xmrig | d38b8dcb0644a6fb49c20edc18a00cfbd202265f2ee6b4ef9c94daa183c47092

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
Size

1.7MB
MD5

5c38ac51bce48daba9bece069226f7a0
SHA1

4c20460eb18a919d92a0ad72a8d8004bfba7a46c
SHA256

d38b8dcb0644a6fb49c20edc18a00cfbd202265f2ee6b4ef9c94daa183c47092
SHA512

cfb07044a090a81e859cebe3887fc3b7b8c838135a5c84c36f693cb0b2559e9693257a62f4e03540e7b711d954280e36c6d661c101530b3bf8281ec25ccf2d1e
SSDEEP

49152:Lz071uv4BPMkHC0IlnASEx/mi1DLIBn+K:NAB0

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1448-50-0x00007FF6958C0000-0x00007FF695CB2000-memory.dmp	xmrig
behavioral2/memory/920-26-0x00007FF7E2B00000-0x00007FF7E2EF2000-memory.dmp	xmrig
behavioral2/memory/4792-171-0x00007FF78FE10000-0x00007FF790202000-memory.dmp	xmrig
behavioral2/memory/3588-175-0x00007FF7C01B0000-0x00007FF7C05A2000-memory.dmp	xmrig
behavioral2/memory/2820-177-0x00007FF62B530000-0x00007FF62B922000-memory.dmp	xmrig
behavioral2/memory/4268-176-0x00007FF7DE270000-0x00007FF7DE662000-memory.dmp	xmrig
behavioral2/memory/1240-174-0x00007FF677480000-0x00007FF677872000-memory.dmp	xmrig
behavioral2/memory/4476-173-0x00007FF725630000-0x00007FF725A22000-memory.dmp	xmrig
behavioral2/memory/3660-172-0x00007FF7B3F70000-0x00007FF7B4362000-memory.dmp	xmrig
behavioral2/memory/2976-170-0x00007FF67F0D0000-0x00007FF67F4C2000-memory.dmp	xmrig
behavioral2/memory/3632-169-0x00007FF6C62E0000-0x00007FF6C66D2000-memory.dmp	xmrig
behavioral2/memory/4396-165-0x00007FF71C040000-0x00007FF71C432000-memory.dmp	xmrig
behavioral2/memory/3224-164-0x00007FF66C930000-0x00007FF66CD22000-memory.dmp	xmrig
behavioral2/memory/5012-141-0x00007FF7565B0000-0x00007FF7569A2000-memory.dmp	xmrig
behavioral2/memory/3456-140-0x00007FF6B1E50000-0x00007FF6B2242000-memory.dmp	xmrig
behavioral2/memory/464-130-0x00007FF72A750000-0x00007FF72AB42000-memory.dmp	xmrig
behavioral2/memory/5080-116-0x00007FF60CE40000-0x00007FF60D232000-memory.dmp	xmrig
behavioral2/memory/3316-115-0x00007FF6C5F50000-0x00007FF6C6342000-memory.dmp	xmrig
behavioral2/memory/4236-103-0x00007FF783190000-0x00007FF783582000-memory.dmp	xmrig
behavioral2/memory/4660-91-0x00007FF7D9B60000-0x00007FF7D9F52000-memory.dmp	xmrig
behavioral2/memory/4484-87-0x00007FF79FF40000-0x00007FF7A0332000-memory.dmp	xmrig
behavioral2/memory/404-72-0x00007FF6D29A0000-0x00007FF6D2D92000-memory.dmp	xmrig
behavioral2/memory/2884-5060-0x00007FF6BFEB0000-0x00007FF6C02A2000-memory.dmp	xmrig
behavioral2/memory/5080-7582-0x00007FF60CE40000-0x00007FF60D232000-memory.dmp	xmrig
behavioral2/memory/1240-7628-0x00007FF677480000-0x00007FF677872000-memory.dmp	xmrig
behavioral2/memory/4268-7644-0x00007FF7DE270000-0x00007FF7DE662000-memory.dmp	xmrig
behavioral2/memory/3224-7660-0x00007FF66C930000-0x00007FF66CD22000-memory.dmp	xmrig
behavioral2/memory/4396-7742-0x00007FF71C040000-0x00007FF71C432000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

8 3552 powershell.exe
10 3552 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

3552 powershell.exe

flow	pid	process
8	3552	powershell.exe
10	3552	powershell.exe

pid	process
3552	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

EOAUdyj.exeLscDDsy.exeFOGsuHZ.exeLJKWvtw.exeKQJXslj.exeIqXCNfW.exeGVAxPYb.exeIWZwGUU.exeaiqCmuQ.exeVQbKkyF.exesUPOspE.exeOuJplTI.exeJWQRugG.exesnMmRJU.exegiQBEya.exeZlWzaqK.exeWHlDBnP.exeTrZFDeZ.exeVOoAxeG.exeUnPtFMa.exeoaCrCDQ.exekDYZTrg.exePnfusHZ.exeoMQJHHS.exeKXnyhhs.exebcUsLft.exealOiDtR.exeQlAVdWl.exetyJtSog.exedHCQjJg.exerzAvstX.exeSMZdELQ.exeXplIPIp.exevHkvWnF.exekBvPHkn.exezrtWYVD.exeKeuQfFH.exewuFMvbk.exeqLOzgUy.exeUxfcQXx.exekeXjflp.exekXumvWu.exeIKbpKaI.exesYjemFj.exehUfkYsX.exenoRecOB.exemkweicD.exeawAcWuV.exefnMVAwK.exeIcuKMVB.exeVobUyof.exevaLRozZ.exeHSzPEvF.exetztRvxj.exeZbCVTOD.exeoZmRYCs.exeKzWaLgD.exezkJDclz.exeLIkJZkv.exeUynyQhx.exejXUenSd.exeTtAXpTL.exeXnhNTZy.exeJFmGpie.exe

pid	process
1448	EOAUdyj.exe
4212	LscDDsy.exe
920	FOGsuHZ.exe
404	LJKWvtw.exe
4484	KQJXslj.exe
3660	IqXCNfW.exe
4660	GVAxPYb.exe
4236	IWZwGUU.exe
4476	aiqCmuQ.exe
3316	VQbKkyF.exe
5080	sUPOspE.exe
1240	OuJplTI.exe
3588	JWQRugG.exe
464	snMmRJU.exe
3456	giQBEya.exe
5012	ZlWzaqK.exe
2884	WHlDBnP.exe
3224	TrZFDeZ.exe
4396	VOoAxeG.exe
4268	UnPtFMa.exe
3632	oaCrCDQ.exe
2976	kDYZTrg.exe
2820	PnfusHZ.exe
4792	oMQJHHS.exe
4024	KXnyhhs.exe
5116	bcUsLft.exe
4568	alOiDtR.exe
4144	QlAVdWl.exe
212	tyJtSog.exe
2732	dHCQjJg.exe
3488	rzAvstX.exe
4892	SMZdELQ.exe
2940	XplIPIp.exe
2920	vHkvWnF.exe
3908	kBvPHkn.exe
3380	zrtWYVD.exe
548	KeuQfFH.exe
2016	wuFMvbk.exe
4416	qLOzgUy.exe
2164	UxfcQXx.exe
4584	keXjflp.exe
1556	kXumvWu.exe
4244	IKbpKaI.exe
4376	sYjemFj.exe
1156	hUfkYsX.exe
5084	noRecOB.exe
4636	mkweicD.exe
4408	awAcWuV.exe
3344	fnMVAwK.exe
2404	IcuKMVB.exe
2428	VobUyof.exe
1976	vaLRozZ.exe
368	HSzPEvF.exe
2368	tztRvxj.exe
1808	ZbCVTOD.exe
3756	oZmRYCs.exe
2132	KzWaLgD.exe
692	zkJDclz.exe
452	LIkJZkv.exe
4540	UynyQhx.exe
640	jXUenSd.exe
5092	TtAXpTL.exe
996	XnhNTZy.exe
872	JFmGpie.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2988-0-0x00007FF6BD3B0000-0x00007FF6BD7A2000-memory.dmp	upx
C:\Windows\System\EOAUdyj.exe	upx
C:\Windows\System\LscDDsy.exe	upx
C:\Windows\System\FOGsuHZ.exe	upx
C:\Windows\System\LJKWvtw.exe	upx
C:\Windows\System\GVAxPYb.exe	upx
C:\Windows\System\IWZwGUU.exe	upx
C:\Windows\System\VQbKkyF.exe	upx
C:\Windows\System\OuJplTI.exe	upx
C:\Windows\System\aiqCmuQ.exe	upx
behavioral2/memory/1448-50-0x00007FF6958C0000-0x00007FF695CB2000-memory.dmp	upx
C:\Windows\System\sUPOspE.exe	upx
C:\Windows\System\KQJXslj.exe	upx
C:\Windows\System\IqXCNfW.exe	upx
behavioral2/memory/920-26-0x00007FF7E2B00000-0x00007FF7E2EF2000-memory.dmp	upx
behavioral2/memory/4212-25-0x00007FF67F2B0000-0x00007FF67F6A2000-memory.dmp	upx
C:\Windows\System\WHlDBnP.exe	upx
C:\Windows\System\ZlWzaqK.exe	upx
C:\Windows\System\VOoAxeG.exe	upx
C:\Windows\System\kDYZTrg.exe	upx
C:\Windows\System\bcUsLft.exe	upx
behavioral2/memory/4792-171-0x00007FF78FE10000-0x00007FF790202000-memory.dmp	upx
behavioral2/memory/3588-175-0x00007FF7C01B0000-0x00007FF7C05A2000-memory.dmp	upx
C:\Windows\System\tyJtSog.exe	upx
C:\Windows\System\QlAVdWl.exe	upx
C:\Windows\System\alOiDtR.exe	upx
behavioral2/memory/2820-177-0x00007FF62B530000-0x00007FF62B922000-memory.dmp	upx
behavioral2/memory/4268-176-0x00007FF7DE270000-0x00007FF7DE662000-memory.dmp	upx
behavioral2/memory/1240-174-0x00007FF677480000-0x00007FF677872000-memory.dmp	upx
behavioral2/memory/4476-173-0x00007FF725630000-0x00007FF725A22000-memory.dmp	upx
behavioral2/memory/3660-172-0x00007FF7B3F70000-0x00007FF7B4362000-memory.dmp	upx
behavioral2/memory/2976-170-0x00007FF67F0D0000-0x00007FF67F4C2000-memory.dmp	upx
behavioral2/memory/3632-169-0x00007FF6C62E0000-0x00007FF6C66D2000-memory.dmp	upx
behavioral2/memory/4396-165-0x00007FF71C040000-0x00007FF71C432000-memory.dmp	upx
behavioral2/memory/3224-164-0x00007FF66C930000-0x00007FF66CD22000-memory.dmp	upx
C:\Windows\System\KXnyhhs.exe	upx
C:\Windows\System\oMQJHHS.exe	upx
C:\Windows\System\PnfusHZ.exe	upx
behavioral2/memory/2884-151-0x00007FF6BFEB0000-0x00007FF6C02A2000-memory.dmp	upx
behavioral2/memory/5012-141-0x00007FF7565B0000-0x00007FF7569A2000-memory.dmp	upx
behavioral2/memory/3456-140-0x00007FF6B1E50000-0x00007FF6B2242000-memory.dmp	upx
C:\Windows\System\TrZFDeZ.exe	upx
C:\Windows\System\oaCrCDQ.exe	upx
C:\Windows\System\UnPtFMa.exe	upx
behavioral2/memory/464-130-0x00007FF72A750000-0x00007FF72AB42000-memory.dmp	upx
C:\Windows\System\snMmRJU.exe	upx
C:\Windows\System\JWQRugG.exe	upx
behavioral2/memory/5080-116-0x00007FF60CE40000-0x00007FF60D232000-memory.dmp	upx
behavioral2/memory/3316-115-0x00007FF6C5F50000-0x00007FF6C6342000-memory.dmp	upx
C:\Windows\System\giQBEya.exe	upx
C:\Windows\System\SMZdELQ.exe	upx
C:\Windows\System\rzAvstX.exe	upx
C:\Windows\System\dHCQjJg.exe	upx
behavioral2/memory/4236-103-0x00007FF783190000-0x00007FF783582000-memory.dmp	upx
behavioral2/memory/4660-91-0x00007FF7D9B60000-0x00007FF7D9F52000-memory.dmp	upx
behavioral2/memory/4484-87-0x00007FF79FF40000-0x00007FF7A0332000-memory.dmp	upx
behavioral2/memory/404-72-0x00007FF6D29A0000-0x00007FF6D2D92000-memory.dmp	upx
behavioral2/memory/2884-5060-0x00007FF6BFEB0000-0x00007FF6C02A2000-memory.dmp	upx
behavioral2/memory/5080-7582-0x00007FF60CE40000-0x00007FF60D232000-memory.dmp	upx
behavioral2/memory/1240-7628-0x00007FF677480000-0x00007FF677872000-memory.dmp	upx
behavioral2/memory/4268-7644-0x00007FF7DE270000-0x00007FF7DE662000-memory.dmp	upx
behavioral2/memory/3224-7660-0x00007FF66C930000-0x00007FF66CD22000-memory.dmp	upx
behavioral2/memory/4396-7742-0x00007FF71C040000-0x00007FF71C432000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

7 raw.githubusercontent.com
8 raw.githubusercontent.com

flow	ioc
7	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

Processes:

5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\System\QEyHMPF.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\boHsnle.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\MMWrBYo.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\iStMxaS.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\WUekZth.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\HOcSrvM.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\EkXUdzk.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\JdeTkzH.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\SPCIOSJ.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZcifSwc.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\DXnXDKf.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\lDsBUgQ.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\VSNIJeL.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\DmBunAQ.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\yfLQwDu.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\egkqOEF.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\YBeQYgD.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\XIqSnEf.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\ujjnZQv.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\baGliZL.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\BDhGdRX.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\bTIYzhs.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\DHdjthm.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\nOLJdCc.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\IXWAkQV.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\HBQDJxR.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\knRPEBd.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\krgvAwl.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\LslqsyQ.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\dkflrzC.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\boISKTD.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\pQLFPnd.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\IeDXByq.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\zyHJrps.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\qKdsuTD.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\xEdfAKb.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\eYUZCWW.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\vfuKHwv.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\tCXtDJf.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\pgZMYlw.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\LqUUQXQ.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\eOLAYwk.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\Ytvfjmx.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\WexvOLo.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\fLuYExM.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\dNfGzqe.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\uASklRQ.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\lghjzGP.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\yojOJhk.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\NxUMbhK.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\xettcNz.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\lvjgvJP.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\aWJYNSl.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\QzWcWls.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\lKAnlQH.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\dfEtZxy.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\jvPzIaY.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\BHirXbT.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\SxcQobP.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\kMmJorO.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\aNnGtlv.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\jdLcTJk.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\PifCVyt.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
File created	C:\Windows\System\sJCnBVU.exe	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dwm.exedwm.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dwm.exedwm.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 36 IoCs

Processes:

dwm.exedwm.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

3552 powershell.exe
3552 powershell.exe
3552 powershell.exe

pid	process
3552	powershell.exe
3552	powershell.exe
3552	powershell.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exepowershell.exedwm.exedwm.exe

description	pid	process
Token: SeLockMemoryPrivilege	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeLockMemoryPrivilege	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
Token: SeCreateGlobalPrivilege	12588	dwm.exe
Token: SeChangeNotifyPrivilege	12588	dwm.exe
Token: 33	12588	dwm.exe
Token: SeIncBasePriorityPrivilege	12588	dwm.exe
Token: SeCreateGlobalPrivilege	13208	dwm.exe
Token: SeChangeNotifyPrivilege	13208	dwm.exe
Token: 33	13208	dwm.exe
Token: SeIncBasePriorityPrivilege	13208	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe

description	pid	process	target process
PID 2988 wrote to memory of 3552	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	powershell.exe
PID 2988 wrote to memory of 3552	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	powershell.exe
PID 2988 wrote to memory of 1448	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	EOAUdyj.exe
PID 2988 wrote to memory of 1448	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	EOAUdyj.exe
PID 2988 wrote to memory of 4212	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	LscDDsy.exe
PID 2988 wrote to memory of 4212	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	LscDDsy.exe
PID 2988 wrote to memory of 920	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	FOGsuHZ.exe
PID 2988 wrote to memory of 920	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	FOGsuHZ.exe
PID 2988 wrote to memory of 404	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	LJKWvtw.exe
PID 2988 wrote to memory of 404	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	LJKWvtw.exe
PID 2988 wrote to memory of 4484	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	KQJXslj.exe
PID 2988 wrote to memory of 4484	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	KQJXslj.exe
PID 2988 wrote to memory of 3660	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	IqXCNfW.exe
PID 2988 wrote to memory of 3660	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	IqXCNfW.exe
PID 2988 wrote to memory of 4660	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	GVAxPYb.exe
PID 2988 wrote to memory of 4660	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	GVAxPYb.exe
PID 2988 wrote to memory of 4236	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	IWZwGUU.exe
PID 2988 wrote to memory of 4236	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	IWZwGUU.exe
PID 2988 wrote to memory of 4476	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	aiqCmuQ.exe
PID 2988 wrote to memory of 4476	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	aiqCmuQ.exe
PID 2988 wrote to memory of 3316	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	VQbKkyF.exe
PID 2988 wrote to memory of 3316	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	VQbKkyF.exe
PID 2988 wrote to memory of 5080	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	sUPOspE.exe
PID 2988 wrote to memory of 5080	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	sUPOspE.exe
PID 2988 wrote to memory of 1240	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	OuJplTI.exe
PID 2988 wrote to memory of 1240	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	OuJplTI.exe
PID 2988 wrote to memory of 3588	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	JWQRugG.exe
PID 2988 wrote to memory of 3588	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	JWQRugG.exe
PID 2988 wrote to memory of 464	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	snMmRJU.exe
PID 2988 wrote to memory of 464	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	snMmRJU.exe
PID 2988 wrote to memory of 3456	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	giQBEya.exe
PID 2988 wrote to memory of 3456	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	giQBEya.exe
PID 2988 wrote to memory of 5012	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	ZlWzaqK.exe
PID 2988 wrote to memory of 5012	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	ZlWzaqK.exe
PID 2988 wrote to memory of 2884	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	WHlDBnP.exe
PID 2988 wrote to memory of 2884	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	WHlDBnP.exe
PID 2988 wrote to memory of 3224	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	TrZFDeZ.exe
PID 2988 wrote to memory of 3224	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	TrZFDeZ.exe
PID 2988 wrote to memory of 4396	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	VOoAxeG.exe
PID 2988 wrote to memory of 4396	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	VOoAxeG.exe
PID 2988 wrote to memory of 3632	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	oaCrCDQ.exe
PID 2988 wrote to memory of 3632	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	oaCrCDQ.exe
PID 2988 wrote to memory of 4268	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	UnPtFMa.exe
PID 2988 wrote to memory of 4268	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	UnPtFMa.exe
PID 2988 wrote to memory of 2820	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	PnfusHZ.exe
PID 2988 wrote to memory of 2820	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	PnfusHZ.exe
PID 2988 wrote to memory of 2976	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	kDYZTrg.exe
PID 2988 wrote to memory of 2976	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	kDYZTrg.exe
PID 2988 wrote to memory of 4792	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	oMQJHHS.exe
PID 2988 wrote to memory of 4792	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	oMQJHHS.exe
PID 2988 wrote to memory of 4024	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	KXnyhhs.exe
PID 2988 wrote to memory of 4024	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	KXnyhhs.exe
PID 2988 wrote to memory of 5116	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	bcUsLft.exe
PID 2988 wrote to memory of 5116	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	bcUsLft.exe
PID 2988 wrote to memory of 4568	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	alOiDtR.exe
PID 2988 wrote to memory of 4568	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	alOiDtR.exe
PID 2988 wrote to memory of 4144	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	QlAVdWl.exe
PID 2988 wrote to memory of 4144	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	QlAVdWl.exe
PID 2988 wrote to memory of 212	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	tyJtSog.exe
PID 2988 wrote to memory of 212	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	tyJtSog.exe
PID 2988 wrote to memory of 2732	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	dHCQjJg.exe
PID 2988 wrote to memory of 2732	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	dHCQjJg.exe
PID 2988 wrote to memory of 3488	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	rzAvstX.exe
PID 2988 wrote to memory of 3488	2988	5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe	rzAvstX.exe

C:\Users\Admin\AppData\Local\Temp\5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\5c38ac51bce48daba9bece069226f7a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552

C:\Windows\System\EOAUdyj.exe
C:\Windows\System\EOAUdyj.exe
2⤵
- Executes dropped EXE
PID:1448

C:\Windows\System\LscDDsy.exe
C:\Windows\System\LscDDsy.exe
2⤵
- Executes dropped EXE
PID:4212

C:\Windows\System\FOGsuHZ.exe
C:\Windows\System\FOGsuHZ.exe
2⤵
- Executes dropped EXE
PID:920

C:\Windows\System\LJKWvtw.exe
C:\Windows\System\LJKWvtw.exe
2⤵
- Executes dropped EXE
PID:404

C:\Windows\System\KQJXslj.exe
C:\Windows\System\KQJXslj.exe
2⤵
- Executes dropped EXE
PID:4484

C:\Windows\System\IqXCNfW.exe
C:\Windows\System\IqXCNfW.exe
2⤵
- Executes dropped EXE
PID:3660

