xmrig | 8404b2fc0f6ee7f2f0e9e2602be3c6d2b0370249213cfe3b6b203792d7fbc7e4

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 14:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
Size 1.8MB
Sample240607-r6jx2aah76
SHA256 8404b2fc0f6ee7f2f0e9e2602be3c6d2b0370249213cfe3b6b203792d7fbc7e4
MD5 ada6ccdbb9cad2170da870f745463560
SHA1 5300d0a914d19b3981a6abedf680d366bd953a52
SHA512 02cfc269d24c88f43df4a209e2d414c5294f34f559bde8d9b79c7b387a51a7e3f1e25470639bc93e92593fd1bd66f6bd6c86b706e30d703c11ce5a63514b4c6e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1r:Lz071uv4BPMkFfdg6NsIRSwV7V
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/2868-452-0x00007FF62A420000-0x00007FF62A812000-memory.dmp	xmrig
behavioral2/memory/4008-552-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp	xmrig
behavioral2/memory/1660-554-0x00007FF698AA0000-0x00007FF698E92000-memory.dmp	xmrig
behavioral2/memory/2360-557-0x00007FF69DDF0000-0x00007FF69E1E2000-memory.dmp	xmrig
behavioral2/memory/4928-560-0x00007FF7B0A80000-0x00007FF7B0E72000-memory.dmp	xmrig
behavioral2/memory/1820-2247-0x00007FF6CDA50000-0x00007FF6CDE42000-memory.dmp	xmrig
behavioral2/memory/1004-566-0x00007FF614EB0000-0x00007FF6152A2000-memory.dmp	xmrig
behavioral2/memory/2708-565-0x00007FF7441B0000-0x00007FF7445A2000-memory.dmp	xmrig
behavioral2/memory/960-564-0x00007FF75B520000-0x00007FF75B912000-memory.dmp	xmrig
behavioral2/memory/1412-563-0x00007FF755570000-0x00007FF755962000-memory.dmp	xmrig
behavioral2/memory/4828-562-0x00007FF6ECA20000-0x00007FF6ECE12000-memory.dmp	xmrig
behavioral2/memory/4888-561-0x00007FF644F00000-0x00007FF6452F2000-memory.dmp	xmrig
behavioral2/memory/2728-559-0x00007FF74A5A0000-0x00007FF74A992000-memory.dmp	xmrig
behavioral2/memory/2740-558-0x00007FF6398E0000-0x00007FF639CD2000-memory.dmp	xmrig
behavioral2/memory/4336-556-0x00007FF6D1D20000-0x00007FF6D2112000-memory.dmp	xmrig
behavioral2/memory/3392-555-0x00007FF7CE820000-0x00007FF7CEC12000-memory.dmp	xmrig
behavioral2/memory/4844-553-0x00007FF75A650000-0x00007FF75AA42000-memory.dmp	xmrig
behavioral2/memory/2512-545-0x00007FF7E1360000-0x00007FF7E1752000-memory.dmp	xmrig
behavioral2/memory/1652-409-0x00007FF7289B0000-0x00007FF728DA2000-memory.dmp	xmrig
behavioral2/memory/1476-407-0x00007FF637EF0000-0x00007FF6382E2000-memory.dmp	xmrig
behavioral2/memory/3124-406-0x00007FF6EF1A0000-0x00007FF6EF592000-memory.dmp	xmrig
behavioral2/memory/2548-383-0x00007FF68F8B0000-0x00007FF68FCA2000-memory.dmp	xmrig
behavioral2/memory/1976-284-0x00007FF700800000-0x00007FF700BF2000-memory.dmp	xmrig
behavioral2/memory/3880-103-0x00007FF76C7D0000-0x00007FF76CBC2000-memory.dmp	xmrig
behavioral2/memory/4344-2359-0x00007FF640F70000-0x00007FF641362000-memory.dmp	xmrig
behavioral2/memory/4344-2369-0x00007FF640F70000-0x00007FF641362000-memory.dmp	xmrig
behavioral2/memory/3880-2371-0x00007FF76C7D0000-0x00007FF76CBC2000-memory.dmp	xmrig
behavioral2/memory/2708-2373-0x00007FF7441B0000-0x00007FF7445A2000-memory.dmp	xmrig
behavioral2/memory/1976-2377-0x00007FF700800000-0x00007FF700BF2000-memory.dmp	xmrig
behavioral2/memory/1476-2375-0x00007FF637EF0000-0x00007FF6382E2000-memory.dmp	xmrig
behavioral2/memory/3124-2381-0x00007FF6EF1A0000-0x00007FF6EF592000-memory.dmp	xmrig
behavioral2/memory/960-2379-0x00007FF75B520000-0x00007FF75B912000-memory.dmp	xmrig
behavioral2/memory/4928-2385-0x00007FF7B0A80000-0x00007FF7B0E72000-memory.dmp	xmrig
behavioral2/memory/1652-2383-0x00007FF7289B0000-0x00007FF728DA2000-memory.dmp	xmrig
behavioral2/memory/2512-2389-0x00007FF7E1360000-0x00007FF7E1752000-memory.dmp	xmrig
behavioral2/memory/4008-2391-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp	xmrig
behavioral2/memory/4844-2393-0x00007FF75A650000-0x00007FF75AA42000-memory.dmp	xmrig
behavioral2/memory/1660-2395-0x00007FF698AA0000-0x00007FF698E92000-memory.dmp	xmrig
behavioral2/memory/2548-2387-0x00007FF68F8B0000-0x00007FF68FCA2000-memory.dmp	xmrig
behavioral2/memory/4336-2402-0x00007FF6D1D20000-0x00007FF6D2112000-memory.dmp	xmrig
behavioral2/memory/3392-2404-0x00007FF7CE820000-0x00007FF7CEC12000-memory.dmp	xmrig
behavioral2/memory/2360-2400-0x00007FF69DDF0000-0x00007FF69E1E2000-memory.dmp	xmrig
behavioral2/memory/1004-2406-0x00007FF614EB0000-0x00007FF6152A2000-memory.dmp	xmrig
behavioral2/memory/4888-2408-0x00007FF644F00000-0x00007FF6452F2000-memory.dmp	xmrig
behavioral2/memory/2740-2414-0x00007FF6398E0000-0x00007FF639CD2000-memory.dmp	xmrig
behavioral2/memory/2728-2416-0x00007FF74A5A0000-0x00007FF74A992000-memory.dmp	xmrig
behavioral2/memory/4828-2410-0x00007FF6ECA20000-0x00007FF6ECE12000-memory.dmp	xmrig
behavioral2/memory/2868-2397-0x00007FF62A420000-0x00007FF62A812000-memory.dmp	xmrig
behavioral2/memory/1412-2420-0x00007FF755570000-0x00007FF755962000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	3300	powershell.exe
11	3300	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3300	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4344	UeVNwVL.exe
960	uPqpMnD.exe
3880	HsovFTa.exe
2708	KuBshiA.exe
1976	ZGYhLfG.exe
2548	MWtRpaK.exe
3124	qzlJVHv.exe
1476	NzBezyq.exe
1652	tMyHFHt.exe
2868	nMzRTKe.exe
2512	FJSFStS.exe
4008	cRJdLvB.exe
4844	TJlhCHG.exe
1660	gCgBoqN.exe
3392	CfHNuOw.exe
4336	ZlPTmAk.exe
2360	QnKroZN.exe
2740	BRTfEHn.exe
2728	HyZFEPA.exe
4928	EMLBhqP.exe
1004	bDeJfpj.exe
4888	XQeJoHr.exe
4828	LNkbWiC.exe
1412	pueMwNs.exe
5072	zkdoqDm.exe
4348	sgUdcub.exe
4208	uJdxKAv.exe
3120	oontZLu.exe
4172	ZVmvTdu.exe
2008	KkuuRQW.exe
4848	NwspqEo.exe
3508	LmnVuoo.exe
3444	LdOexgv.exe
1428	qtAkwde.exe
3564	klcHRBf.exe
1048	jhrsRUi.exe
3896	WKsULmJ.exe
972	JmbqmNo.exe
5116	pbYAXSc.exe
2256	IPVjpPe.exe
1008	XUCpQIr.exe
1752	jeDtVeI.exe
2372	lDYTCAT.exe
3320	lBOqXqn.exe
3944	dfLrWYv.exe
4936	uyfKZdB.exe
636	eQNNRVR.exe
3652	fRnAPNS.exe
2872	PckODhi.exe
3308	eObcpIk.exe
4788	BLxzwDs.exe
2596	OHPRnzA.exe
3640	PgBvBEJ.exe
1852	KWaiMvK.exe
4728	cdMbMLR.exe
2460	JoYbGhm.exe
3352	HzzFdBS.exe
3628	crlukLE.exe
1452	xCxltXf.exe
4464	HUzeGQG.exe
5056	lGVJCrr.exe
4516	qOhWuDN.exe
5076	YeyawxZ.exe
640	mZOyhrM.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1820-0-0x00007FF6CDA50000-0x00007FF6CDE42000-memory.dmp	upx
behavioral2/files/0x0007000000023433-7.dat	upx
behavioral2/files/0x0009000000023431-5.dat	upx
behavioral2/files/0x000700000002343b-106.dat	upx
behavioral2/files/0x0007000000023459-201.dat	upx
behavioral2/memory/2868-452-0x00007FF62A420000-0x00007FF62A812000-memory.dmp	upx
behavioral2/memory/4008-552-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp	upx
behavioral2/memory/1660-554-0x00007FF698AA0000-0x00007FF698E92000-memory.dmp	upx
behavioral2/memory/2360-557-0x00007FF69DDF0000-0x00007FF69E1E2000-memory.dmp	upx
behavioral2/memory/4928-560-0x00007FF7B0A80000-0x00007FF7B0E72000-memory.dmp	upx
behavioral2/memory/1820-2247-0x00007FF6CDA50000-0x00007FF6CDE42000-memory.dmp	upx
behavioral2/memory/1004-566-0x00007FF614EB0000-0x00007FF6152A2000-memory.dmp	upx
behavioral2/memory/2708-565-0x00007FF7441B0000-0x00007FF7445A2000-memory.dmp	upx
behavioral2/memory/960-564-0x00007FF75B520000-0x00007FF75B912000-memory.dmp	upx
behavioral2/memory/1412-563-0x00007FF755570000-0x00007FF755962000-memory.dmp	upx
behavioral2/memory/4828-562-0x00007FF6ECA20000-0x00007FF6ECE12000-memory.dmp	upx
behavioral2/memory/4888-561-0x00007FF644F00000-0x00007FF6452F2000-memory.dmp	upx
behavioral2/memory/2728-559-0x00007FF74A5A0000-0x00007FF74A992000-memory.dmp	upx
behavioral2/memory/2740-558-0x00007FF6398E0000-0x00007FF639CD2000-memory.dmp	upx
behavioral2/memory/4336-556-0x00007FF6D1D20000-0x00007FF6D2112000-memory.dmp	upx
behavioral2/memory/3392-555-0x00007FF7CE820000-0x00007FF7CEC12000-memory.dmp	upx
behavioral2/memory/4844-553-0x00007FF75A650000-0x00007FF75AA42000-memory.dmp	upx
behavioral2/memory/2512-545-0x00007FF7E1360000-0x00007FF7E1752000-memory.dmp	upx
behavioral2/memory/1652-409-0x00007FF7289B0000-0x00007FF728DA2000-memory.dmp	upx
behavioral2/memory/1476-407-0x00007FF637EF0000-0x00007FF6382E2000-memory.dmp	upx
behavioral2/memory/3124-406-0x00007FF6EF1A0000-0x00007FF6EF592000-memory.dmp	upx
behavioral2/memory/2548-383-0x00007FF68F8B0000-0x00007FF68FCA2000-memory.dmp	upx
behavioral2/memory/1976-284-0x00007FF700800000-0x00007FF700BF2000-memory.dmp	upx
behavioral2/files/0x000700000002345c-208.dat	upx
behavioral2/files/0x000700000002345b-207.dat	upx
behavioral2/files/0x000700000002345a-206.dat	upx
behavioral2/files/0x0007000000023448-202.dat	upx
behavioral2/files/0x0007000000023447-194.dat	upx
behavioral2/files/0x0007000000023458-189.dat	upx
behavioral2/files/0x0007000000023457-188.dat	upx
behavioral2/files/0x000700000002344c-179.dat	upx
behavioral2/files/0x000700000002344a-171.dat	upx
behavioral2/files/0x0007000000023453-170.dat	upx
behavioral2/files/0x0007000000023452-166.dat	upx
behavioral2/files/0x0007000000023441-163.dat	upx
behavioral2/files/0x0007000000023451-161.dat	upx
behavioral2/files/0x0007000000023440-156.dat	upx
behavioral2/files/0x0007000000023450-153.dat	upx
behavioral2/files/0x000700000002344f-150.dat	upx
behavioral2/files/0x000700000002343f-147.dat	upx
behavioral2/files/0x000700000002344e-140.dat	upx
behavioral2/files/0x000700000002343a-135.dat	upx
behavioral2/files/0x0007000000023455-176.dat	upx
behavioral2/files/0x000700000002344b-132.dat	upx
behavioral2/files/0x0007000000023445-131.dat	upx
behavioral2/files/0x0007000000023443-128.dat	upx
behavioral2/files/0x000700000002343d-115.dat	upx
behavioral2/files/0x000700000002343c-112.dat	upx
behavioral2/files/0x0007000000023449-111.dat	upx
behavioral2/memory/3880-103-0x00007FF76C7D0000-0x00007FF76CBC2000-memory.dmp	upx
behavioral2/files/0x000700000002344d-137.dat	upx
behavioral2/files/0x0007000000023446-95.dat	upx
behavioral2/files/0x0007000000023439-92.dat	upx
behavioral2/files/0x000700000002343e-119.dat	upx
behavioral2/files/0x0007000000023436-79.dat	upx
behavioral2/files/0x0007000000023444-91.dat	upx
behavioral2/files/0x0007000000023442-88.dat	upx
behavioral2/files/0x0007000000023434-59.dat	upx
