xmrig | d3dc9e9b545b3af1a3b7ab7fca841569272a70092d8e488239816e51c586c23e

Analysis

max time kernel
120s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
Size 1.5MB
Sample240528-fxndbagg96
SHA256 d3dc9e9b545b3af1a3b7ab7fca841569272a70092d8e488239816e51c586c23e
MD5 3404d91aa76f9955bd90284074b5b9a0
SHA1 d1d0dfcba61379189859da057e11499ea48de51d
SHA512 bfbb213cba9472197e031f3dec580a3f5f4c08f4234e917a1437d651ff023c95b7c3bdd04dc2536ea33f2e7eb8c037f19373dd3a876a6fd30940f8d63d89cfee
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fr:Lz071uv4BPMkiqtI+ijRzY8Gwr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/4944-325-0x00007FF606690000-0x00007FF606A82000-memory.dmp	xmrig
behavioral2/memory/2140-399-0x00007FF624080000-0x00007FF624472000-memory.dmp	xmrig
behavioral2/memory/3624-501-0x00007FF679630000-0x00007FF679A22000-memory.dmp	xmrig
behavioral2/memory/3492-500-0x00007FF60F8F0000-0x00007FF60FCE2000-memory.dmp	xmrig
behavioral2/memory/1764-499-0x00007FF6219B0000-0x00007FF621DA2000-memory.dmp	xmrig
behavioral2/memory/4504-497-0x00007FF760D50000-0x00007FF761142000-memory.dmp	xmrig
behavioral2/memory/3160-496-0x00007FF698490000-0x00007FF698882000-memory.dmp	xmrig
behavioral2/memory/2984-495-0x00007FF64F7D0000-0x00007FF64FBC2000-memory.dmp	xmrig
behavioral2/memory/1896-494-0x00007FF775560000-0x00007FF775952000-memory.dmp	xmrig
behavioral2/memory/4916-493-0x00007FF77E710000-0x00007FF77EB02000-memory.dmp	xmrig
behavioral2/memory/2232-492-0x00007FF7AEBA0000-0x00007FF7AEF92000-memory.dmp	xmrig
behavioral2/memory/2268-491-0x00007FF6E5920000-0x00007FF6E5D12000-memory.dmp	xmrig
behavioral2/memory/1360-490-0x00007FF6A8B00000-0x00007FF6A8EF2000-memory.dmp	xmrig
behavioral2/memory/2592-489-0x00007FF636C90000-0x00007FF637082000-memory.dmp	xmrig
behavioral2/memory/5064-487-0x00007FF7B0A40000-0x00007FF7B0E32000-memory.dmp	xmrig
behavioral2/memory/3340-324-0x00007FF7D3420000-0x00007FF7D3812000-memory.dmp	xmrig
behavioral2/memory/1736-286-0x00007FF6CA210000-0x00007FF6CA602000-memory.dmp	xmrig
behavioral2/memory/1232-285-0x00007FF781180000-0x00007FF781572000-memory.dmp	xmrig
behavioral2/memory/1528-238-0x00007FF74F770000-0x00007FF74FB62000-memory.dmp	xmrig
behavioral2/memory/3640-179-0x00007FF74F0B0000-0x00007FF74F4A2000-memory.dmp	xmrig
behavioral2/memory/3032-118-0x00007FF63E250000-0x00007FF63E642000-memory.dmp	xmrig
behavioral2/memory/1044-3611-0x00007FF720AD0000-0x00007FF720EC2000-memory.dmp	xmrig
behavioral2/memory/3032-3619-0x00007FF63E250000-0x00007FF63E642000-memory.dmp	xmrig
behavioral2/memory/1948-3618-0x00007FF7D55A0000-0x00007FF7D5992000-memory.dmp	xmrig
behavioral2/memory/3492-3625-0x00007FF60F8F0000-0x00007FF60FCE2000-memory.dmp	xmrig
behavioral2/memory/1528-3628-0x00007FF74F770000-0x00007FF74FB62000-memory.dmp	xmrig
behavioral2/memory/1736-3629-0x00007FF6CA210000-0x00007FF6CA602000-memory.dmp	xmrig
behavioral2/memory/1764-3623-0x00007FF6219B0000-0x00007FF621DA2000-memory.dmp	xmrig
behavioral2/memory/3640-3622-0x00007FF74F0B0000-0x00007FF74F4A2000-memory.dmp	xmrig
behavioral2/memory/2268-3642-0x00007FF6E5920000-0x00007FF6E5D12000-memory.dmp	xmrig
behavioral2/memory/1360-3653-0x00007FF6A8B00000-0x00007FF6A8EF2000-memory.dmp	xmrig
behavioral2/memory/1896-3655-0x00007FF775560000-0x00007FF775952000-memory.dmp	xmrig
behavioral2/memory/3160-3657-0x00007FF698490000-0x00007FF698882000-memory.dmp	xmrig
behavioral2/memory/3340-3651-0x00007FF7D3420000-0x00007FF7D3812000-memory.dmp	xmrig
behavioral2/memory/3624-3647-0x00007FF679630000-0x00007FF679A22000-memory.dmp	xmrig
behavioral2/memory/1232-3645-0x00007FF781180000-0x00007FF781572000-memory.dmp	xmrig
behavioral2/memory/5064-3636-0x00007FF7B0A40000-0x00007FF7B0E32000-memory.dmp	xmrig
behavioral2/memory/3912-3632-0x00007FF70B650000-0x00007FF70BA42000-memory.dmp	xmrig
behavioral2/memory/2232-3641-0x00007FF7AEBA0000-0x00007FF7AEF92000-memory.dmp	xmrig
behavioral2/memory/2140-3638-0x00007FF624080000-0x00007FF624472000-memory.dmp	xmrig
behavioral2/memory/4944-3633-0x00007FF606690000-0x00007FF606A82000-memory.dmp	xmrig
behavioral2/memory/4916-3663-0x00007FF77E710000-0x00007FF77EB02000-memory.dmp	xmrig
behavioral2/memory/2592-3669-0x00007FF636C90000-0x00007FF637082000-memory.dmp	xmrig
behavioral2/memory/4504-3661-0x00007FF760D50000-0x00007FF761142000-memory.dmp	xmrig
behavioral2/memory/2984-3673-0x00007FF64F7D0000-0x00007FF64FBC2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4620	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1044	qMZRqyg.exe
1948	XZCfEzq.exe
3912	VNiWagu.exe
1764	dlPUSJK.exe
3032	llUTtoC.exe
3640	NRSldyp.exe
1528	AqKXXFy.exe
1232	liCZTXa.exe
1736	NvZQFYa.exe
3340	MIvWcQv.exe
4944	gCAfaQP.exe
3492	VmqPouk.exe
2140	SomRTUl.exe
5064	mxoWTos.exe
2592	EBBoMFQ.exe
1360	QqAhexe.exe
2268	FSiNZMI.exe
2232	nJiFxqm.exe
4916	gXrytCx.exe
3624	geYdsBO.exe
1896	WUUvLnj.exe
2984	ZyAKVUL.exe
3160	MjknQdj.exe
4504	yCgRCRR.exe
4484	qvkCLox.exe
2844	WZKcpYs.exe
4104	rBVDgqu.exe
3204	PTaNjmo.exe
1572	rDCVXQq.exe
2628	XyFATIH.exe
2816	QXQlRBp.exe
1280	ZraOReu.exe
4724	jfxpIaA.exe
1704	YBcRWSN.exe
4604	csLQwKg.exe
3668	qzMErbP.exe
2752	afWYgQa.exe
1556	kuqQqrQ.exe
4188	pazQQov.exe
3904	IweKPsr.exe
2152	TjPbWeF.exe
5060	YtpVNGj.exe
1372	AGjCvEt.exe
3484	wayKvWD.exe
4616	BZtjHVW.exe
3704	mbxieMJ.exe
3628	qLJjhqE.exe
4024	RfBBtlV.exe
940	KtVbeah.exe
2360	khMsFqL.exe
2412	VgWxuXa.exe
4668	IblqKOf.exe
3332	lUEAZJn.exe
3248	aNpEwXC.exe
2212	VTmHwsU.exe
5072	piCCSIa.exe
352	wzZGUpv.exe
648	bxWNguI.exe
2108	DAzKmdG.exe
3164	XBAxZbw.exe
4388	MqcfAmq.exe
868	NOnvLXp.exe
4040	JcVWpPr.exe
4336	drbFknH.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2400-0-0x00007FF671D20000-0x00007FF672112000-memory.dmp	upx
behavioral2/files/0x000900000002348b-5.dat	upx
behavioral2/files/0x000700000002349a-6.dat	upx
behavioral2/files/0x000700000002349b-16.dat	upx
behavioral2/files/0x000700000002349e-29.dat	upx
behavioral2/files/0x00070000000234a7-72.dat	upx
behavioral2/files/0x00070000000234ae-107.dat	upx
behavioral2/files/0x00070000000234be-202.dat	upx
behavioral2/memory/4944-325-0x00007FF606690000-0x00007FF606A82000-memory.dmp	upx
behavioral2/memory/2140-399-0x00007FF624080000-0x00007FF624472000-memory.dmp	upx
behavioral2/memory/3624-501-0x00007FF679630000-0x00007FF679A22000-memory.dmp	upx
behavioral2/memory/3492-500-0x00007FF60F8F0000-0x00007FF60FCE2000-memory.dmp	upx
behavioral2/memory/1764-499-0x00007FF6219B0000-0x00007FF621DA2000-memory.dmp	upx
behavioral2/memory/4504-497-0x00007FF760D50000-0x00007FF761142000-memory.dmp	upx
behavioral2/memory/3160-496-0x00007FF698490000-0x00007FF698882000-memory.dmp	upx
behavioral2/memory/2984-495-0x00007FF64F7D0000-0x00007FF64FBC2000-memory.dmp	upx
behavioral2/memory/1896-494-0x00007FF775560000-0x00007FF775952000-memory.dmp	upx
behavioral2/memory/4916-493-0x00007FF77E710000-0x00007FF77EB02000-memory.dmp	upx
behavioral2/memory/2232-492-0x00007FF7AEBA0000-0x00007FF7AEF92000-memory.dmp	upx
behavioral2/memory/2268-491-0x00007FF6E5920000-0x00007FF6E5D12000-memory.dmp	upx
behavioral2/memory/1360-490-0x00007FF6A8B00000-0x00007FF6A8EF2000-memory.dmp	upx
behavioral2/memory/2592-489-0x00007FF636C90000-0x00007FF637082000-memory.dmp	upx
behavioral2/memory/5064-487-0x00007FF7B0A40000-0x00007FF7B0E32000-memory.dmp	upx
behavioral2/memory/3340-324-0x00007FF7D3420000-0x00007FF7D3812000-memory.dmp	upx
behavioral2/memory/1736-286-0x00007FF6CA210000-0x00007FF6CA602000-memory.dmp	upx
behavioral2/memory/1232-285-0x00007FF781180000-0x00007FF781572000-memory.dmp	upx
behavioral2/memory/1528-238-0x00007FF74F770000-0x00007FF74FB62000-memory.dmp	upx
behavioral2/files/0x00070000000234bf-208.dat	upx
behavioral2/files/0x00070000000234bd-194.dat	upx
behavioral2/files/0x00070000000234b5-189.dat	upx
behavioral2/files/0x00070000000234bc-188.dat	upx
behavioral2/files/0x0009000000023493-186.dat	upx
behavioral2/files/0x00070000000234b3-185.dat	upx
behavioral2/memory/3640-179-0x00007FF74F0B0000-0x00007FF74F4A2000-memory.dmp	upx
behavioral2/files/0x00070000000234ba-178.dat	upx
behavioral2/files/0x00070000000234aa-168.dat	upx
behavioral2/files/0x00070000000234a9-160.dat	upx
behavioral2/files/0x00070000000234a3-157.dat	upx
behavioral2/files/0x00070000000234a8-155.dat	upx
behavioral2/files/0x00070000000234b9-154.dat	upx
behavioral2/files/0x00070000000234b6-143.dat	upx
behavioral2/files/0x00070000000234b7-140.dat	upx
behavioral2/files/0x00070000000234ad-139.dat	upx
behavioral2/files/0x00070000000234a6-130.dat	upx
behavioral2/files/0x00070000000234a0-124.dat	upx
behavioral2/files/0x00070000000234b4-123.dat	upx
behavioral2/memory/3032-118-0x00007FF63E250000-0x00007FF63E642000-memory.dmp	upx
behavioral2/files/0x00070000000234b2-116.dat	upx
behavioral2/files/0x00070000000234b1-115.dat	upx
behavioral2/files/0x00070000000234b0-114.dat	upx
behavioral2/files/0x00070000000234ab-172.dat	upx
behavioral2/files/0x00070000000234af-111.dat	upx
behavioral2/files/0x00070000000234b8-150.dat	upx
behavioral2/files/0x00070000000234ac-99.dat	upx
behavioral2/files/0x00070000000234a5-88.dat	upx
behavioral2/memory/3912-85-0x00007FF70B650000-0x00007FF70BA42000-memory.dmp	upx
behavioral2/files/0x00070000000234a4-112.dat	upx
behavioral2/files/0x00070000000234a2-76.dat	upx
behavioral2/files/0x000700000002349d-68.dat	upx
behavioral2/files/0x00070000000234a1-66.dat	upx
behavioral2/files/0x00070000000234ac-98.dat	upx
behavioral2/files/0x000700000002349f-91.dat	upx
behavioral2/memory/1948-59-0x00007FF7D55A0000-0x00007FF7D5992000-memory.dmp	upx
behavioral2/files/0x000700000002349c-38.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EfRLzUO.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\wJWGWJW.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\LOImclp.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\KvBSzyQ.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\IblqKOf.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\JIKxLdG.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\lrmsZwk.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\tStToSM.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\YwEVkHT.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\nmglsAF.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\dHcozsc.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\WEEQaTi.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZepJNDF.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\FbfDNzk.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\xDyWGqO.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\epKgopB.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ieCxCzc.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ewFOpBl.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\GLSSdab.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\nZuZCnV.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\HUINzmp.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZzGfxuO.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\nzaQAQj.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\wayKvWD.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\KDwukcU.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\IhESkHv.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\yMBITzJ.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\hYOhDuU.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\bUgYTcw.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\XOmcGpV.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\JRxOTPx.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\actPcsv.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\fTmxgWf.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZQEkliI.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\dJkWIlk.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\sxGOWvT.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\LjUipxK.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\LxAcAtl.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ZeOHHUl.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\VFWqbeA.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\qkgJlMo.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\lppSKHe.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ehltZbD.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\JeKVFkI.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\WuvTkHX.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ImsuhGY.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\peFLLLz.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\TPMgpvY.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\MjknQdj.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\BfyerGw.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\acbuPsh.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\dhocvFG.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\avKNYIK.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ckDvXiO.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\EQFpPzr.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\jzoqgBM.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\VsUSGBw.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\RmXMNBY.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\SZXyYEO.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\xnZUvfk.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\SDZWDIA.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\VKozUuG.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\kQCjmUq.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ofMjSlN.exe	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4620	powershell.exe
