xmrig | e46357aa21f9e4484299461a4f0d921aae679f55f0c81bfbb53cee042b6ccdc1

Analysis

max time kernel
121s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
Size

1.6MB
MD5

6d0baada0b21564f13edc9188869efe0
SHA1

56024bb1a9b5d71acff48a7d6b3c6f26f4797009
SHA256

e46357aa21f9e4484299461a4f0d921aae679f55f0c81bfbb53cee042b6ccdc1
SHA512

533011129408c283a2dac92140007b4580a3a164b7567c6603892aabf69d9fcf1df614cf3a1c4271b22b19e7df9725921aff655822de3bfa7b8f67189b6dcc19
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7K6WefmedkVoMXf3:Lz071uv4BPMkyW10/w16BvZuaX2

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/5084-303-0x00007FF716990000-0x00007FF716D82000-memory.dmp	xmrig
behavioral2/memory/3228-353-0x00007FF739F20000-0x00007FF73A312000-memory.dmp	xmrig
behavioral2/memory/448-411-0x00007FF6DC750000-0x00007FF6DCB42000-memory.dmp	xmrig
behavioral2/memory/540-449-0x00007FF6D87A0000-0x00007FF6D8B92000-memory.dmp	xmrig
behavioral2/memory/512-457-0x00007FF72F710000-0x00007FF72FB02000-memory.dmp	xmrig
behavioral2/memory/2172-461-0x00007FF7B6AE0000-0x00007FF7B6ED2000-memory.dmp	xmrig
behavioral2/memory/3144-464-0x00007FF708540000-0x00007FF708932000-memory.dmp	xmrig
behavioral2/memory/1424-4495-0x00007FF7D6E50000-0x00007FF7D7242000-memory.dmp	xmrig
behavioral2/memory/3144-4497-0x00007FF708540000-0x00007FF708932000-memory.dmp	xmrig
behavioral2/memory/4660-4499-0x00007FF6EF530000-0x00007FF6EF922000-memory.dmp	xmrig
behavioral2/memory/4740-4504-0x00007FF644530000-0x00007FF644922000-memory.dmp	xmrig
behavioral2/memory/5084-4507-0x00007FF716990000-0x00007FF716D82000-memory.dmp	xmrig
behavioral2/memory/624-4509-0x00007FF73EC30000-0x00007FF73F022000-memory.dmp	xmrig
behavioral2/memory/4792-4511-0x00007FF7A0220000-0x00007FF7A0612000-memory.dmp	xmrig
behavioral2/memory/3912-4515-0x00007FF7D27B0000-0x00007FF7D2BA2000-memory.dmp	xmrig
behavioral2/memory/1760-4514-0x00007FF7E2850000-0x00007FF7E2C42000-memory.dmp	xmrig
behavioral2/memory/4012-4517-0x00007FF724AD0000-0x00007FF724EC2000-memory.dmp	xmrig
behavioral2/memory/3228-4519-0x00007FF739F20000-0x00007FF73A312000-memory.dmp	xmrig
behavioral2/memory/392-4525-0x00007FF6F3040000-0x00007FF6F3432000-memory.dmp	xmrig
behavioral2/memory/1360-4529-0x00007FF67EDD0000-0x00007FF67F1C2000-memory.dmp	xmrig
behavioral2/memory/448-4527-0x00007FF6DC750000-0x00007FF6DCB42000-memory.dmp	xmrig
behavioral2/memory/4032-4532-0x00007FF620C40000-0x00007FF621032000-memory.dmp	xmrig
behavioral2/memory/4492-4535-0x00007FF657D10000-0x00007FF658102000-memory.dmp	xmrig
behavioral2/memory/2172-4540-0x00007FF7B6AE0000-0x00007FF7B6ED2000-memory.dmp	xmrig
behavioral2/memory/2256-4543-0x00007FF667800000-0x00007FF667BF2000-memory.dmp	xmrig
behavioral2/memory/2772-4538-0x00007FF769910000-0x00007FF769D02000-memory.dmp	xmrig
behavioral2/memory/512-4546-0x00007FF72F710000-0x00007FF72FB02000-memory.dmp	xmrig
behavioral2/memory/2900-4523-0x00007FF64D320000-0x00007FF64D712000-memory.dmp	xmrig
behavioral2/memory/540-4521-0x00007FF6D87A0000-0x00007FF6D8B92000-memory.dmp	xmrig
behavioral2/memory/4656-4505-0x00007FF796630000-0x00007FF796A22000-memory.dmp	xmrig
behavioral2/memory/3932-4501-0x00007FF6A72E0000-0x00007FF6A76D2000-memory.dmp	xmrig
behavioral2/memory/3912-465-0x00007FF7D27B0000-0x00007FF7D2BA2000-memory.dmp	xmrig
behavioral2/memory/2256-463-0x00007FF667800000-0x00007FF667BF2000-memory.dmp	xmrig
behavioral2/memory/1360-462-0x00007FF67EDD0000-0x00007FF67F1C2000-memory.dmp	xmrig
behavioral2/memory/392-460-0x00007FF6F3040000-0x00007FF6F3432000-memory.dmp	xmrig
behavioral2/memory/2900-459-0x00007FF64D320000-0x00007FF64D712000-memory.dmp	xmrig
behavioral2/memory/2772-458-0x00007FF769910000-0x00007FF769D02000-memory.dmp	xmrig
behavioral2/memory/4492-456-0x00007FF657D10000-0x00007FF658102000-memory.dmp	xmrig
behavioral2/memory/4032-455-0x00007FF620C40000-0x00007FF621032000-memory.dmp	xmrig
behavioral2/memory/4012-442-0x00007FF724AD0000-0x00007FF724EC2000-memory.dmp	xmrig
behavioral2/memory/4792-401-0x00007FF7A0220000-0x00007FF7A0612000-memory.dmp	xmrig
behavioral2/memory/1760-381-0x00007FF7E2850000-0x00007FF7E2C42000-memory.dmp	xmrig
behavioral2/memory/624-352-0x00007FF73EC30000-0x00007FF73F022000-memory.dmp	xmrig
behavioral2/memory/4740-322-0x00007FF644530000-0x00007FF644922000-memory.dmp	xmrig
behavioral2/memory/3932-271-0x00007FF6A72E0000-0x00007FF6A76D2000-memory.dmp	xmrig
behavioral2/memory/4656-270-0x00007FF796630000-0x00007FF796A22000-memory.dmp	xmrig
behavioral2/memory/4660-235-0x00007FF6EF530000-0x00007FF6EF922000-memory.dmp	xmrig
behavioral2/memory/1424-183-0x00007FF7D6E50000-0x00007FF7D7242000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Powershell Invoke Web Request.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2936 powershell.exe

pid	process
2936	powershell.exe

Executes dropped EXE 64 IoCs

Processes:

elgfXSY.exeDGLpOhz.exeDONVfJH.exeZpkLFrK.exeJEYPeLH.exekczUXNj.exeebhRIyJ.exeVpArfqO.exeRHzpOpB.exejkyJWnV.exeRybsfsm.exeTGrbrWU.exerMkKJVb.exelpspxhG.exetoNLFjJ.exekqjDEYB.exerbUFPFA.exeAGomZMA.exeCsQQXtf.exepKdBKoB.exedQauJas.exeGKuOlea.exenjZBQtk.exeBISChrU.exeGqgDQkJ.exevHmmTxs.exeVnYANzd.exeRtKLkWx.exeaKBCJnC.exeZqJdKaD.exehhuCvDx.exevTqIrRa.exeadSNkcJ.exebxwwNVs.exebXNHwng.exeNOTTkhX.exetgBlcCA.exekrsEBUu.exetBOsWRE.exesLCGBSX.exeWRFbcnj.exeRkPicpw.exeHfYdcKe.exePdFbcsI.exeijFewvf.exexhCRhAO.execWANRKz.exeXiUTsBA.exebBJypOg.exeRKoaDLj.exeiVxAGZN.exeHtdZYNT.exewgIYGFs.exejIbamDm.exeyTQTQKl.exeUasFoxU.exeOgTErIf.exeCCdFEXB.exexMTTdGz.exeMGuNHfX.exeyJgtDPg.exemebcKrT.exegEwHlsi.execIBilOX.exe

pid	process
1424	elgfXSY.exe
3144	DGLpOhz.exe
4660	DONVfJH.exe
4656	ZpkLFrK.exe
3932	JEYPeLH.exe
5084	kczUXNj.exe
4740	ebhRIyJ.exe
624	VpArfqO.exe
3228	RHzpOpB.exe
3912	jkyJWnV.exe
1760	Rybsfsm.exe
4792	TGrbrWU.exe
448	rMkKJVb.exe
4012	lpspxhG.exe
540	toNLFjJ.exe
4032	kqjDEYB.exe
4492	rbUFPFA.exe
512	AGomZMA.exe
2772	CsQQXtf.exe
2900	pKdBKoB.exe
392	dQauJas.exe
2172	GKuOlea.exe
1360	njZBQtk.exe
2256	BISChrU.exe
3288	GqgDQkJ.exe
1076	vHmmTxs.exe
4112	VnYANzd.exe
4964	RtKLkWx.exe
2012	aKBCJnC.exe
3644	ZqJdKaD.exe
4068	hhuCvDx.exe
4784	vTqIrRa.exe
3324	adSNkcJ.exe
2968	bxwwNVs.exe
5016	bXNHwng.exe
3016	NOTTkhX.exe
2912	tgBlcCA.exe
1440	krsEBUu.exe
5036	tBOsWRE.exe
3988	sLCGBSX.exe
2156	WRFbcnj.exe
3864	RkPicpw.exe
1468	HfYdcKe.exe
5088	PdFbcsI.exe
3680	ijFewvf.exe
2568	xhCRhAO.exe
1664	cWANRKz.exe
2908	XiUTsBA.exe
3404	bBJypOg.exe
2716	RKoaDLj.exe
3824	iVxAGZN.exe
2072	HtdZYNT.exe
3040	wgIYGFs.exe
1660	jIbamDm.exe
440	yTQTQKl.exe
656	UasFoxU.exe
3000	OgTErIf.exe
644	CCdFEXB.exe
2760	xMTTdGz.exe
2088	MGuNHfX.exe
8	yJgtDPg.exe
3608	mebcKrT.exe
3980	gEwHlsi.exe
3632	cIBilOX.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3312-0-0x00007FF6C5B50000-0x00007FF6C5F42000-memory.dmp	upx
C:\Windows\System\elgfXSY.exe	upx
C:\Windows\System\DONVfJH.exe	upx
C:\Windows\System\lpspxhG.exe	upx
C:\Windows\System\dQauJas.exe	upx
behavioral2/memory/5084-303-0x00007FF716990000-0x00007FF716D82000-memory.dmp	upx
behavioral2/memory/3228-353-0x00007FF739F20000-0x00007FF73A312000-memory.dmp	upx
behavioral2/memory/448-411-0x00007FF6DC750000-0x00007FF6DCB42000-memory.dmp	upx
behavioral2/memory/540-449-0x00007FF6D87A0000-0x00007FF6D8B92000-memory.dmp	upx
behavioral2/memory/512-457-0x00007FF72F710000-0x00007FF72FB02000-memory.dmp	upx
behavioral2/memory/2172-461-0x00007FF7B6AE0000-0x00007FF7B6ED2000-memory.dmp	upx
behavioral2/memory/3144-464-0x00007FF708540000-0x00007FF708932000-memory.dmp	upx
behavioral2/memory/1424-4495-0x00007FF7D6E50000-0x00007FF7D7242000-memory.dmp	upx
behavioral2/memory/3144-4497-0x00007FF708540000-0x00007FF708932000-memory.dmp	upx
behavioral2/memory/4660-4499-0x00007FF6EF530000-0x00007FF6EF922000-memory.dmp	upx
behavioral2/memory/4740-4504-0x00007FF644530000-0x00007FF644922000-memory.dmp	upx
behavioral2/memory/5084-4507-0x00007FF716990000-0x00007FF716D82000-memory.dmp	upx
behavioral2/memory/624-4509-0x00007FF73EC30000-0x00007FF73F022000-memory.dmp	upx
behavioral2/memory/4792-4511-0x00007FF7A0220000-0x00007FF7A0612000-memory.dmp	upx
behavioral2/memory/3912-4515-0x00007FF7D27B0000-0x00007FF7D2BA2000-memory.dmp	upx
behavioral2/memory/1760-4514-0x00007FF7E2850000-0x00007FF7E2C42000-memory.dmp	upx
behavioral2/memory/4012-4517-0x00007FF724AD0000-0x00007FF724EC2000-memory.dmp	upx
behavioral2/memory/3228-4519-0x00007FF739F20000-0x00007FF73A312000-memory.dmp	upx
behavioral2/memory/392-4525-0x00007FF6F3040000-0x00007FF6F3432000-memory.dmp	upx
behavioral2/memory/1360-4529-0x00007FF67EDD0000-0x00007FF67F1C2000-memory.dmp	upx
behavioral2/memory/448-4527-0x00007FF6DC750000-0x00007FF6DCB42000-memory.dmp	upx
behavioral2/memory/4032-4532-0x00007FF620C40000-0x00007FF621032000-memory.dmp	upx
behavioral2/memory/4492-4535-0x00007FF657D10000-0x00007FF658102000-memory.dmp	upx
behavioral2/memory/2172-4540-0x00007FF7B6AE0000-0x00007FF7B6ED2000-memory.dmp	upx
behavioral2/memory/2256-4543-0x00007FF667800000-0x00007FF667BF2000-memory.dmp	upx
behavioral2/memory/2772-4538-0x00007FF769910000-0x00007FF769D02000-memory.dmp	upx
behavioral2/memory/512-4546-0x00007FF72F710000-0x00007FF72FB02000-memory.dmp	upx
behavioral2/memory/2900-4523-0x00007FF64D320000-0x00007FF64D712000-memory.dmp	upx
behavioral2/memory/540-4521-0x00007FF6D87A0000-0x00007FF6D8B92000-memory.dmp	upx
behavioral2/memory/4656-4505-0x00007FF796630000-0x00007FF796A22000-memory.dmp	upx
behavioral2/memory/3932-4501-0x00007FF6A72E0000-0x00007FF6A76D2000-memory.dmp	upx
behavioral2/memory/3912-465-0x00007FF7D27B0000-0x00007FF7D2BA2000-memory.dmp	upx
behavioral2/memory/2256-463-0x00007FF667800000-0x00007FF667BF2000-memory.dmp	upx
behavioral2/memory/1360-462-0x00007FF67EDD0000-0x00007FF67F1C2000-memory.dmp	upx
behavioral2/memory/392-460-0x00007FF6F3040000-0x00007FF6F3432000-memory.dmp	upx
behavioral2/memory/2900-459-0x00007FF64D320000-0x00007FF64D712000-memory.dmp	upx
behavioral2/memory/2772-458-0x00007FF769910000-0x00007FF769D02000-memory.dmp	upx
behavioral2/memory/4492-456-0x00007FF657D10000-0x00007FF658102000-memory.dmp	upx
behavioral2/memory/4032-455-0x00007FF620C40000-0x00007FF621032000-memory.dmp	upx
behavioral2/memory/4012-442-0x00007FF724AD0000-0x00007FF724EC2000-memory.dmp	upx
behavioral2/memory/4792-401-0x00007FF7A0220000-0x00007FF7A0612000-memory.dmp	upx
behavioral2/memory/1760-381-0x00007FF7E2850000-0x00007FF7E2C42000-memory.dmp	upx
behavioral2/memory/624-352-0x00007FF73EC30000-0x00007FF73F022000-memory.dmp	upx
behavioral2/memory/4740-322-0x00007FF644530000-0x00007FF644922000-memory.dmp	upx
behavioral2/memory/3932-271-0x00007FF6A72E0000-0x00007FF6A76D2000-memory.dmp	upx
behavioral2/memory/4656-270-0x00007FF796630000-0x00007FF796A22000-memory.dmp	upx
behavioral2/memory/4660-235-0x00007FF6EF530000-0x00007FF6EF922000-memory.dmp	upx
C:\Windows\System\sLCGBSX.exe	upx
C:\Windows\System\tBOsWRE.exe	upx
C:\Windows\System\AGomZMA.exe	upx
C:\Windows\System\CsQQXtf.exe	upx
C:\Windows\System\bXNHwng.exe	upx
C:\Windows\System\NOTTkhX.exe	upx
C:\Windows\System\bXNHwng.exe	upx
C:\Windows\System\ZqJdKaD.exe	upx
C:\Windows\System\aKBCJnC.exe	upx
C:\Windows\System\njZBQtk.exe	upx
C:\Windows\System\rMkKJVb.exe	upx
C:\Windows\System\RtKLkWx.exe	upx

Drops file in Windows directory 64 IoCs

Processes:

6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe

description	ioc	process
File created	C:\Windows\System\FgvFWPT.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\pwTqMOV.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\VotlZSM.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\DGLpOhz.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\WzmUXvU.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\KCVDxhK.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\jawzWVu.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\tqWhsTH.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\yldUtNQ.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\OMGPNbK.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\GqsSQfu.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\dVUIjVg.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\oZeLSeh.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\YnfvOGh.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\JHocNDC.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\PjfmtnT.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\RLnuFax.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\yTynrTL.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\WsZCBIH.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\BLyLDwx.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\EpHRwUg.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\BsgziWp.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\kFlQyJH.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\fwFehgk.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\vEhAzcz.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\waspXMC.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\yHXRlzB.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\yWkUOUn.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\DRfKjBM.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\JlBycIk.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\GamtFSP.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\dDnQRXf.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\QvlLVlU.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\NFItNrx.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\FlNsoMx.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\FeaUEbP.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\JQmSuKS.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\QLTTVus.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\mLHivpN.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\Rocxcrq.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\UveAJjS.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\WncpBLe.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\LFBbANU.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\jMTsUbZ.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\ISsrIju.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\CDhPwur.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\GovpsEQ.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\FuRqCLx.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\GaRLZvZ.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\JtFdDme.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\aJjawkt.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\upoUhlO.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\beWByUN.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\SOdMpqT.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\tPaaBHE.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\lbIWlUz.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\XuWbQhn.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\QDnkZRi.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\BVLOQdq.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\jiIcNGH.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\roLGWPu.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\GZnugvj.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\bBJypOg.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
File created	C:\Windows\System\LurBMZT.exe	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

