe
  C:\Windows\System\dYllbvq.exe
  2⤵
  PID:12504
- C:\Windows\System\ozcBvTj.exe
  C:\Windows\System\ozcBvTj.exe
  2⤵
  PID:12548
- C:\Windows\System\zsRJJcU.exe
  C:\Windows\System\zsRJJcU.exe
  2⤵
  PID:12580
- C:\Windows\System\NSzdryK.exe
  C:\Windows\System\NSzdryK.exe
  2⤵
  PID:12652
- C:\Windows\System\jDvKfjY.exe
  C:\Windows\System\jDvKfjY.exe
  2⤵
  PID:12700
- C:\Windows\System\jnPJyON.exe
  C:\Windows\System\jnPJyON.exe
  2⤵
  PID:12804
- C:\Windows\System\jvMEACc.exe
  C:\Windows\System\jvMEACc.exe
  2⤵
  PID:12896
- C:\Windows\System\GTxvLgn.exe
  C:\Windows\System\GTxvLgn.exe
  2⤵
  PID:12932
- C:\Windows\System\jygBPfH.exe
  C:\Windows\System\jygBPfH.exe
  2⤵
  PID:12956
- C:\Windows\System\putEPqj.exe
  C:\Windows\System\putEPqj.exe
  2⤵
  PID:12992
- C:\Windows\System\fHaPLNJ.exe
  C:\Windows\System\fHaPLNJ.exe
  2⤵
  PID:13096
- C:\Windows\System\svOgIKP.exe
  C:\Windows\System\svOgIKP.exe
  2⤵
  PID:10124
- C:\Windows\System\tOaxRyJ.exe
  C:\Windows\System\tOaxRyJ.exe
  2⤵
  PID:2356
- C:\Windows\System\QdSwszV.exe
  C:\Windows\System\QdSwszV.exe
  2⤵
  PID:3320
- C:\Windows\System\WwkvFUP.exe
  C:\Windows\System\WwkvFUP.exe
  2⤵
  PID:9764
- C:\Windows\System\MCslLcb.exe
  C:\Windows\System\MCslLcb.exe
  2⤵
  PID:10748
- C:\Windows\System\frIqrum.exe
  C:\Windows\System\frIqrum.exe
  2⤵
  PID:13304
- C:\Windows\System\aiCHxIr.exe
  C:\Windows\System\aiCHxIr.exe
  2⤵
  PID:10936
- C:\Windows\System\SndKKKs.exe
  C:\Windows\System\SndKKKs.exe
  2⤵
  PID:10968
- C:\Windows\System\YNrEfFb.exe
  C:\Windows\System\YNrEfFb.exe
  2⤵
  PID:11148
- C:\Windows\System\iVxText.exe
  C:\Windows\System\iVxText.exe
  2⤵
  PID:12040
- C:\Windows\System\Cefbdnm.exe
  C:\Windows\System\Cefbdnm.exe
  2⤵
  PID:10436
- C:\Windows\System\MURAlth.exe
  C:\Windows\System\MURAlth.exe
  2⤵
  PID:10452
- C:\Windows\System\fUCegqH.exe
  C:\Windows\System\fUCegqH.exe
  2⤵
  PID:6628
- C:\Windows\System\JRzGyPe.exe
  C:\Windows\System\JRzGyPe.exe
  2⤵
  PID:12268
- C:\Windows\System\OrFVGMc.exe
  C:\Windows\System\OrFVGMc.exe
  2⤵
  PID:4264
- C:\Windows\System\eiGMfGx.exe
  C:\Windows\System\eiGMfGx.exe
  2⤵
  PID:7628
- C:\Windows\System\OAXeljg.exe
  C:\Windows\System\OAXeljg.exe
  2⤵
  PID:7036
- C:\Windows\System\svMReYa.exe
  C:\Windows\System\svMReYa.exe
  2⤵
  PID:2460
- C:\Windows\System\oHaEvaV.exe
  C:\Windows\System\oHaEvaV.exe
  2⤵
  PID:1964
- C:\Windows\System\ZQdqYZU.exe
  C:\Windows\System\ZQdqYZU.exe
  2⤵
  PID:8992
- C:\Windows\System\bDCCOBI.exe
  C:\Windows\System\bDCCOBI.exe
  2⤵
  PID:4656
- C:\Windows\System\IpfrAPs.exe
  C:\Windows\System\IpfrAPs.exe
  2⤵
  PID:12312
- C:\Windows\System\KuDkRba.exe
  C:\Windows\System\KuDkRba.exe
  2⤵
  PID:10356
- C:\Windows\System\XYSuqbi.exe
  C:\Windows\System\XYSuqbi.exe
  2⤵
  PID:4236
- C:\Windows\System\rivfaeJ.exe
  C:\Windows\System\rivfaeJ.exe
  2⤵
  PID:6176
- C:\Windows\System\tmwlaWC.exe
  C:\Windows\System\tmwlaWC.exe
  2⤵
  PID:3884
- C:\Windows\System\yUYVBaH.exe
  C:\Windows\System\yUYVBaH.exe
  2⤵
  PID:2016
- C:\Windows\System\EFEArZf.exe
  C:\Windows\System\EFEArZf.exe
  2⤵
  PID:8552
- C:\Windows\System\rVBgNvW.exe
  C:\Windows\System\rVBgNvW.exe
  2⤵
  PID:7172
- C:\Windows\System\YaBJDom.exe
  C:\Windows\System\YaBJDom.exe
  2⤵
  PID:10684
- C:\Windows\System\dhHrwsU.exe
  C:\Windows\System\dhHrwsU.exe
  2⤵
