xmrig | 657a3c0c67a2d3c87cdfdc13300e7966f8184f218384c8c4148d9a9f6d472ec7

Analysis

max time kernel
121s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
Size 1.7MB
Sample240528-grk7fagg4x
SHA256 657a3c0c67a2d3c87cdfdc13300e7966f8184f218384c8c4148d9a9f6d472ec7
MD5 358d1f7ea56ab11324fd72946cbd0ba0
SHA1 4e9f0d7fff0115ec955b8a0d8c2fad0bd1e8b4f1
SHA512 e8093e2eddc0bba96db8c3397952329f10af9343304a926ebf8ea21d31290a27b2a8d4baadda797fbef8f83601691eeaddec6224b54df45f32d1eff493fed2f4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEO:Lz071uv4BPMkyW10/w16BvZXBCurmo8D
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/4984-630-0x00007FF662BA0000-0x00007FF662F92000-memory.dmp	xmrig
behavioral2/memory/4892-634-0x00007FF686570000-0x00007FF686962000-memory.dmp	xmrig
behavioral2/memory/4452-641-0x00007FF661C00000-0x00007FF661FF2000-memory.dmp	xmrig
behavioral2/memory/1580-642-0x00007FF7ED2A0000-0x00007FF7ED692000-memory.dmp	xmrig
behavioral2/memory/2940-722-0x00007FF6F6610000-0x00007FF6F6A02000-memory.dmp	xmrig
behavioral2/memory/2484-700-0x00007FF7011B0000-0x00007FF7015A2000-memory.dmp	xmrig
behavioral2/memory/1452-699-0x00007FF74C9B0000-0x00007FF74CDA2000-memory.dmp	xmrig
behavioral2/memory/2688-640-0x00007FF6B1D30000-0x00007FF6B2122000-memory.dmp	xmrig
behavioral2/memory/4436-639-0x00007FF755220000-0x00007FF755612000-memory.dmp	xmrig
behavioral2/memory/1896-638-0x00007FF6EC030000-0x00007FF6EC422000-memory.dmp	xmrig
behavioral2/memory/4888-637-0x00007FF67A210000-0x00007FF67A602000-memory.dmp	xmrig
behavioral2/memory/3408-636-0x00007FF68CF50000-0x00007FF68D342000-memory.dmp	xmrig
behavioral2/memory/1576-635-0x00007FF7DDBB0000-0x00007FF7DDFA2000-memory.dmp	xmrig
behavioral2/memory/3076-633-0x00007FF730FC0000-0x00007FF7313B2000-memory.dmp	xmrig
behavioral2/memory/976-632-0x00007FF7F2EA0000-0x00007FF7F3292000-memory.dmp	xmrig
behavioral2/memory/3884-631-0x00007FF7EC420000-0x00007FF7EC812000-memory.dmp	xmrig
behavioral2/memory/3188-629-0x00007FF6FD910000-0x00007FF6FDD02000-memory.dmp	xmrig
behavioral2/memory/1500-628-0x00007FF7BF500000-0x00007FF7BF8F2000-memory.dmp	xmrig
behavioral2/memory/2320-627-0x00007FF72C790000-0x00007FF72CB82000-memory.dmp	xmrig
behavioral2/memory/400-582-0x00007FF7BD2B0000-0x00007FF7BD6A2000-memory.dmp	xmrig
behavioral2/memory/3532-452-0x00007FF77F260000-0x00007FF77F652000-memory.dmp	xmrig
behavioral2/memory/2864-235-0x00007FF7EF990000-0x00007FF7EFD82000-memory.dmp	xmrig
behavioral2/memory/2796-22-0x00007FF625FE0000-0x00007FF6263D2000-memory.dmp	xmrig
behavioral2/memory/2356-3096-0x00007FF700290000-0x00007FF700682000-memory.dmp	xmrig
behavioral2/memory/2796-3098-0x00007FF625FE0000-0x00007FF6263D2000-memory.dmp	xmrig
behavioral2/memory/1452-3100-0x00007FF74C9B0000-0x00007FF74CDA2000-memory.dmp	xmrig
behavioral2/memory/2356-3102-0x00007FF700290000-0x00007FF700682000-memory.dmp	xmrig
behavioral2/memory/2484-3104-0x00007FF7011B0000-0x00007FF7015A2000-memory.dmp	xmrig
behavioral2/memory/2864-3106-0x00007FF7EF990000-0x00007FF7EFD82000-memory.dmp	xmrig
behavioral2/memory/1500-3108-0x00007FF7BF500000-0x00007FF7BF8F2000-memory.dmp	xmrig
behavioral2/memory/2940-3112-0x00007FF6F6610000-0x00007FF6F6A02000-memory.dmp	xmrig
behavioral2/memory/400-3110-0x00007FF7BD2B0000-0x00007FF7BD6A2000-memory.dmp	xmrig
behavioral2/memory/3532-3126-0x00007FF77F260000-0x00007FF77F652000-memory.dmp	xmrig
behavioral2/memory/2320-3127-0x00007FF72C790000-0x00007FF72CB82000-memory.dmp	xmrig
behavioral2/memory/3188-3122-0x00007FF6FD910000-0x00007FF6FDD02000-memory.dmp	xmrig
behavioral2/memory/1896-3120-0x00007FF6EC030000-0x00007FF6EC422000-memory.dmp	xmrig
behavioral2/memory/1580-3118-0x00007FF7ED2A0000-0x00007FF7ED692000-memory.dmp	xmrig
behavioral2/memory/4892-3115-0x00007FF686570000-0x00007FF686962000-memory.dmp	xmrig
behavioral2/memory/4452-3131-0x00007FF661C00000-0x00007FF661FF2000-memory.dmp	xmrig
behavioral2/memory/2688-3150-0x00007FF6B1D30000-0x00007FF6B2122000-memory.dmp	xmrig
behavioral2/memory/4436-3156-0x00007FF755220000-0x00007FF755612000-memory.dmp	xmrig
behavioral2/memory/3076-3160-0x00007FF730FC0000-0x00007FF7313B2000-memory.dmp	xmrig
behavioral2/memory/976-3155-0x00007FF7F2EA0000-0x00007FF7F3292000-memory.dmp	xmrig
behavioral2/memory/3408-3146-0x00007FF68CF50000-0x00007FF68D342000-memory.dmp	xmrig
behavioral2/memory/4984-3145-0x00007FF662BA0000-0x00007FF662F92000-memory.dmp	xmrig
behavioral2/memory/4888-3142-0x00007FF67A210000-0x00007FF67A602000-memory.dmp	xmrig
behavioral2/memory/1576-3141-0x00007FF7DDBB0000-0x00007FF7DDFA2000-memory.dmp	xmrig
behavioral2/memory/3884-3132-0x00007FF7EC420000-0x00007FF7EC812000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3964	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2796	WSjcMAa.exe
2356	DqLpzye.exe
1452	mBCuXOn.exe
2484	nQorccQ.exe
2864	fzetJCb.exe
3532	xOvMgQS.exe
400	IQoJmHi.exe
2940	mlrGiwp.exe
2320	xKUhCoU.exe
1500	SWvTLgp.exe
3188	tbhrkFn.exe
4984	RrFgFLV.exe
3884	WEfJHNb.exe
976	rnsjgDe.exe
3076	uRGGXYb.exe
4892	cFxTwBw.exe
1576	fNKMGmV.exe
3408	btPWomc.exe
4888	xEsPqqV.exe
1896	jffgUrm.exe
4436	ZYzHnjC.exe
2688	EOWXFjv.exe
4452	xXdxctu.exe
1580	PwBlOOQ.exe
3376	GBrCnvq.exe
1060	buzcMRo.exe
4996	CJKKVro.exe
1084	DrtjLkY.exe
4804	IqXpYLL.exe
2572	KwDGHnE.exe
5108	GNoCMRV.exe
2628	nnKqKSR.exe
2528	TOcaxzX.exe
1612	FaJRgwg.exe
3392	SIHvofu.exe
2128	ocfGnSv.exe
1948	kejbvAu.exe
3752	imhAkCb.exe
4692	jeaPJXf.exe
2176	aJpWOkn.exe
4448	xwxknlj.exe
1292	WUtxMpr.exe
1108	onIFWWy.exe
2960	tiQJTsw.exe
3708	CTxLvcc.exe
3824	GSyJero.exe
4304	hGovciO.exe
1112	NppwzcY.exe
1144	CHWHOyE.exe
740	ZvbwSKC.exe
2452	ggHJcft.exe
4880	qEQrgLQ.exe
3180	xBciLpd.exe
4960	wyAprpS.exe
2312	GTXQKbR.exe
1192	fNnUnto.exe
632	slwbPiM.exe
3604	TDoGJej.exe
2104	IpOwZas.exe
2468	rekNveG.exe
4388	DumOMiz.exe
1628	JDbOmnK.exe
2824	PAjrjmD.exe
2648	ltLzYrI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3536-0-0x00007FF609350000-0x00007FF609742000-memory.dmp	upx
behavioral2/files/0x0007000000023443-69.dat	upx
behavioral2/files/0x000700000002344d-121.dat	upx
behavioral2/memory/4984-630-0x00007FF662BA0000-0x00007FF662F92000-memory.dmp	upx
behavioral2/memory/4892-634-0x00007FF686570000-0x00007FF686962000-memory.dmp	upx
behavioral2/memory/4452-641-0x00007FF661C00000-0x00007FF661FF2000-memory.dmp	upx
behavioral2/memory/1580-642-0x00007FF7ED2A0000-0x00007FF7ED692000-memory.dmp	upx
behavioral2/memory/2940-722-0x00007FF6F6610000-0x00007FF6F6A02000-memory.dmp	upx
behavioral2/memory/2484-700-0x00007FF7011B0000-0x00007FF7015A2000-memory.dmp	upx
behavioral2/memory/1452-699-0x00007FF74C9B0000-0x00007FF74CDA2000-memory.dmp	upx
behavioral2/memory/2688-640-0x00007FF6B1D30000-0x00007FF6B2122000-memory.dmp	upx
behavioral2/memory/4436-639-0x00007FF755220000-0x00007FF755612000-memory.dmp	upx
behavioral2/memory/1896-638-0x00007FF6EC030000-0x00007FF6EC422000-memory.dmp	upx
behavioral2/memory/4888-637-0x00007FF67A210000-0x00007FF67A602000-memory.dmp	upx
behavioral2/memory/3408-636-0x00007FF68CF50000-0x00007FF68D342000-memory.dmp	upx
behavioral2/memory/1576-635-0x00007FF7DDBB0000-0x00007FF7DDFA2000-memory.dmp	upx
behavioral2/memory/3076-633-0x00007FF730FC0000-0x00007FF7313B2000-memory.dmp	upx
behavioral2/memory/976-632-0x00007FF7F2EA0000-0x00007FF7F3292000-memory.dmp	upx
behavioral2/memory/3884-631-0x00007FF7EC420000-0x00007FF7EC812000-memory.dmp	upx
behavioral2/memory/3188-629-0x00007FF6FD910000-0x00007FF6FDD02000-memory.dmp	upx
behavioral2/memory/1500-628-0x00007FF7BF500000-0x00007FF7BF8F2000-memory.dmp	upx
behavioral2/memory/2320-627-0x00007FF72C790000-0x00007FF72CB82000-memory.dmp	upx
behavioral2/memory/400-582-0x00007FF7BD2B0000-0x00007FF7BD6A2000-memory.dmp	upx
behavioral2/memory/3532-452-0x00007FF77F260000-0x00007FF77F652000-memory.dmp	upx
behavioral2/memory/2864-235-0x00007FF7EF990000-0x00007FF7EFD82000-memory.dmp	upx
behavioral2/files/0x0007000000023449-200.dat	upx
behavioral2/files/0x0007000000023461-199.dat	upx
behavioral2/files/0x000700000002345f-197.dat	upx
behavioral2/files/0x000700000002345e-195.dat	upx
behavioral2/files/0x0007000000023451-191.dat	upx
behavioral2/files/0x0007000000023448-189.dat	upx
behavioral2/files/0x000700000002345d-188.dat	upx
behavioral2/files/0x0007000000023446-183.dat	upx
behavioral2/files/0x000700000002345c-182.dat	upx
behavioral2/files/0x000700000002345b-176.dat	upx
behavioral2/files/0x0007000000023459-163.dat	upx
behavioral2/files/0x0007000000023442-159.dat	upx
behavioral2/files/0x0007000000023456-155.dat	upx
behavioral2/files/0x0007000000023455-154.dat	upx
behavioral2/files/0x000700000002343e-153.dat	upx
behavioral2/files/0x0007000000023454-152.dat	upx
behavioral2/files/0x0007000000023453-145.dat	upx
behavioral2/files/0x0007000000023452-138.dat	upx
behavioral2/files/0x0007000000023447-137.dat	upx
behavioral2/files/0x000700000002343d-131.dat	upx
behavioral2/files/0x0007000000023450-130.dat	upx
behavioral2/files/0x000700000002344f-129.dat	upx
behavioral2/files/0x000700000002344e-128.dat	upx
behavioral2/files/0x000700000002344c-119.dat	upx
behavioral2/files/0x000700000002344b-116.dat	upx
behavioral2/files/0x0007000000023458-160.dat	upx
behavioral2/files/0x000700000002343a-111.dat	upx
behavioral2/files/0x000700000002344a-105.dat	upx
behavioral2/files/0x0007000000023439-98.dat	upx
behavioral2/files/0x0007000000023441-91.dat	upx
behavioral2/files/0x0007000000023440-83.dat	upx
behavioral2/files/0x0007000000023445-79.dat	upx
behavioral2/files/0x000700000002343c-76.dat	upx
behavioral2/files/0x000700000002343f-124.dat	upx
behavioral2/files/0x0007000000023444-75.dat	upx
behavioral2/files/0x000700000002343b-66.dat	upx
behavioral2/files/0x0007000000023438-30.dat	upx
behavioral2/memory/2356-41-0x00007FF700290000-0x00007FF700682000-memory.dmp	upx
behavioral2/files/0x0008000000023434-26.dat	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\avgzKWm.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\ecgTvFv.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\MfRjLai.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\dbxrtBx.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\rTUuIQa.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\fvUMrgF.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\vsTdbRJ.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\WSjcMAa.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\VPRldDA.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\OIDeiCB.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\bVocUmm.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\TjtHnTp.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\FbjElLo.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\YnWldwf.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\LPZgfwB.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\ePDllbA.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\hQYFrPy.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\TsKIGyQ.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\IuIkIUQ.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\UKVxkcB.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\pBtkBZy.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\rSbdlaZ.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\rkdoWgS.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\djHGVEr.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\QwBglOK.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\YlLKuuX.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\szeKphg.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\ZqBBGVc.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\nBtKaRz.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\qIQpDfo.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\QVxWrvG.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\GrDefwT.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\EOygFUA.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\VgbekFs.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\EnUjcjR.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\AevjIse.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\CsTauJU.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\IyHQbec.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\wPvZMqo.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\qpPDBwE.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\NJMdHig.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\GRNVxHY.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\CTxLvcc.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\QCCNOeg.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\lKARoSC.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\ilabwHb.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\VYoEvMY.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\CbzgjxA.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\qMVEFqB.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\fNKMGmV.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\pkGHyJU.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\EcINwhc.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\UDEjjqW.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\EqqVhvJ.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\jfCsVDW.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\FaJRgwg.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\ZjxzfuE.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\qEGnXvG.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\sBSJGAF.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\RpAKtKC.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\GJWYDyk.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\UZXfmxx.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\TThOeGT.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