2936 powershell.exe
2936 powershell.exe
2936 powershell.exe

pid	process
2936	powershell.exe
2936	powershell.exe
2936	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2936	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe

description	pid	process	target process
PID 3312 wrote to memory of 2936	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	powershell.exe
PID 3312 wrote to memory of 2936	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	powershell.exe
PID 3312 wrote to memory of 1424	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	elgfXSY.exe
PID 3312 wrote to memory of 1424	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	elgfXSY.exe
PID 3312 wrote to memory of 3144	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	DGLpOhz.exe
PID 3312 wrote to memory of 3144	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	DGLpOhz.exe
PID 3312 wrote to memory of 4660	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	DONVfJH.exe
PID 3312 wrote to memory of 4660	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	DONVfJH.exe
PID 3312 wrote to memory of 4656	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	ZpkLFrK.exe
PID 3312 wrote to memory of 4656	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	ZpkLFrK.exe
PID 3312 wrote to memory of 3932	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	JEYPeLH.exe
PID 3312 wrote to memory of 3932	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	JEYPeLH.exe
PID 3312 wrote to memory of 5084	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	kczUXNj.exe
PID 3312 wrote to memory of 5084	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	kczUXNj.exe
PID 3312 wrote to memory of 4740	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	ebhRIyJ.exe
PID 3312 wrote to memory of 4740	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	ebhRIyJ.exe
PID 3312 wrote to memory of 624	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	VpArfqO.exe
PID 3312 wrote to memory of 624	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	VpArfqO.exe
PID 3312 wrote to memory of 3228	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	RHzpOpB.exe
PID 3312 wrote to memory of 3228	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	RHzpOpB.exe
PID 3312 wrote to memory of 3912	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	jkyJWnV.exe
PID 3312 wrote to memory of 3912	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	jkyJWnV.exe
PID 3312 wrote to memory of 1760	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	Rybsfsm.exe
PID 3312 wrote to memory of 1760	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	Rybsfsm.exe
PID 3312 wrote to memory of 4792	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	TGrbrWU.exe
PID 3312 wrote to memory of 4792	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	TGrbrWU.exe
PID 3312 wrote to memory of 448	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	rMkKJVb.exe
PID 3312 wrote to memory of 448	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	rMkKJVb.exe
PID 3312 wrote to memory of 4012	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	lpspxhG.exe
PID 3312 wrote to memory of 4012	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	lpspxhG.exe
PID 3312 wrote to memory of 540	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	toNLFjJ.exe
PID 3312 wrote to memory of 540	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	toNLFjJ.exe
PID 3312 wrote to memory of 512	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	AGomZMA.exe
PID 3312 wrote to memory of 512	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	AGomZMA.exe
PID 3312 wrote to memory of 2900	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	pKdBKoB.exe
PID 3312 wrote to memory of 2900	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	pKdBKoB.exe
PID 3312 wrote to memory of 1360	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	njZBQtk.exe
PID 3312 wrote to memory of 1360	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	njZBQtk.exe
PID 3312 wrote to memory of 4032	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	kqjDEYB.exe
PID 3312 wrote to memory of 4032	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	kqjDEYB.exe
PID 3312 wrote to memory of 4492	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	rbUFPFA.exe
PID 3312 wrote to memory of 4492	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	rbUFPFA.exe
PID 3312 wrote to memory of 2772	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	CsQQXtf.exe
PID 3312 wrote to memory of 2772	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	CsQQXtf.exe
PID 3312 wrote to memory of 392	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	dQauJas.exe
PID 3312 wrote to memory of 392	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	dQauJas.exe
PID 3312 wrote to memory of 2172	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	GKuOlea.exe
PID 3312 wrote to memory of 2172	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	GKuOlea.exe
PID 3312 wrote to memory of 2256	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	BISChrU.exe
PID 3312 wrote to memory of 2256	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	BISChrU.exe
PID 3312 wrote to memory of 3288	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	GqgDQkJ.exe
PID 3312 wrote to memory of 3288	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	GqgDQkJ.exe
PID 3312 wrote to memory of 1076	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	vHmmTxs.exe
PID 3312 wrote to memory of 1076	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	vHmmTxs.exe
PID 3312 wrote to memory of 4112	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	VnYANzd.exe
PID 3312 wrote to memory of 4112	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	VnYANzd.exe
PID 3312 wrote to memory of 4964	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	RtKLkWx.exe
PID 3312 wrote to memory of 4964	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	RtKLkWx.exe
PID 3312 wrote to memory of 2012	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	aKBCJnC.exe
PID 3312 wrote to memory of 2012	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	aKBCJnC.exe
PID 3312 wrote to memory of 3644	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	ZqJdKaD.exe
PID 3312 wrote to memory of 3644	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	ZqJdKaD.exe
PID 3312 wrote to memory of 4068	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	hhuCvDx.exe
PID 3312 wrote to memory of 4068	3312	6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe	hhuCvDx.exe

C:\Users\Admin\AppData\Local\Temp\6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6d0baada0b21564f13edc9188869efe0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Windows\System\elgfXSY.exe
C:\Windows\System\elgfXSY.exe
2⤵
- Executes dropped EXE
PID:1424

C:\Windows\System\DGLpOhz.exe
C:\Windows\System\DGLpOhz.exe
2⤵
- Executes dropped EXE
PID:3144

C:\Windows\System\DONVfJH.exe
C:\Windows\System\DONVfJH.exe
2⤵
- Executes dropped EXE
PID:4660

C:\Windows\System\ZpkLFrK.exe
C:\Windows\System\ZpkLFrK.exe
2⤵
- Executes dropped EXE
PID:4656

C:\Windows\System\JEYPeLH.exe
C:\Windows\System\JEYPeLH.exe
2⤵
- Executes dropped EXE
PID:3932

C:\Windows\System\kczUXNj.exe
C:\Windows\System\kczUXNj.exe
2⤵
- Executes dropped EXE
PID:5084

C:\Windows\System\ebhRIyJ.exe
C:\Windows\System\ebhRIyJ.exe
2⤵
- Executes dropped EXE
PID:4740

C:\Windows\System\VpArfqO.exe
C:\Windows\System\VpArfqO.exe
2⤵
- Executes dropped EXE
PID:624

C:\Windows\System\RHzpOpB.exe
C:\Windows\System\RHzpOpB.exe
2⤵
- Executes dropped EXE
PID:3228

C:\Windows\System\jkyJWnV.exe
C:\Windows\System\jkyJWnV.exe
2⤵
- Executes dropped EXE
PID:3912

C:\Windows\System\Rybsfsm.exe
C:\Windows\System\Rybsfsm.exe
2⤵
- Executes dropped EXE
PID:1760

C:\Windows\System\TGrbrWU.exe
C:\Windows\System\TGrbrWU.exe
2⤵
- Executes dropped EXE
PID:4792

C:\Windows\System\rMkKJVb.exe
C:\Windows\System\rMkKJVb.exe
2⤵
- Executes dropped EXE
PID:448

C:\Windows\System\lpspxhG.exe
C:\Windows\System\lpspxhG.exe
2⤵
- Executes dropped EXE
PID:4012

C:\Windows\System\toNLFjJ.exe
C:\Windows\System\toNLFjJ.exe
2⤵
- Executes dropped EXE
PID:540

C:\Windows\System\AGomZMA.exe
C:\Windows\System\AGomZMA.exe
2⤵
- Executes dropped EXE
PID:512

C:\Windows\System\pKdBKoB.exe
C:\Windows\System\pKdBKoB.exe
2⤵
- Executes dropped EXE
PID:2900

C:\Windows\System\njZBQtk.exe
C:\Windows\System\njZBQtk.exe
2⤵
- Executes dropped EXE
PID:1360

C:\Windows\System\kqjDEYB.exe
C:\Windows\System\kqjDEYB.exe
2⤵
- Executes dropped EXE
PID:4032

C:\Windows\System\rbUFPFA.exe
C:\Windows\System\rbUFPFA.exe
2⤵
- Executes dropped EXE
PID:4492

C:\Windows\System\CsQQXtf.exe
C:\Windows\System\CsQQXtf.exe
2⤵
- Executes dropped EXE
PID:2772

C:\Windows\System\dQauJas.exe
C:\Windows\System\dQauJas.exe
2⤵
- Executes dropped EXE
PID:392

C:\Windows\System\GKuOlea.exe
C:\Windows\System\GKuOlea.exe
2⤵
- Executes dropped EXE
PID:2172

C:\Windows\System\BISChrU.exe
C:\Windows\System\BISChrU.exe
2⤵
- Executes dropped EXE
PID:2256

C:\Windows\System\GqgDQkJ.exe
C:\Windows\System\GqgDQkJ.exe
2⤵
- Executes dropped EXE
PID:3288

C:\Windows\System\vHmmTxs.exe
C:\Windows\System\vHmmTxs.exe
2⤵
- Executes dropped EXE
PID:1076

C:\Windows\System\VnYANzd.exe
C:\Windows\System\VnYANzd.exe
2⤵
- Executes dropped EXE
PID:4112

C:\Windows\System\RtKLkWx.exe
C:\Windows\System\RtKLkWx.exe
2⤵
- Executes dropped EXE
PID:4964

C:\Windows\System\aKBCJnC.exe
C:\Windows\System\aKBCJnC.exe
2⤵
- Executes dropped EXE
PID:2012

C:\Windows\System\ZqJdKaD.exe
C:\Windows\System\ZqJdKaD.exe
2⤵
- Executes dropped EXE
PID:3644

C:\Windows\System\hhuCvDx.exe
C:\Windows\System\hhuCvDx.exe
2⤵
- Executes dropped EXE
PID:4068

C:\Windows\System\vTqIrRa.exe
C:\Windows\System\vTqIrRa.exe
2⤵
- Executes dropped EXE
PID:4784

C:\Windows\System\adSNkcJ.exe
C:\Windows\System\adSNkcJ.exe
2⤵
- Executes dropped EXE
PID:3324

C:\Windows\System\bxwwNVs.exe
C:\Windows\System\bxwwNVs.exe
2⤵
- Executes dropped EXE
PID:2968

C:\Windows\System\bXNHwng.exe
C:\Windows\System\bXNHwng.exe
2⤵
- Executes dropped EXE
PID:5016

C:\Windows\System\NOTTkhX.exe
C:\Windows\System\NOTTkhX.exe
2⤵
- Executes dropped EXE
PID:3016

C:\Windows\System\tgBlcCA.exe
C:\Windows\System\tgBlcCA.exe
2⤵
- Executes dropped EXE
PID:2912

C:\Windows\System\krsEBUu.exe
C:\Windows\System\krsEBUu.exe
2⤵
- Executes dropped EXE
PID:1440

C:\Windows\System\tBOsWRE.exe
C:\Windows\System\tBOsWRE.exe
2⤵
- Executes dropped EXE
PID:5036

C:\Windows\System\sLCGBSX.exe
C:\Windows\System\sLCGBSX.exe
2⤵
- Executes dropped EXE
PID:3988

C:\Windows\System\WRFbcnj.exe
C:\Windows\System\WRFbcnj.exe
2⤵
- Executes dropped EXE
PID:2156

C:\Windows\System\RkPicpw.exe
C:\Windows\System\RkPicpw.exe
2⤵
- Executes dropped EXE
PID:3864

C:\Windows\System\HfYdcKe.exe
C:\Windows\System\HfYdcKe.exe
2⤵
- Executes dropped EXE
PID:1468

C:\Windows\System\PdFbcsI.exe
C:\Windows\System\PdFbcsI.exe
2⤵
- Executes dropped EXE
PID:5088

C:\Windows\System\ijFewvf.exe
C:\Windows\System\ijFewvf.exe
2⤵
- Executes dropped EXE
PID:3680

C:\Windows\System\xhCRhAO.exe
C:\Windows\System\xhCRhAO.exe
2⤵
- Executes dropped EXE
PID:2568

C:\Windows\System\cWANRKz.exe
C:\Windows\System\cWANRKz.exe
2⤵
- Executes dropped EXE
PID:1664

C:\Windows\System\XiUTsBA.exe
C:\Windows\System\XiUTsBA.exe
2⤵
- Executes dropped EXE
PID:2908

C:\Windows\System\bBJypOg.exe
C:\Windows\System\bBJypOg.exe
2⤵
- Executes dropped EXE
PID:3404

C:\Windows\System\RKoaDLj.exe
C:\Windows\System\RKoaDLj.exe
2⤵
- Executes dropped EXE
PID:2716

C:\Windows\System\iVxAGZN.exe
C:\Windows\System\iVxAGZN.exe
2⤵
- Executes dropped EXE
PID:3824

C:\Windows\System\HtdZYNT.exe
C:\Windows\System\HtdZYNT.exe
2⤵
- Executes dropped EXE
PID:2072

C:\Windows\System\wgIYGFs.exe
C:\Windows\System\wgIYGFs.exe
2⤵
- Executes dropped EXE
PID:3040

C:\Windows\System\UasFoxU.exe
C:\Windows\System\UasFoxU.exe
2⤵
- Executes dropped EXE
PID:656

C:\Windows\System\jIbamDm.exe
C:\Windows\System\jIbamDm.exe
2⤵
- Executes dropped EXE
PID:1660

C:\Windows\System\OgTErIf.exe
C:\Windows\System\OgTErIf.exe
2⤵
- Executes dropped EXE
PID:3000

C:\Windows\System\yTQTQKl.exe
C:\Windows\System\yTQTQKl.exe
2⤵
- Executes dropped EXE
PID:440

C:\Windows\System\CCdFEXB.exe
C:\Windows\System\CCdFEXB.exe
2⤵
- Executes dropped EXE
PID:644

C:\Windows\System\xMTTdGz.exe
C:\Windows\System\xMTTdGz.exe
2⤵
- Executes dropped EXE
PID:2760

C:\Windows\System\MGuNHfX.exe
C:\Windows\System\MGuNHfX.exe
2⤵
- Executes dropped EXE
PID:2088

C:\Windows\System\yJgtDPg.exe
C:\Windows\System\yJgtDPg.exe
2⤵
- Executes dropped EXE
PID:8

C:\Windows\System\mebcKrT.exe
C:\Windows\System\mebcKrT.exe
2⤵
- Executes dropped EXE
PID:3608

C:\Windows\System\nnaTAPs.exe
C:\Windows\System\nnaTAPs.exe
2⤵
PID:2184

C:\Windows\System\JDZPjfh.exe
C:\Windows\System\JDZPjfh.exe
2⤵
PID:4168

C:\Windows\System\gEwHlsi.exe
C:\Windows\System\gEwHlsi.exe
2⤵
- Executes dropped EXE
PID:3980

C:\Windows\System\vmGhBCB.exe
C:\Windows\System\vmGhBCB.exe
2⤵
PID:3800

C:\Windows\System\qDybcqy.exe
C:\Windows\System\qDybcqy.exe
2⤵
PID:2304

C:\Windows\System\cIBilOX.exe
C:\Windows\System\cIBilOX.exe
2⤵
- Executes dropped EXE
PID:3632