C:\Windows\System\GVAxPYb.exe
C:\Windows\System\GVAxPYb.exe
2⤵
- Executes dropped EXE
PID:4660

C:\Windows\System\IWZwGUU.exe
C:\Windows\System\IWZwGUU.exe
2⤵
- Executes dropped EXE
PID:4236

C:\Windows\System\aiqCmuQ.exe
C:\Windows\System\aiqCmuQ.exe
2⤵
- Executes dropped EXE
PID:4476

C:\Windows\System\VQbKkyF.exe
C:\Windows\System\VQbKkyF.exe
2⤵
- Executes dropped EXE
PID:3316

C:\Windows\System\sUPOspE.exe
C:\Windows\System\sUPOspE.exe
2⤵
- Executes dropped EXE
PID:5080

C:\Windows\System\OuJplTI.exe
C:\Windows\System\OuJplTI.exe
2⤵
- Executes dropped EXE
PID:1240

C:\Windows\System\JWQRugG.exe
C:\Windows\System\JWQRugG.exe
2⤵
- Executes dropped EXE
PID:3588

C:\Windows\System\snMmRJU.exe
C:\Windows\System\snMmRJU.exe
2⤵
- Executes dropped EXE
PID:464

C:\Windows\System\giQBEya.exe
C:\Windows\System\giQBEya.exe
2⤵
- Executes dropped EXE
PID:3456

C:\Windows\System\ZlWzaqK.exe
C:\Windows\System\ZlWzaqK.exe
2⤵
- Executes dropped EXE
PID:5012

C:\Windows\System\WHlDBnP.exe
C:\Windows\System\WHlDBnP.exe
2⤵
- Executes dropped EXE
PID:2884

C:\Windows\System\TrZFDeZ.exe
C:\Windows\System\TrZFDeZ.exe
2⤵
- Executes dropped EXE
PID:3224

C:\Windows\System\VOoAxeG.exe
C:\Windows\System\VOoAxeG.exe
2⤵
- Executes dropped EXE
PID:4396

C:\Windows\System\oaCrCDQ.exe
C:\Windows\System\oaCrCDQ.exe
2⤵
- Executes dropped EXE
PID:3632

C:\Windows\System\UnPtFMa.exe
C:\Windows\System\UnPtFMa.exe
2⤵
- Executes dropped EXE
PID:4268

C:\Windows\System\PnfusHZ.exe
C:\Windows\System\PnfusHZ.exe
2⤵
- Executes dropped EXE
PID:2820

C:\Windows\System\kDYZTrg.exe
C:\Windows\System\kDYZTrg.exe
2⤵
- Executes dropped EXE
PID:2976

C:\Windows\System\oMQJHHS.exe
C:\Windows\System\oMQJHHS.exe
2⤵
- Executes dropped EXE
PID:4792

C:\Windows\System\KXnyhhs.exe
C:\Windows\System\KXnyhhs.exe
2⤵
- Executes dropped EXE
PID:4024

C:\Windows\System\bcUsLft.exe
C:\Windows\System\bcUsLft.exe
2⤵
- Executes dropped EXE
PID:5116

C:\Windows\System\alOiDtR.exe
C:\Windows\System\alOiDtR.exe
2⤵
- Executes dropped EXE
PID:4568

C:\Windows\System\QlAVdWl.exe
C:\Windows\System\QlAVdWl.exe
2⤵
- Executes dropped EXE
PID:4144

C:\Windows\System\tyJtSog.exe
C:\Windows\System\tyJtSog.exe
2⤵
- Executes dropped EXE
PID:212

C:\Windows\System\dHCQjJg.exe
C:\Windows\System\dHCQjJg.exe
2⤵
- Executes dropped EXE
PID:2732

C:\Windows\System\rzAvstX.exe
C:\Windows\System\rzAvstX.exe
2⤵
- Executes dropped EXE
PID:3488

C:\Windows\System\SMZdELQ.exe
C:\Windows\System\SMZdELQ.exe
2⤵
- Executes dropped EXE
PID:4892

C:\Windows\System\XplIPIp.exe
C:\Windows\System\XplIPIp.exe
2⤵
- Executes dropped EXE
PID:2940

C:\Windows\System\vHkvWnF.exe
C:\Windows\System\vHkvWnF.exe
2⤵
- Executes dropped EXE
PID:2920

C:\Windows\System\kBvPHkn.exe
C:\Windows\System\kBvPHkn.exe
2⤵
- Executes dropped EXE
PID:3908

C:\Windows\System\zrtWYVD.exe
C:\Windows\System\zrtWYVD.exe
2⤵
- Executes dropped EXE
PID:3380

C:\Windows\System\KeuQfFH.exe
C:\Windows\System\KeuQfFH.exe
2⤵
- Executes dropped EXE
PID:548

C:\Windows\System\wuFMvbk.exe
C:\Windows\System\wuFMvbk.exe
2⤵
- Executes dropped EXE
PID:2016

C:\Windows\System\qLOzgUy.exe
C:\Windows\System\qLOzgUy.exe
2⤵
- Executes dropped EXE
PID:4416

C:\Windows\System\UxfcQXx.exe
C:\Windows\System\UxfcQXx.exe
2⤵
- Executes dropped EXE
PID:2164

C:\Windows\System\keXjflp.exe
C:\Windows\System\keXjflp.exe
2⤵
- Executes dropped EXE
PID:4584

C:\Windows\System\kXumvWu.exe
C:\Windows\System\kXumvWu.exe
2⤵
- Executes dropped EXE
PID:1556

C:\Windows\System\IKbpKaI.exe
C:\Windows\System\IKbpKaI.exe
2⤵
- Executes dropped EXE
PID:4244

C:\Windows\System\sYjemFj.exe
C:\Windows\System\sYjemFj.exe
2⤵
- Executes dropped EXE
PID:4376

C:\Windows\System\noRecOB.exe
C:\Windows\System\noRecOB.exe
2⤵
- Executes dropped EXE
PID:5084

C:\Windows\System\hUfkYsX.exe
C:\Windows\System\hUfkYsX.exe
2⤵
- Executes dropped EXE
PID:1156

C:\Windows\System\mkweicD.exe
C:\Windows\System\mkweicD.exe
2⤵
- Executes dropped EXE
PID:4636

C:\Windows\System\awAcWuV.exe
C:\Windows\System\awAcWuV.exe
2⤵
- Executes dropped EXE
PID:4408

C:\Windows\System\fnMVAwK.exe
C:\Windows\System\fnMVAwK.exe
2⤵
- Executes dropped EXE
PID:3344

C:\Windows\System\IcuKMVB.exe
C:\Windows\System\IcuKMVB.exe
2⤵
- Executes dropped EXE
PID:2404

C:\Windows\System\VobUyof.exe
C:\Windows\System\VobUyof.exe
2⤵
- Executes dropped EXE
PID:2428

C:\Windows\System\vaLRozZ.exe
C:\Windows\System\vaLRozZ.exe
2⤵
- Executes dropped EXE
PID:1976

C:\Windows\System\HSzPEvF.exe
C:\Windows\System\HSzPEvF.exe
2⤵
- Executes dropped EXE
PID:368

C:\Windows\System\tztRvxj.exe
C:\Windows\System\tztRvxj.exe
2⤵
- Executes dropped EXE
PID:2368

C:\Windows\System\ZbCVTOD.exe
C:\Windows\System\ZbCVTOD.exe
2⤵
- Executes dropped EXE
PID:1808

C:\Windows\System\oZmRYCs.exe
C:\Windows\System\oZmRYCs.exe
2⤵
- Executes dropped EXE
PID:3756

C:\Windows\System\KzWaLgD.exe
C:\Windows\System\KzWaLgD.exe
2⤵
- Executes dropped EXE
PID:2132

C:\Windows\System\zkJDclz.exe
C:\Windows\System\zkJDclz.exe
2⤵
- Executes dropped EXE
PID:692

C:\Windows\System\LIkJZkv.exe
C:\Windows\System\LIkJZkv.exe
2⤵
- Executes dropped EXE
PID:452

C:\Windows\System\UynyQhx.exe
C:\Windows\System\UynyQhx.exe
2⤵
- Executes dropped EXE
PID:4540

C:\Windows\System\jXUenSd.exe
C:\Windows\System\jXUenSd.exe
2⤵
- Executes dropped EXE
PID:640

C:\Windows\System\TtAXpTL.exe
C:\Windows\System\TtAXpTL.exe
2⤵
- Executes dropped EXE
PID:5092

C:\Windows\System\XnhNTZy.exe
C:\Windows\System\XnhNTZy.exe
2⤵
- Executes dropped EXE
PID:996

C:\Windows\System\JFmGpie.exe
C:\Windows\System\JFmGpie.exe
2⤵
- Executes dropped EXE
PID:872