behavioral2/files/0x0007000000023438-55.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tDQsFTc.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\hBLcNxf.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\iTJjbDj.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\zyQgLEx.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\IKQOmin.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\zLSmcCB.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\PpLrLOC.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\FODmWqU.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\jRgbsPx.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\kDuSofF.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\PznEdAf.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\CLdFOVE.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\yuRribE.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\wPcdGyL.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\bHwImsB.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\mNopTSm.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\uJdxKAv.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\vZFfhya.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\EnquNQm.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\xgoJHbl.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\XNsIoWn.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\QBTcLsH.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\kjdCSRq.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\ApVNqxX.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\JrDKcLk.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\XQeJoHr.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\BfRhAsa.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\cilVhbo.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\juDKcKi.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\oOSZWWo.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\ufhBMrj.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\JYlqyOP.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\YysDnSB.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\neHcvAs.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\uGyZbQv.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\oKbhqIs.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\ImXKTZN.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\gNHiXFN.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\qOhWuDN.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\jbwjaMv.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\VhVGrsO.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\UiFDRPG.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\jRfcGet.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\kzdTdpD.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\QrMIoFw.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\mRYmjbI.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\DZoRvSc.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\KWpKszx.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\AwwKtbV.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\ZVmvTdu.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\GWAEFJF.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\SWSFHim.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\gwiFCpa.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\xtaeRYg.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\uZVuIMt.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\oontZLu.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\XmxlXxS.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\vJOlOgw.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\GdxtSiX.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\dotCLWG.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\FlDNokZ.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\pjCxfab.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\nrGpcYz.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
File created	C:\Windows\System\EyCZHnK.exe	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3300	powershell.exe
3300	powershell.exe
3300	powershell.exe
3300	powershell.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
Token: SeDebugPrivilege	3300	powershell.exe
Token: SeCreateGlobalPrivilege	9704	dwm.exe
Token: SeChangeNotifyPrivilege	9704	dwm.exe
Token: 33	9704	dwm.exe
Token: SeIncBasePriorityPrivilege	9704	dwm.exe
Token: SeShutdownPrivilege	9704	dwm.exe
Token: SeCreatePagefilePrivilege	9704	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 3300	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	82
PID 1820 wrote to memory of 3300	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	82
PID 1820 wrote to memory of 4344	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	83
PID 1820 wrote to memory of 4344	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	83
PID 1820 wrote to memory of 960	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	84
PID 1820 wrote to memory of 960	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	84
PID 1820 wrote to memory of 3880	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	85
PID 1820 wrote to memory of 3880	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	85
PID 1820 wrote to memory of 1976	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	86
PID 1820 wrote to memory of 1976	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	86
PID 1820 wrote to memory of 2708	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	87
PID 1820 wrote to memory of 2708	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	87
PID 1820 wrote to memory of 2548	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	88
PID 1820 wrote to memory of 2548	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	88
PID 1820 wrote to memory of 3124	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	89
PID 1820 wrote to memory of 3124	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	89
PID 1820 wrote to memory of 1476	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	90
PID 1820 wrote to memory of 1476	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	90
PID 1820 wrote to memory of 1652	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	91
PID 1820 wrote to memory of 1652	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	91
PID 1820 wrote to memory of 2868	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	92
PID 1820 wrote to memory of 2868	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	92
PID 1820 wrote to memory of 2512	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	93
PID 1820 wrote to memory of 2512	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	93
PID 1820 wrote to memory of 4008	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	94
PID 1820 wrote to memory of 4008	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	94
PID 1820 wrote to memory of 4844	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	95
PID 1820 wrote to memory of 4844	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	95
PID 1820 wrote to memory of 1660	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	96
PID 1820 wrote to memory of 1660	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	96
PID 1820 wrote to memory of 3392	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	97
PID 1820 wrote to memory of 3392	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	97
PID 1820 wrote to memory of 4336	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	98
PID 1820 wrote to memory of 4336	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	98
PID 1820 wrote to memory of 2360	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	99
PID 1820 wrote to memory of 2360	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	99
PID 1820 wrote to memory of 2740	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	100
PID 1820 wrote to memory of 2740	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	100
PID 1820 wrote to memory of 1412	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	101
PID 1820 wrote to memory of 1412	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	101
PID 1820 wrote to memory of 2728	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	102
PID 1820 wrote to memory of 2728	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	102
PID 1820 wrote to memory of 5072	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	103
PID 1820 wrote to memory of 5072	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	103
PID 1820 wrote to memory of 4928	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	104
PID 1820 wrote to memory of 4928	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	104
PID 1820 wrote to memory of 1004	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	105
PID 1820 wrote to memory of 1004	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	105
PID 1820 wrote to memory of 4888	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	106
PID 1820 wrote to memory of 4888	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	106
PID 1820 wrote to memory of 4828	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	107
PID 1820 wrote to memory of 4828	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	107
PID 1820 wrote to memory of 3564	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	108
PID 1820 wrote to memory of 3564	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	108
PID 1820 wrote to memory of 4348	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	109
PID 1820 wrote to memory of 4348	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	109
PID 1820 wrote to memory of 4208	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	110
PID 1820 wrote to memory of 4208	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	110
PID 1820 wrote to memory of 3120	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	111
PID 1820 wrote to memory of 3120	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	111
PID 1820 wrote to memory of 4172	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	112
PID 1820 wrote to memory of 4172	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	112
PID 1820 wrote to memory of 2008	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	113
PID 1820 wrote to memory of 2008	1820	ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\ada6ccdbb9cad2170da870f745463560_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3300
- C:\Windows\System\UeVNwVL.exe
  C:\Windows\System\UeVNwVL.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\uPqpMnD.exe
  C:\Windows\System\uPqpMnD.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\HsovFTa.exe
  C:\Windows\System\HsovFTa.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\ZGYhLfG.exe
  C:\Windows\System\ZGYhLfG.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\KuBshiA.exe
  C:\Windows\System\KuBshiA.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\MWtRpaK.exe
  C:\Windows\System\MWtRpaK.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\qzlJVHv.exe
  C:\Windows\System\qzlJVHv.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\NzBezyq.exe
  C:\Windows\System\NzBezyq.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\tMyHFHt.exe
  C:\Windows\System\tMyHFHt.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\nMzRTKe.exe
  C:\Windows\System\nMzRTKe.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\FJSFStS.exe
  C:\Windows\System\FJSFStS.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\cRJdLvB.exe
