xmrig | 973a5c19e5ed22675d03dc182dc6fa022e6004d23a2e6c0d80508f3b2946ba97

Analysis

max time kernel
121s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
Size 1.4MB
Sample240602-2ef26shc91
SHA256 973a5c19e5ed22675d03dc182dc6fa022e6004d23a2e6c0d80508f3b2946ba97
MD5 76e4dadb43bc6b8146d5c38efdf2fb00
SHA1 e832c604b75190140d8315fae2f0233cb54ac318
SHA512 415abc786725fa441bbdb49a4b9655afffcccd5b76ba44fd8a6270ed57476e164700180a3c6bf4beb962d4663a478e4d5530d257cc544d39beff95b91eaeb9ad
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhB:Lz071uv4BPMkHC0IlnASEx/R+MKVl9+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/2004-409-0x00007FF7E8760000-0x00007FF7E8B52000-memory.dmp	xmrig
behavioral2/memory/4712-620-0x00007FF75D6E0000-0x00007FF75DAD2000-memory.dmp	xmrig
behavioral2/memory/4676-623-0x00007FF7A2740000-0x00007FF7A2B32000-memory.dmp	xmrig
behavioral2/memory/2148-625-0x00007FF676F90000-0x00007FF677382000-memory.dmp	xmrig
behavioral2/memory/1916-627-0x00007FF69A830000-0x00007FF69AC22000-memory.dmp	xmrig
behavioral2/memory/2184-631-0x00007FF639BA0000-0x00007FF639F92000-memory.dmp	xmrig
behavioral2/memory/3240-634-0x00007FF7155A0000-0x00007FF715992000-memory.dmp	xmrig
behavioral2/memory/4168-934-0x00007FF6A2790000-0x00007FF6A2B82000-memory.dmp	xmrig
behavioral2/memory/4532-804-0x00007FF7EEFF0000-0x00007FF7EF3E2000-memory.dmp	xmrig
behavioral2/memory/3020-633-0x00007FF6EFBD0000-0x00007FF6EFFC2000-memory.dmp	xmrig
behavioral2/memory/4224-632-0x00007FF702B30000-0x00007FF702F22000-memory.dmp	xmrig
behavioral2/memory/840-630-0x00007FF766DD0000-0x00007FF7671C2000-memory.dmp	xmrig
behavioral2/memory/1752-629-0x00007FF633040000-0x00007FF633432000-memory.dmp	xmrig
behavioral2/memory/4764-628-0x00007FF76B940000-0x00007FF76BD32000-memory.dmp	xmrig
behavioral2/memory/1296-626-0x00007FF7EC7C0000-0x00007FF7ECBB2000-memory.dmp	xmrig
behavioral2/memory/1988-624-0x00007FF611C70000-0x00007FF612062000-memory.dmp	xmrig
behavioral2/memory/4488-622-0x00007FF632CA0000-0x00007FF633092000-memory.dmp	xmrig
behavioral2/memory/2112-621-0x00007FF6F6CC0000-0x00007FF6F70B2000-memory.dmp	xmrig
behavioral2/memory/1748-619-0x00007FF73AB30000-0x00007FF73AF22000-memory.dmp	xmrig
behavioral2/memory/2564-332-0x00007FF75C440000-0x00007FF75C832000-memory.dmp	xmrig
behavioral2/memory/4644-271-0x00007FF71B240000-0x00007FF71B632000-memory.dmp	xmrig
behavioral2/memory/972-219-0x00007FF7C45C0000-0x00007FF7C49B2000-memory.dmp	xmrig
behavioral2/memory/2856-177-0x00007FF7782D0000-0x00007FF7786C2000-memory.dmp	xmrig
behavioral2/memory/1928-23-0x00007FF73BF30000-0x00007FF73C322000-memory.dmp	xmrig
behavioral2/memory/4552-5313-0x00007FF7F1030000-0x00007FF7F1422000-memory.dmp	xmrig
behavioral2/memory/1928-5315-0x00007FF73BF30000-0x00007FF73C322000-memory.dmp	xmrig
behavioral2/memory/2856-5317-0x00007FF7782D0000-0x00007FF7786C2000-memory.dmp	xmrig
behavioral2/memory/4532-5319-0x00007FF7EEFF0000-0x00007FF7EF3E2000-memory.dmp	xmrig
behavioral2/memory/4644-5321-0x00007FF71B240000-0x00007FF71B632000-memory.dmp	xmrig
behavioral2/memory/972-5325-0x00007FF7C45C0000-0x00007FF7C49B2000-memory.dmp	xmrig
behavioral2/memory/4168-5324-0x00007FF6A2790000-0x00007FF6A2B82000-memory.dmp	xmrig
behavioral2/memory/1748-5334-0x00007FF73AB30000-0x00007FF73AF22000-memory.dmp	xmrig
behavioral2/memory/4676-5343-0x00007FF7A2740000-0x00007FF7A2B32000-memory.dmp	xmrig
behavioral2/memory/2564-5344-0x00007FF75C440000-0x00007FF75C832000-memory.dmp	xmrig
behavioral2/memory/4224-5348-0x00007FF702B30000-0x00007FF702F22000-memory.dmp	xmrig
behavioral2/memory/3240-5350-0x00007FF7155A0000-0x00007FF715992000-memory.dmp	xmrig
behavioral2/memory/3020-5352-0x00007FF6EFBD0000-0x00007FF6EFFC2000-memory.dmp	xmrig
behavioral2/memory/1296-5346-0x00007FF7EC7C0000-0x00007FF7ECBB2000-memory.dmp	xmrig
behavioral2/memory/4712-5340-0x00007FF75D6E0000-0x00007FF75DAD2000-memory.dmp	xmrig
behavioral2/memory/4488-5338-0x00007FF632CA0000-0x00007FF633092000-memory.dmp	xmrig
behavioral2/memory/4764-5337-0x00007FF76B940000-0x00007FF76BD32000-memory.dmp	xmrig
behavioral2/memory/2004-5333-0x00007FF7E8760000-0x00007FF7E8B52000-memory.dmp	xmrig
behavioral2/memory/2112-5331-0x00007FF6F6CC0000-0x00007FF6F70B2000-memory.dmp	xmrig
behavioral2/memory/2148-5329-0x00007FF676F90000-0x00007FF677382000-memory.dmp	xmrig
behavioral2/memory/1988-5359-0x00007FF611C70000-0x00007FF612062000-memory.dmp	xmrig
behavioral2/memory/840-5406-0x00007FF766DD0000-0x00007FF7671C2000-memory.dmp	xmrig
behavioral2/memory/1916-5372-0x00007FF69A830000-0x00007FF69AC22000-memory.dmp	xmrig
behavioral2/memory/2184-5366-0x00007FF639BA0000-0x00007FF639F92000-memory.dmp	xmrig
behavioral2/memory/1752-5361-0x00007FF633040000-0x00007FF633432000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4184	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1928	MuPnHWv.exe
2856	cYOMHNH.exe
4532	hrEoTZT.exe
972	KzIolJZ.exe
4644	dHBNyiJ.exe
4168	LhdTmqv.exe
2564	XiMvkxv.exe
2004	wLoWpEA.exe
1748	NdEWMri.exe
4712	PHLzefE.exe
2112	oDojKwS.exe
4488	GNhHauR.exe
4676	LTJValX.exe
1988	VXxkyzH.exe
2148	OaCbWoI.exe
1296	WEpWlzB.exe
1916	dhyCUCh.exe
4764	thWrkIQ.exe
1752	EFUTcEU.exe
840	yaTBLZB.exe
2184	MbeTkIn.exe
4224	uVghJRK.exe
3020	hdCNTXd.exe
3240	znvSdnP.exe
4708	ZEyhqhA.exe
880	ELkCIhT.exe
2392	fhZwLpY.exe
1040	WltyUnB.exe
4092	rMtsLex.exe
800	SFVjoxB.exe
2436	SVyjLRR.exe
2700	zpFbUon.exe
3568	ZTuNqCb.exe
3228	OkIQtEG.exe
3976	AFGsQaq.exe
3248	cACdonv.exe
2456	osKITTu.exe
3824	bzGmWTq.exe
2936	sfDgScq.exe
1244	mESmCIk.exe
1116	CuxJBFD.exe
4084	HIIuRBS.exe
3096	pkdoMHn.exe
2948	FQKZOUh.exe
4980	lyuqZSO.exe
1356	pEgejcc.exe
2820	KyXgglm.exe
3776	Fnmzqkm.exe
712	lvfzURC.exe
752	Whrtqgy.exe
1580	TBwqfRd.exe
3948	wbUdEMM.exe
532	hOfOyFD.exe
4152	EQmYlqA.exe
4580	FfdlIOA.exe
2660	IJkOWOi.exe
4076	OLcGoxN.exe
4964	tiVfkqo.exe
1788	LfZOJRr.exe
1084	Nuahmmh.exe
3276	ZgjGqhx.exe
4416	rmfnRVG.exe
4520	XJxKMPV.exe
2672	qVulpnd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4552-0-0x00007FF7F1030000-0x00007FF7F1422000-memory.dmp	upx
behavioral2/files/0x0009000000023412-8.dat	upx
behavioral2/files/0x000700000002341c-16.dat	upx
behavioral2/files/0x0007000000023419-22.dat	upx
behavioral2/files/0x0007000000023420-48.dat	upx
behavioral2/files/0x0007000000023438-149.dat	upx
behavioral2/files/0x0007000000023437-195.dat	upx
behavioral2/memory/2004-409-0x00007FF7E8760000-0x00007FF7E8B52000-memory.dmp	upx
behavioral2/memory/4712-620-0x00007FF75D6E0000-0x00007FF75DAD2000-memory.dmp	upx
behavioral2/memory/4676-623-0x00007FF7A2740000-0x00007FF7A2B32000-memory.dmp	upx
behavioral2/memory/2148-625-0x00007FF676F90000-0x00007FF677382000-memory.dmp	upx
behavioral2/memory/1916-627-0x00007FF69A830000-0x00007FF69AC22000-memory.dmp	upx
behavioral2/memory/2184-631-0x00007FF639BA0000-0x00007FF639F92000-memory.dmp	upx
behavioral2/memory/3240-634-0x00007FF7155A0000-0x00007FF715992000-memory.dmp	upx
behavioral2/memory/4168-934-0x00007FF6A2790000-0x00007FF6A2B82000-memory.dmp	upx
behavioral2/memory/4532-804-0x00007FF7EEFF0000-0x00007FF7EF3E2000-memory.dmp	upx
behavioral2/memory/3020-633-0x00007FF6EFBD0000-0x00007FF6EFFC2000-memory.dmp	upx
behavioral2/memory/4224-632-0x00007FF702B30000-0x00007FF702F22000-memory.dmp	upx
behavioral2/memory/840-630-0x00007FF766DD0000-0x00007FF7671C2000-memory.dmp	upx
behavioral2/memory/1752-629-0x00007FF633040000-0x00007FF633432000-memory.dmp	upx
behavioral2/memory/4764-628-0x00007FF76B940000-0x00007FF76BD32000-memory.dmp	upx
behavioral2/memory/1296-626-0x00007FF7EC7C0000-0x00007FF7ECBB2000-memory.dmp	upx
behavioral2/memory/1988-624-0x00007FF611C70000-0x00007FF612062000-memory.dmp	upx
behavioral2/memory/4488-622-0x00007FF632CA0000-0x00007FF633092000-memory.dmp	upx
behavioral2/memory/2112-621-0x00007FF6F6CC0000-0x00007FF6F70B2000-memory.dmp	upx
behavioral2/memory/1748-619-0x00007FF73AB30000-0x00007FF73AF22000-memory.dmp	upx
behavioral2/memory/2564-332-0x00007FF75C440000-0x00007FF75C832000-memory.dmp	upx
behavioral2/memory/4644-271-0x00007FF71B240000-0x00007FF71B632000-memory.dmp	upx
behavioral2/files/0x000700000002342c-199.dat	upx
behavioral2/files/0x0007000000023440-196.dat	upx
behavioral2/files/0x000700000002343f-194.dat	upx
behavioral2/files/0x0007000000023436-185.dat	upx
behavioral2/memory/972-219-0x00007FF7C45C0000-0x00007FF7C49B2000-memory.dmp	upx
behavioral2/memory/2856-177-0x00007FF7782D0000-0x00007FF7786C2000-memory.dmp	upx
behavioral2/files/0x000700000002343d-174.dat	upx
behavioral2/files/0x0007000000023430-165.dat	upx
behavioral2/files/0x000700000002342e-161.dat	upx
behavioral2/files/0x0007000000023427-158.dat	upx
behavioral2/files/0x000700000002343a-157.dat	upx
behavioral2/files/0x0007000000023425-156.dat	upx
behavioral2/files/0x000700000002342b-202.dat	upx
behavioral2/files/0x000700000002342a-145.dat	upx
behavioral2/files/0x000700000002343e-188.dat	upx
behavioral2/files/0x0007000000023435-143.dat	upx
behavioral2/files/0x0007000000023434-142.dat	upx
behavioral2/files/0x0007000000023433-141.dat	upx
behavioral2/files/0x0007000000023428-183.dat	upx
behavioral2/files/0x0007000000023431-132.dat	upx
behavioral2/files/0x000700000002342f-130.dat	upx
behavioral2/files/0x0007000000023426-122.dat	upx
behavioral2/files/0x000700000002342d-119.dat	upx
behavioral2/files/0x0007000000023439-153.dat	upx
behavioral2/files/0x0007000000023422-115.dat	upx
behavioral2/files/0x0007000000023429-95.dat	upx
behavioral2/files/0x0007000000023432-140.dat	upx
behavioral2/files/0x0007000000023423-85.dat	upx
behavioral2/files/0x000700000002341f-68.dat	upx
behavioral2/files/0x000700000002341e-67.dat	upx
behavioral2/files/0x0007000000023424-61.dat	upx
behavioral2/files/0x0007000000023421-49.dat	upx
behavioral2/files/0x000700000002341a-55.dat	upx
behavioral2/files/0x000700000002341b-41.dat	upx
behavioral2/files/0x000700000002341d-46.dat	upx
behavioral2/memory/1928-23-0x00007FF73BF30000-0x00007FF73C322000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EHoFZPg.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\tKgdcHl.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\YMAOBCU.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\IGIpJsH.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\kOEWTbR.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\wXsCogg.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\GiNwSuI.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\nXOpEXz.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\zIpvhYf.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\rZoIbfR.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\arlSnhW.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\PsfUkpd.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\PaatKre.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\DnPCEJo.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\EHdOoBy.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\zzdSZtT.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\RcjPkfR.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\ErfckKJ.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\nvfWidm.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\WFvlDfd.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\wGfgVUk.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\VklkrCE.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\mqADYWD.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\RIMgTZl.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\gZlBBEJ.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\fhapBFl.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\ZArXmtc.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\GPIpekq.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\UBkyqXw.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\toqxTCY.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\evFZXTU.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\bziJoAL.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\WiylFaD.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\QyuYAdq.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\OwwjEZL.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\hnfalGz.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\KzngVvI.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\IrhACbN.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\VFbtUin.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\hoZzYFt.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\KUMGFmp.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\LAdesMS.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\tyhwdKA.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\xhaMdPw.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\sZypKIg.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\kwOVwYG.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\TzuuOuV.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\IbIgoHw.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\XjCOhWd.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\OjhIPLl.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\McGFjgj.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\dSktOXc.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\hCZAjhp.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\RQHArQN.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\PPbjBGB.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\HMUqpkB.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\ylTtvdK.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\uKXCdLv.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\GSSwYDJ.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\lGlOCNL.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\zBtMbmZ.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\xGZegvd.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\bPoaJzX.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