C:\Windows\System\CqBouBK.exe
C:\Windows\System\CqBouBK.exe
2⤵
PID:4644

C:\Windows\System\LeoRSoQ.exe
C:\Windows\System\LeoRSoQ.exe
2⤵
PID:4572

C:\Windows\System\mutoRrn.exe
C:\Windows\System\mutoRrn.exe
2⤵
PID:4752

C:\Windows\System\lbIWlUz.exe
C:\Windows\System\lbIWlUz.exe
2⤵
PID:956

C:\Windows\System\zocJbqR.exe
C:\Windows\System\zocJbqR.exe
2⤵
PID:3532

C:\Windows\System\iDOUORZ.exe
C:\Windows\System\iDOUORZ.exe
2⤵
PID:264

C:\Windows\System\oVjJHFJ.exe
C:\Windows\System\oVjJHFJ.exe
2⤵
PID:4320

C:\Windows\System\ETPCLsU.exe
C:\Windows\System\ETPCLsU.exe
2⤵
PID:3972

C:\Windows\System\wAzdSio.exe
C:\Windows\System\wAzdSio.exe
2⤵
PID:4384

C:\Windows\System\QfhCWaD.exe
C:\Windows\System\QfhCWaD.exe
2⤵
PID:1856

C:\Windows\System\UjhNziP.exe
C:\Windows\System\UjhNziP.exe
2⤵
PID:1472

C:\Windows\System\WtZTUQG.exe
C:\Windows\System\WtZTUQG.exe
2⤵
PID:2316

C:\Windows\System\yfeyUxC.exe
C:\Windows\System\yfeyUxC.exe
2⤵
PID:3160

C:\Windows\System\DChgkEY.exe
C:\Windows\System\DChgkEY.exe
2⤵
PID:4772

C:\Windows\System\MMnmkth.exe
C:\Windows\System\MMnmkth.exe
2⤵
PID:5116

C:\Windows\System\zBkfaqd.exe
C:\Windows\System\zBkfaqd.exe
2⤵
PID:5184

C:\Windows\System\OQloCLn.exe
C:\Windows\System\OQloCLn.exe
2⤵
PID:5208

C:\Windows\System\cGEooEb.exe
C:\Windows\System\cGEooEb.exe
2⤵
PID:5236

C:\Windows\System\zIhLHTX.exe
C:\Windows\System\zIhLHTX.exe
2⤵
PID:5252

C:\Windows\System\eOoKEnj.exe
C:\Windows\System\eOoKEnj.exe
2⤵
PID:5280

C:\Windows\System\guHCWCU.exe
C:\Windows\System\guHCWCU.exe
2⤵
PID:5300

C:\Windows\System\zWwmFui.exe
C:\Windows\System\zWwmFui.exe
2⤵
PID:5316

C:\Windows\System\djDyqnG.exe
C:\Windows\System\djDyqnG.exe
2⤵
PID:5336

C:\Windows\System\GnIIWAf.exe
C:\Windows\System\GnIIWAf.exe
2⤵
PID:5396

C:\Windows\System\nlaBbOB.exe
C:\Windows\System\nlaBbOB.exe
2⤵
PID:5416

C:\Windows\System\YuETMEz.exe
C:\Windows\System\YuETMEz.exe
2⤵
PID:5440

C:\Windows\System\gRzwxOc.exe
C:\Windows\System\gRzwxOc.exe
2⤵
PID:5456

C:\Windows\System\ioDUFmY.exe
C:\Windows\System\ioDUFmY.exe
2⤵
PID:5484

C:\Windows\System\xkStpmQ.exe
C:\Windows\System\xkStpmQ.exe
2⤵
PID:5508

C:\Windows\System\dOcxgUz.exe
C:\Windows\System\dOcxgUz.exe
2⤵
PID:5524

C:\Windows\System\MBrmUma.exe
C:\Windows\System\MBrmUma.exe
2⤵
PID:5544

C:\Windows\System\pdQqCVw.exe
C:\Windows\System\pdQqCVw.exe
2⤵
PID:5572

C:\Windows\System\uBBBpvv.exe
C:\Windows\System\uBBBpvv.exe
2⤵
PID:5752

C:\Windows\System\lJYxbnf.exe
C:\Windows\System\lJYxbnf.exe
2⤵
PID:5768

C:\Windows\System\BaoaviJ.exe
C:\Windows\System\BaoaviJ.exe
2⤵
PID:5784

C:\Windows\System\juzkiBC.exe
C:\Windows\System\juzkiBC.exe
2⤵
PID:5804

C:\Windows\System\oFEaOju.exe
C:\Windows\System\oFEaOju.exe
2⤵
PID:5824

C:\Windows\System\YKKpaXT.exe
C:\Windows\System\YKKpaXT.exe
2⤵
PID:5840

C:\Windows\System\jNuWNQA.exe
C:\Windows\System\jNuWNQA.exe
2⤵
PID:5864

C:\Windows\System\nLLQVJb.exe
C:\Windows\System\nLLQVJb.exe
2⤵
PID:5896

C:\Windows\System\QUpHNpy.exe
C:\Windows\System\QUpHNpy.exe
2⤵
PID:5928

C:\Windows\System\DapUuIS.exe
C:\Windows\System\DapUuIS.exe
2⤵
PID:5956

C:\Windows\System\BuvnCye.exe
C:\Windows\System\BuvnCye.exe
2⤵
PID:5976

C:\Windows\System\WDLrkxB.exe
C:\Windows\System\WDLrkxB.exe
2⤵
PID:5992

C:\Windows\System\qGmghop.exe
C:\Windows\System\qGmghop.exe
2⤵
PID:6016

C:\Windows\System\fSVTXUs.exe
C:\Windows\System\fSVTXUs.exe
2⤵
PID:672

C:\Windows\System\BUbpRgP.exe
C:\Windows\System\BUbpRgP.exe
2⤵
PID:2064

C:\Windows\System\MvBkdfI.exe
C:\Windows\System\MvBkdfI.exe
2⤵
PID:2528

C:\Windows\System\tAsPDzr.exe
C:\Windows\System\tAsPDzr.exe
2⤵
PID:2068

C:\Windows\System\NEWcWoz.exe
C:\Windows\System\NEWcWoz.exe
2⤵
PID:4124

C:\Windows\System\DIfyUgG.exe
C:\Windows\System\DIfyUgG.exe
2⤵
PID:4152

C:\Windows\System\xKFqUCj.exe
C:\Windows\System\xKFqUCj.exe
2⤵
PID:2732

C:\Windows\System\sgpUHLy.exe
C:\Windows\System\sgpUHLy.exe
2⤵
PID:5220

C:\Windows\System\PAjIMUj.exe
C:\Windows\System\PAjIMUj.exe
2⤵
PID:5248

C:\Windows\System\evIUUOQ.exe
C:\Windows\System\evIUUOQ.exe
2⤵
PID:4372

C:\Windows\System\haydJlk.exe
C:\Windows\System\haydJlk.exe
2⤵
PID:5204

C:\Windows\System\NmqBcvB.exe
C:\Windows\System\NmqBcvB.exe
2⤵
PID:5224

C:\Windows\System\thIZYvm.exe
C:\Windows\System\thIZYvm.exe
2⤵
PID:1384

C:\Windows\System\jwbmZHk.exe
C:\Windows\System\jwbmZHk.exe
2⤵
PID:1436

C:\Windows\System\QzhnXIM.exe
C:\Windows\System\QzhnXIM.exe
2⤵
PID:5152

C:\Windows\System\QsgkgrD.exe
C:\Windows\System\QsgkgrD.exe
2⤵
PID:5780

C:\Windows\System\bQePPkm.exe
C:\Windows\System\bQePPkm.exe
2⤵
PID:5816

C:\Windows\System\pFIMsrW.exe
C:\Windows\System\pFIMsrW.exe
2⤵
PID:5856

C:\Windows\System\SauraDq.exe
C:\Windows\System\SauraDq.exe
2⤵
PID:5908

C:\Windows\System\MaIkAmA.exe
C:\Windows\System\MaIkAmA.exe
2⤵
PID:4612

C:\Windows\System\RgpjSRf.exe
C:\Windows\System\RgpjSRf.exe
2⤵
PID:4284

C:\Windows\System\dCRoHSb.exe
C:\Windows\System\dCRoHSb.exe
2⤵
PID:3884

C:\Windows\System\WfFtVmX.exe
C:\Windows\System\WfFtVmX.exe
2⤵
PID:5472

C:\Windows\System\QOZDlsT.exe
C:\Windows\System\QOZDlsT.exe
2⤵
PID:5408

C:\Windows\System\mhsOafU.exe
C:\Windows\System\mhsOafU.exe
2⤵
PID:1220

C:\Windows\System\AfFZRSA.exe
C:\Windows\System\AfFZRSA.exe
2⤵
PID:2352

C:\Windows\System\MnTGdkd.exe
C:\Windows\System\MnTGdkd.exe
2⤵
PID:3460

C:\Windows\System\UagDWeh.exe
C:\Windows\System\UagDWeh.exe
2⤵
PID:2212

C:\Windows\System\uamXXtL.exe
C:\Windows\System\uamXXtL.exe
2⤵
PID:1560

C:\Windows\System\ebYQirj.exe
C:\Windows\System\ebYQirj.exe
2⤵
PID:6148

C:\Windows\System\eSvLtwf.exe
C:\Windows\System\eSvLtwf.exe
2⤵
PID:6168

C:\Windows\System\aPrREUL.exe
C:\Windows\System\aPrREUL.exe
2⤵
PID:6188

C:\Windows\System\EjLWzPI.exe
C:\Windows\System\EjLWzPI.exe
2⤵
PID:6204

C:\Windows\System\qUVNHCo.exe
C:\Windows\System\qUVNHCo.exe
2⤵
PID:6228

C:\Windows\System\WDMCRcC.exe
C:\Windows\System\WDMCRcC.exe
2⤵
PID:6248

C:\Windows\System\jmEvQSi.exe
C:\Windows\System\jmEvQSi.exe
2⤵
PID:6328

C:\Windows\System\uBWHsdP.exe
C:\Windows\System\uBWHsdP.exe
2⤵
PID:6348

C:\Windows\System\zVeiuoy.exe
C:\Windows\System\zVeiuoy.exe
2⤵
PID:6368

C:\Windows\System\HBTghWl.exe
C:\Windows\System\HBTghWl.exe
2⤵
PID:6396

C:\Windows\System\OWmqlBA.exe
C:\Windows\System\OWmqlBA.exe
2⤵
PID:6416

C:\Windows\System\sUlVmfo.exe
C:\Windows\System\sUlVmfo.exe
2⤵
PID:6436

C:\Windows\System\aKqDKbI.exe
C:\Windows\System\aKqDKbI.exe
2⤵
PID:6468

C:\Windows\System\XuWbQhn.exe
C:\Windows\System\XuWbQhn.exe
2⤵
PID:6488

C:\Windows\System\cvovnkv.exe
C:\Windows\System\cvovnkv.exe
2⤵
PID:6508

C:\Windows\System\rnPnbUd.exe
C:\Windows\System\rnPnbUd.exe
2⤵
PID:6528

C:\Windows\System\pSvEcyN.exe
C:\Windows\System\pSvEcyN.exe
2⤵
PID:6552

C:\Windows\System\UgejmLj.exe
C:\Windows\System\UgejmLj.exe
2⤵
PID:6568

C:\Windows\System\LAKLqfl.exe
C:\Windows\System\LAKLqfl.exe
2⤵
PID:6592

C:\Windows\System\wsFFiUH.exe
C:\Windows\System\wsFFiUH.exe
2⤵
PID:6620

C:\Windows\System\hcGoXZT.exe
C:\Windows\System\hcGoXZT.exe
2⤵
PID:6640

C:\Windows\System\IIFPtHY.exe
C:\Windows\System\IIFPtHY.exe
2⤵
PID:6664

C:\Windows\System\sIatlVF.exe
C:\Windows\System\sIatlVF.exe
2⤵
PID:6684

C:\Windows\System\sjBcIZn.exe
C:\Windows\System\sjBcIZn.exe
2⤵
PID:6704

C:\Windows\System\zcGxVUU.exe
C:\Windows\System\zcGxVUU.exe
2⤵
PID:6728

C:\Windows\System\vbpgStr.exe
C:\Windows\System\vbpgStr.exe
2⤵
PID:6744

C:\Windows\System\kpHiwJy.exe
C:\Windows\System\kpHiwJy.exe
2⤵
PID:6768

C:\Windows\System\ovnuyla.exe
C:\Windows\System\ovnuyla.exe
2⤵
PID:6792

C:\Windows\System\LurBMZT.exe
C:\Windows\System\LurBMZT.exe
2⤵
PID:6808

C:\Windows\System\uuNHWYr.exe
C:\Windows\System\uuNHWYr.exe
2⤵
PID:6832

C:\Windows\System\krHyUEF.exe
C:\Windows\System\krHyUEF.exe
2⤵
PID:6856

C:\Windows\System\wbcgMWQ.exe
C:\Windows\System\wbcgMWQ.exe
2⤵
PID:6872

C:\Windows\System\gyPauQS.exe
C:\Windows\System\gyPauQS.exe
2⤵
PID:6888

C:\Windows\System\eEZTmZO.exe
C:\Windows\System\eEZTmZO.exe
2⤵
PID:6908

C:\Windows\System\POWjrAU.exe
C:\Windows\System\POWjrAU.exe
2⤵
PID:6932

C:\Windows\System\SkDbtiO.exe
C:\Windows\System\SkDbtiO.exe
2⤵
PID:6948

C:\Windows\System\UlVhvDk.exe
C:\Windows\System\UlVhvDk.exe
2⤵
PID:6964

C:\Windows\System\NJlYaeb.exe
C:\Windows\System\NJlYaeb.exe
2⤵
PID:6980

C:\Windows\System\uNauCeL.exe
C:\Windows\System\uNauCeL.exe
2⤵
PID:7012

C:\Windows\System\QzjgkOg.exe
C:\Windows\System\QzjgkOg.exe
2⤵
PID:7028

C:\Windows\System\KbvrAjX.exe
C:\Windows\System\KbvrAjX.exe
2⤵
PID:7044

C:\Windows\System\RHJGxgv.exe
C:\Windows\System\RHJGxgv.exe
2⤵
PID:7072

C:\Windows\System\RCafKph.exe
C:\Windows\System\RCafKph.exe
2⤵
PID:7088

C:\Windows\System\DBWLeOR.exe
C:\Windows\System\DBWLeOR.exe
2⤵
PID:7104

C:\Windows\System\DomJhma.exe
C:\Windows\System\DomJhma.exe
2⤵
PID:7128

C:\Windows\System\YfiGIgT.exe
C:\Windows\System\YfiGIgT.exe
2⤵
PID:7144

C:\Windows\System\EIJlcsN.exe
C:\Windows\System\EIJlcsN.exe
2⤵
PID:5944

C:\Windows\System\ekRUvDW.exe
C:\Windows\System\ekRUvDW.exe
2⤵
PID:6160

C:\Windows\System\eIHnqQe.exe
C:\Windows\System\eIHnqQe.exe
2⤵
PID:2740

C:\Windows\System\narVBpy.exe
C:\Windows\System\narVBpy.exe
2⤵
PID:6432

C:\Windows\System\bwveINh.exe
C:\Windows\System\bwveINh.exe
2⤵
PID:5892

C:\Windows\System\psYNclE.exe
C:\Windows\System\psYNclE.exe
2⤵
PID:5364

C:\Windows\System\daoMWQl.exe
C:\Windows\System\daoMWQl.exe
2⤵
PID:2112

C:\Windows\System\edDEkSW.exe
C:\Windows\System\edDEkSW.exe
2⤵
PID:5388

C:\Windows\System\ikUvVPK.exe
C:\Windows\System\ikUvVPK.exe
2⤵
PID:4252

C:\Windows\System\SVBqaEr.exe
C:\Windows\System\SVBqaEr.exe
2⤵
PID:1704

C:\Windows\System\rZdNRQh.exe
C:\Windows\System\rZdNRQh.exe
2⤵
PID:6200

C:\Windows\System\clgcRYn.exe
C:\Windows\System\clgcRYn.exe
2⤵
PID:6240

C:\Windows\System\wcSeXZr.exe
C:\Windows\System\wcSeXZr.exe
2⤵
PID:6736

C:\Windows\System\eorvHhX.exe
C:\Windows\System\eorvHhX.exe
2⤵
PID:6804

C:\Windows\System\EXscGwG.exe
C:\Windows\System\EXscGwG.exe
2⤵
PID:6840

C:\Windows\System\GcGTiGE.exe
C:\Windows\System\GcGTiGE.exe
2⤵
PID:6340

C:\Windows\System\iWmMtbh.exe
C:\Windows\System\iWmMtbh.exe
2⤵
PID:6380

C:\Windows\System\iVumhPb.exe
C:\Windows\System\iVumhPb.exe
2⤵
PID:6456

C:\Windows\System\infrFmc.exe
C:\Windows\System\infrFmc.exe
2⤵
PID:6500

C:\Windows\System\SJTvtco.exe
C:\Windows\System\SJTvtco.exe
2⤵
PID:6604

C:\Windows\System\tQjkTlz.exe
C:\Windows\System\tQjkTlz.exe
2⤵
PID:6652

C:\Windows\System\CWWEsnf.exe
C:\Windows\System\CWWEsnf.exe
2⤵
PID:7180

C:\Windows\System\UqkjQor.exe
C:\Windows\System\UqkjQor.exe
2⤵
PID:7204

C:\Windows\System\AJcbcVi.exe
C:\Windows\System\AJcbcVi.exe
2⤵
PID:7220

C:\Windows\System\EDhpBMB.exe
C:\Windows\System\EDhpBMB.exe
2⤵
PID:7248

C:\Windows\System\eATXUDl.exe
C:\Windows\System\eATXUDl.exe
2⤵
PID:7284

C:\Windows\System\BvIilem.exe
C:\Windows\System\BvIilem.exe
2⤵
PID:7300

C:\Windows\System\JLrKhOa.exe
C:\Windows\System\JLrKhOa.exe
2⤵
PID:7320

C:\Windows\System\GaRLZvZ.exe
C:\Windows\System\GaRLZvZ.exe
2⤵
PID:7340

C:\Windows\System\RUKndse.exe
C:\Windows\System\RUKndse.exe
2⤵
PID:7360

C:\Windows\System\YSMqtQt.exe
C:\Windows\System\YSMqtQt.exe
2⤵
PID:7376