  C:\Windows\System\cRJdLvB.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\TJlhCHG.exe
  C:\Windows\System\TJlhCHG.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\gCgBoqN.exe
  C:\Windows\System\gCgBoqN.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\CfHNuOw.exe
  C:\Windows\System\CfHNuOw.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\ZlPTmAk.exe
  C:\Windows\System\ZlPTmAk.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\QnKroZN.exe
  C:\Windows\System\QnKroZN.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\BRTfEHn.exe
  C:\Windows\System\BRTfEHn.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\pueMwNs.exe
  C:\Windows\System\pueMwNs.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\HyZFEPA.exe
  C:\Windows\System\HyZFEPA.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\zkdoqDm.exe
  C:\Windows\System\zkdoqDm.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\EMLBhqP.exe
  C:\Windows\System\EMLBhqP.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\bDeJfpj.exe
  C:\Windows\System\bDeJfpj.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\XQeJoHr.exe
  C:\Windows\System\XQeJoHr.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\LNkbWiC.exe
  C:\Windows\System\LNkbWiC.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\klcHRBf.exe
  C:\Windows\System\klcHRBf.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\sgUdcub.exe
  C:\Windows\System\sgUdcub.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\uJdxKAv.exe
  C:\Windows\System\uJdxKAv.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\oontZLu.exe
  C:\Windows\System\oontZLu.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\ZVmvTdu.exe
  C:\Windows\System\ZVmvTdu.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\KkuuRQW.exe
  C:\Windows\System\KkuuRQW.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\NwspqEo.exe
  C:\Windows\System\NwspqEo.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\LmnVuoo.exe
  C:\Windows\System\LmnVuoo.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\LdOexgv.exe
  C:\Windows\System\LdOexgv.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\qtAkwde.exe
  C:\Windows\System\qtAkwde.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\eQNNRVR.exe
  C:\Windows\System\eQNNRVR.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\jhrsRUi.exe
  C:\Windows\System\jhrsRUi.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\OHPRnzA.exe
  C:\Windows\System\OHPRnzA.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\WKsULmJ.exe
  C:\Windows\System\WKsULmJ.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\JmbqmNo.exe
  C:\Windows\System\JmbqmNo.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\pbYAXSc.exe
  C:\Windows\System\pbYAXSc.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\IPVjpPe.exe
  C:\Windows\System\IPVjpPe.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\XUCpQIr.exe
  C:\Windows\System\XUCpQIr.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\jeDtVeI.exe
  C:\Windows\System\jeDtVeI.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\lDYTCAT.exe
  C:\Windows\System\lDYTCAT.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\lBOqXqn.exe
  C:\Windows\System\lBOqXqn.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\dfLrWYv.exe
  C:\Windows\System\dfLrWYv.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\uyfKZdB.exe
  C:\Windows\System\uyfKZdB.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\fRnAPNS.exe
  C:\Windows\System\fRnAPNS.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\PckODhi.exe
  C:\Windows\System\PckODhi.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\eObcpIk.exe
  C:\Windows\System\eObcpIk.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\BLxzwDs.exe
  C:\Windows\System\BLxzwDs.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\PgBvBEJ.exe
  C:\Windows\System\PgBvBEJ.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\KWaiMvK.exe
  C:\Windows\System\KWaiMvK.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\mZOyhrM.exe
  C:\Windows\System\mZOyhrM.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\cdMbMLR.exe
  C:\Windows\System\cdMbMLR.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\JoYbGhm.exe
  C:\Windows\System\JoYbGhm.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\HzzFdBS.exe
  C:\Windows\System\HzzFdBS.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\crlukLE.exe
  C:\Windows\System\crlukLE.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\xCxltXf.exe
  C:\Windows\System\xCxltXf.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\HUzeGQG.exe
  C:\Windows\System\HUzeGQG.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\lGVJCrr.exe
  C:\Windows\System\lGVJCrr.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\qOhWuDN.exe
  C:\Windows\System\qOhWuDN.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\YeyawxZ.exe
  C:\Windows\System\YeyawxZ.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\MMfQjVu.exe
  C:\Windows\System\MMfQjVu.exe
  2⤵
  PID:4944
- C:\Windows\System\bvwIzSW.exe
  C:\Windows\System\bvwIzSW.exe
  2⤵
  PID:3236
- C:\Windows\System\DPhzuBk.exe
  C:\Windows\System\DPhzuBk.exe
  2⤵
  PID:3348
- C:\Windows\System\huvoRGm.exe
  C:\Windows\System\huvoRGm.exe
  2⤵
  PID:4276
- C:\Windows\System\nyGhTar.exe
  C:\Windows\System\nyGhTar.exe
  2⤵
  PID:3672
- C:\Windows\System\uYmHEiU.exe
  C:\Windows\System\uYmHEiU.exe
  2⤵
  PID:880
- C:\Windows\System\HxUVbII.exe
  C:\Windows\System\HxUVbII.exe
  2⤵
  PID:2088
- C:\Windows\System\CLdFOVE.exe
  C:\Windows\System\CLdFOVE.exe
  2⤵
  PID:4020
- C:\Windows\System\JgkdZFp.exe
  C:\Windows\System\JgkdZFp.exe
  2⤵
  PID:2952
- C:\Windows\System\ZaKivmx.exe
  C:\Windows\System\ZaKivmx.exe
  2⤵
  PID:1104
- C:\Windows\System\URDaRUS.exe
  C:\Windows\System\URDaRUS.exe
  2⤵
  PID:2132
- C:\Windows\System\OqFjwPd.exe
  C:\Windows\System\OqFjwPd.exe
  2⤵
  PID:1188
- C:\Windows\System\qBBLaiz.exe
  C:\Windows\System\qBBLaiz.exe
  2⤵
  PID:804
- C:\Windows\System\FODmWqU.exe
  C:\Windows\System\FODmWqU.exe
  2⤵
  PID:2572
- C:\Windows\System\FasrDUK.exe
  C:\Windows\System\FasrDUK.exe
  2⤵
  PID:4488
- C:\Windows\System\DwFBNlF.exe
  C:\Windows\System\DwFBNlF.exe
  2⤵
  PID:2316
- C:\Windows\System\DiPOnen.exe
  C:\Windows\System\DiPOnen.exe
  2⤵
  PID:4792
- C:\Windows\System\mNopTSm.exe
  C:\Windows\System\mNopTSm.exe
  2⤵
  PID:5036
- C:\Windows\System\YHIFIDj.exe
  C:\Windows\System\YHIFIDj.exe
  2⤵
  PID:3504
- C:\Windows\System\EWAvJRJ.exe
  C:\Windows\System\EWAvJRJ.exe
  2⤵
  PID:1472
- C:\Windows\System\jYcvLcw.exe
  C:\Windows\System\jYcvLcw.exe
  2⤵
  PID:3032
- C:\Windows\System\ljmwnGh.exe
  C:\Windows\System\ljmwnGh.exe
  2⤵
  PID:1632
- C:\Windows\System\QMJCeMF.exe
  C:\Windows\System\QMJCeMF.exe
  2⤵
  PID:3516
- C:\Windows\System\clZTvYV.exe
  C:\Windows\System\clZTvYV.exe
  2⤵
  PID:5128
- C:\Windows\System\UchaLpL.exe
  C:\Windows\System\UchaLpL.exe
  2⤵
  PID:5144
- C:\Windows\System\bUwbylz.exe
  C:\Windows\System\bUwbylz.exe
  2⤵
  PID:5188
- C:\Windows\System\gyhKBYg.exe
  C:\Windows\System\gyhKBYg.exe
  2⤵
  PID:5208
- C:\Windows\System\AlENkSr.exe
  C:\Windows\System\AlENkSr.exe
  2⤵
  PID:5236
- C:\Windows\System\bFmhNly.exe
  C:\Windows\System\bFmhNly.exe
  2⤵
  PID:5252
- C:\Windows\System\OrltXLW.exe
  C:\Windows\System\OrltXLW.exe
  2⤵
  PID:5268
- C:\Windows\System\AtComWX.exe
  C:\Windows\System\AtComWX.exe
  2⤵
  PID:5284
- C:\Windows\System\tDQsFTc.exe
  C:\Windows\System\tDQsFTc.exe
  2⤵
  PID:5308
- C:\Windows\System\HhtuXWi.exe
  C:\Windows\System\HhtuXWi.exe
  2⤵
  PID:5336
- C:\Windows\System\CUjkDDo.exe
  C:\Windows\System\CUjkDDo.exe
  2⤵
  PID:5360
- C:\Windows\System\MHJMkeg.exe
  C:\Windows\System\MHJMkeg.exe
  2⤵
  PID:5392
- C:\Windows\System\PVvqhzu.exe
  C:\Windows\System\PVvqhzu.exe
  2⤵
  PID:5416
- C:\Windows\System\xKSDTZR.exe
  C:\Windows\System\xKSDTZR.exe
  2⤵
  PID:5444
- C:\Windows\System\giKNDdL.exe
  C:\Windows\System\giKNDdL.exe
  2⤵
  PID:5464
- C:\Windows\System\JgcIFlt.exe
  C:\Windows\System\JgcIFlt.exe
  2⤵
  PID:5488
- C:\Windows\System\QBTcLsH.exe
  C:\Windows\System\QBTcLsH.exe
  2⤵
  PID:5504
- C:\Windows\System\czLqGlr.exe
  C:\Windows\System\czLqGlr.exe
  2⤵
  PID:5568
- C:\Windows\System\qeXQtRp.exe
  C:\Windows\System\qeXQtRp.exe
  2⤵
  PID:5600
- C:\Windows\System\OpSnxwq.exe
  C:\Windows\System\OpSnxwq.exe
  2⤵
  PID:5620
- C:\Windows\System\nLcIeXe.exe
  C:\Windows\System\nLcIeXe.exe
  2⤵
  PID:5636
- C:\Windows\System\SboXUHd.exe
  C:\Windows\System\SboXUHd.exe
  2⤵
  PID:5660
- C:\Windows\System\NIbHFzR.exe
  C:\Windows\System\NIbHFzR.exe
  2⤵
  PID:5688
- C:\Windows\System\lgQTMgB.exe
  C:\Windows\System\lgQTMgB.exe
  2⤵
  PID:5704
- C:\Windows\System\vzPiukq.exe
  C:\Windows\System\vzPiukq.exe
  2⤵
  PID:5732
- C:\Windows\System\neHcvAs.exe
  C:\Windows\System\neHcvAs.exe
  2⤵
  PID:5752
- C:\Windows\System\aPMjhOi.exe
  C:\Windows\System\aPMjhOi.exe
  2⤵
  PID:5772
- C:\Windows\System\qeiZbmg.exe
  C:\Windows\System\qeiZbmg.exe
  2⤵
  PID:5800
- C:\Windows\System\TQTfXXy.exe
  C:\Windows\System\TQTfXXy.exe
  2⤵
  PID:5820
- C:\Windows\System\LsabaPj.exe
  C:\Windows\System\LsabaPj.exe
  2⤵
  PID:5844
- C:\Windows\System\wHpukqz.exe
  C:\Windows\System\wHpukqz.exe
  2⤵
  PID:5860
- C:\Windows\System\WqSvUyg.exe
  C:\Windows\System\WqSvUyg.exe
  2⤵
  PID:6016
- C:\Windows\System\vZcEeEP.exe
  C:\Windows\System\vZcEeEP.exe
  2⤵
  PID:6032
- C:\Windows\System\UrPnOMi.exe
  C:\Windows\System\UrPnOMi.exe
  2⤵
  PID:6048
- C:\Windows\System\RbpCrjh.exe
  C:\Windows\System\RbpCrjh.exe
  2⤵
  PID:6068
- C:\Windows\System\PZVkCLD.exe
  C:\Windows\System\PZVkCLD.exe
  2⤵
  PID:6092
- C:\Windows\System\SWSFHim.exe
  C:\Windows\System\SWSFHim.exe
  2⤵
  PID:6108
- C:\Windows\System\TsCUdWo.exe
  C:\Windows\System\TsCUdWo.exe
  2⤵
  PID:6136
- C:\Windows\System\hwZflll.exe
  C:\Windows\System\hwZflll.exe
  2⤵
  PID:2064
- C:\Windows\System\FpoZFIa.exe
  C:\Windows\System\FpoZFIa.exe
  2⤵
  PID:4080
- C:\Windows\System\sycfcKJ.exe
  C:\Windows\System\sycfcKJ.exe
  2⤵
  PID:4432
- C:\Windows\System\xoAyGeJ.exe
  C:\Windows\System\xoAyGeJ.exe
  2⤵
  PID:4620
- C:\Windows\System\Ykhafxc.exe
  C:\Windows\System\Ykhafxc.exe
  2⤵
  PID:884
- C:\Windows\System\vLrKFSI.exe
  C:\Windows\System\vLrKFSI.exe
  2⤵
  PID:5140
- C:\Windows\System\XNsIoWn.exe
  C:\Windows\System\XNsIoWn.exe
  2⤵
  PID:1928
- C:\Windows\System\wcMBWJZ.exe
  C:\Windows\System\wcMBWJZ.exe
  2⤵
  PID:3340
- C:\Windows\System\hpxuODT.exe
  C:\Windows\System\hpxuODT.exe
  2⤵
  PID:4536
- C:\Windows\System\lrpNZPK.exe
  C:\Windows\System\lrpNZPK.exe
  2⤵
  PID:2104
- C:\Windows\System\mhGDyGs.exe
  C:\Windows\System\mhGDyGs.exe
  2⤵
  PID:5868
- C:\Windows\System\mkdocAT.exe