File created	C:\Windows\System\vTmopsW.exe	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4184	powershell.exe
4184	powershell.exe
4184	powershell.exe
4184	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeLockMemoryPrivilege	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 4184	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	83
PID 4552 wrote to memory of 4184	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	83
PID 4552 wrote to memory of 1928	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	84
PID 4552 wrote to memory of 1928	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	84
PID 4552 wrote to memory of 2856	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	85
PID 4552 wrote to memory of 2856	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	85
PID 4552 wrote to memory of 972	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	86
PID 4552 wrote to memory of 972	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	86
PID 4552 wrote to memory of 4644	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	87
PID 4552 wrote to memory of 4644	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	87
PID 4552 wrote to memory of 4532	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	88
PID 4552 wrote to memory of 4532	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	88
PID 4552 wrote to memory of 4168	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	89
PID 4552 wrote to memory of 4168	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	89
PID 4552 wrote to memory of 2564	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	90
PID 4552 wrote to memory of 2564	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	90
PID 4552 wrote to memory of 2004	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	91
PID 4552 wrote to memory of 2004	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	91
PID 4552 wrote to memory of 1748	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	92
PID 4552 wrote to memory of 1748	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	92
PID 4552 wrote to memory of 4712	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	93
PID 4552 wrote to memory of 4712	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	93
PID 4552 wrote to memory of 2112	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	94
PID 4552 wrote to memory of 2112	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	94
PID 4552 wrote to memory of 4488	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	95
PID 4552 wrote to memory of 4488	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	95
PID 4552 wrote to memory of 4676	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	96
PID 4552 wrote to memory of 4676	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	96
PID 4552 wrote to memory of 1988	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	97
PID 4552 wrote to memory of 1988	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	97
PID 4552 wrote to memory of 2148	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	98
PID 4552 wrote to memory of 2148	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	98
PID 4552 wrote to memory of 1296	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	99
PID 4552 wrote to memory of 1296	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	99
PID 4552 wrote to memory of 1916	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	100
PID 4552 wrote to memory of 1916	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	100
PID 4552 wrote to memory of 4764	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	101
PID 4552 wrote to memory of 4764	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	101
PID 4552 wrote to memory of 2436	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	102
PID 4552 wrote to memory of 2436	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	102
PID 4552 wrote to memory of 840	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	103
PID 4552 wrote to memory of 840	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	103
PID 4552 wrote to memory of 1752	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	104
PID 4552 wrote to memory of 1752	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	104
PID 4552 wrote to memory of 2184	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	105
PID 4552 wrote to memory of 2184	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	105
PID 4552 wrote to memory of 4224	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	106
PID 4552 wrote to memory of 4224	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	106
PID 4552 wrote to memory of 3020	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	107
PID 4552 wrote to memory of 3020	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	107
PID 4552 wrote to memory of 3240	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	108
PID 4552 wrote to memory of 3240	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	108
PID 4552 wrote to memory of 4708	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	109
PID 4552 wrote to memory of 4708	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	109
PID 4552 wrote to memory of 880	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	110
PID 4552 wrote to memory of 880	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	110
PID 4552 wrote to memory of 2392	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	111
PID 4552 wrote to memory of 2392	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	111
PID 4552 wrote to memory of 1040	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	112
PID 4552 wrote to memory of 1040	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	112
PID 4552 wrote to memory of 4092	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	113
PID 4552 wrote to memory of 4092	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	113
PID 4552 wrote to memory of 800	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	114
PID 4552 wrote to memory of 800	4552	76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\76e4dadb43bc6b8146d5c38efdf2fb00_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4184
- C:\Windows\System\MuPnHWv.exe
  C:\Windows\System\MuPnHWv.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\cYOMHNH.exe
  C:\Windows\System\cYOMHNH.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\KzIolJZ.exe
  C:\Windows\System\KzIolJZ.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\dHBNyiJ.exe
  C:\Windows\System\dHBNyiJ.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\hrEoTZT.exe
  C:\Windows\System\hrEoTZT.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\LhdTmqv.exe
  C:\Windows\System\LhdTmqv.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\XiMvkxv.exe
  C:\Windows\System\XiMvkxv.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\wLoWpEA.exe
  C:\Windows\System\wLoWpEA.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\NdEWMri.exe
  C:\Windows\System\NdEWMri.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\PHLzefE.exe
  C:\Windows\System\PHLzefE.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\oDojKwS.exe
  C:\Windows\System\oDojKwS.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\GNhHauR.exe
  C:\Windows\System\GNhHauR.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\LTJValX.exe
  C:\Windows\System\LTJValX.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\VXxkyzH.exe
  C:\Windows\System\VXxkyzH.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\OaCbWoI.exe
  C:\Windows\System\OaCbWoI.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\WEpWlzB.exe
  C:\Windows\System\WEpWlzB.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\dhyCUCh.exe
  C:\Windows\System\dhyCUCh.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\thWrkIQ.exe
  C:\Windows\System\thWrkIQ.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\SVyjLRR.exe
  C:\Windows\System\SVyjLRR.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\yaTBLZB.exe
  C:\Windows\System\yaTBLZB.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\EFUTcEU.exe
  C:\Windows\System\EFUTcEU.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\MbeTkIn.exe
  C:\Windows\System\MbeTkIn.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\uVghJRK.exe
  C:\Windows\System\uVghJRK.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\hdCNTXd.exe
  C:\Windows\System\hdCNTXd.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\znvSdnP.exe
  C:\Windows\System\znvSdnP.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\ZEyhqhA.exe
  C:\Windows\System\ZEyhqhA.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\ELkCIhT.exe
  C:\Windows\System\ELkCIhT.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\fhZwLpY.exe
  C:\Windows\System\fhZwLpY.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\WltyUnB.exe
  C:\Windows\System\WltyUnB.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\rMtsLex.exe
  C:\Windows\System\rMtsLex.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\SFVjoxB.exe
  C:\Windows\System\SFVjoxB.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\bzGmWTq.exe
  C:\Windows\System\bzGmWTq.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\zpFbUon.exe
  C:\Windows\System\zpFbUon.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\ZTuNqCb.exe
  C:\Windows\System\ZTuNqCb.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\OkIQtEG.exe
  C:\Windows\System\OkIQtEG.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\pEgejcc.exe
  C:\Windows\System\pEgejcc.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\KyXgglm.exe
  C:\Windows\System\KyXgglm.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\AFGsQaq.exe
  C:\Windows\System\AFGsQaq.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\cACdonv.exe
  C:\Windows\System\cACdonv.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\osKITTu.exe
  C:\Windows\System\osKITTu.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\sfDgScq.exe
  C:\Windows\System\sfDgScq.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\mESmCIk.exe
  C:\Windows\System\mESmCIk.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\CuxJBFD.exe
  C:\Windows\System\CuxJBFD.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\HIIuRBS.exe
  C:\Windows\System\HIIuRBS.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\pkdoMHn.exe
  C:\Windows\System\pkdoMHn.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\FQKZOUh.exe
  C:\Windows\System\FQKZOUh.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\lyuqZSO.exe
  C:\Windows\System\lyuqZSO.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\Fnmzqkm.exe
  C:\Windows\System\Fnmzqkm.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\lvfzURC.exe
  C:\Windows\System\lvfzURC.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\Whrtqgy.exe
  C:\Windows\System\Whrtqgy.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\TBwqfRd.exe
  C:\Windows\System\TBwqfRd.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\jCTUQtC.exe
  C:\Windows\System\jCTUQtC.exe
  2⤵
  PID:2688
- C:\Windows\System\wbUdEMM.exe
  C:\Windows\System\wbUdEMM.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\hOfOyFD.exe