C:\Windows\System\DiGIQFN.exe
C:\Windows\System\DiGIQFN.exe
2⤵
PID:4872

C:\Windows\System\aIetsiT.exe
C:\Windows\System\aIetsiT.exe
2⤵
PID:856

C:\Windows\System\tuLfnGy.exe
C:\Windows\System\tuLfnGy.exe
2⤵
PID:380

C:\Windows\System\JjKNjvW.exe
C:\Windows\System\JjKNjvW.exe
2⤵
PID:2904

C:\Windows\System\XkaeAtm.exe
C:\Windows\System\XkaeAtm.exe
2⤵
PID:1972

C:\Windows\System\OFhookx.exe
C:\Windows\System\OFhookx.exe
2⤵
PID:4128

C:\Windows\System\HoDQjJX.exe
C:\Windows\System\HoDQjJX.exe
2⤵
PID:1840

C:\Windows\System\EbGnzxv.exe
C:\Windows\System\EbGnzxv.exe
2⤵
PID:3992

C:\Windows\System\kaEALCv.exe
C:\Windows\System\kaEALCv.exe
2⤵
PID:4276

C:\Windows\System\etCZhzk.exe
C:\Windows\System\etCZhzk.exe
2⤵
PID:1676

C:\Windows\System\AhPGyiP.exe
C:\Windows\System\AhPGyiP.exe
2⤵
PID:3140

C:\Windows\System\mvHSQgp.exe
C:\Windows\System\mvHSQgp.exe
2⤵
PID:3968

C:\Windows\System\WNGAQkU.exe
C:\Windows\System\WNGAQkU.exe
2⤵
PID:620

C:\Windows\System\YNWVuqC.exe
C:\Windows\System\YNWVuqC.exe
2⤵
PID:3584

C:\Windows\System\sEGBRqy.exe
C:\Windows\System\sEGBRqy.exe
2⤵
PID:4332

C:\Windows\System\ehusXXK.exe
C:\Windows\System\ehusXXK.exe
2⤵
PID:1524

C:\Windows\System\jIfnMgt.exe
C:\Windows\System\jIfnMgt.exe
2⤵
PID:4948

C:\Windows\System\QtwKntL.exe
C:\Windows\System\QtwKntL.exe
2⤵
PID:2020

C:\Windows\System\ODUITZt.exe
C:\Windows\System\ODUITZt.exe
2⤵
PID:4920

C:\Windows\System\qqApGZc.exe
C:\Windows\System\qqApGZc.exe
2⤵
PID:3600

C:\Windows\System\EQLyYEK.exe
C:\Windows\System\EQLyYEK.exe
2⤵
PID:4736

C:\Windows\System\flplfjQ.exe
C:\Windows\System\flplfjQ.exe
2⤵
PID:2880

C:\Windows\System\BUUmPvy.exe
C:\Windows\System\BUUmPvy.exe
2⤵
PID:4372

C:\Windows\System\OUUHPNO.exe
C:\Windows\System\OUUHPNO.exe
2⤵
PID:2756

C:\Windows\System\QAmlnYw.exe
C:\Windows\System\QAmlnYw.exe
2⤵
PID:2240

C:\Windows\System\QVULAmt.exe
C:\Windows\System\QVULAmt.exe
2⤵
PID:5140

C:\Windows\System\CBHKKZy.exe
C:\Windows\System\CBHKKZy.exe
2⤵
PID:5160

C:\Windows\System\HzDvRPu.exe
C:\Windows\System\HzDvRPu.exe
2⤵
PID:5176

C:\Windows\System\RQXHPuP.exe
C:\Windows\System\RQXHPuP.exe
2⤵
PID:5200

C:\Windows\System\dxIogGs.exe
C:\Windows\System\dxIogGs.exe
2⤵
PID:5224

C:\Windows\System\pBdTUXr.exe
C:\Windows\System\pBdTUXr.exe
2⤵
PID:5248

C:\Windows\System\WuRUzLf.exe
C:\Windows\System\WuRUzLf.exe
2⤵
PID:5308

C:\Windows\System\dXFnbyZ.exe
C:\Windows\System\dXFnbyZ.exe
2⤵
PID:5372

C:\Windows\System\yywBoyG.exe
C:\Windows\System\yywBoyG.exe
2⤵
PID:5388

C:\Windows\System\cFHpFAg.exe
C:\Windows\System\cFHpFAg.exe
2⤵
PID:5448

C:\Windows\System\ljrkAyI.exe
C:\Windows\System\ljrkAyI.exe
2⤵
PID:5476

C:\Windows\System\OKshTvd.exe
C:\Windows\System\OKshTvd.exe
2⤵
PID:5500

C:\Windows\System\RvoIrTB.exe
C:\Windows\System\RvoIrTB.exe
2⤵
PID:5540

C:\Windows\System\NbNTDCH.exe
C:\Windows\System\NbNTDCH.exe
2⤵
PID:5556

C:\Windows\System\UqiqaMv.exe
C:\Windows\System\UqiqaMv.exe
2⤵
PID:5576

C:\Windows\System\UORdjqx.exe
C:\Windows\System\UORdjqx.exe
2⤵
PID:5620

C:\Windows\System\DlaCnFS.exe
C:\Windows\System\DlaCnFS.exe
2⤵
PID:5636

C:\Windows\System\ukMjAlx.exe
C:\Windows\System\ukMjAlx.exe
2⤵
PID:5664

C:\Windows\System\FVxTDco.exe
C:\Windows\System\FVxTDco.exe
2⤵
PID:5704

C:\Windows\System\suGQeuW.exe
C:\Windows\System\suGQeuW.exe
2⤵
PID:5724

C:\Windows\System\bFwvzeK.exe
C:\Windows\System\bFwvzeK.exe
2⤵
PID:5748

C:\Windows\System\dEwIHDm.exe
C:\Windows\System\dEwIHDm.exe
2⤵
PID:5792

C:\Windows\System\tRtTjJP.exe
C:\Windows\System\tRtTjJP.exe
2⤵
PID:5820

C:\Windows\System\rtDHLQP.exe
C:\Windows\System\rtDHLQP.exe
2⤵
PID:5848

C:\Windows\System\KmHGagb.exe
C:\Windows\System\KmHGagb.exe
2⤵
PID:5864

C:\Windows\System\zQOoNPa.exe
C:\Windows\System\zQOoNPa.exe
2⤵
PID:5908

C:\Windows\System\xkrGlDQ.exe
C:\Windows\System\xkrGlDQ.exe
2⤵
PID:5928

C:\Windows\System\xsQlnVz.exe
C:\Windows\System\xsQlnVz.exe
2⤵
PID:5952

C:\Windows\System\NUlaewF.exe
C:\Windows\System\NUlaewF.exe
2⤵
PID:5972

C:\Windows\System\AYGqmLC.exe
C:\Windows\System\AYGqmLC.exe
2⤵
PID:6008

C:\Windows\System\XtKSGAA.exe
C:\Windows\System\XtKSGAA.exe
2⤵
PID:6024

C:\Windows\System\KQVOHtg.exe
C:\Windows\System\KQVOHtg.exe
2⤵
PID:6052

C:\Windows\System\WeqLBCa.exe
C:\Windows\System\WeqLBCa.exe
2⤵
PID:6088

C:\Windows\System\ZNvmbiS.exe
C:\Windows\System\ZNvmbiS.exe
2⤵
PID:6116

C:\Windows\System\hsqFljI.exe
C:\Windows\System\hsqFljI.exe
2⤵
PID:6136

C:\Windows\System\DYhjlnv.exe
C:\Windows\System\DYhjlnv.exe
2⤵
PID:4932

C:\Windows\System\FPyQgFQ.exe
C:\Windows\System\FPyQgFQ.exe
2⤵
PID:1392

C:\Windows\System\ViNbfDZ.exe
C:\Windows\System\ViNbfDZ.exe
2⤵
PID:5156

C:\Windows\System\jkHvYIk.exe
C:\Windows\System\jkHvYIk.exe
2⤵
PID:5188

C:\Windows\System\MbTlcGR.exe
C:\Windows\System\MbTlcGR.exe
2⤵
PID:5360

C:\Windows\System\VGemvZA.exe
C:\Windows\System\VGemvZA.exe
2⤵
PID:5472

C:\Windows\System\ORjqGOK.exe
C:\Windows\System\ORjqGOK.exe
2⤵
PID:4808

C:\Windows\System\aFqKHSF.exe
C:\Windows\System\aFqKHSF.exe
2⤵
PID:5532

C:\Windows\System\iVwxzgy.exe
C:\Windows\System\iVwxzgy.exe
2⤵
PID:5568

C:\Windows\System\KEzjAXt.exe
C:\Windows\System\KEzjAXt.exe
2⤵
PID:5628

C:\Windows\System\kANlgke.exe
C:\Windows\System\kANlgke.exe
2⤵
PID:5696

C:\Windows\System\UvfNqqu.exe
C:\Windows\System\UvfNqqu.exe
2⤵
PID:5788

C:\Windows\System\KSmHSkX.exe
C:\Windows\System\KSmHSkX.exe
2⤵
PID:4068

C:\Windows\System\QgizxEO.exe
C:\Windows\System\QgizxEO.exe
2⤵
PID:5856

C:\Windows\System\NsgFHfG.exe
C:\Windows\System\NsgFHfG.exe
2⤵
PID:3928

C:\Windows\System\kIVfcQS.exe
C:\Windows\System\kIVfcQS.exe
2⤵
PID:5964

C:\Windows\System\neFOYIF.exe
C:\Windows\System\neFOYIF.exe
2⤵
PID:6000

C:\Windows\System\EKfhHdK.exe
C:\Windows\System\EKfhHdK.exe
2⤵
PID:6016

C:\Windows\System\qtrtGwL.exe
C:\Windows\System\qtrtGwL.exe
2⤵
PID:6104

C:\Windows\System\bnRhWoF.exe
C:\Windows\System\bnRhWoF.exe
2⤵
PID:5196

C:\Windows\System\XgYcHAN.exe
C:\Windows\System\XgYcHAN.exe
2⤵
PID:5280

C:\Windows\System\zGMqtFh.exe
C:\Windows\System\zGMqtFh.exe
2⤵
PID:1948

C:\Windows\System\IJeTUnY.exe
C:\Windows\System\IJeTUnY.exe
2⤵
PID:5456

C:\Windows\System\YSmszFq.exe
C:\Windows\System\YSmszFq.exe
2⤵
PID:5564

C:\Windows\System\xLNHFTt.exe
C:\Windows\System\xLNHFTt.exe
2⤵
PID:5600

C:\Windows\System\qMCIqoE.exe
C:\Windows\System\qMCIqoE.exe
2⤵
PID:5816

C:\Windows\System\tprgwFK.exe
C:\Windows\System\tprgwFK.exe
2⤵
PID:5920

C:\Windows\System\BLjQbXR.exe
C:\Windows\System\BLjQbXR.exe
2⤵
PID:4492

C:\Windows\System\BdpFJCa.exe
C:\Windows\System\BdpFJCa.exe
2⤵
PID:3416

C:\Windows\System\SDaJsWt.exe
C:\Windows\System\SDaJsWt.exe
2⤵
PID:5304

C:\Windows\System\HYDNkMP.exe
C:\Windows\System\HYDNkMP.exe
2⤵
PID:5676

C:\Windows\System\lRurxCq.exe
C:\Windows\System\lRurxCq.exe
2⤵
PID:5888

C:\Windows\System\VnncvHZ.exe
C:\Windows\System\VnncvHZ.exe
2⤵
PID:5936

C:\Windows\System\kAiyxhR.exe
C:\Windows\System\kAiyxhR.exe
2⤵
PID:5552

C:\Windows\System\uHDrQsV.exe
C:\Windows\System\uHDrQsV.exe
2⤵
PID:6156

C:\Windows\System\luTOewX.exe
C:\Windows\System\luTOewX.exe
2⤵
PID:6192

C:\Windows\System\SOomvuT.exe
C:\Windows\System\SOomvuT.exe
2⤵
PID:6208

C:\Windows\System\KDnpstr.exe
C:\Windows\System\KDnpstr.exe
2⤵
PID:6292

C:\Windows\System\VeZUVrH.exe
C:\Windows\System\VeZUVrH.exe
2⤵
PID:6312

C:\Windows\System\YLwTMMG.exe
C:\Windows\System\YLwTMMG.exe
2⤵
PID:6348

C:\Windows\System\zBmdRVS.exe
C:\Windows\System\zBmdRVS.exe
2⤵
PID:6368

C:\Windows\System\xwQSkBg.exe
C:\Windows\System\xwQSkBg.exe
2⤵
PID:6408

C:\Windows\System\rrzAGCy.exe
C:\Windows\System\rrzAGCy.exe
2⤵
PID:6440

C:\Windows\System\MpqQzZa.exe
C:\Windows\System\MpqQzZa.exe
2⤵
PID:6468

C:\Windows\System\fCHZXVS.exe
C:\Windows\System\fCHZXVS.exe
2⤵
PID:6484

C:\Windows\System\HhvqaAW.exe
C:\Windows\System\HhvqaAW.exe
2⤵
PID:6504

C:\Windows\System\NIXLIkK.exe
C:\Windows\System\NIXLIkK.exe
2⤵
PID:6524

C:\Windows\System\kaTWutj.exe
C:\Windows\System\kaTWutj.exe
2⤵
PID:6572

C:\Windows\System\NywuYLP.exe
C:\Windows\System\NywuYLP.exe
2⤵
PID:6592

C:\Windows\System\TbhMniz.exe
C:\Windows\System\TbhMniz.exe
2⤵
PID:6632

C:\Windows\System\zMDzQIm.exe
C:\Windows\System\zMDzQIm.exe
2⤵
PID:6648

C:\Windows\System\BEUhWLo.exe
C:\Windows\System\BEUhWLo.exe
2⤵
PID:6680

C:\Windows\System\rQqribB.exe
C:\Windows\System\rQqribB.exe
2⤵
PID:6712

C:\Windows\System\QZedNwg.exe
C:\Windows\System\QZedNwg.exe
2⤵
PID:6752

C:\Windows\System\NKbCvSE.exe
C:\Windows\System\NKbCvSE.exe
2⤵
PID:6776

C:\Windows\System\yOSneeR.exe
C:\Windows\System\yOSneeR.exe
2⤵
PID:6804

C:\Windows\System\EJeDDzY.exe
C:\Windows\System\EJeDDzY.exe
2⤵
PID:6828

C:\Windows\System\zRQAqsg.exe
C:\Windows\System\zRQAqsg.exe
2⤵
PID:6848

C:\Windows\System\NNBVtOH.exe
C:\Windows\System\NNBVtOH.exe
2⤵
PID:6872

C:\Windows\System\aWXbOSr.exe
C:\Windows\System\aWXbOSr.exe
2⤵
PID:6900

C:\Windows\System\hxfqYzm.exe
C:\Windows\System\hxfqYzm.exe
2⤵
PID:6920

C:\Windows\System\OlUTBgM.exe
C:\Windows\System\OlUTBgM.exe
2⤵
PID:6956

C:\Windows\System\AhXrQPE.exe
C:\Windows\System\AhXrQPE.exe
2⤵
PID:7000

C:\Windows\System\wOpRkoU.exe
C:\Windows\System\wOpRkoU.exe
2⤵
PID:7024

C:\Windows\System\fGXkOhR.exe
C:\Windows\System\fGXkOhR.exe
2⤵
PID:7064

C:\Windows\System\BycyMxq.exe
C:\Windows\System\BycyMxq.exe
2⤵
PID:7084

C:\Windows\System\dOsPfyR.exe
C:\Windows\System\dOsPfyR.exe
2⤵
PID:7108

C:\Windows\System\ptlfdjl.exe
C:\Windows\System\ptlfdjl.exe
2⤵
PID:7128

C:\Windows\System\sLQPQJm.exe
C:\Windows\System\sLQPQJm.exe
2⤵
PID:7144

C:\Windows\System\dGfycEl.exe
C:\Windows\System\dGfycEl.exe
2⤵
PID:5740

C:\Windows\System\vxsHDBF.exe
C:\Windows\System\vxsHDBF.exe
2⤵
PID:5400

C:\Windows\System\JbhzokO.exe
C:\Windows\System\JbhzokO.exe
2⤵
PID:6204

C:\Windows\System\pFbnFgd.exe
C:\Windows\System\pFbnFgd.exe
2⤵
PID:6228

C:\Windows\System\ReIEVVW.exe
C:\Windows\System\ReIEVVW.exe
2⤵
PID:6268

C:\Windows\System\SQMOhUC.exe
C:\Windows\System\SQMOhUC.exe
2⤵
PID:6344

C:\Windows\System\oFjmcDk.exe
C:\Windows\System\oFjmcDk.exe
2⤵
PID:6420

C:\Windows\System\eCwrwER.exe
C:\Windows\System\eCwrwER.exe
2⤵
PID:6448

C:\Windows\System\aFUMrdo.exe
C:\Windows\System\aFUMrdo.exe
2⤵
PID:6492

C:\Windows\System\udQfDEA.exe
C:\Windows\System\udQfDEA.exe
2⤵
PID:6552

C:\Windows\System\xeSeEKy.exe
C:\Windows\System\xeSeEKy.exe
2⤵
PID:6568

C:\Windows\System\pZOoWhV.exe
C:\Windows\System\pZOoWhV.exe
2⤵
PID:6620

C:\Windows\System\OwriJOw.exe
C:\Windows\System\OwriJOw.exe
2⤵
PID:6700

C:\Windows\System\Prsfbvi.exe
C:\Windows\System\Prsfbvi.exe
2⤵
PID:6868

C:\Windows\System\ekEEJYA.exe
C:\Windows\System\ekEEJYA.exe
2⤵
PID:6896

C:\Windows\System\ehhvCFz.exe
C:\Windows\System\ehhvCFz.exe
2⤵
PID:6948

C:\Windows\System\CUpgeJW.exe
C:\Windows\System\CUpgeJW.exe
2⤵
PID:7008

C:\Windows\System\avNaPin.exe
C:\Windows\System\avNaPin.exe
2⤵
PID:3664

C:\Windows\System\HqrgtjF.exe
C:\Windows\System\HqrgtjF.exe
2⤵
PID:6340

C:\Windows\System\qMwWlvg.exe
C:\Windows\System\qMwWlvg.exe
2⤵
PID:6256

C:\Windows\System\wPrsWEm.exe
C:\Windows\System\wPrsWEm.exe
2⤵
PID:6380

C:\Windows\System\faLjVif.exe
C:\Windows\System\faLjVif.exe
2⤵
PID:6588

C:\Windows\System\hTqAoZp.exe
C:\Windows\System\hTqAoZp.exe
2⤵
PID:6888

C:\Windows\System\pLDucZF.exe
C:\Windows\System\pLDucZF.exe
2⤵
PID:6928

C:\Windows\System\YAhxXVd.exe
C:\Windows\System\YAhxXVd.exe
2⤵
PID:7140

C:\Windows\System\YEnDALL.exe
C:\Windows\System\YEnDALL.exe
2⤵
PID:6364

C:\Windows\System\pMkDaMb.exe
C:\Windows\System\pMkDaMb.exe
2⤵
PID:6796

C:\Windows\System\ONdcJdK.exe
C:\Windows\System\ONdcJdK.exe
2⤵
PID:6264

C:\Windows\System\yuMsbFY.exe
C:\Windows\System\yuMsbFY.exe
2⤵
PID:6644

C:\Windows\System\NhXVUCt.exe
C:\Windows\System\NhXVUCt.exe
2⤵
PID:7092

C:\Windows\System\KgCkLtu.exe
C:\Windows\System\KgCkLtu.exe
2⤵
PID:7188

C:\Windows\System\NwDTEhL.exe
C:\Windows\System\NwDTEhL.exe
2⤵
PID:7216

C:\Windows\System\uOnlnIn.exe
C:\Windows\System\uOnlnIn.exe
2⤵
PID:7232

C:\Windows\System\vCtFEvv.exe
C:\Windows\System\vCtFEvv.exe
2⤵
PID:7260

C:\Windows\System\LbdDxVW.exe
C:\Windows\System\LbdDxVW.exe
2⤵
PID:7280

C:\Windows\System\EJzdSfr.exe
C:\Windows\System\EJzdSfr.exe
2⤵
PID:7324

C:\Windows\System\ncjlpKg.exe
C:\Windows\System\ncjlpKg.exe
2⤵
PID:7356

C:\Windows\System\DvKPxUn.exe
C:\Windows\System\DvKPxUn.exe
2⤵
PID:7372

C:\Windows\System\JitoGmM.exe
C:\Windows\System\JitoGmM.exe
2⤵
PID:7416

C:\Windows\System\MPsttax.exe
C:\Windows\System\MPsttax.exe
2⤵
PID:7432

C:\Windows\System\nrCAbXe.exe
C:\Windows\System\nrCAbXe.exe
2⤵
PID:7456

C:\Windows\System\giLfbEm.exe
C:\Windows\System\giLfbEm.exe
2⤵
PID:7492

C:\Windows\System\eLcxgAT.exe
C:\Windows\System\eLcxgAT.exe
2⤵
PID:7512

C:\Windows\System\ntIjkbE.exe
C:\Windows\System\ntIjkbE.exe
2⤵
PID:7540

C:\Windows\System\LgehjVd.exe
C:\Windows\System\LgehjVd.exe
2⤵
PID:7560

C:\Windows\System\TcWkiPM.exe
C:\Windows\System\TcWkiPM.exe
2⤵
PID:7580

C:\Windows\System\qGVabiR.exe
C:\Windows\System\qGVabiR.exe
2⤵
PID:7604

C:\Windows\System\QekoqXq.exe
C:\Windows\System\QekoqXq.exe
2⤵
PID:7620

C:\Windows\System\fPGvYYm.exe
C:\Windows\System\fPGvYYm.exe
2⤵
PID:7684

C:\Windows\System\UqlEIkb.exe
C:\Windows\System\UqlEIkb.exe
2⤵
PID:7744

C:\Windows\System\xUlRYbv.exe
C:\Windows\System\xUlRYbv.exe
2⤵
PID:7764

C:\Windows\System\HvawfZJ.exe
C:\Windows\System\HvawfZJ.exe
2⤵
PID:7792

C:\Windows\System\cOzDCTV.exe
C:\Windows\System\cOzDCTV.exe
2⤵
PID:7816

C:\Windows\System\YzUZNIp.exe
C:\Windows\System\YzUZNIp.exe
2⤵
PID:7840

C:\Windows\System\CadexQW.exe
C:\Windows\System\CadexQW.exe
2⤵
PID:7900

C:\Windows\System\iSSclQn.exe
C:\Windows\System\iSSclQn.exe
2⤵
PID:7920

C:\Windows\System\PrRhDhV.exe
C:\Windows\System\PrRhDhV.exe
2⤵
PID:7944

C:\Windows\System\UedGslO.exe
C:\Windows\System\UedGslO.exe
2⤵
PID:7964

C:\Windows\System\JhDhLui.exe
C:\Windows\System\JhDhLui.exe
2⤵
PID:8008

C:\Windows\System\RvMUtHi.exe
C:\Windows\System\RvMUtHi.exe
2⤵
PID:8032

C:\Windows\System\cBaFgDF.exe
C:\Windows\System\cBaFgDF.exe
2⤵
PID:8056

C:\Windows\System\wiGfQLr.exe
C:\Windows\System\wiGfQLr.exe
2⤵
PID:8084

C:\Windows\System\EkhiSGh.exe
C:\Windows\System\EkhiSGh.exe
2⤵
PID:8100

C:\Windows\System\DUAqVaE.exe
C:\Windows\System\DUAqVaE.exe
2⤵
PID:8128

C:\Windows\System\tQilEjh.exe
C:\Windows\System\tQilEjh.exe
2⤵
PID:8152

C:\Windows\System\dgKkABs.exe
C:\Windows\System\dgKkABs.exe
2⤵
PID:8172

C:\Windows\System\DNUyJXN.exe
C:\Windows\System\DNUyJXN.exe
2⤵
PID:7180

C:\Windows\System\EvdHBED.exe