  C:\Windows\System\mkdocAT.exe
  2⤵
  PID:3512
- C:\Windows\System\fpqFUqQ.exe
  C:\Windows\System\fpqFUqQ.exe
  2⤵
  PID:676
- C:\Windows\System\GvphuhU.exe
  C:\Windows\System\GvphuhU.exe
  2⤵
  PID:5724
- C:\Windows\System\anYqhZx.exe
  C:\Windows\System\anYqhZx.exe
  2⤵
  PID:5828
- C:\Windows\System\kjdCSRq.exe
  C:\Windows\System\kjdCSRq.exe
  2⤵
  PID:5184
- C:\Windows\System\AMVYYMA.exe
  C:\Windows\System\AMVYYMA.exe
  2⤵
  PID:5264
- C:\Windows\System\CIrlbak.exe
  C:\Windows\System\CIrlbak.exe
  2⤵
  PID:5328
- C:\Windows\System\jZItyam.exe
  C:\Windows\System\jZItyam.exe
  2⤵
  PID:5404
- C:\Windows\System\IFqItbd.exe
  C:\Windows\System\IFqItbd.exe
  2⤵
  PID:5460
- C:\Windows\System\ufhBMrj.exe
  C:\Windows\System\ufhBMrj.exe
  2⤵
  PID:5532
- C:\Windows\System\GWAEFJF.exe
  C:\Windows\System\GWAEFJF.exe
  2⤵
  PID:5584
- C:\Windows\System\jECMFrL.exe
  C:\Windows\System\jECMFrL.exe
  2⤵
  PID:5668
- C:\Windows\System\bNYFiRF.exe
  C:\Windows\System\bNYFiRF.exe
  2⤵
  PID:5728
- C:\Windows\System\gGTqCPT.exe
  C:\Windows\System\gGTqCPT.exe
  2⤵
  PID:5696
- C:\Windows\System\zRSAppP.exe
  C:\Windows\System\zRSAppP.exe
  2⤵
  PID:5260
- C:\Windows\System\tDVfEJt.exe
  C:\Windows\System\tDVfEJt.exe
  2⤵
  PID:5432
- C:\Windows\System\uayhHSJ.exe
  C:\Windows\System\uayhHSJ.exe
  2⤵
  PID:5628
- C:\Windows\System\NBARZBq.exe
  C:\Windows\System\NBARZBq.exe
  2⤵
  PID:5924
- C:\Windows\System\XRvIrRP.exe
  C:\Windows\System\XRvIrRP.exe
  2⤵
  PID:4052
- C:\Windows\System\gRbttJL.exe
  C:\Windows\System\gRbttJL.exe
  2⤵
  PID:3256
- C:\Windows\System\ZASDWSh.exe
  C:\Windows\System\ZASDWSh.exe
  2⤵
  PID:6148
- C:\Windows\System\iAPTxuy.exe
  C:\Windows\System\iAPTxuy.exe
  2⤵
  PID:6168
- C:\Windows\System\ENYmnFU.exe
  C:\Windows\System\ENYmnFU.exe
  2⤵
  PID:6188
- C:\Windows\System\prdqNpf.exe
  C:\Windows\System\prdqNpf.exe
  2⤵
  PID:6208
- C:\Windows\System\dotCLWG.exe
  C:\Windows\System\dotCLWG.exe
  2⤵
  PID:6236
- C:\Windows\System\gwiFCpa.exe
  C:\Windows\System\gwiFCpa.exe
  2⤵
  PID:6252
- C:\Windows\System\GKcqNDW.exe
  C:\Windows\System\GKcqNDW.exe
  2⤵
  PID:6272
- C:\Windows\System\hBLcNxf.exe
  C:\Windows\System\hBLcNxf.exe
  2⤵
  PID:6292
- C:\Windows\System\lkGEHJf.exe
  C:\Windows\System\lkGEHJf.exe
  2⤵
  PID:6312
- C:\Windows\System\VhVGrsO.exe
  C:\Windows\System\VhVGrsO.exe
  2⤵
  PID:6336
- C:\Windows\System\SxnYvYt.exe
  C:\Windows\System\SxnYvYt.exe
  2⤵
  PID:6360
- C:\Windows\System\KtIJrth.exe
  C:\Windows\System\KtIJrth.exe
  2⤵
  PID:6388
- C:\Windows\System\cadllMC.exe
  C:\Windows\System\cadllMC.exe
  2⤵
  PID:6404
- C:\Windows\System\zVVoPaC.exe
  C:\Windows\System\zVVoPaC.exe
  2⤵
  PID:6428
- C:\Windows\System\UHiEnfo.exe
  C:\Windows\System\UHiEnfo.exe
  2⤵
  PID:6452
- C:\Windows\System\iXorCNl.exe
  C:\Windows\System\iXorCNl.exe
  2⤵
  PID:6468
- C:\Windows\System\OPVacBS.exe
  C:\Windows\System\OPVacBS.exe
  2⤵
  PID:6484
- C:\Windows\System\nGCMvaX.exe
  C:\Windows\System\nGCMvaX.exe
  2⤵
  PID:6500
- C:\Windows\System\LwGvLiH.exe
  C:\Windows\System\LwGvLiH.exe
  2⤵
  PID:6540
- C:\Windows\System\kIXLnml.exe
  C:\Windows\System\kIXLnml.exe
  2⤵
  PID:6556
- C:\Windows\System\pONxHAe.exe
  C:\Windows\System\pONxHAe.exe
  2⤵
  PID:6572
- C:\Windows\System\kDuSofF.exe
  C:\Windows\System\kDuSofF.exe
  2⤵
  PID:6748
- C:\Windows\System\iTJjbDj.exe
  C:\Windows\System\iTJjbDj.exe
  2⤵
  PID:6764
- C:\Windows\System\zsZbFsM.exe
  C:\Windows\System\zsZbFsM.exe
  2⤵
  PID:6784
- C:\Windows\System\DloBOBv.exe
  C:\Windows\System\DloBOBv.exe
  2⤵
  PID:6804
- C:\Windows\System\InKTEOy.exe
  C:\Windows\System\InKTEOy.exe
  2⤵
  PID:6828
- C:\Windows\System\TaIIWDQ.exe
  C:\Windows\System\TaIIWDQ.exe
  2⤵
  PID:6844
- C:\Windows\System\JRobKkx.exe
  C:\Windows\System\JRobKkx.exe
  2⤵
  PID:6868
- C:\Windows\System\BIdqGhp.exe
  C:\Windows\System\BIdqGhp.exe
  2⤵
  PID:6888
- C:\Windows\System\zYAFKAU.exe
  C:\Windows\System\zYAFKAU.exe
  2⤵
  PID:6908
- C:\Windows\System\vZFfhya.exe
  C:\Windows\System\vZFfhya.exe
  2⤵
  PID:6928
- C:\Windows\System\ZGmdsxR.exe
  C:\Windows\System\ZGmdsxR.exe
  2⤵
  PID:6944
- C:\Windows\System\jBqFQzg.exe
  C:\Windows\System\jBqFQzg.exe
  2⤵
  PID:6964
- C:\Windows\System\YsopgVU.exe
  C:\Windows\System\YsopgVU.exe
  2⤵
  PID:6984
- C:\Windows\System\CyWuXeI.exe
  C:\Windows\System\CyWuXeI.exe
  2⤵
  PID:7004
- C:\Windows\System\MbnNRBL.exe
  C:\Windows\System\MbnNRBL.exe
  2⤵
  PID:7020
- C:\Windows\System\AIvlsNp.exe
  C:\Windows\System\AIvlsNp.exe
  2⤵
  PID:7048
- C:\Windows\System\wqUWNDM.exe
  C:\Windows\System\wqUWNDM.exe
  2⤵
  PID:7068
- C:\Windows\System\DQKrBpL.exe
  C:\Windows\System\DQKrBpL.exe
  2⤵
  PID:7092
- C:\Windows\System\CrEoCgt.exe
  C:\Windows\System\CrEoCgt.exe
  2⤵
  PID:7108
- C:\Windows\System\FvOLjzS.exe
  C:\Windows\System\FvOLjzS.exe
  2⤵
  PID:7132
- C:\Windows\System\nBaEYFH.exe
  C:\Windows\System\nBaEYFH.exe
  2⤵
  PID:7148
- C:\Windows\System\tERtrXJ.exe
  C:\Windows\System\tERtrXJ.exe
  2⤵
  PID:5456
- C:\Windows\System\DrPvRjH.exe
  C:\Windows\System\DrPvRjH.exe
  2⤵
  PID:3736
- C:\Windows\System\iKwKbBB.exe
  C:\Windows\System\iKwKbBB.exe
  2⤵
  PID:6040
- C:\Windows\System\YSbqvJw.exe
  C:\Windows\System\YSbqvJw.exe
  2⤵
  PID:6080
- C:\Windows\System\clDXpFF.exe
  C:\Windows\System\clDXpFF.exe
  2⤵
  PID:6124
- C:\Windows\System\PTGpZMj.exe
  C:\Windows\System\PTGpZMj.exe
  2⤵
  PID:4772
- C:\Windows\System\qrSXJyw.exe
  C:\Windows\System\qrSXJyw.exe
  2⤵
  PID:812
- C:\Windows\System\JaKdJLN.exe
  C:\Windows\System\JaKdJLN.exe
  2⤵
  PID:4000
- C:\Windows\System\QSNvfmX.exe
  C:\Windows\System\QSNvfmX.exe
  2⤵
  PID:4572
- C:\Windows\System\MMXvZlZ.exe
  C:\Windows\System\MMXvZlZ.exe
  2⤵
  PID:4480
- C:\Windows\System\GOUbjSw.exe
  C:\Windows\System\GOUbjSw.exe
  2⤵
  PID:5816
- C:\Windows\System\TRXjGcz.exe
  C:\Windows\System\TRXjGcz.exe
  2⤵
  PID:4024
- C:\Windows\System\bpPBnha.exe
  C:\Windows\System\bpPBnha.exe
  2⤵
  PID:3968
- C:\Windows\System\EqfuxHO.exe
  C:\Windows\System\EqfuxHO.exe
  2⤵
  PID:5616
- C:\Windows\System\bHwImsB.exe
  C:\Windows\System\bHwImsB.exe
  2⤵
  PID:4116
- C:\Windows\System\hEEhThp.exe
  C:\Windows\System\hEEhThp.exe
  2⤵
  PID:6288
- C:\Windows\System\bZCRzWp.exe
  C:\Windows\System\bZCRzWp.exe
  2⤵
  PID:6412
- C:\Windows\System\JOJZLZH.exe
  C:\Windows\System\JOJZLZH.exe
  2⤵
  PID:5320
- C:\Windows\System\lflNebX.exe
  C:\Windows\System\lflNebX.exe
  2⤵
  PID:5528
- C:\Windows\System\bOdiVTr.exe
  C:\Windows\System\bOdiVTr.exe
  2⤵
  PID:5712
- C:\Windows\System\iJqZrxw.exe
  C:\Windows\System\iJqZrxw.exe
  2⤵
  PID:5400
- C:\Windows\System\dosBDhZ.exe
  C:\Windows\System\dosBDhZ.exe
  2⤵
  PID:6184
- C:\Windows\System\KHqHFzH.exe
  C:\Windows\System\KHqHFzH.exe
  2⤵
  PID:6228
- C:\Windows\System\bsjysyH.exe
  C:\Windows\System\bsjysyH.exe
  2⤵
  PID:6304
- C:\Windows\System\qMxQHBm.exe
  C:\Windows\System\qMxQHBm.exe
  2⤵
  PID:6420
- C:\Windows\System\MteyjKN.exe
  C:\Windows\System\MteyjKN.exe
  2⤵
  PID:6548
- C:\Windows\System\BFfrfvi.exe
  C:\Windows\System\BFfrfvi.exe
  2⤵
  PID:7172
- C:\Windows\System\zwcUnSg.exe
  C:\Windows\System\zwcUnSg.exe
  2⤵
  PID:7188
- C:\Windows\System\PiLZQOC.exe
  C:\Windows\System\PiLZQOC.exe
  2⤵
  PID:7204
- C:\Windows\System\RlmuRlR.exe
  C:\Windows\System\RlmuRlR.exe
  2⤵
  PID:7220
- C:\Windows\System\SEjzpBT.exe
  C:\Windows\System\SEjzpBT.exe
  2⤵
  PID:7236
- C:\Windows\System\vmamrde.exe
  C:\Windows\System\vmamrde.exe
  2⤵
  PID:7252
- C:\Windows\System\NqUlEJG.exe
  C:\Windows\System\NqUlEJG.exe
  2⤵
  PID:7268
- C:\Windows\System\sXCEsJB.exe
  C:\Windows\System\sXCEsJB.exe
  2⤵
  PID:7284
- C:\Windows\System\TAqzAhD.exe
  C:\Windows\System\TAqzAhD.exe
  2⤵
  PID:7304
- C:\Windows\System\ECEmnLy.exe
  C:\Windows\System\ECEmnLy.exe
  2⤵
  PID:7320
- C:\Windows\System\WGeCmFI.exe
  C:\Windows\System\WGeCmFI.exe
  2⤵
  PID:7340
- C:\Windows\System\CjLWiJd.exe
  C:\Windows\System\CjLWiJd.exe
  2⤵
  PID:7364
- C:\Windows\System\lBuuNOR.exe
  C:\Windows\System\lBuuNOR.exe
  2⤵
  PID:7384
- C:\Windows\System\evwKEVG.exe
  C:\Windows\System\evwKEVG.exe
  2⤵
  PID:7404
- C:\Windows\System\eTIDBMa.exe
  C:\Windows\System\eTIDBMa.exe
  2⤵
  PID:7424
- C:\Windows\System\QzBmLfk.exe
  C:\Windows\System\QzBmLfk.exe
  2⤵
  PID:7444
- C:\Windows\System\gNHiXFN.exe
  C:\Windows\System\gNHiXFN.exe
  2⤵
  PID:7468
- C:\Windows\System\CpwcBUO.exe
  C:\Windows\System\CpwcBUO.exe
  2⤵
  PID:7496
- C:\Windows\System\xJRnJnt.exe
  C:\Windows\System\xJRnJnt.exe
  2⤵
  PID:7520
- C:\Windows\System\lHAzLXX.exe
  C:\Windows\System\lHAzLXX.exe
  2⤵
  PID:7540
- C:\Windows\System\CYDODWi.exe
  C:\Windows\System\CYDODWi.exe
  2⤵
  PID:7564
- C:\Windows\System\yLxnwWh.exe
  C:\Windows\System\yLxnwWh.exe
  2⤵
  PID:7588
- C:\Windows\System\mlluYZJ.exe
  C:\Windows\System\mlluYZJ.exe
  2⤵
  PID:7612
- C:\Windows\System\PXhVDnY.exe
  C:\Windows\System\PXhVDnY.exe
  2⤵
  PID:7632
- C:\Windows\System\LNZWJHy.exe
  C:\Windows\System\LNZWJHy.exe
  2⤵
  PID:7652
- C:\Windows\System\FCYDrEI.exe
  C:\Windows\System\FCYDrEI.exe
  2⤵
  PID:7672
- C:\Windows\System\ZxSdicP.exe
  C:\Windows\System\ZxSdicP.exe
  2⤵
  PID:7696
- C:\Windows\System\hIhdRyQ.exe
  C:\Windows\System\hIhdRyQ.exe
  2⤵
  PID:7728
- C:\Windows\System\fjaouGD.exe
  C:\Windows\System\fjaouGD.exe
  2⤵
  PID:7752
- C:\Windows\System\LImQeSn.exe
  C:\Windows\System\LImQeSn.exe
  2⤵
  PID:7776
- C:\Windows\System\EnquNQm.exe
  C:\Windows\System\EnquNQm.exe
  2⤵
  PID:7804
- C:\Windows\System\DhKikkE.exe
  C:\Windows\System\DhKikkE.exe
  2⤵
  PID:7828
- C:\Windows\System\FfNouEd.exe
  C:\Windows\System\FfNouEd.exe
  2⤵
  PID:7852
- C:\Windows\System\UqHksof.exe
  C:\Windows\System\UqHksof.exe
  2⤵
  PID:7868
- C:\Windows\System\rOdyDUs.exe
  C:\Windows\System\rOdyDUs.exe
  2⤵
  PID:7892
- C:\Windows\System\ToScnan.exe
  C:\Windows\System\ToScnan.exe
  2⤵
  PID:7916
- C:\Windows\System\hfdXdAu.exe
  C:\Windows\System\hfdXdAu.exe
  2⤵
  PID:7940
- C:\Windows\System\FMrnVQH.exe
  C:\Windows\System\FMrnVQH.exe
  2⤵
  PID:7964
- C:\Windows\System\CAAyMQo.exe
  C:\Windows\System\CAAyMQo.exe
  2⤵
  PID:7984
- C:\Windows\System\PDFxMLs.exe
  C:\Windows\System\PDFxMLs.exe
  2⤵
  PID:8004
- C:\Windows\System\bvGBtmk.exe
  C:\Windows\System\bvGBtmk.exe
  2⤵
  PID:8028
- C:\Windows\System\tvRlYjI.exe
  C:\Windows\System\tvRlYjI.exe
  2⤵
  PID:8048
- C:\Windows\System\yJeWZZN.exe
  C:\Windows\System\yJeWZZN.exe
  2⤵
  PID:8072
- C:\Windows\System\qCiVZow.exe
  C:\Windows\System\qCiVZow.exe
  2⤵
  PID:8096
- C:\Windows\System\bfoXgbl.exe
  C:\Windows\System\bfoXgbl.exe
  2⤵
  PID:8116
- C:\Windows\System\rulaGLX.exe
  C:\Windows\System\rulaGLX.exe
  2⤵
  PID:8136