4620	powershell.exe
4620	powershell.exe
4620	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeLockMemoryPrivilege	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4620	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	84
PID 2400 wrote to memory of 4620	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	84
PID 2400 wrote to memory of 1044	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	85
PID 2400 wrote to memory of 1044	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	85
PID 2400 wrote to memory of 1948	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	86
PID 2400 wrote to memory of 1948	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	86
PID 2400 wrote to memory of 3912	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	87
PID 2400 wrote to memory of 3912	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	87
PID 2400 wrote to memory of 3640	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	88
PID 2400 wrote to memory of 3640	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	88
PID 2400 wrote to memory of 1764	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	89
PID 2400 wrote to memory of 1764	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	89
PID 2400 wrote to memory of 3032	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	90
PID 2400 wrote to memory of 3032	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	90
PID 2400 wrote to memory of 1528	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	91
PID 2400 wrote to memory of 1528	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	91
PID 2400 wrote to memory of 1232	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	92
PID 2400 wrote to memory of 1232	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	92
PID 2400 wrote to memory of 1736	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	93
PID 2400 wrote to memory of 1736	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	93
PID 2400 wrote to memory of 2592	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	94
PID 2400 wrote to memory of 2592	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	94
PID 2400 wrote to memory of 3340	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	95
PID 2400 wrote to memory of 3340	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	95
PID 2400 wrote to memory of 4944	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	96
PID 2400 wrote to memory of 4944	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	96
PID 2400 wrote to memory of 3492	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	97
PID 2400 wrote to memory of 3492	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	97
PID 2400 wrote to memory of 2140	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	98
PID 2400 wrote to memory of 2140	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	98
PID 2400 wrote to memory of 5064	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	99
PID 2400 wrote to memory of 5064	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	99
PID 2400 wrote to memory of 1360	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	100
PID 2400 wrote to memory of 1360	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	100
PID 2400 wrote to memory of 2268	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	101
PID 2400 wrote to memory of 2268	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	101
PID 2400 wrote to memory of 2232	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	102
PID 2400 wrote to memory of 2232	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	102
PID 2400 wrote to memory of 4916	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	103
PID 2400 wrote to memory of 4916	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	103
PID 2400 wrote to memory of 3624	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	104
PID 2400 wrote to memory of 3624	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	104
PID 2400 wrote to memory of 2628	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	105
PID 2400 wrote to memory of 2628	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	105
PID 2400 wrote to memory of 1896	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	106
PID 2400 wrote to memory of 1896	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	106
PID 2400 wrote to memory of 2984	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	107
PID 2400 wrote to memory of 2984	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	107
PID 2400 wrote to memory of 3160	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	108
PID 2400 wrote to memory of 3160	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	108
PID 2400 wrote to memory of 4504	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	109
PID 2400 wrote to memory of 4504	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	109
PID 2400 wrote to memory of 4484	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	110
PID 2400 wrote to memory of 4484	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	110
PID 2400 wrote to memory of 2844	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	111
PID 2400 wrote to memory of 2844	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	111
PID 2400 wrote to memory of 4104	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	112
PID 2400 wrote to memory of 4104	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	112
PID 2400 wrote to memory of 4604	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	113
PID 2400 wrote to memory of 4604	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	113
PID 2400 wrote to memory of 3204	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	114
PID 2400 wrote to memory of 3204	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	114
PID 2400 wrote to memory of 1572	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	115
PID 2400 wrote to memory of 1572	2400	3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3404d91aa76f9955bd90284074b5b9a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- C:\Windows\System\qMZRqyg.exe
  C:\Windows\System\qMZRqyg.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\XZCfEzq.exe
  C:\Windows\System\XZCfEzq.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\VNiWagu.exe
  C:\Windows\System\VNiWagu.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\NRSldyp.exe
  C:\Windows\System\NRSldyp.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\dlPUSJK.exe
  C:\Windows\System\dlPUSJK.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\llUTtoC.exe
  C:\Windows\System\llUTtoC.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\AqKXXFy.exe
  C:\Windows\System\AqKXXFy.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\liCZTXa.exe
  C:\Windows\System\liCZTXa.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\NvZQFYa.exe
  C:\Windows\System\NvZQFYa.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\EBBoMFQ.exe
  C:\Windows\System\EBBoMFQ.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\MIvWcQv.exe
  C:\Windows\System\MIvWcQv.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\gCAfaQP.exe
  C:\Windows\System\gCAfaQP.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\VmqPouk.exe
  C:\Windows\System\VmqPouk.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\SomRTUl.exe
  C:\Windows\System\SomRTUl.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\mxoWTos.exe
  C:\Windows\System\mxoWTos.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\QqAhexe.exe
  C:\Windows\System\QqAhexe.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\FSiNZMI.exe
  C:\Windows\System\FSiNZMI.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\nJiFxqm.exe
  C:\Windows\System\nJiFxqm.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\gXrytCx.exe
  C:\Windows\System\gXrytCx.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\geYdsBO.exe
  C:\Windows\System\geYdsBO.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\XyFATIH.exe
  C:\Windows\System\XyFATIH.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\WUUvLnj.exe
  C:\Windows\System\WUUvLnj.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\ZyAKVUL.exe
  C:\Windows\System\ZyAKVUL.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\MjknQdj.exe
  C:\Windows\System\MjknQdj.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\yCgRCRR.exe
  C:\Windows\System\yCgRCRR.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\qvkCLox.exe
  C:\Windows\System\qvkCLox.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\WZKcpYs.exe
  C:\Windows\System\WZKcpYs.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\rBVDgqu.exe
  C:\Windows\System\rBVDgqu.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\csLQwKg.exe
  C:\Windows\System\csLQwKg.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\PTaNjmo.exe
  C:\Windows\System\PTaNjmo.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\rDCVXQq.exe
  C:\Windows\System\rDCVXQq.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\QXQlRBp.exe
  C:\Windows\System\QXQlRBp.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\ZraOReu.exe
  C:\Windows\System\ZraOReu.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\jfxpIaA.exe
  C:\Windows\System\jfxpIaA.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\RfBBtlV.exe
  C:\Windows\System\RfBBtlV.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\YBcRWSN.exe
  C:\Windows\System\YBcRWSN.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\qzMErbP.exe
  C:\Windows\System\qzMErbP.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\afWYgQa.exe
  C:\Windows\System\afWYgQa.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\kuqQqrQ.exe
  C:\Windows\System\kuqQqrQ.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\pazQQov.exe
  C:\Windows\System\pazQQov.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\IweKPsr.exe
  C:\Windows\System\IweKPsr.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\TjPbWeF.exe
  C:\Windows\System\TjPbWeF.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\DAzKmdG.exe
  C:\Windows\System\DAzKmdG.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\YtpVNGj.exe
  C:\Windows\System\YtpVNGj.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\AGjCvEt.exe
  C:\Windows\System\AGjCvEt.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\wayKvWD.exe
  C:\Windows\System\wayKvWD.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\BZtjHVW.exe
  C:\Windows\System\BZtjHVW.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\NOnvLXp.exe
  C:\Windows\System\NOnvLXp.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\mbxieMJ.exe
  C:\Windows\System\mbxieMJ.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\QngEprl.exe
  C:\Windows\System\QngEprl.exe
  2⤵
  PID:3984
- C:\Windows\System\qLJjhqE.exe
  C:\Windows\System\qLJjhqE.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\KtVbeah.exe
  C:\Windows\System\KtVbeah.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\khMsFqL.exe
  C:\Windows\System\khMsFqL.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\VgWxuXa.exe
  C:\Windows\System\VgWxuXa.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\IblqKOf.exe
  C:\Windows\System\IblqKOf.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\lUEAZJn.exe
  C:\Windows\System\lUEAZJn.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\aNpEwXC.exe
  C:\Windows\System\aNpEwXC.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\VTmHwsU.exe
  C:\Windows\System\VTmHwsU.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\piCCSIa.exe
  C:\Windows\System\piCCSIa.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\wzZGUpv.exe
  C:\Windows\System\wzZGUpv.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\bxWNguI.exe
  C:\Windows\System\bxWNguI.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\XBAxZbw.exe
  C:\Windows\System\XBAxZbw.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\MqcfAmq.exe
  C:\Windows\System\MqcfAmq.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\JcVWpPr.exe
  C:\Windows\System\JcVWpPr.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\drbFknH.exe
  C:\Windows\System\drbFknH.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\HuvLJAf.exe
  C:\Windows\System\HuvLJAf.exe
  2⤵
  PID:3168
- C:\Windows\System\sfxHCcH.exe
  C:\Windows\System\sfxHCcH.exe
  2⤵
  PID:4284