File created	C:\Windows\System\XNPLanc.exe	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3964	powershell.exe
3964	powershell.exe
3964	powershell.exe
3964	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3964	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 3964	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	83
PID 3536 wrote to memory of 3964	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	83
PID 3536 wrote to memory of 2796	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	84
PID 3536 wrote to memory of 2796	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	84
PID 3536 wrote to memory of 2356	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	85
PID 3536 wrote to memory of 2356	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	85
PID 3536 wrote to memory of 1452	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	86
PID 3536 wrote to memory of 1452	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	86
PID 3536 wrote to memory of 400	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	87
PID 3536 wrote to memory of 400	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	87
PID 3536 wrote to memory of 2940	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	88
PID 3536 wrote to memory of 2940	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	88
PID 3536 wrote to memory of 2484	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	89
PID 3536 wrote to memory of 2484	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	89
PID 3536 wrote to memory of 2864	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	90
PID 3536 wrote to memory of 2864	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	90
PID 3536 wrote to memory of 3532	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	91
PID 3536 wrote to memory of 3532	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	91
PID 3536 wrote to memory of 4984	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	92
PID 3536 wrote to memory of 4984	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	92
PID 3536 wrote to memory of 2320	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	93
PID 3536 wrote to memory of 2320	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	93
PID 3536 wrote to memory of 1500	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	94
PID 3536 wrote to memory of 1500	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	94
PID 3536 wrote to memory of 3188	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	95
PID 3536 wrote to memory of 3188	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	95
PID 3536 wrote to memory of 4436	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	96
PID 3536 wrote to memory of 4436	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	96
PID 3536 wrote to memory of 3884	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	97
PID 3536 wrote to memory of 3884	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	97
PID 3536 wrote to memory of 976	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	98
PID 3536 wrote to memory of 976	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	98
PID 3536 wrote to memory of 3076	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	99
PID 3536 wrote to memory of 3076	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	99
PID 3536 wrote to memory of 4892	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	100
PID 3536 wrote to memory of 4892	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	100
PID 3536 wrote to memory of 1576	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	101
PID 3536 wrote to memory of 1576	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	101
PID 3536 wrote to memory of 3408	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	102
PID 3536 wrote to memory of 3408	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	102
PID 3536 wrote to memory of 4888	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	103
PID 3536 wrote to memory of 4888	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	103
PID 3536 wrote to memory of 1896	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	104
PID 3536 wrote to memory of 1896	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	104
PID 3536 wrote to memory of 2688	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	105
PID 3536 wrote to memory of 2688	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	105
PID 3536 wrote to memory of 4452	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	106
PID 3536 wrote to memory of 4452	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	106
PID 3536 wrote to memory of 1580	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	107
PID 3536 wrote to memory of 1580	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	107
PID 3536 wrote to memory of 3376	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	108
PID 3536 wrote to memory of 3376	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	108
PID 3536 wrote to memory of 1060	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	109
PID 3536 wrote to memory of 1060	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	109
PID 3536 wrote to memory of 4996	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	110
PID 3536 wrote to memory of 4996	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	110
PID 3536 wrote to memory of 1084	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	111
PID 3536 wrote to memory of 1084	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	111
PID 3536 wrote to memory of 4804	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	112
PID 3536 wrote to memory of 4804	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	112
PID 3536 wrote to memory of 2572	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	113
PID 3536 wrote to memory of 2572	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	113
PID 3536 wrote to memory of 5108	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	114
PID 3536 wrote to memory of 5108	3536	358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\358d1f7ea56ab11324fd72946cbd0ba0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Windows\System\WSjcMAa.exe
  C:\Windows\System\WSjcMAa.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\DqLpzye.exe
  C:\Windows\System\DqLpzye.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\mBCuXOn.exe
  C:\Windows\System\mBCuXOn.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\IQoJmHi.exe
  C:\Windows\System\IQoJmHi.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\mlrGiwp.exe
  C:\Windows\System\mlrGiwp.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\nQorccQ.exe
  C:\Windows\System\nQorccQ.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\fzetJCb.exe
  C:\Windows\System\fzetJCb.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\xOvMgQS.exe
  C:\Windows\System\xOvMgQS.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\RrFgFLV.exe
  C:\Windows\System\RrFgFLV.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\xKUhCoU.exe
  C:\Windows\System\xKUhCoU.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\SWvTLgp.exe
  C:\Windows\System\SWvTLgp.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\tbhrkFn.exe
  C:\Windows\System\tbhrkFn.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\ZYzHnjC.exe
  C:\Windows\System\ZYzHnjC.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\WEfJHNb.exe
  C:\Windows\System\WEfJHNb.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\rnsjgDe.exe
  C:\Windows\System\rnsjgDe.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\uRGGXYb.exe
  C:\Windows\System\uRGGXYb.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\cFxTwBw.exe
  C:\Windows\System\cFxTwBw.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\fNKMGmV.exe
  C:\Windows\System\fNKMGmV.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\btPWomc.exe
  C:\Windows\System\btPWomc.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\xEsPqqV.exe
  C:\Windows\System\xEsPqqV.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\jffgUrm.exe
  C:\Windows\System\jffgUrm.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\EOWXFjv.exe
  C:\Windows\System\EOWXFjv.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\xXdxctu.exe
  C:\Windows\System\xXdxctu.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\PwBlOOQ.exe
  C:\Windows\System\PwBlOOQ.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\GBrCnvq.exe
  C:\Windows\System\GBrCnvq.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\buzcMRo.exe
  C:\Windows\System\buzcMRo.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\CJKKVro.exe
  C:\Windows\System\CJKKVro.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\DrtjLkY.exe
  C:\Windows\System\DrtjLkY.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\IqXpYLL.exe
  C:\Windows\System\IqXpYLL.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\KwDGHnE.exe
  C:\Windows\System\KwDGHnE.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\GNoCMRV.exe
  C:\Windows\System\GNoCMRV.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\nnKqKSR.exe
  C:\Windows\System\nnKqKSR.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\TOcaxzX.exe
  C:\Windows\System\TOcaxzX.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\onIFWWy.exe
  C:\Windows\System\onIFWWy.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\FaJRgwg.exe
  C:\Windows\System\FaJRgwg.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\SIHvofu.exe
  C:\Windows\System\SIHvofu.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\hGovciO.exe
  C:\Windows\System\hGovciO.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\ocfGnSv.exe
  C:\Windows\System\ocfGnSv.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\kejbvAu.exe
  C:\Windows\System\kejbvAu.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\imhAkCb.exe
  C:\Windows\System\imhAkCb.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\jeaPJXf.exe
  C:\Windows\System\jeaPJXf.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\aJpWOkn.exe
  C:\Windows\System\aJpWOkn.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\GTXQKbR.exe
  C:\Windows\System\GTXQKbR.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\xwxknlj.exe
  C:\Windows\System\xwxknlj.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\WUtxMpr.exe
  C:\Windows\System\WUtxMpr.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\tiQJTsw.exe
  C:\Windows\System\tiQJTsw.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\CTxLvcc.exe
  C:\Windows\System\CTxLvcc.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\GSyJero.exe
  C:\Windows\System\GSyJero.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\NppwzcY.exe
  C:\Windows\System\NppwzcY.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\CHWHOyE.exe
  C:\Windows\System\CHWHOyE.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\ZvbwSKC.exe
  C:\Windows\System\ZvbwSKC.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\ggHJcft.exe
  C:\Windows\System\ggHJcft.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\qEQrgLQ.exe
  C:\Windows\System\qEQrgLQ.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\xBciLpd.exe
  C:\Windows\System\xBciLpd.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\wyAprpS.exe
  C:\Windows\System\wyAprpS.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\fNnUnto.exe
  C:\Windows\System\fNnUnto.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\slwbPiM.exe
  C:\Windows\System\slwbPiM.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\TDoGJej.exe
  C:\Windows\System\TDoGJej.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\IpOwZas.exe
  C:\Windows\System\IpOwZas.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\sVMRyvT.exe
  C:\Windows\System\sVMRyvT.exe
  2⤵
  PID:2716
- C:\Windows\System\rekNveG.exe
  C:\Windows\System\rekNveG.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\DumOMiz.exe