  C:\Windows\System\hOfOyFD.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\EQmYlqA.exe
  C:\Windows\System\EQmYlqA.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\FfdlIOA.exe
  C:\Windows\System\FfdlIOA.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\IJkOWOi.exe
  C:\Windows\System\IJkOWOi.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\OLcGoxN.exe
  C:\Windows\System\OLcGoxN.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\tiVfkqo.exe
  C:\Windows\System\tiVfkqo.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\DfZQoyo.exe
  C:\Windows\System\DfZQoyo.exe
  2⤵
  PID:1056
- C:\Windows\System\LfZOJRr.exe
  C:\Windows\System\LfZOJRr.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\Nuahmmh.exe
  C:\Windows\System\Nuahmmh.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\RcAXjpY.exe
  C:\Windows\System\RcAXjpY.exe
  2⤵
  PID:2304
- C:\Windows\System\ZgjGqhx.exe
  C:\Windows\System\ZgjGqhx.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\rmfnRVG.exe
  C:\Windows\System\rmfnRVG.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\XJxKMPV.exe
  C:\Windows\System\XJxKMPV.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\qVulpnd.exe
  C:\Windows\System\qVulpnd.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\DzgmMuq.exe
  C:\Windows\System\DzgmMuq.exe
  2⤵
  PID:3652
- C:\Windows\System\HYAjPTV.exe
  C:\Windows\System\HYAjPTV.exe
  2⤵
  PID:4996
- C:\Windows\System\yLTdzVl.exe
  C:\Windows\System\yLTdzVl.exe
  2⤵
  PID:3932
- C:\Windows\System\SUCSQWV.exe
  C:\Windows\System\SUCSQWV.exe
  2⤵
  PID:4424
- C:\Windows\System\CGYgWLG.exe
  C:\Windows\System\CGYgWLG.exe
  2⤵
  PID:5016
- C:\Windows\System\FyaTFNR.exe
  C:\Windows\System\FyaTFNR.exe
  2⤵
  PID:3468
- C:\Windows\System\uSpXnuv.exe
  C:\Windows\System\uSpXnuv.exe
  2⤵
  PID:4904
- C:\Windows\System\UyIPmxX.exe
  C:\Windows\System\UyIPmxX.exe
  2⤵
  PID:1484
- C:\Windows\System\gMhksKx.exe
  C:\Windows\System\gMhksKx.exe
  2⤵
  PID:2280
- C:\Windows\System\nMvegxo.exe
  C:\Windows\System\nMvegxo.exe
  2⤵
  PID:2520
- C:\Windows\System\FMVLqMT.exe
  C:\Windows\System\FMVLqMT.exe
  2⤵
  PID:2816
- C:\Windows\System\MzBezhg.exe
  C:\Windows\System\MzBezhg.exe
  2⤵
  PID:4716
- C:\Windows\System\hKiVrSJ.exe
  C:\Windows\System\hKiVrSJ.exe
  2⤵
  PID:2172
- C:\Windows\System\cFfnShI.exe
  C:\Windows\System\cFfnShI.exe
  2⤵
  PID:2624
- C:\Windows\System\hGISViY.exe
  C:\Windows\System\hGISViY.exe
  2⤵
  PID:936
- C:\Windows\System\GqFgVup.exe
  C:\Windows\System\GqFgVup.exe
  2⤵
  PID:3772
- C:\Windows\System\kEpGEvD.exe
  C:\Windows\System\kEpGEvD.exe
  2⤵
  PID:5148
- C:\Windows\System\iqjijiC.exe
  C:\Windows\System\iqjijiC.exe
  2⤵
  PID:5168
- C:\Windows\System\ytqWqrc.exe
  C:\Windows\System\ytqWqrc.exe
  2⤵
  PID:5184
- C:\Windows\System\cLdiCXB.exe
  C:\Windows\System\cLdiCXB.exe
  2⤵
  PID:5208
- C:\Windows\System\UhmNHfZ.exe
  C:\Windows\System\UhmNHfZ.exe
  2⤵
  PID:5224
- C:\Windows\System\TQLFlae.exe
  C:\Windows\System\TQLFlae.exe
  2⤵
  PID:5252
- C:\Windows\System\iQcnjBu.exe
  C:\Windows\System\iQcnjBu.exe
  2⤵
  PID:5272
- C:\Windows\System\bamZkwj.exe
  C:\Windows\System\bamZkwj.exe
  2⤵
  PID:5288
- C:\Windows\System\GsvaLqo.exe
  C:\Windows\System\GsvaLqo.exe
  2⤵
  PID:5312
- C:\Windows\System\UyCwewU.exe
  C:\Windows\System\UyCwewU.exe
  2⤵
  PID:5336
- C:\Windows\System\zOvIhQO.exe
  C:\Windows\System\zOvIhQO.exe
  2⤵
  PID:5356
- C:\Windows\System\eaAKvfN.exe
  C:\Windows\System\eaAKvfN.exe
  2⤵
  PID:5384
- C:\Windows\System\XEpZXnj.exe
  C:\Windows\System\XEpZXnj.exe
  2⤵
  PID:5400
- C:\Windows\System\qegCaFz.exe
  C:\Windows\System\qegCaFz.exe
  2⤵
  PID:5420
- C:\Windows\System\FWuAZgL.exe
  C:\Windows\System\FWuAZgL.exe
  2⤵
  PID:5440
- C:\Windows\System\axWPvGA.exe
  C:\Windows\System\axWPvGA.exe
  2⤵
  PID:5456
- C:\Windows\System\apDPJKq.exe
  C:\Windows\System\apDPJKq.exe
  2⤵
  PID:5472
- C:\Windows\System\zMmyDUb.exe
  C:\Windows\System\zMmyDUb.exe
  2⤵
  PID:5508
- C:\Windows\System\zoJuBQV.exe
  C:\Windows\System\zoJuBQV.exe
  2⤵
  PID:5524
- C:\Windows\System\BtWGeQh.exe
  C:\Windows\System\BtWGeQh.exe
  2⤵
  PID:5540
- C:\Windows\System\iiXvqNJ.exe
  C:\Windows\System\iiXvqNJ.exe
  2⤵
  PID:5556
- C:\Windows\System\GwrDKSk.exe
  C:\Windows\System\GwrDKSk.exe
  2⤵
  PID:5572
- C:\Windows\System\cIfNLtv.exe
  C:\Windows\System\cIfNLtv.exe
  2⤵
  PID:5592
- C:\Windows\System\RthVwkf.exe
  C:\Windows\System\RthVwkf.exe
  2⤵
  PID:5608
- C:\Windows\System\LSWECtt.exe
  C:\Windows\System\LSWECtt.exe
  2⤵
  PID:5636
- C:\Windows\System\yjcBsiu.exe
  C:\Windows\System\yjcBsiu.exe
  2⤵
  PID:5656
- C:\Windows\System\PwkNMVc.exe
  C:\Windows\System\PwkNMVc.exe
  2⤵
  PID:5676
- C:\Windows\System\WYxULKr.exe
  C:\Windows\System\WYxULKr.exe
  2⤵
  PID:5692
- C:\Windows\System\LSmxfNG.exe
  C:\Windows\System\LSmxfNG.exe
  2⤵
  PID:5712
- C:\Windows\System\uEskfHW.exe
  C:\Windows\System\uEskfHW.exe
  2⤵
  PID:5736
- C:\Windows\System\TUSyFOk.exe
  C:\Windows\System\TUSyFOk.exe
  2⤵
  PID:5756
- C:\Windows\System\nIMgjFj.exe
  C:\Windows\System\nIMgjFj.exe
  2⤵
  PID:5776
- C:\Windows\System\ppdVKSl.exe
  C:\Windows\System\ppdVKSl.exe
  2⤵
  PID:5796
- C:\Windows\System\oUdbqwK.exe
  C:\Windows\System\oUdbqwK.exe
  2⤵
  PID:5812
- C:\Windows\System\zwqlcbG.exe
  C:\Windows\System\zwqlcbG.exe
  2⤵
  PID:5828
- C:\Windows\System\QOgWBQe.exe
  C:\Windows\System\QOgWBQe.exe
  2⤵
  PID:5860
- C:\Windows\System\EqhBORK.exe
  C:\Windows\System\EqhBORK.exe
  2⤵
  PID:5876
- C:\Windows\System\GGebUJA.exe
  C:\Windows\System\GGebUJA.exe
  2⤵
  PID:5908
- C:\Windows\System\KIGHFrP.exe
  C:\Windows\System\KIGHFrP.exe
  2⤵
  PID:5924
- C:\Windows\System\WuCQkyL.exe
  C:\Windows\System\WuCQkyL.exe
  2⤵
  PID:5940
- C:\Windows\System\PFOlzjc.exe
  C:\Windows\System\PFOlzjc.exe
  2⤵
  PID:5988
- C:\Windows\System\WysVgVw.exe
  C:\Windows\System\WysVgVw.exe
  2⤵
  PID:6008
- C:\Windows\System\OnavHAZ.exe
  C:\Windows\System\OnavHAZ.exe
  2⤵
  PID:6028
- C:\Windows\System\lyoKzEU.exe
  C:\Windows\System\lyoKzEU.exe
  2⤵
  PID:6044
- C:\Windows\System\kCJoSyy.exe
  C:\Windows\System\kCJoSyy.exe
  2⤵
  PID:6072
- C:\Windows\System\GluyHgz.exe
  C:\Windows\System\GluyHgz.exe
  2⤵
  PID:6088
- C:\Windows\System\jCialwf.exe
  C:\Windows\System\jCialwf.exe
  2⤵
  PID:6112
- C:\Windows\System\vctAotF.exe
  C:\Windows\System\vctAotF.exe
  2⤵
  PID:6128
- C:\Windows\System\EGucfGt.exe
  C:\Windows\System\EGucfGt.exe
  2⤵
  PID:1996
- C:\Windows\System\yOisacy.exe
  C:\Windows\System\yOisacy.exe
  2⤵
  PID:1028
- C:\Windows\System\qbObIdY.exe
  C:\Windows\System\qbObIdY.exe
  2⤵
  PID:1528
- C:\Windows\System\wFNYMLi.exe
  C:\Windows\System\wFNYMLi.exe
  2⤵
  PID:1032
- C:\Windows\System\JbWcStc.exe
  C:\Windows\System\JbWcStc.exe
  2⤵
  PID:4504
- C:\Windows\System\lxQcEvm.exe
  C:\Windows\System\lxQcEvm.exe
  2⤵
  PID:4356
- C:\Windows\System\HqdgXYy.exe
  C:\Windows\System\HqdgXYy.exe
  2⤵
  PID:3516
- C:\Windows\System\lRLdwpz.exe
  C:\Windows\System\lRLdwpz.exe
  2⤵
  PID:3828
- C:\Windows\System\ixWITGD.exe
  C:\Windows\System\ixWITGD.exe
  2⤵
  PID:5080
- C:\Windows\System\defNuTE.exe
  C:\Windows\System\defNuTE.exe
  2⤵
  PID:4536
- C:\Windows\System\QgcNAuR.exe
  C:\Windows\System\QgcNAuR.exe
  2⤵
  PID:4892
- C:\Windows\System\pSowajq.exe
  C:\Windows\System\pSowajq.exe
  2⤵
  PID:3972
- C:\Windows\System\GhpictF.exe
  C:\Windows\System\GhpictF.exe
  2⤵
  PID:1688
- C:\Windows\System\dcLDCZl.exe
  C:\Windows\System\dcLDCZl.exe
  2⤵
  PID:5568
- C:\Windows\System\yHJolvU.exe
  C:\Windows\System\yHJolvU.exe
  2⤵
  PID:3936
- C:\Windows\System\eTLeBGt.exe
  C:\Windows\System\eTLeBGt.exe
  2⤵
  PID:1212
- C:\Windows\System\CAjynJQ.exe
  C:\Windows\System\CAjynJQ.exe
  2⤵
  PID:332
- C:\Windows\System\dLHTlSV.exe
  C:\Windows\System\dLHTlSV.exe
  2⤵
  PID:5664
- C:\Windows\System\kVxdlXg.exe
  C:\Windows\System\kVxdlXg.exe
  2⤵
  PID:5700
- C:\Windows\System\KktTtZG.exe
  C:\Windows\System\KktTtZG.exe
  2⤵
  PID:5752
- C:\Windows\System\tCniLug.exe
  C:\Windows\System\tCniLug.exe
  2⤵
  PID:6164
- C:\Windows\System\iRTMCyU.exe
  C:\Windows\System\iRTMCyU.exe
  2⤵
  PID:6196
- C:\Windows\System\ZtRasgo.exe
  C:\Windows\System\ZtRasgo.exe
  2⤵
  PID:6220
- C:\Windows\System\uLNtPye.exe
  C:\Windows\System\uLNtPye.exe
  2⤵
  PID:6236
- C:\Windows\System\PqSMYQD.exe
  C:\Windows\System\PqSMYQD.exe
  2⤵
  PID:6252
- C:\Windows\System\yfacbbD.exe
  C:\Windows\System\yfacbbD.exe
  2⤵
  PID:6272
- C:\Windows\System\mvBsVfp.exe
  C:\Windows\System\mvBsVfp.exe
  2⤵
  PID:6292
- C:\Windows\System\WZEJbZn.exe
  C:\Windows\System\WZEJbZn.exe
  2⤵
  PID:6316
- C:\Windows\System\kGzzaJU.exe
  C:\Windows\System\kGzzaJU.exe
  2⤵
  PID:6336
- C:\Windows\System\QPguYvW.exe
  C:\Windows\System\QPguYvW.exe
  2⤵
  PID:6356
- C:\Windows\System\exwVjjg.exe
  C:\Windows\System\exwVjjg.exe
  2⤵
  PID:6392
- C:\Windows\System\QuHDPHn.exe
  C:\Windows\System\QuHDPHn.exe
  2⤵
  PID:6408
- C:\Windows\System\LFitNFW.exe
  C:\Windows\System\LFitNFW.exe
  2⤵
  PID:6424
- C:\Windows\System\UzQtanZ.exe
  C:\Windows\System\UzQtanZ.exe
  2⤵
  PID:6448
- C:\Windows\System\iVbwYee.exe
  C:\Windows\System\iVbwYee.exe
  2⤵
  PID:6464
- C:\Windows\System\YJDGJlx.exe
  C:\Windows\System\YJDGJlx.exe
  2⤵
  PID:6488
- C:\Windows\System\OVyDPXd.exe
  C:\Windows\System\OVyDPXd.exe
  2⤵
  PID:6504
- C:\Windows\System\rSvRbBk.exe
  C:\Windows\System\rSvRbBk.exe
  2⤵
  PID:6528
- C:\Windows\System\bQexufO.exe
  C:\Windows\System\bQexufO.exe
  2⤵
  PID:6544
- C:\Windows\System\QwLudNP.exe
  C:\Windows\System\QwLudNP.exe
  2⤵
  PID:6568
- C:\Windows\System\ymZmzqO.exe
  C:\Windows\System\ymZmzqO.exe
  2⤵
  PID:6588
- C:\Windows\System\EHdwLYI.exe
  C:\Windows\System\EHdwLYI.exe
  2⤵
  PID:6636
- C:\Windows\System\UXCpIve.exe
  C:\Windows\System\UXCpIve.exe
  2⤵
  PID:6664
- C:\Windows\System\PhsNTmm.exe
  C:\Windows\System\PhsNTmm.exe
  2⤵
  PID:6680
- C:\Windows\System\LtwtUte.exe
  C:\Windows\System\LtwtUte.exe
  2⤵
  PID:6704
- C:\Windows\System\zIdcbVI.exe
  C:\Windows\System\zIdcbVI.exe
  2⤵
  PID:6724
- C:\Windows\System\ZLvIfWj.exe
  C:\Windows\System\ZLvIfWj.exe
  2⤵
  PID:6744
- C:\Windows\System\gjWXlhO.exe
  C:\Windows\System\gjWXlhO.exe
  2⤵
  PID:6760
- C:\Windows\System\anLdhOj.exe
  C:\Windows\System\anLdhOj.exe
  2⤵
  PID:6784
- C:\Windows\System\aWhXYyl.exe
  C:\Windows\System\aWhXYyl.exe
  2⤵
  PID:6800
- C:\Windows\System\diyrIli.exe
  C:\Windows\System\diyrIli.exe
  2⤵
  PID:6820
- C:\Windows\System\jrDVOHO.exe
  C:\Windows\System\jrDVOHO.exe
  2⤵
  PID:6836
- C:\Windows\System\RRALLbE.exe
  C:\Windows\System\RRALLbE.exe
  2⤵
  PID:6860
- C:\Windows\System\fdcvnpR.exe
  C:\Windows\System\fdcvnpR.exe
  2⤵
  PID:6880
- C:\Windows\System\ghyZlsZ.exe
  C:\Windows\System\ghyZlsZ.exe
  2⤵
  PID:6900
- C:\Windows\System\EjMIitL.exe
  C:\Windows\System\EjMIitL.exe
  2⤵
  PID:6920
- C:\Windows\System\yiaontZ.exe
  C:\Windows\System\yiaontZ.exe
  2⤵
  PID:6940
- C:\Windows\System\xWQWrTg.exe
  C:\Windows\System\xWQWrTg.exe
  2⤵
  PID:6976
- C:\Windows\System\HzeQlYu.exe
  C:\Windows\System\HzeQlYu.exe
  2⤵
  PID:7000
- C:\Windows\System\lKkgrFH.exe
  C:\Windows\System\lKkgrFH.exe
  2⤵
  PID:7020
- C:\Windows\System\bsWcRGL.exe
  C:\Windows\System\bsWcRGL.exe
  2⤵
  PID:7040
- C:\Windows\System\gDiJGZr.exe
  C:\Windows\System\gDiJGZr.exe
  2⤵
  PID:7060
- C:\Windows\System\gvobcXl.exe
  C:\Windows\System\gvobcXl.exe
  2⤵
  PID:7084
- C:\Windows\System\xrbBGJZ.exe
  C:\Windows\System\xrbBGJZ.exe
  2⤵
  PID:7100
- C:\Windows\System\wUJBLvq.exe
  C:\Windows\System\wUJBLvq.exe
  2⤵
  PID:7120
- C:\Windows\System\tdGCMss.exe
  C:\Windows\System\tdGCMss.exe
  2⤵
  PID:7140
- C:\Windows\System\gWIxfem.exe
  C:\Windows\System\gWIxfem.exe
  2⤵
  PID:7160
- C:\Windows\System\lYkXCld.exe
  C:\Windows\System\lYkXCld.exe
  2⤵
  PID:5284
- C:\Windows\System\JsylNqx.exe
  C:\Windows\System\JsylNqx.exe
  2⤵
  PID:5872
- C:\Windows\System\kbqkkix.exe
  C:\Windows\System\kbqkkix.exe
  2⤵
  PID:3088
- C:\Windows\System\IezjOgB.exe
  C:\Windows\System\IezjOgB.exe
  2⤵
  PID:644
- C:\Windows\System\ftYBRYM.exe
  C:\Windows\System\ftYBRYM.exe
  2⤵
  PID:1216
- C:\Windows\System\ahiUPIr.exe
  C:\Windows\System\ahiUPIr.exe
  2⤵
  PID:4060
- C:\Windows\System\kAZNCYF.exe
  C:\Windows\System\kAZNCYF.exe
  2⤵
  PID:1464
- C:\Windows\System\yDIzehy.exe
  C:\Windows\System\yDIzehy.exe
  2⤵
  PID:3064
- C:\Windows\System\Rgblmaf.exe
  C:\Windows\System\Rgblmaf.exe
  2⤵
  PID:3464
- C:\Windows\System\QNGxMCt.exe