- C:\Windows\System\LuuUSPe.exe
  C:\Windows\System\LuuUSPe.exe
  2⤵
  PID:3664
- C:\Windows\System\FSusaCA.exe
  C:\Windows\System\FSusaCA.exe
  2⤵
  PID:4552
- C:\Windows\System\BPyQtSk.exe
  C:\Windows\System\BPyQtSk.exe
  2⤵
  PID:2280
- C:\Windows\System\YfTjkjC.exe
  C:\Windows\System\YfTjkjC.exe
  2⤵
  PID:1628
- C:\Windows\System\OTcpNjl.exe
  C:\Windows\System\OTcpNjl.exe
  2⤵
  PID:2052
- C:\Windows\System\irsseAG.exe
  C:\Windows\System\irsseAG.exe
  2⤵
  PID:672
- C:\Windows\System\nEXQLzc.exe
  C:\Windows\System\nEXQLzc.exe
  2⤵
  PID:2116
- C:\Windows\System\QJrBcLR.exe
  C:\Windows\System\QJrBcLR.exe
  2⤵
  PID:3524
- C:\Windows\System\NtPIHsQ.exe
  C:\Windows\System\NtPIHsQ.exe
  2⤵
  PID:636
- C:\Windows\System\ZFphMEz.exe
  C:\Windows\System\ZFphMEz.exe
  2⤵
  PID:4860
- C:\Windows\System\zVSOIjP.exe
  C:\Windows\System\zVSOIjP.exe
  2⤵
  PID:3908
- C:\Windows\System\zNfFgmb.exe
  C:\Windows\System\zNfFgmb.exe
  2⤵
  PID:1116
- C:\Windows\System\KZoeWlw.exe
  C:\Windows\System\KZoeWlw.exe
  2⤵
  PID:3456
- C:\Windows\System\VkpUIpp.exe
  C:\Windows\System\VkpUIpp.exe
  2⤵
  PID:848
- C:\Windows\System\vBRUhap.exe
  C:\Windows\System\vBRUhap.exe
  2⤵
  PID:2408
- C:\Windows\System\ZyWNdMd.exe
  C:\Windows\System\ZyWNdMd.exe
  2⤵
  PID:5136
- C:\Windows\System\Xoymavs.exe
  C:\Windows\System\Xoymavs.exe
  2⤵
  PID:5164
- C:\Windows\System\eQagdkQ.exe
  C:\Windows\System\eQagdkQ.exe
  2⤵
  PID:5180
- C:\Windows\System\DRGEjcg.exe
  C:\Windows\System\DRGEjcg.exe
  2⤵
  PID:5200
- C:\Windows\System\dLKeQGa.exe
  C:\Windows\System\dLKeQGa.exe
  2⤵
  PID:5216
- C:\Windows\System\OPdIIRb.exe
  C:\Windows\System\OPdIIRb.exe
  2⤵
  PID:5264
- C:\Windows\System\CxrhIJU.exe
  C:\Windows\System\CxrhIJU.exe
  2⤵
  PID:5292
- C:\Windows\System\lnpfJVD.exe
  C:\Windows\System\lnpfJVD.exe
  2⤵
  PID:5324
- C:\Windows\System\smlwNDI.exe
  C:\Windows\System\smlwNDI.exe
  2⤵
  PID:5388
- C:\Windows\System\bMBVzDX.exe
  C:\Windows\System\bMBVzDX.exe
  2⤵
  PID:5440
- C:\Windows\System\oyAWnfD.exe
  C:\Windows\System\oyAWnfD.exe
  2⤵
  PID:5460
- C:\Windows\System\LobPGJl.exe
  C:\Windows\System\LobPGJl.exe
  2⤵
  PID:5480
- C:\Windows\System\WRlANlP.exe
  C:\Windows\System\WRlANlP.exe
  2⤵
  PID:5496
- C:\Windows\System\AfuuLUv.exe
  C:\Windows\System\AfuuLUv.exe
  2⤵
  PID:5516
- C:\Windows\System\NhbfbIQ.exe
  C:\Windows\System\NhbfbIQ.exe
  2⤵
  PID:5556
- C:\Windows\System\mUtvFMq.exe
  C:\Windows\System\mUtvFMq.exe
  2⤵
  PID:5580
- C:\Windows\System\TRfMUmt.exe
  C:\Windows\System\TRfMUmt.exe
  2⤵
  PID:5600
- C:\Windows\System\IVeBRHp.exe
  C:\Windows\System\IVeBRHp.exe
  2⤵
  PID:5620
- C:\Windows\System\qaJdqTb.exe
  C:\Windows\System\qaJdqTb.exe
  2⤵
  PID:5700
- C:\Windows\System\khtLiSf.exe
  C:\Windows\System\khtLiSf.exe
  2⤵
  PID:5724
- C:\Windows\System\ccDMJHR.exe
  C:\Windows\System\ccDMJHR.exe
  2⤵
  PID:5756
- C:\Windows\System\BLsQleF.exe
  C:\Windows\System\BLsQleF.exe
  2⤵
  PID:5772
- C:\Windows\System\dhpWEnY.exe
  C:\Windows\System\dhpWEnY.exe
  2⤵
  PID:5792
- C:\Windows\System\uhWVDPX.exe
  C:\Windows\System\uhWVDPX.exe
  2⤵
  PID:5812
- C:\Windows\System\UcYSkuv.exe
  C:\Windows\System\UcYSkuv.exe
  2⤵
  PID:5832
- C:\Windows\System\FxEJPcG.exe
  C:\Windows\System\FxEJPcG.exe
  2⤵
  PID:5852
- C:\Windows\System\CuRGDXI.exe
  C:\Windows\System\CuRGDXI.exe
  2⤵
  PID:5868
- C:\Windows\System\Bomftbe.exe
  C:\Windows\System\Bomftbe.exe
  2⤵
  PID:5892
- C:\Windows\System\TwivDHE.exe
  C:\Windows\System\TwivDHE.exe
  2⤵
  PID:5920
- C:\Windows\System\qzoVtLR.exe
  C:\Windows\System\qzoVtLR.exe
  2⤵
  PID:5936
- C:\Windows\System\MNGfcut.exe
  C:\Windows\System\MNGfcut.exe
  2⤵
  PID:5956
- C:\Windows\System\PTWWtdr.exe
  C:\Windows\System\PTWWtdr.exe
  2⤵
  PID:5972
- C:\Windows\System\VWAhdho.exe
  C:\Windows\System\VWAhdho.exe
  2⤵
  PID:5996
- C:\Windows\System\KnJhowC.exe
  C:\Windows\System\KnJhowC.exe
  2⤵
  PID:6016
- C:\Windows\System\kGustBz.exe
  C:\Windows\System\kGustBz.exe
  2⤵
  PID:6044
- C:\Windows\System\wsGkJFl.exe
  C:\Windows\System\wsGkJFl.exe
  2⤵
  PID:6064
- C:\Windows\System\nyvqReE.exe
  C:\Windows\System\nyvqReE.exe
  2⤵
  PID:6092
- C:\Windows\System\CYzARfa.exe
  C:\Windows\System\CYzARfa.exe
  2⤵
  PID:6112
- C:\Windows\System\aBktDZf.exe
  C:\Windows\System\aBktDZf.exe
  2⤵
  PID:6128
- C:\Windows\System\hItCkhE.exe
  C:\Windows\System\hItCkhE.exe
  2⤵
  PID:4156
- C:\Windows\System\vyjnDuw.exe
  C:\Windows\System\vyjnDuw.exe
  2⤵
  PID:2144
- C:\Windows\System\fbJzDoB.exe
  C:\Windows\System\fbJzDoB.exe
  2⤵
  PID:1860
- C:\Windows\System\yIuxCNw.exe
  C:\Windows\System\yIuxCNw.exe
  2⤵
  PID:3472
- C:\Windows\System\HzRzoND.exe
  C:\Windows\System\HzRzoND.exe
  2⤵
  PID:3060
- C:\Windows\System\xzsPNLO.exe
  C:\Windows\System\xzsPNLO.exe
  2⤵
  PID:4572
- C:\Windows\System\irYPdOj.exe
  C:\Windows\System\irYPdOj.exe
  2⤵
  PID:892
- C:\Windows\System\yJOnwmc.exe
  C:\Windows\System\yJOnwmc.exe
  2⤵
  PID:2520
- C:\Windows\System\MMRzSrZ.exe
  C:\Windows\System\MMRzSrZ.exe
  2⤵
  PID:4516
- C:\Windows\System\wpvhUfk.exe
  C:\Windows\System\wpvhUfk.exe
  2⤵
  PID:4608
- C:\Windows\System\ZmZSzZm.exe
  C:\Windows\System\ZmZSzZm.exe
  2⤵
  PID:3364
- C:\Windows\System\FPcROOS.exe
  C:\Windows\System\FPcROOS.exe
  2⤵
  PID:628
- C:\Windows\System\oEvtSko.exe
  C:\Windows\System\oEvtSko.exe
  2⤵
  PID:312
- C:\Windows\System\UrManJg.exe
  C:\Windows\System\UrManJg.exe
  2⤵
  PID:5152
- C:\Windows\System\ZQEkliI.exe
  C:\Windows\System\ZQEkliI.exe
  2⤵
  PID:4312
- C:\Windows\System\exyYsBt.exe
  C:\Windows\System\exyYsBt.exe
  2⤵
  PID:3632
- C:\Windows\System\OczGhSk.exe
  C:\Windows\System\OczGhSk.exe
  2⤵
  PID:1120
- C:\Windows\System\abNlUbn.exe
  C:\Windows\System\abNlUbn.exe
  2⤵
  PID:3792
- C:\Windows\System\tqaQOWQ.exe
  C:\Windows\System\tqaQOWQ.exe
  2⤵
  PID:2976
- C:\Windows\System\epKgopB.exe
  C:\Windows\System\epKgopB.exe
  2⤵
  PID:5344
- C:\Windows\System\MhWnyLP.exe
  C:\Windows\System\MhWnyLP.exe
  2⤵
  PID:6164
- C:\Windows\System\XeOXfVk.exe
  C:\Windows\System\XeOXfVk.exe
  2⤵
  PID:6180
- C:\Windows\System\cgCFWAr.exe
  C:\Windows\System\cgCFWAr.exe
  2⤵
  PID:6200
- C:\Windows\System\JdLbRnd.exe
  C:\Windows\System\JdLbRnd.exe
  2⤵
  PID:6220
- C:\Windows\System\tZvSlhE.exe
  C:\Windows\System\tZvSlhE.exe
  2⤵
  PID:6240
- C:\Windows\System\bWZCVQp.exe
  C:\Windows\System\bWZCVQp.exe
  2⤵
  PID:6256
- C:\Windows\System\QVoOmeg.exe
  C:\Windows\System\QVoOmeg.exe
  2⤵
  PID:6272
- C:\Windows\System\CDVBXCa.exe
  C:\Windows\System\CDVBXCa.exe
  2⤵
  PID:6292
- C:\Windows\System\QcjBImu.exe
  C:\Windows\System\QcjBImu.exe
  2⤵
  PID:6312
- C:\Windows\System\jzoqgBM.exe
  C:\Windows\System\jzoqgBM.exe
  2⤵
  PID:6332
- C:\Windows\System\JvfXAXO.exe
  C:\Windows\System\JvfXAXO.exe
  2⤵
  PID:6356
- C:\Windows\System\lubCnWq.exe
  C:\Windows\System\lubCnWq.exe
  2⤵
  PID:6372
- C:\Windows\System\ivRvnid.exe
  C:\Windows\System\ivRvnid.exe
  2⤵
  PID:6396
- C:\Windows\System\DlLqkId.exe
  C:\Windows\System\DlLqkId.exe
  2⤵
  PID:6412
- C:\Windows\System\dduKXIm.exe
  C:\Windows\System\dduKXIm.exe
  2⤵
  PID:6436
- C:\Windows\System\ZJUuRcX.exe
  C:\Windows\System\ZJUuRcX.exe
  2⤵
  PID:6452
- C:\Windows\System\OzRolhZ.exe
  C:\Windows\System\OzRolhZ.exe
  2⤵
  PID:6476
- C:\Windows\System\wiXZsja.exe
  C:\Windows\System\wiXZsja.exe
  2⤵
  PID:6492
- C:\Windows\System\CYqckRy.exe
  C:\Windows\System\CYqckRy.exe
  2⤵
  PID:6520
- C:\Windows\System\QfXnRmV.exe
  C:\Windows\System\QfXnRmV.exe
  2⤵
  PID:6536
- C:\Windows\System\mGrnttM.exe
  C:\Windows\System\mGrnttM.exe
  2⤵
  PID:6560
- C:\Windows\System\tcoFKya.exe
  C:\Windows\System\tcoFKya.exe
  2⤵
  PID:6748
- C:\Windows\System\vsYxcRY.exe
  C:\Windows\System\vsYxcRY.exe
  2⤵
  PID:6764
- C:\Windows\System\HBvwTiP.exe
  C:\Windows\System\HBvwTiP.exe
  2⤵
  PID:6780
- C:\Windows\System\UFxFSNC.exe
  C:\Windows\System\UFxFSNC.exe
  2⤵
  PID:6796
- C:\Windows\System\fNUTwog.exe
  C:\Windows\System\fNUTwog.exe
  2⤵
  PID:6812
- C:\Windows\System\uhzNiuw.exe
  C:\Windows\System\uhzNiuw.exe
  2⤵
  PID:6828
- C:\Windows\System\tcbBTGn.exe
  C:\Windows\System\tcbBTGn.exe
  2⤵
  PID:6844
- C:\Windows\System\OniXKqd.exe
  C:\Windows\System\OniXKqd.exe
  2⤵
  PID:6860
- C:\Windows\System\CInPAaj.exe
  C:\Windows\System\CInPAaj.exe
  2⤵
  PID:6876
- C:\Windows\System\cUrZzoH.exe
  C:\Windows\System\cUrZzoH.exe
  2⤵
  PID:6892
- C:\Windows\System\VahcGxP.exe
  C:\Windows\System\VahcGxP.exe
  2⤵
  PID:6908
- C:\Windows\System\ZRGXrpT.exe
  C:\Windows\System\ZRGXrpT.exe
  2⤵
  PID:6924
- C:\Windows\System\NtnLguo.exe
  C:\Windows\System\NtnLguo.exe
  2⤵
  PID:6940
- C:\Windows\System\hMrwOdm.exe
  C:\Windows\System\hMrwOdm.exe
  2⤵
  PID:6956
- C:\Windows\System\NROTbMs.exe
  C:\Windows\System\NROTbMs.exe
  2⤵
  PID:6972
- C:\Windows\System\AgTaANu.exe
  C:\Windows\System\AgTaANu.exe
  2⤵
  PID:6988
- C:\Windows\System\KiVUwTr.exe
  C:\Windows\System\KiVUwTr.exe
  2⤵
  PID:7004
- C:\Windows\System\tysbubB.exe
  C:\Windows\System\tysbubB.exe
  2⤵
  PID:7020
- C:\Windows\System\sIOKoGH.exe
  C:\Windows\System\sIOKoGH.exe
  2⤵
  PID:7036
- C:\Windows\System\LbGXNLX.exe
  C:\Windows\System\LbGXNLX.exe
  2⤵
  PID:7052
- C:\Windows\System\RGpeaXK.exe
  C:\Windows\System\RGpeaXK.exe
  2⤵
  PID:7068
- C:\Windows\System\rQspgim.exe
  C:\Windows\System\rQspgim.exe
  2⤵
  PID:7084
- C:\Windows\System\AYLhKhu.exe
  C:\Windows\System\AYLhKhu.exe
  2⤵
  PID:7100
- C:\Windows\System\iLVGfFl.exe
  C:\Windows\System\iLVGfFl.exe
  2⤵
  PID:7116
- C:\Windows\System\yneSEue.exe
  C:\Windows\System\yneSEue.exe
  2⤵
  PID:7156
- C:\Windows\System\tdeIIrK.exe
  C:\Windows\System\tdeIIrK.exe
  2⤵
  PID:4984
- C:\Windows\System\xzVUYfA.exe
  C:\Windows\System\xzVUYfA.exe
  2⤵
  PID:412
- C:\Windows\System\uUCcUng.exe
  C:\Windows\System\uUCcUng.exe
  2⤵
  PID:5332
- C:\Windows\System\oHxriNU.exe
  C:\Windows\System\oHxriNU.exe
  2⤵
  PID:5372
- C:\Windows\System\ojRiQDI.exe
  C:\Windows\System\ojRiQDI.exe
  2⤵
  PID:5860
- C:\Windows\System\XSYWOtb.exe
  C:\Windows\System\XSYWOtb.exe
  2⤵
  PID:5472
- C:\Windows\System\TqOmmJD.exe
  C:\Windows\System\TqOmmJD.exe
  2⤵
  PID:7240
- C:\Windows\System\uEbgWYg.exe
  C:\Windows\System\uEbgWYg.exe
  2⤵
  PID:7260
- C:\Windows\System\CstAVfH.exe
  C:\Windows\System\CstAVfH.exe
  2⤵
  PID:7280
- C:\Windows\System\LEUQdkk.exe
  C:\Windows\System\LEUQdkk.exe
  2⤵
  PID:7300
- C:\Windows\System\CrpNQzK.exe
  C:\Windows\System\CrpNQzK.exe
  2⤵
  PID:7320
- C:\Windows\System\ONatToc.exe
  C:\Windows\System\ONatToc.exe
  2⤵
  PID:7344
- C:\Windows\System\JShXlvr.exe
  C:\Windows\System\JShXlvr.exe
  2⤵
  PID:7364
- C:\Windows\System\xeUjrmZ.exe
  C:\Windows\System\xeUjrmZ.exe
  2⤵
  PID:7428
- C:\Windows\System\ilFtetg.exe
  C:\Windows\System\ilFtetg.exe
  2⤵
  PID:7452
- C:\Windows\System\QOiHenO.exe
  C:\Windows\System\QOiHenO.exe
  2⤵
  PID:7468
- C:\Windows\System\EPJwaYi.exe
  C:\Windows\System\EPJwaYi.exe
  2⤵
  PID:7696
- C:\Windows\System\UVGwSos.exe
  C:\Windows\System\UVGwSos.exe
  2⤵
  PID:7724
- C:\Windows\System\bYHvNHh.exe
  C:\Windows\System\bYHvNHh.exe
  2⤵
  PID:7744
- C:\Windows\System\WbBQDQX.exe
  C:\Windows\System\WbBQDQX.exe
  2⤵
  PID:7764
- C:\Windows\System\voDpgmO.exe
  C:\Windows\System\voDpgmO.exe
  2⤵
  PID:7816
- C:\Windows\System\nImxypb.exe
  C:\Windows\System\nImxypb.exe
  2⤵
  PID:7836
- C:\Windows\System\wTusjun.exe
  C:\Windows\System\wTusjun.exe
  2⤵
  PID:7852
- C:\Windows\System\LuZkHng.exe
  C:\Windows\System\LuZkHng.exe
  2⤵
  PID:7876
- C:\Windows\System\JIKxLdG.exe
  C:\Windows\System\JIKxLdG.exe
  2⤵
  PID:7900
- C:\Windows\System\rXyQvXk.exe
  C:\Windows\System\rXyQvXk.exe
  2⤵
  PID:7920
- C:\Windows\System\QOhFXwz.exe
  C:\Windows\System\QOhFXwz.exe
  2⤵
  PID:7940
- C:\Windows\System\wxuKBsD.exe
  C:\Windows\System\wxuKBsD.exe
  2⤵
  PID:7956
- C:\Windows\System\xwjDXwK.exe
  C:\Windows\System\xwjDXwK.exe
  2⤵
  PID:7980
- C:\Windows\System\XveacMG.exe
  C:\Windows\System\XveacMG.exe
  2⤵
  PID:8016
- C:\Windows\System\woyMsVn.exe
  C:\Windows\System\woyMsVn.exe
  2⤵
  PID:8032
- C:\Windows\System\uUDVGsB.exe
  C:\Windows\System\uUDVGsB.exe
  2⤵
  PID:8048
- C:\Windows\System\HFensqo.exe
  C:\Windows\System\HFensqo.exe
  2⤵
  PID:8064
- C:\Windows\System\TJqrqCO.exe
  C:\Windows\System\TJqrqCO.exe
  2⤵
  PID:8080
- C:\Windows\System\RFKFJmP.exe
  C:\Windows\System\RFKFJmP.exe
  2⤵
  PID:8100
- C:\Windows\System\dBKDItw.exe
  C:\Windows\System\dBKDItw.exe
  2⤵
  PID:8116
- C:\Windows\System\MCoXIuF.exe
  C:\Windows\System\MCoXIuF.exe
  2⤵
  PID:8132
- C:\Windows\System\GbkXVqb.exe
  C:\Windows\System\GbkXVqb.exe
  2⤵
  PID:8148
- C:\Windows\System\LMvQBQq.exe
  C:\Windows\System\LMvQBQq.exe
  2⤵
  PID:6996
- C:\Windows\System\RfbPIBH.exe
  C:\Windows\System\RfbPIBH.exe
  2⤵
  PID:6964
- C:\Windows\System\ieCxCzc.exe
  C:\Windows\System\ieCxCzc.exe
  2⤵
  PID:6932