C:\Windows\System\EvdHBED.exe
2⤵
PID:6516

C:\Windows\System\jJsJqgd.exe
C:\Windows\System\jJsJqgd.exe
2⤵
PID:7396

C:\Windows\System\EJVZLvr.exe
C:\Windows\System\EJVZLvr.exe
2⤵
PID:7472

C:\Windows\System\BJwOJcC.exe
C:\Windows\System\BJwOJcC.exe
2⤵
PID:7508

C:\Windows\System\xjJQkjF.exe
C:\Windows\System\xjJQkjF.exe
2⤵
PID:7616

C:\Windows\System\oAYIcCR.exe
C:\Windows\System\oAYIcCR.exe
2⤵
PID:7660

C:\Windows\System\kcdUVuS.exe
C:\Windows\System\kcdUVuS.exe
2⤵
PID:7640

C:\Windows\System\srXPOyT.exe
C:\Windows\System\srXPOyT.exe
2⤵
PID:7832

C:\Windows\System\zSlgAOO.exe
C:\Windows\System\zSlgAOO.exe
2⤵
PID:7868

C:\Windows\System\eFEBcuH.exe
C:\Windows\System\eFEBcuH.exe
2⤵
PID:7976

C:\Windows\System\XVFOdxr.exe
C:\Windows\System\XVFOdxr.exe
2⤵
PID:8024

C:\Windows\System\JLqnZFX.exe
C:\Windows\System\JLqnZFX.exe
2⤵
PID:8048

C:\Windows\System\vJFOXVO.exe
C:\Windows\System\vJFOXVO.exe
2⤵
PID:8136

C:\Windows\System\NZwCShX.exe
C:\Windows\System\NZwCShX.exe
2⤵
PID:8184

C:\Windows\System\RmqvxBh.exe
C:\Windows\System\RmqvxBh.exe
2⤵
PID:7228

C:\Windows\System\GrARAvi.exe
C:\Windows\System\GrARAvi.exe
2⤵
PID:2952

C:\Windows\System\gQMZUnH.exe
C:\Windows\System\gQMZUnH.exe
2⤵
PID:7332

C:\Windows\System\AOIaWCK.exe
C:\Windows\System\AOIaWCK.exe
2⤵
PID:7520

C:\Windows\System\sXBXzAq.exe
C:\Windows\System\sXBXzAq.exe
2⤵
PID:7756

C:\Windows\System\dqgHlfz.exe
C:\Windows\System\dqgHlfz.exe
2⤵
PID:7912

C:\Windows\System\LElEfnq.exe
C:\Windows\System\LElEfnq.exe
2⤵
PID:8076

C:\Windows\System\LraSYEw.exe
C:\Windows\System\LraSYEw.exe
2⤵
PID:6912

C:\Windows\System\mHOEHjP.exe
C:\Windows\System\mHOEHjP.exe
2⤵
PID:7552

C:\Windows\System\IWukvYh.exe
C:\Windows\System\IWukvYh.exe
2⤵
PID:7992

C:\Windows\System\gtgjSrg.exe
C:\Windows\System\gtgjSrg.exe
2⤵
PID:7172

C:\Windows\System\yptMiYZ.exe
C:\Windows\System\yptMiYZ.exe
2⤵
PID:8224

C:\Windows\System\MzIAOmV.exe
C:\Windows\System\MzIAOmV.exe
2⤵
PID:8244

C:\Windows\System\XIPpymY.exe
C:\Windows\System\XIPpymY.exe
2⤵
PID:8292

C:\Windows\System\bThVFhp.exe
C:\Windows\System\bThVFhp.exe
2⤵
PID:8316

C:\Windows\System\znQPAfH.exe
C:\Windows\System\znQPAfH.exe
2⤵
PID:8344

C:\Windows\System\hnPlWnK.exe
C:\Windows\System\hnPlWnK.exe
2⤵
PID:8364

C:\Windows\System\IbKwTvn.exe
C:\Windows\System\IbKwTvn.exe
2⤵
PID:8384

C:\Windows\System\WIFPpBv.exe
C:\Windows\System\WIFPpBv.exe
2⤵
PID:8428

C:\Windows\System\ExVtKYu.exe
C:\Windows\System\ExVtKYu.exe
2⤵
PID:8444

C:\Windows\System\lEvuRQS.exe
C:\Windows\System\lEvuRQS.exe
2⤵
PID:8468

C:\Windows\System\iNZosEG.exe
C:\Windows\System\iNZosEG.exe
2⤵
PID:8496

C:\Windows\System\MPdLymN.exe
C:\Windows\System\MPdLymN.exe
2⤵
PID:8512

C:\Windows\System\hDOSvbh.exe
C:\Windows\System\hDOSvbh.exe
2⤵
PID:8540

C:\Windows\System\kvpKhni.exe
C:\Windows\System\kvpKhni.exe
2⤵
PID:8568

C:\Windows\System\npNCsVF.exe
C:\Windows\System\npNCsVF.exe
2⤵
PID:8588

C:\Windows\System\KtpzaYs.exe
C:\Windows\System\KtpzaYs.exe
2⤵
PID:8608

C:\Windows\System\oyWwMpB.exe
C:\Windows\System\oyWwMpB.exe
2⤵
PID:8640

C:\Windows\System\KEEJdYr.exe
C:\Windows\System\KEEJdYr.exe
2⤵
PID:8712

C:\Windows\System\XCbnDxN.exe
C:\Windows\System\XCbnDxN.exe
2⤵
PID:8736

C:\Windows\System\VZKWXic.exe
C:\Windows\System\VZKWXic.exe
2⤵
PID:8764

C:\Windows\System\PnQNZlf.exe
C:\Windows\System\PnQNZlf.exe
2⤵
PID:8784

C:\Windows\System\jthqDXJ.exe
C:\Windows\System\jthqDXJ.exe
2⤵
PID:8824

C:\Windows\System\uechLrX.exe
C:\Windows\System\uechLrX.exe
2⤵
PID:8840

C:\Windows\System\jrvIxnl.exe
C:\Windows\System\jrvIxnl.exe
2⤵
PID:8868

C:\Windows\System\HDtTjgA.exe
C:\Windows\System\HDtTjgA.exe
2⤵
PID:8896

C:\Windows\System\TMrxdDZ.exe
C:\Windows\System\TMrxdDZ.exe
2⤵
PID:8932

C:\Windows\System\fMGxHbh.exe
C:\Windows\System\fMGxHbh.exe
2⤵
PID:8948

C:\Windows\System\REzjLTZ.exe
C:\Windows\System\REzjLTZ.exe
2⤵
PID:8968

C:\Windows\System\Mfffjam.exe
C:\Windows\System\Mfffjam.exe
2⤵
PID:9016

C:\Windows\System\EekJOeI.exe
C:\Windows\System\EekJOeI.exe
2⤵
PID:9044

C:\Windows\System\STVvmHt.exe
C:\Windows\System\STVvmHt.exe
2⤵
PID:9060

C:\Windows\System\niGukFb.exe
C:\Windows\System\niGukFb.exe
2⤵
PID:9084

C:\Windows\System\hPfFVHP.exe
C:\Windows\System\hPfFVHP.exe
2⤵
PID:9104

C:\Windows\System\dCRtGvP.exe
C:\Windows\System\dCRtGvP.exe
2⤵
PID:9140

C:\Windows\System\nNHAMxe.exe
C:\Windows\System\nNHAMxe.exe
2⤵
PID:9168

C:\Windows\System\AxwKLpd.exe
C:\Windows\System\AxwKLpd.exe
2⤵
PID:7760

C:\Windows\System\isqDbrB.exe
C:\Windows\System\isqDbrB.exe
2⤵
PID:8220

C:\Windows\System\spGgbBT.exe
C:\Windows\System\spGgbBT.exe
2⤵
PID:8268

C:\Windows\System\XEfGvZV.exe
C:\Windows\System\XEfGvZV.exe
2⤵
PID:8336

C:\Windows\System\BrkvAQS.exe
C:\Windows\System\BrkvAQS.exe
2⤵
PID:8380

C:\Windows\System\PYpfceK.exe
C:\Windows\System\PYpfceK.exe
2⤵
PID:8476

C:\Windows\System\IVXFlEq.exe
C:\Windows\System\IVXFlEq.exe
2⤵
PID:8460

C:\Windows\System\fcbSURM.exe
C:\Windows\System\fcbSURM.exe
2⤵
PID:8552

C:\Windows\System\afOGwjC.exe
C:\Windows\System\afOGwjC.exe
2⤵
PID:8620

C:\Windows\System\EJdDzgK.exe
C:\Windows\System\EJdDzgK.exe
2⤵
PID:8660

C:\Windows\System\yFUhmMg.exe
C:\Windows\System\yFUhmMg.exe
2⤵
PID:8696

C:\Windows\System\OdscLdO.exe
C:\Windows\System\OdscLdO.exe
2⤵
PID:8744

C:\Windows\System\upZYjae.exe
C:\Windows\System\upZYjae.exe
2⤵
PID:8756

C:\Windows\System\JrwMrrH.exe
C:\Windows\System\JrwMrrH.exe
2⤵
PID:8832

C:\Windows\System\BPphkmp.exe
C:\Windows\System\BPphkmp.exe
2⤵
PID:8888

C:\Windows\System\AnhpJuF.exe
C:\Windows\System\AnhpJuF.exe
2⤵
PID:8956

C:\Windows\System\nSxHLzn.exe
C:\Windows\System\nSxHLzn.exe
2⤵
PID:9032

C:\Windows\System\mYljJmg.exe
C:\Windows\System\mYljJmg.exe
2⤵
PID:9184

C:\Windows\System\xLtMaAS.exe
C:\Windows\System\xLtMaAS.exe
2⤵
PID:8324

C:\Windows\System\fTIfbyV.exe
C:\Windows\System\fTIfbyV.exe
2⤵
PID:8524

C:\Windows\System\ydTSeLN.exe
C:\Windows\System\ydTSeLN.exe
2⤵
PID:8700

C:\Windows\System\ehQpXaL.exe
C:\Windows\System\ehQpXaL.exe
2⤵
PID:8780

C:\Windows\System\sFkoaBH.exe
C:\Windows\System\sFkoaBH.exe
2⤵
PID:8860

C:\Windows\System\SfTVEWS.exe
C:\Windows\System\SfTVEWS.exe
2⤵
PID:8912

C:\Windows\System\MyzIwrx.exe
C:\Windows\System\MyzIwrx.exe
2⤵
PID:9128

C:\Windows\System\enlhYsb.exe
C:\Windows\System\enlhYsb.exe
2⤵
PID:8352

C:\Windows\System\JgChNfO.exe
C:\Windows\System\JgChNfO.exe
2⤵
PID:8584

C:\Windows\System\SxgTtxt.exe
C:\Windows\System\SxgTtxt.exe
2⤵
PID:8856

C:\Windows\System\SqJdSEg.exe
C:\Windows\System\SqJdSEg.exe
2⤵
PID:8208

C:\Windows\System\NwOkWJX.exe
C:\Windows\System\NwOkWJX.exe
2⤵
PID:9228

C:\Windows\System\QlcgktI.exe
C:\Windows\System\QlcgktI.exe
2⤵
PID:9268

C:\Windows\System\lOJsAfK.exe
C:\Windows\System\lOJsAfK.exe
2⤵
PID:9292

C:\Windows\System\bOXfjPw.exe
C:\Windows\System\bOXfjPw.exe
2⤵
PID:9312

C:\Windows\System\wzwZUqb.exe
C:\Windows\System\wzwZUqb.exe
2⤵
PID:9336

C:\Windows\System\MDSNOjc.exe
C:\Windows\System\MDSNOjc.exe
2⤵
PID:9368

C:\Windows\System\cXiPlgD.exe
C:\Windows\System\cXiPlgD.exe
2⤵
PID:9396

C:\Windows\System\MphwYbj.exe
C:\Windows\System\MphwYbj.exe
2⤵
PID:9424

C:\Windows\System\naLSFtG.exe
C:\Windows\System\naLSFtG.exe
2⤵
PID:9480

C:\Windows\System\LslzGeW.exe
C:\Windows\System\LslzGeW.exe
2⤵
PID:9508

C:\Windows\System\keSLZtX.exe
C:\Windows\System\keSLZtX.exe
2⤵
PID:9528

C:\Windows\System\fIuRBnc.exe
C:\Windows\System\fIuRBnc.exe
2⤵
PID:9544

C:\Windows\System\eepDWyw.exe
C:\Windows\System\eepDWyw.exe
2⤵
PID:9580

C:\Windows\System\lVhoBXp.exe
C:\Windows\System\lVhoBXp.exe
2⤵
PID:9600

C:\Windows\System\uTBIMJZ.exe
C:\Windows\System\uTBIMJZ.exe
2⤵
PID:9652

C:\Windows\System\NrIujBk.exe
C:\Windows\System\NrIujBk.exe
2⤵
PID:9676

C:\Windows\System\xACIKoj.exe
C:\Windows\System\xACIKoj.exe
2⤵
PID:9696

C:\Windows\System\bQGbQnk.exe
C:\Windows\System\bQGbQnk.exe
2⤵
PID:9724

C:\Windows\System\FALKidx.exe
C:\Windows\System\FALKidx.exe
2⤵
PID:9744

C:\Windows\System\YMQNgvT.exe
C:\Windows\System\YMQNgvT.exe
2⤵
PID:9764

C:\Windows\System\INoCNlP.exe
C:\Windows\System\INoCNlP.exe
2⤵
PID:9788

C:\Windows\System\HROaVaC.exe
C:\Windows\System\HROaVaC.exe
2⤵
PID:9812

C:\Windows\System\nlaGjQM.exe
C:\Windows\System\nlaGjQM.exe
2⤵
PID:9860

C:\Windows\System\EeeLGRR.exe
C:\Windows\System\EeeLGRR.exe
2⤵
PID:9884

C:\Windows\System\FMroksc.exe
C:\Windows\System\FMroksc.exe
2⤵
PID:9928

C:\Windows\System\klJDWhS.exe
C:\Windows\System\klJDWhS.exe
2⤵
PID:9948

C:\Windows\System\knMmvlH.exe
C:\Windows\System\knMmvlH.exe
2⤵
PID:9972

C:\Windows\System\wWpXdQs.exe
C:\Windows\System\wWpXdQs.exe
2⤵
PID:9988

C:\Windows\System\eZOrXwr.exe
C:\Windows\System\eZOrXwr.exe
2⤵
PID:10016

C:\Windows\System\Vcpfnol.exe
C:\Windows\System\Vcpfnol.exe
2⤵
PID:10068

C:\Windows\System\FuqHuSa.exe
C:\Windows\System\FuqHuSa.exe
2⤵
PID:10088

C:\Windows\System\ZDdIFKA.exe
C:\Windows\System\ZDdIFKA.exe
2⤵
PID:10132

C:\Windows\System\WuXGXxe.exe
C:\Windows\System\WuXGXxe.exe
2⤵
PID:10152

C:\Windows\System\ZWGvohA.exe
C:\Windows\System\ZWGvohA.exe
2⤵
PID:10176

C:\Windows\System\rgWpOIe.exe
C:\Windows\System\rgWpOIe.exe
2⤵
PID:10204

C:\Windows\System\YCgMVHr.exe
C:\Windows\System\YCgMVHr.exe
2⤵
PID:10232

C:\Windows\System\UrYxsiI.exe
C:\Windows\System\UrYxsiI.exe
2⤵
PID:9100

C:\Windows\System\LnQnktS.exe
C:\Windows\System\LnQnktS.exe
2⤵
PID:9260

C:\Windows\System\OqdnhJT.exe
C:\Windows\System\OqdnhJT.exe
2⤵
PID:9328

C:\Windows\System\ltECREc.exe
C:\Windows\System\ltECREc.exe
2⤵
PID:9384

C:\Windows\System\JoZTXxp.exe
C:\Windows\System\JoZTXxp.exe
2⤵
PID:9500

C:\Windows\System\TNIqIor.exe
C:\Windows\System\TNIqIor.exe
2⤵
PID:9536

C:\Windows\System\twrkGjl.exe
C:\Windows\System\twrkGjl.exe
2⤵
PID:9592

C:\Windows\System\WoiBVGB.exe
C:\Windows\System\WoiBVGB.exe
2⤵
PID:9628

C:\Windows\System\cFgqFSv.exe
C:\Windows\System\cFgqFSv.exe
2⤵
PID:9684

C:\Windows\System\RhUsmhB.exe
C:\Windows\System\RhUsmhB.exe
2⤵
PID:9784

C:\Windows\System\bOwCCRK.exe
C:\Windows\System\bOwCCRK.exe
2⤵
PID:9756

C:\Windows\System\mvriCjl.exe
C:\Windows\System\mvriCjl.exe
2⤵
PID:9904

C:\Windows\System\PdAxPHu.exe
C:\Windows\System\PdAxPHu.exe
2⤵
PID:9964

C:\Windows\System\WedOEIp.exe
C:\Windows\System\WedOEIp.exe
2⤵
PID:10104

C:\Windows\System\YaqmbUP.exe
C:\Windows\System\YaqmbUP.exe
2⤵
PID:10160

C:\Windows\System\BzwgxrN.exe
C:\Windows\System\BzwgxrN.exe
2⤵
PID:10220

C:\Windows\System\adIcuuo.exe
C:\Windows\System\adIcuuo.exe
2⤵
PID:9276

C:\Windows\System\tyhghDk.exe
C:\Windows\System\tyhghDk.exe
2⤵
PID:9352

C:\Windows\System\ffxuXSZ.exe
C:\Windows\System\ffxuXSZ.exe
2⤵
PID:9596

C:\Windows\System\lxCvGDf.exe
C:\Windows\System\lxCvGDf.exe
2⤵
PID:9688

C:\Windows\System\YUAdJcm.exe
C:\Windows\System\YUAdJcm.exe
2⤵
PID:9876

C:\Windows\System\eiOGJwB.exe
C:\Windows\System\eiOGJwB.exe
2⤵
PID:10052

C:\Windows\System\EqQueUQ.exe
C:\Windows\System\EqQueUQ.exe
2⤵
PID:10188

C:\Windows\System\UkYEIRJ.exe
C:\Windows\System\UkYEIRJ.exe
2⤵
PID:9556

C:\Windows\System\rbiLjjK.exe
C:\Windows\System\rbiLjjK.exe
2⤵
PID:9720

C:\Windows\System\ITggJOV.exe
C:\Windows\System\ITggJOV.exe
2⤵
PID:10108

C:\Windows\System\uTlHTBP.exe
C:\Windows\System\uTlHTBP.exe
2⤵
PID:9800

C:\Windows\System\NfnXQmt.exe
C:\Windows\System\NfnXQmt.exe
2⤵
PID:10252

C:\Windows\System\HTHqGhf.exe
C:\Windows\System\HTHqGhf.exe
2⤵
PID:10280

C:\Windows\System\AXIGaeY.exe
C:\Windows\System\AXIGaeY.exe
2⤵
PID:10304

C:\Windows\System\TDGPlAU.exe
C:\Windows\System\TDGPlAU.exe
2⤵
PID:10332

C:\Windows\System\PNEnqwt.exe
C:\Windows\System\PNEnqwt.exe
2⤵
PID:10356

C:\Windows\System\uAomHCS.exe
C:\Windows\System\uAomHCS.exe
2⤵
PID:10384

C:\Windows\System\ItWDRXr.exe
C:\Windows\System\ItWDRXr.exe
2⤵
PID:10428

C:\Windows\System\iQaGsrD.exe
C:\Windows\System\iQaGsrD.exe
2⤵
PID:10452

C:\Windows\System\XEKtghT.exe
C:\Windows\System\XEKtghT.exe
2⤵
PID:10468

C:\Windows\System\xIRAEvH.exe
C:\Windows\System\xIRAEvH.exe
2⤵
PID:10492

C:\Windows\System\jJpkwSz.exe
C:\Windows\System\jJpkwSz.exe
2⤵
PID:10536

C:\Windows\System\jyhRkLA.exe
C:\Windows\System\jyhRkLA.exe
2⤵
PID:10556

C:\Windows\System\QBylAvT.exe
C:\Windows\System\QBylAvT.exe
2⤵
PID:10580

C:\Windows\System\lCwPzqa.exe
C:\Windows\System\lCwPzqa.exe
2⤵
PID:10600

C:\Windows\System\CpGZEbo.exe
C:\Windows\System\CpGZEbo.exe
2⤵
PID:10640

C:\Windows\System\YkGDZOS.exe
C:\Windows\System\YkGDZOS.exe
2⤵
PID:10684

C:\Windows\System\NglULSX.exe
C:\Windows\System\NglULSX.exe
2⤵
PID:10716

C:\Windows\System\IKxdcpO.exe
C:\Windows\System\IKxdcpO.exe
2⤵
PID:10740

C:\Windows\System\boIfzEr.exe
C:\Windows\System\boIfzEr.exe
2⤵
PID:10760

C:\Windows\System\DQtpPQZ.exe
C:\Windows\System\DQtpPQZ.exe
2⤵
PID:10828

C:\Windows\System\qzONuWJ.exe
C:\Windows\System\qzONuWJ.exe
2⤵
PID:10880

C:\Windows\System\FBBhrVX.exe
C:\Windows\System\FBBhrVX.exe
2⤵
PID:10920

C:\Windows\System\YbNBFBD.exe
C:\Windows\System\YbNBFBD.exe
2⤵
PID:10948

C:\Windows\System\OrkcXnH.exe
C:\Windows\System\OrkcXnH.exe
2⤵
PID:10988

C:\Windows\System\hOPyxnl.exe
C:\Windows\System\hOPyxnl.exe
2⤵
PID:11004

C:\Windows\System\aVBfaxN.exe
C:\Windows\System\aVBfaxN.exe
2⤵
PID:11024

C:\Windows\System\szvKDtt.exe
C:\Windows\System\szvKDtt.exe
2⤵
PID:11048

C:\Windows\System\ypnTeTV.exe
C:\Windows\System\ypnTeTV.exe
2⤵
PID:11064

C:\Windows\System\pfmolbJ.exe
C:\Windows\System\pfmolbJ.exe
2⤵
PID:11080

C:\Windows\System\oFbrdKD.exe
C:\Windows\System\oFbrdKD.exe
2⤵
PID:11096

C:\Windows\System\aArUzCu.exe
C:\Windows\System\aArUzCu.exe
2⤵
PID:11112

C:\Windows\System\WZjjvzc.exe
C:\Windows\System\WZjjvzc.exe
2⤵
PID:11128

C:\Windows\System\cOKtAAs.exe
C:\Windows\System\cOKtAAs.exe
2⤵
PID:11144

C:\Windows\System\UNkxKFD.exe
C:\Windows\System\UNkxKFD.exe
2⤵
PID:11160

C:\Windows\System\YbgLTdz.exe
C:\Windows\System\YbgLTdz.exe
2⤵
PID:11180

C:\Windows\System\YOLyqEt.exe
C:\Windows\System\YOLyqEt.exe
2⤵
PID:11212

C:\Windows\System\LnPaIvy.exe
C:\Windows\System\LnPaIvy.exe
2⤵
PID:11236

C:\Windows\System\azkJMRr.exe
C:\Windows\System\azkJMRr.exe
2⤵
PID:10408

C:\Windows\System\zwIJQxM.exe
C:\Windows\System\zwIJQxM.exe
2⤵
PID:10632

C:\Windows\System\YFfBELX.exe
C:\Windows\System\YFfBELX.exe
2⤵
PID:10712

C:\Windows\System\fBCQtBV.exe
C:\Windows\System\fBCQtBV.exe
2⤵
PID:10784

C:\Windows\System\PXIISzF.exe
C:\Windows\System\PXIISzF.exe
2⤵
PID:10864

C:\Windows\System\USBloNW.exe
C:\Windows\System\USBloNW.exe
2⤵
PID:10900

C:\Windows\System\EPFSjgV.exe
C:\Windows\System\EPFSjgV.exe
2⤵
PID:10800