  PID:10020
- C:\Windows\System\TLcmZhf.exe
  C:\Windows\System\TLcmZhf.exe
  2⤵
  PID:10840
- C:\Windows\System\SlzobOX.exe
  C:\Windows\System\SlzobOX.exe
  2⤵
  PID:4792
- C:\Windows\System\eNGwCeZ.exe
  C:\Windows\System\eNGwCeZ.exe
  2⤵
  PID:8984
- C:\Windows\System\UyxDYvm.exe
  C:\Windows\System\UyxDYvm.exe
  2⤵
  PID:2672
- C:\Windows\System\qIWYcpp.exe
  C:\Windows\System\qIWYcpp.exe
  2⤵
  PID:10576
- C:\Windows\System\CUXGYNx.exe
  C:\Windows\System\CUXGYNx.exe
  2⤵
  PID:9900
- C:\Windows\System\ZFkZXLZ.exe
  C:\Windows\System\ZFkZXLZ.exe
  2⤵
  PID:11832
- C:\Windows\System\hevHYGa.exe
  C:\Windows\System\hevHYGa.exe
  2⤵
  PID:8732
- C:\Windows\System\wnxShEL.exe
  C:\Windows\System\wnxShEL.exe
  2⤵
  PID:10416
- C:\Windows\System\ahtSdbe.exe
  C:\Windows\System\ahtSdbe.exe
  2⤵
  PID:12184
- C:\Windows\System\QiizdYX.exe
  C:\Windows\System\QiizdYX.exe
  2⤵
  PID:13476
- C:\Windows\System\cuuvftw.exe
  C:\Windows\System\cuuvftw.exe
  2⤵
  PID:13544
- C:\Windows\System\jobCVTj.exe
  C:\Windows\System\jobCVTj.exe
  2⤵
  PID:13580
- C:\Windows\System\WaEzbMW.exe
  C:\Windows\System\WaEzbMW.exe
  2⤵
  PID:13596
- C:\Windows\System\yGHUlUF.exe
  C:\Windows\System\yGHUlUF.exe
  2⤵
  PID:13724
- C:\Windows\System\UTKZzfK.exe
  C:\Windows\System\UTKZzfK.exe
  2⤵
  PID:13740
- C:\Windows\System\mUzCoQM.exe
  C:\Windows\System\mUzCoQM.exe
  2⤵
  PID:13772
- C:\Windows\System\fnTGtoh.exe
  C:\Windows\System\fnTGtoh.exe
  2⤵
  PID:13796
- C:\Windows\System\ZjbpHeJ.exe
  C:\Windows\System\ZjbpHeJ.exe
  2⤵
  PID:13816
- C:\Windows\System\lzeQqyd.exe
  C:\Windows\System\lzeQqyd.exe
  2⤵
  PID:13836
- C:\Windows\System\UHKewQL.exe
  C:\Windows\System\UHKewQL.exe
  2⤵
  PID:13856
- C:\Windows\System\gMoBwxI.exe
  C:\Windows\System\gMoBwxI.exe
  2⤵
  PID:13948
- C:\Windows\System\NMOUDQH.exe
  C:\Windows\System\NMOUDQH.exe
  2⤵
  PID:14000
- C:\Windows\System\XUZXYFJ.exe
  C:\Windows\System\XUZXYFJ.exe
  2⤵
  PID:14020
- C:\Windows\System\GFIUmPR.exe
  C:\Windows\System\GFIUmPR.exe
  2⤵
  PID:14100
- C:\Windows\System\mAqdjLX.exe
  C:\Windows\System\mAqdjLX.exe
  2⤵
  PID:14244
- C:\Windows\System\PpewIRC.exe
  C:\Windows\System\PpewIRC.exe
  2⤵
  PID:14264
- C:\Windows\System\AdWULXo.exe
  C:\Windows\System\AdWULXo.exe
  2⤵
  PID:14292
- C:\Windows\System\hifTNpt.exe
  C:\Windows\System\hifTNpt.exe
  2⤵
  PID:4668
- C:\Windows\System\rKCPgLu.exe
  C:\Windows\System\rKCPgLu.exe
  2⤵
  PID:10644
- C:\Windows\System\rUJAfkr.exe
  C:\Windows\System\rUJAfkr.exe
  2⤵
  PID:12740
- C:\Windows\System\hPlZXdo.exe
  C:\Windows\System\hPlZXdo.exe
  2⤵
  PID:12980
- C:\Windows\System\BrmuXZa.exe
  C:\Windows\System\BrmuXZa.exe
  2⤵
  PID:13044
- C:\Windows\System\GPJoHpx.exe
  C:\Windows\System\GPJoHpx.exe
  2⤵
  PID:13072
- C:\Windows\System\hgJeQcP.exe
  C:\Windows\System\hgJeQcP.exe
  2⤵
  PID:11056
- C:\Windows\System\RmcIQNH.exe
  C:\Windows\System\RmcIQNH.exe
  2⤵
  PID:11776
- C:\Windows\System\FLZIXYq.exe
  C:\Windows\System\FLZIXYq.exe
  2⤵
  PID:13420
- C:\Windows\System\ZdWTSax.exe
  C:\Windows\System\ZdWTSax.exe
  2⤵
  PID:8612
- C:\Windows\System\VSKrQRJ.exe
  C:\Windows\System\VSKrQRJ.exe
  2⤵
  PID:4548
- C:\Windows\System\WqiObIK.exe
  C:\Windows\System\WqiObIK.exe
  2⤵
  PID:13704
- C:\Windows\System\HPgDTaL.exe
  C:\Windows\System\HPgDTaL.exe
  2⤵
  PID:9836
- C:\Windows\System\MGLbTbA.exe