- C:\Windows\System\EyCZHnK.exe
  C:\Windows\System\EyCZHnK.exe
  2⤵
  PID:8160
- C:\Windows\System\ADacJAy.exe
  C:\Windows\System\ADacJAy.exe
  2⤵
  PID:8184
- C:\Windows\System\uzpOFVb.exe
  C:\Windows\System\uzpOFVb.exe
  2⤵
  PID:7044
- C:\Windows\System\TdJIWfl.exe
  C:\Windows\System\TdJIWfl.exe
  2⤵
  PID:7128
- C:\Windows\System\seYlghp.exe
  C:\Windows\System\seYlghp.exe
  2⤵
  PID:664
- C:\Windows\System\qbSkhgx.exe
  C:\Windows\System\qbSkhgx.exe
  2⤵
  PID:6064
- C:\Windows\System\WGNqMTj.exe
  C:\Windows\System\WGNqMTj.exe
  2⤵
  PID:4280
- C:\Windows\System\DlqjJZc.exe
  C:\Windows\System\DlqjJZc.exe
  2⤵
  PID:2456
- C:\Windows\System\xjYCZEY.exe
  C:\Windows\System\xjYCZEY.exe
  2⤵
  PID:6380
- C:\Windows\System\xuKurLE.exe
  C:\Windows\System\xuKurLE.exe
  2⤵
  PID:5672
- C:\Windows\System\PreVimC.exe
  C:\Windows\System\PreVimC.exe
  2⤵
  PID:6368
- C:\Windows\System\JNbgrhr.exe
  C:\Windows\System\JNbgrhr.exe
  2⤵
  PID:6900
- C:\Windows\System\oShYxlg.exe
  C:\Windows\System\oShYxlg.exe
  2⤵
  PID:6976
- C:\Windows\System\paoVTmL.exe
  C:\Windows\System\paoVTmL.exe
  2⤵
  PID:7080
- C:\Windows\System\kIDBVKf.exe
  C:\Windows\System\kIDBVKf.exe
  2⤵
  PID:7528
- C:\Windows\System\ioOkCsR.exe
  C:\Windows\System\ioOkCsR.exe
  2⤵
  PID:8200
- C:\Windows\System\dPAuTbd.exe
  C:\Windows\System\dPAuTbd.exe
  2⤵
  PID:8224
- C:\Windows\System\XjoILDJ.exe
  C:\Windows\System\XjoILDJ.exe
  2⤵
  PID:8244
- C:\Windows\System\KhEETde.exe
  C:\Windows\System\KhEETde.exe
  2⤵
  PID:8276
- C:\Windows\System\UOMphDM.exe
  C:\Windows\System\UOMphDM.exe
  2⤵
  PID:8296
- C:\Windows\System\djWLpxV.exe
  C:\Windows\System\djWLpxV.exe
  2⤵
  PID:8316
- C:\Windows\System\Hjwcdan.exe
  C:\Windows\System\Hjwcdan.exe
  2⤵
  PID:8336
- C:\Windows\System\eIEIovy.exe
  C:\Windows\System\eIEIovy.exe
  2⤵
  PID:8368
- C:\Windows\System\qHRTqjy.exe
  C:\Windows\System\qHRTqjy.exe
  2⤵
  PID:8388
- C:\Windows\System\hxsVFuP.exe
  C:\Windows\System\hxsVFuP.exe
  2⤵
  PID:8412
- C:\Windows\System\eJkRWdA.exe
  C:\Windows\System\eJkRWdA.exe
  2⤵
  PID:8432
- C:\Windows\System\SppKOHs.exe
  C:\Windows\System\SppKOHs.exe
  2⤵
  PID:8452
- C:\Windows\System\pwcCUCN.exe
  C:\Windows\System\pwcCUCN.exe
  2⤵
  PID:8472
- C:\Windows\System\DrgHDCv.exe
  C:\Windows\System\DrgHDCv.exe
  2⤵
  PID:8492
- C:\Windows\System\rqJNqlN.exe
  C:\Windows\System\rqJNqlN.exe
  2⤵
  PID:8520
- C:\Windows\System\wkYlIGr.exe
  C:\Windows\System\wkYlIGr.exe
  2⤵
  PID:8536
- C:\Windows\System\HLtHFWW.exe
  C:\Windows\System\HLtHFWW.exe
  2⤵
  PID:8560
- C:\Windows\System\nVgsHEe.exe
  C:\Windows\System\nVgsHEe.exe
  2⤵
  PID:8580
- C:\Windows\System\QbzoQXt.exe
  C:\Windows\System\QbzoQXt.exe
  2⤵
  PID:8600
- C:\Windows\System\JjmTLjd.exe
  C:\Windows\System\JjmTLjd.exe
  2⤵
  PID:8628
- C:\Windows\System\MHaEQPK.exe
  C:\Windows\System\MHaEQPK.exe
  2⤵
  PID:8644
- C:\Windows\System\kESSQHK.exe
  C:\Windows\System\kESSQHK.exe
  2⤵
  PID:8668
- C:\Windows\System\wZbPsmD.exe
  C:\Windows\System\wZbPsmD.exe
  2⤵
  PID:8692
- C:\Windows\System\ZcGwqzX.exe
  C:\Windows\System\ZcGwqzX.exe
  2⤵
  PID:8712
- C:\Windows\System\FtbIPoQ.exe
  C:\Windows\System\FtbIPoQ.exe
  2⤵
  PID:8732
- C:\Windows\System\bvpfmwj.exe
  C:\Windows\System\bvpfmwj.exe
  2⤵
  PID:8756
- C:\Windows\System\BtKwydz.exe
  C:\Windows\System\BtKwydz.exe
  2⤵
  PID:8776
- C:\Windows\System\YxMKwKT.exe
  C:\Windows\System\YxMKwKT.exe
  2⤵
  PID:8796
- C:\Windows\System\vJriGbg.exe
  C:\Windows\System\vJriGbg.exe
  2⤵
  PID:8820
- C:\Windows\System\bPjdZFq.exe
  C:\Windows\System\bPjdZFq.exe
  2⤵
  PID:8844
- C:\Windows\System\rlaZOnx.exe
  C:\Windows\System\rlaZOnx.exe
  2⤵
  PID:8864
- C:\Windows\System\WyXhJxQ.exe
  C:\Windows\System\WyXhJxQ.exe
  2⤵
  PID:8888
- C:\Windows\System\lTWmQQj.exe
  C:\Windows\System\lTWmQQj.exe
  2⤵
  PID:8908
- C:\Windows\System\dTESPAB.exe
  C:\Windows\System\dTESPAB.exe
  2⤵
  PID:8932
- C:\Windows\System\yAvhgis.exe
  C:\Windows\System\yAvhgis.exe
  2⤵
  PID:8952
- C:\Windows\System\HtNfnNy.exe
  C:\Windows\System\HtNfnNy.exe
  2⤵
  PID:8972
- C:\Windows\System\gOPsdMk.exe
  C:\Windows\System\gOPsdMk.exe
  2⤵
  PID:8996
- C:\Windows\System\yuRribE.exe
  C:\Windows\System\yuRribE.exe
  2⤵
  PID:9020
- C:\Windows\System\BMMoNul.exe
  C:\Windows\System\BMMoNul.exe
  2⤵
  PID:9040
- C:\Windows\System\lYQpdMU.exe
  C:\Windows\System\lYQpdMU.exe
  2⤵
  PID:9060
- C:\Windows\System\qiCCWAM.exe
  C:\Windows\System\qiCCWAM.exe
  2⤵
  PID:9084
- C:\Windows\System\ljJGwnH.exe
  C:\Windows\System\ljJGwnH.exe
  2⤵
  PID:6248
- C:\Windows\System\CgfBeyg.exe
  C:\Windows\System\CgfBeyg.exe
  2⤵
  PID:7704
- C:\Windows\System\tIWsfYf.exe
  C:\Windows\System\tIWsfYf.exe
  2⤵
  PID:7760
- C:\Windows\System\lhfeGcq.exe
  C:\Windows\System\lhfeGcq.exe
  2⤵
  PID:4912
- C:\Windows\System\PaWAfIX.exe
  C:\Windows\System\PaWAfIX.exe
  2⤵
  PID:7876
- C:\Windows\System\mlkQMlH.exe
  C:\Windows\System\mlkQMlH.exe
  2⤵
  PID:7908
- C:\Windows\System\UwOImTE.exe
  C:\Windows\System\UwOImTE.exe
  2⤵
  PID:6176
- C:\Windows\System\LebgHAN.exe
  C:\Windows\System\LebgHAN.exe
  2⤵
  PID:7976
- C:\Windows\System\qelDXtG.exe
  C:\Windows\System\qelDXtG.exe
  2⤵
  PID:6492
- C:\Windows\System\ojHWftu.exe
  C:\Windows\System\ojHWftu.exe
  2⤵
  PID:6512
- C:\Windows\System\wPcdGyL.exe
  C:\Windows\System\wPcdGyL.exe
  2⤵
  PID:8104
- C:\Windows\System\WKkXAeH.exe
  C:\Windows\System\WKkXAeH.exe
  2⤵
  PID:6812
- C:\Windows\System\lQNmBsv.exe
  C:\Windows\System\lQNmBsv.exe
  2⤵
  PID:6796
- C:\Windows\System\ynEGIWt.exe
  C:\Windows\System\ynEGIWt.exe
  2⤵
  PID:6860
- C:\Windows\System\YyzdUJX.exe
  C:\Windows\System\YyzdUJX.exe
  2⤵
  PID:2144
- C:\Windows\System\XRUaadg.exe
  C:\Windows\System\XRUaadg.exe
  2⤵
  PID:7464
- C:\Windows\System\ElxMfkU.exe
  C:\Windows\System\ElxMfkU.exe
  2⤵
  PID:7060
- C:\Windows\System\kMwMZJE.exe
  C:\Windows\System\kMwMZJE.exe
  2⤵
  PID:5156
- C:\Windows\System\KLnpRJd.exe
  C:\Windows\System\KLnpRJd.exe
  2⤵
  PID:8220
- C:\Windows\System\aURFHuG.exe
  C:\Windows\System\aURFHuG.exe
  2⤵
  PID:9228
- C:\Windows\System\GEtBkrX.exe
  C:\Windows\System\GEtBkrX.exe
  2⤵
  PID:9248
- C:\Windows\System\BXuFMJe.exe
  C:\Windows\System\BXuFMJe.exe
  2⤵
  PID:9272
- C:\Windows\System\xFwlTVu.exe
  C:\Windows\System\xFwlTVu.exe
  2⤵
  PID:9292
- C:\Windows\System\qfsLIar.exe
  C:\Windows\System\qfsLIar.exe
  2⤵
  PID:9312
- C:\Windows\System\WkOxuRs.exe
  C:\Windows\System\WkOxuRs.exe
  2⤵
  PID:9332
- C:\Windows\System\WneksSw.exe
  C:\Windows\System\WneksSw.exe
  2⤵
  PID:9356
- C:\Windows\System\dFodaUU.exe
  C:\Windows\System\dFodaUU.exe
  2⤵
  PID:9380
- C:\Windows\System\mqEsxuT.exe
  C:\Windows\System\mqEsxuT.exe
  2⤵
  PID:9400
- C:\Windows\System\FZuTLGm.exe
  C:\Windows\System\FZuTLGm.exe
  2⤵
  PID:9416
- C:\Windows\System\aBFikli.exe
  C:\Windows\System\aBFikli.exe
  2⤵
  PID:9440
- C:\Windows\System\hOaTBxT.exe
  C:\Windows\System\hOaTBxT.exe
  2⤵
  PID:9468
- C:\Windows\System\IPTIVRr.exe
  C:\Windows\System\IPTIVRr.exe
  2⤵
  PID:9488
- C:\Windows\System\bQnuWVZ.exe
  C:\Windows\System\bQnuWVZ.exe
  2⤵
  PID:9512
- C:\Windows\System\HxDIbUx.exe
  C:\Windows\System\HxDIbUx.exe
  2⤵
  PID:9536
- C:\Windows\System\sZXREqJ.exe
  C:\Windows\System\sZXREqJ.exe
  2⤵
  PID:9560
- C:\Windows\System\lfxkvJv.exe
  C:\Windows\System\lfxkvJv.exe
  2⤵
  PID:9580
- C:\Windows\System\osCFOGZ.exe
  C:\Windows\System\osCFOGZ.exe
  2⤵
  PID:9608
- C:\Windows\System\SvtFNDe.exe
  C:\Windows\System\SvtFNDe.exe
  2⤵
  PID:9628
- C:\Windows\System\ngOuodb.exe
  C:\Windows\System\ngOuodb.exe
  2⤵
  PID:9660
- C:\Windows\System\aboxtba.exe
  C:\Windows\System\aboxtba.exe
  2⤵
  PID:9676
- C:\Windows\System\FazoMge.exe
  C:\Windows\System\FazoMge.exe
  2⤵
  PID:9700
- C:\Windows\System\bECjDCo.exe
  C:\Windows\System\bECjDCo.exe
  2⤵
  PID:9724
- C:\Windows\System\fNlMSqa.exe
  C:\Windows\System\fNlMSqa.exe
  2⤵
  PID:9744
- C:\Windows\System\NiaFJtA.exe
  C:\Windows\System\NiaFJtA.exe
  2⤵
  PID:9768
- C:\Windows\System\PNzaANh.exe
  C:\Windows\System\PNzaANh.exe
  2⤵
  PID:9788
- C:\Windows\System\MvUbxWz.exe
  C:\Windows\System\MvUbxWz.exe
  2⤵
  PID:9816
- C:\Windows\System\MROVCaT.exe
  C:\Windows\System\MROVCaT.exe
  2⤵
  PID:9832
- C:\Windows\System\ZzIdGTM.exe
  C:\Windows\System\ZzIdGTM.exe
  2⤵
  PID:9856
- C:\Windows\System\FlDNokZ.exe
  C:\Windows\System\FlDNokZ.exe
  2⤵
  PID:9880
- C:\Windows\System\mRYmjbI.exe
  C:\Windows\System\mRYmjbI.exe
  2⤵
  PID:9908
- C:\Windows\System\qMqKLjl.exe
  C:\Windows\System\qMqKLjl.exe
  2⤵
  PID:9924
- C:\Windows\System\UKcYuuC.exe
  C:\Windows\System\UKcYuuC.exe
  2⤵
  PID:9948
- C:\Windows\System\BmSHFZA.exe
  C:\Windows\System\BmSHFZA.exe
  2⤵
  PID:9976
- C:\Windows\System\HmhieGK.exe
  C:\Windows\System\HmhieGK.exe
  2⤵
  PID:9996
- C:\Windows\System\JSRQmIs.exe
  C:\Windows\System\JSRQmIs.exe
  2⤵
  PID:10020
- C:\Windows\System\cilVhbo.exe
  C:\Windows\System\cilVhbo.exe
  2⤵
  PID:10040
- C:\Windows\System\OiujkVV.exe
  C:\Windows\System\OiujkVV.exe
  2⤵
  PID:10060
- C:\Windows\System\ssLKWbu.exe
  C:\Windows\System\ssLKWbu.exe
  2⤵
  PID:10084
- C:\Windows\System\fuhGoWg.exe
  C:\Windows\System\fuhGoWg.exe
  2⤵
  PID:10112
- C:\Windows\System\fkTesHg.exe
  C:\Windows\System\fkTesHg.exe
  2⤵
  PID:10132
- C:\Windows\System\gHJyfwn.exe
  C:\Windows\System\gHJyfwn.exe
  2⤵
  PID:10156
- C:\Windows\System\KbLwSPd.exe
  C:\Windows\System\KbLwSPd.exe
  2⤵
  PID:10188
- C:\Windows\System\QeESvPE.exe
  C:\Windows\System\QeESvPE.exe
  2⤵
  PID:10204
- C:\Windows\System\YAvtPiV.exe
  C:\Windows\System\YAvtPiV.exe
  2⤵
  PID:10228
- C:\Windows\System\ChVjJCk.exe
  C:\Windows\System\ChVjJCk.exe
  2⤵
  PID:7604
- C:\Windows\System\FemXBpf.exe
  C:\Windows\System\FemXBpf.exe
  2⤵
  PID:3260
- C:\Windows\System\OcqTFEX.exe
  C:\Windows\System\OcqTFEX.exe
  2⤵
  PID:8312
- C:\Windows\System\ZxKxVln.exe
  C:\Windows\System\ZxKxVln.exe
  2⤵
  PID:8428
- C:\Windows\System\UcWXPWI.exe
  C:\Windows\System\UcWXPWI.exe
  2⤵
  PID:8528
- C:\Windows\System\AOazczy.exe
  C:\Windows\System\AOazczy.exe
  2⤵
  PID:8616
- C:\Windows\System\dHBIFWZ.exe
  C:\Windows\System\dHBIFWZ.exe
  2⤵
  PID:8772
- C:\Windows\System\cJgOwrz.exe
  C:\Windows\System\cJgOwrz.exe
  2⤵
  PID:5792
- C:\Windows\System\RBLGCNb.exe
  C:\Windows\System\RBLGCNb.exe
  2⤵
  PID:8860
- C:\Windows\System\vlgzXSp.exe
  C:\Windows\System\vlgzXSp.exe
  2⤵
  PID:6220
- C:\Windows\System\DpKIfMQ.exe
  C:\Windows\System\DpKIfMQ.exe
  2⤵
  PID:6464
- C:\Windows\System\REIzvcG.exe
  C:\Windows\System\REIzvcG.exe
  2⤵
  PID:9048
- C:\Windows\System\qLeaZSn.exe
  C:\Windows\System\qLeaZSn.exe
  2⤵
  PID:7180
- C:\Windows\System\jOctDpV.exe
  C:\Windows\System\jOctDpV.exe