C:\Windows\System\cNuWKme.exe
C:\Windows\System\cNuWKme.exe
2⤵
PID:10848

C:\Windows\System\wiBQZTT.exe
C:\Windows\System\wiBQZTT.exe
2⤵
PID:11168

C:\Windows\System\hSWrgPe.exe
C:\Windows\System\hSWrgPe.exe
2⤵
PID:11060

C:\Windows\System\mYoSpoo.exe
C:\Windows\System\mYoSpoo.exe
2⤵
PID:10928

C:\Windows\System\yPnAjhl.exe
C:\Windows\System\yPnAjhl.exe
2⤵
PID:11140

C:\Windows\System\wHvOMta.exe
C:\Windows\System\wHvOMta.exe
2⤵
PID:10980

C:\Windows\System\dUItscm.exe
C:\Windows\System\dUItscm.exe
2⤵
PID:11220

C:\Windows\System\tvUXwRY.exe
C:\Windows\System\tvUXwRY.exe
2⤵
PID:10296

C:\Windows\System\icovHtR.exe
C:\Windows\System\icovHtR.exe
2⤵
PID:10440

C:\Windows\System\MQAzhXk.exe
C:\Windows\System\MQAzhXk.exe
2⤵
PID:10520

C:\Windows\System\OQHOLGt.exe
C:\Windows\System\OQHOLGt.exe
2⤵
PID:10576

C:\Windows\System\VEAibEP.exe
C:\Windows\System\VEAibEP.exe
2⤵
PID:11204

C:\Windows\System\xWMTMgg.exe
C:\Windows\System\xWMTMgg.exe
2⤵
PID:11156

C:\Windows\System\IDTeEZC.exe
C:\Windows\System\IDTeEZC.exe
2⤵
PID:11092

C:\Windows\System\HcrGdYR.exe
C:\Windows\System\HcrGdYR.exe
2⤵
PID:10464

C:\Windows\System\KTyqOHS.exe
C:\Windows\System\KTyqOHS.exe
2⤵
PID:11136

C:\Windows\System\SBJmiFv.exe
C:\Windows\System\SBJmiFv.exe
2⤵
PID:11088

C:\Windows\System\XgwQILA.exe
C:\Windows\System\XgwQILA.exe
2⤵
PID:10064

C:\Windows\System\gInHwuQ.exe
C:\Windows\System\gInHwuQ.exe
2⤵
PID:11280

C:\Windows\System\NWOHWDi.exe
C:\Windows\System\NWOHWDi.exe
2⤵
PID:11300

C:\Windows\System\kFbPZRJ.exe
C:\Windows\System\kFbPZRJ.exe
2⤵
PID:11336

C:\Windows\System\rGbFjCl.exe
C:\Windows\System\rGbFjCl.exe
2⤵
PID:11364

C:\Windows\System\ahDwhlO.exe
C:\Windows\System\ahDwhlO.exe
2⤵
PID:11412

C:\Windows\System\uFvtIua.exe
C:\Windows\System\uFvtIua.exe
2⤵
PID:11436

C:\Windows\System\oUNYZXT.exe
C:\Windows\System\oUNYZXT.exe
2⤵
PID:11464

C:\Windows\System\QEvekhJ.exe
C:\Windows\System\QEvekhJ.exe
2⤵
PID:11492

C:\Windows\System\cVBxOrc.exe
C:\Windows\System\cVBxOrc.exe
2⤵
PID:11512

C:\Windows\System\bYKPDMS.exe
C:\Windows\System\bYKPDMS.exe
2⤵
PID:11532

C:\Windows\System\vtFVkXq.exe
C:\Windows\System\vtFVkXq.exe
2⤵
PID:11560

C:\Windows\System\CBOjHMK.exe
C:\Windows\System\CBOjHMK.exe
2⤵
PID:11576

C:\Windows\System\pZGPGAP.exe
C:\Windows\System\pZGPGAP.exe
2⤵
PID:11600

C:\Windows\System\avyWOAB.exe
C:\Windows\System\avyWOAB.exe
2⤵
PID:11628

C:\Windows\System\UhuuDkp.exe
C:\Windows\System\UhuuDkp.exe
2⤵
PID:11652

C:\Windows\System\jJmDTmA.exe
C:\Windows\System\jJmDTmA.exe
2⤵
PID:11704

C:\Windows\System\gcEKRXG.exe
C:\Windows\System\gcEKRXG.exe
2⤵
PID:11720

C:\Windows\System\EqpTKiV.exe
C:\Windows\System\EqpTKiV.exe
2⤵
PID:11744

C:\Windows\System\ifkeKfq.exe
C:\Windows\System\ifkeKfq.exe
2⤵
PID:11768

C:\Windows\System\OocAnrz.exe
C:\Windows\System\OocAnrz.exe
2⤵
PID:11788

C:\Windows\System\OtpMgQD.exe
C:\Windows\System\OtpMgQD.exe
2⤵
PID:11856

C:\Windows\System\WWkvEjs.exe
C:\Windows\System\WWkvEjs.exe
2⤵
PID:11872

C:\Windows\System\XyjeEkr.exe
C:\Windows\System\XyjeEkr.exe
2⤵
PID:11900

C:\Windows\System\vLUQsiz.exe
C:\Windows\System\vLUQsiz.exe
2⤵
PID:11940

C:\Windows\System\ZcWYgko.exe
C:\Windows\System\ZcWYgko.exe
2⤵
PID:11964

C:\Windows\System\HilLPtM.exe
C:\Windows\System\HilLPtM.exe
2⤵
PID:11996

C:\Windows\System\TVFTLWk.exe
C:\Windows\System\TVFTLWk.exe
2⤵
PID:12012

C:\Windows\System\RfGOpEB.exe
C:\Windows\System\RfGOpEB.exe
2⤵
PID:12040

C:\Windows\System\WhAKizu.exe
C:\Windows\System\WhAKizu.exe
2⤵
PID:12072

C:\Windows\System\cJgjIGC.exe
C:\Windows\System\cJgjIGC.exe
2⤵
PID:12092

C:\Windows\System\EhjekIQ.exe
C:\Windows\System\EhjekIQ.exe
2⤵
PID:12124

C:\Windows\System\PbqGFoD.exe
C:\Windows\System\PbqGFoD.exe
2⤵
PID:12168

C:\Windows\System\civopkT.exe
C:\Windows\System\civopkT.exe
2⤵
PID:12192

C:\Windows\System\iwwEJCN.exe
C:\Windows\System\iwwEJCN.exe
2⤵
PID:12216

C:\Windows\System\YbFZeDE.exe
C:\Windows\System\YbFZeDE.exe
2⤵
PID:12240

C:\Windows\System\iUgAJHR.exe
C:\Windows\System\iUgAJHR.exe
2⤵
PID:12268

C:\Windows\System\JDtESuE.exe
C:\Windows\System\JDtESuE.exe
2⤵
PID:11296

C:\Windows\System\VyiRJrZ.exe
C:\Windows\System\VyiRJrZ.exe
2⤵
PID:11316

C:\Windows\System\woeaosA.exe
C:\Windows\System\woeaosA.exe
2⤵
PID:11328

C:\Windows\System\BCtJLhC.exe
C:\Windows\System\BCtJLhC.exe
2⤵
PID:11432

C:\Windows\System\PUJSrll.exe
C:\Windows\System\PUJSrll.exe
2⤵
PID:11504

C:\Windows\System\UXoYAbI.exe
C:\Windows\System\UXoYAbI.exe
2⤵
PID:11544

C:\Windows\System\VzaGAFC.exe
C:\Windows\System\VzaGAFC.exe
2⤵
PID:11644

C:\Windows\System\HeLGiHf.exe
C:\Windows\System\HeLGiHf.exe
2⤵
PID:11736

C:\Windows\System\IjtMcAO.exe
C:\Windows\System\IjtMcAO.exe
2⤵
PID:11784

C:\Windows\System\cbBDmqm.exe
C:\Windows\System\cbBDmqm.exe
2⤵
PID:11836

C:\Windows\System\iiKncVA.exe
C:\Windows\System\iiKncVA.exe
2⤵
PID:11920

C:\Windows\System\WyjIFdH.exe
C:\Windows\System\WyjIFdH.exe
2⤵
PID:11988

C:\Windows\System\ByFBhRa.exe
C:\Windows\System\ByFBhRa.exe
2⤵
PID:12064

C:\Windows\System\QSMysMI.exe
C:\Windows\System\QSMysMI.exe
2⤵
PID:12120

C:\Windows\System\HcUdfSb.exe
C:\Windows\System\HcUdfSb.exe
2⤵
PID:12176

C:\Windows\System\HxqZtRg.exe
C:\Windows\System\HxqZtRg.exe
2⤵
PID:12208

C:\Windows\System\buTskfd.exe
C:\Windows\System\buTskfd.exe
2⤵
PID:11408

C:\Windows\System\bzMGfGl.exe
C:\Windows\System\bzMGfGl.exe
2⤵
PID:11452

C:\Windows\System\KdzzqxP.exe
C:\Windows\System\KdzzqxP.exe
2⤵
PID:11540

C:\Windows\System\aKFpAHE.exe
C:\Windows\System\aKFpAHE.exe
2⤵
PID:11640

C:\Windows\System\cQmQfVJ.exe
C:\Windows\System\cQmQfVJ.exe
2⤵
PID:11716

C:\Windows\System\SNoUcNe.exe
C:\Windows\System\SNoUcNe.exe
2⤵
PID:12008

C:\Windows\System\VSPWWQl.exe
C:\Windows\System\VSPWWQl.exe
2⤵
PID:4904

C:\Windows\System\zXqojXg.exe
C:\Windows\System\zXqojXg.exe
2⤵
PID:12088

C:\Windows\System\TlhHVbL.exe
C:\Windows\System\TlhHVbL.exe
2⤵
PID:12156

C:\Windows\System\NuKypGD.exe
C:\Windows\System\NuKypGD.exe
2⤵
PID:11404

C:\Windows\System\PTaFkXP.exe
C:\Windows\System\PTaFkXP.exe
2⤵
PID:948

C:\Windows\System\dbfpQni.exe
C:\Windows\System\dbfpQni.exe
2⤵
PID:11728

C:\Windows\System\wnMICqu.exe
C:\Windows\System\wnMICqu.exe
2⤵
PID:11616

C:\Windows\System\mduJyvj.exe
C:\Windows\System\mduJyvj.exe
2⤵
PID:3112

C:\Windows\System\wpZLwTF.exe
C:\Windows\System\wpZLwTF.exe
2⤵
PID:12056

C:\Windows\System\ilHlotk.exe
C:\Windows\System\ilHlotk.exe
2⤵
PID:11976

C:\Windows\System\qsSApKS.exe
C:\Windows\System\qsSApKS.exe
2⤵
PID:12308

C:\Windows\System\quLSqHv.exe
C:\Windows\System\quLSqHv.exe
2⤵
PID:12340

C:\Windows\System\pHSDprP.exe
C:\Windows\System\pHSDprP.exe
2⤵
PID:12364

C:\Windows\System\EuTNIhH.exe
C:\Windows\System\EuTNIhH.exe
2⤵
PID:12392

C:\Windows\System\dDYuqTO.exe
C:\Windows\System\dDYuqTO.exe
2⤵
PID:12412

C:\Windows\System\vxBhzrN.exe
C:\Windows\System\vxBhzrN.exe
2⤵
PID:12436

C:\Windows\System\IdVXmaZ.exe
C:\Windows\System\IdVXmaZ.exe
2⤵
PID:12488

C:\Windows\System\BrzAfPr.exe
C:\Windows\System\BrzAfPr.exe
2⤵
PID:12524

C:\Windows\System\PKebQZI.exe
C:\Windows\System\PKebQZI.exe
2⤵
PID:12548

C:\Windows\System\uHNvrKd.exe
C:\Windows\System\uHNvrKd.exe
2⤵
PID:12576

C:\Windows\System\ummsrIA.exe
C:\Windows\System\ummsrIA.exe
2⤵
PID:12608

C:\Windows\System\XmFNuCC.exe
C:\Windows\System\XmFNuCC.exe
2⤵
PID:12628

C:\Windows\System\bdxZlbR.exe
C:\Windows\System\bdxZlbR.exe
2⤵
PID:12648

C:\Windows\System\sQFcAzN.exe
C:\Windows\System\sQFcAzN.exe
2⤵
PID:12688

C:\Windows\System\rYYqbgd.exe
C:\Windows\System\rYYqbgd.exe
2⤵
PID:12712

C:\Windows\System\OyDfaQN.exe
C:\Windows\System\OyDfaQN.exe
2⤵
PID:12732

C:\Windows\System\Plqtxpd.exe
C:\Windows\System\Plqtxpd.exe
2⤵
PID:12756

C:\Windows\System\qKdsuTD.exe
C:\Windows\System\qKdsuTD.exe
2⤵
PID:12776

C:\Windows\System\GKjxjvc.exe
C:\Windows\System\GKjxjvc.exe
2⤵
PID:12804

C:\Windows\System\BzoSMPC.exe
C:\Windows\System\BzoSMPC.exe
2⤵
PID:12828

C:\Windows\System\nHMVeQF.exe
C:\Windows\System\nHMVeQF.exe
2⤵
PID:12852

C:\Windows\System\opXPQxO.exe
C:\Windows\System\opXPQxO.exe
2⤵
PID:12900

C:\Windows\System\iylswUX.exe
C:\Windows\System\iylswUX.exe
2⤵
PID:12932

C:\Windows\System\bQrTYqu.exe
C:\Windows\System\bQrTYqu.exe
2⤵
PID:12956

C:\Windows\System\raRjUfU.exe
C:\Windows\System\raRjUfU.exe
2⤵
PID:12980

C:\Windows\System\jovmsFH.exe
C:\Windows\System\jovmsFH.exe
2⤵
PID:13008

C:\Windows\System\Gnridzg.exe
C:\Windows\System\Gnridzg.exe
2⤵
PID:13028

C:\Windows\System\HPzoQWv.exe
C:\Windows\System\HPzoQWv.exe
2⤵
PID:13052

C:\Windows\System\CxJkutT.exe
C:\Windows\System\CxJkutT.exe
2⤵
PID:12640

C:\Windows\System\bZtGwIX.exe
C:\Windows\System\bZtGwIX.exe
2⤵
PID:12748

C:\Windows\System\baaIJMp.exe
C:\Windows\System\baaIJMp.exe
2⤵
PID:12912

C:\Windows\System\xVuyfiC.exe
C:\Windows\System\xVuyfiC.exe
2⤵
PID:12948

C:\Windows\System\krgvAwl.exe
C:\Windows\System\krgvAwl.exe
2⤵
PID:13044

C:\Windows\System\EEejurn.exe
C:\Windows\System\EEejurn.exe
2⤵
PID:13184

C:\Windows\System\UUIGXeK.exe
C:\Windows\System\UUIGXeK.exe
2⤵
PID:11752

C:\Windows\System\sXVHnNG.exe
C:\Windows\System\sXVHnNG.exe
2⤵
PID:316

C:\Windows\System\CjiUTSG.exe
C:\Windows\System\CjiUTSG.exe
2⤵
PID:13092

C:\Windows\System\BbndLMx.exe
C:\Windows\System\BbndLMx.exe
2⤵
PID:12836

C:\Windows\System\TzDgPbK.exe
C:\Windows\System\TzDgPbK.exe
2⤵
PID:1228

C:\Windows\System\ztkkUca.exe
C:\Windows\System\ztkkUca.exe
2⤵
PID:1232

C:\Windows\System\xrgbihY.exe
C:\Windows\System\xrgbihY.exe
2⤵
PID:12348

C:\Windows\System\AtMRrey.exe
C:\Windows\System\AtMRrey.exe
2⤵
PID:13244

C:\Windows\System\FQXpUaE.exe
C:\Windows\System\FQXpUaE.exe
2⤵
PID:408

C:\Windows\System\gdjdAuE.exe
C:\Windows\System\gdjdAuE.exe
2⤵
PID:12744

C:\Windows\System\UAdwvTG.exe
C:\Windows\System\UAdwvTG.exe
2⤵
PID:3304

C:\Windows\System\uoHrDVu.exe
C:\Windows\System\uoHrDVu.exe
2⤵
PID:12920

C:\Windows\System\tfQFsLT.exe
C:\Windows\System\tfQFsLT.exe
2⤵
PID:12728

C:\Windows\System\QbznLZY.exe
C:\Windows\System\QbznLZY.exe
2⤵
PID:12820

C:\Windows\System\RiqnlBn.exe
C:\Windows\System\RiqnlBn.exe
2⤵
PID:13180

C:\Windows\System\oUxBBAv.exe
C:\Windows\System\oUxBBAv.exe
2⤵
PID:13236

C:\Windows\System\JWBxxHH.exe
C:\Windows\System\JWBxxHH.exe
2⤵
PID:13096

C:\Windows\System\FHBAIHN.exe
C:\Windows\System\FHBAIHN.exe
2⤵
PID:12424

C:\Windows\System\VRTOvTi.exe
C:\Windows\System\VRTOvTi.exe
2⤵
PID:13216

C:\Windows\System\eNumaEe.exe
C:\Windows\System\eNumaEe.exe
2⤵
PID:4780

C:\Windows\System\JGKPiWQ.exe
C:\Windows\System\JGKPiWQ.exe
2⤵
PID:12444

C:\Windows\System\WFuoQRU.exe
C:\Windows\System\WFuoQRU.exe
2⤵
PID:12384

C:\Windows\System\ILPNAOu.exe
C:\Windows\System\ILPNAOu.exe
2⤵
PID:1548

C:\Windows\System\jeeIRDC.exe
C:\Windows\System\jeeIRDC.exe
2⤵
PID:4424

C:\Windows\System\QUAGfHf.exe
C:\Windows\System\QUAGfHf.exe
2⤵
PID:2172

C:\Windows\System\jnoKUpA.exe
C:\Windows\System\jnoKUpA.exe
2⤵
PID:2836

C:\Windows\System\wSAEheB.exe
C:\Windows\System\wSAEheB.exe
2⤵
PID:4444

C:\Windows\System\MLSHibd.exe
C:\Windows\System\MLSHibd.exe
2⤵
PID:13152

C:\Windows\System\QIVhlik.exe
C:\Windows\System\QIVhlik.exe
2⤵
PID:13300

C:\Windows\System\KgKFVaH.exe
C:\Windows\System\KgKFVaH.exe
2⤵
PID:2984

C:\Windows\System\Nkjmymq.exe
C:\Windows\System\Nkjmymq.exe
2⤵
PID:4740

C:\Windows\System\OwVrGYw.exe
C:\Windows\System\OwVrGYw.exe
2⤵
PID:4472

C:\Windows\System\mnSMOhm.exe
C:\Windows\System\mnSMOhm.exe
2⤵
PID:3480

C:\Windows\System\UreHZZr.exe
C:\Windows\System\UreHZZr.exe
2⤵
PID:1184

C:\Windows\System\jQiloWI.exe
C:\Windows\System\jQiloWI.exe
2⤵
PID:4812

C:\Windows\System\jWcxchK.exe
C:\Windows\System\jWcxchK.exe
2⤵
PID:4304

C:\Windows\System\SioqUOG.exe
C:\Windows\System\SioqUOG.exe
2⤵
PID:696

C:\Windows\System\tGQtYRl.exe
C:\Windows\System\tGQtYRl.exe
2⤵
PID:4256

C:\Windows\System\uBunkeh.exe
C:\Windows\System\uBunkeh.exe
2⤵
PID:12876

C:\Windows\System\qsfcPwJ.exe
C:\Windows\System\qsfcPwJ.exe
2⤵
PID:12740

C:\Windows\System\MMhiCfo.exe
C:\Windows\System\MMhiCfo.exe
2⤵
PID:2928

C:\Windows\System\zKOrCGh.exe
C:\Windows\System\zKOrCGh.exe
2⤵
PID:1532

C:\Windows\System\iDccePq.exe
C:\Windows\System\iDccePq.exe
2⤵
PID:2332

C:\Windows\System\lGtoPJG.exe
C:\Windows\System\lGtoPJG.exe
2⤵
PID:5036

C:\Windows\System\hQvmmsh.exe
C:\Windows\System\hQvmmsh.exe
2⤵
PID:5052

C:\Windows\System\FUOfByv.exe
C:\Windows\System\FUOfByv.exe
2⤵
PID:4772

C:\Windows\System\eXwDDkX.exe
C:\Windows\System\eXwDDkX.exe
2⤵
PID:3272

C:\Windows\System\UNaOLdX.exe
C:\Windows\System\UNaOLdX.exe
2⤵
PID:7152

C:\Windows\System\ZnGXHGg.exe
C:\Windows\System\ZnGXHGg.exe
2⤵
PID:8456

C:\Windows\System\HUaAxGG.exe
C:\Windows\System\HUaAxGG.exe
2⤵
PID:6096

C:\Windows\System\YlMWcty.exe
C:\Windows\System\YlMWcty.exe
2⤵
PID:3248

C:\Windows\System\oCweKFe.exe
C:\Windows\System\oCweKFe.exe
2⤵
PID:8680

C:\Windows\System\pyxvNXx.exe
C:\Windows\System\pyxvNXx.exe
2⤵
PID:5776

C:\Windows\System\SdTUbQi.exe
C:\Windows\System\SdTUbQi.exe
2⤵
PID:6624

C:\Windows\System\OCZBZjj.exe
C:\Windows\System\OCZBZjj.exe
2⤵
PID:8232

C:\Windows\System\grbBjYG.exe
C:\Windows\System\grbBjYG.exe
2⤵
PID:8284

C:\Windows\System\ZuMCAjj.exe
C:\Windows\System\ZuMCAjj.exe
2⤵
PID:6604

C:\Windows\System\WDYoLnN.exe
C:\Windows\System\WDYoLnN.exe
2⤵
PID:6584

C:\Windows\System\yDOBrYQ.exe
C:\Windows\System\yDOBrYQ.exe
2⤵
PID:6768

C:\Windows\System\MHVEZmd.exe
C:\Windows\System\MHVEZmd.exe
2⤵
PID:3180

C:\Windows\System\CrlTGFF.exe
C:\Windows\System\CrlTGFF.exe
2⤵
PID:8256

C:\Windows\System\hcXwSwS.exe
C:\Windows\System\hcXwSwS.exe
2⤵
PID:8356

C:\Windows\System\SIaWMRR.exe
C:\Windows\System\SIaWMRR.exe
2⤵
PID:2288

C:\Windows\System\YSIajMM.exe
C:\Windows\System\YSIajMM.exe
2⤵
PID:7936

C:\Windows\System\kkstEXa.exe
C:\Windows\System\kkstEXa.exe
2⤵
PID:8124

C:\Windows\System\EUETIsJ.exe
C:\Windows\System\EUETIsJ.exe
2⤵
PID:5756

C:\Windows\System\SrYOyHj.exe
C:\Windows\System\SrYOyHj.exe
2⤵
PID:8440

C:\Windows\System\RNXaTzH.exe
C:\Windows\System\RNXaTzH.exe
2⤵
PID:6880

C:\Windows\System\wZoMWBB.exe
C:\Windows\System\wZoMWBB.exe
2⤵
PID:3084

C:\Windows\System\ownqDTm.exe
C:\Windows\System\ownqDTm.exe
2⤵
PID:6772

C:\Windows\System\fXqUiqE.exe
C:\Windows\System\fXqUiqE.exe
2⤵
PID:2844

C:\Windows\System\cAcnvBc.exe
C:\Windows\System\cAcnvBc.exe
2⤵
PID:8412

C:\Windows\System\kIzTTKi.exe
C:\Windows\System\kIzTTKi.exe
2⤵
PID:11508

C:\Windows\System\ZJeqtrI.exe
C:\Windows\System\ZJeqtrI.exe
2⤵
PID:5148

C:\Windows\System\wrmlXof.exe
C:\Windows\System\wrmlXof.exe