  C:\Windows\System\DumOMiz.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\JDbOmnK.exe
  C:\Windows\System\JDbOmnK.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\PAjrjmD.exe
  C:\Windows\System\PAjrjmD.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\ltLzYrI.exe
  C:\Windows\System\ltLzYrI.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\jKUjQht.exe
  C:\Windows\System\jKUjQht.exe
  2⤵
  PID:1672
- C:\Windows\System\ppBaoSh.exe
  C:\Windows\System\ppBaoSh.exe
  2⤵
  PID:1008
- C:\Windows\System\JrREIwg.exe
  C:\Windows\System\JrREIwg.exe
  2⤵
  PID:4400
- C:\Windows\System\FEAmwgi.exe
  C:\Windows\System\FEAmwgi.exe
  2⤵
  PID:3692
- C:\Windows\System\rkBqlNh.exe
  C:\Windows\System\rkBqlNh.exe
  2⤵
  PID:3908
- C:\Windows\System\djHGVEr.exe
  C:\Windows\System\djHGVEr.exe
  2⤵
  PID:4224
- C:\Windows\System\EahYtOe.exe
  C:\Windows\System\EahYtOe.exe
  2⤵
  PID:2588
- C:\Windows\System\OUoHZJt.exe
  C:\Windows\System\OUoHZJt.exe
  2⤵
  PID:4648
- C:\Windows\System\NanedeO.exe
  C:\Windows\System\NanedeO.exe
  2⤵
  PID:4812
- C:\Windows\System\HgeNXgY.exe
  C:\Windows\System\HgeNXgY.exe
  2⤵
  PID:1876
- C:\Windows\System\KXjWYFi.exe
  C:\Windows\System\KXjWYFi.exe
  2⤵
  PID:4736
- C:\Windows\System\NtTRcmL.exe
  C:\Windows\System\NtTRcmL.exe
  2⤵
  PID:2592
- C:\Windows\System\OJWKfhS.exe
  C:\Windows\System\OJWKfhS.exe
  2⤵
  PID:968
- C:\Windows\System\xgaRvKz.exe
  C:\Windows\System\xgaRvKz.exe
  2⤵
  PID:4584
- C:\Windows\System\iivHtAC.exe
  C:\Windows\System\iivHtAC.exe
  2⤵
  PID:4032
- C:\Windows\System\NdKfLqu.exe
  C:\Windows\System\NdKfLqu.exe
  2⤵
  PID:1212
- C:\Windows\System\iUPtqNF.exe
  C:\Windows\System\iUPtqNF.exe
  2⤵
  PID:3432
- C:\Windows\System\nJUKiFO.exe
  C:\Windows\System\nJUKiFO.exe
  2⤵
  PID:4464
- C:\Windows\System\rhrddQm.exe
  C:\Windows\System\rhrddQm.exe
  2⤵
  PID:1436
- C:\Windows\System\FEeKBED.exe
  C:\Windows\System\FEeKBED.exe
  2⤵
  PID:5124
- C:\Windows\System\OeDzxLE.exe
  C:\Windows\System\OeDzxLE.exe
  2⤵
  PID:5148
- C:\Windows\System\OgnSNnv.exe
  C:\Windows\System\OgnSNnv.exe
  2⤵
  PID:5168
- C:\Windows\System\mDkIaZt.exe
  C:\Windows\System\mDkIaZt.exe
  2⤵
  PID:5188
- C:\Windows\System\TfXHQZU.exe
  C:\Windows\System\TfXHQZU.exe
  2⤵
  PID:5240
- C:\Windows\System\DlkYAlw.exe
  C:\Windows\System\DlkYAlw.exe
  2⤵
  PID:5264
- C:\Windows\System\azWYWlx.exe
  C:\Windows\System\azWYWlx.exe
  2⤵
  PID:5280
- C:\Windows\System\kkfPXfP.exe
  C:\Windows\System\kkfPXfP.exe
  2⤵
  PID:5296
- C:\Windows\System\TajKibE.exe
  C:\Windows\System\TajKibE.exe
  2⤵
  PID:5320
- C:\Windows\System\GJglraE.exe
  C:\Windows\System\GJglraE.exe
  2⤵
  PID:5336
- C:\Windows\System\WRulaKq.exe
  C:\Windows\System\WRulaKq.exe
  2⤵
  PID:5352
- C:\Windows\System\hpedrls.exe
  C:\Windows\System\hpedrls.exe
  2⤵
  PID:5372
- C:\Windows\System\VDusmNw.exe
  C:\Windows\System\VDusmNw.exe
  2⤵
  PID:5400
- C:\Windows\System\QeHiMwt.exe
  C:\Windows\System\QeHiMwt.exe
  2⤵
  PID:5416
- C:\Windows\System\UhPECIK.exe
  C:\Windows\System\UhPECIK.exe
  2⤵
  PID:5436
- C:\Windows\System\jVixmjK.exe
  C:\Windows\System\jVixmjK.exe
  2⤵
  PID:5456
- C:\Windows\System\SjxtGZA.exe
  C:\Windows\System\SjxtGZA.exe
  2⤵
  PID:5480
- C:\Windows\System\vqrAgqf.exe
  C:\Windows\System\vqrAgqf.exe
  2⤵
  PID:5532
- C:\Windows\System\SWAEyMG.exe
  C:\Windows\System\SWAEyMG.exe
  2⤵
  PID:5552
- C:\Windows\System\TBroysD.exe
  C:\Windows\System\TBroysD.exe
  2⤵
  PID:5568
- C:\Windows\System\JHdDhGA.exe
  C:\Windows\System\JHdDhGA.exe
  2⤵
  PID:5584
- C:\Windows\System\oVOZAZb.exe
  C:\Windows\System\oVOZAZb.exe
  2⤵
  PID:5604
- C:\Windows\System\pOITaFO.exe
  C:\Windows\System\pOITaFO.exe
  2⤵
  PID:5620
- C:\Windows\System\EkKHayy.exe
  C:\Windows\System\EkKHayy.exe
  2⤵
  PID:5644
- C:\Windows\System\mwMCTsP.exe
  C:\Windows\System\mwMCTsP.exe
  2⤵
  PID:5664
- C:\Windows\System\nrvoiYo.exe
  C:\Windows\System\nrvoiYo.exe
  2⤵
  PID:5688
- C:\Windows\System\XRthLXc.exe
  C:\Windows\System\XRthLXc.exe
  2⤵
  PID:5712
- C:\Windows\System\YgknItl.exe
  C:\Windows\System\YgknItl.exe
  2⤵
  PID:5748
- C:\Windows\System\muPbvsh.exe
  C:\Windows\System\muPbvsh.exe
  2⤵
  PID:5764
- C:\Windows\System\JdODbib.exe
  C:\Windows\System\JdODbib.exe
  2⤵
  PID:5792
- C:\Windows\System\RXDcJdA.exe
  C:\Windows\System\RXDcJdA.exe
  2⤵
  PID:5816
- C:\Windows\System\KvYuHEs.exe
  C:\Windows\System\KvYuHEs.exe
  2⤵
  PID:5832
- C:\Windows\System\aCNHFmC.exe
  C:\Windows\System\aCNHFmC.exe
  2⤵
  PID:5860
- C:\Windows\System\njfgPwd.exe
  C:\Windows\System\njfgPwd.exe
  2⤵
  PID:5884
- C:\Windows\System\KjGgywM.exe
  C:\Windows\System\KjGgywM.exe
  2⤵
  PID:5900
- C:\Windows\System\LipGYYl.exe
  C:\Windows\System\LipGYYl.exe
  2⤵
  PID:5920
- C:\Windows\System\CjMMKcH.exe
  C:\Windows\System\CjMMKcH.exe
  2⤵
  PID:5936
- C:\Windows\System\hDacowF.exe
  C:\Windows\System\hDacowF.exe
  2⤵
  PID:5956
- C:\Windows\System\cgLfGSL.exe
  C:\Windows\System\cgLfGSL.exe
  2⤵
  PID:5972
- C:\Windows\System\LSGCcfA.exe
  C:\Windows\System\LSGCcfA.exe
  2⤵
  PID:5988
- C:\Windows\System\zJnhhPL.exe
  C:\Windows\System\zJnhhPL.exe
  2⤵
  PID:6008
- C:\Windows\System\dniKXKU.exe
  C:\Windows\System\dniKXKU.exe
  2⤵
  PID:6024
- C:\Windows\System\AevjIse.exe
  C:\Windows\System\AevjIse.exe
  2⤵
  PID:6044
- C:\Windows\System\XzQnwYU.exe
  C:\Windows\System\XzQnwYU.exe
  2⤵
  PID:6064
- C:\Windows\System\zxLcywb.exe
  C:\Windows\System\zxLcywb.exe
  2⤵
  PID:6080
- C:\Windows\System\zwCvfHY.exe
  C:\Windows\System\zwCvfHY.exe
  2⤵
  PID:6104
- C:\Windows\System\JbRguSb.exe
  C:\Windows\System\JbRguSb.exe
  2⤵
  PID:6124
- C:\Windows\System\yqOBLzA.exe
  C:\Windows\System\yqOBLzA.exe
  2⤵
  PID:1508
- C:\Windows\System\EOttqdq.exe
  C:\Windows\System\EOttqdq.exe
  2⤵
  PID:4972
- C:\Windows\System\CsTauJU.exe
  C:\Windows\System\CsTauJU.exe
  2⤵
  PID:4896
- C:\Windows\System\VYoEvMY.exe
  C:\Windows\System\VYoEvMY.exe
  2⤵
  PID:1868
- C:\Windows\System\ZjpEYQm.exe
  C:\Windows\System\ZjpEYQm.exe
  2⤵
  PID:1804
- C:\Windows\System\muWfXNL.exe
  C:\Windows\System\muWfXNL.exe
  2⤵
  PID:2340
- C:\Windows\System\yjEiXlw.exe
  C:\Windows\System\yjEiXlw.exe
  2⤵
  PID:1632
- C:\Windows\System\MFnWKgn.exe
  C:\Windows\System\MFnWKgn.exe
  2⤵
  PID:5156
- C:\Windows\System\CDIThnm.exe
  C:\Windows\System\CDIThnm.exe
  2⤵
  PID:2164
- C:\Windows\System\hoAaVKf.exe
  C:\Windows\System\hoAaVKf.exe
  2⤵
  PID:5252
- C:\Windows\System\SNtZbiO.exe
  C:\Windows\System\SNtZbiO.exe
  2⤵
  PID:4952
- C:\Windows\System\hQYFrPy.exe
  C:\Windows\System\hQYFrPy.exe
  2⤵
  PID:5452
- C:\Windows\System\akpDXPk.exe
  C:\Windows\System\akpDXPk.exe
  2⤵
  PID:5472
- C:\Windows\System\ikawAuF.exe
  C:\Windows\System\ikawAuF.exe
  2⤵
  PID:5492
- C:\Windows\System\xxSNdQY.exe
  C:\Windows\System\xxSNdQY.exe
  2⤵
  PID:1604
- C:\Windows\System\YAfFyoj.exe
  C:\Windows\System\YAfFyoj.exe
  2⤵
  PID:4496
- C:\Windows\System\EOygFUA.exe
  C:\Windows\System\EOygFUA.exe
  2⤵
  PID:5024
- C:\Windows\System\SbUShpz.exe
  C:\Windows\System\SbUShpz.exe
  2⤵
  PID:5656
- C:\Windows\System\rqUTZFb.exe
  C:\Windows\System\rqUTZFb.exe
  2⤵
  PID:5708
- C:\Windows\System\pWZBfPq.exe
  C:\Windows\System\pWZBfPq.exe
  2⤵
  PID:4416
- C:\Windows\System\drRmtwu.exe
  C:\Windows\System\drRmtwu.exe
  2⤵
  PID:448
- C:\Windows\System\bqDQRYg.exe
  C:\Windows\System\bqDQRYg.exe
  2⤵
  PID:3428
- C:\Windows\System\MynMWuY.exe
  C:\Windows\System\MynMWuY.exe
  2⤵
  PID:5880
- C:\Windows\System\UHhxpjy.exe
  C:\Windows\System\UHhxpjy.exe
  2⤵
  PID:5944
- C:\Windows\System\YFxdgVB.exe
  C:\Windows\System\YFxdgVB.exe
  2⤵
  PID:812
- C:\Windows\System\OswROox.exe
  C:\Windows\System\OswROox.exe
  2⤵
  PID:4408
- C:\Windows\System\xfvhIzy.exe
  C:\Windows\System\xfvhIzy.exe
  2⤵
  PID:1616
- C:\Windows\System\QpDwtiJ.exe
  C:\Windows\System\QpDwtiJ.exe
  2⤵
  PID:6152
- C:\Windows\System\ztEjXxi.exe
  C:\Windows\System\ztEjXxi.exe
  2⤵
  PID:6176
- C:\Windows\System\GpIbbti.exe
  C:\Windows\System\GpIbbti.exe
  2⤵
  PID:6240
- C:\Windows\System\RMkPsqj.exe
  C:\Windows\System\RMkPsqj.exe
  2⤵
  PID:6264
- C:\Windows\System\siLuedU.exe
  C:\Windows\System\siLuedU.exe
  2⤵
  PID:6280
- C:\Windows\System\uepNFhZ.exe
  C:\Windows\System\uepNFhZ.exe
  2⤵
  PID:6300
- C:\Windows\System\QxUmXQO.exe
  C:\Windows\System\QxUmXQO.exe
  2⤵
  PID:6324
- C:\Windows\System\pkGHyJU.exe
  C:\Windows\System\pkGHyJU.exe
  2⤵
  PID:6348
- C:\Windows\System\UDFKZhd.exe
  C:\Windows\System\UDFKZhd.exe
  2⤵
  PID:6368
- C:\Windows\System\gGtTDen.exe
  C:\Windows\System\gGtTDen.exe
  2⤵
  PID:6392
- C:\Windows\System\ugsgAjX.exe
  C:\Windows\System\ugsgAjX.exe
  2⤵
  PID:6412
- C:\Windows\System\DnwmFhL.exe
  C:\Windows\System\DnwmFhL.exe
  2⤵
  PID:6432
- C:\Windows\System\JUeOQWn.exe
  C:\Windows\System\JUeOQWn.exe
  2⤵
  PID:6448
- C:\Windows\System\VALwdwL.exe
  C:\Windows\System\VALwdwL.exe
  2⤵
  PID:6476
- C:\Windows\System\DmYvRwm.exe
  C:\Windows\System\DmYvRwm.exe
  2⤵
  PID:6492
- C:\Windows\System\cUGLYPR.exe
  C:\Windows\System\cUGLYPR.exe
  2⤵
  PID:6512
- C:\Windows\System\iIQbLbp.exe
  C:\Windows\System\iIQbLbp.exe
  2⤵
  PID:6540
- C:\Windows\System\vbjRdbp.exe
  C:\Windows\System\vbjRdbp.exe
  2⤵
  PID:6556
- C:\Windows\System\BkNyEnT.exe
  C:\Windows\System\BkNyEnT.exe
  2⤵
  PID:6572
- C:\Windows\System\tpsiXtX.exe
  C:\Windows\System\tpsiXtX.exe
  2⤵
  PID:6588
- C:\Windows\System\yYJTHsB.exe
  C:\Windows\System\yYJTHsB.exe
  2⤵
  PID:6612
- C:\Windows\System\WmRTATZ.exe
  C:\Windows\System\WmRTATZ.exe
  2⤵
  PID:6628
- C:\Windows\System\qabJAtA.exe
  C:\Windows\System\qabJAtA.exe
  2⤵
  PID:6644
- C:\Windows\System\QiuXURz.exe
  C:\Windows\System\QiuXURz.exe
  2⤵
  PID:6672
- C:\Windows\System\TZQjyUo.exe
  C:\Windows\System\TZQjyUo.exe
  2⤵
  PID:6708
- C:\Windows\System\rxgchfu.exe
  C:\Windows\System\rxgchfu.exe
  2⤵
  PID:6732
- C:\Windows\System\zavuOZH.exe
  C:\Windows\System\zavuOZH.exe
  2⤵
  PID:6752
- C:\Windows\System\ItiJyrS.exe
  C:\Windows\System\ItiJyrS.exe
  2⤵
  PID:6776
- C:\Windows\System\jJLasuh.exe
  C:\Windows\System\jJLasuh.exe
  2⤵
  PID:6796
- C:\Windows\System\rMkcHtm.exe
  C:\Windows\System\rMkcHtm.exe
  2⤵
  PID:6812
- C:\Windows\System\SeHhPro.exe
  C:\Windows\System\SeHhPro.exe
  2⤵
  PID:6836
- C:\Windows\System\uFaDSQn.exe
  C:\Windows\System\uFaDSQn.exe
  2⤵
  PID:6852
- C:\Windows\System\GkyhojE.exe
  C:\Windows\System\GkyhojE.exe
  2⤵
  PID:6896
- C:\Windows\System\cknfHGc.exe
  C:\Windows\System\cknfHGc.exe
  2⤵
  PID:6916
- C:\Windows\System\LYzpLPw.exe
  C:\Windows\System\LYzpLPw.exe
  2⤵
  PID:6936
- C:\Windows\System\UNCrpNq.exe
  C:\Windows\System\UNCrpNq.exe
  2⤵
  PID:6964
- C:\Windows\System\dDgGAXJ.exe
  C:\Windows\System\dDgGAXJ.exe
  2⤵
  PID:6980
- C:\Windows\System\UZXfmxx.exe
  C:\Windows\System\UZXfmxx.exe
  2⤵
  PID:7000
- C:\Windows\System\VJxLGea.exe
  C:\Windows\System\VJxLGea.exe
  2⤵
  PID:7016
- C:\Windows\System\ncfHcvY.exe
  C:\Windows\System\ncfHcvY.exe
  2⤵
  PID:7040
- C:\Windows\System\nwkPJzE.exe
  C:\Windows\System\nwkPJzE.exe
  2⤵
  PID:7060
- C:\Windows\System\qnrmaKC.exe
  C:\Windows\System\qnrmaKC.exe
  2⤵
  PID:7088
- C:\Windows\System\VrJFVbn.exe
  C:\Windows\System\VrJFVbn.exe
  2⤵
  PID:7108
- C:\Windows\System\fzPNbPK.exe
  C:\Windows\System\fzPNbPK.exe
  2⤵
  PID:7124
- C:\Windows\System\qjyXsMi.exe
  C:\Windows\System\qjyXsMi.exe
  2⤵
  PID:7144
- C:\Windows\System\kHcEGzX.exe
  C:\Windows\System\kHcEGzX.exe
  2⤵
  PID:7164
- C:\Windows\System\GBvRMeC.exe
  C:\Windows\System\GBvRMeC.exe
  2⤵
  PID:5040
- C:\Windows\System\EOjlNqU.exe
  C:\Windows\System\EOjlNqU.exe
  2⤵
  PID:2344
- C:\Windows\System\YIFifiS.exe
  C:\Windows\System\YIFifiS.exe
  2⤵
  PID:2740
- C:\Windows\System\jRxuWXK.exe
  C:\Windows\System\jRxuWXK.exe
  2⤵
  PID:5640
- C:\Windows\System\lgphIPL.exe
  C:\Windows\System\lgphIPL.exe
  2⤵
  PID:5248
- C:\Windows\System\RgiDmUT.exe
  C:\Windows\System\RgiDmUT.exe
  2⤵
  PID:5736
- C:\Windows\System\JUoAVfs.exe
  C:\Windows\System\JUoAVfs.exe
  2⤵
  PID:5272
- C:\Windows\System\rHgceGP.exe
  C:\Windows\System\rHgceGP.exe
  2⤵
  PID:5724
- C:\Windows\System\lISeniX.exe
  C:\Windows\System\lISeniX.exe
  2⤵
  PID:4404
- C:\Windows\System\fuVAiBA.exe
  C:\Windows\System\fuVAiBA.exe
  2⤵
  PID:4392
- C:\Windows\System\cfmlJFj.exe
  C:\Windows\System\cfmlJFj.exe
  2⤵
  PID:6040
- C:\Windows\System\uJDcLvm.exe
  C:\Windows\System\uJDcLvm.exe
  2⤵
  PID:5428
- C:\Windows\System\RceXcmx.exe
  C:\Windows\System\RceXcmx.exe
  2⤵
  PID:6172
- C:\Windows\System\ipjDzXT.exe
  C:\Windows\System\ipjDzXT.exe
  2⤵
  PID:7176
- C:\Windows\System\mtNBLxy.exe
  C:\Windows\System\mtNBLxy.exe
  2⤵
  PID:7196
- C:\Windows\System\aibsmME.exe
  C:\Windows\System\aibsmME.exe
  2⤵
  PID:7220
- C:\Windows\System\vjcosdh.exe