- C:\Windows\System\ldAYrvz.exe
  C:\Windows\System\ldAYrvz.exe
  2⤵
  PID:7044
- C:\Windows\System\ELYkSso.exe
  C:\Windows\System\ELYkSso.exe
  2⤵
  PID:7076
- C:\Windows\System\tJJBoJp.exe
  C:\Windows\System\tJJBoJp.exe
  2⤵
  PID:7124
- C:\Windows\System\xfIsRdj.exe
  C:\Windows\System\xfIsRdj.exe
  2⤵
  PID:7140
- C:\Windows\System\XOmcGpV.exe
  C:\Windows\System\XOmcGpV.exe
  2⤵
  PID:5032
- C:\Windows\System\LeuUVof.exe
  C:\Windows\System\LeuUVof.exe
  2⤵
  PID:5240
- C:\Windows\System\dJkWIlk.exe
  C:\Windows\System\dJkWIlk.exe
  2⤵
  PID:5312
- C:\Windows\System\fmqBjYm.exe
  C:\Windows\System\fmqBjYm.exe
  2⤵
  PID:5360
- C:\Windows\System\ayQEAyF.exe
  C:\Windows\System\ayQEAyF.exe
  2⤵
  PID:6024
- C:\Windows\System\QdjzbAO.exe
  C:\Windows\System\QdjzbAO.exe
  2⤵
  PID:5764
- C:\Windows\System\CBQGfCe.exe
  C:\Windows\System\CBQGfCe.exe
  2⤵
  PID:6040
- C:\Windows\System\VSJiCiD.exe
  C:\Windows\System\VSJiCiD.exe
  2⤵
  PID:2300
- C:\Windows\System\ULjojWd.exe
  C:\Windows\System\ULjojWd.exe
  2⤵
  PID:5736
- C:\Windows\System\ZyNYekl.exe
  C:\Windows\System\ZyNYekl.exe
  2⤵
  PID:6460
- C:\Windows\System\UiUlCbL.exe
  C:\Windows\System\UiUlCbL.exe
  2⤵
  PID:5988
- C:\Windows\System\UJFUJrC.exe
  C:\Windows\System\UJFUJrC.exe
  2⤵
  PID:6120
- C:\Windows\System\RecNWDv.exe
  C:\Windows\System\RecNWDv.exe
  2⤵
  PID:1440
- C:\Windows\System\oQltuZP.exe
  C:\Windows\System\oQltuZP.exe
  2⤵
  PID:5416
- C:\Windows\System\euoCQwP.exe
  C:\Windows\System\euoCQwP.exe
  2⤵
  PID:4360
- C:\Windows\System\iuQMzJy.exe
  C:\Windows\System\iuQMzJy.exe
  2⤵
  PID:7756
- C:\Windows\System\iOTNXVS.exe
  C:\Windows\System\iOTNXVS.exe
  2⤵
  PID:7952
- C:\Windows\System\QyYQtXt.exe
  C:\Windows\System\QyYQtXt.exe
  2⤵
  PID:7976
- C:\Windows\System\TMiqsiB.exe
  C:\Windows\System\TMiqsiB.exe
  2⤵
  PID:6340
- C:\Windows\System\njqJFIA.exe
  C:\Windows\System\njqJFIA.exe
  2⤵
  PID:7248
- C:\Windows\System\mjqgxDn.exe
  C:\Windows\System\mjqgxDn.exe
  2⤵
  PID:7288
- C:\Windows\System\UzIpFOG.exe
  C:\Windows\System\UzIpFOG.exe
  2⤵
  PID:7316
- C:\Windows\System\DtqipER.exe
  C:\Windows\System\DtqipER.exe
  2⤵
  PID:7396
- C:\Windows\System\PLkPqCh.exe
  C:\Windows\System\PLkPqCh.exe
  2⤵
  PID:7444
- C:\Windows\System\qlzsIhU.exe
  C:\Windows\System\qlzsIhU.exe
  2⤵
  PID:7476
- C:\Windows\System\SpNilJp.exe
  C:\Windows\System\SpNilJp.exe
  2⤵
  PID:7780
- C:\Windows\System\osEKjct.exe
  C:\Windows\System\osEKjct.exe
  2⤵
  PID:5564
- C:\Windows\System\uuRRVBr.exe
  C:\Windows\System\uuRRVBr.exe
  2⤵
  PID:4404
- C:\Windows\System\OSxdelK.exe
  C:\Windows\System\OSxdelK.exe
  2⤵
  PID:1944
- C:\Windows\System\DFTtEHf.exe
  C:\Windows\System\DFTtEHf.exe
  2⤵
  PID:8200
- C:\Windows\System\gmLzYTu.exe
  C:\Windows\System\gmLzYTu.exe
  2⤵
  PID:8220
- C:\Windows\System\OIFlxLm.exe
  C:\Windows\System\OIFlxLm.exe
  2⤵
  PID:8256
- C:\Windows\System\HRHmfcz.exe
  C:\Windows\System\HRHmfcz.exe
  2⤵
  PID:8276
- C:\Windows\System\AmRKiOY.exe
  C:\Windows\System\AmRKiOY.exe
  2⤵
  PID:8296
- C:\Windows\System\shorcIN.exe
  C:\Windows\System\shorcIN.exe
  2⤵
  PID:8372
- C:\Windows\System\qNhMPWq.exe
  C:\Windows\System\qNhMPWq.exe
  2⤵
  PID:8388
- C:\Windows\System\jyrvsuf.exe
  C:\Windows\System\jyrvsuf.exe
  2⤵
  PID:8412
- C:\Windows\System\uxjTFsG.exe
  C:\Windows\System\uxjTFsG.exe
  2⤵
  PID:8436
- C:\Windows\System\NqwFEEk.exe
  C:\Windows\System\NqwFEEk.exe
  2⤵
  PID:8452
- C:\Windows\System\fAlHCeN.exe
  C:\Windows\System\fAlHCeN.exe
  2⤵
  PID:8476
- C:\Windows\System\JKlfFMa.exe
  C:\Windows\System\JKlfFMa.exe
  2⤵
  PID:8496
- C:\Windows\System\nNgRJGm.exe
  C:\Windows\System\nNgRJGm.exe
  2⤵
  PID:8512
- C:\Windows\System\TqfLRYM.exe
  C:\Windows\System\TqfLRYM.exe
  2⤵
  PID:8528
- C:\Windows\System\pOYEJBC.exe
  C:\Windows\System\pOYEJBC.exe
  2⤵
  PID:8544
- C:\Windows\System\xThArSi.exe
  C:\Windows\System\xThArSi.exe
  2⤵
  PID:8560
- C:\Windows\System\jOXZyTu.exe
  C:\Windows\System\jOXZyTu.exe
  2⤵
  PID:8576
- C:\Windows\System\JRxOTPx.exe
  C:\Windows\System\JRxOTPx.exe
  2⤵
  PID:8596
- C:\Windows\System\qGapAYi.exe
  C:\Windows\System\qGapAYi.exe
  2⤵
  PID:8616
- C:\Windows\System\IyWOhug.exe
  C:\Windows\System\IyWOhug.exe
  2⤵
  PID:8640
- C:\Windows\System\CdCywDN.exe
  C:\Windows\System\CdCywDN.exe
  2⤵
  PID:8656
- C:\Windows\System\vDVLQfG.exe
  C:\Windows\System\vDVLQfG.exe
  2⤵
  PID:8680
- C:\Windows\System\kTqffdf.exe
  C:\Windows\System\kTqffdf.exe
  2⤵
  PID:8696
- C:\Windows\System\bBCOPcy.exe
  C:\Windows\System\bBCOPcy.exe
  2⤵
  PID:8720
- C:\Windows\System\KWkaiff.exe
  C:\Windows\System\KWkaiff.exe
  2⤵
  PID:8740
- C:\Windows\System\lrmsZwk.exe
  C:\Windows\System\lrmsZwk.exe
  2⤵
  PID:8764
- C:\Windows\System\AhgBgNQ.exe
  C:\Windows\System\AhgBgNQ.exe
  2⤵
  PID:8788
- C:\Windows\System\ARVDSqT.exe
  C:\Windows\System\ARVDSqT.exe
  2⤵
  PID:8816
- C:\Windows\System\ZoxbnSU.exe
  C:\Windows\System\ZoxbnSU.exe
  2⤵
  PID:8832
- C:\Windows\System\GforYSM.exe
  C:\Windows\System\GforYSM.exe
  2⤵
  PID:8856
- C:\Windows\System\IXcwUyP.exe
  C:\Windows\System\IXcwUyP.exe
  2⤵
  PID:8876
- C:\Windows\System\JZPVzEz.exe
  C:\Windows\System\JZPVzEz.exe
  2⤵
  PID:8892
- C:\Windows\System\TIYtggD.exe
  C:\Windows\System\TIYtggD.exe
  2⤵
  PID:8908
- C:\Windows\System\bUDEKDU.exe
  C:\Windows\System\bUDEKDU.exe
  2⤵
  PID:8928
- C:\Windows\System\QCPgwHC.exe
  C:\Windows\System\QCPgwHC.exe
  2⤵
  PID:8948
- C:\Windows\System\FXMfLuc.exe
  C:\Windows\System\FXMfLuc.exe
  2⤵
  PID:8964
- C:\Windows\System\ZRbVuom.exe
  C:\Windows\System\ZRbVuom.exe
  2⤵
  PID:8984
- C:\Windows\System\VPIOPiR.exe
  C:\Windows\System\VPIOPiR.exe
  2⤵
  PID:9000
- C:\Windows\System\tylcpJb.exe
  C:\Windows\System\tylcpJb.exe
  2⤵
  PID:9036
- C:\Windows\System\oAAVdVo.exe
  C:\Windows\System\oAAVdVo.exe
  2⤵
  PID:9060
- C:\Windows\System\GDQXDrc.exe
  C:\Windows\System\GDQXDrc.exe
  2⤵
  PID:9076
- C:\Windows\System\WHlZayq.exe
  C:\Windows\System\WHlZayq.exe
  2⤵
  PID:9096
- C:\Windows\System\CBAgdSv.exe
  C:\Windows\System\CBAgdSv.exe
  2⤵
  PID:9120
- C:\Windows\System\sVIncRE.exe
  C:\Windows\System\sVIncRE.exe
  2⤵
  PID:9136
- C:\Windows\System\TIWbwqA.exe
  C:\Windows\System\TIWbwqA.exe
  2⤵
  PID:9176
- C:\Windows\System\YDxzYyf.exe
  C:\Windows\System\YDxzYyf.exe
  2⤵
  PID:9192
- C:\Windows\System\NylZKHp.exe
  C:\Windows\System\NylZKHp.exe
  2⤵
  PID:9208
- C:\Windows\System\wglPDNj.exe
  C:\Windows\System\wglPDNj.exe
  2⤵
  PID:7528
- C:\Windows\System\RQJjIsR.exe
  C:\Windows\System\RQJjIsR.exe
  2⤵
  PID:7144
- C:\Windows\System\KcCNPKB.exe
  C:\Windows\System\KcCNPKB.exe
  2⤵
  PID:7732
- C:\Windows\System\OwFBUeX.exe
  C:\Windows\System\OwFBUeX.exe
  2⤵
  PID:7844
- C:\Windows\System\nuLoVJh.exe
  C:\Windows\System\nuLoVJh.exe
  2⤵
  PID:6364
- C:\Windows\System\rdcPnYR.exe
  C:\Windows\System\rdcPnYR.exe
  2⤵
  PID:8124
- C:\Windows\System\QKBwCwM.exe
  C:\Windows\System\QKBwCwM.exe
  2⤵
  PID:8156
- C:\Windows\System\bSidMpB.exe
  C:\Windows\System\bSidMpB.exe
  2⤵
  PID:7016
- C:\Windows\System\wPRBlKf.exe
  C:\Windows\System\wPRBlKf.exe
  2⤵
  PID:6936
- C:\Windows\System\pZuBHOj.exe
  C:\Windows\System\pZuBHOj.exe
  2⤵
  PID:7096
- C:\Windows\System\tushpjE.exe
  C:\Windows\System\tushpjE.exe
  2⤵
  PID:5588
- C:\Windows\System\fsFtXRu.exe
  C:\Windows\System\fsFtXRu.exe
  2⤵
  PID:5692
- C:\Windows\System\JreenFs.exe
  C:\Windows\System\JreenFs.exe
  2⤵
  PID:1376
- C:\Windows\System\nIHUDFv.exe
  C:\Windows\System\nIHUDFv.exe
  2⤵
  PID:7308
- C:\Windows\System\DIUsLaG.exe
  C:\Windows\System\DIUsLaG.exe
  2⤵
  PID:7464
- C:\Windows\System\edeSmhM.exe
  C:\Windows\System\edeSmhM.exe
  2⤵
  PID:8676
- C:\Windows\System\CNxQHwQ.exe
  C:\Windows\System\CNxQHwQ.exe
  2⤵
  PID:8760
- C:\Windows\System\zqFpEgp.exe
  C:\Windows\System\zqFpEgp.exe
  2⤵
  PID:8812
- C:\Windows\System\dWkiejW.exe
  C:\Windows\System\dWkiejW.exe
  2⤵
  PID:8872
- C:\Windows\System\YLsszel.exe
  C:\Windows\System\YLsszel.exe
  2⤵
  PID:9232
- C:\Windows\System\xzmEgHs.exe
  C:\Windows\System\xzmEgHs.exe
  2⤵
  PID:9400
- C:\Windows\System\CEvJVmk.exe
  C:\Windows\System\CEvJVmk.exe
  2⤵
  PID:9420
- C:\Windows\System\NWAcAhT.exe
  C:\Windows\System\NWAcAhT.exe
  2⤵
  PID:9436
- C:\Windows\System\cvwjxFs.exe
  C:\Windows\System\cvwjxFs.exe
  2⤵
  PID:9460
- C:\Windows\System\HUzHwrq.exe
  C:\Windows\System\HUzHwrq.exe
  2⤵
  PID:9484
- C:\Windows\System\EwUGmCc.exe
  C:\Windows\System\EwUGmCc.exe
  2⤵
  PID:9504
- C:\Windows\System\yMzaawP.exe
  C:\Windows\System\yMzaawP.exe
  2⤵
  PID:9524
- C:\Windows\System\thWKfFn.exe
  C:\Windows\System\thWKfFn.exe
  2⤵
  PID:9544
- C:\Windows\System\RLodcLs.exe
  C:\Windows\System\RLodcLs.exe
  2⤵
  PID:9576
- C:\Windows\System\ofMjSlN.exe
  C:\Windows\System\ofMjSlN.exe
  2⤵
  PID:9600
- C:\Windows\System\xsHcSYU.exe
  C:\Windows\System\xsHcSYU.exe
  2⤵
  PID:9616
- C:\Windows\System\wmmLkFY.exe
  C:\Windows\System\wmmLkFY.exe
  2⤵
  PID:9640
- C:\Windows\System\EUPiywN.exe
  C:\Windows\System\EUPiywN.exe
  2⤵
  PID:9660
- C:\Windows\System\BZVVPSr.exe
  C:\Windows\System\BZVVPSr.exe
  2⤵
  PID:9680
- C:\Windows\System\ddTRerY.exe
  C:\Windows\System\ddTRerY.exe
  2⤵
  PID:9696
- C:\Windows\System\hgnAtrL.exe
  C:\Windows\System\hgnAtrL.exe
  2⤵
  PID:9720
- C:\Windows\System\JbSVYhs.exe
  C:\Windows\System\JbSVYhs.exe
  2⤵
  PID:9736
- C:\Windows\System\ybPGbbQ.exe
  C:\Windows\System\ybPGbbQ.exe
  2⤵
  PID:9752
- C:\Windows\System\eXMVAIX.exe
  C:\Windows\System\eXMVAIX.exe
  2⤵
  PID:9768
- C:\Windows\System\wMfbCMF.exe
  C:\Windows\System\wMfbCMF.exe
  2⤵
  PID:9788
- C:\Windows\System\nacOesu.exe
  C:\Windows\System\nacOesu.exe
  2⤵
  PID:9804
- C:\Windows\System\LtdaZtx.exe
  C:\Windows\System\LtdaZtx.exe
  2⤵
  PID:9828
- C:\Windows\System\dvJljcJ.exe
  C:\Windows\System\dvJljcJ.exe
  2⤵
  PID:9844
- C:\Windows\System\JseofSX.exe
  C:\Windows\System\JseofSX.exe
  2⤵
  PID:9872
- C:\Windows\System\ciyDQGK.exe
  C:\Windows\System\ciyDQGK.exe
  2⤵
  PID:9892
- C:\Windows\System\sjyUVWO.exe
  C:\Windows\System\sjyUVWO.exe
  2⤵
  PID:9916
- C:\Windows\System\YfOxQeV.exe
  C:\Windows\System\YfOxQeV.exe
  2⤵
  PID:9932
- C:\Windows\System\IGqbjyj.exe
  C:\Windows\System\IGqbjyj.exe
  2⤵
  PID:9956
- C:\Windows\System\VeIJFOE.exe
  C:\Windows\System\VeIJFOE.exe
  2⤵
  PID:9976
- C:\Windows\System\BAkvfFR.exe
  C:\Windows\System\BAkvfFR.exe
  2⤵
  PID:10000
- C:\Windows\System\PlIKhNx.exe
  C:\Windows\System\PlIKhNx.exe
  2⤵
  PID:10016
- C:\Windows\System\FlsKiTm.exe
  C:\Windows\System\FlsKiTm.exe
  2⤵
  PID:10036
- C:\Windows\System\CGbRJrO.exe
  C:\Windows\System\CGbRJrO.exe
  2⤵
  PID:10056
- C:\Windows\System\UxSNHPk.exe
  C:\Windows\System\UxSNHPk.exe
  2⤵
  PID:10076
- C:\Windows\System\mhdMiKd.exe
  C:\Windows\System\mhdMiKd.exe
  2⤵
  PID:10096
- C:\Windows\System\qsJLrCC.exe
  C:\Windows\System\qsJLrCC.exe
  2⤵
  PID:10116
- C:\Windows\System\qKzMVHz.exe
  C:\Windows\System\qKzMVHz.exe
  2⤵
  PID:10136
- C:\Windows\System\swQSpfn.exe
  C:\Windows\System\swQSpfn.exe
  2⤵
  PID:10152
- C:\Windows\System\dMCcvuY.exe
  C:\Windows\System\dMCcvuY.exe
  2⤵
  PID:10176
- C:\Windows\System\EQyFIkc.exe
  C:\Windows\System\EQyFIkc.exe
  2⤵
  PID:10200
- C:\Windows\System\SEpvOBd.exe
  C:\Windows\System\SEpvOBd.exe
  2⤵
  PID:10224
- C:\Windows\System\TjZskmT.exe
  C:\Windows\System\TjZskmT.exe
  2⤵
  PID:5524
- C:\Windows\System\EJtbonb.exe
  C:\Windows\System\EJtbonb.exe
  2⤵
  PID:7832
- C:\Windows\System\CeJqrEe.exe
  C:\Windows\System\CeJqrEe.exe
  2⤵
  PID:1012
- C:\Windows\System\YwEVkHT.exe
  C:\Windows\System\YwEVkHT.exe
  2⤵
  PID:7420
- C:\Windows\System\kLNUPAx.exe
  C:\Windows\System\kLNUPAx.exe
  2⤵
  PID:8796
- C:\Windows\System\ZAxkzIa.exe
  C:\Windows\System\ZAxkzIa.exe
  2⤵
  PID:9228
- C:\Windows\System\nytnpOT.exe
  C:\Windows\System\nytnpOT.exe
  2⤵
  PID:4252
- C:\Windows\System\vFWjsOn.exe
  C:\Windows\System\vFWjsOn.exe
  2⤵
  PID:8240
- C:\Windows\System\AtTkbMa.exe
  C:\Windows\System\AtTkbMa.exe
  2⤵
  PID:8460
- C:\Windows\System\HkuToIz.exe
  C:\Windows\System\HkuToIz.exe
  2⤵
  PID:8520
- C:\Windows\System\Dpzpsyb.exe
  C:\Windows\System\Dpzpsyb.exe
  2⤵
  PID:8552
- C:\Windows\System\nsagEvn.exe
  C:\Windows\System\nsagEvn.exe
  2⤵
  PID:8588
- C:\Windows\System\tKjdKyu.exe
  C:\Windows\System\tKjdKyu.exe
  2⤵
  PID:8632
- C:\Windows\System\OipYFHV.exe
  C:\Windows\System\OipYFHV.exe
  2⤵
  PID:8732
- C:\Windows\System\AZoFHRr.exe
  C:\Windows\System\AZoFHRr.exe
  2⤵
  PID:8844
- C:\Windows\System\LHpHkSJ.exe
  C:\Windows\System\LHpHkSJ.exe
  2⤵
  PID:9612
- C:\Windows\System\BoKHoex.exe
  C:\Windows\System\BoKHoex.exe
  2⤵
  PID:10272
- C:\Windows\System\IpiNuoU.exe
  C:\Windows\System\IpiNuoU.exe
  2⤵
  PID:10292
- C:\Windows\System\oQmGIdM.exe
  C:\Windows\System\oQmGIdM.exe
  2⤵
  PID:10312
- C:\Windows\System\vZwEgCC.exe
  C:\Windows\System\vZwEgCC.exe