2⤵
PID:9660

C:\Windows\System\MXMQmRG.exe
C:\Windows\System\MXMQmRG.exe
2⤵
PID:11016

C:\Windows\System\qDdwLya.exe
C:\Windows\System\qDdwLya.exe
2⤵
PID:5424

C:\Windows\System\UADnrnC.exe
C:\Windows\System\UADnrnC.exe
2⤵
PID:9808

C:\Windows\System\ZrpssWA.exe
C:\Windows\System\ZrpssWA.exe
2⤵
PID:12084

C:\Windows\System\IufbHkH.exe
C:\Windows\System\IufbHkH.exe
2⤵
PID:8720

C:\Windows\System\TGcHuhI.exe
C:\Windows\System\TGcHuhI.exe
2⤵
PID:9896

C:\Windows\System\aodmJyQ.exe
C:\Windows\System\aodmJyQ.exe
2⤵
PID:9908

C:\Windows\System\MVEglOG.exe
C:\Windows\System\MVEglOG.exe
2⤵
PID:5520

C:\Windows\System\uNlCnSE.exe
C:\Windows\System\uNlCnSE.exe
2⤵
PID:7908

C:\Windows\System\FkdWJqa.exe
C:\Windows\System\FkdWJqa.exe
2⤵
PID:10824

C:\Windows\System\ilzkDLA.exe
C:\Windows\System\ilzkDLA.exe
2⤵
PID:11356

C:\Windows\System\hYbQJsY.exe
C:\Windows\System\hYbQJsY.exe
2⤵
PID:10100

C:\Windows\System\YVXGUjc.exe
C:\Windows\System\YVXGUjc.exe
2⤵
PID:2336

C:\Windows\System\QiFhRoe.exe
C:\Windows\System\QiFhRoe.exe
2⤵
PID:8040

C:\Windows\System\ZlFkFxe.exe
C:\Windows\System\ZlFkFxe.exe
2⤵
PID:5060

C:\Windows\System\jxATPNj.exe
C:\Windows\System\jxATPNj.exe
2⤵
PID:6892

C:\Windows\System\EPXjRWc.exe
C:\Windows\System\EPXjRWc.exe
2⤵
PID:8908

C:\Windows\System\sBhVLeX.exe
C:\Windows\System\sBhVLeX.exe
2⤵
PID:6984

C:\Windows\System\IcltrBq.exe
C:\Windows\System\IcltrBq.exe
2⤵
PID:11420

C:\Windows\System\pqzpTud.exe
C:\Windows\System\pqzpTud.exe
2⤵
PID:8140

C:\Windows\System\bfVgjoT.exe
C:\Windows\System\bfVgjoT.exe
2⤵
PID:1204

C:\Windows\System\KYVWfAD.exe
C:\Windows\System\KYVWfAD.exe
2⤵
PID:3568

C:\Windows\System\gpKNETq.exe
C:\Windows\System\gpKNETq.exe
2⤵
PID:9476

C:\Windows\System\Pzvadgz.exe
C:\Windows\System\Pzvadgz.exe
2⤵
PID:6992

C:\Windows\System\KOufKEu.exe
C:\Windows\System\KOufKEu.exe
2⤵
PID:11896

C:\Windows\System\ZsUqkcV.exe
C:\Windows\System\ZsUqkcV.exe
2⤵
PID:7776

C:\Windows\System\sNNCLmA.exe
C:\Windows\System\sNNCLmA.exe
2⤵
PID:1660

C:\Windows\System\PykFcWL.exe
C:\Windows\System\PykFcWL.exe
2⤵
PID:7804

C:\Windows\System\BGaRZMF.exe
C:\Windows\System\BGaRZMF.exe
2⤵
PID:12824

C:\Windows\System\naRzVAc.exe
C:\Windows\System\naRzVAc.exe
2⤵
PID:11636

C:\Windows\System\QqfzTUR.exe
C:\Windows\System\QqfzTUR.exe
2⤵
PID:11584

C:\Windows\System\odfOiST.exe
C:\Windows\System\odfOiST.exe
2⤵
PID:4848

C:\Windows\System\ivcrkap.exe
C:\Windows\System\ivcrkap.exe
2⤵
PID:2528

C:\Windows\System\jepBAlp.exe
C:\Windows\System\jepBAlp.exe
2⤵
PID:532

C:\Windows\System\OKCwRNL.exe
C:\Windows\System\OKCwRNL.exe
2⤵
PID:11796

C:\Windows\System\eRkDMRW.exe
C:\Windows\System\eRkDMRW.exe
2⤵
PID:10612

C:\Windows\System\eTFjKws.exe
C:\Windows\System\eTFjKws.exe
2⤵
PID:7276

C:\Windows\System\vCQdCrA.exe
C:\Windows\System\vCQdCrA.exe
2⤵
PID:10416

C:\Windows\System\SROvIRp.exe
C:\Windows\System\SROvIRp.exe
2⤵
PID:5604

C:\Windows\System\HbzchOB.exe
C:\Windows\System\HbzchOB.exe
2⤵
PID:12708

C:\Windows\System\dnhuKJj.exe
C:\Windows\System\dnhuKJj.exe
2⤵
PID:8604

C:\Windows\System\CmUChjw.exe
C:\Windows\System\CmUChjw.exe
2⤵
PID:5780

C:\Windows\System\IXHqEDl.exe
C:\Windows\System\IXHqEDl.exe
2⤵
PID:10964

C:\Windows\System\AvBcPxC.exe
C:\Windows\System\AvBcPxC.exe
2⤵
PID:6452

C:\Windows\System\jyBcnsu.exe
C:\Windows\System\jyBcnsu.exe
2⤵
PID:3752

C:\Windows\System\pmEAAVT.exe
C:\Windows\System\pmEAAVT.exe
2⤵
PID:2484

C:\Windows\System\XjyRHhz.exe
C:\Windows\System\XjyRHhz.exe
2⤵
PID:1980

C:\Windows\System\rDBAWni.exe
C:\Windows\System\rDBAWni.exe
2⤵
PID:4240

C:\Windows\System\aMUwzBs.exe
C:\Windows\System\aMUwzBs.exe
2⤵
PID:10040

C:\Windows\System\zLhSUba.exe
C:\Windows\System\zLhSUba.exe
2⤵
PID:4140

C:\Windows\System\ivrYMwA.exe
C:\Windows\System\ivrYMwA.exe
2⤵
PID:2808

C:\Windows\System\jDYHkuv.exe
C:\Windows\System\jDYHkuv.exe
2⤵
PID:756

C:\Windows\System\wyiuIxS.exe
C:\Windows\System\wyiuIxS.exe
2⤵
PID:6836

C:\Windows\System\ZSyQtmG.exe
C:\Windows\System\ZSyQtmG.exe
2⤵
PID:11396

C:\Windows\System\yAecoJL.exe
C:\Windows\System\yAecoJL.exe
2⤵
PID:9040

C:\Windows\System\TJLtNyI.exe
C:\Windows\System\TJLtNyI.exe
2⤵
PID:1812

C:\Windows\System\FzRWEYk.exe
C:\Windows\System\FzRWEYk.exe
2⤵
PID:5348

C:\Windows\System\TkBVMNm.exe
C:\Windows\System\TkBVMNm.exe
2⤵
PID:2800

C:\Windows\System\sXFfwgf.exe
C:\Windows\System\sXFfwgf.exe
2⤵
PID:12512

C:\Windows\System\ovRWgDD.exe
C:\Windows\System\ovRWgDD.exe
2⤵
PID:4672

C:\Windows\System\USqcmUL.exe
C:\Windows\System\USqcmUL.exe
2⤵
PID:4400

C:\Windows\System\MiSried.exe
C:\Windows\System\MiSried.exe
2⤵
PID:3220

C:\Windows\System\cXPsmBG.exe
C:\Windows\System\cXPsmBG.exe
2⤵
PID:3796

C:\Windows\System\MPvXYzP.exe
C:\Windows\System\MPvXYzP.exe
2⤵
PID:9212

C:\Windows\System\LPZAMlT.exe
C:\Windows\System\LPZAMlT.exe
2⤵
PID:9664

C:\Windows\System\UddJGmt.exe
C:\Windows\System\UddJGmt.exe
2⤵
PID:5996

C:\Windows\System\zMTppWN.exe
C:\Windows\System\zMTppWN.exe
2⤵
PID:6036

C:\Windows\System\blkKbvW.exe
C:\Windows\System\blkKbvW.exe
2⤵
PID:5128

C:\Windows\System\fzpdPcQ.exe
C:\Windows\System\fzpdPcQ.exe
2⤵
PID:10372

C:\Windows\System\JBDXaAC.exe
C:\Windows\System\JBDXaAC.exe
2⤵
PID:5496

C:\Windows\System\Vdskdvp.exe
C:\Windows\System\Vdskdvp.exe
2⤵
PID:12676

C:\Windows\System\pWAejfF.exe
C:\Windows\System\pWAejfF.exe
2⤵
PID:6076

C:\Windows\System\mDmAxqZ.exe
C:\Windows\System\mDmAxqZ.exe
2⤵
PID:6060

C:\Windows\System\gDScEHi.exe
C:\Windows\System\gDScEHi.exe
2⤵
PID:7488

C:\Windows\System\wvbxQbA.exe
C:\Windows\System\wvbxQbA.exe
2⤵
PID:6356

C:\Windows\System\cKrFpLL.exe
C:\Windows\System\cKrFpLL.exe
2⤵
PID:4440

C:\Windows\System\yFNBjRJ.exe
C:\Windows\System\yFNBjRJ.exe
2⤵
PID:4336

C:\Windows\System\QMyZuIf.exe
C:\Windows\System\QMyZuIf.exe
2⤵
PID:9848

C:\Windows\System\HJrolLI.exe
C:\Windows\System\HJrolLI.exe
2⤵
PID:5768

C:\Windows\System\IeNpZIs.exe
C:\Windows\System\IeNpZIs.exe
2⤵
PID:6044

C:\Windows\System\bTrNqSd.exe
C:\Windows\System\bTrNqSd.exe
2⤵
PID:2264

C:\Windows\System\NOnzzfl.exe
C:\Windows\System\NOnzzfl.exe
2⤵
PID:8068

C:\Windows\System\VDFTdvw.exe
C:\Windows\System\VDFTdvw.exe
2⤵
PID:7032

C:\Windows\System\jAWIago.exe
C:\Windows\System\jAWIago.exe
2⤵
PID:11380

C:\Windows\System\qguspdz.exe
C:\Windows\System\qguspdz.exe
2⤵
PID:2044

C:\Windows\System\plmNKhV.exe
C:\Windows\System\plmNKhV.exe
2⤵
PID:6184

C:\Windows\System\xoBRFJy.exe
C:\Windows\System\xoBRFJy.exe
2⤵
PID:5192

C:\Windows\System\xmfzGHH.exe
C:\Windows\System\xmfzGHH.exe
2⤵
PID:7096

C:\Windows\System\ZfBkRbj.exe
C:\Windows\System\ZfBkRbj.exe
2⤵
PID:7080

C:\Windows\System\npPTVIl.exe
C:\Windows\System\npPTVIl.exe
2⤵
PID:10696

C:\Windows\System\glMhbIa.exe
C:\Windows\System\glMhbIa.exe
2⤵
PID:7452

C:\Windows\System\MpoLNDS.exe
C:\Windows\System\MpoLNDS.exe
2⤵
PID:5268

C:\Windows\System\UwTjPQY.exe
C:\Windows\System\UwTjPQY.exe
2⤵
PID:6332

C:\Windows\System\zNUQItm.exe
C:\Windows\System\zNUQItm.exe
2⤵
PID:7528

C:\Windows\System\gLNUbeh.exe
C:\Windows\System\gLNUbeh.exe
2⤵
PID:6692

C:\Windows\System\oAMxoAu.exe
C:\Windows\System\oAMxoAu.exe
2⤵
PID:7116

C:\Windows\System\KSyCMBO.exe
C:\Windows\System\KSyCMBO.exe
2⤵
PID:6556

C:\Windows\System\iIEbJYr.exe
C:\Windows\System\iIEbJYr.exe
2⤵
PID:11276

C:\Windows\System\ThoDqQB.exe
C:\Windows\System\ThoDqQB.exe
2⤵
PID:1456

C:\Windows\System\chwahVu.exe
C:\Windows\System\chwahVu.exe
2⤵
PID:2460

C:\Windows\System\DCyHVsj.exe
C:\Windows\System\DCyHVsj.exe
2⤵
PID:7696

C:\Windows\System\ZLKJjQW.exe
C:\Windows\System\ZLKJjQW.exe
2⤵
PID:5440

C:\Windows\System\TYrIIDG.exe
C:\Windows\System\TYrIIDG.exe
2⤵
PID:7972

C:\Windows\System\gCTqnBx.exe
C:\Windows\System\gCTqnBx.exe
2⤵
PID:5672

C:\Windows\System\twTZFge.exe
C:\Windows\System\twTZFge.exe
2⤵
PID:7864

C:\Windows\System\ZnntygS.exe
C:\Windows\System\ZnntygS.exe
2⤵
PID:4916

C:\Windows\System\mKTrtJO.exe
C:\Windows\System\mKTrtJO.exe
2⤵
PID:5896

C:\Windows\System\pBgfzai.exe
C:\Windows\System\pBgfzai.exe
2⤵
PID:5892

C:\Windows\System\EAnDWMd.exe
C:\Windows\System\EAnDWMd.exe
2⤵
PID:10396

C:\Windows\System\nwnFLNo.exe
C:\Windows\System\nwnFLNo.exe
2⤵
PID:8480

C:\Windows\System\WJdxoKn.exe
C:\Windows\System\WJdxoKn.exe
2⤵
PID:5404

C:\Windows\System\uHNwayC.exe
C:\Windows\System\uHNwayC.exe
2⤵
PID:760

C:\Windows\System\QwTpjux.exe
C:\Windows\System\QwTpjux.exe
2⤵
PID:5656

C:\Windows\System\azjMQyd.exe
C:\Windows\System\azjMQyd.exe
2⤵
PID:7784

C:\Windows\System\cdlguTJ.exe
C:\Windows\System\cdlguTJ.exe
2⤵
PID:8216

C:\Windows\System\KzQDwzB.exe
C:\Windows\System\KzQDwzB.exe
2⤵
PID:7364

C:\Windows\System\RTsQSyW.exe
C:\Windows\System\RTsQSyW.exe
2⤵
PID:11484

C:\Windows\System\olITxxG.exe
C:\Windows\System\olITxxG.exe
2⤵
PID:8260

C:\Windows\System\xUgwFdP.exe
C:\Windows\System\xUgwFdP.exe
2⤵
PID:6168

C:\Windows\System\VpmNbnh.exe
C:\Windows\System\VpmNbnh.exe
2⤵
PID:3288

C:\Windows\System\VpMktFz.exe
C:\Windows\System\VpMktFz.exe
2⤵
PID:8648

C:\Windows\System\yPyvycw.exe
C:\Windows\System\yPyvycw.exe
2⤵
PID:13120

C:\Windows\System\XkliUke.exe
C:\Windows\System\XkliUke.exe
2⤵
PID:6288

C:\Windows\System\cWVQwVt.exe
C:\Windows\System\cWVQwVt.exe
2⤵
PID:960

C:\Windows\System\SVEWRLD.exe
C:\Windows\System\SVEWRLD.exe
2⤵
PID:9124

C:\Windows\System\NETnMwa.exe
C:\Windows\System\NETnMwa.exe
2⤵
PID:4876

C:\Windows\System\MOtWHrM.exe
C:\Windows\System\MOtWHrM.exe
2⤵
PID:9056

C:\Windows\System\yqvnkBZ.exe
C:\Windows\System\yqvnkBZ.exe
2⤵
PID:8892

C:\Windows\System\pSuOPSY.exe
C:\Windows\System\pSuOPSY.exe
2⤵
PID:9132

C:\Windows\System\FfHJTjb.exe
C:\Windows\System\FfHJTjb.exe
2⤵
PID:8636

C:\Windows\System\RCvaYCx.exe
C:\Windows\System\RCvaYCx.exe
2⤵
PID:8328

C:\Windows\System\RMRqObL.exe
C:\Windows\System\RMRqObL.exe
2⤵
PID:7036

C:\Windows\System\WmETtoy.exe
C:\Windows\System\WmETtoy.exe
2⤵
PID:6740

C:\Windows\System\vTpPbXZ.exe
C:\Windows\System\vTpPbXZ.exe
2⤵
PID:9188

C:\Windows\System\lksclyS.exe
C:\Windows\System\lksclyS.exe
2⤵
PID:4964

C:\Windows\System\OmowKwN.exe
C:\Windows\System\OmowKwN.exe
2⤵
PID:7160

C:\Windows\System\XyBkCEm.exe
C:\Windows\System\XyBkCEm.exe
2⤵
PID:1744

C:\Windows\System\HiqHKzD.exe
C:\Windows\System\HiqHKzD.exe
2⤵
PID:8304

C:\Windows\System\GMvZyfr.exe
C:\Windows\System\GMvZyfr.exe
2⤵
PID:5320

C:\Windows\System\wcUPUtP.exe
C:\Windows\System\wcUPUtP.exe
2⤵
PID:7212

C:\Windows\System\LEHPzwJ.exe
C:\Windows\System\LEHPzwJ.exe
2⤵
PID:9852

C:\Windows\System\vlXwEIC.exe
C:\Windows\System\vlXwEIC.exe
2⤵
PID:5412

C:\Windows\System\ErTBgTi.exe
C:\Windows\System\ErTBgTi.exe
2⤵
PID:10012

C:\Windows\System\JCXnvjf.exe
C:\Windows\System\JCXnvjf.exe
2⤵
PID:10164

C:\Windows\System\nrhNeId.exe
C:\Windows\System\nrhNeId.exe
2⤵
PID:7412

C:\Windows\System\jfAkKIs.exe
C:\Windows\System\jfAkKIs.exe
2⤵
PID:9036

C:\Windows\System\JIhohVb.exe
C:\Windows\System\JIhohVb.exe
2⤵
PID:9284

C:\Windows\System\zDKdIcc.exe
C:\Windows\System\zDKdIcc.exe
2⤵
PID:9412

C:\Windows\System\AjyMVKG.exe
C:\Windows\System\AjyMVKG.exe
2⤵
PID:5680

C:\Windows\System\PVvjfqO.exe
C:\Windows\System\PVvjfqO.exe
2⤵
PID:4220

C:\Windows\System\Hjqkpaq.exe
C:\Windows\System\Hjqkpaq.exe
2⤵
PID:9252

C:\Windows\System\LoesYCe.exe
C:\Windows\System\LoesYCe.exe
2⤵
PID:9236

C:\Windows\System\lHSHgHM.exe
C:\Windows\System\lHSHgHM.exe
2⤵
PID:7876

C:\Windows\System\yyYuFym.exe
C:\Windows\System\yyYuFym.exe
2⤵
PID:5184

C:\Windows\System\acPFAay.exe
C:\Windows\System\acPFAay.exe
2⤵
PID:11764

C:\Windows\System\LNisVSs.exe
C:\Windows\System\LNisVSs.exe
2⤵
PID:10368

C:\Windows\System\lJAIWpV.exe
C:\Windows\System\lJAIWpV.exe
2⤵
PID:12508

C:\Windows\System\CbDKVWm.exe
C:\Windows\System\CbDKVWm.exe
2⤵
PID:7572

C:\Windows\System\pkQDaLR.exe
C:\Windows\System\pkQDaLR.exe
2⤵
PID:10620

C:\Windows\System\iHqDSeY.exe
C:\Windows\System\iHqDSeY.exe
2⤵
PID:10476

C:\Windows\System\aCCiKzs.exe
C:\Windows\System\aCCiKzs.exe
2⤵
PID:10932

C:\Windows\System\CqxZVrh.exe
C:\Windows\System\CqxZVrh.exe
2⤵
PID:5684

C:\Windows\System\bPyioIJ.exe
C:\Windows\System\bPyioIJ.exe
2⤵
PID:13116

C:\Windows\System\LmmCRwO.exe
C:\Windows\System\LmmCRwO.exe
2⤵
PID:6164

C:\Windows\System\TpnvCtJ.exe
C:\Windows\System\TpnvCtJ.exe
2⤵
PID:8880

C:\Windows\System\GmMYstL.exe
C:\Windows\System\GmMYstL.exe
2⤵
PID:10400

C:\Windows\System\hyfXzIn.exe
C:\Windows\System\hyfXzIn.exe
2⤵
PID:6176

C:\Windows\System\gfvwjsm.exe
C:\Windows\System\gfvwjsm.exe
2⤵
PID:13040

C:\Windows\System\HZsFMup.exe
C:\Windows\System\HZsFMup.exe
2⤵
PID:10772

C:\Windows\System\iQcRxXp.exe
C:\Windows\System\iQcRxXp.exe
2⤵
PID:8376

C:\Windows\System\bFMzPEG.exe
C:\Windows\System\bFMzPEG.exe
2⤵
PID:10940

C:\Windows\System\YohoRRJ.exe
C:\Windows\System\YohoRRJ.exe
2⤵
PID:7120

C:\Windows\System\JhWpCld.exe
C:\Windows\System\JhWpCld.exe
2⤵
PID:10972

C:\Windows\System\jISXkqX.exe
C:\Windows\System\jISXkqX.exe
2⤵
PID:5244

C:\Windows\System\LRiYdOT.exe
C:\Windows\System\LRiYdOT.exe
2⤵
PID:10124

C:\Windows\System\ZiYcvaB.exe
C:\Windows\System\ZiYcvaB.exe
2⤵
PID:10820

C:\Windows\System\HJEgqVu.exe
C:\Windows\System\HJEgqVu.exe
2⤵
PID:8280

C:\Windows\System\btWzmwY.exe
C:\Windows\System\btWzmwY.exe
2⤵
PID:11040

C:\Windows\System\yVHLoiP.exe
C:\Windows\System\yVHLoiP.exe
2⤵
PID:11324

C:\Windows\System\vkOdAvD.exe
C:\Windows\System\vkOdAvD.exe
2⤵
PID:9432

C:\Windows\System\IqfWgwk.exe
C:\Windows\System\IqfWgwk.exe
2⤵
PID:6640

C:\Windows\System\WKdKGkI.exe
C:\Windows\System\WKdKGkI.exe
2⤵
PID:11488

C:\Windows\System\efYptUX.exe
C:\Windows\System\efYptUX.exe
2⤵
PID:11688

C:\Windows\System\vFpWyZw.exe
C:\Windows\System\vFpWyZw.exe
2⤵
PID:11756

C:\Windows\System\RJqXmda.exe
C:\Windows\System\RJqXmda.exe
2⤵
PID:7312

C:\Windows\System\ZGMToKf.exe
C:\Windows\System\ZGMToKf.exe
2⤵
PID:11884

C:\Windows\System\dYcaydP.exe
C:\Windows\System\dYcaydP.exe
2⤵
PID:7480

C:\Windows\System\puGvfeA.exe
C:\Windows\System\puGvfeA.exe
2⤵
PID:11936

C:\Windows\System\THNfIeF.exe
C:\Windows\System\THNfIeF.exe
2⤵
PID:6260

C:\Windows\System\dFUabdJ.exe
C:\Windows\System\dFUabdJ.exe
2⤵
PID:1924

C:\Windows\System\CxahHjC.exe
C:\Windows\System\CxahHjC.exe
2⤵
PID:12068

C:\Windows\System\WnCzGcS.exe
C:\Windows\System\WnCzGcS.exe
2⤵
PID:10752

C:\Windows\System\xGiRhFy.exe
C:\Windows\System\xGiRhFy.exe
2⤵
PID:9984

C:\Windows\System\MWzrjrN.exe
C:\Windows\System\MWzrjrN.exe
2⤵
PID:10192

C:\Windows\System\LXfrFOV.exe
C:\Windows\System\LXfrFOV.exe
2⤵
PID:7272

C:\Windows\System\BHAHflN.exe
C:\Windows\System\BHAHflN.exe