  C:\Windows\System\MGLbTbA.exe
  2⤵
  PID:14332
- C:\Windows\System\WxbySne.exe
  C:\Windows\System\WxbySne.exe
  2⤵
  PID:12916
- C:\Windows\System\aDxiTnG.exe
  C:\Windows\System\aDxiTnG.exe
  2⤵
  PID:12968
- C:\Windows\System\VtcsUDg.exe
  C:\Windows\System\VtcsUDg.exe
  2⤵
  PID:4268
- C:\Windows\System\fxYsWvG.exe
  C:\Windows\System\fxYsWvG.exe
  2⤵
  PID:13680
- C:\Windows\System\wnKbTyM.exe
  C:\Windows\System\wnKbTyM.exe
  2⤵
  PID:12528
- C:\Windows\System\UqpMVzG.exe
  C:\Windows\System\UqpMVzG.exe
  2⤵
  PID:14236
- C:\Windows\System\TsyCPMO.exe
  C:\Windows\System\TsyCPMO.exe
  2⤵
  PID:13380
- C:\Windows\System\lLIHxKL.exe
  C:\Windows\System\lLIHxKL.exe
  2⤵
  PID:13904
- C:\Windows\System\VEkmqng.exe
  C:\Windows\System\VEkmqng.exe
  2⤵
  PID:13944
- C:\Windows\System\cGlICcw.exe
  C:\Windows\System\cGlICcw.exe
  2⤵
  PID:13388
- C:\Windows\System\wKEFOuP.exe
  C:\Windows\System\wKEFOuP.exe
  2⤵
  PID:13520
- C:\Windows\System\NFLNTlL.exe
  C:\Windows\System\NFLNTlL.exe
  2⤵
  PID:14040
- C:\Windows\System\tbOwfzW.exe
  C:\Windows\System\tbOwfzW.exe
  2⤵
  PID:10660
- C:\Windows\System\nDQvBWx.exe
  C:\Windows\System\nDQvBWx.exe
  2⤵
  PID:13640
- C:\Windows\System\kjajlvp.exe
  C:\Windows\System\kjajlvp.exe
  2⤵
  PID:14172
- C:\Windows\System\iPyBgmA.exe
  C:\Windows\System\iPyBgmA.exe
  2⤵
  PID:4812
- C:\Windows\System\XwAgluR.exe
  C:\Windows\System\XwAgluR.exe
  2⤵
  PID:14152
- C:\Windows\System\KgFHhrF.exe
  C:\Windows\System\KgFHhrF.exe
  2⤵
  PID:14060
- C:\Windows\System\NycIzUH.exe
  C:\Windows\System\NycIzUH.exe
  2⤵
  PID:13300
- C:\Windows\System\kktxxBz.exe
  C:\Windows\System\kktxxBz.exe
  2⤵
  PID:10480
- C:\Windows\System\anPpFUF.exe
  C:\Windows\System\anPpFUF.exe
  2⤵
  PID:4244
- C:\Windows\System\BSCoBKC.exe
  C:\Windows\System\BSCoBKC.exe
  2⤵
  PID:10352
- C:\Windows\System\oXYhqwv.exe
  C:\Windows\System\oXYhqwv.exe
  2⤵
  PID:11612
- C:\Windows\System\NTvPhDy.exe
  C:\Windows\System\NTvPhDy.exe
  2⤵
  PID:13360
- C:\Windows\System\VigqOLg.exe
  C:\Windows\System\VigqOLg.exe
  2⤵
  PID:8884
- C:\Windows\System\cOFkEGn.exe
  C:\Windows\System\cOFkEGn.exe
  2⤵
  PID:916
- C:\Windows\System\jfePJQe.exe
  C:\Windows\System\jfePJQe.exe
  2⤵
  PID:11292
- C:\Windows\System\cbKrvIW.exe
  C:\Windows\System\cbKrvIW.exe
  2⤵
  PID:9348
- C:\Windows\System\gjNYWBU.exe
  C:\Windows\System\gjNYWBU.exe
  2⤵
  PID:13488
- C:\Windows\System\yknOsJy.exe
  C:\Windows\System\yknOsJy.exe
  2⤵
  PID:12168
- C:\Windows\System\koyXsZQ.exe
  C:\Windows\System\koyXsZQ.exe
  2⤵
  PID:13824
- C:\Windows\System\yWzIfQe.exe
  C:\Windows\System\yWzIfQe.exe
  2⤵
  PID:12064
- C:\Windows\System\lkmZTJx.exe
  C:\Windows\System\lkmZTJx.exe
  2⤵
  PID:13276
- C:\Windows\System\fztrzyH.exe
  C:\Windows\System\fztrzyH.exe
  2⤵
  PID:2680
- C:\Windows\System\PjHyxzM.exe
  C:\Windows\System\PjHyxzM.exe
  2⤵
  PID:13992
- C:\Windows\System\KHSbRHL.exe
  C:\Windows\System\KHSbRHL.exe
  2⤵
  PID:13508
- C:\Windows\System\WpfBCtW.exe
  C:\Windows\System\WpfBCtW.exe
  2⤵
  PID:13752
- C:\Windows\System\tykbfZW.exe
  C:\Windows\System\tykbfZW.exe
  2⤵
  PID:14140
- C:\Windows\System\FERVpnv.exe
  C:\Windows\System\FERVpnv.exe
  2⤵
  PID:14224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_noxj1ozu.450.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ANcctmD.exe