  2⤵
  PID:10348
- C:\Windows\System\vblztSX.exe
  C:\Windows\System\vblztSX.exe
  2⤵
  PID:10372
- C:\Windows\System\okQROrZ.exe
  C:\Windows\System\okQROrZ.exe
  2⤵
  PID:10396
- C:\Windows\System\aKUioYl.exe
  C:\Windows\System\aKUioYl.exe
  2⤵
  PID:10420
- C:\Windows\System\jqaNYSD.exe
  C:\Windows\System\jqaNYSD.exe
  2⤵
  PID:10436
- C:\Windows\System\XdhZXyR.exe
  C:\Windows\System\XdhZXyR.exe
  2⤵
  PID:10464
- C:\Windows\System\vdgkwez.exe
  C:\Windows\System\vdgkwez.exe
  2⤵
  PID:10484
- C:\Windows\System\grxEthR.exe
  C:\Windows\System\grxEthR.exe
  2⤵
  PID:10512
- C:\Windows\System\snryUoh.exe
  C:\Windows\System\snryUoh.exe
  2⤵
  PID:10532
- C:\Windows\System\tQqvmmL.exe
  C:\Windows\System\tQqvmmL.exe
  2⤵
  PID:10556
- C:\Windows\System\ggYBhGm.exe
  C:\Windows\System\ggYBhGm.exe
  2⤵
  PID:10576
- C:\Windows\System\ZdzHBVc.exe
  C:\Windows\System\ZdzHBVc.exe
  2⤵
  PID:10596
- C:\Windows\System\QYSGTNy.exe
  C:\Windows\System\QYSGTNy.exe
  2⤵
  PID:10616
- C:\Windows\System\OYnbdwy.exe
  C:\Windows\System\OYnbdwy.exe
  2⤵
  PID:10644
- C:\Windows\System\zORezNI.exe
  C:\Windows\System\zORezNI.exe
  2⤵
  PID:10660
- C:\Windows\System\WQzqTza.exe
  C:\Windows\System\WQzqTza.exe
  2⤵
  PID:10684
- C:\Windows\System\zyQgLEx.exe
  C:\Windows\System\zyQgLEx.exe
  2⤵
  PID:10708
- C:\Windows\System\xEocgWj.exe
  C:\Windows\System\xEocgWj.exe
  2⤵
  PID:10732
- C:\Windows\System\XFsNwZd.exe
  C:\Windows\System\XFsNwZd.exe
  2⤵
  PID:10752
- C:\Windows\System\DuQHKNM.exe
  C:\Windows\System\DuQHKNM.exe
  2⤵
  PID:10772
- C:\Windows\System\wReRZNa.exe
  C:\Windows\System\wReRZNa.exe
  2⤵
  PID:10796
- C:\Windows\System\rUjQZmb.exe
  C:\Windows\System\rUjQZmb.exe
  2⤵
  PID:10820
- C:\Windows\System\lXCZYjv.exe
  C:\Windows\System\lXCZYjv.exe
  2⤵
  PID:10840
- C:\Windows\System\xLQSimJ.exe
  C:\Windows\System\xLQSimJ.exe
  2⤵
  PID:10864
- C:\Windows\System\PwbMIlX.exe
  C:\Windows\System\PwbMIlX.exe
  2⤵
  PID:10880
- C:\Windows\System\SRKAqsK.exe
  C:\Windows\System\SRKAqsK.exe
  2⤵
  PID:10904
- C:\Windows\System\mtCzmKH.exe
  C:\Windows\System\mtCzmKH.exe
  2⤵
  PID:10932
- C:\Windows\System\dfIRJSj.exe
  C:\Windows\System\dfIRJSj.exe
  2⤵
  PID:10952
- C:\Windows\System\XmxlXxS.exe
  C:\Windows\System\XmxlXxS.exe
  2⤵
  PID:10976
- C:\Windows\System\zhyiAvj.exe
  C:\Windows\System\zhyiAvj.exe
  2⤵
  PID:11012
- C:\Windows\System\KzeFvfl.exe
  C:\Windows\System\KzeFvfl.exe
  2⤵
  PID:11032
- C:\Windows\System\laJZjDu.exe
  C:\Windows\System\laJZjDu.exe
  2⤵
  PID:11056
- C:\Windows\System\jbwjaMv.exe
  C:\Windows\System\jbwjaMv.exe
  2⤵
  PID:11076
- C:\Windows\System\CzvUgZu.exe
  C:\Windows\System\CzvUgZu.exe
  2⤵
  PID:11100
- C:\Windows\System\vjAyQYN.exe
  C:\Windows\System\vjAyQYN.exe
  2⤵
  PID:11120
- C:\Windows\System\RJIHRNo.exe
  C:\Windows\System\RJIHRNo.exe
  2⤵
  PID:11136
- C:\Windows\System\PmWJdnk.exe
  C:\Windows\System\PmWJdnk.exe
  2⤵
  PID:11164
- C:\Windows\System\BqqCdsj.exe
  C:\Windows\System\BqqCdsj.exe
  2⤵
  PID:11188
- C:\Windows\System\QHNsErv.exe
  C:\Windows\System\QHNsErv.exe
  2⤵
  PID:11208
- C:\Windows\System\XGkweoh.exe
  C:\Windows\System\XGkweoh.exe
  2⤵
  PID:11224
- C:\Windows\System\IKQOmin.exe
  C:\Windows\System\IKQOmin.exe
  2⤵
  PID:11244
- C:\Windows\System\DsMmMpL.exe
  C:\Windows\System\DsMmMpL.exe
  2⤵
  PID:7200
- C:\Windows\System\JPbcqLd.exe
  C:\Windows\System\JPbcqLd.exe
  2⤵
  PID:2764
- C:\Windows\System\eYKHxvB.exe
  C:\Windows\System\eYKHxvB.exe
  2⤵
  PID:7280
- C:\Windows\System\OlxKugD.exe
  C:\Windows\System\OlxKugD.exe
  2⤵
  PID:7332
- C:\Windows\System\IOaScJu.exe
  C:\Windows\System\IOaScJu.exe
  2⤵
  PID:9368
- C:\Windows\System\WXgCdVP.exe
  C:\Windows\System\WXgCdVP.exe
  2⤵
  PID:7796
- C:\Windows\System\mtLTuol.exe
  C:\Windows\System\mtLTuol.exe
  2⤵
  PID:8348
- C:\Windows\System\DZisqQJ.exe
  C:\Windows\System\DZisqQJ.exe
  2⤵
  PID:7884
- C:\Windows\System\bptsGSM.exe
  C:\Windows\System\bptsGSM.exe
  2⤵
  PID:9548
- C:\Windows\System\kMPsPIL.exe
  C:\Windows\System\kMPsPIL.exe
  2⤵
  PID:7936
- C:\Windows\System\JWoQBiV.exe
  C:\Windows\System\JWoQBiV.exe
  2⤵
  PID:8636
- C:\Windows\System\AySvSuB.exe
  C:\Windows\System\AySvSuB.exe
  2⤵
  PID:9920
- C:\Windows\System\zLXmqsT.exe
  C:\Windows\System\zLXmqsT.exe
  2⤵
  PID:8060
- C:\Windows\System\FmJizIq.exe
  C:\Windows\System\FmJizIq.exe
  2⤵
  PID:10056
- C:\Windows\System\IHTFAHj.exe
  C:\Windows\System\IHTFAHj.exe
  2⤵
  PID:8964
- C:\Windows\System\wierCKm.exe
  C:\Windows\System\wierCKm.exe
  2⤵
  PID:8128
- C:\Windows\System\JidOawS.exe
  C:\Windows\System\JidOawS.exe
  2⤵
  PID:9960
- C:\Windows\System\ofDTkKL.exe
  C:\Windows\System\ofDTkKL.exe
  2⤵
  PID:8084
- C:\Windows\System\iPokwpM.exe
  C:\Windows\System\iPokwpM.exe
  2⤵
  PID:6936
- C:\Windows\System\ijRGIiz.exe
  C:\Windows\System\ijRGIiz.exe
  2⤵
  PID:5916
- C:\Windows\System\UQCgPXd.exe
  C:\Windows\System\UQCgPXd.exe
  2⤵
  PID:7116
- C:\Windows\System\YnMeAxh.exe
  C:\Windows\System\YnMeAxh.exe
  2⤵
  PID:6024
- C:\Windows\System\mXccufG.exe
  C:\Windows\System\mXccufG.exe
  2⤵
  PID:1944
- C:\Windows\System\qIrLFVO.exe
  C:\Windows\System\qIrLFVO.exe
  2⤵
  PID:10628
- C:\Windows\System\dOoXseZ.exe
  C:\Windows\System\dOoXseZ.exe
  2⤵
  PID:11268
- C:\Windows\System\fCTQXyq.exe
  C:\Windows\System\fCTQXyq.exe
  2⤵
  PID:11292
- C:\Windows\System\kqHItOC.exe
  C:\Windows\System\kqHItOC.exe
  2⤵
  PID:11312
- C:\Windows\System\CqRwxKI.exe
  C:\Windows\System\CqRwxKI.exe
  2⤵
  PID:11332
- C:\Windows\System\VnvtxIu.exe
  C:\Windows\System\VnvtxIu.exe
  2⤵
  PID:11356
- C:\Windows\System\szsRXtn.exe
  C:\Windows\System\szsRXtn.exe
  2⤵
  PID:11376
- C:\Windows\System\egCaciJ.exe
  C:\Windows\System\egCaciJ.exe
  2⤵
  PID:11404
- C:\Windows\System\omjOzFp.exe
  C:\Windows\System\omjOzFp.exe
  2⤵
  PID:11424
- C:\Windows\System\FsZYQXv.exe
  C:\Windows\System\FsZYQXv.exe
  2⤵
  PID:11448
- C:\Windows\System\jRfcGet.exe
  C:\Windows\System\jRfcGet.exe
  2⤵
  PID:11468
- C:\Windows\System\ZoWCDNY.exe
  C:\Windows\System\ZoWCDNY.exe
  2⤵
  PID:11492
- C:\Windows\System\uqNOUPG.exe
  C:\Windows\System\uqNOUPG.exe
  2⤵
  PID:11512
- C:\Windows\System\sOoUzBk.exe
  C:\Windows\System\sOoUzBk.exe
  2⤵
  PID:11532
- C:\Windows\System\kraFqvJ.exe
  C:\Windows\System\kraFqvJ.exe
  2⤵
  PID:11560
- C:\Windows\System\mQEiYjh.exe
  C:\Windows\System\mQEiYjh.exe
  2⤵
  PID:11580
- C:\Windows\System\iGpPhse.exe
  C:\Windows\System\iGpPhse.exe
  2⤵
  PID:11604
- C:\Windows\System\YgroUeS.exe
  C:\Windows\System\YgroUeS.exe
  2⤵
  PID:11628
- C:\Windows\System\bjEuiCL.exe
  C:\Windows\System\bjEuiCL.exe
  2⤵
  PID:11656
- C:\Windows\System\ULAjOOr.exe
  C:\Windows\System\ULAjOOr.exe
  2⤵
  PID:11680
- C:\Windows\System\Jnqoceg.exe
  C:\Windows\System\Jnqoceg.exe
  2⤵
  PID:11700
- C:\Windows\System\cjmHqzO.exe
  C:\Windows\System\cjmHqzO.exe
  2⤵
  PID:11720
- C:\Windows\System\EEHXyYp.exe
  C:\Windows\System\EEHXyYp.exe
  2⤵
  PID:11740
- C:\Windows\System\lGXNYIP.exe
  C:\Windows\System\lGXNYIP.exe
  2⤵
  PID:11760
- C:\Windows\System\egtQvNF.exe
  C:\Windows\System\egtQvNF.exe
  2⤵
  PID:11776
- C:\Windows\System\YzGtGZQ.exe
  C:\Windows\System\YzGtGZQ.exe
  2⤵
  PID:11792
- C:\Windows\System\oLXUGCB.exe
  C:\Windows\System\oLXUGCB.exe
  2⤵
  PID:11808
- C:\Windows\System\DuIphRp.exe
  C:\Windows\System\DuIphRp.exe
  2⤵
  PID:11824
- C:\Windows\System\pRJNxvv.exe
  C:\Windows\System\pRJNxvv.exe
  2⤵
  PID:11840
- C:\Windows\System\ddmfDsA.exe
  C:\Windows\System\ddmfDsA.exe
  2⤵
  PID:11864
- C:\Windows\System\DUezunB.exe
  C:\Windows\System\DUezunB.exe
  2⤵
  PID:11888
- C:\Windows\System\DxkOLbj.exe
  C:\Windows\System\DxkOLbj.exe
  2⤵
  PID:11908
- C:\Windows\System\fDOUSLV.exe
  C:\Windows\System\fDOUSLV.exe
  2⤵
  PID:11932
- C:\Windows\System\sWwpkHH.exe
  C:\Windows\System\sWwpkHH.exe
  2⤵
  PID:11952
- C:\Windows\System\jXqPqtf.exe
  C:\Windows\System\jXqPqtf.exe
  2⤵
  PID:11976
- C:\Windows\System\nBYxicn.exe
  C:\Windows\System\nBYxicn.exe
  2⤵
  PID:12000
- C:\Windows\System\koCnJTS.exe
  C:\Windows\System\koCnJTS.exe
  2⤵
  PID:12024
- C:\Windows\System\ObRafWm.exe
  C:\Windows\System\ObRafWm.exe
  2⤵
  PID:12044
- C:\Windows\System\NWLGkcC.exe
  C:\Windows\System\NWLGkcC.exe
  2⤵
  PID:12068
- C:\Windows\System\QXkayGg.exe
  C:\Windows\System\QXkayGg.exe
  2⤵
  PID:12092
- C:\Windows\System\nddbtrV.exe
  C:\Windows\System\nddbtrV.exe
  2⤵
  PID:12112
- C:\Windows\System\BmXZAFw.exe
  C:\Windows\System\BmXZAFw.exe
  2⤵
  PID:12132
- C:\Windows\System\TDbTTMb.exe
  C:\Windows\System\TDbTTMb.exe
  2⤵
  PID:12160
- C:\Windows\System\HVooBnW.exe
  C:\Windows\System\HVooBnW.exe
  2⤵
  PID:12176
- C:\Windows\System\wMDHETS.exe
  C:\Windows\System\wMDHETS.exe
  2⤵
  PID:12196
- C:\Windows\System\LaDBJBt.exe
  C:\Windows\System\LaDBJBt.exe
  2⤵
  PID:12220
- C:\Windows\System\QXGdPiZ.exe
  C:\Windows\System\QXGdPiZ.exe
  2⤵
  PID:12240
- C:\Windows\System\kjoieIZ.exe
  C:\Windows\System\kjoieIZ.exe
  2⤵
  PID:12264
- C:\Windows\System\PzzBOLx.exe
  C:\Windows\System\PzzBOLx.exe
  2⤵
  PID:12284
- C:\Windows\System\OtaEfbi.exe
  C:\Windows\System\OtaEfbi.exe
  2⤵
  PID:10676
- C:\Windows\System\Nsyrfwp.exe
  C:\Windows\System\Nsyrfwp.exe
  2⤵
  PID:10724
- C:\Windows\System\xLhFksK.exe
  C:\Windows\System\xLhFksK.exe
  2⤵
  PID:10876
- C:\Windows\System\WirNAiZ.exe
  C:\Windows\System\WirNAiZ.exe
  2⤵
  PID:8324
- C:\Windows\System\DZoRvSc.exe
  C:\Windows\System\DZoRvSc.exe
  2⤵
  PID:9448
- C:\Windows\System\UPFmaOk.exe
  C:\Windows\System\UPFmaOk.exe
  2⤵
  PID:8384
- C:\Windows\System\YMZdXjR.exe
  C:\Windows\System\YMZdXjR.exe
  2⤵
  PID:11204
- C:\Windows\System\ZawPBiC.exe
  C:\Windows\System\ZawPBiC.exe
  2⤵
  PID:8464
- C:\Windows\System\BbZKBZt.exe
  C:\Windows\System\BbZKBZt.exe
  2⤵
  PID:8572
- C:\Windows\System\gdtFHyn.exe
  C:\Windows\System\gdtFHyn.exe
  2⤵
  PID:9672
- C:\Windows\System\gAHfjve.exe
  C:\Windows\System\gAHfjve.exe
  2⤵
  PID:8688
- C:\Windows\System\BnbSTpf.exe
  C:\Windows\System\BnbSTpf.exe
  2⤵
  PID:8764
- C:\Windows\System\SNVbjbD.exe
  C:\Windows\System\SNVbjbD.exe
  2⤵
  PID:8828
- C:\Windows\System\XrZzKZW.exe
  C:\Windows\System\XrZzKZW.exe
  2⤵
  PID:9896
- C:\Windows\System\msfrlXY.exe
  C:\Windows\System\msfrlXY.exe
  2⤵
  PID:8920
- C:\Windows\System\XJhVgaQ.exe
  C:\Windows\System\XJhVgaQ.exe
  2⤵
  PID:5496
- C:\Windows\System\mmjtgyN.exe
  C:\Windows\System\mmjtgyN.exe
  2⤵
  PID:9012
- C:\Windows\System\QvwPeio.exe
  C:\Windows\System\QvwPeio.exe
  2⤵
  PID:9872
- C:\Windows\System\NNnGuNE.exe
  C:\Windows\System\NNnGuNE.exe
  2⤵
  PID:9068
- C:\Windows\System\wGAwAOv.exe
  C:\Windows\System\wGAwAOv.exe
  2⤵
  PID:8236
- C:\Windows\System\BIndHbX.exe