2⤵
PID:12160

C:\Windows\System\PnSQcRb.exe
C:\Windows\System\PnSQcRb.exe
2⤵
PID:10668

C:\Windows\System\rMbiySj.exe
C:\Windows\System\rMbiySj.exe
2⤵
PID:5764

C:\Windows\System\FvvqHND.exe
C:\Windows\System\FvvqHND.exe
2⤵
PID:5276

C:\Windows\System\uBdZGOw.exe
C:\Windows\System\uBdZGOw.exe
2⤵
PID:7612

C:\Windows\System\dlrlCJv.exe
C:\Windows\System\dlrlCJv.exe
2⤵
PID:9564

C:\Windows\System\cRQgwug.exe
C:\Windows\System\cRQgwug.exe
2⤵
PID:11924

C:\Windows\System\mwoJZMI.exe
C:\Windows\System\mwoJZMI.exe
2⤵
PID:10392

C:\Windows\System\hbQCCRK.exe
C:\Windows\System\hbQCCRK.exe
2⤵
PID:5240

C:\Windows\System\zuaFfvC.exe
C:\Windows\System\zuaFfvC.exe
2⤵
PID:11808

C:\Windows\System\lZAYLdQ.exe
C:\Windows\System\lZAYLdQ.exe
2⤵
PID:12304

C:\Windows\System\RwFsanY.exe
C:\Windows\System\RwFsanY.exe
2⤵
PID:12448

C:\Windows\System\NUxtrHU.exe
C:\Windows\System\NUxtrHU.exe
2⤵
PID:12452

C:\Windows\System\Votbwlm.exe
C:\Windows\System\Votbwlm.exe
2⤵
PID:10344

C:\Windows\System\SxzaBTr.exe
C:\Windows\System\SxzaBTr.exe
2⤵
PID:8624

C:\Windows\System\QYBBGdJ.exe
C:\Windows\System\QYBBGdJ.exe
2⤵
PID:12752

C:\Windows\System\cKdTpbk.exe
C:\Windows\System\cKdTpbk.exe
2⤵
PID:12896

C:\Windows\System\tCznjok.exe
C:\Windows\System\tCznjok.exe
2⤵
PID:10500

C:\Windows\System\srlisbi.exe
C:\Windows\System\srlisbi.exe
2⤵
PID:3912

C:\Windows\System\SclkkuW.exe
C:\Windows\System\SclkkuW.exe
2⤵
PID:9052

C:\Windows\System\swNUkeS.exe
C:\Windows\System\swNUkeS.exe
2⤵
PID:13068

C:\Windows\System\upRQufV.exe
C:\Windows\System\upRQufV.exe
2⤵
PID:3016

C:\Windows\System\PHUiIQP.exe
C:\Windows\System\PHUiIQP.exe
2⤵
PID:10860

C:\Windows\System\fRnACZs.exe
C:\Windows\System\fRnACZs.exe
2⤵
PID:10872

C:\Windows\System\qtXyUob.exe
C:\Windows\System\qtXyUob.exe
2⤵
PID:6180

C:\Windows\System\aYqZOSQ.exe
C:\Windows\System\aYqZOSQ.exe
2⤵
PID:11360

C:\Windows\System\ovabuhQ.exe
C:\Windows\System\ovabuhQ.exe
2⤵
PID:7468

C:\Windows\System\kyikXbh.exe
C:\Windows\System\kyikXbh.exe
2⤵
PID:12848

C:\Windows\System\wwooqJj.exe
C:\Windows\System\wwooqJj.exe
2⤵
PID:7300

C:\Windows\System\kCJoEIO.exe
C:\Windows\System\kCJoEIO.exe
2⤵
PID:9840

C:\Windows\System\vFhywvT.exe
C:\Windows\System\vFhywvT.exe
2⤵
PID:7588

C:\Windows\System\GvRdjgH.exe
C:\Windows\System\GvRdjgH.exe
2⤵
PID:12812

C:\Windows\System\zXGYsCi.exe
C:\Windows\System\zXGYsCi.exe
2⤵
PID:12136

C:\Windows\System\uBrjfGd.exe
C:\Windows\System\uBrjfGd.exe
2⤵
PID:12212

C:\Windows\System\OouczTF.exe
C:\Windows\System\OouczTF.exe
2⤵
PID:4516

C:\Windows\System\VJgExQo.exe
C:\Windows\System\VJgExQo.exe
2⤵
PID:5648

C:\Windows\System\UckdYtK.exe
C:\Windows\System\UckdYtK.exe
2⤵
PID:7780

C:\Windows\System\OHKjKOc.exe
C:\Windows\System\OHKjKOc.exe
2⤵
PID:9752

C:\Windows\System\DmbPwdY.exe
C:\Windows\System\DmbPwdY.exe
2⤵
PID:7884

C:\Windows\System\TiAzOnk.exe
C:\Windows\System\TiAzOnk.exe
2⤵
PID:10260

C:\Windows\System\jHbevmZ.exe
C:\Windows\System\jHbevmZ.exe
2⤵
PID:2860

C:\Windows\System\kEoHHTE.exe
C:\Windows\System\kEoHHTE.exe
2⤵
PID:4908

C:\Windows\System\nfpXuTX.exe
C:\Windows\System\nfpXuTX.exe
2⤵
PID:4656

C:\Windows\System\RBpUABX.exe
C:\Windows\System\RBpUABX.exe
2⤵
PID:2704

C:\Windows\System\LwUglyN.exe
C:\Windows\System\LwUglyN.exe
2⤵
PID:3520

C:\Windows\System\fCzxVvX.exe
C:\Windows\System\fCzxVvX.exe
2⤵
PID:1632

C:\Windows\System\cvIkcBH.exe
C:\Windows\System\cvIkcBH.exe
2⤵
PID:10340

C:\Windows\System\zQyiXdQ.exe
C:\Windows\System\zQyiXdQ.exe
2⤵
PID:5488

C:\Windows\System\ECxQXJZ.exe
C:\Windows\System\ECxQXJZ.exe
2⤵
PID:4328

C:\Windows\System\frOLYOZ.exe
C:\Windows\System\frOLYOZ.exe
2⤵
PID:6384

C:\Windows\System\fiOokgM.exe
C:\Windows\System\fiOokgM.exe
2⤵
PID:4320

C:\Windows\System\TcKEnVn.exe
C:\Windows\System\TcKEnVn.exe
2⤵
PID:13100

C:\Windows\System\fuJKWre.exe
C:\Windows\System\fuJKWre.exe
2⤵
PID:11232

C:\Windows\System\XsWdFwF.exe
C:\Windows\System\XsWdFwF.exe
2⤵
PID:11120

C:\Windows\System\OuUUhTm.exe
C:\Windows\System\OuUUhTm.exe
2⤵
PID:9012

C:\Windows\System\ejPxFXa.exe
C:\Windows\System\ejPxFXa.exe
2⤵
PID:9460

C:\Windows\System\DaZgaRS.exe
C:\Windows\System\DaZgaRS.exe
2⤵
PID:7136

C:\Windows\System\LAfkliR.exe
C:\Windows\System\LAfkliR.exe
2⤵
PID:6720

C:\Windows\System\VxZJvAv.exe
C:\Windows\System\VxZJvAv.exe
2⤵
PID:12080

C:\Windows\System\WyAjHHA.exe
C:\Windows\System\WyAjHHA.exe
2⤵
PID:10212

C:\Windows\System\RMiuMnl.exe
C:\Windows\System\RMiuMnl.exe
2⤵
PID:5988

C:\Windows\System\ZbYyOTQ.exe
C:\Windows\System\ZbYyOTQ.exe
2⤵
PID:11960

C:\Windows\System\IlKiNpP.exe
C:\Windows\System\IlKiNpP.exe
2⤵
PID:13004

C:\Windows\System\LHHMqOe.exe
C:\Windows\System\LHHMqOe.exe
2⤵
PID:8876

C:\Windows\System\OTKdYiT.exe
C:\Windows\System\OTKdYiT.exe
2⤵
PID:6300

C:\Windows\System\rzpqgnm.exe
C:\Windows\System\rzpqgnm.exe
2⤵
PID:13304

C:\Windows\System\ffGVdvb.exe
C:\Windows\System\ffGVdvb.exe
2⤵
PID:10552

C:\Windows\System\LCAZZtZ.exe
C:\Windows\System\LCAZZtZ.exe
2⤵
PID:12464

C:\Windows\System\tnpqYop.exe
C:\Windows\System\tnpqYop.exe
2⤵
PID:12972

C:\Windows\System\QVioKUU.exe
C:\Windows\System\QVioKUU.exe
2⤵
PID:1724

C:\Windows\System\bRsXATk.exe
C:\Windows\System\bRsXATk.exe
2⤵
PID:6748

C:\Windows\System\iaYFJRe.exe
C:\Windows\System\iaYFJRe.exe
2⤵
PID:12164

C:\Windows\System\frqzbMS.exe
C:\Windows\System\frqzbMS.exe
2⤵
PID:9736

C:\Windows\System\aOgLRHe.exe
C:\Windows\System\aOgLRHe.exe
2⤵
PID:10200

C:\Windows\System\qniiDDY.exe
C:\Windows\System\qniiDDY.exe
2⤵
PID:10264

C:\Windows\System\DvlFPsy.exe
C:\Windows\System\DvlFPsy.exe
2⤵
PID:8004

C:\Windows\System\FBmaHfX.exe
C:\Windows\System\FBmaHfX.exe
2⤵
PID:12228

C:\Windows\System\rejGWwv.exe
C:\Windows\System\rejGWwv.exe
2⤵
PID:11588

C:\Windows\System\OcwKqxO.exe
C:\Windows\System\OcwKqxO.exe
2⤵
PID:9320

C:\Windows\System\aKteMEJ.exe
C:\Windows\System\aKteMEJ.exe
2⤵
PID:1312

C:\Windows\System\jmGPtxE.exe
C:\Windows\System\jmGPtxE.exe
2⤵
PID:11224

C:\Windows\System\hjUOZPz.exe
C:\Windows\System\hjUOZPz.exe
2⤵
PID:10660

C:\Windows\System\ZMuwjCP.exe
C:\Windows\System\ZMuwjCP.exe
2⤵
PID:12892

C:\Windows\System\ScmKHUG.exe
C:\Windows\System\ScmKHUG.exe
2⤵
PID:13164

C:\Windows\System\gDZYdro.exe
C:\Windows\System\gDZYdro.exe
2⤵
PID:4620

C:\Windows\System\VTGiLhK.exe
C:\Windows\System\VTGiLhK.exe
2⤵
PID:4168

C:\Windows\System\kaNoSIU.exe
C:\Windows\System\kaNoSIU.exe
2⤵
PID:6200

C:\Windows\System\sJCnBVU.exe
C:\Windows\System\sJCnBVU.exe
2⤵
PID:2612

C:\Windows\System\jVRZCsm.exe
C:\Windows\System\jVRZCsm.exe
2⤵
PID:10548

C:\Windows\System\SarubYp.exe
C:\Windows\System\SarubYp.exe
2⤵
PID:1908

C:\Windows\System\JylDJXh.exe
C:\Windows\System\JylDJXh.exe
2⤵
PID:12684

C:\Windows\System\DUWuYmF.exe
C:\Windows\System\DUWuYmF.exe
2⤵
PID:13328

C:\Windows\System\JjdhbJN.exe
C:\Windows\System\JjdhbJN.exe
2⤵
PID:13356

C:\Windows\System\LjaMljo.exe
C:\Windows\System\LjaMljo.exe
2⤵
PID:13384

C:\Windows\System\NViIanR.exe
C:\Windows\System\NViIanR.exe
2⤵
PID:13412

C:\Windows\System\sCjsXlg.exe
C:\Windows\System\sCjsXlg.exe
2⤵
PID:13428

C:\Windows\System\JRkzCuq.exe
C:\Windows\System\JRkzCuq.exe
2⤵
PID:13444

C:\Windows\System\sZQaukW.exe
C:\Windows\System\sZQaukW.exe
2⤵
PID:13488

C:\Windows\System\mtlzvdy.exe
C:\Windows\System\mtlzvdy.exe
2⤵
PID:13524

C:\Windows\System\xZAOqWV.exe
C:\Windows\System\xZAOqWV.exe
2⤵
PID:13552

C:\Windows\System\GGQymdI.exe
C:\Windows\System\GGQymdI.exe
2⤵
PID:13580

C:\Windows\System\ZlDTrpb.exe
C:\Windows\System\ZlDTrpb.exe
2⤵
PID:13608

C:\Windows\System\GQobGZC.exe
C:\Windows\System\GQobGZC.exe
2⤵
PID:13636

C:\Windows\System\TdpnTbD.exe
C:\Windows\System\TdpnTbD.exe
2⤵
PID:13668

C:\Windows\System\QbImnHp.exe
C:\Windows\System\QbImnHp.exe
2⤵
PID:13696

C:\Windows\System\TJHhdZx.exe
C:\Windows\System\TJHhdZx.exe
2⤵
PID:13724

C:\Windows\System\OhlostO.exe
C:\Windows\System\OhlostO.exe
2⤵
PID:13752

C:\Windows\System\UOadPaz.exe
C:\Windows\System\UOadPaz.exe
2⤵
PID:13888

C:\Windows\System\rUYnBXb.exe
C:\Windows\System\rUYnBXb.exe
2⤵
PID:13920

C:\Windows\System\QoUnicA.exe
C:\Windows\System\QoUnicA.exe
2⤵
PID:13940

C:\Windows\System\iuwqiIy.exe
C:\Windows\System\iuwqiIy.exe
2⤵
PID:13980

C:\Windows\System\Decsjmv.exe
C:\Windows\System\Decsjmv.exe
2⤵
PID:14000

C:\Windows\System\bwPJdub.exe
C:\Windows\System\bwPJdub.exe
2⤵
PID:14020

C:\Windows\System\FvxEpln.exe
C:\Windows\System\FvxEpln.exe
2⤵
PID:14072

C:\Windows\System\nkAhgxS.exe
C:\Windows\System\nkAhgxS.exe
2⤵
PID:14100

C:\Windows\System\axmldBb.exe
C:\Windows\System\axmldBb.exe
2⤵
PID:14128

C:\Windows\System\GKMynmB.exe
C:\Windows\System\GKMynmB.exe
2⤵
PID:14156

C:\Windows\System\qZhgcaE.exe
C:\Windows\System\qZhgcaE.exe
2⤵
PID:14184

C:\Windows\System\sjvjouZ.exe
C:\Windows\System\sjvjouZ.exe
2⤵
PID:14212

C:\Windows\System\OkzTwlv.exe
C:\Windows\System\OkzTwlv.exe
2⤵
PID:14240

C:\Windows\System\qnqOvPB.exe
C:\Windows\System\qnqOvPB.exe
2⤵
PID:14268

C:\Windows\System\bLskCKA.exe
C:\Windows\System\bLskCKA.exe
2⤵
PID:14296

C:\Windows\System\sXGjoni.exe
C:\Windows\System\sXGjoni.exe
2⤵
PID:14328

C:\Windows\System\eOFqBYe.exe
C:\Windows\System\eOFqBYe.exe
2⤵
PID:3292

C:\Windows\System\MvyhYTi.exe
C:\Windows\System\MvyhYTi.exe
2⤵
PID:13400

C:\Windows\System\iAfkvTi.exe
C:\Windows\System\iAfkvTi.exe
2⤵
PID:13460

C:\Windows\System\gluXfSJ.exe
C:\Windows\System\gluXfSJ.exe
2⤵
PID:13532

C:\Windows\System\rlYklEl.exe
C:\Windows\System\rlYklEl.exe
2⤵
PID:13560

C:\Windows\System\sftaLld.exe
C:\Windows\System\sftaLld.exe
2⤵
PID:13596

C:\Windows\System\bmEuVpv.exe
C:\Windows\System\bmEuVpv.exe
2⤵
PID:13632

C:\Windows\System\WVUwOPo.exe
C:\Windows\System\WVUwOPo.exe
2⤵
PID:13684

C:\Windows\System\ejGWNVS.exe
C:\Windows\System\ejGWNVS.exe
2⤵
PID:1616

C:\Windows\System\XiibKws.exe
C:\Windows\System\XiibKws.exe
2⤵
PID:13760

C:\Windows\System\BaEAwuC.exe
C:\Windows\System\BaEAwuC.exe
2⤵
PID:13820

C:\Windows\System\GCervrJ.exe
C:\Windows\System\GCervrJ.exe
2⤵
PID:13848

C:\Windows\System\FrptKoj.exe
C:\Windows\System\FrptKoj.exe
2⤵
PID:13868

C:\Windows\System\LbGCwuW.exe
C:\Windows\System\LbGCwuW.exe
2⤵
PID:12328

C:\Windows\System\YJjhMEE.exe
C:\Windows\System\YJjhMEE.exe
2⤵
PID:13936

C:\Windows\System\vpXdldS.exe
C:\Windows\System\vpXdldS.exe
2⤵
PID:14012

C:\Windows\System\baYokhM.exe
C:\Windows\System\baYokhM.exe
2⤵
PID:14060

C:\Windows\System\LRonpIF.exe
C:\Windows\System\LRonpIF.exe
2⤵
PID:14136

C:\Windows\System\zRHXsTc.exe
C:\Windows\System\zRHXsTc.exe
2⤵
PID:14200

C:\Windows\System\PHDXLlZ.exe
C:\Windows\System\PHDXLlZ.exe
2⤵
PID:14264

C:\Windows\System\IvmyLpm.exe
C:\Windows\System\IvmyLpm.exe
2⤵
PID:13316

C:\Windows\System\CTZRVlc.exe
C:\Windows\System\CTZRVlc.exe
2⤵
PID:13420

C:\Windows\System\RKVRwaM.exe
C:\Windows\System\RKVRwaM.exe
2⤵
PID:13520

C:\Windows\System\EosFTBy.exe
C:\Windows\System\EosFTBy.exe
2⤵
PID:13548

C:\Windows\System\HSuhIpr.exe
C:\Windows\System\HSuhIpr.exe
2⤵
PID:13676

C:\Windows\System\rZIAyoY.exe
C:\Windows\System\rZIAyoY.exe
2⤵
PID:1856

C:\Windows\System\AeFOMmM.exe
C:\Windows\System\AeFOMmM.exe
2⤵
PID:13856

C:\Windows\System\WJJETKJ.exe
C:\Windows\System\WJJETKJ.exe
2⤵
PID:13916

C:\Windows\System\PYCNClD.exe
C:\Windows\System\PYCNClD.exe
2⤵
PID:14172

C:\Windows\System\xLNKXsx.exe
C:\Windows\System\xLNKXsx.exe
2⤵
PID:14308

C:\Windows\System\RDxniDJ.exe
C:\Windows\System\RDxniDJ.exe
2⤵
PID:13656

C:\Windows\System\BsYoorv.exe
C:\Windows\System\BsYoorv.exe
2⤵
PID:13836

C:\Windows\System\wwzGdzp.exe
C:\Windows\System\wwzGdzp.exe
2⤵
PID:14048

C:\Windows\System\lZLeRdZ.exe
C:\Windows\System\lZLeRdZ.exe
2⤵
PID:14304

C:\Windows\System\vtQFZdu.exe
C:\Windows\System\vtQFZdu.exe
2⤵
PID:13896

C:\Windows\System\pNKvIlX.exe
C:\Windows\System\pNKvIlX.exe
2⤵
PID:13504

C:\Windows\System\NEdqMLK.exe
C:\Windows\System\NEdqMLK.exe
2⤵
PID:13424

C:\Windows\System\jkRYHEa.exe
C:\Windows\System\jkRYHEa.exe
2⤵
PID:14364

C:\Windows\System\FDRYBua.exe
C:\Windows\System\FDRYBua.exe
2⤵
PID:14392

C:\Windows\System\sYEdoBt.exe
C:\Windows\System\sYEdoBt.exe
2⤵
PID:14420

C:\Windows\System\LOiWmyf.exe
C:\Windows\System\LOiWmyf.exe
2⤵
PID:14436

C:\Windows\System\wPtOVrM.exe
C:\Windows\System\wPtOVrM.exe
2⤵
PID:14452

C:\Windows\System\awaEbWf.exe
C:\Windows\System\awaEbWf.exe
2⤵
PID:14472

C:\Windows\System\WTrsfYd.exe
C:\Windows\System\WTrsfYd.exe
2⤵
PID:14512

C:\Windows\System\JcNWZHF.exe
C:\Windows\System\JcNWZHF.exe
2⤵
PID:14560

C:\Windows\System\ubrLfNZ.exe
C:\Windows\System\ubrLfNZ.exe
2⤵
PID:14592

C:\Windows\System\ltBShIw.exe
C:\Windows\System\ltBShIw.exe
2⤵
PID:14620

C:\Windows\System\cywckfn.exe
C:\Windows\System\cywckfn.exe
2⤵
PID:14648

C:\Windows\System\onmYhKH.exe
C:\Windows\System\onmYhKH.exe
2⤵
PID:14708

C:\Windows\System\bzMadQk.exe
C:\Windows\System\bzMadQk.exe
2⤵
PID:14744

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:12588

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:13208

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sb5hjwfh.an4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\EOAUdyj.exe

Filesize
1.7MB

MD5
186eb7d68a92d35db60ea7da6cac8e16

SHA1
2568c4b23b18efaaf61d2fb5abb2ea5109d1abef

SHA256
470b5f381cfea80871143b976608e231dd7c447d6cf3262005a93096a3e6698a

SHA512
9608fea149cac215eee062af60bda959630e91a25174ddae572eee600bad8f012c286efc98e038d8c24f08046a10c1fd892fadfef2c0d8bc67fa498a78b5fab5

Download Submit
C:\Windows\System\FOGsuHZ.exe

Filesize
1.7MB

MD5
fd0fc51d9e718d45b8df0eb2f054b0f0

SHA1
f204a75a1f1737400be8671352ae10ca3fdf61e7

SHA256
0226da4db2fd8741604e3ac2bcc2c218cb8370847aa424db1809a26cc7956d8b

SHA512
72c018e47b95a83b8f722bf105d2fc662cf7a44bf4b81493405b00efba0fd90b1b84b444ba19995f8fb2046e50a7630c5db503b012b682df67c7a7a0830118c2

Download Submit
C:\Windows\System\GVAxPYb.exe

Filesize
1.7MB

MD5
66125ef744e038b3d3302f8a5ac277ee

SHA1
0d87e3174fa38feb45043d6d7419176bd9c4ce3a

SHA256
3d1c1e53cd7ccb60439def00f6360355b6b235161846c3ddf4b85933e7907793

SHA512
ec880e6aa73cccd51423ed8e5869a75a145f88bf4f985a57e1f016f22acd73c3931b37894dfaff6b2e771cba8427a0d7bc02dc56912e9766baf31f5b2e73c2fc

Download Submit
C:\Windows\System\IWZwGUU.exe

Filesize
1.7MB

MD5
1da8ded2650f223fddbe112a5e604e7c

SHA1
c91da5ed168de79b655a10c0d3805d216b22ad4f

SHA256
7f171d8a10dc7cfd06e820298a93fdbe5b5c2866dbd882fbb645b55b1044966b

SHA512
d1d0c5dab34a553011e146eb5b8a1bc53500cd1279baa73bc8e15e97c8c26975af4fe53e1b12e0d61a47f3b5da0988e3a6bd32ddfde970fe4931e057318757db