  2⤵
  PID:10332
- C:\Windows\System\jBbweBK.exe
  C:\Windows\System\jBbweBK.exe
  2⤵
  PID:10352
- C:\Windows\System\JAifNYt.exe
  C:\Windows\System\JAifNYt.exe
  2⤵
  PID:10372
- C:\Windows\System\THcNUMI.exe
  C:\Windows\System\THcNUMI.exe
  2⤵
  PID:10392
- C:\Windows\System\WnAWqqe.exe
  C:\Windows\System\WnAWqqe.exe
  2⤵
  PID:10412
- C:\Windows\System\ierVUAV.exe
  C:\Windows\System\ierVUAV.exe
  2⤵
  PID:10428
- C:\Windows\System\bafTsYi.exe
  C:\Windows\System\bafTsYi.exe
  2⤵
  PID:10448
- C:\Windows\System\crENoBo.exe
  C:\Windows\System\crENoBo.exe
  2⤵
  PID:10468
- C:\Windows\System\NGskACZ.exe
  C:\Windows\System\NGskACZ.exe
  2⤵
  PID:10484
- C:\Windows\System\RuVZlwR.exe
  C:\Windows\System\RuVZlwR.exe
  2⤵
  PID:10508
- C:\Windows\System\jMmnBBw.exe
  C:\Windows\System\jMmnBBw.exe
  2⤵
  PID:10524
- C:\Windows\System\rThbzuT.exe
  C:\Windows\System\rThbzuT.exe
  2⤵
  PID:10544
- C:\Windows\System\haziJrV.exe
  C:\Windows\System\haziJrV.exe
  2⤵
  PID:10568
- C:\Windows\System\XCqXubs.exe
  C:\Windows\System\XCqXubs.exe
  2⤵
  PID:10596
- C:\Windows\System\kWmbabB.exe
  C:\Windows\System\kWmbabB.exe
  2⤵
  PID:10612
- C:\Windows\System\KBFWAmE.exe
  C:\Windows\System\KBFWAmE.exe
  2⤵
  PID:10636
- C:\Windows\System\UKvlkNf.exe
  C:\Windows\System\UKvlkNf.exe
  2⤵
  PID:10656
- C:\Windows\System\CTDcFGO.exe
  C:\Windows\System\CTDcFGO.exe
  2⤵
  PID:10672
- C:\Windows\System\UbSnHAS.exe
  C:\Windows\System\UbSnHAS.exe
  2⤵
  PID:10692
- C:\Windows\System\QrhOeQn.exe
  C:\Windows\System\QrhOeQn.exe
  2⤵
  PID:10716
- C:\Windows\System\wjtwrcG.exe
  C:\Windows\System\wjtwrcG.exe
  2⤵
  PID:10732
- C:\Windows\System\HdboleO.exe
  C:\Windows\System\HdboleO.exe
  2⤵
  PID:10752
- C:\Windows\System\JUSuosg.exe
  C:\Windows\System\JUSuosg.exe
  2⤵
  PID:10768
- C:\Windows\System\AAXjPYJ.exe
  C:\Windows\System\AAXjPYJ.exe
  2⤵
  PID:10792
- C:\Windows\System\tPYohjO.exe
  C:\Windows\System\tPYohjO.exe
  2⤵
  PID:10812
- C:\Windows\System\zXHmVLl.exe
  C:\Windows\System\zXHmVLl.exe
  2⤵
  PID:10836
- C:\Windows\System\bKoZLAR.exe
  C:\Windows\System\bKoZLAR.exe
  2⤵
  PID:10852
- C:\Windows\System\TwCkgCa.exe
  C:\Windows\System\TwCkgCa.exe
  2⤵
  PID:10876
- C:\Windows\System\wKLWXAb.exe
  C:\Windows\System\wKLWXAb.exe
  2⤵
  PID:10904
- C:\Windows\System\VsUSGBw.exe
  C:\Windows\System\VsUSGBw.exe
  2⤵
  PID:10924
- C:\Windows\System\bVYoyAu.exe
  C:\Windows\System\bVYoyAu.exe
  2⤵
  PID:10944
- C:\Windows\System\ITZVDey.exe
  C:\Windows\System\ITZVDey.exe
  2⤵
  PID:10964
- C:\Windows\System\PIHObUg.exe
  C:\Windows\System\PIHObUg.exe
  2⤵
  PID:10984
- C:\Windows\System\mfYkjeg.exe
  C:\Windows\System\mfYkjeg.exe
  2⤵
  PID:11008
- C:\Windows\System\PUCLtQx.exe
  C:\Windows\System\PUCLtQx.exe
  2⤵
  PID:11024
- C:\Windows\System\nRPBLFN.exe
  C:\Windows\System\nRPBLFN.exe
  2⤵
  PID:11064
- C:\Windows\System\DsOPkYe.exe
  C:\Windows\System\DsOPkYe.exe
  2⤵
  PID:11080
- C:\Windows\System\oaPqHhX.exe
  C:\Windows\System\oaPqHhX.exe
  2⤵
  PID:11096
- C:\Windows\System\xwlkzYm.exe
  C:\Windows\System\xwlkzYm.exe
  2⤵
  PID:11112
- C:\Windows\System\uCdmnkv.exe
  C:\Windows\System\uCdmnkv.exe
  2⤵
  PID:11168
- C:\Windows\System\qsfcxjG.exe
  C:\Windows\System\qsfcxjG.exe
  2⤵
  PID:11184
- C:\Windows\System\lHVRwkx.exe
  C:\Windows\System\lHVRwkx.exe
  2⤵
  PID:11208
- C:\Windows\System\ooQaMMY.exe
  C:\Windows\System\ooQaMMY.exe
  2⤵
  PID:11232
- C:\Windows\System\PcyXJtW.exe
  C:\Windows\System\PcyXJtW.exe
  2⤵
  PID:11252
- C:\Windows\System\nbGiVGw.exe
  C:\Windows\System\nbGiVGw.exe
  2⤵
  PID:9672
- C:\Windows\System\riiLQMX.exe
  C:\Windows\System\riiLQMX.exe
  2⤵
  PID:9712
- C:\Windows\System\hXnlfIQ.exe
  C:\Windows\System\hXnlfIQ.exe
  2⤵
  PID:3612
- C:\Windows\System\VcBCSVh.exe
  C:\Windows\System\VcBCSVh.exe
  2⤵
  PID:9812
- C:\Windows\System\VYQGTvE.exe
  C:\Windows\System\VYQGTvE.exe
  2⤵
  PID:9900
- C:\Windows\System\jgWVQdz.exe
  C:\Windows\System\jgWVQdz.exe
  2⤵
  PID:10028
- C:\Windows\System\UYPWckB.exe
  C:\Windows\System\UYPWckB.exe
  2⤵
  PID:10092
- C:\Windows\System\lWnDsQz.exe
  C:\Windows\System\lWnDsQz.exe
  2⤵
  PID:8920
- C:\Windows\System\WryqNIG.exe
  C:\Windows\System\WryqNIG.exe
  2⤵
  PID:10216
- C:\Windows\System\hCMmvau.exe
  C:\Windows\System\hCMmvau.exe
  2⤵
  PID:7772
- C:\Windows\System\bLNYqjC.exe
  C:\Windows\System\bLNYqjC.exe
  2⤵
  PID:8936
- C:\Windows\System\SOcsNMo.exe
  C:\Windows\System\SOcsNMo.exe
  2⤵
  PID:8484
- C:\Windows\System\MCVdWTI.exe
  C:\Windows\System\MCVdWTI.exe
  2⤵
  PID:9056
- C:\Windows\System\FZtFGKf.exe
  C:\Windows\System\FZtFGKf.exe
  2⤵
  PID:9088
- C:\Windows\System\qMaODHD.exe
  C:\Windows\System\qMaODHD.exe
  2⤵
  PID:9128
- C:\Windows\System\nXxGHxw.exe
  C:\Windows\System\nXxGHxw.exe
  2⤵
  PID:9300
- C:\Windows\System\kyEsxwR.exe
  C:\Windows\System\kyEsxwR.exe
  2⤵
  PID:9204
- C:\Windows\System\YhwElLX.exe
  C:\Windows\System\YhwElLX.exe
  2⤵
  PID:7544
- C:\Windows\System\WiOvcbh.exe
  C:\Windows\System\WiOvcbh.exe
  2⤵
  PID:7740
- C:\Windows\System\thuHzFy.exe
  C:\Windows\System\thuHzFy.exe
  2⤵
  PID:7892
- C:\Windows\System\JhEuzfV.exe
  C:\Windows\System\JhEuzfV.exe
  2⤵
  PID:7272
- C:\Windows\System\tStToSM.exe
  C:\Windows\System\tStToSM.exe
  2⤵
  PID:1180
- C:\Windows\System\kpQRqWd.exe
  C:\Windows\System\kpQRqWd.exe
  2⤵
  PID:6948
- C:\Windows\System\UzWnhUw.exe
  C:\Windows\System\UzWnhUw.exe
  2⤵
  PID:7132
- C:\Windows\System\RjDsSur.exe
  C:\Windows\System\RjDsSur.exe
  2⤵
  PID:7948
- C:\Windows\System\LFWjBNZ.exe
  C:\Windows\System\LFWjBNZ.exe
  2⤵
  PID:8652
- C:\Windows\System\mjjYPSl.exe
  C:\Windows\System\mjjYPSl.exe
  2⤵
  PID:8784
- C:\Windows\System\YNIUptj.exe
  C:\Windows\System\YNIUptj.exe
  2⤵
  PID:9224
- C:\Windows\System\LZojDsA.exe
  C:\Windows\System\LZojDsA.exe
  2⤵
  PID:9588
- C:\Windows\System\KjyQQDv.exe
  C:\Windows\System\KjyQQDv.exe
  2⤵
  PID:9624
- C:\Windows\System\LvODxXU.exe
  C:\Windows\System\LvODxXU.exe
  2⤵
  PID:10320
- C:\Windows\System\PNWqqOu.exe
  C:\Windows\System\PNWqqOu.exe
  2⤵
  PID:10360
- C:\Windows\System\YrqPTQP.exe
  C:\Windows\System\YrqPTQP.exe
  2⤵
  PID:10384
- C:\Windows\System\eeWpVfT.exe
  C:\Windows\System\eeWpVfT.exe
  2⤵
  PID:216
- C:\Windows\System\YsfophZ.exe
  C:\Windows\System\YsfophZ.exe
  2⤵
  PID:10436
- C:\Windows\System\ovLsBAi.exe
  C:\Windows\System\ovLsBAi.exe
  2⤵
  PID:10464
- C:\Windows\System\pUQSZEd.exe
  C:\Windows\System\pUQSZEd.exe
  2⤵
  PID:9888
- C:\Windows\System\zsJHMbL.exe
  C:\Windows\System\zsJHMbL.exe
  2⤵
  PID:10536
- C:\Windows\System\efVWVya.exe
  C:\Windows\System\efVWVya.exe
  2⤵
  PID:2320
- C:\Windows\System\dquUxnM.exe
  C:\Windows\System\dquUxnM.exe
  2⤵
  PID:11280
- C:\Windows\System\fiJKIJa.exe
  C:\Windows\System\fiJKIJa.exe
  2⤵
  PID:11300
- C:\Windows\System\xgVfqAB.exe
  C:\Windows\System\xgVfqAB.exe
  2⤵
  PID:11316
- C:\Windows\System\xWrjGGd.exe
  C:\Windows\System\xWrjGGd.exe
  2⤵
  PID:11348
- C:\Windows\System\mOUCUsK.exe
  C:\Windows\System\mOUCUsK.exe
  2⤵
  PID:11644
- C:\Windows\System\MpGIyEv.exe
  C:\Windows\System\MpGIyEv.exe
  2⤵
  PID:11660
- C:\Windows\System\mvVWhzT.exe
  C:\Windows\System\mvVWhzT.exe
  2⤵
  PID:11680
- C:\Windows\System\VcYtPlH.exe
  C:\Windows\System\VcYtPlH.exe
  2⤵
  PID:11700
- C:\Windows\System\ewFOpBl.exe
  C:\Windows\System\ewFOpBl.exe
  2⤵
  PID:11756
- C:\Windows\System\GQEVnGx.exe
  C:\Windows\System\GQEVnGx.exe
  2⤵
  PID:11780
- C:\Windows\System\KFBOqXn.exe
  C:\Windows\System\KFBOqXn.exe
  2⤵
  PID:11796
- C:\Windows\System\HurFcZD.exe
  C:\Windows\System\HurFcZD.exe
  2⤵
  PID:11820
- C:\Windows\System\XADrRPr.exe
  C:\Windows\System\XADrRPr.exe
  2⤵
  PID:11840
- C:\Windows\System\dvZsMYM.exe
  C:\Windows\System\dvZsMYM.exe
  2⤵
  PID:11860
- C:\Windows\System\CchBUYO.exe
  C:\Windows\System\CchBUYO.exe
  2⤵
  PID:11880
- C:\Windows\System\tqQkdwK.exe
  C:\Windows\System\tqQkdwK.exe
  2⤵
  PID:11896
- C:\Windows\System\myxSjLI.exe
  C:\Windows\System\myxSjLI.exe
  2⤵
  PID:11916
- C:\Windows\System\mYpEQDL.exe
  C:\Windows\System\mYpEQDL.exe
  2⤵
  PID:11940
- C:\Windows\System\dnvRGxh.exe
  C:\Windows\System\dnvRGxh.exe
  2⤵
  PID:11956
- C:\Windows\System\xsjdPBX.exe
  C:\Windows\System\xsjdPBX.exe
  2⤵
  PID:11980
- C:\Windows\System\NlQIgvb.exe
  C:\Windows\System\NlQIgvb.exe
  2⤵
  PID:12004
- C:\Windows\System\kkyynyC.exe
  C:\Windows\System\kkyynyC.exe
  2⤵
  PID:12020
- C:\Windows\System\cGifcNY.exe
  C:\Windows\System\cGifcNY.exe
  2⤵
  PID:12040
- C:\Windows\System\xGRgrWX.exe
  C:\Windows\System\xGRgrWX.exe
  2⤵
  PID:12056
- C:\Windows\System\wVoqaAP.exe
  C:\Windows\System\wVoqaAP.exe
  2⤵
  PID:12084
- C:\Windows\System\MknRaPB.exe
  C:\Windows\System\MknRaPB.exe
  2⤵
  PID:12112
- C:\Windows\System\NWBfDaO.exe
  C:\Windows\System\NWBfDaO.exe
  2⤵
  PID:12136
- C:\Windows\System\gKGkKak.exe
  C:\Windows\System\gKGkKak.exe
  2⤵
  PID:12152
- C:\Windows\System\odeWabz.exe
  C:\Windows\System\odeWabz.exe
  2⤵
  PID:12172
- C:\Windows\System\fwHsylk.exe
  C:\Windows\System\fwHsylk.exe
  2⤵
  PID:12192
- C:\Windows\System\BvCyRuX.exe
  C:\Windows\System\BvCyRuX.exe
  2⤵
  PID:12220
- C:\Windows\System\ZyKhObm.exe
  C:\Windows\System\ZyKhObm.exe
  2⤵
  PID:12236
- C:\Windows\System\EdLRDBw.exe
  C:\Windows\System\EdLRDBw.exe
  2⤵
  PID:12260
- C:\Windows\System\gfSNuOf.exe
  C:\Windows\System\gfSNuOf.exe
  2⤵
  PID:12280
- C:\Windows\System\QwfvGvr.exe
  C:\Windows\System\QwfvGvr.exe
  2⤵
  PID:9972
- C:\Windows\System\kbXnqpZ.exe
  C:\Windows\System\kbXnqpZ.exe
  2⤵
  PID:10728
- C:\Windows\System\ElszQXn.exe
  C:\Windows\System\ElszQXn.exe
  2⤵
  PID:10776
- C:\Windows\System\VoXfnes.exe
  C:\Windows\System\VoXfnes.exe
  2⤵
  PID:10808
- C:\Windows\System\zjjoTMv.exe
  C:\Windows\System\zjjoTMv.exe
  2⤵
  PID:8776
- C:\Windows\System\RxsXDhp.exe
  C:\Windows\System\RxsXDhp.exe
  2⤵
  PID:7552
- C:\Windows\System\HOBdlDp.exe
  C:\Windows\System\HOBdlDp.exe
  2⤵
  PID:452
- C:\Windows\System\tMsBUyf.exe
  C:\Windows\System\tMsBUyf.exe
  2⤵
  PID:9500
- C:\Windows\System\QOTPguC.exe
  C:\Windows\System\QOTPguC.exe
  2⤵
  PID:9456
- C:\Windows\System\AdNPyuq.exe
  C:\Windows\System\AdNPyuq.exe
  2⤵
  PID:9412
- C:\Windows\System\OUTSrSy.exe
  C:\Windows\System\OUTSrSy.exe
  2⤵
  PID:1136
- C:\Windows\System\MJitRSv.exe
  C:\Windows\System\MJitRSv.exe
  2⤵
  PID:9868
- C:\Windows\System\bnXekEF.exe
  C:\Windows\System\bnXekEF.exe
  2⤵
  PID:9536
- C:\Windows\System\jtGejsI.exe
  C:\Windows\System\jtGejsI.exe
  2⤵
  PID:9312
- C:\Windows\System\FsDbwuD.exe
  C:\Windows\System\FsDbwuD.exe
  2⤵
  PID:9240
- C:\Windows\System\QUexrWi.exe
  C:\Windows\System\QUexrWi.exe
  2⤵
  PID:11224
- C:\Windows\System\hZXXSZq.exe
  C:\Windows\System\hZXXSZq.exe
  2⤵
  PID:10824
- C:\Windows\System\CNeCVzJ.exe
  C:\Windows\System\CNeCVzJ.exe
  2⤵
  PID:8268
- C:\Windows\System\GejayaL.exe
  C:\Windows\System\GejayaL.exe
  2⤵
  PID:6036
- C:\Windows\System\bUeEdon.exe
  C:\Windows\System\bUeEdon.exe
  2⤵
  PID:10328
- C:\Windows\System\RXzOBLo.exe
  C:\Windows\System\RXzOBLo.exe
  2⤵
  PID:10444
- C:\Windows\System\mxmaLBi.exe
  C:\Windows\System\mxmaLBi.exe
  2⤵
  PID:11268
- C:\Windows\System\MoFLght.exe
  C:\Windows\System\MoFLght.exe
  2⤵
  PID:10820
- C:\Windows\System\WACjqtD.exe
  C:\Windows\System\WACjqtD.exe
  2⤵
  PID:10168
- C:\Windows\System\eToEMJH.exe
  C:\Windows\System\eToEMJH.exe
  2⤵
  PID:10940
- C:\Windows\System\ZQFynpZ.exe
  C:\Windows\System\ZQFynpZ.exe
  2⤵
  PID:3672
- C:\Windows\System\MHKZjOn.exe
  C:\Windows\System\MHKZjOn.exe
  2⤵
  PID:8420
- C:\Windows\System\YzUhleI.exe
  C:\Windows\System\YzUhleI.exe
  2⤵
  PID:2572
- C:\Windows\System\GnLNAZK.exe
  C:\Windows\System\GnLNAZK.exe
  2⤵
  PID:8536
- C:\Windows\System\LPXbDwc.exe
  C:\Windows\System\LPXbDwc.exe
  2⤵
  PID:8592
- C:\Windows\System\rfVlvyk.exe
  C:\Windows\System\rfVlvyk.exe
  2⤵
  PID:12292
- C:\Windows\System\QICJiZB.exe
  C:\Windows\System\QICJiZB.exe
  2⤵
  PID:12312
- C:\Windows\System\pYScrUs.exe
  C:\Windows\System\pYScrUs.exe
  2⤵
  PID:12332
- C:\Windows\System\zUBjczi.exe
  C:\Windows\System\zUBjczi.exe
  2⤵
  PID:12356
- C:\Windows\System\czRVXpG.exe
  C:\Windows\System\czRVXpG.exe
  2⤵
  PID:12380
- C:\Windows\System\YgTNTcj.exe
  C:\Windows\System\YgTNTcj.exe
  2⤵
  PID:12400
- C:\Windows\System\AqHRvin.exe
  C:\Windows\System\AqHRvin.exe
  2⤵
  PID:12424
- C:\Windows\System\GMLVBaP.exe
  C:\Windows\System\GMLVBaP.exe
  2⤵
  PID:12440
- C:\Windows\System\GBFGhuo.exe
  C:\Windows\System\GBFGhuo.exe
  2⤵
  PID:12468
- C:\Windows\System\ISWncoC.exe
  C:\Windows\System\ISWncoC.exe
  2⤵
  PID:12488
- C:\Windows\System\FqDXFzp.exe
  C:\Windows\System\FqDXFzp.exe
  2⤵
  PID:12512
- C:\Windows\System\VdcwpZp.exe
  C:\Windows\System\VdcwpZp.exe
  2⤵
  PID:12528
- C:\Windows\System\avKNYIK.exe
  C:\Windows\System\avKNYIK.exe
  2⤵
  PID:12556
- C:\Windows\System\NWUkkiB.exe