Filesize
1.7MB

MD5
1bcfef2d32a413b8ce526c575193d085

SHA1
e2003bb0644b62cb92229c4e17e362e6a6c12249

SHA256
391e17f670608d61175bd6b38e4b1f03b9b2e6124203507488f1d01af4da2c11

SHA512
a783e9f580e9e558850866578bad72db181a733a500ad20d63f808077deb9a1216ee89413efe971eecabbc35c1fac9c3fd511724acc7601e1b447cc2dc1272fb

Download Submit
C:\Windows\System\BCOdpDH.exe

Filesize
1.7MB

MD5
392e5f10b446e3d489915e6d6a7f3f3a

SHA1
2f5209737ec18d29036037e48e8afb49a89ed5a9

SHA256
daeca141c6d554a7e3ac96f57405e025301a865e066a5d1e2ea0ef12dc12760f

SHA512
6450b21b540081c591ff3a0c69513950d8dd9d8023169dbb63fc0d831c30d42737f486425a3e84807c5e8eac0a1535441e30a15f82ca38c67e3f6f4ce1e3a695

Download Submit
C:\Windows\System\BQHuVHJ.exe

Filesize
1.7MB

MD5
9135bdad4d5af646d730bcfbfa1fb899

SHA1
7154a137225cea6236163276fe1514f0167c45b4

SHA256
ee150d8567eca25464d86e3da5e5d261c8602dfc8f7957940671e5544f97ce5b

SHA512
50f5a7918bea09c4ec0c2ea024ad70c2c539e71f13c69aec3be72c0396f97163cfee81749689fc185036a073a1e39facd3fd7f26968c3158c010247e0f90f526

Download Submit
C:\Windows\System\CQwiYJH.exe

Filesize
1.7MB

MD5
f3bf778ee3bb958dbe929cccce04ca62

SHA1
ca9871bb0dea5e7b929b1784536cafd1a0faa107

SHA256
4be09ae80535c9da5ae170f8d19bdf113d2b2e1ece6cec3d57ed7a92817dc137

SHA512
aa298034899d16de1b7cf3c1f3b0850ce655c6c843191730b19192b531dd059df9dfeb83062d58f588af37ee40a8b1587e82fc090839990308315a88b0edaa1e

Download Submit
C:\Windows\System\CajWuNS.exe

Filesize
1.7MB

MD5
f5a7d7d9fbe9bd3dd10be425ecaaf53d

SHA1
30f087a8a927dcb2a1fca2b8cc16e3ad662f132c

SHA256
84a9102e323f15d10dacbe82e3f027368a7f20501b165f69c06c8377569fec22

SHA512
0466aeac398551b436adc2d7406b608bb69bdb64c8662cafc73421b71201f6599822404db8d2388253ab5405bb1a335851447119ed0ee5c85d82116240637809

Download Submit
C:\Windows\System\FunSFty.exe

Filesize
1.7MB

MD5
6993cd681467120d9c1c27a222f5dd15

SHA1
2c62ee3ff3ac6d711b03d0e07f8630919a09ef37

SHA256
06841e1a25e7f1cb05c76224b9b22afab669f0d046f0980c721db47d2027cd79

SHA512
8b5fdadf5de64df81b26db98de54dcf25b1960aba788c32a1a6e13609439fd35723c866d4845bb511c5be55a5214e57c94a3bf3fa8d4d55cb61df6d44097e525

Download Submit
C:\Windows\System\JlPuOLu.exe

Filesize
1.7MB

MD5
3b4ab66aa7b220155d3577fad501ae73

SHA1
d09bb33ef91ce74b902d7d16f59c98e9528b5a52

SHA256
545ca60355048c399a2091d5dee7fae86c4ce2ee0f9cfcb6535e1db72cedc167

SHA512
ca9daed6f0eccfba00f3cecf3c9e8223a53a9b943f8e30ca5df07a0446d185dfe14a182f0e860c98ef6870008cefc09e612e7a18be60809af13aac50d7acac11

Download Submit
C:\Windows\System\KspHbgY.exe

Filesize
1.7MB

MD5
38f54fb0ec6808b23b2fcfc6967b72e2

SHA1
170ff100b74e0dd0010a4c7ae6e085dc97af9150

SHA256
a49cd194e99e785b3abbc14c581ca1147cbaf61913f4808a55fc4d61e047f19a

SHA512
3e20cd5bc19efaab49f2ac442e55e78d36f7b6d0085a76afd124786234c1f02f965d39490a9e30b0244f29e72b89132eee4ba39975fb33da415e2d44c5ba9031

Download Submit
C:\Windows\System\MYZKOYB.exe

Filesize
1.7MB

MD5
96ca2a39659ed1e4012716dcb571366b

SHA1
369d25ebe88b89ad7385135730f3f15da8274372

SHA256
7d3c0fb78566e49a80791e35e1710d28210c232d0ccf1522487090800aafbecd

SHA512
21f25291434d1a8029713c0b9f8348f128c5a8d221eda1e70372d629b48f5c3686abde6f2aedaad2189c9a99c2ea6f1ce79899bbdf5af826e698137b292888d3

Download Submit
C:\Windows\System\McJSkLs.exe

Filesize
1.7MB

MD5
a01a7b140992c764562793ab584ac532

SHA1
2d880c9df7ed024373b3d6374f1356a610468349

SHA256
9e7d6d127ff7fd092b6abd896e23bcf778e595453a94b44c472f6fc502cd7f95

SHA512
c6664b25d30c3934e81a14acf7ebae4de2a1df4a95ae91e0ad7d9d44df7bea4e90d12dfa6a37ab1b2fab242f99c1ba4e3f3e9b23fa3c45366e5b5943d616d4e6

Download Submit
C:\Windows\System\McJSkLs.exe

Filesize
1.2MB

MD5
fd56f81791f410e85bc7173bcd4f4154

SHA1
e465aa5055d829c004c48cace9e0fea745d72850

SHA256
273a7e29f0e62266d465c870e9ba9d76d7566c99a2eb3c11a77b737eeb83fafe

SHA512
513d1daf2f8d12e0cc16d58ddf8dee36e12537dad0d45d8ab9b199f68ca9d07ca5f1e49f43414c23ad20f4e73693d58d3770056b0c07a83f757189102bd64e7f

Download Submit
C:\Windows\System\NgeJtoV.exe

Filesize
1.7MB

MD5
d4e54d7d97fa5bb4b3a7313981ef06f3

SHA1
fe8a26acb9527caaed557928ee1d904dc4d65919

SHA256
e2f2307e4f7ff8fcf00a8c104470fc3b0262f08a52e5b0e0461dfc685c85018c

SHA512
b2b69cc4a341014eaea312bd9d66f4c71042a20df780f3b28bad4f2d9b4da592c621f0ab82582e0971a22e4b3f0b549547468c5a599f26d9582f62a96b56b5e7