Download Submit
C:\Windows\System\IqXCNfW.exe

Filesize
1.7MB

MD5
cd97c6d64573024df1c707a409e57afe

SHA1
4cc228df08568298a622df8d04afbd583341ffb3

SHA256
a93cc23342c2b85f2da1f2b5a3fb9a13ecf5c34cf79ae4cc450966fb936108cb

SHA512
a95836d76ad8b61b0587faf3e0f5352ddd19a6706d34a4ec5be4223b7d023199ae50eb08ae1304880529c4647e045260052ccb7d39ebe8d4b566303e650fa52d

Download Submit
C:\Windows\System\JWQRugG.exe

Filesize
1.7MB

MD5
dca72321af7303dc5221f8af9360c32f

SHA1
96acdc19ff5ef700bf45a8c6d9d3962776d835ac

SHA256
b053568a887694f48e59824955c547774139ba59c471185ee97df8b7e6aba3f4

SHA512
f93d93186107290ac1217dceacecd8699b8f35dd5caa3e7a0584b37b56ad3a89b3c800b4a314be14923e9ab7b95e27439a1c9a8dc4ca8a1c09931359a0a6b337

Download Submit
C:\Windows\System\KQJXslj.exe

Filesize
1.7MB

MD5
ddf3b924153b8012897d78cbf3379137

SHA1
fdb5be2f84f58d5496734a7db017b56765646416

SHA256
22b487aff1e26ca969aeb8a76e896e798b3d956ac9b79e9168f1868e4eecc1a8

SHA512
4706b8f737ff8b2931a58a55c8de993822ad92016da494c466f371f9f8e16b36b42292dc9581957bca236535be6cb53cae47b49956f6194934376b3a5508f462

Download Submit
C:\Windows\System\KXnyhhs.exe

Filesize
1.7MB

MD5
06ea7eabe529f9e0bedd64852d382a7e

SHA1
050f3fb175f0836d63d8d6f83702b577661ed806

SHA256
7339565b40ac337b2b79957d145ccb3917816e73fcdcac1b6c756f6be7fd4e57

SHA512
527495c9587911bcd20a6da6c608c61083457ae16e986b3363ccd4a444c3912c59d57e59a1d5b572a1a7a682a010bd23a6486c294e30adf9811df6cc4f094d23

Download Submit
C:\Windows\System\LJKWvtw.exe

Filesize
1.7MB

MD5
76406f07594d050445ea49c095834aa0

SHA1
32988eb208838c0680034005e33b6e4cc1d25f7e

SHA256
db3a157de769f6ff81217ea21737f33b1f07c8826db0c529e7b9e49b6fd35d17

SHA512
1de7d0dedc245a8ea1168941aafea7ac283f237105bade2b220d56dd568a10ace1b7dfeca1010ae6f9ba707f2681e3b9e324da72cfc2ebb7f03d6ed5d862bf78

Download Submit
C:\Windows\System\LscDDsy.exe

Filesize
1.7MB

MD5
812b0ddf1dbfc4ab6a4e5a5be472f2cc

SHA1
1ad397c345d3586fa966bbdb55c5208c6a7e1b26

SHA256
345fe50a96823dfef7ab832d8e382bf0bdeb75b421f0cfb83b729e4a98d2cc6a

SHA512
137879b2de9cfe28f68548bfd524a6183c71f5744df9185b58a6fff2aab592e63bdc41dde387a73b27f0834e3eb7a1e6b03a218f66d68fd63c37ff600e3aa3c5

Download Submit
C:\Windows\System\OuJplTI.exe

Filesize
1.7MB

MD5
9b4361621234516624aae366722bca87

SHA1
b97ddd948c8d826458898e0ce5e53e01ec297f6e

SHA256
e3806aa0b9efaf57351d9f590064b251d8fb85a58170714282468c1c929ac7b1

SHA512
e0f39d16278edac9c3ef31f31014b301e5fc49ce086dca923a93fc2c6c8e1a1b482f22980c8a385e8693e74c0f9e2e39bd6647d0f21c4716bac2fb4399ca044c

Download Submit
C:\Windows\System\PnfusHZ.exe

Filesize
1.7MB

MD5
f31d48b3ea9caa560e0d1cb8d4e42678

SHA1
b3532f73c5c015258d3f8eb643030409530cf141

SHA256
4c8b31056f5c14a9d2b30740e38c60d61f471987ba23cc0f9db8893484667af2

SHA512
2080ef9864d2e7fb4ef0d796f625ee0e73606067bb702bc3a23350939172bdb4c38ed403c1bb41972396846d4f245f24bf12ad359032652c7b94d71a67599846

Download Submit
C:\Windows\System\QlAVdWl.exe

Filesize
1.7MB

MD5
0dc894ab477acfba311286c068b9299a

SHA1
612d79383dd51aec7d6e316880557de8ecdf0a65

SHA256
39f913dd756454fcc5e72ac5bddf9b503cff579d2d5b803440a5d73abc7a9e25

SHA512
efb850f74f7a80690b2423e1b328b4915275a81ea2c62a67f9383adb9437b64512a7d7bb77f650c54bdb2b1aa42a11a6c42886c5c00b1a555455eabc42b558a0

Download Submit
C:\Windows\System\SMZdELQ.exe

Filesize
1.7MB

MD5
4a1413482d4aa58214cad8b8bacddbc4

SHA1
112ebf488f8874fbc89957e7bc02f1b525b428f2

SHA256
2df82240f81b8358ec8c462f5c7c2e7f7efcf89e900547f4e72d69892722cfcf

SHA512
ef862a61f118e3f1fcfd56629f234b1a7f1583d2fb81b5aa4702b0f86fb20712c168e52c962a4203273a669d0b4c7c8ee1d890e595997fb3881f85a8919ee30f

Download Submit
C:\Windows\System\TrZFDeZ.exe

Filesize
1.7MB

MD5
b6aba02107a4b0e6206757c1987590b5

SHA1
8ae7375d94a4aad4724bc7466579f384265ad2c7

SHA256
7cae87a37f051c95e9feb88fc2712cdcba1c273930325f2964a5345d00294719

SHA512
ce5436caa527295b8b6caa8524744c361b151ae6bdde963b102c6bc985c5fb39fbf83aacec5f8a77a6fd200637554be95bfdaf24f57d44483f779ef0c8add745

Download Submit
C:\Windows\System\UnPtFMa.exe

Filesize
1.7MB

MD5
b4b800da4f16b486f4596e2155170f4b

SHA1
33794d3cedc2e7075fc615ab07fed95d594e7f8e

SHA256
9f323f3e56a1d74fe30658179b0338cfcedd92d93ad3a5f50fed17276156bc65

SHA512
5ce37d443c74ff79b53736dc6545d55fdae2d7de934a98dd9f913386ce6f637b387b38dde01e48d3c06a3060839cef5399566ce951711f694e907b4057c2da0b

Download Submit
C:\Windows\System\VOoAxeG.exe

Filesize
1.7MB

MD5
3aed92bfc46a6c859e93d6804b4bc842

SHA1
544c7baac1644a181fd619b166a8fdedbd397fa3

SHA256
2fa0ae577561b15a5a2a3c5e2eaf5ea8ff459a6018a1544e26e3db09e35cb7fd

SHA512
d8053a4567af657291b4c87dd75ea38811d1f8a629b873e28685ff635cb23acaa359f8931a8790a77bc40c88bf14adcb0e45cabaea32e8ca1f4029ca8df34deb

Download Submit
C:\Windows\System\VQbKkyF.exe

Filesize
1.7MB

MD5
e2b2287c6d0904df4d2be054f9f15f35

SHA1
9e8290194737a93cb21b39dc6a16b616f9d4233e

SHA256
ae0dcf17a5ef2d224e0cdfe3f4bb29f27e6fb1ee8bea12a52fab04c11bcfb7cb

SHA512
5829f8cc79f5ed81a0c45923198bee1b66e0ae94897b9a7ac36cc6fb24faca6cffed71a30bf102730ae27d4539177d6e972a1913301844cc9683dbee756e22e3

Download Submit
C:\Windows\System\WHlDBnP.exe

Filesize
1.7MB

MD5
62e42af864ca1434542674e906bf907d

SHA1
fb4b7b3b1b2a3b40f9ba2d3aefa69583da500116

SHA256
ae3f63aabcd98d836bc8abc5a66f7ec4b4daf8de2086d1a9c9faff00cb0a2365

SHA512
2a6ec030880966253b4fa0186110d59b2deca5844a24872717ae320b335f1a290174df78c4e2abaf3044adbaa0aaaf699314dd51ffbc75e956a9eae4f304c915

Download Submit
C:\Windows\System\ZlWzaqK.exe

Filesize
1.7MB

MD5
433a0804b3fe9750385a874b856816b3

SHA1
2f1e2d59e2b38d6e7891bf01ee7d639d45aa6d44

SHA256
d8675b20c265112b413a3e2352c3947fdd8d590fbc697862c742eccd71e05a35

SHA512
207832941a88cb04e92c14334f8026123dd579da38f2dfc64944295bbc295f23f5ad140b1fb328d4a6fdc21b83a6cbdebeafe14120d974e0a805499a54ce080f

Download Submit
C:\Windows\System\aiqCmuQ.exe

Filesize
1.7MB

MD5
c8fe853f60753943bab335fbd49a79e9

SHA1
d808040925e9b3779df6741b2959d13d31cfdaca

SHA256
f3253b0c57f1b777c55ba8417e05689c4b3e6d2fbff6669c71afa79d4ccc674b

SHA512
96280b61bf44576f02adf60a773c14103c680e8f1e9de9d36dd9e1daa4771a02d16c5d16694b2b608967f4cbb06be84483c4f8b83cb4f64293faf4cde7ba021c

Download Submit
C:\Windows\System\alOiDtR.exe

Filesize
1.7MB

MD5
dc6f3650233c3654c996a3762717d96b

SHA1
0ec72af7f818086d4e20ccd4009f3656c1087f98

SHA256
5ebf9fe39a118086baecb68980bd3065b7a674e244995876443395928cd80956

SHA512
b5e5edfaaf7f67f45e336a4ebf2d4e2226c9fd09ec347d93e254529b7f6ea457eefb49bff0d983fbbe0f5ab345bb454e80bc36e2506f42823564cf9b8fc1232d

Download Submit
C:\Windows\System\bcUsLft.exe

Filesize
1.7MB

MD5
fa88abd343b21b4e5989366aa44e0e34

SHA1
31431125dede94b6523703a27d3feaac228bf12f

SHA256
225c05f390ad2fa3ef41a12072f59be23c1f5a89d4ef7a9a7cd21bf0819a73bf

SHA512
19ba5cae6a380e7db67dfce0b896354eb0b63f80468fbb4f25efbcdeb55655964718240ffa942a3855a888145cbd7b9a2ec3e4072ceb2c38421883710d5edca0

Download Submit
C:\Windows\System\dHCQjJg.exe

Filesize
1.7MB

MD5
ae29cc85ea377377747e1ecdb761544f

SHA1
7286522e8d78c18aae54f6648bea888b588d128e

SHA256
bec4e0c9b3c7f0bde102e56cbf12385bcff03cf6d23d086f25d45597f1cef215

SHA512
27947c8941ff58350248d929ad9f1ad1fd3456d469975bb6fdcc401e4c631f2989f462a04065aee4298325a96d35ebdebc978d80bfdd2ea6c87b278d593b6c79

Download Submit
C:\Windows\System\giQBEya.exe

Filesize
1.7MB

MD5
63cc3e16dd78a712e03c6ee2852c5974

SHA1
f1051a9edf9a4433c3c684a7498545456ec3995a

SHA256
6aad65135b64b0865865b33ea84428051077dc766d440fd810f28b72fb19e255

SHA512
ccd014c0aa92695046884fabcf4ceecb61ba6f772512ebc435a91706aa4050630d11e68ae204316f82cdb6b4ef406b5627d7558542e92323a7d3e8f1349b5b57

Download Submit
C:\Windows\System\kDYZTrg.exe

Filesize
1.7MB

MD5
9d5976333e133c69e1dcf6b42e3c61dd

SHA1
e25f2d21dbb5cd3fe6d94b15fe7984f8e91f29c8

SHA256
e7e4d870bd933d6cf8ca169e7d20fd102c6113cc1edb10204ccd603d588292a4

SHA512
047e6d75fd5d3005357440b7297605dc136619e8d790b9e76c208d9141075167a4d71fae122bb3e9c13b5310903bfc4c8dd0e180aae79e970a41f8fcc031ac75

Download Submit
C:\Windows\System\lZbXoLG.exe

Filesize
8B

MD5
4585af961e6be7f3b03d075298565b62

SHA1
8e84c60639225761f581ea4ec1ff9a2d8e5472c9

SHA256
b8920be4ca9181e84576dfb449141c7d9af40d7ddc5588ea3cac8c68ef3a0a88

SHA512
aca862ef42a6056537a17dcbf9d8778efa38fbecbcb6ce3dce02a2eb0f5b9ffb56a667b21c26a29159a0ebcd14d21a77c5b25a36880c46863acba28da90e75f0

Download Submit
C:\Windows\System\oMQJHHS.exe

Filesize
1.7MB

MD5
fdc2d20e49aa3ddb1099124806d3d865

SHA1
69d9ad49d62b1a31c8dd20281524772d0d912674

SHA256
4210649e0c92e2a26b185359956698ed316e36371f334c328cf7481f2467bd43

SHA512
4db0aac9d7f08deb85666306bdb4c74e8b57e3836dd7e051cb4a949f6d49e5364dc66814cf933590fe615f13382373e1e3a80a1df89cd483d9280ad87ed7ce7c

Download Submit
C:\Windows\System\oaCrCDQ.exe

Filesize
1.7MB

MD5
e63197f2c99b207b3b1b000e18c3bffe

SHA1
daca819bae524fe130049055964895c06e3179db

SHA256
6c2ba6b1f3dfc2a6bc04e86ff12713cad18e0b63b391305571f583752ae7caf8

SHA512
440f5703b0cccaed807f028373df527cdcdc214f346344c7fb51801a2dc6ac9b37e3c80bd7b7fc64c606b647611775488df8e2de7e7b5febc866f859ddf4837a

Download Submit
C:\Windows\System\qnYCMpD.exe

Filesize
18B

MD5
71e0e9a01c07c9af3d26de48f425201d

SHA1
0428e838f0440f448214021201dccc3b0cd9314d

SHA256
c3558c958ef14ea5da64069945aac0435e2391341e2da791416812aed335e45b

SHA512
69137ecd2fa8a765e623ee3270350595212a21c7d849338768b929e0e0bcf6cc828bf542e28ee333c298d574dbbea34bd07daa602194212c7e6c0a564cfbc33e

Download Submit
C:\Windows\System\rzAvstX.exe

Filesize
1.7MB

MD5
c044289d9fa85f7cf3b71e1e29a7ecb2

SHA1
3f030508905dac8d43d574dcccd7d15e52132709

SHA256
ee29b3066bcbb8552ba9f53c3c70aacedaa30ec7aa645a9dd2b3936a2cc6d4d3

SHA512
a92ca51760ff367d23aea5abb6b0561925300ae0d7033765dc12e2af136a62caba08aac76734ad07a8857d8faea52270fa6c14ce9cfdea2da13967c4fbb0d8c4

Download Submit
C:\Windows\System\sUPOspE.exe

Filesize
1.7MB

MD5
24497cae07bb6bb5e022a03410cfa574

SHA1
67c63f45d5ba8ba199d072efd26bd3193a2d2afc

SHA256
067f7a836c5c178ae315dcd88e11b159ade1be90834ffc3d52e554c35ef95e04

SHA512
61b5702af50cba87c1babfc6a773ddc1bae817b56e9c708e6bd99213362da4ab9330f9649a30c3834ba8ec21fcda72ad4a98f2376a3c01c69e59b030c447917f

Download Submit
C:\Windows\System\snMmRJU.exe

Filesize
1.7MB

MD5
670bc4fafe83f3c4e63e9b345b6fa428

SHA1
743272b3ca97e8f5557132b0c22441392e49ce4f

SHA256
022675551d90d49d5a1f931bb4d9bf0df02c93e13cac19a07c0a6126261903b9

SHA512
ce32d39dd93c4d5c12a1023a09a8542382c9ddf2c13f2b2148ad8ed5a42b85977a748b0539fbae6d5cdd67c8d46284e37d3858c069709158ad218a39f69ade8a

Download Submit
C:\Windows\System\tyJtSog.exe

Filesize
1.7MB

MD5
8480e6402182280774e37769f61d0afb

SHA1
a4aa6f5d1419164bef5d0405fcf6fbdd00f11885

SHA256
e9d6d90ec3557ab68c445bcc401531450bf71132f34847c60fbcb8f2cefd4dca

SHA512
070c2eec82f502d4b51a36161eeba35e2453cca4e836de58df1b861943cd4afffffaab5f0beab6bc797d97a8479409ec7df55e33c921a7d27854a424888e518a

Download Submit
memory/404-72-0x00007FF6D29A0000-0x00007FF6D2D92000-memory.dmp

Filesize
3.9MB

Download
memory/464-130-0x00007FF72A750000-0x00007FF72AB42000-memory.dmp

Filesize
3.9MB

Download
memory/920-26-0x00007FF7E2B00000-0x00007FF7E2EF2000-memory.dmp

Filesize
3.9MB

Download
memory/1240-7628-0x00007FF677480000-0x00007FF677872000-memory.dmp

Filesize
3.9MB

Download
memory/1240-174-0x00007FF677480000-0x00007FF677872000-memory.dmp

Filesize
3.9MB

Download
memory/1448-50-0x00007FF6958C0000-0x00007FF695CB2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-177-0x00007FF62B530000-0x00007FF62B922000-memory.dmp

Filesize
3.9MB

Download
memory/2884-151-0x00007FF6BFEB0000-0x00007FF6C02A2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-5060-0x00007FF6BFEB0000-0x00007FF6C02A2000-memory.dmp

Filesize
3.9MB

Download
memory/2976-170-0x00007FF67F0D0000-0x00007FF67F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-0-0x00007FF6BD3B0000-0x00007FF6BD7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-1-0x00000208E41F0000-0x00000208E4200000-memory.dmp

Filesize
64KB

Download
memory/3224-164-0x00007FF66C930000-0x00007FF66CD22000-memory.dmp

Filesize
3.9MB

Download
memory/3224-7660-0x00007FF66C930000-0x00007FF66CD22000-memory.dmp

Filesize
3.9MB

Download
memory/3316-115-0x00007FF6C5F50000-0x00007FF6C6342000-memory.dmp

Filesize
3.9MB

Download
memory/3456-140-0x00007FF6B1E50000-0x00007FF6B2242000-memory.dmp

Filesize
3.9MB

Download
memory/3552-41-0x00007FFC74860000-0x00007FFC75321000-memory.dmp

Filesize
10.8MB

Download
memory/3552-184-0x000001C5FB100000-0x000001C5FB8A6000-memory.dmp

Filesize
7.6MB

Download
memory/3552-64-0x000001C5F9A80000-0x000001C5F9AA2000-memory.dmp

Filesize
136KB

Download
memory/3552-19-0x00007FFC74860000-0x00007FFC75321000-memory.dmp

Filesize
10.8MB

Download
memory/3552-5-0x00007FFC74863000-0x00007FFC74865000-memory.dmp

Filesize
8KB

Download
memory/3588-175-0x00007FF7C01B0000-0x00007FF7C05A2000-memory.dmp

Filesize
3.9MB

Download
memory/3632-169-0x00007FF6C62E0000-0x00007FF6C66D2000-memory.dmp

Filesize
3.9MB

Download
memory/3660-172-0x00007FF7B3F70000-0x00007FF7B4362000-memory.dmp

Filesize
3.9MB

Download
memory/4212-25-0x00007FF67F2B0000-0x00007FF67F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/4236-103-0x00007FF783190000-0x00007FF783582000-memory.dmp

Filesize
3.9MB

Download
memory/4268-176-0x00007FF7DE270000-0x00007FF7DE662000-memory.dmp

Filesize
3.9MB

Download
memory/4268-7644-0x00007FF7DE270000-0x00007FF7DE662000-memory.dmp

Filesize
3.9MB

Download
memory/4396-165-0x00007FF71C040000-0x00007FF71C432000-memory.dmp

Filesize
3.9MB

Download
memory/4396-7742-0x00007FF71C040000-0x00007FF71C432000-memory.dmp

Filesize
3.9MB

Download
memory/4476-173-0x00007FF725630000-0x00007FF725A22000-memory.dmp

Filesize
3.9MB

Download
memory/4484-87-0x00007FF79FF40000-0x00007FF7A0332000-memory.dmp

Filesize
3.9MB

Download
memory/4660-91-0x00007FF7D9B60000-0x00007FF7D9F52000-memory.dmp

Filesize
3.9MB

Download
memory/4792-171-0x00007FF78FE10000-0x00007FF790202000-memory.dmp

Filesize
3.9MB

Download
memory/5012-141-0x00007FF7565B0000-0x00007FF7569A2000-memory.dmp

Filesize
3.9MB

Download
memory/5080-7582-0x00007FF60CE40000-0x00007FF60D232000-memory.dmp

Filesize
3.9MB

Download
memory/5080-116-0x00007FF60CE40000-0x00007FF60D232000-memory.dmp

Filesize
3.9MB

Download