  C:\Windows\System\QNGxMCt.exe
  2⤵
  PID:5216
- C:\Windows\System\xFEfelo.exe
  C:\Windows\System\xFEfelo.exe
  2⤵
  PID:4444
- C:\Windows\System\Jwbaxrs.exe
  C:\Windows\System\Jwbaxrs.exe
  2⤵
  PID:4400
- C:\Windows\System\MkWGpdF.exe
  C:\Windows\System\MkWGpdF.exe
  2⤵
  PID:6152
- C:\Windows\System\zftWWcW.exe
  C:\Windows\System\zftWWcW.exe
  2⤵
  PID:6160
- C:\Windows\System\FlOxOSP.exe
  C:\Windows\System\FlOxOSP.exe
  2⤵
  PID:5304
- C:\Windows\System\RzVQlEJ.exe
  C:\Windows\System\RzVQlEJ.exe
  2⤵
  PID:5328
- C:\Windows\System\zUGnBIa.exe
  C:\Windows\System\zUGnBIa.exe
  2⤵
  PID:5396
- C:\Windows\System\qbLpuvs.exe
  C:\Windows\System\qbLpuvs.exe
  2⤵
  PID:7244
- C:\Windows\System\hLzuEiA.exe
  C:\Windows\System\hLzuEiA.exe
  2⤵
  PID:7452
- C:\Windows\System\hjMokGO.exe
  C:\Windows\System\hjMokGO.exe
  2⤵
  PID:7476
- C:\Windows\System\fkyfFyu.exe
  C:\Windows\System\fkyfFyu.exe
  2⤵
  PID:7492
- C:\Windows\System\DCYCvun.exe
  C:\Windows\System\DCYCvun.exe
  2⤵
  PID:7512
- C:\Windows\System\jujmvdZ.exe
  C:\Windows\System\jujmvdZ.exe
  2⤵
  PID:7532
- C:\Windows\System\wmLMNzS.exe
  C:\Windows\System\wmLMNzS.exe
  2⤵
  PID:7548
- C:\Windows\System\leYXcQO.exe
  C:\Windows\System\leYXcQO.exe
  2⤵
  PID:7572
- C:\Windows\System\CdGpFyN.exe
  C:\Windows\System\CdGpFyN.exe
  2⤵
  PID:7592
- C:\Windows\System\xaIksmD.exe
  C:\Windows\System\xaIksmD.exe
  2⤵
  PID:7612
- C:\Windows\System\vZzLoKg.exe
  C:\Windows\System\vZzLoKg.exe
  2⤵
  PID:7628
- C:\Windows\System\vMGMnup.exe
  C:\Windows\System\vMGMnup.exe
  2⤵
  PID:7648
- C:\Windows\System\qoBNuMU.exe
  C:\Windows\System\qoBNuMU.exe
  2⤵
  PID:7668
- C:\Windows\System\KWLOAYG.exe
  C:\Windows\System\KWLOAYG.exe
  2⤵
  PID:7688
- C:\Windows\System\ASexDtl.exe
  C:\Windows\System\ASexDtl.exe
  2⤵
  PID:7708
- C:\Windows\System\XsoiRHS.exe
  C:\Windows\System\XsoiRHS.exe
  2⤵
  PID:7728
- C:\Windows\System\aNjGzXV.exe
  C:\Windows\System\aNjGzXV.exe
  2⤵
  PID:7748
- C:\Windows\System\vwrnpYS.exe
  C:\Windows\System\vwrnpYS.exe
  2⤵
  PID:7764
- C:\Windows\System\rlAGRdd.exe
  C:\Windows\System\rlAGRdd.exe
  2⤵
  PID:7788
- C:\Windows\System\tUfgGBM.exe
  C:\Windows\System\tUfgGBM.exe
  2⤵
  PID:7804
- C:\Windows\System\sdDwubZ.exe
  C:\Windows\System\sdDwubZ.exe
  2⤵
  PID:7824
- C:\Windows\System\YUgFcZX.exe
  C:\Windows\System\YUgFcZX.exe
  2⤵
  PID:7844
- C:\Windows\System\wlMhRCF.exe
  C:\Windows\System\wlMhRCF.exe
  2⤵
  PID:7860
- C:\Windows\System\ngfnrHk.exe
  C:\Windows\System\ngfnrHk.exe
  2⤵
  PID:7880
- C:\Windows\System\PFcyvgG.exe
  C:\Windows\System\PFcyvgG.exe
  2⤵
  PID:7900
- C:\Windows\System\bTWwIzE.exe
  C:\Windows\System\bTWwIzE.exe
  2⤵
  PID:7920
- C:\Windows\System\cTXXfNJ.exe
  C:\Windows\System\cTXXfNJ.exe
  2⤵
  PID:7940
- C:\Windows\System\uLrMiLM.exe
  C:\Windows\System\uLrMiLM.exe
  2⤵
  PID:7964
- C:\Windows\System\fQZhlUq.exe
  C:\Windows\System\fQZhlUq.exe
  2⤵
  PID:7980
- C:\Windows\System\tgLEAuw.exe
  C:\Windows\System\tgLEAuw.exe
  2⤵
  PID:8004
- C:\Windows\System\ZOSCFQF.exe
  C:\Windows\System\ZOSCFQF.exe
  2⤵
  PID:8020
- C:\Windows\System\aCOXFyt.exe
  C:\Windows\System\aCOXFyt.exe
  2⤵
  PID:8040
- C:\Windows\System\PgYznbK.exe
  C:\Windows\System\PgYznbK.exe
  2⤵
  PID:8064
- C:\Windows\System\THmzcCs.exe
  C:\Windows\System\THmzcCs.exe
  2⤵
  PID:8080
- C:\Windows\System\urTRpjf.exe
  C:\Windows\System\urTRpjf.exe
  2⤵
  PID:8096
- C:\Windows\System\LAohcvS.exe
  C:\Windows\System\LAohcvS.exe
  2⤵
  PID:8120
- C:\Windows\System\IiPQwUx.exe
  C:\Windows\System\IiPQwUx.exe
  2⤵
  PID:8136
- C:\Windows\System\iufIIcx.exe
  C:\Windows\System\iufIIcx.exe
  2⤵
  PID:8160
- C:\Windows\System\qCOWoEK.exe
  C:\Windows\System\qCOWoEK.exe
  2⤵
  PID:8180
- C:\Windows\System\TxknBKk.exe
  C:\Windows\System\TxknBKk.exe
  2⤵
  PID:5412
- C:\Windows\System\wXsCogg.exe
  C:\Windows\System\wXsCogg.exe
  2⤵
  PID:5468
- C:\Windows\System\sXGUbqV.exe
  C:\Windows\System\sXGUbqV.exe
  2⤵
  PID:5600
- C:\Windows\System\LmZOHko.exe
  C:\Windows\System\LmZOHko.exe
  2⤵
  PID:5520
- C:\Windows\System\xIHwLEO.exe
  C:\Windows\System\xIHwLEO.exe
  2⤵
  PID:5628
- C:\Windows\System\HMUqpkB.exe
  C:\Windows\System\HMUqpkB.exe
  2⤵
  PID:5392
- C:\Windows\System\zBZRxaR.exe
  C:\Windows\System\zBZRxaR.exe
  2⤵
  PID:5804
- C:\Windows\System\RUDiUby.exe
  C:\Windows\System\RUDiUby.exe
  2⤵
  PID:5916
- C:\Windows\System\tafFUcm.exe
  C:\Windows\System\tafFUcm.exe
  2⤵
  PID:5952
- C:\Windows\System\iOwJnRP.exe
  C:\Windows\System\iOwJnRP.exe
  2⤵
  PID:5976
- C:\Windows\System\qAEIJSi.exe
  C:\Windows\System\qAEIJSi.exe
  2⤵
  PID:6036
- C:\Windows\System\rfQDorA.exe
  C:\Windows\System\rfQDorA.exe
  2⤵
  PID:6068
- C:\Windows\System\uqfylJc.exe
  C:\Windows\System\uqfylJc.exe
  2⤵
  PID:6136
- C:\Windows\System\aTTHcRp.exe
  C:\Windows\System\aTTHcRp.exe
  2⤵
  PID:3060
- C:\Windows\System\ArGWSYS.exe
  C:\Windows\System\ArGWSYS.exe
  2⤵
  PID:3880
- C:\Windows\System\EgMsaoc.exe
  C:\Windows\System\EgMsaoc.exe
  2⤵
  PID:4044
- C:\Windows\System\coKOTxh.exe
  C:\Windows\System\coKOTxh.exe
  2⤵
  PID:1756
- C:\Windows\System\DFlZLGN.exe
  C:\Windows\System\DFlZLGN.exe
  2⤵
  PID:5268
- C:\Windows\System\RtJbkbV.exe
  C:\Windows\System\RtJbkbV.exe
  2⤵
  PID:5552
- C:\Windows\System\FHDzfZF.exe
  C:\Windows\System\FHDzfZF.exe
  2⤵
  PID:6184
- C:\Windows\System\DXEkgmK.exe
  C:\Windows\System\DXEkgmK.exe
  2⤵
  PID:6228
- C:\Windows\System\iJHKbsv.exe
  C:\Windows\System\iJHKbsv.exe
  2⤵
  PID:6264
- C:\Windows\System\SobRmAq.exe
  C:\Windows\System\SobRmAq.exe
  2⤵
  PID:6304
- C:\Windows\System\FpVeWRh.exe
  C:\Windows\System\FpVeWRh.exe
  2⤵
  PID:6352
- C:\Windows\System\jnnragT.exe
  C:\Windows\System\jnnragT.exe
  2⤵
  PID:6512
- C:\Windows\System\VdAukjk.exe
  C:\Windows\System\VdAukjk.exe
  2⤵
  PID:6688
- C:\Windows\System\jhPovDy.exe
  C:\Windows\System\jhPovDy.exe
  2⤵
  PID:7032
- C:\Windows\System\CxRizas.exe
  C:\Windows\System\CxRizas.exe
  2⤵
  PID:7156
- C:\Windows\System\cRCritZ.exe
  C:\Windows\System\cRCritZ.exe
  2⤵
  PID:5768
- C:\Windows\System\DNnTehy.exe
  C:\Windows\System\DNnTehy.exe
  2⤵
  PID:7176
- C:\Windows\System\UMvdvVc.exe
  C:\Windows\System\UMvdvVc.exe
  2⤵
  PID:7524
- C:\Windows\System\dYVfXnB.exe
  C:\Windows\System\dYVfXnB.exe
  2⤵
  PID:7580
- C:\Windows\System\Pqkdusc.exe
  C:\Windows\System\Pqkdusc.exe
  2⤵
  PID:7036
- C:\Windows\System\mEsuDRj.exe
  C:\Windows\System\mEsuDRj.exe
  2⤵
  PID:7076
- C:\Windows\System\ZjwPBNu.exe
  C:\Windows\System\ZjwPBNu.exe
  2⤵
  PID:8212
- C:\Windows\System\yVFHITh.exe
  C:\Windows\System\yVFHITh.exe
  2⤵
  PID:8232
- C:\Windows\System\DGbUadL.exe
  C:\Windows\System\DGbUadL.exe
  2⤵
  PID:8252
- C:\Windows\System\xismEwQ.exe
  C:\Windows\System\xismEwQ.exe
  2⤵
  PID:8276
- C:\Windows\System\emMkFPs.exe
  C:\Windows\System\emMkFPs.exe
  2⤵
  PID:8300
- C:\Windows\System\IhVaEoy.exe
  C:\Windows\System\IhVaEoy.exe
  2⤵
  PID:8316
- C:\Windows\System\UVZqraW.exe
  C:\Windows\System\UVZqraW.exe
  2⤵
  PID:8336
- C:\Windows\System\sliGzJp.exe
  C:\Windows\System\sliGzJp.exe
  2⤵
  PID:8360
- C:\Windows\System\rETRZwa.exe
  C:\Windows\System\rETRZwa.exe
  2⤵
  PID:8380
- C:\Windows\System\cuPuHRB.exe
  C:\Windows\System\cuPuHRB.exe
  2⤵
  PID:8400
- C:\Windows\System\LltMGsF.exe
  C:\Windows\System\LltMGsF.exe
  2⤵
  PID:8424
- C:\Windows\System\tSKdCCa.exe
  C:\Windows\System\tSKdCCa.exe
  2⤵
  PID:8440
- C:\Windows\System\gVKMmcW.exe
  C:\Windows\System\gVKMmcW.exe
  2⤵
  PID:8456
- C:\Windows\System\faysnBT.exe
  C:\Windows\System\faysnBT.exe
  2⤵
  PID:8472
- C:\Windows\System\mSOIpRn.exe
  C:\Windows\System\mSOIpRn.exe
  2⤵
  PID:8492
- C:\Windows\System\hVKhulW.exe
  C:\Windows\System\hVKhulW.exe
  2⤵
  PID:8516
- C:\Windows\System\CsnnTTr.exe
  C:\Windows\System\CsnnTTr.exe
  2⤵
  PID:8536
- C:\Windows\System\QIwwLHU.exe
  C:\Windows\System\QIwwLHU.exe
  2⤵
  PID:8556
- C:\Windows\System\JURjXQa.exe
  C:\Windows\System\JURjXQa.exe
  2⤵
  PID:8580
- C:\Windows\System\yrfozRY.exe
  C:\Windows\System\yrfozRY.exe
  2⤵
  PID:8600
- C:\Windows\System\NLXbUGe.exe
  C:\Windows\System\NLXbUGe.exe
  2⤵
  PID:8624
- C:\Windows\System\xkiUzQB.exe
  C:\Windows\System\xkiUzQB.exe
  2⤵
  PID:8644
- C:\Windows\System\bYdYkWB.exe
  C:\Windows\System\bYdYkWB.exe
  2⤵
  PID:8664
- C:\Windows\System\SBLQDqU.exe
  C:\Windows\System\SBLQDqU.exe
  2⤵
  PID:8688
- C:\Windows\System\bEwXCXN.exe
  C:\Windows\System\bEwXCXN.exe
  2⤵
  PID:8704
- C:\Windows\System\qdTPjJN.exe
  C:\Windows\System\qdTPjJN.exe
  2⤵
  PID:8728
- C:\Windows\System\HaDThjC.exe
  C:\Windows\System\HaDThjC.exe
  2⤵
  PID:8744
- C:\Windows\System\ZUgHaTu.exe
  C:\Windows\System\ZUgHaTu.exe
  2⤵
  PID:8764
- C:\Windows\System\QUgUlMu.exe
  C:\Windows\System\QUgUlMu.exe
  2⤵
  PID:8788
- C:\Windows\System\praXhgF.exe
  C:\Windows\System\praXhgF.exe
  2⤵
  PID:8808
- C:\Windows\System\hqhwwUf.exe
  C:\Windows\System\hqhwwUf.exe
  2⤵
  PID:8832
- C:\Windows\System\mHxJldx.exe
  C:\Windows\System\mHxJldx.exe
  2⤵
  PID:8852
- C:\Windows\System\MeWWsXl.exe
  C:\Windows\System\MeWWsXl.exe
  2⤵
  PID:8880
- C:\Windows\System\eIwHFdS.exe
  C:\Windows\System\eIwHFdS.exe
  2⤵
  PID:8900
- C:\Windows\System\VQlozxm.exe
  C:\Windows\System\VQlozxm.exe
  2⤵
  PID:8924
- C:\Windows\System\lPbCHqq.exe
  C:\Windows\System\lPbCHqq.exe
  2⤵
  PID:8948
- C:\Windows\System\tdJfurv.exe
  C:\Windows\System\tdJfurv.exe
  2⤵
  PID:8964
- C:\Windows\System\ZMaCtNY.exe
  C:\Windows\System\ZMaCtNY.exe
  2⤵
  PID:8980
- C:\Windows\System\VWumgDB.exe
  C:\Windows\System\VWumgDB.exe
  2⤵
  PID:8996
- C:\Windows\System\QsYlMzp.exe
  C:\Windows\System\QsYlMzp.exe
  2⤵
  PID:9016
- C:\Windows\System\LjfXneS.exe
  C:\Windows\System\LjfXneS.exe
  2⤵
  PID:9032
- C:\Windows\System\vhuZZMf.exe
  C:\Windows\System\vhuZZMf.exe
  2⤵
  PID:9056
- C:\Windows\System\TTwhNZh.exe
  C:\Windows\System\TTwhNZh.exe
  2⤵
  PID:6496
- C:\Windows\System\pkEuLgF.exe
  C:\Windows\System\pkEuLgF.exe
  2⤵
  PID:6536
- C:\Windows\System\NmceUXb.exe
  C:\Windows\System\NmceUXb.exe
  2⤵
  PID:6624
- C:\Windows\System\IwkBOHh.exe
  C:\Windows\System\IwkBOHh.exe
  2⤵
  PID:6676
- C:\Windows\System\DbRfFBm.exe
  C:\Windows\System\DbRfFBm.exe
  2⤵
  PID:6716
- C:\Windows\System\AaTzdMB.exe
  C:\Windows\System\AaTzdMB.exe
  2⤵
  PID:6776
- C:\Windows\System\sXOCLgx.exe
  C:\Windows\System\sXOCLgx.exe
  2⤵
  PID:6816
- C:\Windows\System\qaSZFip.exe
  C:\Windows\System\qaSZFip.exe
  2⤵
  PID:6936
- C:\Windows\System\GmLcbme.exe
  C:\Windows\System\GmLcbme.exe
  2⤵
  PID:7092
- C:\Windows\System\ZaRRdUW.exe
  C:\Windows\System\ZaRRdUW.exe
  2⤵
  PID:8308
- C:\Windows\System\QLCfdMp.exe
  C:\Windows\System\QLCfdMp.exe
  2⤵
  PID:8396
- C:\Windows\System\ksFXhXO.exe
  C:\Windows\System\ksFXhXO.exe
  2⤵
  PID:7832
- C:\Windows\System\CsongoT.exe
  C:\Windows\System\CsongoT.exe
  2⤵
  PID:7936
- C:\Windows\System\EjMsptk.exe
  C:\Windows\System\EjMsptk.exe
  2⤵
  PID:8012
- C:\Windows\System\bxohwhl.exe
  C:\Windows\System\bxohwhl.exe
  2⤵
  PID:8092
- C:\Windows\System\RIIftRf.exe
  C:\Windows\System\RIIftRf.exe
  2⤵
  PID:5448
- C:\Windows\System\nUYRTWp.exe
  C:\Windows\System\nUYRTWp.exe
  2⤵
  PID:8760
- C:\Windows\System\BfeEPxT.exe
  C:\Windows\System\BfeEPxT.exe
  2⤵
  PID:8960
- C:\Windows\System\OkRtdcM.exe
  C:\Windows\System\OkRtdcM.exe
  2⤵
  PID:6780
- C:\Windows\System\OcbGazG.exe
  C:\Windows\System\OcbGazG.exe
  2⤵
  PID:6844
- C:\Windows\System\ZddDOoo.exe
  C:\Windows\System\ZddDOoo.exe
  2⤵
  PID:9224
- C:\Windows\System\CMIQVvo.exe
  C:\Windows\System\CMIQVvo.exe
  2⤵
  PID:9244
- C:\Windows\System\pLUpExf.exe
  C:\Windows\System\pLUpExf.exe
  2⤵
  PID:9268
- C:\Windows\System\ajlgIiR.exe
  C:\Windows\System\ajlgIiR.exe
  2⤵
  PID:9284
- C:\Windows\System\gVqEIdG.exe
  C:\Windows\System\gVqEIdG.exe
  2⤵
  PID:9300
- C:\Windows\System\jWPKTwC.exe
  C:\Windows\System\jWPKTwC.exe
  2⤵
  PID:9316
- C:\Windows\System\HCQsddC.exe
  C:\Windows\System\HCQsddC.exe
  2⤵
  PID:9336
- C:\Windows\System\EOAzKcJ.exe
  C:\Windows\System\EOAzKcJ.exe
  2⤵
  PID:9360
- C:\Windows\System\hRiZJaQ.exe
  C:\Windows\System\hRiZJaQ.exe
  2⤵
  PID:9384
- C:\Windows\System\DtrPyqp.exe
  C:\Windows\System\DtrPyqp.exe
  2⤵
  PID:9408
- C:\Windows\System\tXMWexN.exe
  C:\Windows\System\tXMWexN.exe
  2⤵
  PID:9424
- C:\Windows\System\nsxSIoQ.exe
  C:\Windows\System\nsxSIoQ.exe
  2⤵
  PID:9448
- C:\Windows\System\GDNuRpm.exe
  C:\Windows\System\GDNuRpm.exe
  2⤵
  PID:9464
- C:\Windows\System\CbJiPwq.exe