Download Submit
C:\Windows\System\OOpMREC.exe

Filesize
1.7MB

MD5
7d438637e44a37ee6903bd9c3376f4e0

SHA1
fe91918d383d4fdb467f02ee8d06c0453713dd33

SHA256
612dee702dd73505e07e6effd4b5addc3560f89d59a17b1d6255789df815fb76

SHA512
8037b0f8c72e9bdfb4399ade365f1582d67cab27fdeaeecb51cf9dba06795f62fab0236362f5f49d2756ca06c570bc8e9bd1efbb6498c214aa51ff70573d4a84

Download Submit
C:\Windows\System\OQRMbPZ.exe

Filesize
1.7MB

MD5
9c389ca7dc2fa3c6b2ceb31bf47e5db2

SHA1
44847d406bd770855d53c669897bdc9911709275

SHA256
3555eea9eea8c766146162e0fa952fec66642b4d5cab719049d65a715e1d518c

SHA512
98a1d10a6314427918f9fa3ef0447d1643199996546f9c0723e01ca942ffd609f47302bc3fa43d2ee297fc28d1b3ab42737c9aa7af4a5b970cc3fe9ec4fba1cc

Download Submit
C:\Windows\System\OkBsXTN.exe

Filesize
1.7MB

MD5
ac03f641bec5e1284c05662f49374116

SHA1
f5cc3f365857e8c15b5494b6af7701c794baa8ea

SHA256
d9f034039b1487b8f957ca78eba929fc79918d93a4e7b4f539ede05d6ad6032d

SHA512
89ef78230ecd680e1c93403bac7266d140300b4ea0b6daa3991bac72d8f516275958a913895899391e08524ec384259493f2acc07b7ced36d40322739f353253

Download Submit
C:\Windows\System\PNBdzHe.exe

Filesize
1.7MB

MD5
ab45b5d3ca1bd2c219216480b0221ca5

SHA1
c055eddd6e39ac066297a4bccf20d3915c719633

SHA256
1e57f03dafd9458cbd3c304985692d0a713e515d4f7d216f898858c9035721fe

SHA512
7439447cc7f2baeb4d9399fbfb0a1103a82a9eaa4e49143164442504bc359082534d8c50fc980ef7050ac363c78cc858c96072742a8d9c459f9b6c5e8c2a9c8a

Download Submit
C:\Windows\System\UAzrLzO.exe

Filesize
1.7MB

MD5
5e0d5e0dcc5a753e1650fb6638cb7ba9

SHA1
4f5f4c2e5adf2bfd5ce2ecc721192cbc58e71f4a

SHA256
7fdb7e2fcb710c47cdddf0f0b0d94c912b7870be65081fd1e5024185acab576c

SHA512
94e43840dfc719dddbb801592336f64b98499dc5200a405b4b0cf71ca7574cdcbb8fbd6403a36eb660b2e93ba2c500e9d752ac2eaeeccf41657e5e8d1707fdc5

Download Submit
C:\Windows\System\UhZMAVa.exe

Filesize
1.7MB

MD5
210b241a7085372c07314badae5acb9a

SHA1
66f2efc45ee55660f6b489c173e08dc183330a9a

SHA256
5c1ab59e2f00b9006c8e5ec1b173eeeeadf746b0cc925a41e85df01143f2a2be

SHA512
a616fd40a7815c435466215d330d7e9cd38529133f486ae95b878d2cf44a6625d6dd51623195502c9bd670b9b7564076b1f0116636bbfeccb25eaba3bafb77c0

Download Submit
C:\Windows\System\VdSmkKI.exe

Filesize
1.7MB

MD5
31534cbb00972826c200bed502393a04

SHA1
db2e16de77c25c8f2a361db9c2e925471c4688d2

SHA256
625fcc7cfc077e337dd19c17575dfb3cbf0858583cbab8b9bba7de81bfc73458

SHA512
addec3311b112349dabaec8e167be6813c16d5c5547e4314c3ece06711b0aae9e6876c90eeb160635a81ea9479dcc1523a4efdc2f3ba22bff3c031245730c8d3

Download Submit
C:\Windows\System\WAamkMd.exe

Filesize
1.7MB

MD5
6f4aec4b6387c0859c9ceb4a078c97fb

SHA1
fdaded46d12f1b6006b6e999e3b202d6d461f4f3

SHA256
6c41ef953a79ba4a7b40132d863be0ab10fb7732fd19be300d6f3cc284205e52

SHA512
f44ec92d077873f2a15dc6dd3915358a14c58bc41c1e1cfa3eecd7be69676d3b5e72438621404d22e5758538eca706b2d772dd3302a70af5c9066abee532463e

Download Submit
C:\Windows\System\WKTzHEP.exe

Filesize
8B

MD5
b51f4f6ea566c7181d4d1f715615a414

SHA1
5f5d2057c3e793a449fbedd304d5084c92db621c

SHA256
efa8a7a6952ccabd712273da0ab5538682fcdaff585ff7604e7a4346286e9320

SHA512
cf70e5addae3f1995c350d8ead332088224d80c10cffe6e3f241ed79cc752dc79ee18c102b4cce11ffe47af43c22c4887cb7ff11f4d8c7bdc4456269c5638b1a

Download Submit
C:\Windows\System\YgvnCOJ.exe

Filesize
1.7MB

MD5
99b4e3c36e97e49a40cb6fc26084960e

SHA1
378fb5cf0b23bd7424ac38c0947a66f764151dba

SHA256
8c1f9f9c15ef39d32faf8f01c7bae69653d464c3b4bd3fb7a2ef26f9e52dcb31

SHA512
9d7ec6e64071d57f3a91a164706dfb92beb4aa4bb093af68e0fa5262982a6ced99f9594cb303c355de4f67e8f545f81d08c054cc7c3f6f025d115de4e8ba3ee3