  C:\Windows\System\vjcosdh.exe
  2⤵
  PID:7244
- C:\Windows\System\LtbqJKy.exe
  C:\Windows\System\LtbqJKy.exe
  2⤵
  PID:7472
- C:\Windows\System\iaABIEC.exe
  C:\Windows\System\iaABIEC.exe
  2⤵
  PID:7488
- C:\Windows\System\CzfstpQ.exe
  C:\Windows\System\CzfstpQ.exe
  2⤵
  PID:7504
- C:\Windows\System\mzdXuLi.exe
  C:\Windows\System\mzdXuLi.exe
  2⤵
  PID:7520
- C:\Windows\System\KbDOHFB.exe
  C:\Windows\System\KbDOHFB.exe
  2⤵
  PID:7536
- C:\Windows\System\QVMHhxO.exe
  C:\Windows\System\QVMHhxO.exe
  2⤵
  PID:7552
- C:\Windows\System\IjzVtad.exe
  C:\Windows\System\IjzVtad.exe
  2⤵
  PID:7568
- C:\Windows\System\rCAtCnM.exe
  C:\Windows\System\rCAtCnM.exe
  2⤵
  PID:7584
- C:\Windows\System\yfsuYuz.exe
  C:\Windows\System\yfsuYuz.exe
  2⤵
  PID:7600
- C:\Windows\System\gwxhaRh.exe
  C:\Windows\System\gwxhaRh.exe
  2⤵
  PID:7616
- C:\Windows\System\FdKZaAy.exe
  C:\Windows\System\FdKZaAy.exe
  2⤵
  PID:7632
- C:\Windows\System\aqqylGs.exe
  C:\Windows\System\aqqylGs.exe
  2⤵
  PID:1208
- C:\Windows\System\jkXDVaK.exe
  C:\Windows\System\jkXDVaK.exe
  2⤵
  PID:7320
- C:\Windows\System\BTVYBRk.exe
  C:\Windows\System\BTVYBRk.exe
  2⤵
  PID:7340
- C:\Windows\System\NoIWUhK.exe
  C:\Windows\System\NoIWUhK.exe
  2⤵
  PID:2396
- C:\Windows\System\keqipTa.exe
  C:\Windows\System\keqipTa.exe
  2⤵
  PID:6808
- C:\Windows\System\DNogoUM.exe
  C:\Windows\System\DNogoUM.exe
  2⤵
  PID:7120
- C:\Windows\System\UmjOrhE.exe
  C:\Windows\System\UmjOrhE.exe
  2⤵
  PID:7048
- C:\Windows\System\ONwGwhh.exe
  C:\Windows\System\ONwGwhh.exe
  2⤵
  PID:6580
- C:\Windows\System\ANaOtcI.exe
  C:\Windows\System\ANaOtcI.exe
  2⤵
  PID:7548
- C:\Windows\System\GzzQuRO.exe
  C:\Windows\System\GzzQuRO.exe
  2⤵
  PID:7656
- C:\Windows\System\wUMNcsh.exe
  C:\Windows\System\wUMNcsh.exe
  2⤵
  PID:7700
- C:\Windows\System\VdJucob.exe
  C:\Windows\System\VdJucob.exe
  2⤵
  PID:7752
- C:\Windows\System\LBqrOEa.exe
  C:\Windows\System\LBqrOEa.exe
  2⤵
  PID:7800
- C:\Windows\System\nIVPRMT.exe
  C:\Windows\System\nIVPRMT.exe
  2⤵
  PID:7848
- C:\Windows\System\bqZsvzW.exe
  C:\Windows\System\bqZsvzW.exe
  2⤵
  PID:7888
- C:\Windows\System\TjhRrOa.exe
  C:\Windows\System\TjhRrOa.exe
  2⤵
  PID:8084
- C:\Windows\System\vYKWrwS.exe
  C:\Windows\System\vYKWrwS.exe
  2⤵
  PID:8144
- C:\Windows\System\YlLKuuX.exe
  C:\Windows\System\YlLKuuX.exe
  2⤵
  PID:116
- C:\Windows\System\QwsnWic.exe
  C:\Windows\System\QwsnWic.exe
  2⤵
  PID:3412
- C:\Windows\System\ftFkHmK.exe
  C:\Windows\System\ftFkHmK.exe
  2⤵
  PID:3804
- C:\Windows\System\rkVbesY.exe
  C:\Windows\System\rkVbesY.exe
  2⤵
  PID:7608
- C:\Windows\System\xQlAiFP.exe
  C:\Windows\System\xQlAiFP.exe
  2⤵
  PID:7208
- C:\Windows\System\HDtpPYz.exe
  C:\Windows\System\HDtpPYz.exe
  2⤵
  PID:4800
- C:\Windows\System\ePDllbA.exe
  C:\Windows\System\ePDllbA.exe
  2⤵
  PID:7156
- C:\Windows\System\CgKkqdn.exe
  C:\Windows\System\CgKkqdn.exe
  2⤵
  PID:6948
- C:\Windows\System\WIAGxwA.exe
  C:\Windows\System\WIAGxwA.exe
  2⤵
  PID:6824
- C:\Windows\System\yVjLcjb.exe
  C:\Windows\System\yVjLcjb.exe
  2⤵
  PID:6620
- C:\Windows\System\uQDPmgc.exe
  C:\Windows\System\uQDPmgc.exe
  2⤵
  PID:6232
- C:\Windows\System\qDGccTp.exe
  C:\Windows\System\qDGccTp.exe
  2⤵
  PID:6292
- C:\Windows\System\qwANCHa.exe
  C:\Windows\System\qwANCHa.exe
  2⤵
  PID:8196
- C:\Windows\System\AhNXIHp.exe
  C:\Windows\System\AhNXIHp.exe
  2⤵
  PID:8352
- C:\Windows\System\QBuwXkh.exe
  C:\Windows\System\QBuwXkh.exe
  2⤵
  PID:8368
- C:\Windows\System\qkHjsPZ.exe
  C:\Windows\System\qkHjsPZ.exe
  2⤵
  PID:8400
- C:\Windows\System\lwMHiiP.exe
  C:\Windows\System\lwMHiiP.exe
  2⤵
  PID:8416
- C:\Windows\System\lAaaAcw.exe
  C:\Windows\System\lAaaAcw.exe
  2⤵
  PID:8436
- C:\Windows\System\pAlnIFi.exe
  C:\Windows\System\pAlnIFi.exe
  2⤵
  PID:8464
- C:\Windows\System\IRcYJpB.exe
  C:\Windows\System\IRcYJpB.exe
  2⤵
  PID:8500
- C:\Windows\System\VsRLXoA.exe
  C:\Windows\System\VsRLXoA.exe
  2⤵
  PID:8516
- C:\Windows\System\dlqjMcs.exe
  C:\Windows\System\dlqjMcs.exe
  2⤵
  PID:8532
- C:\Windows\System\FbjElLo.exe
  C:\Windows\System\FbjElLo.exe
  2⤵
  PID:8548
- C:\Windows\System\aAsEGLK.exe
  C:\Windows\System\aAsEGLK.exe
  2⤵
  PID:8564
- C:\Windows\System\iBQVGbm.exe
  C:\Windows\System\iBQVGbm.exe
  2⤵
  PID:8580
- C:\Windows\System\PLitDWw.exe
  C:\Windows\System\PLitDWw.exe
  2⤵
  PID:8596
- C:\Windows\System\OIuevKU.exe
  C:\Windows\System\OIuevKU.exe
  2⤵
  PID:8612
- C:\Windows\System\EkDaALq.exe
  C:\Windows\System\EkDaALq.exe
  2⤵
  PID:8628
- C:\Windows\System\KrNLAvG.exe
  C:\Windows\System\KrNLAvG.exe
  2⤵
  PID:8644
- C:\Windows\System\wJvLcdN.exe
  C:\Windows\System\wJvLcdN.exe
  2⤵
  PID:8660
- C:\Windows\System\XWSAvey.exe
  C:\Windows\System\XWSAvey.exe
  2⤵
  PID:8676
- C:\Windows\System\ZjxzfuE.exe
  C:\Windows\System\ZjxzfuE.exe
  2⤵
  PID:8692
- C:\Windows\System\wqFdHQu.exe
  C:\Windows\System\wqFdHQu.exe
  2⤵
  PID:8712
- C:\Windows\System\RCDgwTm.exe
  C:\Windows\System\RCDgwTm.exe
  2⤵
  PID:8736
- C:\Windows\System\yYgUUuB.exe
  C:\Windows\System\yYgUUuB.exe
  2⤵
  PID:8760
- C:\Windows\System\gBFZpqR.exe
  C:\Windows\System\gBFZpqR.exe
  2⤵
  PID:8784
- C:\Windows\System\MwORTIz.exe
  C:\Windows\System\MwORTIz.exe
  2⤵
  PID:8804
- C:\Windows\System\SyVgVMw.exe
  C:\Windows\System\SyVgVMw.exe
  2⤵
  PID:8824
- C:\Windows\System\WvxIDti.exe
  C:\Windows\System\WvxIDti.exe
  2⤵
  PID:8848
- C:\Windows\System\UNOUYgH.exe
  C:\Windows\System\UNOUYgH.exe
  2⤵
  PID:8864
- C:\Windows\System\QRTdNnf.exe
  C:\Windows\System\QRTdNnf.exe
  2⤵
  PID:8888
- C:\Windows\System\xSOwWRb.exe
  C:\Windows\System\xSOwWRb.exe
  2⤵
  PID:8912
- C:\Windows\System\pQNDZIK.exe
  C:\Windows\System\pQNDZIK.exe
  2⤵
  PID:8932
- C:\Windows\System\WBuoIWZ.exe
  C:\Windows\System\WBuoIWZ.exe
  2⤵
  PID:8952
- C:\Windows\System\tNWzTJM.exe
  C:\Windows\System\tNWzTJM.exe
  2⤵
  PID:8976
- C:\Windows\System\GFVSbKL.exe
  C:\Windows\System\GFVSbKL.exe
  2⤵
  PID:9000
- C:\Windows\System\XeITUmR.exe
  C:\Windows\System\XeITUmR.exe
  2⤵
  PID:9020
- C:\Windows\System\AzgNmfy.exe
  C:\Windows\System\AzgNmfy.exe
  2⤵
  PID:9040
- C:\Windows\System\TjtHnTp.exe
  C:\Windows\System\TjtHnTp.exe
  2⤵
  PID:9056
- C:\Windows\System\WheZMPU.exe
  C:\Windows\System\WheZMPU.exe
  2⤵
  PID:9080
- C:\Windows\System\jFklQdi.exe
  C:\Windows\System\jFklQdi.exe
  2⤵
  PID:9104
- C:\Windows\System\aNNVcPJ.exe
  C:\Windows\System\aNNVcPJ.exe
  2⤵
  PID:9120
- C:\Windows\System\xeOCcTx.exe
  C:\Windows\System\xeOCcTx.exe
  2⤵
  PID:9136
- C:\Windows\System\NNSShuB.exe
  C:\Windows\System\NNSShuB.exe
  2⤵
  PID:9152
- C:\Windows\System\OIDeiCB.exe
  C:\Windows\System\OIDeiCB.exe
  2⤵
  PID:9172
- C:\Windows\System\JLHEjnR.exe
  C:\Windows\System\JLHEjnR.exe
  2⤵
  PID:6276
- C:\Windows\System\nXjijYU.exe
  C:\Windows\System\nXjijYU.exe
  2⤵
  PID:6696
- C:\Windows\System\OSeWjnZ.exe
  C:\Windows\System\OSeWjnZ.exe
  2⤵
  PID:7132
- C:\Windows\System\iwlSCbP.exe
  C:\Windows\System\iwlSCbP.exe
  2⤵
  PID:6488
- C:\Windows\System\EFsTLHH.exe
  C:\Windows\System\EFsTLHH.exe
  2⤵
  PID:6508
- C:\Windows\System\IyHQbec.exe
  C:\Windows\System\IyHQbec.exe
  2⤵
  PID:7104
- C:\Windows\System\pMWGYZN.exe
  C:\Windows\System\pMWGYZN.exe
  2⤵
  PID:3764
- C:\Windows\System\BLTFxae.exe
  C:\Windows\System\BLTFxae.exe
  2⤵
  PID:8040
- C:\Windows\System\ZjVCExR.exe
  C:\Windows\System\ZjVCExR.exe
  2⤵
  PID:1584
- C:\Windows\System\xPVZBhc.exe
  C:\Windows\System\xPVZBhc.exe
  2⤵
  PID:7140
- C:\Windows\System\NiawCaS.exe
  C:\Windows\System\NiawCaS.exe
  2⤵
  PID:7468
- C:\Windows\System\FCiEDkz.exe
  C:\Windows\System\FCiEDkz.exe
  2⤵
  PID:7076
- C:\Windows\System\QJFoFFg.exe
  C:\Windows\System\QJFoFFg.exe
  2⤵
  PID:7580
- C:\Windows\System\Xqwcijp.exe
  C:\Windows\System\Xqwcijp.exe
  2⤵
  PID:7736
- C:\Windows\System\OpIlwrF.exe
  C:\Windows\System\OpIlwrF.exe
  2⤵
  PID:7824
- C:\Windows\System\YEZfWNr.exe
  C:\Windows\System\YEZfWNr.exe
  2⤵
  PID:8100
- C:\Windows\System\jYFAtUv.exe
  C:\Windows\System\jYFAtUv.exe
  2⤵
  PID:6500
- C:\Windows\System\IgntATl.exe
  C:\Windows\System\IgntATl.exe
  2⤵
  PID:5872
- C:\Windows\System\TRBTrXs.exe
  C:\Windows\System\TRBTrXs.exe
  2⤵
  PID:7232
- C:\Windows\System\qTPrqSc.exe
  C:\Windows\System\qTPrqSc.exe
  2⤵
  PID:6784
- C:\Windows\System\nbFtlIM.exe
  C:\Windows\System\nbFtlIM.exe
  2⤵
  PID:6212
- C:\Windows\System\BtElmFy.exe
  C:\Windows\System\BtElmFy.exe
  2⤵
  PID:8796
- C:\Windows\System\QqYsTOf.exe
  C:\Windows\System\QqYsTOf.exe
  2⤵
  PID:8820
- C:\Windows\System\WyDJyGA.exe
  C:\Windows\System\WyDJyGA.exe
  2⤵
  PID:8872
- C:\Windows\System\NCIXjSo.exe
  C:\Windows\System\NCIXjSo.exe
  2⤵
  PID:8928
- C:\Windows\System\kEiRrdg.exe
  C:\Windows\System\kEiRrdg.exe
  2⤵
  PID:8984
- C:\Windows\System\QHYhnMG.exe
  C:\Windows\System\QHYhnMG.exe
  2⤵
  PID:9220
- C:\Windows\System\VUJiWlf.exe
  C:\Windows\System\VUJiWlf.exe
  2⤵
  PID:9236
- C:\Windows\System\qqyWFxQ.exe
  C:\Windows\System\qqyWFxQ.exe
  2⤵
  PID:9252
- C:\Windows\System\YhPVNwe.exe
  C:\Windows\System\YhPVNwe.exe
  2⤵
  PID:9268
- C:\Windows\System\tujaGAz.exe
  C:\Windows\System\tujaGAz.exe
  2⤵
  PID:9284
- C:\Windows\System\fIviSTu.exe
  C:\Windows\System\fIviSTu.exe
  2⤵
  PID:9304
- C:\Windows\System\zYbNcNG.exe
  C:\Windows\System\zYbNcNG.exe
  2⤵
  PID:9324
- C:\Windows\System\vhAepPN.exe
  C:\Windows\System\vhAepPN.exe
  2⤵
  PID:9340
- C:\Windows\System\JYySXec.exe
  C:\Windows\System\JYySXec.exe
  2⤵
  PID:9356
- C:\Windows\System\GJwYBUH.exe
  C:\Windows\System\GJwYBUH.exe
  2⤵
  PID:9372
- C:\Windows\System\oRpUcAx.exe
  C:\Windows\System\oRpUcAx.exe
  2⤵
  PID:9392
- C:\Windows\System\PzZfGUS.exe
  C:\Windows\System\PzZfGUS.exe
  2⤵
  PID:9412
- C:\Windows\System\cjslrDB.exe
  C:\Windows\System\cjslrDB.exe
  2⤵
  PID:9444
- C:\Windows\System\wBQMepW.exe
  C:\Windows\System\wBQMepW.exe
  2⤵
  PID:9460
- C:\Windows\System\cxzgiox.exe
  C:\Windows\System\cxzgiox.exe
  2⤵
  PID:9488
- C:\Windows\System\LpMetBl.exe
  C:\Windows\System\LpMetBl.exe
  2⤵
  PID:9504
- C:\Windows\System\wYCvYyG.exe
  C:\Windows\System\wYCvYyG.exe
  2⤵
  PID:9524
- C:\Windows\System\aZFNCuv.exe
  C:\Windows\System\aZFNCuv.exe
  2⤵
  PID:9544
- C:\Windows\System\JNbudqB.exe
  C:\Windows\System\JNbudqB.exe
  2⤵
  PID:9564
- C:\Windows\System\TeMISXq.exe
  C:\Windows\System\TeMISXq.exe
  2⤵
  PID:9588
- C:\Windows\System\MjNXNPc.exe
  C:\Windows\System\MjNXNPc.exe
  2⤵
  PID:9604
- C:\Windows\System\zZXfexj.exe
  C:\Windows\System\zZXfexj.exe
  2⤵
  PID:9624
- C:\Windows\System\NyPjwyC.exe
  C:\Windows\System\NyPjwyC.exe
  2⤵
  PID:9640
- C:\Windows\System\vxtCtOk.exe
  C:\Windows\System\vxtCtOk.exe
  2⤵
  PID:9664
- C:\Windows\System\PGLTSCY.exe
  C:\Windows\System\PGLTSCY.exe
  2⤵
  PID:9692
- C:\Windows\System\kJbqWpm.exe
  C:\Windows\System\kJbqWpm.exe
  2⤵
  PID:9708
- C:\Windows\System\SaBSUZi.exe
  C:\Windows\System\SaBSUZi.exe
  2⤵
  PID:9724
- C:\Windows\System\eIUdCya.exe
  C:\Windows\System\eIUdCya.exe
  2⤵
  PID:9740
- C:\Windows\System\fhlkMqm.exe
  C:\Windows\System\fhlkMqm.exe
  2⤵
  PID:9764
- C:\Windows\System\GlErgMI.exe
  C:\Windows\System\GlErgMI.exe
  2⤵
  PID:9780
- C:\Windows\System\lxJZLjq.exe
  C:\Windows\System\lxJZLjq.exe
  2⤵
  PID:9804
- C:\Windows\System\QoLmsYL.exe
  C:\Windows\System\QoLmsYL.exe
  2⤵
  PID:9828
- C:\Windows\System\bhpdulv.exe
  C:\Windows\System\bhpdulv.exe
  2⤵
  PID:9844
- C:\Windows\System\glomNmX.exe
  C:\Windows\System\glomNmX.exe
  2⤵
  PID:9908
- C:\Windows\System\dZayBnj.exe
  C:\Windows\System\dZayBnj.exe
  2⤵
  PID:9924
- C:\Windows\System\ewIhVwn.exe
  C:\Windows\System\ewIhVwn.exe
  2⤵
  PID:9940
- C:\Windows\System\gTMELtv.exe
  C:\Windows\System\gTMELtv.exe
  2⤵
  PID:9956
- C:\Windows\System\jOHZaJI.exe
  C:\Windows\System\jOHZaJI.exe
  2⤵
  PID:9972
- C:\Windows\System\AZwDZAJ.exe
  C:\Windows\System\AZwDZAJ.exe
  2⤵
  PID:9992
- C:\Windows\System\gGiqzgr.exe
  C:\Windows\System\gGiqzgr.exe
  2⤵
  PID:10012
- C:\Windows\System\dSUakHZ.exe
  C:\Windows\System\dSUakHZ.exe
  2⤵
  PID:10044
- C:\Windows\System\CHkjcpZ.exe
  C:\Windows\System\CHkjcpZ.exe
  2⤵
  PID:10068
- C:\Windows\System\KsvbGKc.exe
  C:\Windows\System\KsvbGKc.exe
  2⤵
  PID:10092
- C:\Windows\System\dNpPiZu.exe
  C:\Windows\System\dNpPiZu.exe
  2⤵
  PID:10108
- C:\Windows\System\GGWxeUe.exe
  C:\Windows\System\GGWxeUe.exe
  2⤵
  PID:10140
- C:\Windows\System\WwHURdx.exe
  C:\Windows\System\WwHURdx.exe
  2⤵
  PID:10160
- C:\Windows\System\VWDcOsj.exe
  C:\Windows\System\VWDcOsj.exe
  2⤵
  PID:10184
- C:\Windows\System\yoqsKQR.exe
  C:\Windows\System\yoqsKQR.exe
  2⤵
  PID:10204
- C:\Windows\System\DdqwxmX.exe
  C:\Windows\System\DdqwxmX.exe
  2⤵
  PID:10220
- C:\Windows\System\FIXVEpr.exe
  C:\Windows\System\FIXVEpr.exe
  2⤵
  PID:9076