  C:\Windows\System\CbJiPwq.exe
  2⤵
  PID:9500
- C:\Windows\System\meVsiaS.exe
  C:\Windows\System\meVsiaS.exe
  2⤵
  PID:9516
- C:\Windows\System\VhQjKVS.exe
  C:\Windows\System\VhQjKVS.exe
  2⤵
  PID:9540
- C:\Windows\System\wSiIwzt.exe
  C:\Windows\System\wSiIwzt.exe
  2⤵
  PID:9560
- C:\Windows\System\IuidwsC.exe
  C:\Windows\System\IuidwsC.exe
  2⤵
  PID:9584
- C:\Windows\System\Zoouyfv.exe
  C:\Windows\System\Zoouyfv.exe
  2⤵
  PID:9600
- C:\Windows\System\RZUHKTK.exe
  C:\Windows\System\RZUHKTK.exe
  2⤵
  PID:9624
- C:\Windows\System\SJubfLR.exe
  C:\Windows\System\SJubfLR.exe
  2⤵
  PID:9644
- C:\Windows\System\FZlbpoM.exe
  C:\Windows\System\FZlbpoM.exe
  2⤵
  PID:9660
- C:\Windows\System\OjhIPLl.exe
  C:\Windows\System\OjhIPLl.exe
  2⤵
  PID:9680
- C:\Windows\System\sZypKIg.exe
  C:\Windows\System\sZypKIg.exe
  2⤵
  PID:9700
- C:\Windows\System\kQYWRDQ.exe
  C:\Windows\System\kQYWRDQ.exe
  2⤵
  PID:9724
- C:\Windows\System\aewrNsC.exe
  C:\Windows\System\aewrNsC.exe
  2⤵
  PID:9740
- C:\Windows\System\xfPeVlQ.exe
  C:\Windows\System\xfPeVlQ.exe
  2⤵
  PID:9768
- C:\Windows\System\bUtSJBk.exe
  C:\Windows\System\bUtSJBk.exe
  2⤵
  PID:9788
- C:\Windows\System\AJQvgGi.exe
  C:\Windows\System\AJQvgGi.exe
  2⤵
  PID:9804
- C:\Windows\System\VBVyRXS.exe
  C:\Windows\System\VBVyRXS.exe
  2⤵
  PID:9820
- C:\Windows\System\ztXdlig.exe
  C:\Windows\System\ztXdlig.exe
  2⤵
  PID:9836
- C:\Windows\System\jLnIKZh.exe
  C:\Windows\System\jLnIKZh.exe
  2⤵
  PID:9852
- C:\Windows\System\KSJmwvw.exe
  C:\Windows\System\KSJmwvw.exe
  2⤵
  PID:9868
- C:\Windows\System\dDsaKkr.exe
  C:\Windows\System\dDsaKkr.exe
  2⤵
  PID:9916
- C:\Windows\System\zDiELBb.exe
  C:\Windows\System\zDiELBb.exe
  2⤵
  PID:9968
- C:\Windows\System\XAlxlkV.exe
  C:\Windows\System\XAlxlkV.exe
  2⤵
  PID:10004
- C:\Windows\System\zSKVntT.exe
  C:\Windows\System\zSKVntT.exe
  2⤵
  PID:10028
- C:\Windows\System\SgiyHRV.exe
  C:\Windows\System\SgiyHRV.exe
  2⤵
  PID:10064
- C:\Windows\System\gpQauzt.exe
  C:\Windows\System\gpQauzt.exe
  2⤵
  PID:10088
- C:\Windows\System\FzNjvzZ.exe
  C:\Windows\System\FzNjvzZ.exe
  2⤵
  PID:10128
- C:\Windows\System\LNdvRXa.exe
  C:\Windows\System\LNdvRXa.exe
  2⤵
  PID:10180
- C:\Windows\System\QbPIJzU.exe
  C:\Windows\System\QbPIJzU.exe
  2⤵
  PID:10224
- C:\Windows\System\jxFiSPb.exe
  C:\Windows\System\jxFiSPb.exe
  2⤵
  PID:7484
- C:\Windows\System\AffNCAb.exe
  C:\Windows\System\AffNCAb.exe
  2⤵
  PID:7660
- C:\Windows\System\RgDagoi.exe
  C:\Windows\System\RgDagoi.exe
  2⤵
  PID:7720
- C:\Windows\System\TfpRCrI.exe
  C:\Windows\System\TfpRCrI.exe
  2⤵
  PID:7896
- C:\Windows\System\PilXWUt.exe
  C:\Windows\System\PilXWUt.exe
  2⤵
  PID:8436
- C:\Windows\System\cmhZwnQ.exe
  C:\Windows\System\cmhZwnQ.exe
  2⤵
  PID:8488
- C:\Windows\System\ABgbcGQ.exe
  C:\Windows\System\ABgbcGQ.exe
  2⤵
  PID:8172
- C:\Windows\System\RHiOfdq.exe
  C:\Windows\System\RHiOfdq.exe
  2⤵
  PID:2132
- C:\Windows\System\pdMxrrG.exe
  C:\Windows\System\pdMxrrG.exe
  2⤵
  PID:8844
- C:\Windows\System\opqUdqq.exe
  C:\Windows\System\opqUdqq.exe
  2⤵
  PID:8888
- C:\Windows\System\DBNpIpf.exe
  C:\Windows\System\DBNpIpf.exe
  2⤵
  PID:4696
- C:\Windows\System\QhvAXhO.exe
  C:\Windows\System\QhvAXhO.exe
  2⤵
  PID:5368
- C:\Windows\System\EXHOATI.exe
  C:\Windows\System\EXHOATI.exe
  2⤵
  PID:7556
- C:\Windows\System\zjRttOy.exe
  C:\Windows\System\zjRttOy.exe
  2⤵
  PID:8244
- C:\Windows\System\IQlCHpo.exe
  C:\Windows\System\IQlCHpo.exe
  2⤵
  PID:8592
- C:\Windows\System\tHikxPc.exe
  C:\Windows\System\tHikxPc.exe
  2⤵
  PID:10256
- C:\Windows\System\zsoqtPU.exe
  C:\Windows\System\zsoqtPU.exe
  2⤵
  PID:10276
- C:\Windows\System\sTtlvHt.exe
  C:\Windows\System\sTtlvHt.exe
  2⤵
  PID:10300
- C:\Windows\System\LvQMafh.exe
  C:\Windows\System\LvQMafh.exe
  2⤵
  PID:10384
- C:\Windows\System\PzVxxJB.exe
  C:\Windows\System\PzVxxJB.exe
  2⤵
  PID:10400
- C:\Windows\System\Oghcnyb.exe
  C:\Windows\System\Oghcnyb.exe
  2⤵
  PID:10416
- C:\Windows\System\xLdgWth.exe
  C:\Windows\System\xLdgWth.exe
  2⤵
  PID:10432
- C:\Windows\System\tSRISVe.exe
  C:\Windows\System\tSRISVe.exe
  2⤵
  PID:10448
- C:\Windows\System\EZSgpIp.exe
  C:\Windows\System\EZSgpIp.exe
  2⤵
  PID:10464
- C:\Windows\System\PaEvTNK.exe
  C:\Windows\System\PaEvTNK.exe
  2⤵
  PID:10480
- C:\Windows\System\sYoLWsu.exe
  C:\Windows\System\sYoLWsu.exe
  2⤵
  PID:10496
- C:\Windows\System\OhwfdoR.exe
  C:\Windows\System\OhwfdoR.exe
  2⤵
  PID:10520
- C:\Windows\System\QVCifhL.exe
  C:\Windows\System\QVCifhL.exe
  2⤵
  PID:10540
- C:\Windows\System\UzlCgiE.exe
  C:\Windows\System\UzlCgiE.exe
  2⤵
  PID:10560
- C:\Windows\System\juvnNhX.exe
  C:\Windows\System\juvnNhX.exe
  2⤵
  PID:10580
- C:\Windows\System\xPrQMCR.exe
  C:\Windows\System\xPrQMCR.exe
  2⤵
  PID:10756
- C:\Windows\System\zTzaASR.exe
  C:\Windows\System\zTzaASR.exe
  2⤵
  PID:10784
- C:\Windows\System\Tckjvql.exe
  C:\Windows\System\Tckjvql.exe
  2⤵
  PID:10804
- C:\Windows\System\WHIJwtf.exe
  C:\Windows\System\WHIJwtf.exe
  2⤵
  PID:10824
- C:\Windows\System\OVnlMNf.exe
  C:\Windows\System\OVnlMNf.exe
  2⤵
  PID:10848
- C:\Windows\System\ZZsfJkD.exe
  C:\Windows\System\ZZsfJkD.exe
  2⤵
  PID:10864
- C:\Windows\System\tlHGBGd.exe
  C:\Windows\System\tlHGBGd.exe
  2⤵
  PID:10896
- C:\Windows\System\yfWJnOw.exe
  C:\Windows\System\yfWJnOw.exe
  2⤵
  PID:10920
- C:\Windows\System\tdtpzuc.exe
  C:\Windows\System\tdtpzuc.exe
  2⤵
  PID:10940
- C:\Windows\System\kQlElnj.exe
  C:\Windows\System\kQlElnj.exe
  2⤵
  PID:10964
- C:\Windows\System\KmxBTfy.exe
  C:\Windows\System\KmxBTfy.exe
  2⤵
  PID:10988
- C:\Windows\System\ArNktCt.exe
  C:\Windows\System\ArNktCt.exe
  2⤵
  PID:11008
- C:\Windows\System\nDtZqxc.exe
  C:\Windows\System\nDtZqxc.exe
  2⤵
  PID:11040
- C:\Windows\System\mNvGwPG.exe
  C:\Windows\System\mNvGwPG.exe
  2⤵
  PID:11064
- C:\Windows\System\QzpqZEo.exe
  C:\Windows\System\QzpqZEo.exe
  2⤵
  PID:11088
- C:\Windows\System\OFeKGVN.exe
  C:\Windows\System\OFeKGVN.exe
  2⤵
  PID:11108
- C:\Windows\System\crTvHQQ.exe
  C:\Windows\System\crTvHQQ.exe
  2⤵
  PID:11128
- C:\Windows\System\ILXILBc.exe
  C:\Windows\System\ILXILBc.exe
  2⤵
  PID:11148
- C:\Windows\System\OVFdZrl.exe
  C:\Windows\System\OVFdZrl.exe
  2⤵
  PID:11172
- C:\Windows\System\MIyzWYe.exe
  C:\Windows\System\MIyzWYe.exe
  2⤵
  PID:11196
- C:\Windows\System\DAbVnAS.exe
  C:\Windows\System\DAbVnAS.exe
  2⤵
  PID:11220
- C:\Windows\System\UQSMOUs.exe
  C:\Windows\System\UQSMOUs.exe
  2⤵
  PID:11236
- C:\Windows\System\PIIEhYh.exe
  C:\Windows\System\PIIEhYh.exe
  2⤵
  PID:8988
- C:\Windows\System\kFboVPf.exe
  C:\Windows\System\kFboVPf.exe
  2⤵
  PID:9024
- C:\Windows\System\mBNbRWz.exe
  C:\Windows\System\mBNbRWz.exe
  2⤵
  PID:9064
- C:\Windows\System\yYddimc.exe
  C:\Windows\System\yYddimc.exe
  2⤵
  PID:9112
- C:\Windows\System\BTrpjIT.exe
  C:\Windows\System\BTrpjIT.exe
  2⤵
  PID:6712
- C:\Windows\System\BQwZNpI.exe
  C:\Windows\System\BQwZNpI.exe
  2⤵
  PID:9196
- C:\Windows\System\iggZCow.exe
  C:\Windows\System\iggZCow.exe
  2⤵
  PID:6772
- C:\Windows\System\XgKiHgj.exe
  C:\Windows\System\XgKiHgj.exe
  2⤵
  PID:11016
- C:\Windows\System\UfAqAJT.exe
  C:\Windows\System\UfAqAJT.exe
  2⤵
  PID:10816
- C:\Windows\System\QAgnTGv.exe
  C:\Windows\System\QAgnTGv.exe
  2⤵
  PID:2920
- C:\Windows\System\NfsQXDp.exe
  C:\Windows\System\NfsQXDp.exe
  2⤵
  PID:11276
- C:\Windows\System\JPDUoiq.exe
  C:\Windows\System\JPDUoiq.exe
  2⤵
  PID:11292
- C:\Windows\System\CugFKdj.exe
  C:\Windows\System\CugFKdj.exe
  2⤵
  PID:11312
- C:\Windows\System\qytuVru.exe
  C:\Windows\System\qytuVru.exe
  2⤵
  PID:11336
- C:\Windows\System\XjNIdxT.exe
  C:\Windows\System\XjNIdxT.exe
  2⤵
  PID:11352
- C:\Windows\System\EdOjjzY.exe
  C:\Windows\System\EdOjjzY.exe
  2⤵
  PID:11376
- C:\Windows\System\WCbdXse.exe
  C:\Windows\System\WCbdXse.exe
  2⤵
  PID:11400
- C:\Windows\System\HTlOfAt.exe
  C:\Windows\System\HTlOfAt.exe
  2⤵
  PID:11420
- C:\Windows\System\pBsvBTx.exe
  C:\Windows\System\pBsvBTx.exe
  2⤵
  PID:11444
- C:\Windows\System\TNTjDBu.exe
  C:\Windows\System\TNTjDBu.exe
  2⤵
  PID:11464
- C:\Windows\System\SshbEqq.exe
  C:\Windows\System\SshbEqq.exe
  2⤵
  PID:11484
- C:\Windows\System\rCFWtkf.exe
  C:\Windows\System\rCFWtkf.exe
  2⤵
  PID:11504
- C:\Windows\System\tJdLgqQ.exe
  C:\Windows\System\tJdLgqQ.exe
  2⤵
  PID:11524
- C:\Windows\System\hGdmXbl.exe
  C:\Windows\System\hGdmXbl.exe
  2⤵
  PID:11548
- C:\Windows\System\RvibKxz.exe
  C:\Windows\System\RvibKxz.exe
  2⤵
  PID:11568
- C:\Windows\System\Mstehlo.exe
  C:\Windows\System\Mstehlo.exe
  2⤵
  PID:11584
- C:\Windows\System\CuSczXs.exe
  C:\Windows\System\CuSczXs.exe
  2⤵
  PID:11604
- C:\Windows\System\DTCNQKR.exe
  C:\Windows\System\DTCNQKR.exe
  2⤵
  PID:11624
- C:\Windows\System\iBJHsWw.exe
  C:\Windows\System\iBJHsWw.exe
  2⤵
  PID:11644
- C:\Windows\System\IngxjXc.exe
  C:\Windows\System\IngxjXc.exe
  2⤵
  PID:11672
- C:\Windows\System\sqRAhxB.exe
  C:\Windows\System\sqRAhxB.exe
  2⤵
  PID:11700
- C:\Windows\System\QuQdIqi.exe
  C:\Windows\System\QuQdIqi.exe
  2⤵
  PID:11724
- C:\Windows\System\CpHAbby.exe
  C:\Windows\System\CpHAbby.exe
  2⤵
  PID:11752
- C:\Windows\System\kpgObPr.exe
  C:\Windows\System\kpgObPr.exe
  2⤵
  PID:11768
- C:\Windows\System\kOWVYOz.exe
  C:\Windows\System\kOWVYOz.exe
  2⤵
  PID:11788
- C:\Windows\System\rqWhEXH.exe
  C:\Windows\System\rqWhEXH.exe
  2⤵
  PID:11812
- C:\Windows\System\BTZkjOn.exe
  C:\Windows\System\BTZkjOn.exe
  2⤵
  PID:11832
- C:\Windows\System\inYwENX.exe
  C:\Windows\System\inYwENX.exe
  2⤵
  PID:11848
- C:\Windows\System\qhLDNas.exe
  C:\Windows\System\qhLDNas.exe
  2⤵
  PID:11868
- C:\Windows\System\QCxhIPB.exe
  C:\Windows\System\QCxhIPB.exe
  2⤵
  PID:11884
- C:\Windows\System\zZFmnqm.exe
  C:\Windows\System\zZFmnqm.exe
  2⤵
  PID:11900
- C:\Windows\System\SJCLdOa.exe
  C:\Windows\System\SJCLdOa.exe
  2⤵
  PID:11916
- C:\Windows\System\tQMDBbT.exe
  C:\Windows\System\tQMDBbT.exe
  2⤵
  PID:11932
- C:\Windows\System\clcnZkK.exe
  C:\Windows\System\clcnZkK.exe
  2⤵
  PID:11952
- C:\Windows\System\YgJEakU.exe
  C:\Windows\System\YgJEakU.exe
  2⤵
  PID:11968
- C:\Windows\System\HWKRDhD.exe
  C:\Windows\System\HWKRDhD.exe
  2⤵
  PID:11984
- C:\Windows\System\UncXRPY.exe
  C:\Windows\System\UncXRPY.exe
  2⤵
  PID:12004
- C:\Windows\System\EvbHUAf.exe
  C:\Windows\System\EvbHUAf.exe
  2⤵
  PID:12020
- C:\Windows\System\IgKhYdY.exe
  C:\Windows\System\IgKhYdY.exe
  2⤵
  PID:12036
- C:\Windows\System\KnBrwPI.exe
  C:\Windows\System\KnBrwPI.exe
  2⤵
  PID:12052
- C:\Windows\System\tTJkYea.exe
  C:\Windows\System\tTJkYea.exe
  2⤵
  PID:12068
- C:\Windows\System\BKpfdQk.exe
  C:\Windows\System\BKpfdQk.exe
  2⤵
  PID:12104
- C:\Windows\System\GjDnFFu.exe
  C:\Windows\System\GjDnFFu.exe
  2⤵
  PID:12124
- C:\Windows\System\giZWeAo.exe
  C:\Windows\System\giZWeAo.exe
  2⤵
  PID:12140
- C:\Windows\System\CtWsURP.exe
  C:\Windows\System\CtWsURP.exe
  2⤵
  PID:12156
- C:\Windows\System\LMBkZzm.exe
  C:\Windows\System\LMBkZzm.exe
  2⤵
  PID:12176
- C:\Windows\System\bcvaavg.exe
  C:\Windows\System\bcvaavg.exe
  2⤵
  PID:12192
- C:\Windows\System\vECLXaA.exe
  C:\Windows\System\vECLXaA.exe
  2⤵
  PID:12220
- C:\Windows\System\DhXbNeT.exe
  C:\Windows\System\DhXbNeT.exe
  2⤵
  PID:12256
- C:\Windows\System\yFQiwMG.exe
  C:\Windows\System\yFQiwMG.exe
  2⤵
  PID:8144
- C:\Windows\System\PyEnOWw.exe
  C:\Windows\System\PyEnOWw.exe
  2⤵
  PID:9956
- C:\Windows\System\vNQuGCp.exe
  C:\Windows\System\vNQuGCp.exe
  2⤵
  PID:10060
- C:\Windows\System\uAANioO.exe
  C:\Windows\System\uAANioO.exe
  2⤵
  PID:10832
- C:\Windows\System\nbDWbdU.exe
  C:\Windows\System\nbDWbdU.exe
  2⤵
  PID:6896
- C:\Windows\System\QrTZzvi.exe
  C:\Windows\System\QrTZzvi.exe
  2⤵
  PID:8348
- C:\Windows\System\wuwExds.exe
  C:\Windows\System\wuwExds.exe
  2⤵
  PID:8432
- C:\Windows\System\duCMXlZ.exe
  C:\Windows\System\duCMXlZ.exe
  2⤵
  PID:1680
- C:\Windows\System\bqMhxnm.exe
  C:\Windows\System\bqMhxnm.exe
  2⤵
  PID:8468
- C:\Windows\System\fmTzQDl.exe
  C:\Windows\System\fmTzQDl.exe
  2⤵
  PID:8548
- C:\Windows\System\QtGfhFH.exe
  C:\Windows\System\QtGfhFH.exe
  2⤵
  PID:10248
- C:\Windows\System\GiNyvtp.exe
  C:\Windows\System\GiNyvtp.exe
  2⤵
  PID:10292
- C:\Windows\System\SzBFlUa.exe
  C:\Windows\System\SzBFlUa.exe
  2⤵
  PID:10396
- C:\Windows\System\yBDsqBN.exe
  C:\Windows\System\yBDsqBN.exe
  2⤵
  PID:10556
- C:\Windows\System\mgQijOE.exe
  C:\Windows\System\mgQijOE.exe