Download Submit
C:\Windows\System\YvgGtCU.exe

Filesize
1.7MB

MD5
7108ff4ae53f890b889e72c71464439c

SHA1
92833ddbdc686ac7e1b59de955b6c770b5eee494

SHA256
afbe2d01ac896cb857724d503e32070495fa778c4752605cb3a48ff683f5a982

SHA512
debc04f2c3e230fece0a4e7cedc1e317aaa60d5dbcd974a07a29168f8eb6509464c935d2a7b71b57d2103d55a4d6d9a16b8066a2589a9557a6b1cf5266c6acdd

Download Submit
C:\Windows\System\ZjtVUDm.exe

Filesize
1.7MB

MD5
03b57f27a116b9869e298cce7d17b3f3

SHA1
4befc6ef60932be5713676654630723ed4ebff68

SHA256
57c774d1cbca0ae48793fbbe91deebf672dbd93a2db381fe52493e6f737f55d5

SHA512
2e60bab7a04d3c4cf1e6160c918996c3d75a2365ed0d3d06cb19ddfffe91d2a520722f2e9f0a88de50b34e65974e008b91e077a6a05b364ecb8f70bccacb149f

Download Submit
C:\Windows\System\cCPWJLW.exe

Filesize
1.7MB

MD5
138b0f75b38b771e88841a086fa45574

SHA1
0d91ecbf6940f40b28f6673328e1c3f17d78e0cf

SHA256
35acf4c1f6e3e2b7d3cfa4df7f6da03047e24ceb25856b20d6721dcbbf34be48

SHA512
dc7ee1e666921bea671f00a0b13a1a84d32ad92a3ece887e5d0aecec5cafb188cb71fd971e963dbf1249ab69b9081cb774cc1c60fa35e1d7e3c8818baa33e3cd

Download Submit
C:\Windows\System\eOekSGG.exe

Filesize
1.7MB

MD5
be49917c53a898f0edc46577b38cbff6

SHA1
1f25e313d7a6785b8c5dde5a05224c6c44096d8a

SHA256
9ad99d0a69c1b0e2651a91c31f17456c9728e4514720fbb74b10991db2ef97fb

SHA512
972a52bc14fd69a26442d05a170866702b1513abd447a1a5e41167a949298bf5e1f14ee8c4f32a6ef8c616d03663c676e42cae71d839e4f50bc78b08fd2825f5

Download Submit
C:\Windows\System\eOekSGG.exe

Filesize
1.6MB

MD5
1be5c0cb6dff446c3240c95ba99bf874

SHA1
c7bc554b4ca4259b3b8a6ba47297a45b95e2a5a2

SHA256
621de8c62a7fff184b92877bf5fc84c80bc2bfbfe6f98aa26c77edae6198046f

SHA512
5b3e6784bcb9e56c0beee124a5c5436e764f5b9de97ee313b4b1d3ee7185906d5201e3db2d2d6b9cc810ff91501fe7cf152094d7af20a816d83f5b7d809d4576

Download Submit
C:\Windows\System\fzFYxpa.exe

Filesize
1.7MB

MD5
0c290696e1763039c60492ed2a7491af

SHA1
eaad3da97968ee2c0a7b504eebab224aba3e5ab6

SHA256
bfabc4eccbdac05c4b51983de414bf58ea5efa735a52b163116582f2fee4fc54

SHA512
606a760de5d8e90049f70cd11c846966496cbe3685c27938e210ff8cd4cb07528e434d26912d05f2cf02f4e2102fac55bcc984c86780afaba63d01c990db49c4

Download Submit
C:\Windows\System\iESoAye.exe

Filesize
1.7MB

MD5
3fc7d404f09b909cbc569b7dea9f1045

SHA1
47d6499bf5163d8aad31db474b02f8a55eab0b3c

SHA256
04b0d9bc20a89d0d4f5024a250716e0f013b23c295404120b1903447faae55c7

SHA512
e6334d3016030d297ecb5537283421c5e74dd17ed7eee523fa35c6071c7ab720ac0326a9fccea6dc09e4becb74cc5b19d9afbd0e6fb256f0a08130e95947508b

Download Submit
C:\Windows\System\jWDXqoq.exe

Filesize
1.7MB

MD5
30845057d3cd7c012d735aae3e521d14

SHA1
9eb3441af77a7ee13b5a6c5bca86735b92551a36

SHA256
8522619796d46108b84478316a53f2d4cd304d65d7288c53a8d7dfef30861ae5

SHA512
8810afa536d4f7917c954600152f6037316f4a26c1054e6a5194312e9fe96e5fd29c399590924b09188c72243b2f816f2ff6eae4307a685eca04e541470f95a7

Download Submit
C:\Windows\System\kMPkoXm.exe

Filesize
1.7MB

MD5
660348c58fb7fa6a6784460346c89ca1

SHA1
d92c835fb02566881d117493835c496569466465

SHA256
84397aa159ca3564857988433177911cd8411e1013958bd4c92e58e0839f5e74

SHA512
12253637b5134d0798be156a72a7cbff063087483878e0d75d3f45d1e6c1c28fe741ffcc4087e113df05e2e0622d82c082ad90edd4018c650e3cd9df58342c6f

Download Submit
C:\Windows\System\miAzIxZ.exe

Filesize
1.7MB

MD5
9c0587cf79c259f4c08405f0c76b5a85

SHA1
7a812423141223873c0cfd8f1c3ddd4359daae94

SHA256
2072e1baa69f3f50ed4b9c5d090203aabb697518e61cdc39ea8a588c3c917a81

SHA512
4d11bbdc8e52c3ea6c69dec6be6c27067237a2ccccbb729f08c8ce02ed354b5d3fa5ea3480f5b2d1ba1d9aa2e8ed5e33a5e5779ddd53cfbb398eeada7b585315