  C:\Windows\System\NWUkkiB.exe
  2⤵
  PID:12576
- C:\Windows\System\xkNZnny.exe
  C:\Windows\System\xkNZnny.exe
  2⤵
  PID:12596
- C:\Windows\System\vnVtIIW.exe
  C:\Windows\System\vnVtIIW.exe
  2⤵
  PID:12620
- C:\Windows\System\KbodeXs.exe
  C:\Windows\System\KbodeXs.exe
  2⤵
  PID:12636
- C:\Windows\System\sPYSxBD.exe
  C:\Windows\System\sPYSxBD.exe
  2⤵
  PID:12660
- C:\Windows\System\MZJdkMs.exe
  C:\Windows\System\MZJdkMs.exe
  2⤵
  PID:12680
- C:\Windows\System\doyEzlp.exe
  C:\Windows\System\doyEzlp.exe
  2⤵
  PID:12696
- C:\Windows\System\DokqSuA.exe
  C:\Windows\System\DokqSuA.exe
  2⤵
  PID:12716
- C:\Windows\System\qnHexAp.exe
  C:\Windows\System\qnHexAp.exe
  2⤵
  PID:12732
- C:\Windows\System\TKLhKbG.exe
  C:\Windows\System\TKLhKbG.exe
  2⤵
  PID:12748
- C:\Windows\System\SnvynsU.exe
  C:\Windows\System\SnvynsU.exe
  2⤵
  PID:12768
- C:\Windows\System\FOsjKCQ.exe
  C:\Windows\System\FOsjKCQ.exe
  2⤵
  PID:12784
- C:\Windows\System\ngVXoMh.exe
  C:\Windows\System\ngVXoMh.exe
  2⤵
  PID:12808
- C:\Windows\System\oHeZMaW.exe
  C:\Windows\System\oHeZMaW.exe
  2⤵
  PID:12832
- C:\Windows\System\zdcVooR.exe
  C:\Windows\System\zdcVooR.exe
  2⤵
  PID:12860
- C:\Windows\System\KNDODOj.exe
  C:\Windows\System\KNDODOj.exe
  2⤵
  PID:12876
- C:\Windows\System\KpUrLXl.exe
  C:\Windows\System\KpUrLXl.exe
  2⤵
  PID:12892
- C:\Windows\System\qWCWsPN.exe
  C:\Windows\System\qWCWsPN.exe
  2⤵
  PID:12908
- C:\Windows\System\SSNmFUV.exe
  C:\Windows\System\SSNmFUV.exe
  2⤵
  PID:12924
- C:\Windows\System\AmVopNM.exe
  C:\Windows\System\AmVopNM.exe
  2⤵
  PID:12940
- C:\Windows\System\JVDnNJj.exe
  C:\Windows\System\JVDnNJj.exe
  2⤵
  PID:12960
- C:\Windows\System\oKcNYDY.exe
  C:\Windows\System\oKcNYDY.exe
  2⤵
  PID:12980
- C:\Windows\System\OEuLRhA.exe
  C:\Windows\System\OEuLRhA.exe
  2⤵
  PID:12996
- C:\Windows\System\pTNqrLc.exe
  C:\Windows\System\pTNqrLc.exe
  2⤵
  PID:13012
- C:\Windows\System\QTScHXo.exe
  C:\Windows\System\QTScHXo.exe
  2⤵
  PID:13036
- C:\Windows\System\FrlPmWc.exe
  C:\Windows\System\FrlPmWc.exe
  2⤵
  PID:13052
- C:\Windows\System\XtOdfGw.exe
  C:\Windows\System\XtOdfGw.exe
  2⤵
  PID:13072
- C:\Windows\System\DBuSzYD.exe
  C:\Windows\System\DBuSzYD.exe
  2⤵
  PID:13100
- C:\Windows\System\gJLtAhv.exe
  C:\Windows\System\gJLtAhv.exe
  2⤵
  PID:13116
- C:\Windows\System\ZUFfjzt.exe
  C:\Windows\System\ZUFfjzt.exe
  2⤵
  PID:13136
- C:\Windows\System\oDlQmfs.exe
  C:\Windows\System\oDlQmfs.exe
  2⤵
  PID:13156
- C:\Windows\System\KDwukcU.exe
  C:\Windows\System\KDwukcU.exe
  2⤵
  PID:13172
- C:\Windows\System\MjvqrQe.exe
  C:\Windows\System\MjvqrQe.exe
  2⤵
  PID:13192
- C:\Windows\System\sayIZnA.exe
  C:\Windows\System\sayIZnA.exe
  2⤵
  PID:13216
- C:\Windows\System\wLvSiyo.exe
  C:\Windows\System\wLvSiyo.exe
  2⤵
  PID:13236
- C:\Windows\System\xBWbjab.exe
  C:\Windows\System\xBWbjab.exe
  2⤵
  PID:10648
- C:\Windows\System\XNscLNj.exe
  C:\Windows\System\XNscLNj.exe
  2⤵
  PID:13132
- C:\Windows\System\RzhLhwa.exe
  C:\Windows\System\RzhLhwa.exe
  2⤵
  PID:13084
- C:\Windows\System\XLntCJF.exe
  C:\Windows\System\XLntCJF.exe
  2⤵
  PID:13048
- C:\Windows\System\jDwkjMQ.exe
  C:\Windows\System\jDwkjMQ.exe
  2⤵
  PID:13008
- C:\Windows\System\actPcsv.exe
  C:\Windows\System\actPcsv.exe
  2⤵
  PID:12968
- C:\Windows\System\pnlQAHd.exe
  C:\Windows\System\pnlQAHd.exe
  2⤵
  PID:12932
- C:\Windows\System\aYznDIe.exe
  C:\Windows\System\aYznDIe.exe
  2⤵
  PID:12900
- C:\Windows\System\qOEKWBY.exe
  C:\Windows\System\qOEKWBY.exe
  2⤵
  PID:12868
- C:\Windows\System\yMfnNbz.exe
  C:\Windows\System\yMfnNbz.exe
  2⤵
  PID:12824
- C:\Windows\System\UrzbgpF.exe
  C:\Windows\System\UrzbgpF.exe
  2⤵
  PID:12776
- C:\Windows\System\zExppAV.exe
  C:\Windows\System\zExppAV.exe
  2⤵
  PID:520
- C:\Windows\System\bwlYXaz.exe
  C:\Windows\System\bwlYXaz.exe
  2⤵
  PID:10952
- C:\Windows\System\acbuPsh.exe
  C:\Windows\System\acbuPsh.exe
  2⤵
  PID:9160
- C:\Windows\System\QNnTSkA.exe
  C:\Windows\System\QNnTSkA.exe
  2⤵
  PID:8992
- C:\Windows\System\nTgsBaQ.exe
  C:\Windows\System\nTgsBaQ.exe
  2⤵
  PID:9840
- C:\Windows\System\nBUnhMg.exe
  C:\Windows\System\nBUnhMg.exe
  2⤵
  PID:9688
- C:\Windows\System\rykOLya.exe
  C:\Windows\System\rykOLya.exe
  2⤵
  PID:11216
- C:\Windows\System\WJrjkeC.exe
  C:\Windows\System\WJrjkeC.exe
  2⤵
  PID:1392
- C:\Windows\System\dBEnjnC.exe
  C:\Windows\System\dBEnjnC.exe
  2⤵
  PID:11672
- C:\Windows\System\juePDCc.exe
  C:\Windows\System\juePDCc.exe
  2⤵
  PID:11804
- C:\Windows\System\XnZIDyE.exe
  C:\Windows\System\XnZIDyE.exe
  2⤵
  PID:10748
- C:\Windows\System\WXsRiMS.exe
  C:\Windows\System\WXsRiMS.exe
  2⤵
  PID:8972
- C:\Windows\System\ibgpQZm.exe
  C:\Windows\System\ibgpQZm.exe
  2⤵
  PID:13020
- C:\Windows\System\EIdzoYc.exe
  C:\Windows\System\EIdzoYc.exe
  2⤵
  PID:13164
- C:\Windows\System\KPZrngD.exe
  C:\Windows\System\KPZrngD.exe
  2⤵
  PID:13224
- C:\Windows\System\FzVYtJf.exe
  C:\Windows\System\FzVYtJf.exe
  2⤵
  PID:11712
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 11712 -s 28
    3⤵
    PID:12952
- C:\Windows\System\oLXXVnQ.exe
  C:\Windows\System\oLXXVnQ.exe
  2⤵
  PID:11060
- C:\Windows\System\vdQrGqP.exe
  C:\Windows\System\vdQrGqP.exe
  2⤵
  PID:7032
- C:\Windows\System\eCchUwI.exe
  C:\Windows\System\eCchUwI.exe
  2⤵
  PID:7436
- C:\Windows\System\KslMMkF.exe
  C:\Windows\System\KslMMkF.exe
  2⤵
  PID:10260
- C:\Windows\System\QHqHpZr.exe
  C:\Windows\System\QHqHpZr.exe
  2⤵
  PID:10496
- C:\Windows\System\OXWIXBs.exe
  C:\Windows\System\OXWIXBs.exe
  2⤵
  PID:9948
- C:\Windows\System\orJZwUw.exe
  C:\Windows\System\orJZwUw.exe
  2⤵
  PID:11312
- C:\Windows\System\CVfQeoI.exe
  C:\Windows\System\CVfQeoI.exe
  2⤵
  PID:11368
- C:\Windows\System\bbzGIRI.exe
  C:\Windows\System\bbzGIRI.exe
  2⤵
  PID:10704
- C:\Windows\System\LRmzHtA.exe
  C:\Windows\System\LRmzHtA.exe
  2⤵
  PID:7492
- C:\Windows\System\lmsVsFn.exe
  C:\Windows\System\lmsVsFn.exe
  2⤵
  PID:9968
- C:\Windows\System\WFfawOm.exe
  C:\Windows\System\WFfawOm.exe
  2⤵
  PID:11144
- C:\Windows\System\vDQQrww.exe
  C:\Windows\System\vDQQrww.exe
  2⤵
  PID:12760
- C:\Windows\System\xPmrIZD.exe
  C:\Windows\System\xPmrIZD.exe
  2⤵
  PID:9468
- C:\Windows\System\cGcvkoB.exe
  C:\Windows\System\cGcvkoB.exe
  2⤵
  PID:13068
- C:\Windows\System\WtXwVvP.exe
  C:\Windows\System\WtXwVvP.exe
  2⤵
  PID:13188
- C:\Windows\System\ICJhqQK.exe
  C:\Windows\System\ICJhqQK.exe
  2⤵
  PID:11584
- C:\Windows\System\sxGOWvT.exe
  C:\Windows\System\sxGOWvT.exe
  2⤵
  PID:12036
- C:\Windows\System\bQZDJWU.exe
  C:\Windows\System\bQZDJWU.exe
  2⤵
  PID:12712
- C:\Windows\System\gKmxvka.exe
  C:\Windows\System\gKmxvka.exe
  2⤵
  PID:9732
- C:\Windows\System\yCrsgEP.exe
  C:\Windows\System\yCrsgEP.exe
  2⤵
  PID:13108
- C:\Windows\System\DslVtKi.exe
  C:\Windows\System\DslVtKi.exe
  2⤵
  PID:11816
- C:\Windows\System\VgLcuWo.exe
  C:\Windows\System\VgLcuWo.exe
  2⤵
  PID:3260
- C:\Windows\System\JccztmA.exe
  C:\Windows\System\JccztmA.exe
  2⤵
  PID:8716
- C:\Windows\System\PylbaAu.exe
  C:\Windows\System\PylbaAu.exe
  2⤵
  PID:10256
- C:\Windows\System\QqDulxu.exe
  C:\Windows\System\QqDulxu.exe
  2⤵
  PID:11272
- C:\Windows\System\nmglsAF.exe
  C:\Windows\System\nmglsAF.exe
  2⤵
  PID:10604
- C:\Windows\System\baWuexa.exe
  C:\Windows\System\baWuexa.exe
  2⤵
  PID:11296
- C:\Windows\System\uuFrksJ.exe
  C:\Windows\System\uuFrksJ.exe
  2⤵
  PID:12232
- C:\Windows\System\WdfoFIi.exe
  C:\Windows\System\WdfoFIi.exe
  2⤵
  PID:4308
- C:\Windows\System\MyPobyL.exe
  C:\Windows\System\MyPobyL.exe
  2⤵
  PID:11912
- C:\Windows\System\TiaoRyh.exe
  C:\Windows\System\TiaoRyh.exe
  2⤵
  PID:11420
- C:\Windows\System\LGfNeYg.exe
  C:\Windows\System\LGfNeYg.exe
  2⤵
  PID:12148
- C:\Windows\System\QmdVcjX.exe
  C:\Windows\System\QmdVcjX.exe
  2⤵
  PID:2012
- C:\Windows\System\bFkOkLB.exe
  C:\Windows\System\bFkOkLB.exe
  2⤵
  PID:860
- C:\Windows\System\SLileCS.exe
  C:\Windows\System\SLileCS.exe
  2⤵
  PID:12208
- C:\Windows\System\PLqFUPe.exe
  C:\Windows\System\PLqFUPe.exe
  2⤵
  PID:3264
- C:\Windows\System\RLdDMHE.exe
  C:\Windows\System\RLdDMHE.exe
  2⤵
  PID:796
- C:\Windows\System\gyHBxNG.exe
  C:\Windows\System\gyHBxNG.exe
  2⤵
  PID:4212
- C:\Windows\System\fBRfeyk.exe
  C:\Windows\System\fBRfeyk.exe
  2⤵
  PID:3104
- C:\Windows\System\KvaLiWV.exe
  C:\Windows\System\KvaLiWV.exe
  2⤵
  PID:12672
- C:\Windows\System\zSefOVJ.exe
  C:\Windows\System\zSefOVJ.exe
  2⤵
  PID:10848
- C:\Windows\System\xnEhDwC.exe
  C:\Windows\System\xnEhDwC.exe
  2⤵
  PID:4204
- C:\Windows\System\zkhmUfv.exe
  C:\Windows\System\zkhmUfv.exe
  2⤵
  PID:5228
- C:\Windows\System\YvUpHPl.exe
  C:\Windows\System\YvUpHPl.exe
  2⤵
  PID:7916
- C:\Windows\System\EYoXyLy.exe
  C:\Windows\System\EYoXyLy.exe
  2⤵
  PID:12552
- C:\Windows\System\EPGEhiE.exe
  C:\Windows\System\EPGEhiE.exe
  2⤵
  PID:11160
- C:\Windows\System\MZIMyhK.exe
  C:\Windows\System\MZIMyhK.exe
  2⤵
  PID:4508
- C:\Windows\System\RmXMNBY.exe
  C:\Windows\System\RmXMNBY.exe
  2⤵
  PID:9908
- C:\Windows\System\asucRyP.exe
  C:\Windows\System\asucRyP.exe
  2⤵
  PID:8208
- C:\Windows\System\qoGPIND.exe
  C:\Windows\System\qoGPIND.exe
  2⤵
  PID:4544
- C:\Windows\System\UoDRuMx.exe
  C:\Windows\System\UoDRuMx.exe
  2⤵
  PID:12856
- C:\Windows\System\hXILFwE.exe
  C:\Windows\System\hXILFwE.exe
  2⤵
  PID:8944
- C:\Windows\System\JXQUNtg.exe
  C:\Windows\System\JXQUNtg.exe
  2⤵
  PID:7888
- C:\Windows\System\fEeCGoe.exe
  C:\Windows\System\fEeCGoe.exe
  2⤵
  PID:12308
- C:\Windows\System\kQlaVQE.exe
  C:\Windows\System\kQlaVQE.exe
  2⤵
  PID:11848
- C:\Windows\System\nANdIIc.exe
  C:\Windows\System\nANdIIc.exe
  2⤵
  PID:10380
- C:\Windows\System\fRdOFep.exe
  C:\Windows\System\fRdOFep.exe
  2⤵
  PID:12948
- C:\Windows\System\XhCOUQc.exe
  C:\Windows\System\XhCOUQc.exe
  2⤵
  PID:4688
- C:\Windows\System\nIxBrvt.exe
  C:\Windows\System\nIxBrvt.exe
  2⤵
  PID:1436
- C:\Windows\System\fNOCEwH.exe
  C:\Windows\System\fNOCEwH.exe
  2⤵
  PID:4036
- C:\Windows\System\DHoePkD.exe
  C:\Windows\System\DHoePkD.exe
  2⤵
  PID:13476
- C:\Windows\System\METPSUx.exe
  C:\Windows\System\METPSUx.exe
  2⤵
  PID:13520
- C:\Windows\System\FauTkdM.exe
  C:\Windows\System\FauTkdM.exe
  2⤵
  PID:13548
- C:\Windows\System\GtWRuvg.exe
  C:\Windows\System\GtWRuvg.exe
  2⤵
  PID:13580
- C:\Windows\System\OghNgXu.exe
  C:\Windows\System\OghNgXu.exe
  2⤵
  PID:13692
- C:\Windows\System\srIZFAN.exe
  C:\Windows\System\srIZFAN.exe
  2⤵
  PID:13720
- C:\Windows\System\HWPHusg.exe
  C:\Windows\System\HWPHusg.exe
  2⤵
  PID:13736
- C:\Windows\System\hRiNsJY.exe
  C:\Windows\System\hRiNsJY.exe
  2⤵
  PID:13756
- C:\Windows\System\RpTSKah.exe
  C:\Windows\System\RpTSKah.exe
  2⤵
  PID:13976
- C:\Windows\System\XpQQmHd.exe
  C:\Windows\System\XpQQmHd.exe
  2⤵
  PID:14184
- C:\Windows\System\PNdGugc.exe
  C:\Windows\System\PNdGugc.exe
  2⤵
  PID:14220
- C:\Windows\System\GAmJFJl.exe
  C:\Windows\System\GAmJFJl.exe
  2⤵
  PID:14328
- C:\Windows\System\xDyWGqO.exe
  C:\Windows\System\xDyWGqO.exe
  2⤵
  PID:13208
- C:\Windows\System\yMaCVLr.exe
  C:\Windows\System\yMaCVLr.exe
  2⤵
  PID:7064
- C:\Windows\System\UsDcnGE.exe
  C:\Windows\System\UsDcnGE.exe
  2⤵
  PID:12952
- C:\Windows\System\fGDSHlO.exe
  C:\Windows\System\fGDSHlO.exe
  2⤵
  PID:13320
- C:\Windows\System\TJABtZM.exe
  C:\Windows\System\TJABtZM.exe
  2⤵
  PID:7848
- C:\Windows\System\edFuTyT.exe
  C:\Windows\System\edFuTyT.exe
  2⤵
  PID:13364
- C:\Windows\System\sXrFClW.exe
  C:\Windows\System\sXrFClW.exe
  2⤵
  PID:11964
- C:\Windows\System\UkdmkVe.exe
  C:\Windows\System\UkdmkVe.exe
  2⤵
  PID:13512
- C:\Windows\System\SMxZGFL.exe
  C:\Windows\System\SMxZGFL.exe
  2⤵
  PID:13668
- C:\Windows\System\huUuPCx.exe
  C:\Windows\System\huUuPCx.exe
  2⤵
  PID:13672
- C:\Windows\System\nmaYFTy.exe
  C:\Windows\System\nmaYFTy.exe
  2⤵
  PID:13732
- C:\Windows\System\RMonbHG.exe
  C:\Windows\System\RMonbHG.exe
  2⤵
  PID:13700
- C:\Windows\System\sTzUUzo.exe
  C:\Windows\System\sTzUUzo.exe
  2⤵
  PID:13840
- C:\Windows\System\rvCyANA.exe
  C:\Windows\System\rvCyANA.exe
  2⤵
  PID:13660
- C:\Windows\System\uoflvJb.exe
  C:\Windows\System\uoflvJb.exe
  2⤵
  PID:13864
- C:\Windows\System\OoycMyZ.exe
  C:\Windows\System\OoycMyZ.exe
  2⤵
  PID:13944
- C:\Windows\System\MNRrLNP.exe
  C:\Windows\System\MNRrLNP.exe
  2⤵
  PID:13896
- C:\Windows\System\PVPnDMk.exe
  C:\Windows\System\PVPnDMk.exe
  2⤵
  PID:13680
- C:\Windows\System\YZEqYVE.exe
  C:\Windows\System\YZEqYVE.exe
  2⤵
  PID:14128
- C:\Windows\System\hjHXKuY.exe
  C:\Windows\System\hjHXKuY.exe
  2⤵
  PID:13252
- C:\Windows\System\sruXRrf.exe
  C:\Windows\System\sruXRrf.exe
  2⤵
  PID:14272
- C:\Windows\System\jEgyQqZ.exe
  C:\Windows\System\jEgyQqZ.exe
  2⤵
  PID:9708
- C:\Windows\System\fACoVMl.exe
  C:\Windows\System\fACoVMl.exe
  2⤵
  PID:14124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:11144