  2⤵
  PID:10664
- C:\Windows\System\BXrhKoC.exe
  C:\Windows\System\BXrhKoC.exe
  2⤵
  PID:10764
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 10764 -s 28
    3⤵
    PID:4448
- C:\Windows\System\CrShDcA.exe
  C:\Windows\System\CrShDcA.exe
  2⤵
  PID:10960
- C:\Windows\System\gZnfnDl.exe
  C:\Windows\System\gZnfnDl.exe
  2⤵
  PID:11020
- C:\Windows\System\eSCVAkS.exe
  C:\Windows\System\eSCVAkS.exe
  2⤵
  PID:2008
- C:\Windows\System\jeUgmMM.exe
  C:\Windows\System\jeUgmMM.exe
  2⤵
  PID:11104
- C:\Windows\System\gKjNcTP.exe
  C:\Windows\System\gKjNcTP.exe
  2⤵
  PID:11208
- C:\Windows\System\LYwRjCv.exe
  C:\Windows\System\LYwRjCv.exe
  2⤵
  PID:11252
- C:\Windows\System\tXaBDuI.exe
  C:\Windows\System\tXaBDuI.exe
  2⤵
  PID:11228
- C:\Windows\System\ZArXmtc.exe
  C:\Windows\System\ZArXmtc.exe
  2⤵
  PID:11140
- C:\Windows\System\bXbFjTn.exe
  C:\Windows\System\bXbFjTn.exe
  2⤵
  PID:11056
- C:\Windows\System\KbmRTFo.exe
  C:\Windows\System\KbmRTFo.exe
  2⤵
  PID:7912
- C:\Windows\System\LzGoUpw.exe
  C:\Windows\System\LzGoUpw.exe
  2⤵
  PID:9008
- C:\Windows\System\pSfAMux.exe
  C:\Windows\System\pSfAMux.exe
  2⤵
  PID:9108
- C:\Windows\System\dzQgJNn.exe
  C:\Windows\System\dzQgJNn.exe
  2⤵
  PID:2460
- C:\Windows\System\bwXaCCa.exe
  C:\Windows\System\bwXaCCa.exe
  2⤵
  PID:10328
- C:\Windows\System\VUZSHxQ.exe
  C:\Windows\System\VUZSHxQ.exe
  2⤵
  PID:10408
- C:\Windows\System\SfkjlVa.exe
  C:\Windows\System\SfkjlVa.exe
  2⤵
  PID:9908
- C:\Windows\System\CDcsaBN.exe
  C:\Windows\System\CDcsaBN.exe
  2⤵
  PID:7068
- C:\Windows\System\RFCjXdW.exe
  C:\Windows\System\RFCjXdW.exe
  2⤵
  PID:11060
- C:\Windows\System\mEBWjSm.exe
  C:\Windows\System\mEBWjSm.exe
  2⤵
  PID:6892
- C:\Windows\System\qCGSGzV.exe
  C:\Windows\System\qCGSGzV.exe
  2⤵
  PID:10512
- C:\Windows\System\UrXpUHm.exe
  C:\Windows\System\UrXpUHm.exe
  2⤵
  PID:11304
- C:\Windows\System\MCMBfaO.exe
  C:\Windows\System\MCMBfaO.exe
  2⤵
  PID:11348
- C:\Windows\System\SRmglFG.exe
  C:\Windows\System\SRmglFG.exe
  2⤵
  PID:11428
- C:\Windows\System\TtCmDUR.exe
  C:\Windows\System\TtCmDUR.exe
  2⤵
  PID:11476
- C:\Windows\System\CgMAbdR.exe
  C:\Windows\System\CgMAbdR.exe
  2⤵
  PID:2388
- C:\Windows\System\iPZZxMG.exe
  C:\Windows\System\iPZZxMG.exe
  2⤵
  PID:11576
- C:\Windows\System\KOSOAhM.exe
  C:\Windows\System\KOSOAhM.exe
  2⤵
  PID:11612
- C:\Windows\System\KixtkPz.exe
  C:\Windows\System\KixtkPz.exe
  2⤵
  PID:11660
- C:\Windows\System\PeNEOty.exe
  C:\Windows\System\PeNEOty.exe
  2⤵
  PID:11696
- C:\Windows\System\ILvrQIF.exe
  C:\Windows\System\ILvrQIF.exe
  2⤵
  PID:11732
- C:\Windows\System\DudWeQw.exe
  C:\Windows\System\DudWeQw.exe
  2⤵
  PID:11764
- C:\Windows\System\foZBzUL.exe
  C:\Windows\System\foZBzUL.exe
  2⤵
  PID:11796
- C:\Windows\System\PHQitRG.exe
  C:\Windows\System\PHQitRG.exe
  2⤵
  PID:11824
- C:\Windows\System\IrhACbN.exe
  C:\Windows\System\IrhACbN.exe
  2⤵
  PID:11856
- C:\Windows\System\ZGCPdnX.exe
  C:\Windows\System\ZGCPdnX.exe
  2⤵
  PID:11896
- C:\Windows\System\mrvRdkN.exe
  C:\Windows\System\mrvRdkN.exe
  2⤵
  PID:11928
- C:\Windows\System\SLWWQww.exe
  C:\Windows\System\SLWWQww.exe
  2⤵
  PID:11992
- C:\Windows\System\NjQCJjk.exe
  C:\Windows\System\NjQCJjk.exe
  2⤵
  PID:12044
- C:\Windows\System\CeYlfha.exe
  C:\Windows\System\CeYlfha.exe
  2⤵
  PID:12064
- C:\Windows\System\VLYYnSK.exe
  C:\Windows\System\VLYYnSK.exe
  2⤵
  PID:9652
- C:\Windows\System\bpExdbI.exe
  C:\Windows\System\bpExdbI.exe
  2⤵
  PID:9568
- C:\Windows\System\CzMdTDB.exe
  C:\Windows\System\CzMdTDB.exe
  2⤵
  PID:9292
- C:\Windows\System\IxzJGYv.exe
  C:\Windows\System\IxzJGYv.exe
  2⤵
  PID:3164
- C:\Windows\System\KgdChUK.exe
  C:\Windows\System\KgdChUK.exe
  2⤵
  PID:12272
- C:\Windows\System\rSAyTbo.exe
  C:\Windows\System\rSAyTbo.exe
  2⤵
  PID:12212
- C:\Windows\System\zFrjyhL.exe
  C:\Windows\System\zFrjyhL.exe
  2⤵
  PID:12152
- C:\Windows\System\XlvXqdB.exe
  C:\Windows\System\XlvXqdB.exe
  2⤵
  PID:12116
- C:\Windows\System\FNqnJsA.exe
  C:\Windows\System\FNqnJsA.exe
  2⤵
  PID:4640
- C:\Windows\System\ugDuwpB.exe
  C:\Windows\System\ugDuwpB.exe
  2⤵
  PID:8572
- C:\Windows\System\XVbxQWR.exe
  C:\Windows\System\XVbxQWR.exe
  2⤵
  PID:10532
- C:\Windows\System\sCYCJqo.exe
  C:\Windows\System\sCYCJqo.exe
  2⤵
  PID:12312
- C:\Windows\System\rsTGrvL.exe
  C:\Windows\System\rsTGrvL.exe
  2⤵
  PID:12332
- C:\Windows\System\gzwoqaK.exe
  C:\Windows\System\gzwoqaK.exe
  2⤵
  PID:12348
- C:\Windows\System\KXBggWM.exe
  C:\Windows\System\KXBggWM.exe
  2⤵
  PID:12364
- C:\Windows\System\cSUjpQe.exe
  C:\Windows\System\cSUjpQe.exe
  2⤵
  PID:12380
- C:\Windows\System\IrfEHwV.exe
  C:\Windows\System\IrfEHwV.exe
  2⤵
  PID:10596
- C:\Windows\System\UuVyCJi.exe
  C:\Windows\System\UuVyCJi.exe
  2⤵
  PID:12552
- C:\Windows\System\uZyTbYj.exe
  C:\Windows\System\uZyTbYj.exe
  2⤵
  PID:11784
- C:\Windows\System\jUlDjOj.exe
  C:\Windows\System\jUlDjOj.exe
  2⤵
  PID:11652
- C:\Windows\System\NzOoyIo.exe
  C:\Windows\System\NzOoyIo.exe
  2⤵
  PID:10324
- C:\Windows\System\BgwGczx.exe
  C:\Windows\System\BgwGczx.exe
  2⤵
  PID:12436
- C:\Windows\System\CbthlHu.exe
  C:\Windows\System\CbthlHu.exe
  2⤵
  PID:10740
- C:\Windows\System\clBpAPV.exe
  C:\Windows\System\clBpAPV.exe
  2⤵
  PID:10504
- C:\Windows\System\zLBtbdw.exe
  C:\Windows\System\zLBtbdw.exe
  2⤵
  PID:11180
- C:\Windows\System\lmUUaeO.exe
  C:\Windows\System\lmUUaeO.exe
  2⤵
  PID:9012
- C:\Windows\System\bqDPMbD.exe
  C:\Windows\System\bqDPMbD.exe
  2⤵
  PID:10316
- C:\Windows\System\rDNkkWV.exe
  C:\Windows\System\rDNkkWV.exe
  2⤵
  PID:11544
- C:\Windows\System\nlDisBk.exe
  C:\Windows\System\nlDisBk.exe
  2⤵
  PID:12640
- C:\Windows\System\PFJcTQb.exe
  C:\Windows\System\PFJcTQb.exe
  2⤵
  PID:12608
- C:\Windows\System\XtATaUf.exe
  C:\Windows\System\XtATaUf.exe
  2⤵
  PID:9732
- C:\Windows\System\HXxVYFp.exe
  C:\Windows\System\HXxVYFp.exe
  2⤵
  PID:12200
- C:\Windows\System\NJKyMfl.exe
  C:\Windows\System\NJKyMfl.exe
  2⤵
  PID:12404
- C:\Windows\System\QMqunoY.exe
  C:\Windows\System\QMqunoY.exe
  2⤵
  PID:12464
- C:\Windows\System\oFEOheu.exe
  C:\Windows\System\oFEOheu.exe
  2⤵
  PID:3964
- C:\Windows\System\vZJkSgD.exe
  C:\Windows\System\vZJkSgD.exe
  2⤵
  PID:12572
- C:\Windows\System\idPJeaH.exe
  C:\Windows\System\idPJeaH.exe
  2⤵
  PID:12796
- C:\Windows\System\amsmtLP.exe
  C:\Windows\System\amsmtLP.exe
  2⤵
  PID:12684
- C:\Windows\System\fOKihBI.exe
  C:\Windows\System\fOKihBI.exe
  2⤵
  PID:13128
- C:\Windows\System\aAHTfxJ.exe
  C:\Windows\System\aAHTfxJ.exe
  2⤵
  PID:12228
- C:\Windows\System\dGEnkgj.exe
  C:\Windows\System\dGEnkgj.exe
  2⤵
  PID:10112
- C:\Windows\System\NgRYFne.exe
  C:\Windows\System\NgRYFne.exe
  2⤵
  PID:12136
- C:\Windows\System\WDNnUOu.exe
  C:\Windows\System\WDNnUOu.exe
  2⤵
  PID:12304
- C:\Windows\System\MDrtEFO.exe
  C:\Windows\System\MDrtEFO.exe
  2⤵
  PID:7028
- C:\Windows\System\UyyKVYO.exe
  C:\Windows\System\UyyKVYO.exe
  2⤵
  PID:10036
- C:\Windows\System\tdVNcrU.exe
  C:\Windows\System\tdVNcrU.exe
  2⤵
  PID:11880
- C:\Windows\System\EPadNDl.exe
  C:\Windows\System\EPadNDl.exe
  2⤵
  PID:12076
- C:\Windows\System\gpivsGb.exe
  C:\Windows\System\gpivsGb.exe
  2⤵
  PID:12692
- C:\Windows\System\lAZFUCI.exe
  C:\Windows\System\lAZFUCI.exe
  2⤵
  PID:3752
- C:\Windows\System\TbDAFbk.exe
  C:\Windows\System\TbDAFbk.exe
  2⤵
  PID:12328
- C:\Windows\System\rtTFiWd.exe
  C:\Windows\System\rtTFiWd.exe
  2⤵
  PID:12528
- C:\Windows\System\AQZdMsZ.exe
  C:\Windows\System\AQZdMsZ.exe
  2⤵
  PID:10368
- C:\Windows\System\GviLGyL.exe
  C:\Windows\System\GviLGyL.exe
  2⤵
  PID:11144
- C:\Windows\System\QgGKZiU.exe
  C:\Windows\System\QgGKZiU.exe
  2⤵
  PID:4448
- C:\Windows\System\zloMSSh.exe
  C:\Windows\System\zloMSSh.exe
  2⤵
  PID:12488
- C:\Windows\System\YIyCIVR.exe
  C:\Windows\System\YIyCIVR.exe
  2⤵
  PID:12512
- C:\Windows\System\CCVuwMA.exe
  C:\Windows\System\CCVuwMA.exe
  2⤵
  PID:9592
- C:\Windows\System\uSnXunP.exe
  C:\Windows\System\uSnXunP.exe
  2⤵
  PID:216
- C:\Windows\System\UbYIQfc.exe
  C:\Windows\System\UbYIQfc.exe
  2⤵
  PID:10932
- C:\Windows\System\xiwzQwY.exe
  C:\Windows\System\xiwzQwY.exe
  2⤵
  PID:10528
- C:\Windows\System\OzueKUW.exe
  C:\Windows\System\OzueKUW.exe
  2⤵
  PID:12660
- C:\Windows\System\yKDMCVM.exe
  C:\Windows\System\yKDMCVM.exe
  2⤵
  PID:11004
- C:\Windows\System\wWyxarm.exe
  C:\Windows\System\wWyxarm.exe
  2⤵
  PID:10308
- C:\Windows\System\GiNwSuI.exe
  C:\Windows\System\GiNwSuI.exe
  2⤵
  PID:10488
- C:\Windows\System\chivsMX.exe
  C:\Windows\System\chivsMX.exe
  2⤵
  PID:11076
- C:\Windows\System\PMkVPgc.exe
  C:\Windows\System\PMkVPgc.exe
  2⤵
  PID:12908
- C:\Windows\System\caHmYlI.exe
  C:\Windows\System\caHmYlI.exe
  2⤵
  PID:12892
- C:\Windows\System\kSWeWde.exe
  C:\Windows\System\kSWeWde.exe
  2⤵
  PID:10620
- C:\Windows\System\txllXuG.exe
  C:\Windows\System\txllXuG.exe
  2⤵
  PID:13020
- C:\Windows\System\EbPNPyb.exe
  C:\Windows\System\EbPNPyb.exe
  2⤵
  PID:13308
- C:\Windows\System\jbLxTnp.exe
  C:\Windows\System\jbLxTnp.exe
  2⤵
  PID:12940
- C:\Windows\System\skdulLd.exe
  C:\Windows\System\skdulLd.exe
  2⤵
  PID:13052
- C:\Windows\System\tJiDKiO.exe
  C:\Windows\System\tJiDKiO.exe
  2⤵
  PID:6472
- C:\Windows\System\LJHfDlP.exe
  C:\Windows\System\LJHfDlP.exe
  2⤵
  PID:13180
- C:\Windows\System\XMbDcSB.exe
  C:\Windows\System\XMbDcSB.exe
  2⤵
  PID:12244
- C:\Windows\System\ExBQKDV.exe
  C:\Windows\System\ExBQKDV.exe
  2⤵
  PID:10872
- C:\Windows\System\QQSHCIg.exe
  C:\Windows\System\QQSHCIg.exe
  2⤵
  PID:2372
- C:\Windows\System\DZlsgIS.exe
  C:\Windows\System\DZlsgIS.exe
  2⤵
  PID:3048
- C:\Windows\System\QuUHVMq.exe
  C:\Windows\System\QuUHVMq.exe
  2⤵
  PID:3320
- C:\Windows\System\gsUwDCd.exe
  C:\Windows\System\gsUwDCd.exe
  2⤵
  PID:11844
- C:\Windows\System\VytyuIb.exe
  C:\Windows\System\VytyuIb.exe
  2⤵
  PID:1712
- C:\Windows\System\Pybagph.exe
  C:\Windows\System\Pybagph.exe
  2⤵
  PID:5036
- C:\Windows\System\TGxkBSD.exe
  C:\Windows\System\TGxkBSD.exe
  2⤵
  PID:12540
- C:\Windows\System\lWMezTS.exe
  C:\Windows\System\lWMezTS.exe
  2⤵
  PID:2144
- C:\Windows\System\BcqVFPd.exe
  C:\Windows\System\BcqVFPd.exe
  2⤵
  PID:3564
- C:\Windows\System\WZCaiLr.exe
  C:\Windows\System\WZCaiLr.exe
  2⤵
  PID:13100
- C:\Windows\System\UBJIDGW.exe
  C:\Windows\System\UBJIDGW.exe
  2⤵
  PID:2652
- C:\Windows\System\EoWEvsg.exe
  C:\Windows\System\EoWEvsg.exe
  2⤵
  PID:5116
- C:\Windows\System\EYCYEHG.exe
  C:\Windows\System\EYCYEHG.exe
  2⤵
  PID:13688
- C:\Windows\System\RpDMGFM.exe
  C:\Windows\System\RpDMGFM.exe
  2⤵
  PID:13720
- C:\Windows\System\oSNrNJF.exe
  C:\Windows\System\oSNrNJF.exe
  2⤵
  PID:13736
- C:\Windows\System\lIjCBJi.exe
  C:\Windows\System\lIjCBJi.exe
  2⤵
  PID:13752
- C:\Windows\System\ykxBiES.exe
  C:\Windows\System\ykxBiES.exe
  2⤵
  PID:13772
- C:\Windows\System\pYzLzfP.exe
  C:\Windows\System\pYzLzfP.exe
  2⤵
  PID:13788
- C:\Windows\System\sAJqgrT.exe
  C:\Windows\System\sAJqgrT.exe
  2⤵
  PID:13804
- C:\Windows\System\NhVXSPc.exe
  C:\Windows\System\NhVXSPc.exe
  2⤵
  PID:13820
- C:\Windows\System\TFDtIEX.exe
  C:\Windows\System\TFDtIEX.exe
  2⤵
  PID:13836
- C:\Windows\System\OuGECQj.exe
  C:\Windows\System\OuGECQj.exe
  2⤵
  PID:13856
- C:\Windows\System\FKKmcaE.exe
  C:\Windows\System\FKKmcaE.exe
  2⤵
  PID:13888
- C:\Windows\System\AplFUSB.exe
  C:\Windows\System\AplFUSB.exe
  2⤵
  PID:13916
- C:\Windows\System\ZyCTBGF.exe
  C:\Windows\System\ZyCTBGF.exe
  2⤵
  PID:13940
- C:\Windows\System\DEogWWw.exe
  C:\Windows\System\DEogWWw.exe
  2⤵
  PID:14100
- C:\Windows\System\TNVnDQb.exe
  C:\Windows\System\TNVnDQb.exe
  2⤵
  PID:14124
- C:\Windows\System\oLIbxsy.exe
  C:\Windows\System\oLIbxsy.exe
  2⤵
  PID:14308
- C:\Windows\System\KfRCQNO.exe
  C:\Windows\System\KfRCQNO.exe
  2⤵
  PID:14332
- C:\Windows\System\QFYkXul.exe
  C:\Windows\System\QFYkXul.exe
  2⤵
  PID:11216
- C:\Windows\System\vTVHcin.exe
  C:\Windows\System\vTVHcin.exe
  2⤵
  PID:13296
- C:\Windows\System\xikZPzp.exe
  C:\Windows\System\xikZPzp.exe
  2⤵
  PID:9168
- C:\Windows\System\kmMzQkp.exe
  C:\Windows\System\kmMzQkp.exe
  2⤵
  PID:13624
- C:\Windows\System\VIEQrHL.exe
  C:\Windows\System\VIEQrHL.exe
  2⤵
  PID:13512
- C:\Windows\System\XVCWZuC.exe
  C:\Windows\System\XVCWZuC.exe
  2⤵
  PID:13564
- C:\Windows\System\VUVxegX.exe
  C:\Windows\System\VUVxegX.exe
  2⤵
  PID:5096
- C:\Windows\System\tgOVXvF.exe
  C:\Windows\System\tgOVXvF.exe
  2⤵
  PID:13436