C:\Windows\System\ahHebHY.exe
C:\Windows\System\ahHebHY.exe
2⤵
PID:7400

C:\Windows\System\eiEUbbm.exe
C:\Windows\System\eiEUbbm.exe
2⤵
PID:7420

C:\Windows\System\nkdEuWs.exe
C:\Windows\System\nkdEuWs.exe
2⤵
PID:7440

C:\Windows\System\FjXZDtL.exe
C:\Windows\System\FjXZDtL.exe
2⤵
PID:7464

C:\Windows\System\zuTtWQY.exe
C:\Windows\System\zuTtWQY.exe
2⤵
PID:7480

C:\Windows\System\DstOEFM.exe
C:\Windows\System\DstOEFM.exe
2⤵
PID:7504

C:\Windows\System\QBIcWvx.exe
C:\Windows\System\QBIcWvx.exe
2⤵
PID:7524

C:\Windows\System\zmPiFsU.exe
C:\Windows\System\zmPiFsU.exe
2⤵
PID:7544

C:\Windows\System\qDxBVLB.exe
C:\Windows\System\qDxBVLB.exe
2⤵
PID:7568

C:\Windows\System\eVmYHiX.exe
C:\Windows\System\eVmYHiX.exe
2⤵
PID:7584

C:\Windows\System\mQZwPqs.exe
C:\Windows\System\mQZwPqs.exe
2⤵
PID:7600

C:\Windows\System\oKDJQxJ.exe
C:\Windows\System\oKDJQxJ.exe
2⤵
PID:7624

C:\Windows\System\bnZYZZV.exe
C:\Windows\System\bnZYZZV.exe
2⤵
PID:7640

C:\Windows\System\btZvDFc.exe
C:\Windows\System\btZvDFc.exe
2⤵
PID:7664

C:\Windows\System\kFlrlPB.exe
C:\Windows\System\kFlrlPB.exe
2⤵
PID:7688

C:\Windows\System\nhwwXaZ.exe
C:\Windows\System\nhwwXaZ.exe
2⤵
PID:7712

C:\Windows\System\ItijktB.exe
C:\Windows\System\ItijktB.exe
2⤵
PID:7728

C:\Windows\System\rwihuDT.exe
C:\Windows\System\rwihuDT.exe
2⤵
PID:7756

C:\Windows\System\rQyRers.exe
C:\Windows\System\rQyRers.exe
2⤵
PID:7776

C:\Windows\System\tmxPIQI.exe
C:\Windows\System\tmxPIQI.exe
2⤵
PID:7796

C:\Windows\System\eygenCf.exe
C:\Windows\System\eygenCf.exe
2⤵
PID:7816

C:\Windows\System\HrODVGo.exe
C:\Windows\System\HrODVGo.exe
2⤵
PID:7840

C:\Windows\System\qxcGizK.exe
C:\Windows\System\qxcGizK.exe
2⤵
PID:7860

C:\Windows\System\pcyBzzZ.exe
C:\Windows\System\pcyBzzZ.exe
2⤵
PID:7876

C:\Windows\System\ETNlcAf.exe
C:\Windows\System\ETNlcAf.exe
2⤵
PID:7896

C:\Windows\System\HZarkgt.exe
C:\Windows\System\HZarkgt.exe
2⤵
PID:7920

C:\Windows\System\BGQFyxn.exe
C:\Windows\System\BGQFyxn.exe
2⤵
PID:7940

C:\Windows\System\UnuFLEW.exe
C:\Windows\System\UnuFLEW.exe
2⤵
PID:7964

C:\Windows\System\lxiRcem.exe
C:\Windows\System\lxiRcem.exe
2⤵
PID:7980

C:\Windows\System\ZEmOaiO.exe
C:\Windows\System\ZEmOaiO.exe
2⤵
PID:8004

C:\Windows\System\dcOtXPT.exe
C:\Windows\System\dcOtXPT.exe
2⤵
PID:8028

C:\Windows\System\EXLIFzO.exe
C:\Windows\System\EXLIFzO.exe
2⤵
PID:8044

C:\Windows\System\HkxgXaz.exe
C:\Windows\System\HkxgXaz.exe
2⤵
PID:8068

C:\Windows\System\sRBTPlR.exe
C:\Windows\System\sRBTPlR.exe
2⤵
PID:8084

C:\Windows\System\awdzjQd.exe
C:\Windows\System\awdzjQd.exe
2⤵
PID:8112

C:\Windows\System\zxuAnkV.exe
C:\Windows\System\zxuAnkV.exe
2⤵
PID:8132

C:\Windows\System\yPSjprf.exe
C:\Windows\System\yPSjprf.exe
2⤵
PID:8152

C:\Windows\System\NzeSQYE.exe
C:\Windows\System\NzeSQYE.exe
2⤵
PID:8180

C:\Windows\System\aiUSLvI.exe
C:\Windows\System\aiUSLvI.exe
2⤵
PID:2924

C:\Windows\System\pZSPLaH.exe
C:\Windows\System\pZSPLaH.exe
2⤵
PID:6940

C:\Windows\System\pobyOnU.exe
C:\Windows\System\pobyOnU.exe
2⤵
PID:7024

C:\Windows\System\hoeSZxs.exe
C:\Windows\System\hoeSZxs.exe
2⤵
PID:6564

C:\Windows\System\RvFGDFa.exe
C:\Windows\System\RvFGDFa.exe
2⤵
PID:6828

C:\Windows\System\TtMgUkU.exe
C:\Windows\System\TtMgUkU.exe
2⤵
PID:7120

C:\Windows\System\fdxNyiu.exe
C:\Windows\System\fdxNyiu.exe
2⤵
PID:6656

C:\Windows\System\eWeFKtU.exe
C:\Windows\System\eWeFKtU.exe
2⤵
PID:6676

C:\Windows\System\mtYfAPB.exe
C:\Windows\System\mtYfAPB.exe
2⤵
PID:6220

C:\Windows\System\pZhqmtQ.exe
C:\Windows\System\pZhqmtQ.exe
2⤵
PID:6780

C:\Windows\System\jVBNJmB.exe
C:\Windows\System\jVBNJmB.exe
2⤵
PID:5384

C:\Windows\System\YgOxigJ.exe
C:\Windows\System\YgOxigJ.exe
2⤵
PID:924

C:\Windows\System\ZomFgLu.exe
C:\Windows\System\ZomFgLu.exe
2⤵
PID:6184

C:\Windows\System\ZjlwUXj.exe
C:\Windows\System\ZjlwUXj.exe
2⤵
PID:6916

C:\Windows\System\jqZVPZA.exe
C:\Windows\System\jqZVPZA.exe
2⤵
PID:6972

C:\Windows\System\WpfNUoM.exe
C:\Windows\System\WpfNUoM.exe
2⤵
PID:7020

C:\Windows\System\gIPAkGl.exe
C:\Windows\System\gIPAkGl.exe
2⤵
PID:7096

C:\Windows\System\rjaQANh.exe
C:\Windows\System\rjaQANh.exe
2⤵
PID:5800

C:\Windows\System\djrFVcD.exe
C:\Windows\System\djrFVcD.exe
2⤵
PID:8216

C:\Windows\System\OKoWAvs.exe
C:\Windows\System\OKoWAvs.exe
2⤵
PID:8240

C:\Windows\System\VXPpJIA.exe
C:\Windows\System\VXPpJIA.exe
2⤵
PID:8260

C:\Windows\System\GZBeZOX.exe
C:\Windows\System\GZBeZOX.exe
2⤵
PID:8280

C:\Windows\System\cXxjnTk.exe
C:\Windows\System\cXxjnTk.exe
2⤵
PID:8300

C:\Windows\System\NGvxRiJ.exe
C:\Windows\System\NGvxRiJ.exe
2⤵
PID:8320

C:\Windows\System\bqSALmr.exe
C:\Windows\System\bqSALmr.exe
2⤵
PID:8344

C:\Windows\System\SsHiWUu.exe
C:\Windows\System\SsHiWUu.exe
2⤵
PID:8364

C:\Windows\System\TsYzbsE.exe
C:\Windows\System\TsYzbsE.exe
2⤵
PID:8388

C:\Windows\System\EoFMZif.exe
C:\Windows\System\EoFMZif.exe
2⤵
PID:8408

C:\Windows\System\PmbSGvV.exe
C:\Windows\System\PmbSGvV.exe
2⤵
PID:8428

C:\Windows\System\LEGwbiQ.exe
C:\Windows\System\LEGwbiQ.exe
2⤵
PID:8452

C:\Windows\System\rVlKwFK.exe
C:\Windows\System\rVlKwFK.exe
2⤵
PID:8468

C:\Windows\System\ubgmnSF.exe
C:\Windows\System\ubgmnSF.exe
2⤵
PID:8492

C:\Windows\System\cccqgjw.exe
C:\Windows\System\cccqgjw.exe
2⤵
PID:8512

C:\Windows\System\GqWzBQA.exe
C:\Windows\System\GqWzBQA.exe
2⤵
PID:8532

C:\Windows\System\ySyciGT.exe
C:\Windows\System\ySyciGT.exe
2⤵
PID:8548

C:\Windows\System\tQyFgcx.exe
C:\Windows\System\tQyFgcx.exe
2⤵
PID:8564

C:\Windows\System\CSIoqoP.exe
C:\Windows\System\CSIoqoP.exe
2⤵
PID:8592

C:\Windows\System\wLoyLgT.exe
C:\Windows\System\wLoyLgT.exe
2⤵
PID:8608

C:\Windows\System\YIjzSpu.exe
C:\Windows\System\YIjzSpu.exe
2⤵
PID:8632

C:\Windows\System\QVXJSMo.exe
C:\Windows\System\QVXJSMo.exe
2⤵
PID:8648

C:\Windows\System\tepjjer.exe
C:\Windows\System\tepjjer.exe
2⤵
PID:8672

C:\Windows\System\IGcCwgO.exe
C:\Windows\System\IGcCwgO.exe
2⤵
PID:8692

C:\Windows\System\YcnIvwp.exe
C:\Windows\System\YcnIvwp.exe
2⤵
PID:8720

C:\Windows\System\EfLfKmw.exe
C:\Windows\System\EfLfKmw.exe
2⤵
PID:8736

C:\Windows\System\SuofJmh.exe
C:\Windows\System\SuofJmh.exe
2⤵
PID:8760

C:\Windows\System\NOQQOCI.exe
C:\Windows\System\NOQQOCI.exe
2⤵
PID:8780

C:\Windows\System\rSUcLiP.exe
C:\Windows\System\rSUcLiP.exe
2⤵
PID:8804

C:\Windows\System\iUapsaW.exe
C:\Windows\System\iUapsaW.exe
2⤵
PID:8820

C:\Windows\System\abJQVpD.exe
C:\Windows\System\abJQVpD.exe
2⤵
PID:8840

C:\Windows\System\KmcDWyp.exe
C:\Windows\System\KmcDWyp.exe
2⤵
PID:8864

C:\Windows\System\adALCUa.exe
C:\Windows\System\adALCUa.exe
2⤵
PID:8880

C:\Windows\System\SWTcVLw.exe
C:\Windows\System\SWTcVLw.exe
2⤵
PID:8896

C:\Windows\System\hZsTVTr.exe
C:\Windows\System\hZsTVTr.exe
2⤵
PID:8928

C:\Windows\System\QbJVwbW.exe
C:\Windows\System\QbJVwbW.exe
2⤵
PID:8948

C:\Windows\System\iKNsasa.exe
C:\Windows\System\iKNsasa.exe
2⤵
PID:8972

C:\Windows\System\rPKjfFo.exe
C:\Windows\System\rPKjfFo.exe
2⤵
PID:8992

C:\Windows\System\bRRxGkY.exe
C:\Windows\System\bRRxGkY.exe
2⤵
PID:9012

C:\Windows\System\bNlDEgj.exe
C:\Windows\System\bNlDEgj.exe
2⤵
PID:9040

C:\Windows\System\AZMPfWZ.exe
C:\Windows\System\AZMPfWZ.exe
2⤵
PID:9064

C:\Windows\System\RogNEyt.exe
C:\Windows\System\RogNEyt.exe
2⤵
PID:9084

C:\Windows\System\JjkLHjY.exe
C:\Windows\System\JjkLHjY.exe
2⤵
PID:9100

C:\Windows\System\nqeHtKy.exe
C:\Windows\System\nqeHtKy.exe
2⤵
PID:9120

C:\Windows\System\XSrPFUk.exe
C:\Windows\System\XSrPFUk.exe
2⤵
PID:9144

C:\Windows\System\pjZOtqZ.exe
C:\Windows\System\pjZOtqZ.exe
2⤵
PID:9164

C:\Windows\System\dqBpZQF.exe
C:\Windows\System\dqBpZQF.exe
2⤵
PID:9184

C:\Windows\System\mCiJznG.exe
C:\Windows\System\mCiJznG.exe
2⤵
PID:9208

C:\Windows\System\OsPmFGX.exe
C:\Windows\System\OsPmFGX.exe
2⤵
PID:7724

C:\Windows\System\cyeTfXJ.exe
C:\Windows\System\cyeTfXJ.exe
2⤵
PID:5836

C:\Windows\System\XxkXoBl.exe
C:\Windows\System\XxkXoBl.exe
2⤵
PID:7228

C:\Windows\System\ihvkoeR.exe
C:\Windows\System\ihvkoeR.exe
2⤵
PID:4084

C:\Windows\System\aTvFnYJ.exe
C:\Windows\System\aTvFnYJ.exe
2⤵
PID:8020

C:\Windows\System\DUSiuuS.exe
C:\Windows\System\DUSiuuS.exe
2⤵
PID:7004

C:\Windows\System\QNvTrOH.exe
C:\Windows\System\QNvTrOH.exe
2⤵
PID:7176

C:\Windows\System\CNbswfJ.exe
C:\Windows\System\CNbswfJ.exe
2⤵
PID:6196

C:\Windows\System\rGENsUP.exe
C:\Windows\System\rGENsUP.exe
2⤵
PID:6356

C:\Windows\System\zwIwSBN.exe
C:\Windows\System\zwIwSBN.exe
2⤵
PID:8204

C:\Windows\System\yQKmjEq.exe
C:\Windows\System\yQKmjEq.exe
2⤵
PID:6884

C:\Windows\System\yjUqdOH.exe
C:\Windows\System\yjUqdOH.exe
2⤵
PID:7708

C:\Windows\System\EOgastc.exe
C:\Windows\System\EOgastc.exe
2⤵
PID:7532

C:\Windows\System\mOffBJO.exe
C:\Windows\System\mOffBJO.exe
2⤵
PID:7812

C:\Windows\System\uQeYfmE.exe
C:\Windows\System\uQeYfmE.exe
2⤵
PID:7828

C:\Windows\System\ONkAOaI.exe
C:\Windows\System\ONkAOaI.exe
2⤵
PID:6224

C:\Windows\System\EhOMlta.exe
C:\Windows\System\EhOMlta.exe
2⤵
PID:8772

C:\Windows\System\BvAeyRe.exe
C:\Windows\System\BvAeyRe.exe
2⤵
PID:9232

C:\Windows\System\KWvkvnV.exe
C:\Windows\System\KWvkvnV.exe
2⤵
PID:9256

C:\Windows\System\CyWQiQT.exe
C:\Windows\System\CyWQiQT.exe
2⤵
PID:9272

C:\Windows\System\ftJnonk.exe
C:\Windows\System\ftJnonk.exe
2⤵
PID:9296

C:\Windows\System\aKkkSwm.exe
C:\Windows\System\aKkkSwm.exe
2⤵
PID:9320

C:\Windows\System\pGrYcnw.exe
C:\Windows\System\pGrYcnw.exe
2⤵
PID:9340

C:\Windows\System\oNssSBm.exe
C:\Windows\System\oNssSBm.exe
2⤵
PID:9360

C:\Windows\System\vfZJLfw.exe
C:\Windows\System\vfZJLfw.exe
2⤵
PID:9384

C:\Windows\System\TkIHtVJ.exe
C:\Windows\System\TkIHtVJ.exe
2⤵
PID:9404

C:\Windows\System\ZnxdCtH.exe
C:\Windows\System\ZnxdCtH.exe
2⤵
PID:9424

C:\Windows\System\ottPHhR.exe
C:\Windows\System\ottPHhR.exe
2⤵
PID:9448

C:\Windows\System\kDEakrP.exe
C:\Windows\System\kDEakrP.exe
2⤵
PID:9468

C:\Windows\System\TrSfWtD.exe
C:\Windows\System\TrSfWtD.exe
2⤵
PID:9492

C:\Windows\System\ZKisZHW.exe
C:\Windows\System\ZKisZHW.exe
2⤵
PID:9516

C:\Windows\System\GMSuEnw.exe
C:\Windows\System\GMSuEnw.exe
2⤵
PID:9532

C:\Windows\System\tBFEvCI.exe
C:\Windows\System\tBFEvCI.exe
2⤵
PID:9560

C:\Windows\System\BqNCoCS.exe
C:\Windows\System\BqNCoCS.exe
2⤵
PID:9580

C:\Windows\System\NUwOmkQ.exe
C:\Windows\System\NUwOmkQ.exe
2⤵
PID:9604

C:\Windows\System\ORtwTlz.exe
C:\Windows\System\ORtwTlz.exe
2⤵
PID:9636

C:\Windows\System\ZvOcqOn.exe
C:\Windows\System\ZvOcqOn.exe
2⤵
PID:9844

C:\Windows\System\QdlpyEu.exe
C:\Windows\System\QdlpyEu.exe
2⤵
PID:9884

C:\Windows\System\XcXmHAZ.exe
C:\Windows\System\XcXmHAZ.exe
2⤵
PID:9924

C:\Windows\System\GFlzPuI.exe
C:\Windows\System\GFlzPuI.exe
2⤵
PID:9952

C:\Windows\System\DDLOviy.exe
C:\Windows\System\DDLOviy.exe
2⤵
PID:9976

C:\Windows\System\VAxUZxa.exe
C:\Windows\System\VAxUZxa.exe
2⤵
PID:10004

C:\Windows\System\WvhihDM.exe
C:\Windows\System\WvhihDM.exe
2⤵
PID:10024

C:\Windows\System\AmuHpTt.exe
C:\Windows\System\AmuHpTt.exe
2⤵
PID:10040

C:\Windows\System\hVSNZej.exe
C:\Windows\System\hVSNZej.exe
2⤵
PID:10060

C:\Windows\System\XFePrBB.exe
C:\Windows\System\XFePrBB.exe
2⤵
PID:10080

C:\Windows\System\LoJRPzj.exe
C:\Windows\System\LoJRPzj.exe
2⤵
PID:10108