- C:\Windows\System\OwiMCuA.exe
  C:\Windows\System\OwiMCuA.exe
  2⤵
  PID:9052
- C:\Windows\System\XYWUvoB.exe
  C:\Windows\System\XYWUvoB.exe
  2⤵
  PID:8512
- C:\Windows\System\kYibFQj.exe
  C:\Windows\System\kYibFQj.exe
  2⤵
  PID:1752
- C:\Windows\System\HTcYVze.exe
  C:\Windows\System\HTcYVze.exe
  2⤵
  PID:1308
- C:\Windows\System\csIBAeB.exe
  C:\Windows\System\csIBAeB.exe
  2⤵
  PID:8620
- C:\Windows\System\HPvalVT.exe
  C:\Windows\System\HPvalVT.exe
  2⤵
  PID:8656
- C:\Windows\System\RYkmsQF.exe
  C:\Windows\System\RYkmsQF.exe
  2⤵
  PID:8700
- C:\Windows\System\JrWUoSy.exe
  C:\Windows\System\JrWUoSy.exe
  2⤵
  PID:8732
- C:\Windows\System\xRdYNRH.exe
  C:\Windows\System\xRdYNRH.exe
  2⤵
  PID:8840
- C:\Windows\System\CpvppFX.exe
  C:\Windows\System\CpvppFX.exe
  2⤵
  PID:9012
- C:\Windows\System\LDciHir.exe
  C:\Windows\System\LDciHir.exe
  2⤵
  PID:9064
- C:\Windows\System\JsepXxu.exe
  C:\Windows\System\JsepXxu.exe
  2⤵
  PID:9116
- C:\Windows\System\LIBIfLF.exe
  C:\Windows\System\LIBIfLF.exe
  2⤵
  PID:9144
- C:\Windows\System\vepRfUo.exe
  C:\Windows\System\vepRfUo.exe
  2⤵
  PID:9480
- C:\Windows\System\YQIzktr.exe
  C:\Windows\System\YQIzktr.exe
  2⤵
  PID:9520
- C:\Windows\System\nBMbxrm.exe
  C:\Windows\System\nBMbxrm.exe
  2⤵
  PID:9648
- C:\Windows\System\BmFcoFH.exe
  C:\Windows\System\BmFcoFH.exe
  2⤵
  PID:10244
- C:\Windows\System\KuIUoed.exe
  C:\Windows\System\KuIUoed.exe
  2⤵
  PID:10264
- C:\Windows\System\LyDDwBA.exe
  C:\Windows\System\LyDDwBA.exe
  2⤵
  PID:10288
- C:\Windows\System\uXcmqDr.exe
  C:\Windows\System\uXcmqDr.exe
  2⤵
  PID:10308
- C:\Windows\System\pkSOfVx.exe
  C:\Windows\System\pkSOfVx.exe
  2⤵
  PID:10332
- C:\Windows\System\ZaZOKbb.exe
  C:\Windows\System\ZaZOKbb.exe
  2⤵
  PID:10352
- C:\Windows\System\xnYuSxU.exe
  C:\Windows\System\xnYuSxU.exe
  2⤵
  PID:10380
- C:\Windows\System\SzlIfNw.exe
  C:\Windows\System\SzlIfNw.exe
  2⤵
  PID:10400
- C:\Windows\System\QJdtLFs.exe
  C:\Windows\System\QJdtLFs.exe
  2⤵
  PID:10424
- C:\Windows\System\CsNgNWQ.exe
  C:\Windows\System\CsNgNWQ.exe
  2⤵
  PID:10452
- C:\Windows\System\qtppXDn.exe
  C:\Windows\System\qtppXDn.exe
  2⤵
  PID:10468
- C:\Windows\System\fyOKLdt.exe
  C:\Windows\System\fyOKLdt.exe
  2⤵
  PID:10484
- C:\Windows\System\qgNKCkP.exe
  C:\Windows\System\qgNKCkP.exe
  2⤵
  PID:10508
- C:\Windows\System\yzVaayD.exe
  C:\Windows\System\yzVaayD.exe
  2⤵
  PID:10524
- C:\Windows\System\kgHcuIB.exe
  C:\Windows\System\kgHcuIB.exe
  2⤵
  PID:10552
- C:\Windows\System\IzlLFrD.exe
  C:\Windows\System\IzlLFrD.exe
  2⤵
  PID:10572
- C:\Windows\System\nLvGsEw.exe
  C:\Windows\System\nLvGsEw.exe
  2⤵
  PID:10592
- C:\Windows\System\okHRNBb.exe
  C:\Windows\System\okHRNBb.exe
  2⤵
  PID:10616
- C:\Windows\System\qEGnXvG.exe
  C:\Windows\System\qEGnXvG.exe
  2⤵
  PID:10640
- C:\Windows\System\wCIpJZI.exe
  C:\Windows\System\wCIpJZI.exe
  2⤵
  PID:10672
- C:\Windows\System\gRjKkXD.exe
  C:\Windows\System\gRjKkXD.exe
  2⤵
  PID:10692
- C:\Windows\System\Krdvkdl.exe
  C:\Windows\System\Krdvkdl.exe
  2⤵
  PID:10712
- C:\Windows\System\BvxCQOh.exe
  C:\Windows\System\BvxCQOh.exe
  2⤵
  PID:10732
- C:\Windows\System\yfUiwAG.exe
  C:\Windows\System\yfUiwAG.exe
  2⤵
  PID:10756
- C:\Windows\System\CNHnfUz.exe
  C:\Windows\System\CNHnfUz.exe
  2⤵
  PID:10784
- C:\Windows\System\PiqEGVC.exe
  C:\Windows\System\PiqEGVC.exe
  2⤵
  PID:10804
- C:\Windows\System\bnUKmAv.exe
  C:\Windows\System\bnUKmAv.exe
  2⤵
  PID:10820
- C:\Windows\System\hCNanri.exe
  C:\Windows\System\hCNanri.exe
  2⤵
  PID:10840
- C:\Windows\System\dTmTqhY.exe
  C:\Windows\System\dTmTqhY.exe
  2⤵
  PID:10864
- C:\Windows\System\hLckLtZ.exe
  C:\Windows\System\hLckLtZ.exe
  2⤵
  PID:10892
- C:\Windows\System\NjZJfnH.exe
  C:\Windows\System\NjZJfnH.exe
  2⤵
  PID:10912
- C:\Windows\System\oejjOpr.exe
  C:\Windows\System\oejjOpr.exe
  2⤵
  PID:10928
- C:\Windows\System\QoIHqbW.exe
  C:\Windows\System\QoIHqbW.exe
  2⤵
  PID:10944
- C:\Windows\System\dJhNCXH.exe
  C:\Windows\System\dJhNCXH.exe
  2⤵
  PID:10960
- C:\Windows\System\yCWbpOD.exe
  C:\Windows\System\yCWbpOD.exe
  2⤵
  PID:10976
- C:\Windows\System\QGdzpTn.exe
  C:\Windows\System\QGdzpTn.exe
  2⤵
  PID:11008
- C:\Windows\System\OvsCZDq.exe
  C:\Windows\System\OvsCZDq.exe
  2⤵
  PID:11032
- C:\Windows\System\PauCKAY.exe
  C:\Windows\System\PauCKAY.exe
  2⤵
  PID:11056
- C:\Windows\System\sQdaZyN.exe
  C:\Windows\System\sQdaZyN.exe
  2⤵
  PID:11072
- C:\Windows\System\BPningQ.exe
  C:\Windows\System\BPningQ.exe
  2⤵
  PID:11108
- C:\Windows\System\JYfGvVM.exe
  C:\Windows\System\JYfGvVM.exe
  2⤵
  PID:11132
- C:\Windows\System\rUCGhbr.exe
  C:\Windows\System\rUCGhbr.exe
  2⤵
  PID:11152
- C:\Windows\System\RwzFoFs.exe
  C:\Windows\System\RwzFoFs.exe
  2⤵
  PID:11168
- C:\Windows\System\VEVqosc.exe
  C:\Windows\System\VEVqosc.exe
  2⤵
  PID:11188
- C:\Windows\System\QYVawVe.exe
  C:\Windows\System\QYVawVe.exe
  2⤵
  PID:11216
- C:\Windows\System\nOQOuvp.exe
  C:\Windows\System\nOQOuvp.exe
  2⤵
  PID:11240
- C:\Windows\System\NSsLSrk.exe
  C:\Windows\System\NSsLSrk.exe
  2⤵
  PID:11256
- C:\Windows\System\tiLcSon.exe
  C:\Windows\System\tiLcSon.exe
  2⤵
  PID:9824
- C:\Windows\System\kGNEKbT.exe
  C:\Windows\System\kGNEKbT.exe
  2⤵
  PID:9204
- C:\Windows\System\KblxtfD.exe
  C:\Windows\System\KblxtfD.exe
  2⤵
  PID:5368
- C:\Windows\System\hjoebXM.exe
  C:\Windows\System\hjoebXM.exe
  2⤵
  PID:464
- C:\Windows\System\etGgLGh.exe
  C:\Windows\System\etGgLGh.exe
  2⤵
  PID:6956
- C:\Windows\System\GUSDtRg.exe
  C:\Windows\System\GUSDtRg.exe
  2⤵
  PID:6996
- C:\Windows\System\HgeeuEH.exe
  C:\Windows\System\HgeeuEH.exe
  2⤵
  PID:4616
- C:\Windows\System\cQJcoVF.exe
  C:\Windows\System\cQJcoVF.exe
  2⤵
  PID:6760
- C:\Windows\System\WWVXywK.exe
  C:\Windows\System\WWVXywK.exe
  2⤵
  PID:7696
- C:\Windows\System\oNbDTPh.exe
  C:\Windows\System\oNbDTPh.exe
  2⤵
  PID:6200
- C:\Windows\System\ZSvHOHO.exe
  C:\Windows\System\ZSvHOHO.exe
  2⤵
  PID:5560
- C:\Windows\System\UEvFzpR.exe
  C:\Windows\System\UEvFzpR.exe
  2⤵
  PID:3396
- C:\Windows\System\xkykMfU.exe
  C:\Windows\System\xkykMfU.exe
  2⤵
  PID:6548
- C:\Windows\System\oWSmQxX.exe
  C:\Windows\System\oWSmQxX.exe
  2⤵
  PID:8816
- C:\Windows\System\PKPxSLY.exe
  C:\Windows\System\PKPxSLY.exe
  2⤵
  PID:8960
- C:\Windows\System\cDRXglJ.exe
  C:\Windows\System\cDRXglJ.exe
  2⤵
  PID:10000
- C:\Windows\System\ApLRRMK.exe
  C:\Windows\System\ApLRRMK.exe
  2⤵
  PID:9316
- C:\Windows\System\xfjsqtJ.exe
  C:\Windows\System\xfjsqtJ.exe
  2⤵
  PID:9388
- C:\Windows\System\XUxdImy.exe
  C:\Windows\System\XUxdImy.exe
  2⤵
  PID:10200
- C:\Windows\System\dbmMfRP.exe
  C:\Windows\System\dbmMfRP.exe
  2⤵
  PID:8640
- C:\Windows\System\lMWuEDT.exe
  C:\Windows\System\lMWuEDT.exe
  2⤵
  PID:9600
- C:\Windows\System\bAgseQg.exe
  C:\Windows\System\bAgseQg.exe
  2⤵
  PID:9048
- C:\Windows\System\ESYlODw.exe
  C:\Windows\System\ESYlODw.exe
  2⤵
  PID:9180
- C:\Windows\System\gsTBshT.exe
  C:\Windows\System\gsTBshT.exe
  2⤵
  PID:9716
- C:\Windows\System\gUSdKLa.exe
  C:\Windows\System\gUSdKLa.exe
  2⤵
  PID:10260
- C:\Windows\System\peWigvG.exe
  C:\Windows\System\peWigvG.exe
  2⤵
  PID:10316
- C:\Windows\System\sBoylzP.exe
  C:\Windows\System\sBoylzP.exe
  2⤵
  PID:9868
- C:\Windows\System\rvNdEWW.exe
  C:\Windows\System\rvNdEWW.exe
  2⤵
  PID:10440
- C:\Windows\System\JdrkLkg.exe
  C:\Windows\System\JdrkLkg.exe
  2⤵
  PID:10460
- C:\Windows\System\vPbljCj.exe
  C:\Windows\System\vPbljCj.exe
  2⤵
  PID:10540
- C:\Windows\System\KCkytfR.exe
  C:\Windows\System\KCkytfR.exe
  2⤵
  PID:2504
- C:\Windows\System\VPuZOmk.exe
  C:\Windows\System\VPuZOmk.exe
  2⤵
  PID:11288
- C:\Windows\System\IpxSxPY.exe
  C:\Windows\System\IpxSxPY.exe
  2⤵
  PID:11308
- C:\Windows\System\CHNpttr.exe
  C:\Windows\System\CHNpttr.exe
  2⤵
  PID:11328
- C:\Windows\System\VDAzlFl.exe
  C:\Windows\System\VDAzlFl.exe
  2⤵
  PID:11352
- C:\Windows\System\ldJVRtt.exe
  C:\Windows\System\ldJVRtt.exe
  2⤵
  PID:11376
- C:\Windows\System\JUCXKhl.exe
  C:\Windows\System\JUCXKhl.exe
  2⤵
  PID:11392
- C:\Windows\System\mjDrsyl.exe
  C:\Windows\System\mjDrsyl.exe
  2⤵
  PID:11420
- C:\Windows\System\qTKbOAy.exe
  C:\Windows\System\qTKbOAy.exe
  2⤵
  PID:11444
- C:\Windows\System\krIQWHZ.exe
  C:\Windows\System\krIQWHZ.exe
  2⤵
  PID:11460
- C:\Windows\System\HwtvaZJ.exe
  C:\Windows\System\HwtvaZJ.exe
  2⤵
  PID:11484
- C:\Windows\System\TmhoJQH.exe
  C:\Windows\System\TmhoJQH.exe
  2⤵
  PID:11500
- C:\Windows\System\KBnZPKU.exe
  C:\Windows\System\KBnZPKU.exe
  2⤵
  PID:11516
- C:\Windows\System\VorClEm.exe
  C:\Windows\System\VorClEm.exe
  2⤵
  PID:11536
- C:\Windows\System\xiYxBhw.exe
  C:\Windows\System\xiYxBhw.exe
  2⤵
  PID:11552
- C:\Windows\System\XBHVVMr.exe
  C:\Windows\System\XBHVVMr.exe
  2⤵
  PID:11568
- C:\Windows\System\jsmlVeb.exe
  C:\Windows\System\jsmlVeb.exe
  2⤵
  PID:11588
- C:\Windows\System\obvzyux.exe
  C:\Windows\System\obvzyux.exe
  2⤵
  PID:11608
- C:\Windows\System\OjWCMjU.exe
  C:\Windows\System\OjWCMjU.exe
  2⤵
  PID:11636
- C:\Windows\System\gVtXETT.exe
  C:\Windows\System\gVtXETT.exe
  2⤵
  PID:11656
- C:\Windows\System\zjyahcx.exe
  C:\Windows\System\zjyahcx.exe
  2⤵
  PID:11672
- C:\Windows\System\bdIekZx.exe
  C:\Windows\System\bdIekZx.exe
  2⤵
  PID:11688
- C:\Windows\System\CwAkDRp.exe
  C:\Windows\System\CwAkDRp.exe
  2⤵
  PID:11708
- C:\Windows\System\vdYLUME.exe
  C:\Windows\System\vdYLUME.exe
  2⤵
  PID:11732
- C:\Windows\System\yBXdrsa.exe
  C:\Windows\System\yBXdrsa.exe
  2⤵
  PID:11756
- C:\Windows\System\FIzozmU.exe
  C:\Windows\System\FIzozmU.exe
  2⤵
  PID:11780
- C:\Windows\System\uaeJimF.exe
  C:\Windows\System\uaeJimF.exe
  2⤵
  PID:11800
- C:\Windows\System\UDlUUNw.exe
  C:\Windows\System\UDlUUNw.exe
  2⤵
  PID:11820
- C:\Windows\System\dzXaJfd.exe
  C:\Windows\System\dzXaJfd.exe
  2⤵
  PID:11836
- C:\Windows\System\DjSiTFU.exe
  C:\Windows\System\DjSiTFU.exe
  2⤵
  PID:11852
- C:\Windows\System\MWEgVUH.exe
  C:\Windows\System\MWEgVUH.exe
  2⤵
  PID:11868
- C:\Windows\System\qrnuLgi.exe
  C:\Windows\System\qrnuLgi.exe
  2⤵
  PID:11888
- C:\Windows\System\ODHyhmI.exe
  C:\Windows\System\ODHyhmI.exe
  2⤵
  PID:11912
- C:\Windows\System\MCgJKrJ.exe
  C:\Windows\System\MCgJKrJ.exe
  2⤵
  PID:11940
- C:\Windows\System\uwPYgpO.exe
  C:\Windows\System\uwPYgpO.exe
  2⤵
  PID:11960
- C:\Windows\System\cRyrMQG.exe
  C:\Windows\System\cRyrMQG.exe
  2⤵
  PID:11976
- C:\Windows\System\QdenXnK.exe
  C:\Windows\System\QdenXnK.exe
  2⤵
  PID:11996
- C:\Windows\System\omtuhlu.exe
  C:\Windows\System\omtuhlu.exe
  2⤵
  PID:12016
- C:\Windows\System\CkgznsQ.exe
  C:\Windows\System\CkgznsQ.exe
  2⤵
  PID:12032
- C:\Windows\System\oooeqHp.exe
  C:\Windows\System\oooeqHp.exe
  2⤵
  PID:12052
- C:\Windows\System\DPKiorI.exe
  C:\Windows\System\DPKiorI.exe
  2⤵
  PID:12072
- C:\Windows\System\TPTVOCp.exe
  C:\Windows\System\TPTVOCp.exe
  2⤵
  PID:12096
- C:\Windows\System\SCArEAz.exe
  C:\Windows\System\SCArEAz.exe
  2⤵
  PID:12120
- C:\Windows\System\bguxIoj.exe
  C:\Windows\System\bguxIoj.exe
  2⤵
  PID:12140
- C:\Windows\System\nLqyDXm.exe
  C:\Windows\System\nLqyDXm.exe
  2⤵
  PID:12156
- C:\Windows\System\wFtWwmp.exe
  C:\Windows\System\wFtWwmp.exe
  2⤵
  PID:12180
- C:\Windows\System\JbMCfGB.exe
  C:\Windows\System\JbMCfGB.exe
  2⤵
  PID:12204
- C:\Windows\System\IcrhpyT.exe
  C:\Windows\System\IcrhpyT.exe
  2⤵
  PID:12220
- C:\Windows\System\LkKXYKz.exe
  C:\Windows\System\LkKXYKz.exe
  2⤵
  PID:12236
- C:\Windows\System\pkAjjed.exe
  C:\Windows\System\pkAjjed.exe
  2⤵
  PID:12256
- C:\Windows\System\AyaoJOM.exe
  C:\Windows\System\AyaoJOM.exe
  2⤵
  PID:12272
- C:\Windows\System\FricmKG.exe
  C:\Windows\System\FricmKG.exe
  2⤵
  PID:10648
- C:\Windows\System\qxqXIxE.exe
  C:\Windows\System\qxqXIxE.exe
  2⤵
  PID:9244
- C:\Windows\System\Uoieizv.exe
  C:\Windows\System\Uoieizv.exe
  2⤵
  PID:10796
- C:\Windows\System\NnGVNUo.exe
  C:\Windows\System\NnGVNUo.exe
  2⤵
  PID:10816
- C:\Windows\System\fgxkOQe.exe
  C:\Windows\System\fgxkOQe.exe
  2⤵
  PID:10888
- C:\Windows\System\DrUURry.exe
  C:\Windows\System\DrUURry.exe
  2⤵
  PID:10968
- C:\Windows\System\JzAzkJe.exe
  C:\Windows\System\JzAzkJe.exe
  2⤵
  PID:11092
- C:\Windows\System\oeHrWUK.exe
  C:\Windows\System\oeHrWUK.exe
  2⤵
  PID:9368
- C:\Windows\System\SSZRTQU.exe
  C:\Windows\System\SSZRTQU.exe
  2⤵
  PID:11144
- C:\Windows\System\BlfBlyQ.exe
  C:\Windows\System\BlfBlyQ.exe
  2⤵
  PID:9424
- C:\Windows\System\CiYLpSj.exe
  C:\Windows\System\CiYLpSj.exe
  2⤵
  PID:9476
- C:\Windows\System\dqNdagC.exe
  C:\Windows\System\dqNdagC.exe
  2⤵
  PID:4820
- C:\Windows\System\WKpWEPg.exe
  C:\Windows\System\WKpWEPg.exe
  2⤵
  PID:8684
- C:\Windows\System\CAwErEH.exe
  C:\Windows\System\CAwErEH.exe
  2⤵
  PID:9348
- C:\Windows\System\KkmBepv.exe