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 716 -p 13068 -ip 13068
1⤵
PID:11964

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 844 -p 11144 -ip 11144
1⤵
PID:12856

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 844 -p 12380 -ip 12380
1⤵
PID:7848

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 512 -p 10544 -ip 10544
1⤵
PID:13864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_jk2ruj5s.yxw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jk2ruj5s.yxw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AqKXXFy.exe

Path C:\Windows\System\AqKXXFy.exe
Size 1.5MB
SHA256 a00d9b9dfb0363fa8bfcc1645bc47880dc50d46e95640ec9d72a715b7bf9fff9
MD5 1b924a9d0f20e69d9710b72cffe2f228
SHA1 cbb0b4cfdcc4f2b376cc85741e27d700f53d1fe2
SHA512 b1e5f667d98baa8f1baa99de01ccc3682057d5bf94a43c79fd0b73730409669c1ca5e35efa2a80c05655095496e59a5c0648eeb1f1f6e7e79bb322063a9b8f71
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f3:Lz071uv4BPMkiqtI+ijRzY8Gw3
MD5 SHA1 SHA512 SSDEEP

Submit Download

EBBoMFQ.exe

Path C:\Windows\System\EBBoMFQ.exe
Size 1.5MB
SHA256 0f679d503c13c2effc142ce28362461a34c619f5300cbcc47fb1b6215d55446e
MD5 b83b23cbad46f6bc8be6ef80c6c56f94
SHA1 648249158ce91a39c554eadd4118a6ab07ebebc1
SHA512 ced2acf023c08c00a2120e4fae8866ad924d33f0e04567ec385e905ed6d9a638792b2110ebd3861a73e9d4cc7d7760204ceaab09f3c3357124027309d394f07f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f2:Lz071uv4BPMkiqtI+ijRzY8Gw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

FSiNZMI.exe

Path C:\Windows\System\FSiNZMI.exe
Size 1.5MB
SHA256 88a1218db32dd8eac5d507ca306935960ab089333b9046402c343413a3293641
MD5 dd6318a0b7fc7c3e526803a7bcd458d3
SHA1 cd4e3f09772cc660099f82dedd8886f7a6592dcc
SHA512 4c900c6a9fb9bf1e7bc1677920f1f0602dcf1c4098ee67bb33ba944aad7847c52f39ec46b7dd7b606c17f14b3a34715d29444529ab54e0274ae34c4ad1619b78
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f6:Lz071uv4BPMkiqtI+ijRzY8Gw6
MD5 SHA1 SHA512 SSDEEP

Submit Download

IMfOeIn.exe

Path C:\Windows\System\IMfOeIn.exe
Size 8B
SHA256 ebec1be56406b8ccda98c6ae40713b17ab0e77787c03fa110b421dcd4ed20236
MD5 3989110bf28e1752d8354fc44aee0a5a
SHA1 2d341ede84fcdf1393cbc1c69b98173c16076de5
SHA512 05d90fae41717bc7686b0f44550f09d1b8636af054b5f3ca56692a92791caee36e681dc16ad6673b593b02851b240971a152f999e8c1a1c5d0d92fad9fcf82a2
MD5 SHA1 SHA512

Submit Download

MIvWcQv.exe

Path C:\Windows\System\MIvWcQv.exe
Size 1.5MB
SHA256 f73f1a670c27f0b1314b121e85d71965c5c2f8a67ada10d6600a794f3f229bdf
MD5 0b956fe7b14f527047e36ed359ea51a2
SHA1 e9901bbeb56d125109618331e6a51ddd7cced2e8
SHA512 14675c12375e4b129f698419856e215e052498979287618901f8c41b4485559ea99213464c3acbafd44c6a87f65510f08d1d92646e12c0d658fd30c0f703d8fb
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fP:Lz071uv4BPMkiqtI+ijRzY8GwP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MjknQdj.exe

Path C:\Windows\System\MjknQdj.exe
Size 1.5MB
SHA256 af6b827a9f69021cd07d4c2306735f3bdac0e4f1aaeac1bf638e4004d8472740
MD5 71132f598f0ace516b11482eb2267bf0
SHA1 f5c80fabf2e0fcb9b58e67c05bf36057f01572e9
SHA512 cdcbd189b7775cd74101c9119c9bc4cb439de0cfc8cfcac583388142f4fd3f70e2db4fb4a569741ccdd624920544285827f02d30d1080be382d63649865fb009
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fR:Lz071uv4BPMkiqtI+ijRzY8GwR
MD5 SHA1 SHA512 SSDEEP

Submit Download

NRSldyp.exe

Path C:\Windows\System\NRSldyp.exe
Size 1.5MB
SHA256 47bfcec2359a45082f4a93c4ef18a650db33ca8150a444d923fcf6458653323c
MD5 5b78caddd69fb26a34dec1400893bd70
SHA1 232079a5d5b949f4e4e44095c11521f17fd35bc2
SHA512 3b515d7c0a4074ef3bcd5ed71050f07d4fe64ce2eb81ddaf7eb4960781629ff8369591b7c14a7ebcfb9697fc6e95afb8cf9c5ba262758e2de858106344b08256
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f9:Lz071uv4BPMkiqtI+ijRzY8Gw9
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvZQFYa.exe

Path C:\Windows\System\NvZQFYa.exe
Size 1.5MB
SHA256 51b0d2775d0d9d718279c813b499de4668f3e97a10af83271895fe9e643430c7
MD5 777b1b5cefdc4bd508794334c5bfada7
SHA1 c4050ec617133620c5157a28a75e991c7c329253
SHA512 1183b0b87c87ac2921a52f85ece9b031390756e1158fe68ebc572af652e42018818b6e4aca47317c47a6786d48a93b61087dd2e7faf50c03b09a7b537264a9ee
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f62:Lz071uv4BPMkiqtI+ijRzY8GwL
MD5 SHA1 SHA512 SSDEEP

Submit Download

PTaNjmo.exe

Path C:\Windows\System\PTaNjmo.exe
Size 1.5MB
SHA256 c31679c356eee6d95d49ba64b4b5c4260e190dce9e76757b22fd1424a1312bd9
MD5 125148162d2487fba396742701ad1c88
SHA1 2ce8518bb2be6b65b4ad91d14cc8d40935d59f9e
SHA512 972189bc1ee250916eca8757d0c837f94944f9b72cc233ef4c2cdc3c845e4fb5571dbfac7024189c333e8c06f50018bf14593ead7e908fe7cced2db5cf572c7c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fo:Lz071uv4BPMkiqtI+ijRzY8Gwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

QXQlRBp.exe

Path C:\Windows\System\QXQlRBp.exe
Size 1.5MB
SHA256 f137c1db60fb02799e6d612a6ba0f76d5970063b7d10b372df38665c01704b5e
MD5 56c017c72b5d3a1b34ea89652f7d8a93
SHA1 eceddfb31427643a1cf3e1eb4506005a03057af3
SHA512 640947060d44c62f9472ea7d21d6a634305af43c5094b446d41940b369e2fcc2617082d669f7f7e71dfb2b79dcdb8604781fb88f5f57eee243017392688b68e9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fCL:Lz071uv4BPMkiqtI+ijRzY8Gw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

QqAhexe.exe

Path C:\Windows\System\QqAhexe.exe
Size 1.5MB
SHA256 7e078182b396dc446c2a87182393d8efb2b43c143189d2e045a79c358cfee05b
MD5 227afa38cd7430f71dd7e3b10e0514ab
SHA1 eeff0cb2c488b5996217af71c914ab10f96578c4
SHA512 55ce409bfcbc4739f9249fe362c3c8f37078a82d12b32cc6719f2ca49d3293de1bc9da269e1d18e60ddad951201fa6343cff38dbcde61059d21de4c2b4d35538
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f6:Lz071uv4BPMkiqtI+ijRzY8Gw6
MD5 SHA1 SHA512 SSDEEP

Submit Download

SomRTUl.exe

Path C:\Windows\System\SomRTUl.exe
Size 1.5MB
SHA256 cdcb8ab97532da8470e6f4631adfa13b49c91cf36de6aeeec76053699fb265b4
MD5 d99504c8bcbd3a1dafd4807ede6fdcbf
SHA1 da01ab9154bb10ec5c438105cc036f7d7f1a9a95
SHA512 6811a2f247291b49bd68c81d0771593f2ab1d18ac7b32b212cc89c34c72176a3e888f860e9b3c6f6bb5ea30ceb0d64c51f3923c163a3b4d3e49c5fd60a719ea1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f27h:Lz071uv4BPMkiqtI+ijRzY8GwEh
MD5 SHA1 SHA512 SSDEEP

Submit Download

VNiWagu.exe

Path C:\Windows\System\VNiWagu.exe
Size 1.5MB
SHA256 ac289d07359c2e5bb9304fe24ae18874d39547966bf1f81a8ceb310370b3ea0d
MD5 98e0dcf8b199832c59c63d3bef955fb3
SHA1 47f9e472b5f5c3cb5eb8d7d92a97f3aadde4826f
SHA512 637c9b47182e83ca311af400952bb30f321c264824f60402154d29fa56cf795f355c145dca08150e4b13d785811abcda392d409254b8a6708f99d289b8945b25
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f7:Lz071uv4BPMkiqtI+ijRzY8Gw7
MD5 SHA1 SHA512 SSDEEP

Submit Download

VmqPouk.exe

Path C:\Windows\System\VmqPouk.exe
Size 1.5MB
SHA256 3e9d4bcd995e95e2fd5b51f23d7e22a02d6b724bea043ea06dc4351bd92a19e1
MD5 5dd1b606a706202c8ea52d9f8a0c4593
SHA1 eb0a0b100863d3e2a6d2b7c7943c8fe86eef9829
SHA512 0b5d31bc02f5a9a660c360966d12fc1abe12618f2a257c502ed39a42d73b22ba0e9b6eb909509d437f967299ab5f3bf84634252de5e1793b4fa0b324a43d1727
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fS:Lz071uv4BPMkiqtI+ijRzY8GwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

WUUvLnj.exe

Path C:\Windows\System\WUUvLnj.exe
Size 1.5MB
SHA256 5ea16dbc4e94c6a07e4521fd0fc36ac930a6390d5522fad0a44b70d4450ba1f3
MD5 da9612ae3e6807fa54fcf6fd8f2548e6
SHA1 2718f3e3fd7861278a27863b0f9a65c4b1643c2a
SHA512 8a56f78c7fd36ee278146942a8f3c8ba915a6a19883f3ae51bc1cdacb05a626ba5a4384c82e691c36895a3adee6d18d5bbc3d473ec04b78fc07720ef90b9624b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fh:Lz071uv4BPMkiqtI+ijRzY8Gwh
MD5 SHA1 SHA512 SSDEEP

Submit Download

WZKcpYs.exe

Path C:\Windows\System\WZKcpYs.exe
Size 1.5MB
SHA256 1c9223af1c1e9353990d0a633db51c5a39e9dc893b8b5ff138b49cd7e80a3f46
MD5 4570f58811563ca4f2c5326b2f5686e1
SHA1 b9a26dc5063653c0704d8db2f0ace6a99ce66bfb
SHA512 3eeeaf77cb0c9d00a3321c94ea6126ad5a19cac07e2c8a5faa185e7da82a48893dc2e38e9b3c107a7595022ee12850bd7a458d2e08e238693f5acedb7f7af5e3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f3:Lz071uv4BPMkiqtI+ijRzY8Gw3
MD5 SHA1 SHA512 SSDEEP

Submit Download

XZCfEzq.exe

Path C:\Windows\System\XZCfEzq.exe
Size 1.5MB
SHA256 adab620bfa342c3444b399a6aa199ab3229422dd9c0988e018f7e33627a60c50
MD5 f61903480580922a41528a1f3e164ff9
SHA1 c5daede3268af8d13cb69c59a04a58a8ac4b4835
SHA512 2601132a7275c1180ad5c5890d5fa0eca0555b08397f1e59b8888f8d93b002d92b10c7300c334234e4252a87fdeb9f243c41b2d8dc1598f39a86571e088084a1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f1:Lz071uv4BPMkiqtI+ijRzY8Gw1
MD5 SHA1 SHA512 SSDEEP

Submit Download

XyFATIH.exe

Path C:\Windows\System\XyFATIH.exe
Size 1.5MB
SHA256 723af133a899141bc26d20723791f0ce8ff874f96b21fd80df947ada73a4df84
MD5 70081e6b8b4066edc0a6072aaf285914
SHA1 e39e743d4bc7b085ec991b94f328cd0deb2cddfa
SHA512 88ca5d81171b207ca3840ad98b157c1132c81f89c40d57d7b58ffdf5390b2bdd508b36703c86de44434ca99cf8ac41482c89bc8b725934a4b51a099e9a564555
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fw:Lz071uv4BPMkiqtI+ijRzY8Gww
MD5 SHA1 SHA512 SSDEEP

Submit Download

YBcRWSN.exe

Path C:\Windows\System\YBcRWSN.exe
Size 1.5MB
SHA256 69d8f293be1f11c6c29afa1b02a81c405b4fb973375d9f1344a0e0dde0873532
MD5 1cdd47cfd75a09aa1c3156a0493b2fb0
SHA1 7023f12d28c4d06fa5066e4f3cd8c8cc50e455f7
SHA512 253f95eba45cc5873cba778fd2b16b64ed7314b071c6b7ba195a72ad3ce181d604a346531fdc3e5c865c49f9d6c6f171bac61073521e9e840e80c8a9b148d3b0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fqa:Lz071uv4BPMkiqtI+ijRzY8Gw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZraOReu.exe

Path C:\Windows\System\ZraOReu.exe
Size 1.5MB
SHA256 8f3aa9c4ae39df6c6590aab2c6ce5c4cf3eb537de042403cf46bdb981ca15eb2
MD5 af5f104a4e6171df71bf8695adf52a48
SHA1 039b8ff5cf698e6905e0c61cdf3b8ad16b204219
SHA512 cc3b9e87c64999fa14fbc840d2ec30dbe26034979d8a1500e9f48682975428c1d07d0506192b0564cf92da3fc1928937f11cfce922c652ebae9a00fbdf402f3f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fw8:Lz071uv4BPMkiqtI+ijRzY8GwZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZyAKVUL.exe

Path C:\Windows\System\ZyAKVUL.exe
Size 1.5MB
SHA256 e619906b43fc3ad06d9e9f681e47a365ae83e8b6e518c125540bac8f9079805b
MD5 6d15c765fa0c353693db5e15b2d069e8
SHA1 69f18c729a4d8b9fab78b1b7c8eed83e9c89e369
SHA512 88b65e9106630bf015afbdb3f4d9379b873177b3a2fd17193d759dbb0ea06d4ef2f5d185361e970f49665e5f4d1c8dd34f45423fe06903d771fa2bc3e8c98043
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fI:Lz071uv4BPMkiqtI+ijRzY8GwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

afWYgQa.exe

Path C:\Windows\System\afWYgQa.exe
Size 1.5MB
SHA256 833d59b0200dff2907584ea416fdfdd9a2eac717b083012ecf8741827a6d71b9
MD5 5e07174100b5bff9286eea355cd7ff76
SHA1 babbead348a270633c8251022c7b4d788dabd984
SHA512 154d065eebd9c76ccf210021cb72f0cefc3a932f86742ca72a8809a65903f809ddc963143b6cf32610f2af27f265ccd4a4dd72605f646c24e0881e4f0c1beee5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fH:Lz071uv4BPMkiqtI+ijRzY8GwH
MD5 SHA1 SHA512 SSDEEP

Submit Download

csLQwKg.exe

Path C:\Windows\System\csLQwKg.exe
Size 1.5MB
SHA256 b0e01870f321f78a403065eb71d6b7c0470827234fdee75b625958c91753b98a
MD5 7360b7e247578a9ef43a3bbb55a8cb35
SHA1 83fc4d665e3873f5b64fc9bd161b92bd868febd6
SHA512 4a6faa9de06812fd92e43fc6af2a5119ccf5121f1ed6a12e433070efa875b90dc7b714c467c8ac2d36c995b311c5beee7d152825dacba02e77739ff8278fad43
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1ff:Lz071uv4BPMkiqtI+ijRzY8Gwf
MD5 SHA1 SHA512 SSDEEP