C:\Windows\System\PKXRoqJ.exe
C:\Windows\System\PKXRoqJ.exe
2⤵
PID:10124

C:\Windows\System\KzKvuKF.exe
C:\Windows\System\KzKvuKF.exe
2⤵
PID:10152

C:\Windows\System\kuqYUyu.exe
C:\Windows\System\kuqYUyu.exe
2⤵
PID:10176

C:\Windows\System\YokGVHl.exe
C:\Windows\System\YokGVHl.exe
2⤵
PID:10192

C:\Windows\System\rLEpRhs.exe
C:\Windows\System\rLEpRhs.exe
2⤵
PID:10216

C:\Windows\System\DFqiaaU.exe
C:\Windows\System\DFqiaaU.exe
2⤵
PID:8556

C:\Windows\System\UxGxoRQ.exe
C:\Windows\System\UxGxoRQ.exe
2⤵
PID:8420

C:\Windows\System\yoJtYKk.exe
C:\Windows\System\yoJtYKk.exe
2⤵
PID:8544

C:\Windows\System\KdQMBkn.exe
C:\Windows\System\KdQMBkn.exe
2⤵
PID:7888

C:\Windows\System\DOmjnMR.exe
C:\Windows\System\DOmjnMR.exe
2⤵
PID:7936

C:\Windows\System\iIACoDY.exe
C:\Windows\System\iIACoDY.exe
2⤵
PID:7988

C:\Windows\System\umQJQAG.exe
C:\Windows\System\umQJQAG.exe
2⤵
PID:8836

C:\Windows\System\FsNTwGB.exe
C:\Windows\System\FsNTwGB.exe
2⤵
PID:6880

C:\Windows\System\DLtLvyp.exe
C:\Windows\System\DLtLvyp.exe
2⤵
PID:6560

C:\Windows\System\UbPgXak.exe
C:\Windows\System\UbPgXak.exe
2⤵
PID:6680

C:\Windows\System\YMkMpCd.exe
C:\Windows\System\YMkMpCd.exe
2⤵
PID:3628

C:\Windows\System\oZvPhNY.exe
C:\Windows\System\oZvPhNY.exe
2⤵
PID:6960

C:\Windows\System\iDrfoMw.exe
C:\Windows\System\iDrfoMw.exe
2⤵
PID:9160

C:\Windows\System\YTHoEdC.exe
C:\Windows\System\YTHoEdC.exe
2⤵
PID:8312

C:\Windows\System\Porymiy.exe
C:\Windows\System\Porymiy.exe
2⤵
PID:8356

C:\Windows\System\cJiQYCg.exe
C:\Windows\System\cJiQYCg.exe
2⤵
PID:748

C:\Windows\System\NcbxqiE.exe
C:\Windows\System\NcbxqiE.exe
2⤵
PID:7196

C:\Windows\System\KHRoulC.exe
C:\Windows\System\KHRoulC.exe
2⤵
PID:7720

C:\Windows\System\avvFwtB.exe
C:\Windows\System\avvFwtB.exe
2⤵
PID:8984

C:\Windows\System\QDnkZRi.exe
C:\Windows\System\QDnkZRi.exe
2⤵
PID:8872

C:\Windows\System\FLSaflL.exe
C:\Windows\System\FLSaflL.exe
2⤵
PID:3112

C:\Windows\System\efnDMOY.exe
C:\Windows\System\efnDMOY.exe
2⤵
PID:8600

C:\Windows\System\iLdEfIs.exe
C:\Windows\System\iLdEfIs.exe
2⤵
PID:9224

C:\Windows\System\yjxZKMN.exe
C:\Windows\System\yjxZKMN.exe
2⤵
PID:9280

C:\Windows\System\yHBfouE.exe
C:\Windows\System\yHBfouE.exe
2⤵
PID:7636

C:\Windows\System\gveezRq.exe
C:\Windows\System\gveezRq.exe
2⤵
PID:8460

C:\Windows\System\phqrEuF.exe
C:\Windows\System\phqrEuF.exe
2⤵
PID:6520

C:\Windows\System\OitrXcJ.exe
C:\Windows\System\OitrXcJ.exe
2⤵
PID:8684

C:\Windows\System\iElkTcH.exe
C:\Windows\System\iElkTcH.exe
2⤵
PID:8656

C:\Windows\System\spaNbwI.exe
C:\Windows\System\spaNbwI.exe
2⤵
PID:9588

C:\Windows\System\PxfrJII.exe
C:\Windows\System\PxfrJII.exe
2⤵
PID:2228

C:\Windows\System\YIvzvFs.exe
C:\Windows\System\YIvzvFs.exe
2⤵
PID:8860

C:\Windows\System\jpvLIbF.exe
C:\Windows\System\jpvLIbF.exe
2⤵
PID:10244

C:\Windows\System\CPyBEUp.exe
C:\Windows\System\CPyBEUp.exe
2⤵
PID:10260

C:\Windows\System\cYOgjxB.exe
C:\Windows\System\cYOgjxB.exe
2⤵
PID:10284

C:\Windows\System\LsmVhGe.exe
C:\Windows\System\LsmVhGe.exe
2⤵
PID:10312

C:\Windows\System\GehPccP.exe
C:\Windows\System\GehPccP.exe
2⤵
PID:10336

C:\Windows\System\OKleIES.exe
C:\Windows\System\OKleIES.exe
2⤵
PID:10352

C:\Windows\System\CMWBzZz.exe
C:\Windows\System\CMWBzZz.exe
2⤵
PID:10376

C:\Windows\System\AuYzEOt.exe
C:\Windows\System\AuYzEOt.exe
2⤵
PID:10396

C:\Windows\System\lTueQkk.exe
C:\Windows\System\lTueQkk.exe
2⤵
PID:10424

C:\Windows\System\TEENaey.exe
C:\Windows\System\TEENaey.exe
2⤵
PID:10440

C:\Windows\System\aZCExfo.exe
C:\Windows\System\aZCExfo.exe
2⤵
PID:10468

C:\Windows\System\SsIpyPg.exe
C:\Windows\System\SsIpyPg.exe
2⤵
PID:10484

C:\Windows\System\KtVtwst.exe
C:\Windows\System\KtVtwst.exe
2⤵
PID:10504

C:\Windows\System\VVZzekP.exe
C:\Windows\System\VVZzekP.exe
2⤵
PID:10528

C:\Windows\System\XfmliHq.exe
C:\Windows\System\XfmliHq.exe
2⤵
PID:10556

C:\Windows\System\nfagDgk.exe
C:\Windows\System\nfagDgk.exe
2⤵
PID:10580

C:\Windows\System\XZTJwCn.exe
C:\Windows\System\XZTJwCn.exe
2⤵
PID:10612

C:\Windows\System\LFqRbqp.exe
C:\Windows\System\LFqRbqp.exe
2⤵
PID:10640

C:\Windows\System\dVKAuvP.exe
C:\Windows\System\dVKAuvP.exe
2⤵
PID:10660

C:\Windows\System\JGgPhYl.exe
C:\Windows\System\JGgPhYl.exe
2⤵
PID:10676

C:\Windows\System\oKkFzFB.exe
C:\Windows\System\oKkFzFB.exe
2⤵
PID:10692

C:\Windows\System\vEhAzcz.exe
C:\Windows\System\vEhAzcz.exe
2⤵
PID:10708

C:\Windows\System\KAGnByJ.exe
C:\Windows\System\KAGnByJ.exe
2⤵
PID:10724

C:\Windows\System\WaDWkpA.exe
C:\Windows\System\WaDWkpA.exe
2⤵
PID:10740

C:\Windows\System\zNCxiDz.exe
C:\Windows\System\zNCxiDz.exe
2⤵
PID:10764

C:\Windows\System\nOhWvlO.exe
C:\Windows\System\nOhWvlO.exe
2⤵
PID:10780

C:\Windows\System\RvmhPdP.exe
C:\Windows\System\RvmhPdP.exe
2⤵
PID:10808

C:\Windows\System\yrheklp.exe
C:\Windows\System\yrheklp.exe
2⤵
PID:10824

C:\Windows\System\BeZLRae.exe
C:\Windows\System\BeZLRae.exe
2⤵
PID:10844

C:\Windows\System\cQHiGpw.exe
C:\Windows\System\cQHiGpw.exe
2⤵
PID:10864

C:\Windows\System\OfMLixl.exe
C:\Windows\System\OfMLixl.exe
2⤵
PID:10884

C:\Windows\System\YHejGAw.exe
C:\Windows\System\YHejGAw.exe
2⤵
PID:10904

C:\Windows\System\FCgiZRr.exe
C:\Windows\System\FCgiZRr.exe
2⤵
PID:10932

C:\Windows\System\PzpsicV.exe
C:\Windows\System\PzpsicV.exe
2⤵
PID:10952

C:\Windows\System\teeMhoh.exe
C:\Windows\System\teeMhoh.exe
2⤵
PID:10976

C:\Windows\System\ZeWRxhv.exe
C:\Windows\System\ZeWRxhv.exe
2⤵
PID:10996

C:\Windows\System\RPYtFku.exe
C:\Windows\System\RPYtFku.exe
2⤵
PID:11012

C:\Windows\System\UvJGuIL.exe
C:\Windows\System\UvJGuIL.exe
2⤵
PID:11036

C:\Windows\System\KevkNMM.exe
C:\Windows\System\KevkNMM.exe
2⤵
PID:11060

C:\Windows\System\mRjEAYR.exe
C:\Windows\System\mRjEAYR.exe
2⤵
PID:11076

C:\Windows\System\FeuCnDC.exe
C:\Windows\System\FeuCnDC.exe
2⤵
PID:11096

C:\Windows\System\pAhLdsl.exe
C:\Windows\System\pAhLdsl.exe
2⤵
PID:11120

C:\Windows\System\ogojBEQ.exe
C:\Windows\System\ogojBEQ.exe
2⤵
PID:11136

C:\Windows\System\HGVzSWN.exe
C:\Windows\System\HGVzSWN.exe
2⤵
PID:11160

C:\Windows\System\limgwYL.exe
C:\Windows\System\limgwYL.exe
2⤵
PID:11184

C:\Windows\System\dRuvfvP.exe
C:\Windows\System\dRuvfvP.exe
2⤵
PID:11200

C:\Windows\System\mWaNVWx.exe
C:\Windows\System\mWaNVWx.exe
2⤵
PID:11220

C:\Windows\System\sVsGFww.exe
C:\Windows\System\sVsGFww.exe
2⤵
PID:11236

C:\Windows\System\uGNbYda.exe
C:\Windows\System\uGNbYda.exe
2⤵
PID:11260

C:\Windows\System\spIsvHA.exe
C:\Windows\System\spIsvHA.exe
2⤵
PID:7396

C:\Windows\System\knZXFza.exe
C:\Windows\System\knZXFza.exe
2⤵
PID:9116

C:\Windows\System\LTMARbX.exe
C:\Windows\System\LTMARbX.exe
2⤵
PID:9196

C:\Windows\System\aIYPALB.exe
C:\Windows\System\aIYPALB.exe
2⤵
PID:10016

C:\Windows\System\SPwFqTP.exe
C:\Windows\System\SPwFqTP.exe
2⤵
PID:6760

C:\Windows\System\JzYvvaL.exe
C:\Windows\System\JzYvvaL.exe
2⤵
PID:10144

C:\Windows\System\psrGzDx.exe
C:\Windows\System\psrGzDx.exe
2⤵
PID:8016

C:\Windows\System\FHkHyao.exe
C:\Windows\System\FHkHyao.exe
2⤵
PID:9024

C:\Windows\System\WwhSxig.exe
C:\Windows\System\WwhSxig.exe
2⤵
PID:7976

C:\Windows\System\VVoxwaL.exe
C:\Windows\System\VVoxwaL.exe
2⤵
PID:7808

C:\Windows\System\ahPNHaT.exe
C:\Windows\System\ahPNHaT.exe
2⤵
PID:7856

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 7856 -s 244
3⤵
PID:10652

C:\Windows\System\uKTFxtx.exe
C:\Windows\System\uKTFxtx.exe
2⤵
PID:9352

C:\Windows\System\Aaloijh.exe
C:\Windows\System\Aaloijh.exe
2⤵
PID:7608

C:\Windows\System\ZcfccDI.exe
C:\Windows\System\ZcfccDI.exe
2⤵
PID:2904

C:\Windows\System\BTbEVjy.exe
C:\Windows\System\BTbEVjy.exe
2⤵
PID:8888

C:\Windows\System\njaFeQF.exe
C:\Windows\System\njaFeQF.exe
2⤵
PID:9576

C:\Windows\System\RPbGSix.exe
C:\Windows\System\RPbGSix.exe
2⤵
PID:11284

C:\Windows\System\kpaahWR.exe
C:\Windows\System\kpaahWR.exe
2⤵
PID:11300

C:\Windows\System\XUOlWbi.exe
C:\Windows\System\XUOlWbi.exe
2⤵
PID:11328

C:\Windows\System\YVFcRvP.exe
C:\Windows\System\YVFcRvP.exe
2⤵
PID:11344

C:\Windows\System\CWjvSHb.exe
C:\Windows\System\CWjvSHb.exe
2⤵
PID:11376

C:\Windows\System\lKOihoB.exe
C:\Windows\System\lKOihoB.exe
2⤵
PID:11396

C:\Windows\System\bEilqxm.exe
C:\Windows\System\bEilqxm.exe
2⤵
PID:11420

C:\Windows\System\XCRwqaY.exe
C:\Windows\System\XCRwqaY.exe
2⤵
PID:11448

C:\Windows\System\asSUTtD.exe
C:\Windows\System\asSUTtD.exe
2⤵
PID:11472

C:\Windows\System\AGnwMzB.exe
C:\Windows\System\AGnwMzB.exe
2⤵
PID:11500

C:\Windows\System\nvTfCPf.exe
C:\Windows\System\nvTfCPf.exe
2⤵
PID:11516

C:\Windows\System\yUgkTpx.exe
C:\Windows\System\yUgkTpx.exe
2⤵
PID:11540

C:\Windows\System\WffynKP.exe
C:\Windows\System\WffynKP.exe
2⤵
PID:11564

C:\Windows\System\MRRuXHB.exe
C:\Windows\System\MRRuXHB.exe
2⤵
PID:11580

C:\Windows\System\CGicMFL.exe
C:\Windows\System\CGicMFL.exe
2⤵
PID:11612

C:\Windows\System\etZOZnr.exe
C:\Windows\System\etZOZnr.exe
2⤵
PID:11632

C:\Windows\System\JCvPoHZ.exe
C:\Windows\System\JCvPoHZ.exe
2⤵
PID:11660

C:\Windows\System\MICmEKw.exe
C:\Windows\System\MICmEKw.exe
2⤵
PID:11676

C:\Windows\System\keQSOaR.exe
C:\Windows\System\keQSOaR.exe
2⤵
PID:11696

C:\Windows\System\ZFnlvXd.exe
C:\Windows\System\ZFnlvXd.exe
2⤵
PID:11712

C:\Windows\System\BxDUgLP.exe
C:\Windows\System\BxDUgLP.exe
2⤵
PID:11728

C:\Windows\System\giPIirr.exe
C:\Windows\System\giPIirr.exe
2⤵
PID:11744

C:\Windows\System\OjEzEGE.exe
C:\Windows\System\OjEzEGE.exe
2⤵
PID:11760

C:\Windows\System\WoXYCcW.exe
C:\Windows\System\WoXYCcW.exe
2⤵
PID:11784

C:\Windows\System\xovbMIh.exe
C:\Windows\System\xovbMIh.exe
2⤵
PID:11804

C:\Windows\System\XAdVWTW.exe
C:\Windows\System\XAdVWTW.exe
2⤵
PID:11824

C:\Windows\System\VvwxfVk.exe
C:\Windows\System\VvwxfVk.exe
2⤵
PID:11844

C:\Windows\System\zUbZugR.exe
C:\Windows\System\zUbZugR.exe
2⤵
PID:11864

C:\Windows\System\sIFIXAR.exe
C:\Windows\System\sIFIXAR.exe
2⤵
PID:11888

C:\Windows\System\CfkwTZq.exe
C:\Windows\System\CfkwTZq.exe
2⤵
PID:11904

C:\Windows\System\EfIeNCm.exe
C:\Windows\System\EfIeNCm.exe
2⤵
PID:11932

C:\Windows\System\QyouvDQ.exe
C:\Windows\System\QyouvDQ.exe
2⤵
PID:11952

C:\Windows\System\RmUcQiI.exe
C:\Windows\System\RmUcQiI.exe
2⤵
PID:11968

C:\Windows\System\dVlCYJt.exe
C:\Windows\System\dVlCYJt.exe
2⤵
PID:11988

C:\Windows\System\yCMJzOC.exe
C:\Windows\System\yCMJzOC.exe
2⤵
PID:12012

C:\Windows\System\esGviiV.exe
C:\Windows\System\esGviiV.exe
2⤵
PID:12032

C:\Windows\System\OVstndx.exe
C:\Windows\System\OVstndx.exe
2⤵
PID:12052

C:\Windows\System\xNlgrpx.exe
C:\Windows\System\xNlgrpx.exe
2⤵
PID:12072

C:\Windows\System\eGZWkYD.exe
C:\Windows\System\eGZWkYD.exe
2⤵
PID:12092

C:\Windows\System\bzbcPte.exe
C:\Windows\System\bzbcPte.exe
2⤵
PID:12112

C:\Windows\System\lQjWwYX.exe
C:\Windows\System\lQjWwYX.exe
2⤵
PID:12132

C:\Windows\System\cjeYOen.exe
C:\Windows\System\cjeYOen.exe
2⤵
PID:12152

C:\Windows\System\euNnmoK.exe
C:\Windows\System\euNnmoK.exe
2⤵
PID:12172

C:\Windows\System\qidnwNv.exe
C:\Windows\System\qidnwNv.exe
2⤵
PID:12188

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 12188 -s 28
3⤵
PID:12920

C:\Windows\System\iaTyNxj.exe
C:\Windows\System\iaTyNxj.exe
2⤵
PID:12212

C:\Windows\System\cgEOkvi.exe
C:\Windows\System\cgEOkvi.exe