  C:\Windows\System\KkmBepv.exe
  2⤵
  PID:12308
- C:\Windows\System\TThOeGT.exe
  C:\Windows\System\TThOeGT.exe
  2⤵
  PID:12328
- C:\Windows\System\hWcwVam.exe
  C:\Windows\System\hWcwVam.exe
  2⤵
  PID:12352
- C:\Windows\System\EGqKOLl.exe
  C:\Windows\System\EGqKOLl.exe
  2⤵
  PID:12376
- C:\Windows\System\IusLniC.exe
  C:\Windows\System\IusLniC.exe
  2⤵
  PID:12396
- C:\Windows\System\oVVrGCt.exe
  C:\Windows\System\oVVrGCt.exe
  2⤵
  PID:12412
- C:\Windows\System\rtXBpCp.exe
  C:\Windows\System\rtXBpCp.exe
  2⤵
  PID:12428
- C:\Windows\System\ypRiOHK.exe
  C:\Windows\System\ypRiOHK.exe
  2⤵
  PID:12448
- C:\Windows\System\sBSJGAF.exe
  C:\Windows\System\sBSJGAF.exe
  2⤵
  PID:12472
- C:\Windows\System\KiRltkZ.exe
  C:\Windows\System\KiRltkZ.exe
  2⤵
  PID:12488
- C:\Windows\System\VOKTlEz.exe
  C:\Windows\System\VOKTlEz.exe
  2⤵
  PID:12504
- C:\Windows\System\rMzitGf.exe
  C:\Windows\System\rMzitGf.exe
  2⤵
  PID:12520
- C:\Windows\System\npGrpSu.exe
  C:\Windows\System\npGrpSu.exe
  2⤵
  PID:12536
- C:\Windows\System\SYFfRAh.exe
  C:\Windows\System\SYFfRAh.exe
  2⤵
  PID:12552
- C:\Windows\System\wPvZMqo.exe
  C:\Windows\System\wPvZMqo.exe
  2⤵
  PID:12568
- C:\Windows\System\OrSlaQB.exe
  C:\Windows\System\OrSlaQB.exe
  2⤵
  PID:12584
- C:\Windows\System\UlbMItE.exe
  C:\Windows\System\UlbMItE.exe
  2⤵
  PID:12604
- C:\Windows\System\PUplHKG.exe
  C:\Windows\System\PUplHKG.exe
  2⤵
  PID:12620
- C:\Windows\System\kryaSEV.exe
  C:\Windows\System\kryaSEV.exe
  2⤵
  PID:12640
- C:\Windows\System\AwKQrEY.exe
  C:\Windows\System\AwKQrEY.exe
  2⤵
  PID:12660
- C:\Windows\System\OolHsGU.exe
  C:\Windows\System\OolHsGU.exe
  2⤵
  PID:12680
- C:\Windows\System\YEZYDsf.exe
  C:\Windows\System\YEZYDsf.exe
  2⤵
  PID:12700
- C:\Windows\System\OIbxJfF.exe
  C:\Windows\System\OIbxJfF.exe
  2⤵
  PID:12724
- C:\Windows\System\JqSLXAj.exe
  C:\Windows\System\JqSLXAj.exe
  2⤵
  PID:12740
- C:\Windows\System\BOaONmD.exe
  C:\Windows\System\BOaONmD.exe
  2⤵
  PID:12776
- C:\Windows\System\uucOutk.exe
  C:\Windows\System\uucOutk.exe
  2⤵
  PID:12792
- C:\Windows\System\EUphbNg.exe
  C:\Windows\System\EUphbNg.exe
  2⤵
  PID:12816
- C:\Windows\System\ZhUAmBI.exe
  C:\Windows\System\ZhUAmBI.exe
  2⤵
  PID:12836
- C:\Windows\System\AVuQDSS.exe
  C:\Windows\System\AVuQDSS.exe
  2⤵
  PID:12864
- C:\Windows\System\oLdwhcF.exe
  C:\Windows\System\oLdwhcF.exe
  2⤵
  PID:12884
- C:\Windows\System\HHwHfqo.exe
  C:\Windows\System\HHwHfqo.exe
  2⤵
  PID:12904
- C:\Windows\System\dCwuXdY.exe
  C:\Windows\System\dCwuXdY.exe
  2⤵
  PID:12924
- C:\Windows\System\DoRDVIC.exe
  C:\Windows\System\DoRDVIC.exe
  2⤵
  PID:12948
- C:\Windows\System\LOnlzQK.exe
  C:\Windows\System\LOnlzQK.exe
  2⤵
  PID:12980
- C:\Windows\System\juIhdWE.exe
  C:\Windows\System\juIhdWE.exe
  2⤵
  PID:12996
- C:\Windows\System\IgMryqC.exe
  C:\Windows\System\IgMryqC.exe
  2⤵
  PID:13020
- C:\Windows\System\CRLfkEZ.exe
  C:\Windows\System\CRLfkEZ.exe
  2⤵
  PID:13040
- C:\Windows\System\PmdVSXC.exe
  C:\Windows\System\PmdVSXC.exe
  2⤵
  PID:13076
- C:\Windows\System\wRBmbvI.exe
  C:\Windows\System\wRBmbvI.exe
  2⤵
  PID:13096
- C:\Windows\System\rlrtueY.exe
  C:\Windows\System\rlrtueY.exe
  2⤵
  PID:13116
- C:\Windows\System\gUCThxT.exe
  C:\Windows\System\gUCThxT.exe
  2⤵
  PID:10860
- C:\Windows\System\KsBHtPK.exe
  C:\Windows\System\KsBHtPK.exe
  2⤵
  PID:10996
- C:\Windows\System\zDyDdnY.exe
  C:\Windows\System\zDyDdnY.exe
  2⤵
  PID:10104
- C:\Windows\System\TWFuNLN.exe
  C:\Windows\System\TWFuNLN.exe
  2⤵
  PID:10848
- C:\Windows\System\hyrXINM.exe
  C:\Windows\System\hyrXINM.exe
  2⤵
  PID:10632
- C:\Windows\System\CvqGiUU.exe
  C:\Windows\System\CvqGiUU.exe
  2⤵
  PID:2584
- C:\Windows\System\EcINwhc.exe
  C:\Windows\System\EcINwhc.exe
  2⤵
  PID:3928
- C:\Windows\System\cBzbxQD.exe
  C:\Windows\System\cBzbxQD.exe
  2⤵
  PID:1848
- C:\Windows\System\ESTiHiW.exe
  C:\Windows\System\ESTiHiW.exe
  2⤵
  PID:5932
- C:\Windows\System\MpqWcnE.exe
  C:\Windows\System\MpqWcnE.exe
  2⤵
  PID:11812
- C:\Windows\System\TLOJXDE.exe
  C:\Windows\System\TLOJXDE.exe
  2⤵
  PID:7680
- C:\Windows\System\eMLDByy.exe
  C:\Windows\System\eMLDByy.exe
  2⤵
  PID:10232
- C:\Windows\System\FrGDExT.exe
  C:\Windows\System\FrGDExT.exe
  2⤵
  PID:9196
- C:\Windows\System\zbSPiRh.exe
  C:\Windows\System\zbSPiRh.exe
  2⤵
  PID:10436
- C:\Windows\System\AyWrgcK.exe
  C:\Windows\System\AyWrgcK.exe
  2⤵
  PID:11272
- C:\Windows\System\CYMXvUz.exe
  C:\Windows\System\CYMXvUz.exe
  2⤵
  PID:8460
- C:\Windows\System\MpmdVDP.exe
  C:\Windows\System\MpmdVDP.exe
  2⤵
  PID:12044
- C:\Windows\System\uRunlBd.exe
  C:\Windows\System\uRunlBd.exe
  2⤵
  PID:12088
- C:\Windows\System\dLaiqyy.exe
  C:\Windows\System\dLaiqyy.exe
  2⤵
  PID:12676
- C:\Windows\System\NzbPhFx.exe
  C:\Windows\System\NzbPhFx.exe
  2⤵
  PID:10688
- C:\Windows\System\JbQtbpO.exe
  C:\Windows\System\JbQtbpO.exe
  2⤵
  PID:640
- C:\Windows\System\RpAKtKC.exe
  C:\Windows\System\RpAKtKC.exe
  2⤵
  PID:11956
- C:\Windows\System\ChlDNxP.exe
  C:\Windows\System\ChlDNxP.exe
  2⤵
  PID:11764
- C:\Windows\System\qBkGOON.exe
  C:\Windows\System\qBkGOON.exe
  2⤵
  PID:11808
- C:\Windows\System\kbDaUcl.exe
  C:\Windows\System\kbDaUcl.exe
  2⤵
  PID:11844
- C:\Windows\System\xImeeIO.exe
  C:\Windows\System\xImeeIO.exe
  2⤵
  PID:7816
- C:\Windows\System\vNDZeyX.exe
  C:\Windows\System\vNDZeyX.exe
  2⤵
  PID:11928
- C:\Windows\System\wryIqfZ.exe
  C:\Windows\System\wryIqfZ.exe
  2⤵
  PID:12092
- C:\Windows\System\ZqBBGVc.exe
  C:\Windows\System\ZqBBGVc.exe
  2⤵
  PID:9264
- C:\Windows\System\BNRvvTB.exe
  C:\Windows\System\BNRvvTB.exe
  2⤵
  PID:9948
- C:\Windows\System\pQrbKPQ.exe
  C:\Windows\System\pQrbKPQ.exe
  2⤵
  PID:12920
- C:\Windows\System\KguOMwB.exe
  C:\Windows\System\KguOMwB.exe
  2⤵
  PID:13168
- C:\Windows\System\lkwlwih.exe
  C:\Windows\System\lkwlwih.exe
  2⤵
  PID:11596
- C:\Windows\System\NeUIcnw.exe
  C:\Windows\System\NeUIcnw.exe
  2⤵
  PID:9968
- C:\Windows\System\sfFRbEU.exe
  C:\Windows\System\sfFRbEU.exe
  2⤵
  PID:10972
- C:\Windows\System\RQTHGPi.exe
  C:\Windows\System\RQTHGPi.exe
  2⤵
  PID:4364
- C:\Windows\System\VRbJuhm.exe
  C:\Windows\System\VRbJuhm.exe
  2⤵
  PID:10076
- C:\Windows\System\YPJUxma.exe
  C:\Windows\System\YPJUxma.exe
  2⤵
  PID:1200
- C:\Windows\System\KgQpLCW.exe
  C:\Windows\System\KgQpLCW.exe
  2⤵
  PID:12732
- C:\Windows\System\SADqCkU.exe
  C:\Windows\System\SADqCkU.exe
  2⤵
  PID:10388
- C:\Windows\System\CeFaUfJ.exe
  C:\Windows\System\CeFaUfJ.exe
  2⤵
  PID:10256
- C:\Windows\System\KNIYMoo.exe
  C:\Windows\System\KNIYMoo.exe
  2⤵
  PID:10764
- C:\Windows\System\UsBCCMg.exe
  C:\Windows\System\UsBCCMg.exe
  2⤵
  PID:7496
- C:\Windows\System\lwajnYY.exe
  C:\Windows\System\lwajnYY.exe
  2⤵
  PID:12944
- C:\Windows\System\vPeDdTX.exe
  C:\Windows\System\vPeDdTX.exe
  2⤵
  PID:13012
- C:\Windows\System\JRJgUKe.exe
  C:\Windows\System\JRJgUKe.exe
  2⤵
  PID:12348
- C:\Windows\System\xbHvWzN.exe
  C:\Windows\System\xbHvWzN.exe
  2⤵
  PID:13260
- C:\Windows\System\CZLSoRO.exe
  C:\Windows\System\CZLSoRO.exe
  2⤵
  PID:12336
- C:\Windows\System\GatVlKo.exe
  C:\Windows\System\GatVlKo.exe
  2⤵
  PID:12440
- C:\Windows\System\CBlKViW.exe
  C:\Windows\System\CBlKViW.exe
  2⤵
  PID:12484
- C:\Windows\System\GwADOun.exe
  C:\Windows\System\GwADOun.exe
  2⤵
  PID:8364
- C:\Windows\System\mNssxML.exe
  C:\Windows\System\mNssxML.exe
  2⤵
  PID:12560
- C:\Windows\System\jXpYuuK.exe
  C:\Windows\System\jXpYuuK.exe
  2⤵
  PID:4652
- C:\Windows\System\AmiFInn.exe
  C:\Windows\System\AmiFInn.exe
  2⤵
  PID:4604
- C:\Windows\System\BZvosQw.exe
  C:\Windows\System\BZvosQw.exe
  2⤵
  PID:7448
- C:\Windows\System\lHNqdvI.exe
  C:\Windows\System\lHNqdvI.exe
  2⤵
  PID:5848
- C:\Windows\System\lvsjbjY.exe
  C:\Windows\System\lvsjbjY.exe
  2⤵
  PID:1992
- C:\Windows\System\HHcjFcz.exe
  C:\Windows\System\HHcjFcz.exe
  2⤵
  PID:13176
- C:\Windows\System\swxCbMT.exe
  C:\Windows\System\swxCbMT.exe
  2⤵
  PID:12784
- C:\Windows\System\pdIqWtT.exe
  C:\Windows\System\pdIqWtT.exe
  2⤵
  PID:11200
- C:\Windows\System\HdFUrzC.exe
  C:\Windows\System\HdFUrzC.exe
  2⤵
  PID:13132
- C:\Windows\System\DfIGUbh.exe
  C:\Windows\System\DfIGUbh.exe
  2⤵
  PID:2488
- C:\Windows\System\FdXASZE.exe
  C:\Windows\System\FdXASZE.exe
  2⤵
  PID:9300
- C:\Windows\System\ZvryoVj.exe
  C:\Windows\System\ZvryoVj.exe
  2⤵
  PID:12736
- C:\Windows\System\aEndGar.exe
  C:\Windows\System\aEndGar.exe
  2⤵
  PID:9616
- C:\Windows\System\mNDwwVZ.exe
  C:\Windows\System\mNDwwVZ.exe
  2⤵
  PID:12264
- C:\Windows\System\dbxrtBx.exe
  C:\Windows\System\dbxrtBx.exe
  2⤵
  PID:13088
- C:\Windows\System\AGcsaHA.exe
  C:\Windows\System\AGcsaHA.exe
  2⤵
  PID:10052
- C:\Windows\System\DcGBQHV.exe
  C:\Windows\System\DcGBQHV.exe
  2⤵
  PID:3092
- C:\Windows\System\hZoKhUW.exe
  C:\Windows\System\hZoKhUW.exe
  2⤵
  PID:2964
- C:\Windows\System\ynbMoEd.exe
  C:\Windows\System\ynbMoEd.exe
  2⤵
  PID:4644
- C:\Windows\System\bCCYzTR.exe
  C:\Windows\System\bCCYzTR.exe
  2⤵
  PID:4492
- C:\Windows\System\KeMjdMG.exe
  C:\Windows\System\KeMjdMG.exe
  2⤵
  PID:12852
- C:\Windows\System\vCAujkX.exe
  C:\Windows\System\vCAujkX.exe
  2⤵
  PID:6768
- C:\Windows\System\jkpzEmi.exe
  C:\Windows\System\jkpzEmi.exe
  2⤵
  PID:7416
- C:\Windows\System\WnlVuVK.exe
  C:\Windows\System\WnlVuVK.exe
  2⤵
  PID:11924
- C:\Windows\System\mrmDEaY.exe
  C:\Windows\System\mrmDEaY.exe
  2⤵
  PID:8996
- C:\Windows\System\qQTcYPd.exe
  C:\Windows\System\qQTcYPd.exe
  2⤵
  PID:13340
- C:\Windows\System\ddudtsE.exe
  C:\Windows\System\ddudtsE.exe
  2⤵
  PID:13368
- C:\Windows\System\PcGKrNc.exe
  C:\Windows\System\PcGKrNc.exe
  2⤵
  PID:13432
- C:\Windows\System\GEhFeeG.exe
  C:\Windows\System\GEhFeeG.exe
  2⤵
  PID:13504
- C:\Windows\System\boANUpG.exe
  C:\Windows\System\boANUpG.exe
  2⤵
  PID:13524
- C:\Windows\System\uVglrxP.exe
  C:\Windows\System\uVglrxP.exe
  2⤵
  PID:13540
- C:\Windows\System\hLhPhhK.exe
  C:\Windows\System\hLhPhhK.exe
  2⤵
  PID:13564
- C:\Windows\System\voBoCov.exe
  C:\Windows\System\voBoCov.exe
  2⤵
  PID:13608
- C:\Windows\System\WcWKeGa.exe
  C:\Windows\System\WcWKeGa.exe
  2⤵
  PID:13628
- C:\Windows\System\weMUedw.exe
  C:\Windows\System\weMUedw.exe
  2⤵
  PID:13648
- C:\Windows\System\gNCXsQA.exe
  C:\Windows\System\gNCXsQA.exe
  2⤵
  PID:13668
- C:\Windows\System\sgGgFQV.exe
  C:\Windows\System\sgGgFQV.exe
  2⤵
  PID:13692
- C:\Windows\System\EVTFLkK.exe
  C:\Windows\System\EVTFLkK.exe
  2⤵
  PID:13712
- C:\Windows\System\XqCHmEe.exe
  C:\Windows\System\XqCHmEe.exe
  2⤵
  PID:13736
- C:\Windows\System\eSWYRYu.exe
  C:\Windows\System\eSWYRYu.exe
  2⤵
  PID:13808
- C:\Windows\System\qnlhdTt.exe
  C:\Windows\System\qnlhdTt.exe
  2⤵
  PID:13824
- C:\Windows\System\wOQJhpg.exe
  C:\Windows\System\wOQJhpg.exe
  2⤵
  PID:14008
- C:\Windows\System\XwHcllD.exe
  C:\Windows\System\XwHcllD.exe
  2⤵
  PID:14024
- C:\Windows\System\fReARdq.exe
  C:\Windows\System\fReARdq.exe
  2⤵
  PID:14048
- C:\Windows\System\AphBcOz.exe
  C:\Windows\System\AphBcOz.exe
  2⤵
  PID:14136
- C:\Windows\System\KkLeJsG.exe
  C:\Windows\System\KkLeJsG.exe
  2⤵
  PID:14156
- C:\Windows\System\LDSPLmk.exe
  C:\Windows\System\LDSPLmk.exe
  2⤵
  PID:14172
- C:\Windows\System\qjltzTG.exe
  C:\Windows\System\qjltzTG.exe
  2⤵
  PID:14188
- C:\Windows\System\qraQOrn.exe
  C:\Windows\System\qraQOrn.exe
  2⤵
  PID:14204
- C:\Windows\System\GGHJefk.exe
  C:\Windows\System\GGHJefk.exe
  2⤵
  PID:14220
- C:\Windows\System\UaRWVLI.exe
  C:\Windows\System\UaRWVLI.exe
  2⤵
  PID:14236
- C:\Windows\System\UQCyYlO.exe
  C:\Windows\System\UQCyYlO.exe
  2⤵
  PID:14256
- C:\Windows\System\qDkXSab.exe
  C:\Windows\System\qDkXSab.exe
  2⤵
  PID:14280
- C:\Windows\System\uoGBlmC.exe
  C:\Windows\System\uoGBlmC.exe
  2⤵
  PID:14304
- C:\Windows\System\XHsbRCT.exe
  C:\Windows\System\XHsbRCT.exe
  2⤵
  PID:14320
- C:\Windows\System\qfaYUVW.exe
  C:\Windows\System\qfaYUVW.exe
  2⤵
  PID:12192
- C:\Windows\System\ZUhGGew.exe
  C:\Windows\System\ZUhGGew.exe
  2⤵
  PID:10792
- C:\Windows\System\vbxlLIm.exe
  C:\Windows\System\vbxlLIm.exe
  2⤵
  PID:1756
- C:\Windows\System\yWiSeIA.exe
  C:\Windows\System\yWiSeIA.exe
  2⤵
  PID:6196
- C:\Windows\System\RTqSjmI.exe
  C:\Windows\System\RTqSjmI.exe
  2⤵
  PID:12252
- C:\Windows\System\eMgUKmL.exe
  C:\Windows\System\eMgUKmL.exe
  2⤵
  PID:9296
- C:\Windows\System\TMmJmfG.exe
  C:\Windows\System\TMmJmfG.exe
  2⤵
  PID:13440
- C:\Windows\System\XFkOTVZ.exe
  C:\Windows\System\XFkOTVZ.exe
  2⤵
  PID:13792
- C:\Windows\System\wDuLiSb.exe
  C:\Windows\System\wDuLiSb.exe
  2⤵
  PID:14016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_mdf4ofn5.0u4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mdf4ofn5.0u4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