Download Submit
C:\Windows\System\oYfVhBF.exe

Filesize
1.7MB

MD5
26063750dcacece6d75e1af6ca970dee

SHA1
0f301f6ac41bc377b241ee2fbf0c831a8525801f

SHA256
3308fe620a0682d6ee0e12833fa51543846ca00dea3b265418b4d729fda4f886

SHA512
55da81aa74750099526e7e2794cee5f323a088461e9273e9222c09e03a5705e0795e986703fb0efe63930baf55971e78df6a6b137026a82e3ff6e3124b3e13a0

Download Submit
C:\Windows\System\ooRJdka.exe

Filesize
1.7MB

MD5
3725f7c63cf385b4d7bf293cc97b178d

SHA1
8f96681871c13b8b2fc8a12884e1f812a49ddd22

SHA256
023bc66e4e87e2c3b115dc8b8116a9b98730f6e38c26ea38de94cf621bbef384

SHA512
259fb5435e88583761f1026eb1da914ee61f925824e38453e2a9c9ac37e0412fb3014db63344f019365874cffa8312357168e6639bc76514f05cac1f3050277a

Download Submit
C:\Windows\System\qLAzfuc.exe

Filesize
1.7MB

MD5
743e370c6bef4f89bdefb72c2c74d3d4

SHA1
ea84ef82c6cc9bfa8b48542463bd77b026e6f084

SHA256
330b0f717be91e9323a2a359422586b3b45f1ff24553acc1eba6152f11a78155

SHA512
69fcd95895173e4153795629f9d24002c3f8e50a87dbd7e23cd2f5a0c0aa5ce9f23e2571954fd8820a4b1ddc18c62509d48f9c164d1cdfe5308da9fc8c71a94e

Download Submit
C:\Windows\System\rJNArwR.exe

Filesize
1.7MB

MD5
4c95cf7ff49cdf904d5ab9ff951f9499

SHA1
d8a2c4f9c6de139660d9c819576a5546bf5bf294

SHA256
f65032cc8e447b581682c8fe24bc2a2bc56b2c629f74980f8bde6311a4ceda2f

SHA512
dfe11d2baf7c4dc2f6d3dd2dcaff48b72e9ff9c0454dd803940f370de1affcf943ed2541083bd9e2eebb77b95c613b77e135f3e59f745fe4a094bc3ddca73498

Download Submit
C:\Windows\System\sZfMfFh.exe

Filesize
1.7MB

MD5
93d6afc91200832eeddc98de667cb737

SHA1
4822f00888af9967c33d7f456b29237f5312f61d

SHA256
9af0c4837cedc3b49119b91870092ce303eeed8164ea43d1ad83b391a290666e

SHA512
02aa2c1cf38d2ca142d12fca2b087b9a2ea26e2919c91b76f9e3ecf23dee5e2a8172c3a4cada6aa0a94f1c8c0c348843cefacdd3f1f1b9326b7e1b6453db533b

Download Submit
C:\Windows\System\tKhjarr.exe

Filesize
1.7MB

MD5
23f725f042c51d22a3c75d00e5a5141a

SHA1
e6687a80f4c3d1883eb2949b8a1819a11f02f9ca

SHA256
11d40bf738c3a85661cb28150dcbad14bebd002f459c092b05ef29f212240df0

SHA512
be2ef6066e7266f460298ed2c57705f455a384e9ae2e8da4718ede383bf257c436c1f2fee35c7871ce09389063aea44ba4f6cdd4283dea06cf799b3277f390e9

Download Submit
C:\Windows\System\vNKlWtF.exe

Filesize
1.7MB

MD5
a863c8a27f713ccfdec54d55f1a9c3d7

SHA1
afd75b490ed9bc4a1a85f59898fbb3149f08e438

SHA256
9fa3b8800ffc2f4993fc9edab4824880b69b597cf462a9436a83c4d7d44c009b

SHA512
b3b8fedbc220b69af6e0c33f7f7cde7464be7e100802d3d0fa23e89fb0a0dbcb582b1ce9cac2375819d29159d23a7f5a85f0e101a2611817a03c3a951b42f1d8

Download Submit
C:\Windows\System\wvNpVGE.exe

Filesize
1.7MB

MD5
2ee74bba6291563b55fd33b151d9d99f

SHA1
722bba5d655cbbe256fc952f4f07380589fcf302

SHA256
e06237e9123f21346214cb2178fde5f05fe9a20efe3adb9169469b19e819756a

SHA512
a46768a4f66a6e730f4b1d704880e1ff955976284b6bb6388b28688eb3d6304168c8176a285e0acc0e50f25f070056966458b630ed0aa92a91d52f87e47eafe2

Download Submit
C:\Windows\System\xTGhTml.exe

Filesize
1.7MB

MD5
eee8342196475a428ed769eb0d091b49

SHA1
43093f8f87151da579ebc582d343bf69ab8cb607

SHA256
a5a84c5e16501ad30eb7369777ef24823c6710a0688fe218bbeff4f94e7fd710

SHA512
7b9a26e812ec76f647e9682a065f0dcf39bd21615030e713b062efdea4dddf41447b09fee9f18b9844ba3365df2ad932357dbe64900c652baec878d555e1d9bd

Download Submit
memory/736-150-0x00007FF71F7E0000-0x00007FF71FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/736-3230-0x00007FF71F7E0000-0x00007FF71FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/768-488-0x00007FF783600000-0x00007FF7839F2000-memory.dmp