2⤵
PID:12236

C:\Windows\System\PhetCoi.exe
C:\Windows\System\PhetCoi.exe
2⤵
PID:12252

C:\Windows\System\zbkNgPA.exe
C:\Windows\System\zbkNgPA.exe
2⤵
PID:12276

C:\Windows\System\BoPEFrs.exe
C:\Windows\System\BoPEFrs.exe
2⤵
PID:8124

C:\Windows\System\jtNUPeT.exe
C:\Windows\System\jtNUPeT.exe
2⤵
PID:10328

C:\Windows\System\CyMWfRf.exe
C:\Windows\System\CyMWfRf.exe
2⤵
PID:10416

C:\Windows\System\tZeqtMg.exe
C:\Windows\System\tZeqtMg.exe
2⤵
PID:7412

C:\Windows\System\HGjWNAF.exe
C:\Windows\System\HGjWNAF.exe
2⤵
PID:10572

C:\Windows\System\CeCPMHY.exe
C:\Windows\System\CeCPMHY.exe
2⤵
PID:7488

C:\Windows\System\zsErOla.exe
C:\Windows\System\zsErOla.exe
2⤵
PID:1980

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1980 -s 28
3⤵
PID:7672

C:\Windows\System\QUoiXXD.exe
C:\Windows\System\QUoiXXD.exe
2⤵
PID:4932

C:\Windows\System\lJfnUOQ.exe
C:\Windows\System\lJfnUOQ.exe
2⤵
PID:10100

C:\Windows\System\aHjyCqA.exe
C:\Windows\System\aHjyCqA.exe
2⤵
PID:10928

C:\Windows\System\cubHpfM.exe
C:\Windows\System\cubHpfM.exe
2⤵
PID:10208

C:\Windows\System\ZltnMkI.exe
C:\Windows\System\ZltnMkI.exe
2⤵
PID:10992

C:\Windows\System\waWxEqW.exe
C:\Windows\System\waWxEqW.exe
2⤵
PID:8528

C:\Windows\System\zQGWHcS.exe
C:\Windows\System\zQGWHcS.exe
2⤵
PID:9248

C:\Windows\System\EFChUMy.exe
C:\Windows\System\EFChUMy.exe
2⤵
PID:6524

C:\Windows\System\MLyDHAB.exe
C:\Windows\System\MLyDHAB.exe
2⤵
PID:9304

C:\Windows\System\GQDlJOf.exe
C:\Windows\System\GQDlJOf.exe
2⤵
PID:9332

C:\Windows\System\JHkwFIl.exe
C:\Windows\System\JHkwFIl.exe
2⤵
PID:9368

C:\Windows\System\gjMNCEp.exe
C:\Windows\System\gjMNCEp.exe
2⤵
PID:11244

C:\Windows\System\kwEtflg.exe
C:\Windows\System\kwEtflg.exe
2⤵
PID:9080

C:\Windows\System\XcHIiPT.exe
C:\Windows\System\XcHIiPT.exe
2⤵
PID:9172

C:\Windows\System\DsbAzZk.exe
C:\Windows\System\DsbAzZk.exe
2⤵
PID:9004

C:\Windows\System\MBMYRes.exe
C:\Windows\System\MBMYRes.exe
2⤵
PID:9484

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 9484 -s 28
3⤵
PID:336

C:\Windows\System\hOVaaIQ.exe
C:\Windows\System\hOVaaIQ.exe
2⤵
PID:9648

C:\Windows\System\LADNsKO.exe
C:\Windows\System\LADNsKO.exe
2⤵
PID:12300

C:\Windows\System\TOKXFzC.exe
C:\Windows\System\TOKXFzC.exe
2⤵
PID:12324

C:\Windows\System\MPohlCK.exe
C:\Windows\System\MPohlCK.exe
2⤵
PID:12344

C:\Windows\System\FUCXCcq.exe
C:\Windows\System\FUCXCcq.exe
2⤵
PID:12368

C:\Windows\System\MmqcCwv.exe
C:\Windows\System\MmqcCwv.exe
2⤵
PID:12384

C:\Windows\System\LTLzdCf.exe
C:\Windows\System\LTLzdCf.exe
2⤵
PID:12400

C:\Windows\System\EUhmuQw.exe
C:\Windows\System\EUhmuQw.exe
2⤵
PID:12416

C:\Windows\System\ZCxhRTj.exe
C:\Windows\System\ZCxhRTj.exe
2⤵
PID:12432

C:\Windows\System\gzAqGmk.exe
C:\Windows\System\gzAqGmk.exe
2⤵
PID:12448

C:\Windows\System\XNVSIFU.exe
C:\Windows\System\XNVSIFU.exe
2⤵
PID:12464

C:\Windows\System\DvSRigR.exe
C:\Windows\System\DvSRigR.exe
2⤵
PID:12480

C:\Windows\System\fdzKoPr.exe
C:\Windows\System\fdzKoPr.exe
2⤵
PID:12524

C:\Windows\System\opfqTjk.exe
C:\Windows\System\opfqTjk.exe
2⤵
PID:12560

C:\Windows\System\YMbDXuH.exe
C:\Windows\System\YMbDXuH.exe
2⤵
PID:12584

C:\Windows\System\kbBFwZa.exe
C:\Windows\System\kbBFwZa.exe
2⤵
PID:12600

C:\Windows\System\epKfgFl.exe
C:\Windows\System\epKfgFl.exe
2⤵
PID:12624

C:\Windows\System\utBNFNN.exe
C:\Windows\System\utBNFNN.exe
2⤵
PID:12648

C:\Windows\System\avBzktJ.exe
C:\Windows\System\avBzktJ.exe
2⤵
PID:12668

C:\Windows\System\YNUsstv.exe
C:\Windows\System\YNUsstv.exe
2⤵
PID:12688

C:\Windows\System\jvcQnYO.exe
C:\Windows\System\jvcQnYO.exe
2⤵
PID:12712

C:\Windows\System\lvgCWDC.exe
C:\Windows\System\lvgCWDC.exe
2⤵
PID:12736

C:\Windows\System\kGPLxLd.exe
C:\Windows\System\kGPLxLd.exe
2⤵
PID:12760

C:\Windows\System\XsSpbqZ.exe
C:\Windows\System\XsSpbqZ.exe
2⤵
PID:12784

C:\Windows\System\wvtyXSK.exe
C:\Windows\System\wvtyXSK.exe
2⤵
PID:12804

C:\Windows\System\VFyRHZt.exe
C:\Windows\System\VFyRHZt.exe
2⤵
PID:12824

C:\Windows\System\uDariDx.exe
C:\Windows\System\uDariDx.exe
2⤵
PID:12848

C:\Windows\System\aMtRJfN.exe
C:\Windows\System\aMtRJfN.exe
2⤵
PID:12868

C:\Windows\System\tennVPR.exe
C:\Windows\System\tennVPR.exe
2⤵
PID:12888

C:\Windows\System\hkhLTXM.exe
C:\Windows\System\hkhLTXM.exe
2⤵
PID:12904

C:\Windows\System\SJzlhdj.exe
C:\Windows\System\SJzlhdj.exe
2⤵
PID:12924

C:\Windows\System\AQfdxXy.exe
C:\Windows\System\AQfdxXy.exe
2⤵
PID:12944

C:\Windows\System\uijCYLa.exe
C:\Windows\System\uijCYLa.exe
2⤵
PID:12964

C:\Windows\System\QgMjTiS.exe
C:\Windows\System\QgMjTiS.exe
2⤵
PID:12980

C:\Windows\System\ZHSMPIS.exe
C:\Windows\System\ZHSMPIS.exe
2⤵
PID:12996

C:\Windows\System\zPmogii.exe
C:\Windows\System\zPmogii.exe
2⤵
PID:10704

C:\Windows\System\tGzSkgI.exe
C:\Windows\System\tGzSkgI.exe
2⤵
PID:10748

C:\Windows\System\jvabveH.exe
C:\Windows\System\jvabveH.exe
2⤵
PID:10860

C:\Windows\System\zTFJzKs.exe
C:\Windows\System\zTFJzKs.exe
2⤵
PID:12040

C:\Windows\System\QkWXdXH.exe
C:\Windows\System\QkWXdXH.exe
2⤵
PID:11008

C:\Windows\System\yvtQlRB.exe
C:\Windows\System\yvtQlRB.exe
2⤵
PID:11068

C:\Windows\System\kAmtTsG.exe
C:\Windows\System\kAmtTsG.exe
2⤵
PID:11192

C:\Windows\System\cenIwqb.exe
C:\Windows\System\cenIwqb.exe
2⤵
PID:2296

C:\Windows\System\QVRnPZr.exe
C:\Windows\System\QVRnPZr.exe
2⤵
PID:10072

C:\Windows\System\kWmRNmj.exe
C:\Windows\System\kWmRNmj.exe
2⤵
PID:11460

C:\Windows\System\wUZsBWn.exe
C:\Windows\System\wUZsBWn.exe
2⤵
PID:11900

C:\Windows\System\kFlQyJH.exe
C:\Windows\System\kFlQyJH.exe
2⤵
PID:11980

C:\Windows\System\EtimBeB.exe
C:\Windows\System\EtimBeB.exe
2⤵
PID:12048

C:\Windows\System\tnaypGn.exe
C:\Windows\System\tnaypGn.exe
2⤵
PID:7116

C:\Windows\System\oNzblnP.exe
C:\Windows\System\oNzblnP.exe
2⤵
PID:12392

C:\Windows\System\CGzsNHC.exe
C:\Windows\System\CGzsNHC.exe
2⤵
PID:12316

C:\Windows\System\bjvqHfl.exe
C:\Windows\System\bjvqHfl.exe
2⤵
PID:12896

C:\Windows\System\wHUwsmw.exe
C:\Windows\System\wHUwsmw.exe
2⤵
PID:13192

C:\Windows\System\AmpoCUe.exe
C:\Windows\System\AmpoCUe.exe
2⤵
PID:13144

C:\Windows\System\fsGwlwc.exe
C:\Windows\System\fsGwlwc.exe
2⤵
PID:13120

C:\Windows\System\xwWwEoB.exe
C:\Windows\System\xwWwEoB.exe
2⤵
PID:13080

C:\Windows\System\fJRdKzk.exe
C:\Windows\System\fJRdKzk.exe
2⤵
PID:13048

C:\Windows\System\lGPHpug.exe
C:\Windows\System\lGPHpug.exe
2⤵
PID:11628

C:\Windows\System\SCRIMal.exe
C:\Windows\System\SCRIMal.exe
2⤵
PID:9892

C:\Windows\System\lwGJjPB.exe
C:\Windows\System\lwGJjPB.exe
2⤵
PID:12268

C:\Windows\System\qxbadQD.exe
C:\Windows\System\qxbadQD.exe
2⤵
PID:10684

C:\Windows\System\peYQjVf.exe
C:\Windows\System\peYQjVf.exe
2⤵
PID:9240

C:\Windows\System\GNfadku.exe
C:\Windows\System\GNfadku.exe
2⤵
PID:12884

C:\Windows\System\kJyiLql.exe
C:\Windows\System\kJyiLql.exe
2⤵
PID:8708

C:\Windows\System\DfhEOKn.exe
C:\Windows\System\DfhEOKn.exe
2⤵
PID:11408

C:\Windows\System\ftlhToc.exe
C:\Windows\System\ftlhToc.exe
2⤵
PID:8376

C:\Windows\System\OuYZupH.exe
C:\Windows\System\OuYZupH.exe
2⤵
PID:9252

C:\Windows\System\PKyAqdj.exe
C:\Windows\System\PKyAqdj.exe
2⤵
PID:12636

C:\Windows\System\cyYMfDI.exe
C:\Windows\System\cyYMfDI.exe
2⤵
PID:9528

C:\Windows\System\Iennfdt.exe
C:\Windows\System\Iennfdt.exe
2⤵
PID:12976

C:\Windows\System\yYVPGNx.exe
C:\Windows\System\yYVPGNx.exe
2⤵
PID:11048

C:\Windows\System\LNgeYUq.exe
C:\Windows\System\LNgeYUq.exe
2⤵
PID:10548

C:\Windows\System\lywvsqx.exe
C:\Windows\System\lywvsqx.exe
2⤵
PID:10268

C:\Windows\System\fkSwwiH.exe
C:\Windows\System\fkSwwiH.exe
2⤵
PID:13004

C:\Windows\System\zGaFwhz.exe
C:\Windows\System\zGaFwhz.exe
2⤵
PID:11592

C:\Windows\System\xrrOQZN.exe
C:\Windows\System\xrrOQZN.exe
2⤵
PID:12572

C:\Windows\System\soibUHh.exe
C:\Windows\System\soibUHh.exe
2⤵
PID:12816

C:\Windows\System\YGIsGiN.exe
C:\Windows\System\YGIsGiN.exe
2⤵
PID:11876

C:\Windows\System\PkPEsFq.exe
C:\Windows\System\PkPEsFq.exe
2⤵
PID:12140

C:\Windows\System\mdcwmRd.exe
C:\Windows\System\mdcwmRd.exe
2⤵
PID:12260

C:\Windows\System\UwtdaEd.exe
C:\Windows\System\UwtdaEd.exe
2⤵
PID:10492

C:\Windows\System\RpIUygg.exe
C:\Windows\System\RpIUygg.exe
2⤵
PID:4424

C:\Windows\System\ITqXHZV.exe
C:\Windows\System\ITqXHZV.exe
2⤵
PID:13108

C:\Windows\System\ZWqlksH.exe
C:\Windows\System\ZWqlksH.exe
2⤵
PID:12832

C:\Windows\System\AncSBXz.exe
C:\Windows\System\AncSBXz.exe
2⤵
PID:10568

C:\Windows\System\LGXGOTG.exe
C:\Windows\System\LGXGOTG.exe
2⤵
PID:13012

C:\Windows\System\WOTAjcB.exe
C:\Windows\System\WOTAjcB.exe
2⤵
PID:7264

C:\Windows\System\uNEAaxx.exe
C:\Windows\System\uNEAaxx.exe
2⤵
PID:212

C:\Windows\System\HFCLwTW.exe
C:\Windows\System\HFCLwTW.exe
2⤵
PID:12592

C:\Windows\System\kRYkemU.exe
C:\Windows\System\kRYkemU.exe
2⤵
PID:2696

C:\Windows\System\GaaSpkr.exe
C:\Windows\System\GaaSpkr.exe
2⤵
PID:12544

C:\Windows\System\XWlQKQI.exe
C:\Windows\System\XWlQKQI.exe
2⤵
PID:13036

C:\Windows\System\cdQTQtM.exe
C:\Windows\System\cdQTQtM.exe
2⤵
PID:13148

C:\Windows\System\uxSdSCz.exe
C:\Windows\System\uxSdSCz.exe
2⤵
PID:13008

C:\Windows\System\Guarlbn.exe
C:\Windows\System\Guarlbn.exe
2⤵
PID:5020

C:\Windows\System\EuQMzeW.exe
C:\Windows\System\EuQMzeW.exe
2⤵
PID:7908

C:\Windows\System\TNDQkfG.exe
C:\Windows\System\TNDQkfG.exe
2⤵
PID:11768

C:\Windows\System\hojHyMP.exe
C:\Windows\System\hojHyMP.exe
2⤵
PID:10000

C:\Windows\System\ipnkyFf.exe
C:\Windows\System\ipnkyFf.exe
2⤵
PID:10480

C:\Windows\System\NgRbdqy.exe
C:\Windows\System\NgRbdqy.exe
2⤵
PID:12796

C:\Windows\System\ioscRhZ.exe
C:\Windows\System\ioscRhZ.exe
2⤵
PID:12920

C:\Windows\System\opbEGfe.exe
C:\Windows\System\opbEGfe.exe
2⤵
PID:10120

C:\Windows\System\rGjQpoA.exe
C:\Windows\System\rGjQpoA.exe
2⤵
PID:13204

C:\Windows\System\Rcxcuxe.exe
C:\Windows\System\Rcxcuxe.exe
2⤵
PID:11104

C:\Windows\System\DfeTBMb.exe
C:\Windows\System\DfeTBMb.exe
2⤵
PID:13240

C:\Windows\System\rVAthiq.exe
C:\Windows\System\rVAthiq.exe
2⤵
PID:10652

C:\Windows\System\XfvhKov.exe
C:\Windows\System\XfvhKov.exe
2⤵
PID:8336

C:\Windows\System\pcMyOns.exe
C:\Windows\System\pcMyOns.exe
2⤵
PID:11512

C:\Windows\System\WyZcquq.exe
C:\Windows\System\WyZcquq.exe
2⤵
PID:3920

C:\Windows\System\uNembQm.exe
C:\Windows\System\uNembQm.exe
2⤵
PID:12164

C:\Windows\System\dIvGMIm.exe
C:\Windows\System\dIvGMIm.exe
2⤵
PID:12704

C:\Windows\System\WiAAveI.exe
C:\Windows\System\WiAAveI.exe
2⤵
PID:2676

C:\Windows\System\ocaUSoB.exe
C:\Windows\System\ocaUSoB.exe
2⤵
PID:7672

C:\Windows\System\vJZlfCT.exe
C:\Windows\System\vJZlfCT.exe
2⤵
PID:12364

C:\Windows\System\TJRnFXe.exe
C:\Windows\System\TJRnFXe.exe
2⤵
PID:12620

C:\Windows\System\QwahaXx.exe
C:\Windows\System\QwahaXx.exe
2⤵
PID:12424

C:\Windows\System\ORuRFFj.exe
C:\Windows\System\ORuRFFj.exe
2⤵
PID:4628

C:\Windows\System\bfqLHPj.exe
C:\Windows\System\bfqLHPj.exe
2⤵
PID:11116

C:\Windows\System\fmUaYBA.exe
C:\Windows\System\fmUaYBA.exe
2⤵
PID:8160

C:\Windows\System\TofcQmH.exe
C:\Windows\System\TofcQmH.exe
2⤵
PID:11464

C:\Windows\System\WpahAlp.exe
C:\Windows\System\WpahAlp.exe
2⤵
PID:11216

C:\Windows\System\ITbxJfR.exe
C:\Windows\System\ITbxJfR.exe
2⤵
PID:12128