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 500 -p 10764 -ip 10764
1⤵
PID:10620

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 528 -p 10532 -ip 10532
1⤵
PID:12892

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 548 -p 7068 -ip 7068
1⤵
PID:13180

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 11732 -ip 11732
1⤵
PID:10368

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:11388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_2ztmxzom.pwn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ztmxzom.pwn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

AFGsQaq.exe

Path C:\Windows\System\AFGsQaq.exe
Size 1.4MB
SHA256 12132743d5451781ab256ace9b48d6a57ebed3559736b88bebef20fdd865e957
MD5 9e2a9a0ebe1f1fb68d04fb7eb0559799
SHA1 230c912925b7536c390fd3d979f8aad69428ab40
SHA512 01c3ddd2664cdd25151ad86911b7b75d49ddc896c27b88b91519363997c113c4af63459fe181c0c7cb86d545fd1c723756119193f8cf417ab3d17fa8cf004a8c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yh1:Lz071uv4BPMkHC0IlnASEx/R+MKVl9A
MD5 SHA1 SHA512 SSDEEP

Submit Download

EFUTcEU.exe

Path C:\Windows\System\EFUTcEU.exe
Size 1.4MB
SHA256 06bdd5e8b9355b8f228b283bd1e2fea924c22aaca1316a0b3a242c7495482e8c
MD5 142e2c01c350021fe026824605e0f7fd
SHA1 ed6a85aa0afe644000886f4e7a348cd34580952c
SHA512 27039050fcaf771bf4a424f404bb167f47db7fec40f5c0c73b46982d506afe88b940bb3e218f598ff6bbedcdb1f9067a73363fe7f22f8ee69a9b1a51e6f0931e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yh2:Lz071uv4BPMkHC0IlnASEx/R+MKVl9V
MD5 SHA1 SHA512 SSDEEP

Submit Download

ELkCIhT.exe

Path C:\Windows\System\ELkCIhT.exe
Size 1.4MB
SHA256 53bd11de3018e9c6ea0be5d54b89c82da9441d0438035ee538bd87c4d73e85ec
MD5 d16ba2be53e61ea31a5637f523559e14
SHA1 b2aa2cfb61377bfb1d465f985448a0b559b93ca5
SHA512 cb7ce165761fdda5bc178f7966480af4fd153694ed619c53dbed54a995726887c468bca7f820f23a4ab56ee429dd0daaf0d73efef1a48f2fca3abd010176cbde
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhq:Lz071uv4BPMkHC0IlnASEx/R+MKVl91
MD5 SHA1 SHA512 SSDEEP

Submit Download

GNhHauR.exe

Path C:\Windows\System\GNhHauR.exe
Size 1.4MB
SHA256 e82159e4c68d273d21d14e5f24009a3c2a4011cf8670283612335cafdd7f5fd3
MD5 7843eab2a41c5ee2f23e7950b7d9f845
SHA1 39611754c92a7babc4e89e35f4cd3bd7a006fd6f
SHA512 8c185881024b2f479bdaaa37083018df8994b081964c74e8ee2adf149f44d0d5934238aac191782fcc4502ac2ef0ddc24e443b214344f540cc8a165be5a4d76b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhQ:Lz071uv4BPMkHC0IlnASEx/R+MKVl91
MD5 SHA1 SHA512 SSDEEP

Submit Download

KzIolJZ.exe

Path C:\Windows\System\KzIolJZ.exe
Size 1.4MB
SHA256 ff27456cc1113bb8b2665ddf87ab316648f2b12107005ed3dc27eb439b5a6bde
MD5 aafe8f38abebf43bdf20369109118b2b
SHA1 9b96469c652d4526bb583c8e88f8f7013085f6a5
SHA512 f9f6ad383fb8bd9aed5482457231ddfc85504354ac307509b880e522ab9dceabde22192d53200a324494440ae5393afc291bdeb5158afa92bbd2a769cdaa54fd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yho:Lz071uv4BPMkHC0IlnASEx/R+MKVl9n
MD5 SHA1 SHA512 SSDEEP

Submit Download

LTJValX.exe

Path C:\Windows\System\LTJValX.exe
Size 1.4MB
SHA256 7fb70a3d175985c4e2d1f4d1fe42a3e56f1ec30bbd6cb661e9a443a345f36bcf
MD5 ef2c95615d78bca3e550689df28a395d
SHA1 e0641bcabdebd53e7955aed6edd27d27b9428f85
SHA512 06f42516d541a5b7a42756454486a1bf5bd155c0c210048f51ee9dc7750db359becb78e06069b952746db20f2b6637d3a5f1631b0fc75001158f53593f7d7f9e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhk:Lz071uv4BPMkHC0IlnASEx/R+MKVl9f
MD5 SHA1 SHA512 SSDEEP

Submit Download

LhdTmqv.exe

Path C:\Windows\System\LhdTmqv.exe
Size 1.4MB
SHA256 aa40a3d9f37479fe893f00dc02fb42114abe102c0ee1c2007266421e2a0f5bd0
MD5 f1a3ad38b4b28ce2594d1a5ebbbe342b
SHA1 3c5be0e02dd88108912d057c306eed2b6d249c92
SHA512 e642f8b6cc9341c09184f19a69b955db70f3263ad8b0675b2357a70e256089f0a23e48f7e7a66ff6c5c8bb356efce4b9b1b0f984fb38989002a5616fc07dfaec
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhM:Lz071uv4BPMkHC0IlnASEx/R+MKVl9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

MaQwqMh.exe

Path C:\Windows\System\MaQwqMh.exe
Size 8B
SHA256 593106c260dc81c57565b84dcf164e3aba348716b31b67ed996f84e8eb33a8f2
MD5 e71397695bfc95ac5fe1d82687725659
SHA1 45272317203fb987b8952f41b0170bd5a78944b0
SHA512 b0a8d0ea3899c2bbb7c006edeeb2ecf2f4894f56db8d8ff247c4e6fc5083c186ab234b2494615de540e99bc5dda8055b1dfec22d34c5a32a9febff889f810e0e
MD5 SHA1 SHA512

Submit Download

MbeTkIn.exe

Path C:\Windows\System\MbeTkIn.exe
Size 1.4MB
SHA256 67eeba6ad9998f6b4d6a4a1a487265a0c1ed3ec865cf45e3f24dcc99596b0f1f
MD5 e027c742c2ec28e2e4fdf4902636fbff
SHA1 0c84b67b539b711600588617fbc6ccb82085bb15
SHA512 658ab25fc1d09660a1c1e41e31fded78057a4cb6d4ea3cf1e35ad903373c6d42d04259ad7b133b0abc807f15406f512a850760f54820fe1a7605c49f7045f04b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhs:Lz071uv4BPMkHC0IlnASEx/R+MKVl9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

MuPnHWv.exe

Path C:\Windows\System\MuPnHWv.exe
Size 1.4MB
SHA256 f959a95e783524a2bc314399d555502b165ec028979ba023e73ec797c33a2509
MD5 b5fb81bcae0520fa61c285e49105b69e
SHA1 a9a026657efc68225a98873ea1644893eda9a107
SHA512 188df03010d44b7a67c71915214c7eea715cb35fad1ae48c7e658768a118d9df28169b7028bf9453c10ad3f445b874278b97a4b0e1aeae7ee0f59e7174a9a7bd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yh3:Lz071uv4BPMkHC0IlnASEx/R+MKVl9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

NdEWMri.exe

Path C:\Windows\System\NdEWMri.exe
Size 1.4MB
SHA256 4e246218fe22694f94adb824af46fdf1856bfd5dc693f336ae10ce3943161a73
MD5 4d458fd1365974c64d1e6ccea06c0a74
SHA1 9a7913ce6300870942f86bb95aef2a860363d178
SHA512 52e7bd637de3e5b158979cdcfb36525d59864e4af528b3f2e23bdc5fbe00647add802b80d6864d7305667d3c935fed7b2eb02ed84d7ab8b9f1b0007ff3ef8d68
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhl:Lz071uv4BPMkHC0IlnASEx/R+MKVl9u
MD5 SHA1 SHA512 SSDEEP

Submit Download

OaCbWoI.exe

Path C:\Windows\System\OaCbWoI.exe
Size 1.4MB
SHA256 0655be5a805f369605f864735a54c5e0508f2a4f546e635cae66dfd8d5603353
MD5 544a260d019f0c46bc5cdeddb079e552
SHA1 f96bb0d25d62ad70403187ee8a8fdfcd796776e9
SHA512 ebb7bb084adb4ee4040fc47824d0e4bbf3ab41ee9c733f37967941a79c58c8e737c8efd7ad7dc989572e8e7d9477edb57982010676fe493066a17cc641868943
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhV:Lz071uv4BPMkHC0IlnASEx/R+MKVl9W
MD5 SHA1 SHA512 SSDEEP

Submit Download

OkIQtEG.exe

Path C:\Windows\System\OkIQtEG.exe
Size 1.4MB
SHA256 eb65bfb887e264df054982ef727549093391229ab63e45c192358b178edd6ed2
MD5 e2fd83b24ad9bf6081721b57948176b4
SHA1 60492d318dddd9a423f01dabc88883649cb8f1c8
SHA512 c09fa98dadb255b9f2093ccd34094d3b1b8b0ce92148b1575de0ac01b2b6d88b8f62e5b61888e31b620acc4c2bdf4fa3ae660b1ca5bb6b123a10e8e366d65446
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhA:Lz071uv4BPMkHC0IlnASEx/R+MKVl9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

PHLzefE.exe

Path C:\Windows\System\PHLzefE.exe
Size 1.4MB
SHA256 7ec2d3e93e54b5ca958c68eabd0dd719bb96911e3c63b497580c6d51ab3c3570
MD5 9818c6a13e8b624364e071932b262ce0
SHA1 20f39c8dc614257e1accab39bfdfe5a2713ee14e
SHA512 10c7f13c0b760129ca23098047b3138d0d80b0eafc8241f7da4966c408e743c63f42df8bcfb23addd251a168f9f5f94170170133f7bf17d588218326ccae8be2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhu:Lz071uv4BPMkHC0IlnASEx/R+MKVl97
MD5 SHA1 SHA512 SSDEEP

Submit Download

SFVjoxB.exe

Path C:\Windows\System\SFVjoxB.exe
Size 1.4MB
SHA256 9158a83a1feb5128561ff90badb3def6a3d891a766f69e0b97f94216f3248602
MD5 34b01a8b1c7c99b1d225d0a454ca7020
SHA1 47d2e3a593a8c67ee217a46ca77c71f31b012164
SHA512 e45548f3026e5a51f0b288e24999cf2de756f8284e9172698cc2ac34f48d732377a23717986fb24c5d26032c814ed0e47ae85f59aa997383c698b0b6b37ee485
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhr:Lz071uv4BPMkHC0IlnASEx/R+MKVl9A
MD5 SHA1 SHA512 SSDEEP

Submit Download

SVyjLRR.exe

Path C:\Windows\System\SVyjLRR.exe
Size 1.4MB
SHA256 595a412481b741f83b0488d2740eb1bfca1be86da11a66605f79408de9bd1d1b
MD5 f5f4093168725e8eab1ef0af26244a62
SHA1 6a27dd5a3e61d821fce80e0b217ca27158774608
SHA512 11e333cec4bc0c58e7eb49cd247b626645342fe76914f27545d8f18f18c3a35d5f8a52a9982440c6fc98cd2d6a6fcb288ac2bb781c1944b3bdf68bdca838b305
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhB:Lz071uv4BPMkHC0IlnASEx/R+MKVl9+
MD5 SHA1 SHA512 SSDEEP

Submit Download

VXxkyzH.exe

Path C:\Windows\System\VXxkyzH.exe
Size 1.4MB
SHA256 6acaacc84f989c08ac02c26f1db343ef5013f5e5114318a471b1cc12999c763a
MD5 d6e2f6b3d32a66c772f8256b5deb0e81
SHA1 545b2caa4a4e5406ac15265a1c73514e1c038749
SHA512 d48fc4c24ab128e22ba87050a3a5b78ffb7ae6f1d431ce0a6946bb69121b6c3161daa17fa99a939cc7c05e909f909a8050087e20c8067c805eb013dc147fe8ab
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhW:Lz071uv4BPMkHC0IlnASEx/R+MKVl9f
MD5 SHA1 SHA512 SSDEEP

Submit Download

WEpWlzB.exe

Path C:\Windows\System\WEpWlzB.exe
Size 1.4MB
SHA256 3c055a414abd7ba14bc4cfdb766612c80c04762428dc4a68dff40431b2692b7a
MD5 174bc24eeaf67a894744897764bad4d2
SHA1 35538e0b93fc8e5b8fb03d8d02f3fc2d47142475
SHA512 4e880b55438dda10d10d57c021a6706ac8600dfcd6c126bbc71e1dddf4aa9c1ca10f061f1ee82234b0fe5399faafff8a64879dd4edb709c4a0b4f4c14bcffa4e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhc:Lz071uv4BPMkHC0IlnASEx/R+MKVl9N
MD5 SHA1 SHA512 SSDEEP

Submit Download

WltyUnB.exe

Path C:\Windows\System\WltyUnB.exe
Size 1.4MB
SHA256 c028b093d9e51582849ad8e8e203e86cfdce405776a811a3096007667e4a15ca
MD5 6a2a9ec8a6060568623160ed8d77307d
SHA1 291eac9099103c5a866ffb9b53dd385e3fbe2d41
SHA512 85353ec25ce32e9afb777fd90a30f6777e8d73871e1e68b8699c0146d1a13180331d346cd4d2ea587d226daf0476eab556695f0ef48c36ae1cfe85c8839ff720
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhG:Lz071uv4BPMkHC0IlnASEx/R+MKVl99
MD5 SHA1 SHA512 SSDEEP

Submit Download

XiMvkxv.exe

Path C:\Windows\System\XiMvkxv.exe
Size 1.4MB
SHA256 aff354f6ca2c0de64561dbfe173201d2a0952c6e07911ccb23d424c33342cd19
MD5 d302244355a83b74a1c2265fb5293ef1
SHA1 6c2ef85a1ff57a01ee890a18f12d65274af771c6
SHA512 d386dd211185bb25be4e3d003a3da38d7d0612e3dcdd5f6477b3fe2de291ab8a0e67ccd337f84415b2785fb2bed74c188c9c563b4974d3f08836a72afed479f2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhg:Lz071uv4BPMkHC0IlnASEx/R+MKVl9b
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZEyhqhA.exe

Path C:\Windows\System\ZEyhqhA.exe
Size 1.4MB
SHA256 3933a41dcf1d467a95438a06e1f7dcc98a33c97fe8a128705d3dca389d6b1462
MD5 c7466a66c9c155a9b3b53606aa55166e
SHA1 a8c33480a216b4e5d3801279380e03ac8792b884
SHA512 78cea58408d5dc1564023a288097da1a48a55dfcee3262791293478f24c9f6c4c01339f7f136cbb244ae9c15d326110d8b4711e303430daecb34b886ff75b74a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhh:Lz071uv4BPMkHC0IlnASEx/R+MKVl9Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZTuNqCb.exe

Path C:\Windows\System\ZTuNqCb.exe
Size 1.4MB
SHA256 143b6ad59624293ec9a35ad3f3760171e42576f262c2a65e6512171c0a6db3dd
MD5 f11b7af9f6a9dbe291a0c0ff7908e6d2
SHA1 0f542350d6651618749e98c2fed9669713977ba1
SHA512 94a27c5dcf15a5fdca1946ee96d376fb0f595fa4501c6595fc9e95a0ca1bcd22833c60c4ead224499f5a8822bbaf64a4a96ea5f962264670f5baad82205d95b0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhk:Lz071uv4BPMkHC0IlnASEx/R+MKVl9Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

bzGmWTq.exe

Path C:\Windows\System\bzGmWTq.exe
Size 1.4MB
SHA256 92e93e75e57f5e2f1663ecefffeb12026d972db72563adc0eddecb7255d6959a
MD5 b859c8738c9175d235dc0c293fe515da
SHA1 1a0d61a9fc53bd5a224ac2241db70e3da42901f9
SHA512 ae2bce40f95440b26cce6357a8bb93866dbaa60d3bbf6dd860e2f24b2ad1ea4fd0827bfe0e60a28346a9b55f7f0c01db8eb89baca95550dc8a9d21e3ad1cada9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhf:Lz071uv4BPMkHC0IlnASEx/R+MKVl9e
MD5 SHA1 SHA512 SSDEEP

Submit Download

cACdonv.exe

Path C:\Windows\System\cACdonv.exe
Size 1.4MB
SHA256 ec1fd45717333b8d0e1e1b8d0bfd287dd8da68b69c5e2cb9587110a025776100
MD5 9f748e219bd0799c1e63d1b09a67105f
SHA1 5ba47c75860add8b76b65b6baaf1d57414c9ccab
SHA512 eb5af8020d2350c030441d0dfc6ea3515941da2964f6f4a0bae4c2b74602750f7b72071fee1af17936e471b6dffda81f38c7ab8953bc12c8478a2ef9ed4e19e9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhz:Lz071uv4BPMkHC0IlnASEx/R+MKVl9+F
MD5 SHA1 SHA512 SSDEEP