CJKKVro.exe

Path C:\Windows\System\CJKKVro.exe
Size 1.7MB
SHA256 ccf4ae43534d734c92195cef231a7e0d37b6f80dfa1ae28f8c8ab8e885ae4e37
MD5 97ac2daf271a90973e5ced74585b7b26
SHA1 1587468481a4d182ddab88b4c58f0864e2e0dd72
SHA512 7088e86cbec92538f4fb4fa8882bdab0c116e51e096a1eba9497bc4d50eaf6382d6a7cf8c55fedeb98144e17b61d320bead502fd005d65d74245d485d4a734c8
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJE8:Lz071uv4BPMkyW10/w16BvZXBCurmo8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

DqLpzye.exe

Path C:\Windows\System\DqLpzye.exe
Size 1.7MB
SHA256 3aa482dda3fe3ad7d64c40b0dd7f7e9746e11b4e0830d8df88c95b3faa9f0f9b
MD5 0e1038aac8824bb878efdf1f2f0cc97c
SHA1 3c6d5502c404da9ef22b3f501a3e251221b62356
SHA512 9f1df3ec39655ca4187e1fff82ed03d8149acee0c70e9a0521fb615392bf325e18b756f240df833a017f932470ba13c94400181a221cdbb73a3faa4d6702aa5b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEj:Lz071uv4BPMkyW10/w16BvZXBCurmo8s
MD5 SHA1 SHA512 SSDEEP

Submit Download

DrtjLkY.exe

Path C:\Windows\System\DrtjLkY.exe
Size 1.7MB
SHA256 36bd6d63940d6bec72ec9bff10b5dd5e235696d22542ff020c5aed439565ba76
MD5 888d6a695deaba8146755724093067e8
SHA1 1329111f7f05d422b9413e301c6b880b8e6c7d73
SHA512 b64f9647ac3462eeb2c9466ee738e894a8f1be95b6663dfa6bbe3a3055c00335e7805c99b11c69608f97b48a1699cff5e29d6ff02e65640048ac3ce79c1dcdd7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEn:Lz071uv4BPMkyW10/w16BvZXBCurmo8A
MD5 SHA1 SHA512 SSDEEP

Submit Download

EOWXFjv.exe

Path C:\Windows\System\EOWXFjv.exe
Size 1.7MB
SHA256 ae82222fa7f4760b0a8eec185c8c33f69204efffb7580fb3b08839974f6f46f0
MD5 e8a42116501065d6a426b83a56c64dda
SHA1 dd1af1915e41102e4df03f49aaec92eccba44384
SHA512 a6c5fa8374c29a963ef81aaa7769b6ca0438c890e900c8af31991c76abb92d2774dba35525d4f02a2ffd9ca85648425d9ac73fae3b358d6a0bd52438bdace92a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEH:Lz071uv4BPMkyW10/w16BvZXBCurmo8U
MD5 SHA1 SHA512 SSDEEP

Submit Download

FaJRgwg.exe

Path C:\Windows\System\FaJRgwg.exe
Size 1.7MB
SHA256 8af5a711520a4ced9287dc89d172496453c6fda7560da2aba4b15c6c3b90d589
MD5 c0dab626202c058b9d8055939e08f551
SHA1 a880b52f4201c67ca9d24d62b5748e199bb055c5
SHA512 e408b4e48dfb675a9ebc18fca31bb2123dfb60d5c7dbb5a03c85af084b50677edd6c200992c94a075212d86663e017cbc264ffb3ae845e5d14b69142669747ac
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEQ:Lz071uv4BPMkyW10/w16BvZXBCurmo8B
MD5 SHA1 SHA512 SSDEEP

Submit Download

GBrCnvq.exe

Path C:\Windows\System\GBrCnvq.exe
Size 1.7MB
SHA256 5316e135410739fa0869a382388ba9731ae98f1883059ca43d93c0ecb4b95827
MD5 fb35e64624a5a77010f2eef17ef1b6db
SHA1 cc1e710b9d6b1cd48e671b007f3748ad91b6b8fc
SHA512 397cf7b5b1a8e9af71b59f5c7132f90a305da0e065d3c012194f0714d1aba7a87d8db6990eb32cb1063f454fbec52e3f4530fa67b970652ebbfcdb128bf187d5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJES:Lz071uv4BPMkyW10/w16BvZXBCurmo8n
MD5 SHA1 SHA512 SSDEEP

Submit Download

GNoCMRV.exe

Path C:\Windows\System\GNoCMRV.exe
Size 1.7MB
SHA256 b9140beefa6af54a4b86fbcd717e94b02bf7bd3eaa23714520c9e90e2bfcb46d
MD5 4be10bc064313b693b8f12782a705464
SHA1 4628887ccc0e316c1dd65dc5e4a45c073b93ffd2
SHA512 eb1ee440b3a3615a410018c0bfe31299ed0dd149b04e7ab7416d5a2eabbfc62a71ed04a6e0de8f3ac2e43cc1f1b238d900f9cd1404410ecef7b0eb7eaa114172
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEa:Lz071uv4BPMkyW10/w16BvZXBCurmo8D
MD5 SHA1 SHA512 SSDEEP

Submit Download

IQoJmHi.exe

Path C:\Windows\System\IQoJmHi.exe
Size 1.7MB
SHA256 7ef80999a7a4e85c204e0e084ff8430aa20fc61d752de3daa5bf59eecdc21635
MD5 77dfb2e57511d679f593ffe71eb306b1
SHA1 d4893176f6746f15f9ec527cf35c7cd946e6e8b0
SHA512 137b56b8fb8c4fd65d81cd965ad40374282f7ff131c3270e0c134717d60f33be66136687f42ee8b1e2d0f4973f7d322ee76996f49583ab664f884a257d8b25a6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEV:Lz071uv4BPMkyW10/w16BvZXBCurmo8W
MD5 SHA1 SHA512 SSDEEP

Submit Download

IqXpYLL.exe

Path C:\Windows\System\IqXpYLL.exe
Size 1.7MB
SHA256 2ae7259cd6e084c74c621515cc0e2ef8a9d0f40faff0f7b1606d0f5ac58f7160
MD5 94b52c94a5f2921b9bdd9e964be5cab5
SHA1 d4a471f04534ae533d95741095d995bc3e6aa38c
SHA512 0c2ea9d61ebdd7f4f0aa24bab9cbb937d8f3e247572839654cd702f97db24a853ff42a08982d42cc4f98773cbe33270b51471670449e50f09ac9db5b18e45b63
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEG:Lz071uv4BPMkyW10/w16BvZXBCurmo8T
MD5 SHA1 SHA512 SSDEEP

Submit Download

KwDGHnE.exe

Path C:\Windows\System\KwDGHnE.exe
Size 1.7MB
SHA256 e06234b37b968d173c1f660e79634f1b8b9fdc614025f5828b97b3a9c0e9cd2d
MD5 36455ce106064bf383a5c09dec8074bb
SHA1 dab4c4c02db6797a0be0e0030fecfc770e58d586
SHA512 fdca5a4ad959f991b16cadfb756facc603238f598bc99285b58376af29de511703719dae4864fc805a030835917b4f1ec9efe4ca0ac17fe05844b0a201a29c9c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJE/:Lz071uv4BPMkyW10/w16BvZXBCurmo88
MD5 SHA1 SHA512 SSDEEP

Submit Download

PwBlOOQ.exe

Path C:\Windows\System\PwBlOOQ.exe
Size 1.7MB
SHA256 781c158953587d3a9050e855f1b3da942a52d2c784729874bc364e127d95238c
MD5 3cf579c910095e0aa648bf66b58b9d11
SHA1 100280fc426be8d7ec6d22b21eec3138e10a4af8
SHA512 117d382a4b5192147d24c851347c8b011d39c3c855fad62b18860b8e361f2a7ff48ee85e1528060acf542c3469c6e5550ca23776f19d433c339b2b9c5008746a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJED:Lz071uv4BPMkyW10/w16BvZXBCurmo8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

RrFgFLV.exe

Path C:\Windows\System\RrFgFLV.exe
Size 1.7MB
SHA256 84052b03f971738b9beb4590de41381187bc1fca7d427f3d64e9e9b8d4ccea2f
MD5 5fa9fefbbf93a62a6241e641942800f7
SHA1 30fcc40f1eed79b443cf663fd0133c298850792c
SHA512 1e6adbcd42ad394f6fef452f08a94c3f6acac52023ae5f0cc7ee68bc7a2fedf2c91b51da48900e57f6df1d3ed5c2723b78791716969e7200f885556e481ddd74
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJE4:Lz071uv4BPMkyW10/w16BvZXBCurmo8J
MD5 SHA1 SHA512 SSDEEP

Submit Download

SIHvofu.exe

Path C:\Windows\System\SIHvofu.exe
Size 1.7MB
SHA256 49774e0746592a748d9c743379bbd96c0a9c029d05be2b03061ff9385476e2c4
MD5 c77493f5d953844ae5c8327848c3cd5c
SHA1 ee76698f0d52ec6b0932990401dfe9adba93ff4c
SHA512 3e33cf17f69842ffa98c73dddeefec39989fdc97a08253bf52c6ba8a5413347e680eb5112e81cb51d9a67a1860189ce5e6d91d31666839d2d0380cac962f9019
SSDEEP 49152:Lz071uv4BPMkyW10/w16BvZXBCurmo8n2:NABw
MD5 SHA1 SHA512 SSDEEP

Submit Download

SWvTLgp.exe

Path C:\Windows\System\SWvTLgp.exe
Size 1.7MB
SHA256 dc7cdda966fbf3aa8e1debc6dff4ece6e3e26e38ce7adb3ee64a84514489f564
MD5 eaca3568d1f62e19e51f0882e863d18c
SHA1 3d6318db3d407cce2ffc05a3a8b371004644dae2
SHA512 b4407d3849ca7a6655f236b9c968c8e5873a45125fb5ec8fc77f9b92e48182bdeb912a1ed52ce3001ce52a609897cdf2bb20157c065aecbeb3785362d03c7f0f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEj:Lz071uv4BPMkyW10/w16BvZXBCurmo86
MD5 SHA1 SHA512 SSDEEP

Submit Download

TOcaxzX.exe

Path C:\Windows\System\TOcaxzX.exe
Size 1.7MB
SHA256 a679740557f7277e8f0184bb44d692f30064385c3719bb696638d72ab0005209
MD5 4efca261b6e3bab9ab87b692d3de6320
SHA1 d4b816a35916985f5b4f0455ff87e7d387872316
SHA512 d581e74aa6a4acda39dbf415a09cf30ae0e034e2955130b07fe6d73415059be7cfcfe8639a0e0372e63922ab23031753e56781b6c115f25ed19aa912e811bd58
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJE0:Lz071uv4BPMkyW10/w16BvZXBCurmo85
MD5 SHA1 SHA512 SSDEEP

Submit Download

VPRldDA.exe

Path C:\Windows\System\VPRldDA.exe
Size 8B
SHA256 889f3baefc9f46c7632a467db8882ec92f1f0df14da91d5a211e7484de261e45
MD5 6c6a33c852f4e05ffd14cdf0dcab7779
SHA1 70449821f99925d7b8d245181569b7ac4d2ffae8
SHA512 92e5654661ef50c470f84dbec4dcad9efdca5e4026c073f08c798af48c0b5d8107a7b2ff4d63fdb982f371e15d79e95f8a6d716a30b5c5123a7273c49d650d19
MD5 SHA1 SHA512

Submit Download

WEfJHNb.exe

Path C:\Windows\System\WEfJHNb.exe
Size 1.7MB
SHA256 b138e0265daee3fe2b304c0172b92472e3092a82a168296b7820d78e6df1472a
MD5 5741daf52755a50b2364a1ef1a60c802
SHA1 3989856fe275e0629b2983df4617fe0590a55ec2
SHA512 8c0858b13e32e7958c51e6cdf7b15cd254bc26a6df805f2ce0668784901be279982f1a075b956db1c6a0d071ee2e2a4dddad9ff7c3bce9eddddcdae41603ec40
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEY:Lz071uv4BPMkyW10/w16BvZXBCurmo8b
MD5 SHA1 SHA512 SSDEEP

Submit Download

WSjcMAa.exe

Path C:\Windows\System\WSjcMAa.exe
Size 1.7MB
SHA256 f2e554e3fb159ff2ae2b000b187a8a31f24dcccff9ba44a487cbd409554ffacf
MD5 bbce65a40a2086382b361705542cc8f5
SHA1 49324fc8a7b4b97330bb4081e6785231a686b849
SHA512 08d791773c1cd6ca20bf57b41bf449bd57de1706ea776f8164d1c632597a37ca87c31360dd8688ce4902bbdfc75e1b3f7e174456cd70f2af457ab2e898ef842d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJE4:Lz071uv4BPMkyW10/w16BvZXBCurmo8x
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZYzHnjC.exe

Path C:\Windows\System\ZYzHnjC.exe
Size 1.7MB
SHA256 ed10cb0eff3a699d7f1fab10f18ba0314d8b9d09cf4c10a0b62779dd4bfde18d
MD5 f3d1fb78334f5f9564cb713aaedbe1fb
SHA1 4839d4553c8e0d6f1c5166555d5c77a0cfca3f53
SHA512 942e916fcf1577fb79980be7cb4ebe88a838356a4598ecee44df4b3b5509c583e1e07ae882955dd0a22af1588d2b0c39762f05e2278181da2021b3020d445f2a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJE8:Lz071uv4BPMkyW10/w16BvZXBCurmo8h
MD5 SHA1 SHA512 SSDEEP

Submit Download

aJpWOkn.exe

Path C:\Windows\System\aJpWOkn.exe
Size 1.7MB
SHA256 f84652ccc8eacac87bca7e4def94df3bffbc81a8b83bf5c1c8629aae6d5ab6ef
MD5 585d7f3257f6defeb9cef9579ac5fbc3
SHA1 fc18801fb887072d94ff604a773761ba7a4935a4
SHA512 f719401f7a39c8b01dd516981a4269d0ec0116c69a79e8d012a1a6226d8ac070e3aada56f6b1456dbdb3684dbd09cfcdbfab1177a55844a981c3576e5f90631b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEO:Lz071uv4BPMkyW10/w16BvZXBCurmo81
MD5 SHA1 SHA512 SSDEEP

Submit Download

btPWomc.exe

Path C:\Windows\System\btPWomc.exe
Size 1.7MB
SHA256 a36ab08e6bd8f73b104de6efb20fe0cbd22ce8446c878aa4e289bae78dd7683d
MD5 9bc5aa62c1c1286603833fcb2c7aa616
SHA1 d752c081b5d1ab2a1709bdfd0c26a4b90661bcae
SHA512 f6ae15d76ea2fa43e486031716a113d8a2588fb66dd0708841e2a135ff04b47bf850efced9a6b091a71738d91dfc3b01ea13a694304976af8c5011dd23186a4b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEh:Lz071uv4BPMkyW10/w16BvZXBCurmo8M
MD5 SHA1 SHA512 SSDEEP

Submit Download

buzcMRo.exe

Path C:\Windows\System\buzcMRo.exe
Size 1.7MB
SHA256 69ddb9ef53ce87c5d02677fdb6a4abd04423d941e5f6b590c4a914d4b6d51a6c
MD5 5d81adf6799debcbb4e6ccfd3e7ec0c5
SHA1 32ec302e30f997123db28ce2efcfbd28d809e7ed
SHA512 c88021ff7e06c46aeffbe4b955307704ee4e79319d8074089c46255409fa169e81d335c7684d8b46d7f2c41a67fd3abd6913131fb54961cd52e7548548520c2e
SSDEEP 49152:Lz071uv4BPMkyW10/w16BvZXBCurmo8IC:NABZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cFxTwBw.exe

Path C:\Windows\System\cFxTwBw.exe
Size 1.7MB
SHA256 f3b392e99b54d97240d910a28c6abd5b20df8045666ab6b414483cac9e9286dc
MD5 7e1037368a9c035e73303794f692d6eb
SHA1 66532b52c7bfac659a6dc0304ca5ac591171c232
SHA512 52d0de75b13a81c44b95ebde65b1bf2c8f75b07b3194c97ba4e2f894e53261faeb7179a4f9cacbc2b66d5df098b5d101562bf3e3efa63f74e41c44716c62f255
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEw:Lz071uv4BPMkyW10/w16BvZXBCurmo8t
MD5 SHA1 SHA512 SSDEEP

Submit Download

fNKMGmV.exe

Path C:\Windows\System\fNKMGmV.exe
Size 1.7MB
SHA256 f6d6375bc14c7c956926b081bd983bc60d587eaa9126df51a1457f1cdc92eb77
MD5 15beca1eda74d79d37bfc13ea9326074
SHA1 f964f0645eaf12562a0527e735af76e2d320532b
SHA512 8d3718c31526c800036448134ed3359172b3e3ebfa9c24f5626aba76a8570de73caff0d4af83c06d081abd1fbc1bf7ea8e022ed1f89cfba76cad8e6b1232bc59
SSDEEP 49152:Lz071uv4BPMkyW10/w16BvZXBCurmo8vW:NABo
MD5 SHA1 SHA512 SSDEEP