C:\Windows\System\DyNHCcv.exe
C:\Windows\System\DyNHCcv.exe
2⤵
PID:336

C:\Windows\System\qBKTQpC.exe
C:\Windows\System\qBKTQpC.exe
2⤵
PID:10760

C:\Windows\System\rezahms.exe
C:\Windows\System\rezahms.exe
2⤵
PID:6092

C:\Windows\System\iWvzDTH.exe
C:\Windows\System\iWvzDTH.exe
2⤵
PID:13032

C:\Windows\System\Hhfjzzc.exe
C:\Windows\System\Hhfjzzc.exe
2⤵
PID:12220

C:\Windows\System\ezokOTj.exe
C:\Windows\System\ezokOTj.exe
2⤵
PID:13468

C:\Windows\System\dZlyhxG.exe
C:\Windows\System\dZlyhxG.exe
2⤵
PID:13488

C:\Windows\System\JrxHgmq.exe
C:\Windows\System\JrxHgmq.exe
2⤵
PID:13608

C:\Windows\System\RRSHYdm.exe
C:\Windows\System\RRSHYdm.exe
2⤵
PID:13624

C:\Windows\System\XBuJEOu.exe
C:\Windows\System\XBuJEOu.exe
2⤵
PID:13640

C:\Windows\System\BLxOtoT.exe
C:\Windows\System\BLxOtoT.exe
2⤵
PID:13664

C:\Windows\System\JMDPuYL.exe
C:\Windows\System\JMDPuYL.exe
2⤵
PID:13680

C:\Windows\System\SJYrsmi.exe
C:\Windows\System\SJYrsmi.exe
2⤵
PID:13704

C:\Windows\System\mSeTpJp.exe
C:\Windows\System\mSeTpJp.exe
2⤵
PID:13732

C:\Windows\System\kqpyjUY.exe
C:\Windows\System\kqpyjUY.exe
2⤵
PID:13756

C:\Windows\System\HWFeQdP.exe
C:\Windows\System\HWFeQdP.exe
2⤵
PID:13784

C:\Windows\System\JlMisqF.exe
C:\Windows\System\JlMisqF.exe
2⤵
PID:13812

C:\Windows\System\oLRFNvC.exe
C:\Windows\System\oLRFNvC.exe
2⤵
PID:13832

C:\Windows\System\ENiNPaK.exe
C:\Windows\System\ENiNPaK.exe
2⤵
PID:13860

C:\Windows\System\PgaGAaA.exe
C:\Windows\System\PgaGAaA.exe
2⤵
PID:13900

C:\Windows\System\amobweQ.exe
C:\Windows\System\amobweQ.exe
2⤵
PID:13924

C:\Windows\System\kRjDlJD.exe
C:\Windows\System\kRjDlJD.exe
2⤵
PID:13952

C:\Windows\System\JfgwxND.exe
C:\Windows\System\JfgwxND.exe
2⤵
PID:13972

C:\Windows\System\bgYxVMg.exe
C:\Windows\System\bgYxVMg.exe
2⤵
PID:13992

C:\Windows\System\DHavgID.exe
C:\Windows\System\DHavgID.exe
2⤵
PID:14016

C:\Windows\System\GnIjgUL.exe
C:\Windows\System\GnIjgUL.exe
2⤵
PID:14132

C:\Windows\System\dPkOuzZ.exe
C:\Windows\System\dPkOuzZ.exe
2⤵
PID:14152

C:\Windows\System\WOXFnfP.exe
C:\Windows\System\WOXFnfP.exe
2⤵
PID:14176

C:\Windows\System\FAIlKew.exe
C:\Windows\System\FAIlKew.exe
2⤵
PID:14204

C:\Windows\System\wzCpyWs.exe
C:\Windows\System\wzCpyWs.exe
2⤵
PID:14232

C:\Windows\System\IMHkXSJ.exe
C:\Windows\System\IMHkXSJ.exe
2⤵
PID:1640

C:\Windows\System\tPlTQgE.exe
C:\Windows\System\tPlTQgE.exe
2⤵
PID:13404

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 612 -p 10424 -ip 10424
1⤵
PID:12544

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 748 -p 12688 -ip 12688
1⤵
PID:7908

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 700 -p 11728 -ip 11728
1⤵
PID:12128

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 764 -p 9024 -ip 9024
1⤵
PID:8160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ft5on0b.wg0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AGomZMA.exe

Filesize
1.6MB

MD5
e733daaa58c0debaa9c1c320794535ab

SHA1
bc519d32eac069499dea182c0d419f003264baa3

SHA256
85411f782b8afb2d0477aa4a81c692b966de4cd1113a2c583c995a565c368a92

SHA512
e0f870b72fb65ab67f9e0c3ac2009a0f07fe517665a762a90ce5ad66f056122bb2f2089eef9d84ba54a1541fe831360a931711b299640c89ca35847561508be5

Download Submit
C:\Windows\System\BISChrU.exe

Filesize
1.6MB

MD5
20f85a15e2e480ba21c8132b6b0e5e7a

SHA1
c457adb16b535cba32ec8eaf7b36c3bc63b71092

SHA256
db991c62316f2416005a02bec4078899c15796946f05fe5a46544c1639dd832a

SHA512
0ecdcf6d801e08a1ee7d872449bc674f2b015c540a3c17360e63aeea1518d9ecefcb387e28f5b7f0840f9d0120bd1f9cca42a1d9664aac0d6f2784664a64c604

Download Submit
C:\Windows\System\CDDsnfc.exe

Filesize
8B

MD5
4585af961e6be7f3b03d075298565b62

SHA1
8e84c60639225761f581ea4ec1ff9a2d8e5472c9

SHA256
b8920be4ca9181e84576dfb449141c7d9af40d7ddc5588ea3cac8c68ef3a0a88

SHA512
aca862ef42a6056537a17dcbf9d8778efa38fbecbcb6ce3dce02a2eb0f5b9ffb56a667b21c26a29159a0ebcd14d21a77c5b25a36880c46863acba28da90e75f0

Download Submit
C:\Windows\System\CsQQXtf.exe

Filesize
1.6MB

MD5
f7bdb1fb0496699d24a15d8acbfba168

SHA1
291a1513d8ba16883dae7e0d782a882072df7755

SHA256
f244a0a68e70bac6ecc734d1db4cd119cea3ba680f7d491cd738a258b6f825a6

SHA512
d1005200bd55a375a63f92c2f0ba4689d680b55d4ce7dfcacad539ec0621abe95c55b61f8218b9ebf133f3d0a59e9b33939c7a5ca673529af6270fd29ada8fba

Download Submit
C:\Windows\System\DGLpOhz.exe

Filesize
1.6MB

MD5
90afa80a2e38222c9970858351337aff

SHA1
54b0971ac0b228eee70e2dfd395c3eb505164bd8

SHA256
27b8e6e9e760fe9c58756a6eeb2c4be46270378bde21641dfa667505ea39b0a0

SHA512
576ba05fa1322d6660feb07a79b92c00758908912cf294e195c559bcd83a8f89b775aa452ecd80bcd0e31761d5be4d0ff6980b80ab8e190386c0322a918c814f

Download Submit
C:\Windows\System\DONVfJH.exe

Filesize
1.6MB

MD5
27dcff4a2cd125c2009ef61e9d563ac6

SHA1
926f98a7893e2acb6b3cc7cd46979c8e0617de5e

SHA256
9dd52c2e6a55e1a48f27f7a08069e3a15eb14e3900def1b2e50f37472d60c790

SHA512
265f6c9fdb5e02393cb51e3c0f0d3966fef420ea49ce33cf817eb410dc03473c5f627e912847e7b0d0cddec14e501cb2048c861dbdfaaaf8c2332dbd71011ee1

Download Submit
C:\Windows\System\GKuOlea.exe

Filesize
1.6MB

MD5
b2febb175afe30555ffa0fc28a513fc6

SHA1
7df6b47d4b3655d2dfccd10dbe3602a92c4e3b03

SHA256
10a54b3f86e3b655080998fa0604d8e34b720849fd72076e029731f3ef1de749

SHA512
4f7e23e81aa3f224e9123a7ff6dc209adc8974981c15d6576b16304138ab47d9c2c15f4e5a887443e165ff960c1e5327c84c45bcccdf27fe561224e8c2d2a738

Download Submit
C:\Windows\System\GqgDQkJ.exe

Filesize
1.6MB

MD5
569d217750cea92be419c4e143f84bdc

SHA1
9ed072299781f978555e03c9b27648d8abaf6d71

SHA256
6ae63ae2c4f3acb105eb42edd4a83da6b646ece0833029482efc641d450a0009

SHA512
16c2d2b02eff73cc0c41e6f265daa596922ffad59652a781ba8a13032947d2ffa068044bdb3574887844b1fb8b19ac2e71746d041307237a231120f357580956

Download Submit
C:\Windows\System\JEYPeLH.exe

Filesize
1.6MB

MD5
2047f4969933a61cc2299a9bf1852965

SHA1
a2df78a2bb2bf43225e791ac6166de88a3698c06

SHA256
772fcf064c30d47638c7df73e8a0efc45a9b79cd263858fde16f075058228a9e

SHA512
26df07ffa945360a72d27030244c82bf2cb895781aec55c7f35442f0601c00f6cceebec136a3bbef643f61d1784d79c8be8ddc4bb957e23deeec1bd16adbd76f

Download Submit
C:\Windows\System\NOTTkhX.exe

Filesize
1.6MB

MD5
173b16a44d634318a0a85997a1bf2c6a

SHA1
e9708f00394a42bf92358e73adf0d15c4ab2610c

SHA256
a2630afbb6660a0b71bcd3d3d3a8803cf465757e20278b941b05c1da264698d5

SHA512
e06ab68c760c391df11af3d8177fd84e10eea61dcd7ab83743cc9eca26b8ef1c1c1128480c8f55a5e5ee2e9d2e994db083a1c18ee1e6dd2a662ddee0d5f0e5ae

Download Submit
C:\Windows\System\RHzpOpB.exe

Filesize
1.6MB

MD5
72d0eeaaf95e8f3682672084d929da5c

SHA1
b068ed654f703acc077affa2ef0ec743d4f9f81a

SHA256
ae24ccbdb3be004c4e949181e6b454dae69bde07233d81cdc09d28f23f90b56d

SHA512
7dddaf66319afab3114139ae755287eb5f04edecd10cb2b95a64a7adf80beeb26eb3f6e1ca2b63fffbb2fe6e083da448398507247afb53c9b5c91d03c48dc862

Download Submit
C:\Windows\System\RtKLkWx.exe

Filesize
1.6MB

MD5
94a002c40cded4b69491375ed09e87da

SHA1
c895eff05a8e5532f1c0c3dc06fea5d9388504e9

SHA256
b4f68cc27f21e681ad174e0d783119256497c67077380c9d53244bc3b3e547b2

SHA512
567df409ed2fb98cc86cb0a59e6ac63671dd87f59ddccce772bd15f0257453b158078f8eead6ab9fbf6c89143ca1b17c4a5b67c6a8da736f8a4a3b801988c1c1

Download Submit
C:\Windows\System\Rybsfsm.exe

Filesize
1.6MB

MD5
d83da348b953d1f28a9a048ffc007e6b

SHA1
376078a9fef314b9b5a989318ed6faeb10eacd3f

SHA256
52a308ec6d2e09bad92c9772975587567c170c60e8e89343762da14de73765c2

SHA512
ac60d4840b6a2971ad547681af5b8e674e216d17227fc1582b3432a65158a3f0f5f565ac3129cb9564803bc174a276ccde3380e3b8ef0377d367663ffc4404a3

Download Submit
C:\Windows\System\TGrbrWU.exe

Filesize
1.6MB

MD5
9ab814a2c8f934e120b23a4f3ed920c3

SHA1
069a8d388158b90350ebcc770b273402f0c0ec78

SHA256
d7aac10d47e9910cbf90bbdd2e7c76d45bce4b2c4657e4a6de756c60f1dd07d2

SHA512
e723d1c69486a4f279a00b332cbb8ea247b9ed24c370d77ed18baade4fd9f5751ba50ec36f5dee28c274e5867c8e24a78f9a6e58dbd4680aa822f80dde06e899

Download Submit
C:\Windows\System\VnYANzd.exe

Filesize
1.6MB

MD5
dd8f5befd7155d1cc7433e31a15a2369

SHA1
52f947ab8e6592f315d457f15fc03f9e540d795e

SHA256
d7b524f1d5002775ccdfbb63f758682e72451167cbd2444501f84490bd61865a

SHA512
af6998403d5f42da6cd9a827791dedbd1a1e98106a9996fc98e5da91544245c5fb0654266c5295df2540e329174d16cc4719b8827fd0fee9627674bcb7853347

Download Submit
C:\Windows\System\VpArfqO.exe

Filesize
1.6MB

MD5
b7f9692344c65c2f7b5828420453a75e

SHA1
e3a27f7da471c6f63a7e065c0771cc6457ace0c8

SHA256
d1a533f15bc8c397713288ee24d5af23a187866d4f6943235a802260b3aab0f2

SHA512
d19eae061ec9cd1bf0bd9ec51076e5f7309ecc3461459c06ca79cfa2037cb8b65101ad55805a35ba63fd4b037bad03ff79889133c7aa599b2fecfe433f148278

Download Submit
C:\Windows\System\ZpkLFrK.exe

Filesize
1.6MB

MD5
5fb9e14d82aa42ce3e72efcea57c3d96

SHA1
abe5ab9556c84f4d2eac2823e1325679d43b07e6

SHA256
ca62285c2e8c63ebf07f755acd7561aab06352f2ce7170ae6dfc178384a56645

SHA512
8a69afe46d7644d22eaf9da19f4ef6080bff73ab40d137dbc4f644cf7838b316b0957274d3e0e55bc001295813a7d94715616cc18ade6dd03a22da9f868c0b38

Download Submit
C:\Windows\System\ZqJdKaD.exe

Filesize
1.6MB

MD5
278276bcffe2b421cb6dd08c88f5a97a

SHA1
e76660fe34ef765c2d9bfb6e1a1aa6760a6a2ee6

SHA256
d0d41f2af35d120a0cfd130b2fb76c04cc15ca548a3f67607ef7f6b895f73ece

SHA512
aed6a6762c291225d49205f475b8a704db4b4251c706ff421cb026ff054bb7b61a8b51233d573e5b9fba459f5965db219cd2c9563144e435bc23a56f2209ca75

Download Submit
C:\Windows\System\aKBCJnC.exe

Filesize
1.6MB

MD5
d56b97f0abd9aea149ad3568e4902ccc

SHA1
19e0634f2577b5af28aa1837063d2ee85fbd45cc

SHA256
b7c801dc02283c85bde98731da3ff1c1f66a14c4cd0c22616073ae7846a66a0e

SHA512
1f24a97280a87bad83e76216a2924e9811affed3ded330780664cf5fb1ae7fb412b2dd34385b80775e3d5a6f9815cdf43193f9d118e625ff4806b1c1b55334ad

Download Submit
C:\Windows\System\adSNkcJ.exe

Filesize
1.6MB

MD5
46326005b7bf0ecd2d81950f5902cb72

SHA1
99c02bd26e9d3e91b986e4b6d0c19805467d5278

SHA256
fe0cba6a7235e022e415fdb40d20abcb04d543730cfb3a3a10dec88d2467445f

SHA512
fc0308f8e7221badb64f4ae1372ab5d7f70ecdc6495d95c834ade9ba628f9bf3164a9818ea775a65a751890d276ee3fb44232e27bd234326750e00915853414a

Download Submit
C:\Windows\System\bXNHwng.exe

Filesize
1.3MB

MD5
2cb90bd2fbfd09789065264f56cde731

SHA1
68c853d0dfde1ee388376dd5f00eeef7896bd23b

SHA256
52a5b046cb769f9519c3bf1dcbdd0ce53240f19195dee46b2e53a674be242b21

SHA512
96a4cba296891d7be87e3567ba1471e9efb45cda3de7f2c6ac36856dd53997f071e96ed197ae7f4174568b6435b3384fd9fd92beefd19145a7f229d00aefc1d8

Download Submit
C:\Windows\System\bXNHwng.exe

Filesize
1.6MB

MD5
9e41a1139f6915ea4eefc1ccaabcd726

SHA1
91d73ac85ef2d09d19197b96ad3bedce4cef8c4a

SHA256
71ce12dcf0091a8be54462664f180d00d360f6f75f41bff2b863e27fdeba48e3

SHA512
464d4750b4103a49c6694719efeaed8585f9c8aea6b4ca0d82a96d1961c5a128da2b3b52c35f53586ce951a0c022d3e78b75476cf0ebbe289a8e275a6d5b3fa2

Download Submit
C:\Windows\System\bxwwNVs.exe

Filesize
1.6MB

MD5
9ed16f8033a8ebeac70b7fa6540def3a

SHA1
02da9656dc293c4965c5a7a1039d0c1be64e12fd

SHA256
ea1ed1cd59c4541bce7f7c53c8f3bc995f7e212c4a40a8faa333acb11309cc6b

SHA512
dc1423f4e9bb6766e00cd7ae61df64ff496b36760c69c7a4ac032fa73d6cb4ebe667320752764b6a5449edb57d08140e8fb4954794fef4a07a58f8ed7ef7e395