Submit Download

dlPUSJK.exe

Path C:\Windows\System\dlPUSJK.exe
Size 1.5MB
SHA256 cb671826fa505c2878e330b396385c717d34ddb30bac07498ef7c605c61ff21a
MD5 ff8332ec3854e247bb051db206f69606
SHA1 f3bf196cdbb906e5ee9a68e46813f7fb63a77f8f
SHA512 60ff918aa0b3c8391dbf4326672902623aac9c63a0bace4f1833da6f73199d61bcd5c09b2b99efcb1defe8bd183e089ee796f54729e7d65a59ad4bb96d743d7f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fb:Lz071uv4BPMkiqtI+ijRzY8Gwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

gCAfaQP.exe

Path C:\Windows\System\gCAfaQP.exe
Size 1.5MB
SHA256 546ed238893f639fcb6b2b4055841b89b0ce48ae38ffcd547a7f541187d31faf
MD5 e7c6b545f3aa9d7589f9f6f6372700ad
SHA1 7bc9136f18214674b25babd7cd99a35d26f25bcb
SHA512 1f63c0b0471b789f2f5f49b6ba4484bf412019475211b7e112afe85fa2a9eb8fee2f3586954878faddd464465b1c03c594643d6ab6b2a603810cc1616fb1cd8c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fn:Lz071uv4BPMkiqtI+ijRzY8Gwn
MD5 SHA1 SHA512 SSDEEP

Submit Download

gXrytCx.exe

Path C:\Windows\System\gXrytCx.exe
Size 1.5MB
SHA256 1d7b089f3b3b799fc788f0a5971b5ca2654747d86e6c8e667c320e1eeaf58cc7
MD5 3cfb04b7694521877589e46b542906df
SHA1 8a1799e19d8def21f9bb2df01dd65afe64036278
SHA512 99336db1cec0ec138e24598891f8360d854ed25d742cb72442dcf983ea6f8226e14e8cabe8e4957c677c7d81ec685785928c3039c1b850862e18d15934226cd9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fY:Lz071uv4BPMkiqtI+ijRzY8GwY
MD5 SHA1 SHA512 SSDEEP

Submit Download

geYdsBO.exe

Path C:\Windows\System\geYdsBO.exe
Size 1.5MB
SHA256 7f0bbfa2e9d1fb437d823921c33d907a8370b40f65f660fc9d8fc5590bb63921
MD5 65b751932a809297a2574a02562870c5
SHA1 c069f1e5a95fb052dea320e4ca9770b8d1be871c
SHA512 5ffca8fc0db6cd61c424b007a9b7d09949bc0f993c44f4acb09152f690a311245336e28767f348d26d7ffe9b326bd9af9c36f79422d737b2771c8a736d1df0a0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fS:Lz071uv4BPMkiqtI+ijRzY8GwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

geYdsBO.exe

Path C:\Windows\System\geYdsBO.exe
Size 1.2MB
SHA256 f78171a8b39300fdf7f031f3712ca07a354c160f57bff89508581ee92c455c5d
MD5 0c589e2df16c21cd288f849be8c01565
SHA1 397205ec94645360fa6e378153aa260f2969990c
SHA512 17ac277e0f8510754706c62443444a77f3469e43f3b8c1209e901ced3c0b620fa58198ac047611f94a018f0337017e178cb1e597ac6a1f4065cfddb72e2d9925
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDS:Lz071uv4BPMkiqtI+ijRzS
MD5 SHA1 SHA512 SSDEEP

Submit Download

jfxpIaA.exe

Path C:\Windows\System\jfxpIaA.exe
Size 1.5MB
SHA256 196e4c13f97effb76ca4d480d81ce1c57400db218532eb3a0da48a505a705fc7
MD5 76cc7318bb35b9a6593d904f17efe4fa
SHA1 85868243cab51653e78c811e186378951e1d0e8a
SHA512 006d0438c9a15a101f7efc5bab08c4f40e004510cd913ef32bf1f70fb640923cab7d40351333cc1074c05b71032db8b515452bc20547f923e8ccf6f23e988fd4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f/:Lz071uv4BPMkiqtI+ijRzY8Gw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

kuqQqrQ.exe

Path C:\Windows\System\kuqQqrQ.exe
Size 1.5MB
SHA256 a4fcf421fc7bef2784c4dd4a4ad7e99d3aded935d0e4412ee5d2027a05f99a48
MD5 42fa6bd190373094d717a0b1bdb76d2e
SHA1 db2a1f2e772a97dae76a21c15a6faf42d89ebfc8
SHA512 cc84afe979440c21b4ae06a0916f792204905a8d24e5e2fa63d57b0168b1206b09a71ecad9f16586dde7ce016512e3dc4caf3de4927554b9126165d66143144b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fZz:Lz071uv4BPMkiqtI+ijRzY8GwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

liCZTXa.exe

Path C:\Windows\System\liCZTXa.exe
Size 1.5MB
SHA256 8d5413825c6fc3b226d4eb21ff249d73326878eecd67a9bafa612b27ed72c2bc
MD5 f8e4c312a8ebe7d17ea20d47fef8e34e
SHA1 eafdcc41b66281a4efef09ac803011c4f802e716
SHA512 6737e288af6fad3080c341fff58a9ef40ae0542f4dd32b7919d565daea6fb7e26b3e17bfbdee9ec9914dbd4feb1463509d3f42ac0d5590b7ca92fc0a18c3443d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fc:Lz071uv4BPMkiqtI+ijRzY8Gwc
MD5 SHA1 SHA512 SSDEEP

Submit Download

llUTtoC.exe

Path C:\Windows\System\llUTtoC.exe
Size 1.5MB
SHA256 22f2d2343664eb8b56d7f6deae3a2ac797a81700e00f4d49d231e8dc49527ca1
MD5 69268401d72ae15c1045ab220e34dae4
SHA1 c4f8f06f11b68f1892ad787d81ae41476f0e7eea
SHA512 dc2d03086b0a9d00befc626984e7b88429066f2048a14b211f60d88850be96511a56dafcb20ad0af6e3d5d1c4ba7021bbc32411a036b5813cf701a2c28ca3d3a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f9:Lz071uv4BPMkiqtI+ijRzY8Gw9
MD5 SHA1 SHA512 SSDEEP

Submit Download

mxoWTos.exe

Path C:\Windows\System\mxoWTos.exe
Size 1.5MB
SHA256 bee9a9b8c1b1047f940b32f3a09f60851e3af1acccb11eba346ab8db0e8f41db
MD5 ff82b1e6c94b16336527ee62c477be5a
SHA1 befe478355e5a41367a3b43c682d943b3a0ae446
SHA512 5c7bd899bdc115b48ce5ae8f9bf79984d7b8f7afbb8f9d6acbe6e7546a8e192709d62312fbcfb859cdcb7abe3a1f917da5f149ad0fc23329ea36b834517c3656
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fI:Lz071uv4BPMkiqtI+ijRzY8GwI
MD5 SHA1 SHA512 SSDEEP

Submit Download

nJiFxqm.exe

Path C:\Windows\System\nJiFxqm.exe
Size 1.5MB
SHA256 1bc7ae3ea589c57703e9f9bb05389ea10cd44e0f8ce455dd8d65145008bfaa2a
MD5 e7864b5338405c33da21f27d845efafd
SHA1 56bcbc7b493e7b95571ecf613d97d444d8ef8d0e
SHA512 1c291240883d1c8b8964e9e81cc0721b1b0238c401280437c76bf4b8d395a6d965e7d11466bc8fd9c176bc0b01fa76e0fe886d787c87bee7cce80377b530e097
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f2:Lz071uv4BPMkiqtI+ijRzY8Gw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

pazQQov.exe

Path C:\Windows\System\pazQQov.exe
Size 1.5MB
SHA256 06922c3e59495f4b4e3dfd93ce362c4959bae64db982b989d79402908c98118f
MD5 d6be992519d08cfe3890e17ce21ae87a
SHA1 4c1e1d5706494595be2a6a7ec50b24fd7cf9e97d
SHA512 12a2c835eb497df536bb72c460fe7aef1114dc28c6c967eebab83cd95468e636c64fa220ac9da01f794244f2efcb64d2bd21bc4c9494690c67bb0eb2b79b629a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fP:Lz071uv4BPMkiqtI+ijRzY8GwP
MD5 SHA1 SHA512 SSDEEP

Submit Download

qMZRqyg.exe

Path C:\Windows\System\qMZRqyg.exe
Size 1.5MB
SHA256 eb52ca91a7f52356e2a5367456a911a45cf9d85c2bf265b8aeeffadbb79fa5da
MD5 d4874bb106188881e03c349f5378de2b
SHA1 689293ad1a92da57933eb00c9bda859b15c052db
SHA512 52bfc6e703e58115fadb8510a97a02c16d5565defa1ea8acdf0fc12d934cd3d25ab941654709f37452e11caa08cb9d5fdfeb4ab3eacdeea4f4b659dab62ef0bd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fd:Lz071uv4BPMkiqtI+ijRzY8Gwd
MD5 SHA1 SHA512 SSDEEP

Submit Download

qvkCLox.exe

Path C:\Windows\System\qvkCLox.exe
Size 1.5MB
SHA256 fca143b1c9388d608f57d7373280571508ff9fa6e41c0e3f7bb2dd0058c7a83c
MD5 f1c159bb7ef684595724963c1d8d4c14
SHA1 50e225fd35c41f45f47517584b46d533ac7a93df
SHA512 19b6a7da3afb2fc1931d3a0fee04192dcd112aae953cce2a8113199afde465e1e4af37ae67bf1755ca91f096b73f6612ecbbf5d3ff366e597ca7ff0613a5abfd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f/:Lz071uv4BPMkiqtI+ijRzY8Gw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzMErbP.exe

Path C:\Windows\System\qzMErbP.exe
Size 1.5MB
SHA256 a30268043a976cf87e2e6ed3847b3ffa9bc1ec4c28328d453b77bcf7321e6891
MD5 00b3789ef8d364fdb3f872c62ad9bd04
SHA1 187cdb1d41e7d02edbafc15e6c5a820b2301daa7
SHA512 f71f6dde79a9d3ba9d0934de28fe3122697abe34331d46077479db7443f77a40152874171e3776918d0d8368e7d31f9a002aba2ed11f1b4e7265bf0f8f1270af
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fls:Lz071uv4BPMkiqtI+ijRzY8GwS
MD5 SHA1 SHA512 SSDEEP

Submit Download

rBVDgqu.exe

Path C:\Windows\System\rBVDgqu.exe
Size 1.5MB
SHA256 da018ebfcff46c8669daa3b19c1e3e6e15a01e9bb14f7e32a155150a08b2e596
MD5 68880198341f67edb18259884401c89f
SHA1 1369c454792f5fdd1a8e68323ac67bda64e4927c
SHA512 49c69c088574aa4656da2860097141c088b00c6de6420f9fd21213719bc7861d16a566bf4b96cd46f1edab8aedaf24948d0f462352e6c746506494f07dcffff1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1f2:Lz071uv4BPMkiqtI+ijRzY8Gw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

rDCVXQq.exe

Path C:\Windows\System\rDCVXQq.exe
Size 1.5MB
SHA256 cce2b95a255504c5d84da28874b1fbf96af7047bc758b0cf9842d89851e895a7
MD5 b8aac61b57b7e5fc466dbfabe5d31d25
SHA1 3aa52d720c4120c547fc02c64a605fe3ea5fb5e1
SHA512 104eb3ee54f011a5a073db7e490dc8730e63bc524c73ea497a9bb9271910f56b85d0f4ea0bfcf06d7a4a384119a87a9fc8876255bea586a2728f78b912eabf4d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fc4:Lz071uv4BPMkiqtI+ijRzY8Gwc4
MD5 SHA1 SHA512 SSDEEP

Submit Download

yCgRCRR.exe

Path C:\Windows\System\yCgRCRR.exe
Size 1.5MB
SHA256 8de33ff34865b1db24efa696e19b7d492340c6bfb34a5cfa6966e65e792421d0
MD5 effd4621b9efc4f424a993edd3d5ab4b
SHA1 8d4f378282604ce08a09eca4949feac68a09a097
SHA512 74a763f652ba8cae7cd3e4079074009101ebc8a1e764d827f1ecda27a0b94d69c4e8c4e82ab7dd42d738f1b67625bd3228fdd9ea73645f7404dce7f447b57cd9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipctp++Ft4mzS1jRtbpDYNetZrBXADo1fo:Lz071uv4BPMkiqtI+ijRzY8Gwo
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1044-3611-0x00007FF720AD0000-0x00007FF720EC2000-memory.dmp

Download

memory/1044-12-0x00007FF720AD0000-0x00007FF720EC2000-memory.dmp

Download

memory/1232-285-0x00007FF781180000-0x00007FF781572000-memory.dmp

Download

memory/1232-3645-0x00007FF781180000-0x00007FF781572000-memory.dmp

Download

memory/1360-490-0x00007FF6A8B00000-0x00007FF6A8EF2000-memory.dmp

Download

memory/1360-3653-0x00007FF6A8B00000-0x00007FF6A8EF2000-memory.dmp

Download

memory/1528-3628-0x00007FF74F770000-0x00007FF74FB62000-memory.dmp

Download

memory/1528-238-0x00007FF74F770000-0x00007FF74FB62000-memory.dmp

Download

memory/1736-3629-0x00007FF6CA210000-0x00007FF6CA602000-memory.dmp

Download

memory/1736-286-0x00007FF6CA210000-0x00007FF6CA602000-memory.dmp

Download

memory/1764-499-0x00007FF6219B0000-0x00007FF621DA2000-memory.dmp

Download

memory/1764-3623-0x00007FF6219B0000-0x00007FF621DA2000-memory.dmp

Download

memory/1896-494-0x00007FF775560000-0x00007FF775952000-memory.dmp

Download

memory/1896-3655-0x00007FF775560000-0x00007FF775952000-memory.dmp

Download

memory/1948-59-0x00007FF7D55A0000-0x00007FF7D5992000-memory.dmp

Download

memory/1948-3618-0x00007FF7D55A0000-0x00007FF7D5992000-memory.dmp

Download

memory/2140-3638-0x00007FF624080000-0x00007FF624472000-memory.dmp

Download

memory/2140-399-0x00007FF624080000-0x00007FF624472000-memory.dmp

Download

memory/2232-3641-0x00007FF7AEBA0000-0x00007FF7AEF92000-memory.dmp

Download

memory/2232-492-0x00007FF7AEBA0000-0x00007FF7AEF92000-memory.dmp

Download

memory/2268-3642-0x00007FF6E5920000-0x00007FF6E5D12000-memory.dmp

Download

memory/2268-491-0x00007FF6E5920000-0x00007FF6E5D12000-memory.dmp

Download

memory/2400-1-0x000001A9B4E20000-0x000001A9B4E30000-memory.dmp

Download

memory/2400-0-0x00007FF671D20000-0x00007FF672112000-memory.dmp

Download

memory/2592-3669-0x00007FF636C90000-0x00007FF637082000-memory.dmp

Download

memory/2592-489-0x00007FF636C90000-0x00007FF637082000-memory.dmp

Download

memory/2984-3673-0x00007FF64F7D0000-0x00007FF64FBC2000-memory.dmp

Download

memory/2984-495-0x00007FF64F7D0000-0x00007FF64FBC2000-memory.dmp

Download

memory/3032-118-0x00007FF63E250000-0x00007FF63E642000-memory.dmp

Download

memory/3032-3619-0x00007FF63E250000-0x00007FF63E642000-memory.dmp

Download

memory/3160-3657-0x00007FF698490000-0x00007FF698882000-memory.dmp

Download

memory/3160-496-0x00007FF698490000-0x00007FF698882000-memory.dmp

Download

memory/3340-3651-0x00007FF7D3420000-0x00007FF7D3812000-memory.dmp

Download

memory/3340-324-0x00007FF7D3420000-0x00007FF7D3812000-memory.dmp

Download

memory/3492-3625-0x00007FF60F8F0000-0x00007FF60FCE2000-memory.dmp

Download

memory/3492-500-0x00007FF60F8F0000-0x00007FF60FCE2000-memory.dmp

Download

memory/3624-3647-0x00007FF679630000-0x00007FF679A22000-memory.dmp

Download

memory/3624-501-0x00007FF679630000-0x00007FF679A22000-memory.dmp

Download

memory/3640-3622-0x00007FF74F0B0000-0x00007FF74F4A2000-memory.dmp

Download

memory/3640-179-0x00007FF74F0B0000-0x00007FF74F4A2000-memory.dmp

Download

memory/3912-3632-0x00007FF70B650000-0x00007FF70BA42000-memory.dmp

Download

memory/3912-85-0x00007FF70B650000-0x00007FF70BA42000-memory.dmp

Download

memory/4504-497-0x00007FF760D50000-0x00007FF761142000-memory.dmp

Download

memory/4504-3661-0x00007FF760D50000-0x00007FF761142000-memory.dmp

Download

memory/4620-180-0x00000222C8DD0000-0x00000222C8DE0000-memory.dmp

Download

memory/4620-25-0x00000222C8DD0000-0x00000222C8DE0000-memory.dmp

Download

memory/4620-498-0x00007FFB06F83000-0x00007FFB06F85000-memory.dmp

Download

memory/4620-573-0x00000222C8D90000-0x00000222C8DB2000-memory.dmp

Download

memory/4916-493-0x00007FF77E710000-0x00007FF77EB02000-memory.dmp

Download

memory/4916-3663-0x00007FF77E710000-0x00007FF77EB02000-memory.dmp

Download

memory/4944-3633-0x00007FF606690000-0x00007FF606A82000-memory.dmp

Download

memory/4944-325-0x00007FF606690000-0x00007FF606A82000-memory.dmp

Download

memory/5064-3636-0x00007FF7B0A40000-0x00007FF7B0E32000-memory.dmp

Download

memory/5064-487-0x00007FF7B0A40000-0x00007FF7B0E32000-memory.dmp

Download