  C:\Windows\System\BIndHbX.exe
  2⤵
  PID:7956
- C:\Windows\System\UOAEzAe.exe
  C:\Windows\System\UOAEzAe.exe
  2⤵
  PID:9116
- C:\Windows\System\mpAxQGo.exe
  C:\Windows\System\mpAxQGo.exe
  2⤵
  PID:9184
- C:\Windows\System\GlFnXad.exe
  C:\Windows\System\GlFnXad.exe
  2⤵
  PID:12312
- C:\Windows\System\RlEmXjy.exe
  C:\Windows\System\RlEmXjy.exe
  2⤵
  PID:12332
- C:\Windows\System\IhQTukJ.exe
  C:\Windows\System\IhQTukJ.exe
  2⤵
  PID:12372
- C:\Windows\System\jLkFCfF.exe
  C:\Windows\System\jLkFCfF.exe
  2⤵
  PID:12400
- C:\Windows\System\vJOlOgw.exe
  C:\Windows\System\vJOlOgw.exe
  2⤵
  PID:12416
- C:\Windows\System\wmjdVwP.exe
  C:\Windows\System\wmjdVwP.exe
  2⤵
  PID:12436
- C:\Windows\System\AKcLXAT.exe
  C:\Windows\System\AKcLXAT.exe
  2⤵
  PID:12452
- C:\Windows\System\SCGksye.exe
  C:\Windows\System\SCGksye.exe
  2⤵
  PID:12468
- C:\Windows\System\qdWtDqL.exe
  C:\Windows\System\qdWtDqL.exe
  2⤵
  PID:12488
- C:\Windows\System\aVHZKdL.exe
  C:\Windows\System\aVHZKdL.exe
  2⤵
  PID:12512
- C:\Windows\System\hlObolK.exe
  C:\Windows\System\hlObolK.exe
  2⤵
  PID:12536
- C:\Windows\System\TnnApoz.exe
  C:\Windows\System\TnnApoz.exe
  2⤵
  PID:12560
- C:\Windows\System\BSHGtSm.exe
  C:\Windows\System\BSHGtSm.exe
  2⤵
  PID:12584
- C:\Windows\System\eYYfvCy.exe
  C:\Windows\System\eYYfvCy.exe
  2⤵
  PID:12604
- C:\Windows\System\LLWkWsG.exe
  C:\Windows\System\LLWkWsG.exe
  2⤵
  PID:12624
- C:\Windows\System\JDXGUmJ.exe
  C:\Windows\System\JDXGUmJ.exe
  2⤵
  PID:12644
- C:\Windows\System\ygtANCc.exe
  C:\Windows\System\ygtANCc.exe
  2⤵
  PID:12668
- C:\Windows\System\uzqwHec.exe
  C:\Windows\System\uzqwHec.exe
  2⤵
  PID:12696
- C:\Windows\System\cMKSRPn.exe
  C:\Windows\System\cMKSRPn.exe
  2⤵
  PID:12712
- C:\Windows\System\KVumJxn.exe
  C:\Windows\System\KVumJxn.exe
  2⤵
  PID:12732
- C:\Windows\System\UiFDRPG.exe
  C:\Windows\System\UiFDRPG.exe
  2⤵
  PID:12752
- C:\Windows\System\ITkIVXf.exe
  C:\Windows\System\ITkIVXf.exe
  2⤵
  PID:12780
- C:\Windows\System\fHLHXnX.exe
  C:\Windows\System\fHLHXnX.exe
  2⤵
  PID:12804
- C:\Windows\System\JBHtALa.exe
  C:\Windows\System\JBHtALa.exe
  2⤵
  PID:12824
- C:\Windows\System\gaLYGCn.exe
  C:\Windows\System\gaLYGCn.exe
  2⤵
  PID:12844
- C:\Windows\System\JqqsBwL.exe
  C:\Windows\System\JqqsBwL.exe
  2⤵
  PID:12868
- C:\Windows\System\VmnJwQp.exe
  C:\Windows\System\VmnJwQp.exe
  2⤵
  PID:12892
- C:\Windows\System\WEOXivn.exe
  C:\Windows\System\WEOXivn.exe
  2⤵
  PID:12916
- C:\Windows\System\cndLjKX.exe
  C:\Windows\System\cndLjKX.exe
  2⤵
  PID:12936
- C:\Windows\System\FweeROa.exe
  C:\Windows\System\FweeROa.exe
  2⤵
  PID:12956
- C:\Windows\System\xtaeRYg.exe
  C:\Windows\System\xtaeRYg.exe
  2⤵
  PID:12976
- C:\Windows\System\xZMGjcW.exe
  C:\Windows\System\xZMGjcW.exe
  2⤵
  PID:13000
- C:\Windows\System\QrMIoFw.exe
  C:\Windows\System\QrMIoFw.exe
  2⤵
  PID:13024
- C:\Windows\System\fWGvKlQ.exe
  C:\Windows\System\fWGvKlQ.exe
  2⤵
  PID:13040
- C:\Windows\System\zLSmcCB.exe
  C:\Windows\System\zLSmcCB.exe
  2⤵
  PID:13060
- C:\Windows\System\iGKxFLf.exe
  C:\Windows\System\iGKxFLf.exe
  2⤵
  PID:13084
- C:\Windows\System\xwGnThc.exe
  C:\Windows\System\xwGnThc.exe
  2⤵
  PID:13108
- C:\Windows\System\wACBsak.exe
  C:\Windows\System\wACBsak.exe
  2⤵
  PID:13128
- C:\Windows\System\LIESGfp.exe
  C:\Windows\System\LIESGfp.exe
  2⤵
  PID:13152
- C:\Windows\System\OMrQMOX.exe
  C:\Windows\System\OMrQMOX.exe
  2⤵
  PID:13168
- C:\Windows\System\IjypOYe.exe
  C:\Windows\System\IjypOYe.exe
  2⤵
  PID:13188
- C:\Windows\System\wTUrycK.exe
  C:\Windows\System\wTUrycK.exe
  2⤵
  PID:13204
- C:\Windows\System\ImXKTZN.exe
  C:\Windows\System\ImXKTZN.exe
  2⤵
  PID:13220
- C:\Windows\System\KWpKszx.exe
  C:\Windows\System\KWpKszx.exe
  2⤵
  PID:13236
- C:\Windows\System\UMECMuH.exe
  C:\Windows\System\UMECMuH.exe
  2⤵
  PID:13260
- C:\Windows\System\ZBpRwhR.exe
  C:\Windows\System\ZBpRwhR.exe
  2⤵
  PID:9524
- C:\Windows\System\RuflArW.exe
  C:\Windows\System\RuflArW.exe
  2⤵
  PID:9596
- C:\Windows\System\RezvShM.exe
  C:\Windows\System\RezvShM.exe
  2⤵
  PID:8900
- C:\Windows\System\QHdKmKO.exe
  C:\Windows\System\QHdKmKO.exe
  2⤵
  PID:8948
- C:\Windows\System\jfpmcuM.exe
  C:\Windows\System\jfpmcuM.exe
  2⤵
  PID:4744
- C:\Windows\System\XuHStEN.exe
  C:\Windows\System\XuHStEN.exe
  2⤵
  PID:8488
- C:\Windows\System\LXRnQsN.exe
  C:\Windows\System\LXRnQsN.exe
  2⤵
  PID:11004
- C:\Windows\System\HBGRDGC.exe
  C:\Windows\System\HBGRDGC.exe
  2⤵
  PID:6116
- C:\Windows\System\PzaRCmh.exe
  C:\Windows\System\PzaRCmh.exe
  2⤵
  PID:8208
- C:\Windows\System\zDKFnwT.exe
  C:\Windows\System\zDKFnwT.exe
  2⤵
  PID:11420
- C:\Windows\System\VIcmHIy.exe
  C:\Windows\System\VIcmHIy.exe
  2⤵
  PID:11500
- C:\Windows\System\WZGdqyu.exe
  C:\Windows\System\WZGdqyu.exe
  2⤵
  PID:11544
- C:\Windows\System\vBeHQgy.exe
  C:\Windows\System\vBeHQgy.exe
  2⤵
  PID:11616
- C:\Windows\System\YmurZio.exe
  C:\Windows\System\YmurZio.exe
  2⤵
  PID:11756
- C:\Windows\System\nJmlCMK.exe
  C:\Windows\System\nJmlCMK.exe
  2⤵
  PID:7600
- C:\Windows\System\eXhPiet.exe
  C:\Windows\System\eXhPiet.exe
  2⤵
  PID:12100
- C:\Windows\System\FAZmvje.exe
  C:\Windows\System\FAZmvje.exe
  2⤵
  PID:9720
- C:\Windows\System\PEvVxzo.exe
  C:\Windows\System\PEvVxzo.exe
  2⤵
  PID:11396
- C:\Windows\System\WOSzzQz.exe
  C:\Windows\System\WOSzzQz.exe
  2⤵
  PID:9008
- C:\Windows\System\hKBONvZ.exe
  C:\Windows\System\hKBONvZ.exe
  2⤵
  PID:7628
- C:\Windows\System\GQdRPkX.exe
  C:\Windows\System\GQdRPkX.exe
  2⤵
  PID:6160
- C:\Windows\System\GaSlolt.exe
  C:\Windows\System\GaSlolt.exe
  2⤵
  PID:12296
- C:\Windows\System\zWCJMIt.exe
  C:\Windows\System\zWCJMIt.exe
  2⤵
  PID:12348
- C:\Windows\System\uZrfIDg.exe
  C:\Windows\System\uZrfIDg.exe
  2⤵
  PID:10984
- C:\Windows\System\mSzawjv.exe
  C:\Windows\System\mSzawjv.exe
  2⤵
  PID:12364
- C:\Windows\System\ZNYkvyz.exe
  C:\Windows\System\ZNYkvyz.exe
  2⤵
  PID:12412
- C:\Windows\System\oYsltWA.exe
  C:\Windows\System\oYsltWA.exe
  2⤵
  PID:12464
- C:\Windows\System\zzoLpAK.exe
  C:\Windows\System\zzoLpAK.exe
  2⤵
  PID:12544
- C:\Windows\System\xwIvRpQ.exe
  C:\Windows\System\xwIvRpQ.exe
  2⤵
  PID:12632
- C:\Windows\System\BreODlr.exe
  C:\Windows\System\BreODlr.exe
  2⤵
  PID:12720
- C:\Windows\System\psDmZsU.exe
  C:\Windows\System\psDmZsU.exe
  2⤵
  PID:12832
- C:\Windows\System\mPgtLRz.exe
  C:\Windows\System\mPgtLRz.exe
  2⤵
  PID:12904
- C:\Windows\System\ZWQSBuM.exe
  C:\Windows\System\ZWQSBuM.exe
  2⤵
  PID:12984
- C:\Windows\System\ENRrwKj.exe
  C:\Windows\System\ENRrwKj.exe
  2⤵
  PID:13036
- C:\Windows\System\ENdgtkx.exe
  C:\Windows\System\ENdgtkx.exe
  2⤵
  PID:13140
- C:\Windows\System\DDYFPFV.exe
  C:\Windows\System\DDYFPFV.exe
  2⤵
  PID:13248
- C:\Windows\System\rpgxsOt.exe
  C:\Windows\System\rpgxsOt.exe
  2⤵
  PID:7836
- C:\Windows\System\WIaGNGF.exe
  C:\Windows\System\WIaGNGF.exe
  2⤵
  PID:5564
- C:\Windows\System\EIzqLTZ.exe
  C:\Windows\System\EIzqLTZ.exe
  2⤵
  PID:4492
- C:\Windows\System\qMoitkS.exe
  C:\Windows\System\qMoitkS.exe
  2⤵
  PID:12324
- C:\Windows\System\TAHPBrF.exe
  C:\Windows\System\TAHPBrF.exe
  2⤵
  PID:10912
- C:\Windows\System\IdUjFhp.exe
  C:\Windows\System\IdUjFhp.exe
  2⤵
  PID:7212
- C:\Windows\System\JrDKcLk.exe
  C:\Windows\System\JrDKcLk.exe
  2⤵
  PID:11084
- C:\Windows\System\KrNWwOj.exe
  C:\Windows\System\KrNWwOj.exe
  2⤵
  PID:11596
- C:\Windows\System\yjnTHGs.exe
  C:\Windows\System\yjnTHGs.exe
  2⤵
  PID:3780
- C:\Windows\System\uGyZbQv.exe
  C:\Windows\System\uGyZbQv.exe
  2⤵
  PID:10668
- C:\Windows\System\faNybJJ.exe
  C:\Windows\System\faNybJJ.exe
  2⤵
  PID:12708
- C:\Windows\System\NYYMEzR.exe
  C:\Windows\System\NYYMEzR.exe
  2⤵
  PID:1840
- C:\Windows\System\MmZOMEW.exe
  C:\Windows\System\MmZOMEW.exe
  2⤵
  PID:10172
- C:\Windows\System\vXRZryr.exe
  C:\Windows\System\vXRZryr.exe
  2⤵
  PID:9796
- C:\Windows\System\jfNPbEe.exe
  C:\Windows\System\jfNPbEe.exe
  2⤵
  PID:10808
- C:\Windows\System\WZtcVJs.exe
  C:\Windows\System\WZtcVJs.exe
  2⤵
  PID:12616
- C:\Windows\System\rSiPvzn.exe
  C:\Windows\System\rSiPvzn.exe
  2⤵
  PID:11236
- C:\Windows\System\LZBgQjR.exe
  C:\Windows\System\LZBgQjR.exe
  2⤵
  PID:11144
- C:\Windows\System\YdgrHMM.exe
  C:\Windows\System\YdgrHMM.exe
  2⤵
  PID:5100
- C:\Windows\System\FgCKTDY.exe
  C:\Windows\System\FgCKTDY.exe
  2⤵
  PID:8212
- C:\Windows\System\NpTGKJQ.exe
  C:\Windows\System\NpTGKJQ.exe
  2⤵
  PID:11384
- C:\Windows\System\udmUQbE.exe
  C:\Windows\System\udmUQbE.exe
  2⤵
  PID:9028
- C:\Windows\System\BPATYfq.exe
  C:\Windows\System\BPATYfq.exe
  2⤵
  PID:9668
- C:\Windows\System\FczPaBU.exe
  C:\Windows\System\FczPaBU.exe
  2⤵
  PID:12576
- C:\Windows\System\vyaSCGU.exe
  C:\Windows\System\vyaSCGU.exe
  2⤵
  PID:4852
- C:\Windows\System\oOSZWWo.exe
  C:\Windows\System\oOSZWWo.exe
  2⤵
  PID:11044
- C:\Windows\System\jRgbsPx.exe
  C:\Windows\System\jRgbsPx.exe
  2⤵
  PID:3676
- C:\Windows\System\hVwJLde.exe
  C:\Windows\System\hVwJLde.exe
  2⤵
  PID:8444
- C:\Windows\System\OgZcPGU.exe
  C:\Windows\System\OgZcPGU.exe
  2⤵
  PID:12276
- C:\Windows\System\mCLeIjX.exe
  C:\Windows\System\mCLeIjX.exe
  2⤵
  PID:4312
- C:\Windows\System\uaNAyTO.exe
  C:\Windows\System\uaNAyTO.exe
  2⤵
  PID:744
- C:\Windows\System\zLtBkbk.exe
  C:\Windows\System\zLtBkbk.exe
  2⤵
  PID:3520
- C:\Windows\System\uZVuIMt.exe
  C:\Windows\System\uZVuIMt.exe
  2⤵
  PID:2356
- C:\Windows\System\qyyEWOW.exe
  C:\Windows\System\qyyEWOW.exe
  2⤵
  PID:11800
- C:\Windows\System\ILLnWbU.exe
  C:\Windows\System\ILLnWbU.exe
  2⤵
  PID:3316
- C:\Windows\System\YOwKNHG.exe
  C:\Windows\System\YOwKNHG.exe
  2⤵
  PID:5580
- C:\Windows\System\CdgtFdv.exe
  C:\Windows\System\CdgtFdv.exe
  2⤵
  PID:6332
- C:\Windows\System\IHNRMYQ.exe
  C:\Windows\System\IHNRMYQ.exe
  2⤵
  PID:6268
- C:\Windows\System\YpoXVJf.exe
  C:\Windows\System\YpoXVJf.exe
  2⤵
  PID:8240
- C:\Windows\System\rdSLVmJ.exe
  C:\Windows\System\rdSLVmJ.exe
  2⤵
  PID:5012
- C:\Windows\System\IgDBxMV.exe
  C:\Windows\System\IgDBxMV.exe
  2⤵
  PID:3252
- C:\Windows\System\kvmgjHW.exe
  C:\Windows\System\kvmgjHW.exe
  2⤵
  PID:6508
- C:\Windows\System\rzDQMXv.exe
  C:\Windows\System\rzDQMXv.exe
  2⤵
  PID:3772
- C:\Windows\System\iTJXCEp.exe
  C:\Windows\System\iTJXCEp.exe
  2⤵
  PID:13144
- C:\Windows\System\dvVXgei.exe
  C:\Windows\System\dvVXgei.exe
  2⤵
  PID:11924
- C:\Windows\System\amrkrby.exe
  C:\Windows\System\amrkrby.exe
  2⤵
  PID:9504
- C:\Windows\System\SInmUMU.exe
  C:\Windows\System\SInmUMU.exe
  2⤵
  PID:6696
- C:\Windows\System\KnNDwMU.exe
  C:\Windows\System\KnNDwMU.exe
  2⤵
  PID:8132
- C:\Windows\System\ImXsneK.exe
  C:\Windows\System\ImXsneK.exe
  2⤵
  PID:1328