Download Submit
C:\Windows\System\dQauJas.exe

Filesize
1.6MB

MD5
a9d61d2182e8ce81c738bed67891ad13

SHA1
6f4804d1016c2bf94879ab3441f6b45971cfbe88

SHA256
e5660de0a00ce3acded524001ec223532ef061ad2b56127e23e2cf0c6d66b023

SHA512
677f91a1cd6a774075adaace75b0816e7a32385e727dac492794456855f0316de3d1d0cfd86376761aa20308e249294b3c00b1e9d157773aaf2d2f08539b2059

Download Submit
C:\Windows\System\ebhRIyJ.exe

Filesize
1.6MB

MD5
25ae8bcb5c5b8653c2ea106ecdbe433f

SHA1
028d8a98633bdfbc186f69533a8e159f2cbec9b2

SHA256
b419f0a7c47f522a1db50be7cf52cafb863d8d0e99acaa1bc586bcce97e813db

SHA512
3d2606567a577381a744071b62090d94b06cef2d152193ae62b23c352e3a861a493795b92e12b611a89fb57ce5b11d31255d8c7fe2d867fd11c0ad631fdeeae3

Download Submit
C:\Windows\System\elgfXSY.exe

Filesize
1.6MB

MD5
aafde6bbcbe526030b314d7b5c932b75

SHA1
7eda10f2785f2096c8802ad434ed3f3ef661096c

SHA256
389fc4f4570fec4fcc18be0bae1a25f1045acec28f7bf6417164cf39bd123317

SHA512
42efda4735dc0d3c9aea5fbf5a2f6cb4f22fd7a0b4cba8a6ba5d5e86730f93e554cfccbde1b4649e75162f76d2e4e9e48c39ed21e3b1355b0f5e6f2d47a61a5a

Download Submit
C:\Windows\System\hhuCvDx.exe

Filesize
1.6MB

MD5
34d9afacdc5eac4f853f4d331e6be736

SHA1
656da6199fe28214c91131c06e832c57e17b98f7

SHA256
ae5aa41ebc8167b3788fc0991cf0205497785d85f4c76071925d76f650599f45

SHA512
89d6294e3c64fbc8b34eda5d4368023ed278bcf213363f8e3305224f10ce16ab5af645ee8efa318c0ad61e690089ad340188e1d54fca2971453c71bd5cda0a98

Download Submit
C:\Windows\System\jkyJWnV.exe

Filesize
1.6MB

MD5
d308d1b02dc795b40a2ee0c7dc18ef35

SHA1
48a682bfb3257358ac593110ea9e74ae19e3cf14

SHA256
185834e742595f4122f35394dbf1cbbd7da0bff30469293ecc1589f5f96f9e9b

SHA512
5d3bbea3ee66eca6fb032f93080577e1e0e619d4cbb9d0a915a9d87f207fb8edc32003e4ce75d2b479de67e6b7395659d1703437ea137d41badd1e49c7fad934

Download Submit
C:\Windows\System\kczUXNj.exe

Filesize
1.6MB

MD5
daba9ad6e1340f0be7450cc95e8c9a57

SHA1
cd53c55b09e71b1826fc03a4b47d9083a38bc35b

SHA256
38821203a5fd79f018eeabcc6ee1e40fd0bb1478bd14557a0f9ea42597cac6ef

SHA512
4fecc0e74a6d61f8c9afd5842011e2451bda4e1a8c04a59fbb59e5963b8eeaf6242b7935485ce7c848c237e8ec049d9b1dc169c538b50280323b68a63604b9f0

Download Submit
C:\Windows\System\kqjDEYB.exe

Filesize
1.6MB

MD5
a5b93e81c8ab59895f683b457766e80b

SHA1
b14b9dabe3e5184b9e744b98a82f51055eb3ba57

SHA256
25c479c2aa1d618181ee64734265bbc87795ac552a6f4ec087f5d111663f2202

SHA512
a31413bcdb77bb63e320112c24be2c7fdc05f2756e72f4a1af58377e759bdef2ccb6a742d9d2fbf18ed1ba09b545575121e1a1b242fed3c858ec4e6e97b6acf1

Download Submit
C:\Windows\System\krsEBUu.exe

Filesize
1.6MB

MD5
c0b9673b608b83d37c1ca9ba664c6f67

SHA1
9e8fda1fa8678e31d3ab54c42949aeb25bad9b08

SHA256
269198b60ae4268829ab97b75dd82f32bfab7d7110918caf9bee2bf79997e152

SHA512
ae60d856109278b33d4e755877736b7fb696b11c23caa88db6d5edd213695b5438675420ca259c874121ac47df571445575e95a2a5e575ddc036e9342d80456a

Download Submit
C:\Windows\System\lpspxhG.exe

Filesize
1.6MB

MD5
575ee42ba7d86934162d497dcfbb5d11

SHA1
999049fe0072f4e3c00576b972646801cb8ad613

SHA256
b5dac67a99b41e5d322c3760638fdb46aaf383e3cc4e141bbc7a952490229d73

SHA512
af681c752fdf62a69c3db9c18a7365768de92f896cd93e003558f352c441c6f3a75480dcbc95b5a5e8669c5858a6a87813b41e139da51e2b502fc6035f6e3db4

Download Submit
C:\Windows\System\njZBQtk.exe

Filesize
1.6MB

MD5
2faff3f0bc4a6d2521afe82729866924

SHA1
bed60f8b69068c8eb9de3141ccdb01df748909be

SHA256
f893cf870944f455bc15081691044aedde6f2fbe5095cdfeb286841efec4c84f

SHA512
fae9980b83f21e6fef666dbf75ea7e2e6763a138bf4fbfeaff814f50a5461c43173ce9b0cc8fa92808c53c873ecb4c93fd1bac9d882bb6b7a334f3dd79dc5076

Download Submit
C:\Windows\System\pKdBKoB.exe

Filesize
1.6MB

MD5
87a32c4ff18b9119b87a494c8ccb4b89

SHA1
fb32403b90efec26c80138fb037b1b05a5a0ad79

SHA256
0bd9fddc529d66c49f3b94a77fa3b06ae2929c1f8406ebb6459d1d43fc5e508a

SHA512
3c06a3438a3cf046a488e96903acc872d56cf8aa97f847d460b57181cbf8b79d9879869b0e067977bb34353372d0a3695b26f901370cefb81008604104712c58

Download Submit
C:\Windows\System\rMkKJVb.exe

Filesize
1.6MB

MD5
ff22259445ac18bedf2d8be73c96914c

SHA1
1215b86b5b5892e92a0fb88bd250ec3091415b96

SHA256
829ce8f2da8103634844ee010f5a20f1f7550972d11af3d977ae29b4f0ca77f2

SHA512
13d4a9b5e6680eacec8bd7204ff835047c1bac05f19300ef2be5e3fb918d1212c27cd5d0064ddcd52e11dc1132ebbb54891a2d4ba0a2d7d2b1b6ff0f5cfe413d

Download Submit
C:\Windows\System\rbUFPFA.exe

Filesize
1.6MB

MD5
5f5b37e85e490e62b7946f5c868678cc

SHA1
6527c66192d304841b37fe43bcc74064ac243814

SHA256
233d5b33221fb5b6139f850a43cdeb1bf9c20915f5ab1c380e00ba81b1948658

SHA512
627484513e84b73d2f7eca9fe0e8b3676cce63093ed8455b3e206443bf2915ede34879bb36fba91e514d0918e18f8fd8092a1dcc35e6093af5447362d9e9ebcf

Download Submit
C:\Windows\System\sLCGBSX.exe

Filesize
1.6MB

MD5
9f2640838af162501cc7ec6caff2b96b

SHA1
50c760d9517792d74dddb754567cefff5e75c5a4

SHA256
14fc3613721e4bbd3d737e18fefc923b79104a4d145300db35c6095645e47d54

SHA512
24d728d20f347334942e7a66b261b7e5322bd09b797a41a88e1bde841f87a19260b6dc0885c40e4b8ecb9fa12b19bdcea97122130ed5d84094dcb866953d993f

Download Submit
C:\Windows\System\tBOsWRE.exe

Filesize
1.6MB

MD5
d6b21388ed3020a326720c1000da064b

SHA1
644b22c09b4f636fc4acf04db2187f98784b585a

SHA256
0fa2fc0c7da9e95005da2494d26284315b1360a6c3c595877a834f3b58638359

SHA512
9b82130e0f9f1e9a0004bd6ab8f3cc44d733b9b055b9aff021087f3e2ffdfa24a75314f04a81fa4e4464ed7c52b8ecd24515e5c053b7aa92c676d3bd8eb234b8

Download Submit
C:\Windows\System\tgBlcCA.exe

Filesize
1.6MB

MD5
bd897f713e9faa1a684fa41fce38f5b8

SHA1
077fb66d3a3196011174a3e64754d5af84660746

SHA256
486c7cf963468d71236479f4d09babc3d37834707bbbb46eaf79e4698daace74

SHA512
e6c0d059ce7157afc4999be89829565e920453a1bbba0bf7964e0e38aa35eb67b6726b0468773b9cc23d9700f44e6b76874d622a899b0bea3b2dd441bc963f56

Download Submit
C:\Windows\System\toNLFjJ.exe

Filesize
1.6MB

MD5
4165c9b338ef888dc3de3b47b5d28cd2

SHA1
7b1a12247ff5cf324687fd0fbc05e3523921358a

SHA256
3913ac3d57a26a95fb13c8c4c1c91996f02d386e7afe112b62efdbf6359ca1ac

SHA512
37bb69dbc7ee4498e01b54d37d68905685d4fb08184aa55b2a862df9007d0433c7baa223375dde6570a6889d901bf155d9a09c9f32d3a307d317c37b25038499

Download Submit
C:\Windows\System\vHmmTxs.exe

Filesize
1.6MB

MD5
783fc17b10a52eccc7b959ccf8bcad55

SHA1
789258088a77572dbdfa6a7c08da0957ee987e69

SHA256
b9a9fcceac0994af37fb8ecff84b6c5d71eb310d082fc79cbb8e97b7acaec692

SHA512
948a5721f026b829510991f4ea6c24793a50a030700f80294f7465d506f5d194f11f1c7c42308031994d58525bd6bff6f1121fae6d92d0c4263fdd6202d2170f

Download Submit
C:\Windows\System\vTqIrRa.exe

Filesize
1.6MB

MD5
5f931125e2db49486b8c29d9c335fee0

SHA1
3115c18e8baafb26cc21f096531b8f2e0e90ea9d

SHA256
c5356d5fdfe4e18769e661b753fb6c32402b0d69db6706616baf56556474b10d

SHA512
7a332c6380df101753205077e97d28b91966a37b37d0005e93100e53564319bfd077f7325e02b38dc754efdc154cce28c7a2e0053d747b645b65361a965df132

Download Submit
memory/392-460-0x00007FF6F3040000-0x00007FF6F3432000-memory.dmp

Filesize
3.9MB

Download
memory/392-4525-0x00007FF6F3040000-0x00007FF6F3432000-memory.dmp

Filesize
3.9MB

Download
memory/448-4527-0x00007FF6DC750000-0x00007FF6DCB42000-memory.dmp

Filesize
3.9MB

Download
memory/448-411-0x00007FF6DC750000-0x00007FF6DCB42000-memory.dmp

Filesize
3.9MB

Download
memory/512-4546-0x00007FF72F710000-0x00007FF72FB02000-memory.dmp

Filesize
3.9MB

Download
memory/512-457-0x00007FF72F710000-0x00007FF72FB02000-memory.dmp

Filesize
3.9MB

Download
memory/540-449-0x00007FF6D87A0000-0x00007FF6D8B92000-memory.dmp

Filesize
3.9MB

Download
memory/540-4521-0x00007FF6D87A0000-0x00007FF6D8B92000-memory.dmp

Filesize
3.9MB

Download
memory/624-4509-0x00007FF73EC30000-0x00007FF73F022000-memory.dmp

Filesize
3.9MB

Download
memory/624-352-0x00007FF73EC30000-0x00007FF73F022000-memory.dmp

Filesize
3.9MB

Download
memory/1360-4529-0x00007FF67EDD0000-0x00007FF67F1C2000-memory.dmp

Filesize
3.9MB

Download
memory/1360-462-0x00007FF67EDD0000-0x00007FF67F1C2000-memory.dmp

Filesize
3.9MB

Download
memory/1424-183-0x00007FF7D6E50000-0x00007FF7D7242000-memory.dmp

Filesize
3.9MB

Download
memory/1424-4495-0x00007FF7D6E50000-0x00007FF7D7242000-memory.dmp

Filesize
3.9MB

Download
memory/1760-4514-0x00007FF7E2850000-0x00007FF7E2C42000-memory.dmp

Filesize
3.9MB

Download
memory/1760-381-0x00007FF7E2850000-0x00007FF7E2C42000-memory.dmp

Filesize
3.9MB

Download
memory/2172-461-0x00007FF7B6AE0000-0x00007FF7B6ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-4540-0x00007FF7B6AE0000-0x00007FF7B6ED2000-memory.dmp

Filesize
3.9MB

Download
memory/2256-463-0x00007FF667800000-0x00007FF667BF2000-memory.dmp

Filesize
3.9MB

Download
memory/2256-4543-0x00007FF667800000-0x00007FF667BF2000-memory.dmp

Filesize
3.9MB

Download
memory/2772-4538-0x00007FF769910000-0x00007FF769D02000-memory.dmp

Filesize
3.9MB

Download
memory/2772-458-0x00007FF769910000-0x00007FF769D02000-memory.dmp

Filesize
3.9MB

Download
memory/2900-459-0x00007FF64D320000-0x00007FF64D712000-memory.dmp

Filesize
3.9MB

Download
memory/2900-4523-0x00007FF64D320000-0x00007FF64D712000-memory.dmp

Filesize
3.9MB

Download
memory/2936-62-0x00007FFCAA420000-0x00007FFCAAEE1000-memory.dmp

Filesize
10.8MB

Download
memory/2936-6-0x00007FFCAA423000-0x00007FFCAA425000-memory.dmp

Filesize
8KB

Download
memory/2936-124-0x00007FFCAA420000-0x00007FFCAAEE1000-memory.dmp

Filesize
10.8MB

Download
memory/2936-93-0x0000025DC98B0000-0x0000025DC98D2000-memory.dmp

Filesize
136KB

Download
memory/3144-4497-0x00007FF708540000-0x00007FF708932000-memory.dmp

Filesize
3.9MB

Download
memory/3144-464-0x00007FF708540000-0x00007FF708932000-memory.dmp

Filesize
3.9MB

Download
memory/3228-353-0x00007FF739F20000-0x00007FF73A312000-memory.dmp

Filesize
3.9MB

Download
memory/3228-4519-0x00007FF739F20000-0x00007FF73A312000-memory.dmp

Filesize
3.9MB

Download
memory/3312-1-0x000002ABDFEC0000-0x000002ABDFED0000-memory.dmp

Filesize
64KB

Download
memory/3312-0-0x00007FF6C5B50000-0x00007FF6C5F42000-memory.dmp

Filesize
3.9MB

Download
memory/3912-4515-0x00007FF7D27B0000-0x00007FF7D2BA2000-memory.dmp

Filesize
3.9MB

Download
memory/3912-465-0x00007FF7D27B0000-0x00007FF7D2BA2000-memory.dmp

Filesize
3.9MB

Download
memory/3932-271-0x00007FF6A72E0000-0x00007FF6A76D2000-memory.dmp

Filesize
3.9MB

Download
memory/3932-4501-0x00007FF6A72E0000-0x00007FF6A76D2000-memory.dmp

Filesize
3.9MB

Download
memory/4012-442-0x00007FF724AD0000-0x00007FF724EC2000-memory.dmp

Filesize
3.9MB

Download
memory/4012-4517-0x00007FF724AD0000-0x00007FF724EC2000-memory.dmp

Filesize
3.9MB

Download
memory/4032-455-0x00007FF620C40000-0x00007FF621032000-memory.dmp

Filesize
3.9MB

Download
memory/4032-4532-0x00007FF620C40000-0x00007FF621032000-memory.dmp

Filesize
3.9MB

Download
memory/4492-4535-0x00007FF657D10000-0x00007FF658102000-memory.dmp

Filesize
3.9MB

Download
memory/4492-456-0x00007FF657D10000-0x00007FF658102000-memory.dmp

Filesize
3.9MB

Download
memory/4656-4505-0x00007FF796630000-0x00007FF796A22000-memory.dmp

Filesize
3.9MB

Download
memory/4656-270-0x00007FF796630000-0x00007FF796A22000-memory.dmp

Filesize
3.9MB

Download
memory/4660-4499-0x00007FF6EF530000-0x00007FF6EF922000-memory.dmp

Filesize
3.9MB

Download
memory/4660-235-0x00007FF6EF530000-0x00007FF6EF922000-memory.dmp

Filesize
3.9MB

Download
memory/4740-4504-0x00007FF644530000-0x00007FF644922000-memory.dmp

Filesize
3.9MB

Download
memory/4740-322-0x00007FF644530000-0x00007FF644922000-memory.dmp

Filesize
3.9MB

Download
memory/4792-4511-0x00007FF7A0220000-0x00007FF7A0612000-memory.dmp

Filesize
3.9MB

Download
memory/4792-401-0x00007FF7A0220000-0x00007FF7A0612000-memory.dmp

Filesize
3.9MB

Download
memory/5084-4507-0x00007FF716990000-0x00007FF716D82000-memory.dmp

Filesize
3.9MB

Download
memory/5084-303-0x00007FF716990000-0x00007FF716D82000-memory.dmp

Filesize
3.9MB

Download