Filesize
3.9MB

Download
memory/768-3309-0x00007FF783600000-0x00007FF7839F2000-memory.dmp

Filesize
3.9MB

Download
memory/868-3325-0x00007FF753220000-0x00007FF753612000-memory.dmp

Filesize
3.9MB

Download
memory/868-495-0x00007FF753220000-0x00007FF753612000-memory.dmp

Filesize
3.9MB

Download
memory/1072-3330-0x00007FF68E0A0000-0x00007FF68E492000-memory.dmp

Filesize
3.9MB

Download
memory/1072-590-0x00007FF68E0A0000-0x00007FF68E492000-memory.dmp

Filesize
3.9MB

Download
memory/1096-0-0x00007FF7442A0000-0x00007FF744692000-memory.dmp

Filesize
3.9MB

Download
memory/1096-1-0x00000157C9760000-0x00000157C9770000-memory.dmp

Filesize
64KB

Download
memory/1128-3228-0x00007FF76B430000-0x00007FF76B822000-memory.dmp

Filesize
3.9MB

Download
memory/1128-15-0x00007FF76B430000-0x00007FF76B822000-memory.dmp

Filesize
3.9MB

Download
memory/1200-489-0x00007FF729A90000-0x00007FF729E82000-memory.dmp

Filesize
3.9MB

Download
memory/1200-3311-0x00007FF729A90000-0x00007FF729E82000-memory.dmp

Filesize
3.9MB

Download
memory/1232-425-0x00007FF7D31F0000-0x00007FF7D35E2000-memory.dmp

Filesize
3.9MB

Download
memory/1232-3299-0x00007FF7D31F0000-0x00007FF7D35E2000-memory.dmp

Filesize
3.9MB

Download
memory/1276-3327-0x00007FF7C8D60000-0x00007FF7C9152000-memory.dmp

Filesize
3.9MB

Download
memory/1276-496-0x00007FF7C8D60000-0x00007FF7C9152000-memory.dmp

Filesize
3.9MB

Download
memory/1292-497-0x00007FFB278C0000-0x00007FFB28381000-memory.dmp

Filesize
10.8MB

Download
memory/1292-17-0x00007FFB278C3000-0x00007FFB278C5000-memory.dmp

Filesize
8KB

Download
memory/1292-93-0x00007FFB278C0000-0x00007FFB28381000-memory.dmp

Filesize
10.8MB

Download
memory/1292-199-0x000001DD46830000-0x000001DD46852000-memory.dmp

Filesize
136KB

Download
memory/1292-2082-0x00007FFB278C0000-0x00007FFB28381000-memory.dmp

Filesize
10.8MB

Download
memory/1328-476-0x00007FF6A33E0000-0x00007FF6A37D2000-memory.dmp

Filesize
3.9MB

Download
memory/1328-3303-0x00007FF6A33E0000-0x00007FF6A37D2000-memory.dmp

Filesize
3.9MB

Download
memory/1640-491-0x00007FF75D190000-0x00007FF75D582000-memory.dmp

Filesize
3.9MB

Download
memory/1640-3323-0x00007FF75D190000-0x00007FF75D582000-memory.dmp

Filesize
3.9MB

Download
memory/1764-490-0x00007FF64F3D0000-0x00007FF64F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1764-3313-0x00007FF64F3D0000-0x00007FF64F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2124-492-0x00007FF78D8B0000-0x00007FF78DCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2124-3305-0x00007FF78D8B0000-0x00007FF78DCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-3275-0x00007FF73B260000-0x00007FF73B652000-memory.dmp

Filesize
3.9MB

Download
memory/2940-186-0x00007FF73B260000-0x00007FF73B652000-memory.dmp

Filesize
3.9MB

Download
memory/2992-344-0x00007FF704190000-0x00007FF704582000-memory.dmp

Filesize
3.9MB

Download
memory/2992-3236-0x00007FF704190000-0x00007FF704582000-memory.dmp

Filesize
3.9MB

Download
memory/2996-401-0x00007FF6FF830000-0x00007FF6FFC22000-memory.dmp

Filesize
3.9MB

Download
memory/2996-3297-0x00007FF6FF830000-0x00007FF6FFC22000-memory.dmp

Filesize
3.9MB

Download
memory/3016-494-0x00007FF7DF5B0000-0x00007FF7DF9A2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-3307-0x00007FF7DF5B0000-0x00007FF7DF9A2000-memory.dmp

Filesize
3.9MB

Download
memory/3364-3234-0x00007FF7D20B0000-0x00007FF7D24A2000-memory.dmp

Filesize
3.9MB

Download
memory/3364-216-0x00007FF7D20B0000-0x00007FF7D24A2000-memory.dmp

Filesize
3.9MB

Download
memory/3892-3301-0x00007FF6C1660000-0x00007FF6C1A52000-memory.dmp

Filesize
3.9MB

Download
memory/3892-265-0x00007FF6C1660000-0x00007FF6C1A52000-memory.dmp

Filesize
3.9MB

Download
memory/3896-3331-0x00007FF68EBB0000-0x00007FF68EFA2000-memory.dmp

Filesize
3.9MB

Download
memory/3896-486-0x00007FF68EBB0000-0x00007FF68EFA2000-memory.dmp

Filesize
3.9MB

Download
memory/3940-3318-0x00007FF67F4F0000-0x00007FF67F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/3940-487-0x00007FF67F4F0000-0x00007FF67F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-3283-0x00007FF7354D0000-0x00007FF7358C2000-memory.dmp

Filesize
3.9MB

Download
memory/4588-286-0x00007FF7354D0000-0x00007FF7358C2000-memory.dmp

Filesize
3.9MB

Download
memory/4728-565-0x00007FF628DA0000-0x00007FF629192000-memory.dmp

Filesize
3.9MB

Download
memory/4728-3232-0x00007FF628DA0000-0x00007FF629192000-memory.dmp

Filesize
3.9MB

Download
memory/4860-424-0x00007FF661FB0000-0x00007FF6623A2000-memory.dmp

Filesize
3.9MB

Download
memory/4860-3315-0x00007FF661FB0000-0x00007FF6623A2000-memory.dmp

Filesize
3.9MB

Download
memory/4868-3320-0x00007FF749220000-0x00007FF749612000-memory.dmp

Filesize
3.9MB

Download
memory/4868-493-0x00007FF749220000-0x00007FF749612000-memory.dmp

Filesize
3.9MB

Download