Submit Download

fzetJCb.exe

Path C:\Windows\System\fzetJCb.exe
Size 1.7MB
SHA256 e2432364ca05ebeefdf9a93e580dac7198f031b6174f6e3dfb76f782830fc4b1
MD5 4434a9b4b8bf463db13853e3669927d6
SHA1 282a4141ea2581fa7d31ea457fccc43399d4e2f5
SHA512 9443e97126dd9301a288b75752eee8ef6bade64e93d35d396e07be35a52e78bb3019d472604c2c0616f8761989a765072bcc85e627438366ffa1facef0cf151f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEZ:Lz071uv4BPMkyW10/w16BvZXBCurmo8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

imhAkCb.exe

Path C:\Windows\System\imhAkCb.exe
Size 1.7MB
SHA256 8d58f34d8cdf0aab0325bced917c3222827f68eafe79dfc0ce239ddec44c351d
MD5 bc85cc93611e6d356fec49ef6714349f
SHA1 eb376d9f96a86fa43f91b4c64a44fe825b2fb7d1
SHA512 d418bcc066857e4de79cb8be5022f1692d12290a7d3612e80c6e8a77f43bc1a74d7c2054e8a762c5374af667df1b0c042ffaeaedc1ab35f2e264c593aa2ad1db
SSDEEP 49152:Lz071uv4BPMkyW10/w16BvZXBCurmo8Ci:NABl
MD5 SHA1 SHA512 SSDEEP

Submit Download

jeaPJXf.exe

Path C:\Windows\System\jeaPJXf.exe
Size 1.7MB
SHA256 0bdcbb762363f75b4c3c811646ad3bb3d50f82e005ab94c9a2daa14f46bb1a84
MD5 3c60a809c5a41e809aa46f32f45295ea
SHA1 f554aeca40395ba9ee8ae1e97743a98c29ad158f
SHA512 f5e31ae5ac1dddc15249b29e4a4b38f66c7e50cb496cc7822befdb7ba4851abe4c53d76f14d5f140c251e8eb2d464cb08d8641ffa3a10a5a77843ef67277a817
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJE2:Lz071uv4BPMkyW10/w16BvZXBCurmo8z
MD5 SHA1 SHA512 SSDEEP

Submit Download

jffgUrm.exe

Path C:\Windows\System\jffgUrm.exe
Size 1.7MB
SHA256 55751e6d1d46a7a50630deacee6be79e20c229b6fd77c47822a052258a3780f9
MD5 80fa37a370bafacdf4ce7ebb8419de7b
SHA1 096f4040e9def62c63701aee43e73f0b792b35e1
SHA512 ac8936f6b40b152beec003704a7c1f2866b421cb084a425f936f4b5933e9b9d8368854184fa0775faa1569c3d3088e2263ada8e20d71d33709e41a03cec86f19
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEl:Lz071uv4BPMkyW10/w16BvZXBCurmo8o
MD5 SHA1 SHA512 SSDEEP

Submit Download

kejbvAu.exe

Path C:\Windows\System\kejbvAu.exe
Size 1.7MB
SHA256 2f2958e7fda16f8f0ef799c6b7c3fae457ef3431ca9bc5668ea50c82a51827a2
MD5 b96bb091765d662e3732ce207748b279
SHA1 17a5e39465027060045b9a23ff95295aaa27ccb2
SHA512 88ce51c51e2dc6f912e4434aece8f9ff1d9f326f4bef3d716d3f29432d85d00e2787742b994513101e193f091948f8e7415e4c2e249229cbcac824be0d71fc00
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJE1:Lz071uv4BPMkyW10/w16BvZXBCurmo8o
MD5 SHA1 SHA512 SSDEEP

Submit Download

mBCuXOn.exe

Path C:\Windows\System\mBCuXOn.exe
Size 1.7MB
SHA256 75de4bf51088f8ba3e2bd19fa0c3f7c125ec52a32fae85305615487ca53631ea
MD5 5162d9d5e5123e3b08e75ad57cd17184
SHA1 98bc04fc618f433046ffec9589521db57cdd742e
SHA512 66eedca1fdac2b5a91c2fce37b1020ea63cc12f8e003149f32414ef8f98c617e331528cc4a522215a212a73e6b586da155ba439651c9f07303538fc3e3db79af
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEQ:Lz071uv4BPMkyW10/w16BvZXBCurmo89
MD5 SHA1 SHA512 SSDEEP

Submit Download

mlrGiwp.exe

Path C:\Windows\System\mlrGiwp.exe
Size 1.7MB
SHA256 b5980aaba72e7757f60e178a8f22270f1031cf0a4da6fb442310614e2d374bd1
MD5 77c71870408256e8ca26a4128f7dd08e
SHA1 d45207d4ba5b1cbcec763d26067197ad985eb404
SHA512 14ca57cebdd4363d0e254f73fd60f2fadf93bcd8ae13e96f6762fe88a07ce4a69a0e676a347cb84ce93469a325da46c8ea6ee599a383226208275aefb4fe649c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEE:Lz071uv4BPMkyW10/w16BvZXBCurmo8h
MD5 SHA1 SHA512 SSDEEP

Submit Download

nQorccQ.exe

Path C:\Windows\System\nQorccQ.exe
Size 1.7MB
SHA256 7747229b6b2ee661038eb9c5ebf4bcf3e1b092f9666627c84ca42af15716758d
MD5 bea4c7d59e402fbe8db393fae3369e3c
SHA1 9b5cd9db9ca935866758d31e29f6c641bdb03161
SHA512 cfdc9c225da71d4f4516bca583f25e7f9ba3ee085791c12bae8d5f8346a7145ad6ff83045833f099f21f039679915558a1cf88fe741e2c746ddbf8d6e326a797
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJE5:Lz071uv4BPMkyW10/w16BvZXBCurmo8q
MD5 SHA1 SHA512 SSDEEP

Submit Download

nnKqKSR.exe

Path C:\Windows\System\nnKqKSR.exe
Size 1.7MB
SHA256 a8a83f62b53c5431637ef1c56c29027f8930ab5915ca099252ca4bc01cfc45e3
MD5 f0bd9839bfb19613c488846c949ac592
SHA1 e867886a70653059602185a3ce03159be68b4d0a
SHA512 2170a9fe7e0f1d98426a21ef774127c41668a8d05d9ac17ddeb506211a8cbcd8c5bc6af0855f777d77e2a5ca392e2ce7eb5fcfc7392f1a59ec3d8801fa97fdce
SSDEEP 49152:Lz071uv4BPMkyW10/w16BvZXBCurmo8T1:NABr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ocfGnSv.exe

Path C:\Windows\System\ocfGnSv.exe
Size 1.7MB
SHA256 28df28bf8221f20fb52861446d785538145de44a63ecaa7aebbdb701c02840e9
MD5 80897c183bab861251e6b7e731914e8b
SHA1 e6833dd7f4c15d8d3b363676df914d4e73f07321
SHA512 0b5a914dd69d2f6300133b9c05d239a20304840d35fdbb57499fdad5f7b91cf63b7a472ec401ede462daa8e8e54b2cb2f3eae5512db5985faa9302f6d6f034f8
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEg:Lz071uv4BPMkyW10/w16BvZXBCurmo8X
MD5 SHA1 SHA512 SSDEEP

Submit Download

rnsjgDe.exe

Path C:\Windows\System\rnsjgDe.exe
Size 1.7MB
SHA256 e7fefdab429e4ad82aef7746167fcc58e866add599cbf8722481d96aa7fd0910
MD5 45249f0076eab59b7f361240ce683ce5
SHA1 0eebab28efc6848f826428d1688061db1ccd6a52
SHA512 974fb76254be5d717ab3a54e6ccf739816691e1366691478de808a239f52f3a60137196bc1dd2096a7cf4f12524195c4723075176ad1241f3d45891aeea43d01
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJE+:Lz071uv4BPMkyW10/w16BvZXBCurmo8f
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbhrkFn.exe

Path C:\Windows\System\tbhrkFn.exe
Size 1.7MB
SHA256 edc3e75ca5148e7e623f148059c6eeee216f3fb2a61f0c02562914177a4c81c3
MD5 6ae7f784b9ce9474080d53031abdb6d5
SHA1 12adb5813fea69284f687dcb9fdc7086bf1c4e51
SHA512 0e0e8a8db6c680fd99815c3e69e0b041ce52ffec2560ab0d17bad8bb12f0a2185ef5a78415937bcd50ab6f3e5e75fde242be6620ae2692b8d640eb3375b00862
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEe:Lz071uv4BPMkyW10/w16BvZXBCurmo89
MD5 SHA1 SHA512 SSDEEP

Submit Download

uRGGXYb.exe

Path C:\Windows\System\uRGGXYb.exe
Size 1.7MB
SHA256 e6de91c5469334ae2f5948ae74c23700efb63925d05e53f5e7b0df51548cfb8d
MD5 9fa7627e6cf6919bc03e37cd57724f96
SHA1 2d4c7077cebaf6bcad454b62fae66cce156d27b0
SHA512 48ac6e0aa14a892127620e93202d60e1656b735731895da74fed9599c2f89b217bcda8b889c2c8044448b06dce134073e212c407a2cfb5cd956195e00aff0da6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEY:Lz071uv4BPMkyW10/w16BvZXBCurmo8P
MD5 SHA1 SHA512 SSDEEP

Submit Download

xEsPqqV.exe

Path C:\Windows\System\xEsPqqV.exe
Size 1.7MB
SHA256 bf6b5da081b5e864ffb552865b3aeaf8439f9993de2eb90c85e761e9be51206f
MD5 1022385b449999463c55f2189894b04a
SHA1 abc36ce294cd007075c5564ef32cee8ce4ed04e1
SHA512 45e48b08c2b32eba6753be171f0dd3265af42722e3b057c40c97d55aaf48221d0c45130a6826025c468296b3aa13625733a6c693b0fdd75f49090c0e7b68febf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJES:Lz071uv4BPMkyW10/w16BvZXBCurmo81
MD5 SHA1 SHA512 SSDEEP

Submit Download

xKUhCoU.exe

Path C:\Windows\System\xKUhCoU.exe
Size 1.7MB
SHA256 da6fe63c4390b46a6fa9703c2de4e31ed6285516f1d2390bdb9e2bf70779db18
MD5 2e4e5136435cbdea3a83718597f3a184
SHA1 06baabe71a1300bc2df95f06aef2036f1be1a2df
SHA512 537a18c3c372e1e4d866200bd77d6a0fec1e464dbe0d07b3bbe19b370bbb3a180e6b6a8d77dec4af34fb115a61b28fd3066cd15cc8787d46c7e43201283a4d67
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEb:Lz071uv4BPMkyW10/w16BvZXBCurmo8Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

xOvMgQS.exe

Path C:\Windows\System\xOvMgQS.exe
Size 1.7MB
SHA256 4bc6b8deb79327a39d8e894360985a6be88d4f2d5feb50139ea226c2012de0c4
MD5 ba2e59eb3c697c18760ce9eab9de7b55
SHA1 468229ab1ca63b185b5e5f4d5cc7db8ca476ab51
SHA512 2341b996872c7f608b6bc4dec68a95ec87495c49247a3115da8b3f1fa796aa643feaea0554a8c5f66f3daef77890ccab5f48659053707903a188c7b9410fc66b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEn:Lz071uv4BPMkyW10/w16BvZXBCurmo80
MD5 SHA1 SHA512 SSDEEP

Submit Download

xXdxctu.exe

Path C:\Windows\System\xXdxctu.exe
Size 1.7MB
SHA256 bb8c31b417372224d39714419d2a26467bdc3c60f0c8b808119d5ab46ead4962
MD5 4e30b553b0cc729de88947b4636595ee
SHA1 a02b9021984a559ea7119404903f0027ef95ada8
SHA512 98ef866919a36c3c25180fa116ca2113a573a89a273d6550d8e8dabde6319b0081f7bf976ef8f3b8631638e9470968aedb413839a7d279fd398688c6cd8166cd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEz:Lz071uv4BPMkyW10/w16BvZXBCurmo8+
MD5 SHA1 SHA512 SSDEEP

Submit Download

xwxknlj.exe

Path C:\Windows\System\xwxknlj.exe
Size 1.7MB
SHA256 45512e8e8b5e30fe08e91d318814ccf4aa9789859a19842eccbdf587e8763380
MD5 d9643e0bab1a581d088d11506ba9b37e
SHA1 905fb422eb67863fe2fc8a1176a57bddef1ca0d0
SHA512 3bd6bd0f4fbdac84236c247f1c52f8bc295af5f911e1add41272bf74daad6e3cb9e02d6b3c37467b754512852cecbe52de4de66fcedb2b1c063ed738f8166555
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5NnNvZWNChZ7fI+BJBxyODsbJEP:Lz071uv4BPMkyW10/w16BvZXBCurmo8E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-582-0x00007FF7BD2B0000-0x00007FF7BD6A2000-memory.dmp

Download

memory/400-3110-0x00007FF7BD2B0000-0x00007FF7BD6A2000-memory.dmp

Download

memory/976-3155-0x00007FF7F2EA0000-0x00007FF7F3292000-memory.dmp

Download

memory/976-632-0x00007FF7F2EA0000-0x00007FF7F3292000-memory.dmp

Download

memory/1452-3100-0x00007FF74C9B0000-0x00007FF74CDA2000-memory.dmp

Download

memory/1452-699-0x00007FF74C9B0000-0x00007FF74CDA2000-memory.dmp

Download

memory/1500-3108-0x00007FF7BF500000-0x00007FF7BF8F2000-memory.dmp

Download

memory/1500-628-0x00007FF7BF500000-0x00007FF7BF8F2000-memory.dmp

Download

memory/1576-3141-0x00007FF7DDBB0000-0x00007FF7DDFA2000-memory.dmp

Download

memory/1576-635-0x00007FF7DDBB0000-0x00007FF7DDFA2000-memory.dmp

Download

memory/1580-3118-0x00007FF7ED2A0000-0x00007FF7ED692000-memory.dmp

Download

memory/1580-642-0x00007FF7ED2A0000-0x00007FF7ED692000-memory.dmp

Download

memory/1896-3120-0x00007FF6EC030000-0x00007FF6EC422000-memory.dmp

Download

memory/1896-638-0x00007FF6EC030000-0x00007FF6EC422000-memory.dmp

Download

memory/2320-3127-0x00007FF72C790000-0x00007FF72CB82000-memory.dmp

Download

memory/2320-627-0x00007FF72C790000-0x00007FF72CB82000-memory.dmp

Download

memory/2356-3102-0x00007FF700290000-0x00007FF700682000-memory.dmp

Download

memory/2356-41-0x00007FF700290000-0x00007FF700682000-memory.dmp

Download

memory/2356-3096-0x00007FF700290000-0x00007FF700682000-memory.dmp

Download

memory/2484-3104-0x00007FF7011B0000-0x00007FF7015A2000-memory.dmp

Download

memory/2484-700-0x00007FF7011B0000-0x00007FF7015A2000-memory.dmp

Download

memory/2688-640-0x00007FF6B1D30000-0x00007FF6B2122000-memory.dmp

Download

memory/2688-3150-0x00007FF6B1D30000-0x00007FF6B2122000-memory.dmp

Download

memory/2796-22-0x00007FF625FE0000-0x00007FF6263D2000-memory.dmp

Download

memory/2796-3098-0x00007FF625FE0000-0x00007FF6263D2000-memory.dmp

Download

memory/2864-235-0x00007FF7EF990000-0x00007FF7EFD82000-memory.dmp

Download

memory/2864-3106-0x00007FF7EF990000-0x00007FF7EFD82000-memory.dmp

Download

memory/2940-722-0x00007FF6F6610000-0x00007FF6F6A02000-memory.dmp

Download

memory/2940-3112-0x00007FF6F6610000-0x00007FF6F6A02000-memory.dmp

Download

memory/3076-633-0x00007FF730FC0000-0x00007FF7313B2000-memory.dmp

Download

memory/3076-3160-0x00007FF730FC0000-0x00007FF7313B2000-memory.dmp

Download

memory/3188-3122-0x00007FF6FD910000-0x00007FF6FDD02000-memory.dmp

Download

memory/3188-629-0x00007FF6FD910000-0x00007FF6FDD02000-memory.dmp

Download

memory/3408-636-0x00007FF68CF50000-0x00007FF68D342000-memory.dmp

Download

memory/3408-3146-0x00007FF68CF50000-0x00007FF68D342000-memory.dmp

Download

memory/3532-452-0x00007FF77F260000-0x00007FF77F652000-memory.dmp

Download

memory/3532-3126-0x00007FF77F260000-0x00007FF77F652000-memory.dmp

Download

memory/3536-1-0x000001D500F90000-0x000001D500FA0000-memory.dmp

Download

memory/3536-0-0x00007FF609350000-0x00007FF609742000-memory.dmp

Download

memory/3884-3132-0x00007FF7EC420000-0x00007FF7EC812000-memory.dmp

Download

memory/3884-631-0x00007FF7EC420000-0x00007FF7EC812000-memory.dmp

Download

memory/3964-23-0x00007FFEEE1A3000-0x00007FFEEE1A5000-memory.dmp

Download

memory/3964-477-0x000001D1CCB40000-0x000001D1CCB62000-memory.dmp

Download

memory/3964-170-0x00007FFEEE1A0000-0x00007FFEEEC61000-memory.dmp

Download

memory/4436-3156-0x00007FF755220000-0x00007FF755612000-memory.dmp

Download

memory/4436-639-0x00007FF755220000-0x00007FF755612000-memory.dmp

Download

memory/4452-641-0x00007FF661C00000-0x00007FF661FF2000-memory.dmp

Download

memory/4452-3131-0x00007FF661C00000-0x00007FF661FF2000-memory.dmp

Download

memory/4888-637-0x00007FF67A210000-0x00007FF67A602000-memory.dmp

Download

memory/4888-3142-0x00007FF67A210000-0x00007FF67A602000-memory.dmp

Download

memory/4892-3115-0x00007FF686570000-0x00007FF686962000-memory.dmp

Download

memory/4892-634-0x00007FF686570000-0x00007FF686962000-memory.dmp

Download

memory/4984-3145-0x00007FF662BA0000-0x00007FF662F92000-memory.dmp

Download

memory/4984-630-0x00007FF662BA0000-0x00007FF662F92000-memory.dmp

Download