Submit Download

cYOMHNH.exe

Path C:\Windows\System\cYOMHNH.exe
Size 1.4MB
SHA256 2636f03c43e2b0c0776d85e335db59efdd19c8e5e069ce119f5981cb904df055
MD5 099d4424d9fa33353f15f146c41e4c6e
SHA1 240e18d7f05caf271410549d5d8dccf7e484bc37
SHA512 1aa1655af1c93a84165fba4b9d1e52064fa014557127cf0dd46b9a6db82b3ed047d4d9ba6b443aceb0bc4907ac7b6692159dc0c385e137b6a34826f2724fa26c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhJ:Lz071uv4BPMkHC0IlnASEx/R+MKVl9w
MD5 SHA1 SHA512 SSDEEP

Submit Download

dHBNyiJ.exe

Path C:\Windows\System\dHBNyiJ.exe
Size 1.4MB
SHA256 a6abf60aefc0946b1e8ea669c0c2b353d16208df276c579544369f9f63c0ad7d
MD5 f84f79694a05a5ab7e718e675eb0758c
SHA1 98ce293ec156a0cc5eaba9177699440c5e2370e4
SHA512 49f5ebad52289ea5a0e799dcc4d3aabdc70e077c96c2e1f63c72c4530b33679a180bdb6bb15333c10a88b2169b7d7c352c2b3bd29555e8a8ebd56d17b92491c9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhE:Lz071uv4BPMkHC0IlnASEx/R+MKVl9F
MD5 SHA1 SHA512 SSDEEP

Submit Download

dhyCUCh.exe

Path C:\Windows\System\dhyCUCh.exe
Size 1.4MB
SHA256 0bf0b4669f7c55a0aaf130458f6287328f4384410e6bbdacabc5d5d505e0bec4
MD5 af5d42e2b9eb16e5a072eb3256178b59
SHA1 769f170f85bc38f5995ef2f74f93a1fd7140668b
SHA512 5f48f647a10de6b4a652dbbe5c5977816e7409b564a50ac2ecfee25822be2f8221eb946825c2f5f2eecc924c560515cff9c56c28998e9a3c98be3994742cc811
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yh5:Lz071uv4BPMkHC0IlnASEx/R+MKVl92
MD5 SHA1 SHA512 SSDEEP

Submit Download

fhZwLpY.exe

Path C:\Windows\System\fhZwLpY.exe
Size 1.4MB
SHA256 f2879c60ca7cb29a00b2a59667bbc072af11753363d3a50c68de9c52bfc212c4
MD5 616f4b5a7333eae90253d5291ab0525a
SHA1 2fd939a83e44762a2b45e75f59bde67d2f81bd7c
SHA512 95027a21fd806634981feaa14f497226dce6b8baf93a6bc4da9a17576507c306b064958494704949e98b9dabb99a0f9fdaa9015597d93f1d9143724647a2cf7d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhy:Lz071uv4BPMkHC0IlnASEx/R+MKVl9r
MD5 SHA1 SHA512 SSDEEP

Submit Download

hdCNTXd.exe

Path C:\Windows\System\hdCNTXd.exe
Size 1.4MB
SHA256 e3a7bfcd0091f548fd717eac271d8c6e2ce71a6998f0f739ea96222fa4a5edfd
MD5 4b73efb74070c3df14fef47172ed6a8f
SHA1 ee3b2faf64e1f79322a2fa8f62c9f7d3efea8afb
SHA512 6ba834683272e5b81371dd8ece34cc4fa11ca28380579ee1a55291e9864357719a84833ba96648577f300c66bd7e20c397938cdb28236cc0edd38d2f14bf903d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yh1:Lz071uv4BPMkHC0IlnASEx/R+MKVl98
MD5 SHA1 SHA512 SSDEEP

Submit Download

hrEoTZT.exe

Path C:\Windows\System\hrEoTZT.exe
Size 1.4MB
SHA256 bb3ae689e727ca5dc4532422ebba7d4fa74c52fcdc97754edc54aa7ea5a7c745
MD5 34985d6af535d1efce760474ac3e6203
SHA1 3abcfd59071c12223aac669fad9a5bb1485046d8
SHA512 4cd27527b3ddd9f0f4a66b4013af9ae0a05e8e7187dbba778618e85916c4e1ad9f73b35aff0795f6f1f966e10c9ca39d67e76f081558d9218cefd15284fe9968
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhC:Lz071uv4BPMkHC0IlnASEx/R+MKVl95
MD5 SHA1 SHA512 SSDEEP

Submit Download

oDojKwS.exe

Path C:\Windows\System\oDojKwS.exe
Size 1.4MB
SHA256 ddd38f6fe13ada9192cf843b40f8a5c89149bba7b0011d6f9f4e481b5a5e8b2a
MD5 d8ae9f2e3549424911bc65119355e993
SHA1 e8849c1c5d60d555c880dc7208762dd1ad0d765c
SHA512 be90230dc47a927ba5a7feab3dc6791459af457c38cc634197969377805bcedb482564e25915ad4358f06712d3b6b3df5b0c051496e465f13791cd57edfb15cf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhQ:Lz071uv4BPMkHC0IlnASEx/R+MKVl97
MD5 SHA1 SHA512 SSDEEP

Submit Download

osKITTu.exe

Path C:\Windows\System\osKITTu.exe
Size 1.4MB
SHA256 98c4cdcd269825e82a00a8cd3f1b582b2e5e51444ab91e44baea03355b31cb68
MD5 dd837ab36f9cf75eedef056be89be491
SHA1 a2168a2a05d5214194879ada906199aa21d51597
SHA512 068e7abccf76e9ded178b00e36d8ce0ce3b30de03b16eb05c0b6a01a87a9bb033488a05b9386b89650dee71b14f6e348074dd0fb88c7019f4df077d28497d3a6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhg:Lz071uv4BPMkHC0IlnASEx/R+MKVl95
MD5 SHA1 SHA512 SSDEEP

Submit Download

rMtsLex.exe

Path C:\Windows\System\rMtsLex.exe
Size 1.4MB
SHA256 a312e29f5e8fa45e75c2d6364ea0490059ab97b7ca21c5ea5114a6a8377a6702
MD5 9341aff84f1640d3e524c82d5486a166
SHA1 7b839d04fc47f9d092201abbff5977d030762dbe
SHA512 eca2374a1782aaacbd05f40f5b16200610666d7d1ad4905655d6776b40b071bf63d1aa613556bd4adf1de4b033434ec7c14634e1790dcb5a2665c5741483fafd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhO:Lz071uv4BPMkHC0IlnASEx/R+MKVl9L
MD5 SHA1 SHA512 SSDEEP

Submit Download

sfDgScq.exe

Path C:\Windows\System\sfDgScq.exe
Size 1.4MB
SHA256 7fbcdcc6b6e21fdb62bedddd1578fb05e82a82ada4cb0bea4504c18605c0c202
MD5 bedd5fd4dccbcfcaa485555544a5c5f4
SHA1 619c32d7960a202c2928b759845dd00dbd0fd334
SHA512 43f4c90d36c317fb75a9bc900f97d2aa3d1b1b8e96e6d9a512c075d761116e174c6f5fe1768053b3bc4b76789f4c62e58118b30ca81c3357db6a59f98600bd12
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhG:Lz071uv4BPMkHC0IlnASEx/R+MKVl9Lt
MD5 SHA1 SHA512 SSDEEP

Submit Download

thWrkIQ.exe

Path C:\Windows\System\thWrkIQ.exe
Size 1.4MB
SHA256 d2d14f82b20d3de8b425a21b312ce5bb1f801a5f66cb9e64ac0f1cab8790a573
MD5 12f336452e5269c602f1700b386daf51
SHA1 0832bf683603f6d76b4eb456b3b2b30eb2fa225c
SHA512 bc0086544149ced7b6075b213e1b16c88b692f3cf373e9fe6f24c39bb6df4bd0a72c778f7cd3a03c3637979af6ecf22e6016c5a0bc1d3a24986c38533994fe15
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhd:Lz071uv4BPMkHC0IlnASEx/R+MKVl9c
MD5 SHA1 SHA512 SSDEEP

Submit Download

uVghJRK.exe

Path C:\Windows\System\uVghJRK.exe
Size 1.4MB
SHA256 878b0ff7110954b8dfa2d41810884014dff0831328609fadb242d21c6d00a54d
MD5 077f7c4ab09b4120168b17df39034f81
SHA1 4d80ca1ba33c0e5c208886b078a61ec1f4563afc
SHA512 09817a0681db2ce88dc03b30fd61e89877eab2fce596293d55325b40fdceb3de550df717ec797ac74005105fb98677e84aef67493ecbaa4e92ec556b46a75999
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhd:Lz071uv4BPMkHC0IlnASEx/R+MKVl9m
MD5 SHA1 SHA512 SSDEEP

Submit Download

wLoWpEA.exe

Path C:\Windows\System\wLoWpEA.exe
Size 1.4MB
SHA256 a5104704bd5bbd4c3be91d79f0a58474490e4781efdce6c513963f64d470d15d
MD5 bbab0d637d1a46448adcd3462b7a77a3
SHA1 2f975cf8cded2beb2f990b52199f6daa360ba4b5
SHA512 91b505c9397077430ce85e392bd422f90557ae75cefef18bd3c0b3aea22b2f1bc8f22dae9c55e8046ef50504880da9409a643a36086a624da81dff85ba460afb
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhI:Lz071uv4BPMkHC0IlnASEx/R+MKVl9B
MD5 SHA1 SHA512 SSDEEP

Submit Download

yaTBLZB.exe

Path C:\Windows\System\yaTBLZB.exe
Size 1.4MB
SHA256 8909eeb9c4262dea01d78d354f0c9b20a17c5726b27e1ab120815857fb206ffa
MD5 a81fc94d2231e182f36ec92384c88867
SHA1 38b954f79965e26dee152c0fc3adffc96a84a41c
SHA512 54e0ad21d9135f964b8032a02d9470c6cdacbaec007c5a178fdd189b223338142cd07eb28c877dd1920bc53130e0bf6fd63ccc2498abf224756756f0c5c6a290
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yht:Lz071uv4BPMkHC0IlnASEx/R+MKVl9o
MD5 SHA1 SHA512 SSDEEP

Submit Download

znvSdnP.exe

Path C:\Windows\System\znvSdnP.exe
Size 1.4MB
SHA256 aa21931c228da9d3a0ce3bac94a12b54eab56743176bb8c986e9c056fc55977c
MD5 cb98e8d6fea754917d34f64144aa1bff
SHA1 f19ee3baeb38e511545691fdc82245ec35648e22
SHA512 d4a02995388f99f7ce46426d34692814dd76e4408da5390f65827a684482682356c42ec7bd4699016a51662bd7d317b99f93063e04f34b108a3dd765d4f48233
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yh8:Lz071uv4BPMkHC0IlnASEx/R+MKVl9T
MD5 SHA1 SHA512 SSDEEP

Submit Download

zpFbUon.exe

Path C:\Windows\System\zpFbUon.exe
Size 1.4MB
SHA256 9dc1abbaaa7e14038e436d9d31d285ff164efa16ef6397e581bb9d456a3b359e
MD5 56d9000aee6cec2dadd190d03b52d506
SHA1 98c2f2e222494157b308ffdcecea4d52b2b688bd
SHA512 ee640154f51e81ff821d8ebfc4c0b49392866c92a7bfc518711461b2b573f8e22af24b09b5d40b7c29174459de162573d9383049403645ba3017591e7f5f0281
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRRWWlvIkcVcZS9yhX:Lz071uv4BPMkHC0IlnASEx/R+MKVl9c
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/840-5406-0x00007FF766DD0000-0x00007FF7671C2000-memory.dmp

Download

memory/840-630-0x00007FF766DD0000-0x00007FF7671C2000-memory.dmp

Download

memory/972-5325-0x00007FF7C45C0000-0x00007FF7C49B2000-memory.dmp

Download

memory/972-219-0x00007FF7C45C0000-0x00007FF7C49B2000-memory.dmp

Download

memory/1296-626-0x00007FF7EC7C0000-0x00007FF7ECBB2000-memory.dmp

Download

memory/1296-5346-0x00007FF7EC7C0000-0x00007FF7ECBB2000-memory.dmp

Download

memory/1748-5334-0x00007FF73AB30000-0x00007FF73AF22000-memory.dmp

Download

memory/1748-619-0x00007FF73AB30000-0x00007FF73AF22000-memory.dmp

Download

memory/1752-629-0x00007FF633040000-0x00007FF633432000-memory.dmp

Download

memory/1752-5361-0x00007FF633040000-0x00007FF633432000-memory.dmp

Download

memory/1916-627-0x00007FF69A830000-0x00007FF69AC22000-memory.dmp

Download

memory/1916-5372-0x00007FF69A830000-0x00007FF69AC22000-memory.dmp

Download

memory/1928-5315-0x00007FF73BF30000-0x00007FF73C322000-memory.dmp

Download

memory/1928-23-0x00007FF73BF30000-0x00007FF73C322000-memory.dmp

Download

memory/1988-624-0x00007FF611C70000-0x00007FF612062000-memory.dmp

Download

memory/1988-5359-0x00007FF611C70000-0x00007FF612062000-memory.dmp

Download

memory/2004-409-0x00007FF7E8760000-0x00007FF7E8B52000-memory.dmp

Download

memory/2004-5333-0x00007FF7E8760000-0x00007FF7E8B52000-memory.dmp

Download

memory/2112-621-0x00007FF6F6CC0000-0x00007FF6F70B2000-memory.dmp

Download

memory/2112-5331-0x00007FF6F6CC0000-0x00007FF6F70B2000-memory.dmp

Download

memory/2148-5329-0x00007FF676F90000-0x00007FF677382000-memory.dmp

Download

memory/2148-625-0x00007FF676F90000-0x00007FF677382000-memory.dmp

Download

memory/2184-5366-0x00007FF639BA0000-0x00007FF639F92000-memory.dmp

Download

memory/2184-631-0x00007FF639BA0000-0x00007FF639F92000-memory.dmp

Download

memory/2564-332-0x00007FF75C440000-0x00007FF75C832000-memory.dmp

Download

memory/2564-5344-0x00007FF75C440000-0x00007FF75C832000-memory.dmp

Download

memory/2856-177-0x00007FF7782D0000-0x00007FF7786C2000-memory.dmp

Download

memory/2856-5317-0x00007FF7782D0000-0x00007FF7786C2000-memory.dmp

Download

memory/3020-5352-0x00007FF6EFBD0000-0x00007FF6EFFC2000-memory.dmp

Download

memory/3020-633-0x00007FF6EFBD0000-0x00007FF6EFFC2000-memory.dmp

Download

memory/3240-634-0x00007FF7155A0000-0x00007FF715992000-memory.dmp

Download

memory/3240-5350-0x00007FF7155A0000-0x00007FF715992000-memory.dmp

Download

memory/4168-934-0x00007FF6A2790000-0x00007FF6A2B82000-memory.dmp

Download

memory/4168-5324-0x00007FF6A2790000-0x00007FF6A2B82000-memory.dmp

Download

memory/4184-443-0x0000029DD0160000-0x0000029DD0182000-memory.dmp

Download

memory/4184-26-0x00007FF8EDF53000-0x00007FF8EDF55000-memory.dmp

Download

memory/4184-139-0x00007FF8EDF50000-0x00007FF8EEA11000-memory.dmp

Download

memory/4184-616-0x00007FF8EDF50000-0x00007FF8EEA11000-memory.dmp

Download

memory/4224-632-0x00007FF702B30000-0x00007FF702F22000-memory.dmp

Download

memory/4224-5348-0x00007FF702B30000-0x00007FF702F22000-memory.dmp

Download

memory/4488-5338-0x00007FF632CA0000-0x00007FF633092000-memory.dmp

Download

memory/4488-622-0x00007FF632CA0000-0x00007FF633092000-memory.dmp

Download

memory/4532-804-0x00007FF7EEFF0000-0x00007FF7EF3E2000-memory.dmp

Download

memory/4532-5319-0x00007FF7EEFF0000-0x00007FF7EF3E2000-memory.dmp

Download

memory/4552-5313-0x00007FF7F1030000-0x00007FF7F1422000-memory.dmp

Download

memory/4552-0-0x00007FF7F1030000-0x00007FF7F1422000-memory.dmp

Download

memory/4552-1-0x000001B35F230000-0x000001B35F240000-memory.dmp

Download

memory/4644-5321-0x00007FF71B240000-0x00007FF71B632000-memory.dmp

Download

memory/4644-271-0x00007FF71B240000-0x00007FF71B632000-memory.dmp

Download

memory/4676-5343-0x00007FF7A2740000-0x00007FF7A2B32000-memory.dmp

Download

memory/4676-623-0x00007FF7A2740000-0x00007FF7A2B32000-memory.dmp

Download

memory/4712-5340-0x00007FF75D6E0000-0x00007FF75DAD2000-memory.dmp

Download

memory/4712-620-0x00007FF75D6E0000-0x00007FF75DAD2000-memory.dmp

Download

memory/4764-5337-0x00007FF76B940000-0x00007FF76BD32000-memory.dmp

Download

memory/4764-628-0x00007FF76B940000-0x00007FF76BD32000-memory.dmp

Download