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe c85890d8dec8d66600eb8687dde45c38 4qz548cWFUerQlTFUcRf9A.0.1.0.0.0
1⤵
PID:12512
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:12536

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:9704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_hvrurd2s.vbf.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hvrurd2s.vbf.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

BRTfEHn.exe

Path C:\Windows\System\BRTfEHn.exe
Size 1.8MB
SHA256 649acc42053601ad1cd658b6d34e7f298104068a37a89a6ac07583f8c073a13c
MD5 743faf42ffef0cf76a2b2fb6a5f3a9ca
SHA1 e219c8e430251466913e13af215a925030d2a58e
SHA512 cca898b1f712c01f2992e9774ff379d2d85a4798fbc5076f4acb75c7d431948242c4217455e085bbba2ee4e6ed691cbc785c49ea903f6797d7ac319fd53e674b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD17:Lz071uv4BPMkFfdg6NsIRSwV7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

CfHNuOw.exe

Path C:\Windows\System\CfHNuOw.exe
Size 1.8MB
SHA256 9b08bd53fc70a3124c825efcf17d0cab456777e13e7b6c5aea7325a1252f7c88
MD5 4007a5fff57640ed35fd3c645e86fac9
SHA1 250ae70b6debb9602b11fb42c1a36212ced5774f
SHA512 1a3a10e75e7bd674a98613279f08a885cfc37ab4b8fde19f54e3a9adfeaf9a14e7a906260e574bd863bc031ab2b3582d3abcd6e85b8ada0c588a3c6c254fd31a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1m:Lz071uv4BPMkFfdg6NsIRSwV7Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

EMLBhqP.exe

Path C:\Windows\System\EMLBhqP.exe
Size 1.8MB
SHA256 906b8a89116d63915b29d26caa37608c903a1ff9e76707a37f905793e86bd298
MD5 ae2518623f0cf8e0a104d74ae76f7c7c
SHA1 7324101ee0b09dc5d42ff1b5e2695535f80c8aca
SHA512 8ddeb3a32b0940e795893430fa27a3d0706d378cd1d9ac4759769b739a50df7bc045d1702040357d2c9e3a1904a370cfd37428586aeb8df7ac5c819cb799df5a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1W:Lz071uv4BPMkFfdg6NsIRSwV7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

FJSFStS.exe

Path C:\Windows\System\FJSFStS.exe
Size 1.8MB
SHA256 4b3c5801c56c0ac340a6b3c96d391fc5cb9325d47f1f99bebd4997bb89cda53a
MD5 b6fabc488ce5319656c093dfff021a6e
SHA1 b62bd2243ae63cc5a04235e7b9c5388b1a7142d9
SHA512 b710fd9a8901a083f99f77a9109d19d3b1575e283e59bf9c4b915d592256cfb8b377d5cc9454eb2de54164701ea164fa7a2e488c3b7704dffe2a152db91fe874
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1z:Lz071uv4BPMkFfdg6NsIRSwV7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

HsovFTa.exe

Path C:\Windows\System\HsovFTa.exe
Size 1.8MB
SHA256 7af7a3458f08543eef9f0d487d54faa7d01f7e700d272d5f08f9162c0de236cb
MD5 36a5a6631fac2e2b72fc7192cb99ee6d
SHA1 efc750fbf654f3cbaca295495dedbffcf588ef15
SHA512 85683e71792be77bdefd1c843fae7e50c6ff1c8530d2a00efdd5e55ae9fe00141894f8e3212de3e55bff1d47c81bd0aff1048c9a079cb4a6a29e884937e037fc
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD16:Lz071uv4BPMkFfdg6NsIRSwV7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

HyZFEPA.exe

Path C:\Windows\System\HyZFEPA.exe
Size 1.8MB
SHA256 ecfdb799a3a8f281367b8caad6d44a4df5d6b3e98a735a8f071728af3f1b0436
MD5 ab29800cc6fc9118d2ec8d8382859afa
SHA1 c90d96196196037a8e804292c9c50c57af1487cc
SHA512 4f2ccf4609389c90a956dddbf0a4f1446ca58921bd20d2adc0896b25f6eb3656b42e8b6c4c286b8b2ff0cbba74bd9f38788fce8742559edce6ec9c078782f922
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD10:Lz071uv4BPMkFfdg6NsIRSwV76
MD5 SHA1 SHA512 SSDEEP

Submit Download

IPVjpPe.exe

Path C:\Windows\System\IPVjpPe.exe
Size 1.8MB
SHA256 ab994e3c9f91d09732f8ce9f32b9c6a22a1c8ef8d3fb7e22f4acaa6ee8693b5c
MD5 ab56a6c7c573c8c05984ea02695df511
SHA1 16147bb52f9984e165cb0505892ce59c29e154ec
SHA512 d708391fe6aaeaa82018e7425c2ac58364f7f5d32c584338a46a8defdf7f30b7a01b66fd84c2551705846a300a5a74216c7d0b2c8802cad79943de7ce9a8dfd3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1m+:Lz071uv4BPMkFfdg6NsIRSwV7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

JmbqmNo.exe

Path C:\Windows\System\JmbqmNo.exe
Size 1.8MB
SHA256 61e341d47c40836c1d738e5ad02bb7cc3d6ce87d42de2f8505b51ae8156f2c6b
MD5 cc463000b867db8b5ce792f5f4d76135
SHA1 22908b341b6bc4b50c7e690c7b4bf20d6caca14d
SHA512 413ebcb7d9ef8bd2290d57eeeb735e4c5ebbe1ec01ee266c34da4d9d3d95ec92b85701d565b310cd54c9de58736bcda300685186df84eaa870853a96d8dc060e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1h+:Lz071uv4BPMkFfdg6NsIRSwV7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

KkuuRQW.exe

Path C:\Windows\System\KkuuRQW.exe
Size 1.8MB
SHA256 399e92cc8dccd74092e75e46e3cd879b2f965206f71a260c10dad01d4859cc50
MD5 359baa46ceff3389c4fda1019d8d2de7
SHA1 e8df09bd48c5c03f68c1f8daefc613be4e7ffbfc
SHA512 1debe719bf417ebd1e2f6478344d6d5861c620d308d811c9b31ffaf3e8f74ca6d24baf91e2e768418b2a0abec8ecf287f148e5beb91b486f70fa5640df0d4996
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1B:Lz071uv4BPMkFfdg6NsIRSwV7z
MD5 SHA1 SHA512 SSDEEP

Submit Download

KuBshiA.exe

Path C:\Windows\System\KuBshiA.exe
Size 1.8MB
SHA256 3e94f61ef80abb6497d95e1d966ba854a8e22d12825d8c635678a5968d673438
MD5 82e89b8e6324bf43ec62181627684e39
SHA1 132959c7164a83e668a02d8f80ef3634ddcdb398
SHA512 d34fcc0309b6c2ca66e1b7c69a6c7cc4fd3b6831216b84fd97aef40df5dd021a9e479a277cbefc539c726c3a7f00077885704f8bca7c993e71f19575b85782fd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1L:Lz071uv4BPMkFfdg6NsIRSwV7F
MD5 SHA1 SHA512 SSDEEP

Submit Download

LNkbWiC.exe

Path C:\Windows\System\LNkbWiC.exe
Size 1.8MB
SHA256 974c1ec87a3d8a631c5931e9f04babf8cc2230104cacd6fc30e47d7abfa4db17
MD5 182650eae9f6068cd544e8c165395a21
SHA1 243e2530e1d4e91041647c3c5fffd8d1c60b7016
SHA512 a176bd67927fe0c4c226f160b0eb905045c422810ba01ffa39d1fa37c41411ed7bc31256103797706d376a0797413939e329655fb8aadbea71a9f96de61b2cfe
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1A:Lz071uv4BPMkFfdg6NsIRSwV7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

LdOexgv.exe

Path C:\Windows\System\LdOexgv.exe
Size 1.8MB
SHA256 906da3dbe011391baa627f534472d475bc6444cc27975b4a82679dbf15f469e2
MD5 db173b75ac081b57e712314af1082b4d
SHA1 f4c7654abb417745d4f60d6a87f842b267fea896
SHA512 aa5f1a0cafc3bd3fcd85b1bd6d4b851456311d2792240ce4ed45356e57221906f78f7b584f4275b31e65b20c0523f819a9ba011aca6fb465f295363e5e52b019
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1chx:Lz071uv4BPMkFfdg6NsIRSwV7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

LmnVuoo.exe

Path C:\Windows\System\LmnVuoo.exe
Size 1.8MB
SHA256 0e8c2addaacb4a128ecb511774d113677ef9a90bc93e3818bc11b6acc851f413
MD5 b770956b5fd5a50796ef5921c4540a82
SHA1 a3da3a293b8da4163a1b9a2d9885ff7453ed3cc5
SHA512 0b20e56d0ea72a47bfd7c7416443194b9445382b96bb4762b0b3fa4f2ccc2501c94c32b569a3a51899f8faa6a200d68c5a127f9cd939105d5746cec94454c195
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1x:Lz071uv4BPMkFfdg6NsIRSwV7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

MWtRpaK.exe

Path C:\Windows\System\MWtRpaK.exe
Size 1.8MB
SHA256 991f5ae7f189c6fd9c5db6a5a48fd50b03647c56c171942804a6502b1e0e9ac5
MD5 f7dd71005e74baadf0b1ca0725e57a9d
SHA1 66804192e6240c67970064b2d2b6524642824ed6
SHA512 34d4cd3a0f8b34225dc95670d5de5d886832be22ddf9fe861937e8448de89d5dd732b21d6f301c8f109c050bf978fe146d0d31007f9d42914e7e01f883326fbd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1m:Lz071uv4BPMkFfdg6NsIRSwV7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

NwspqEo.exe

Path C:\Windows\System\NwspqEo.exe
Size 1.8MB
SHA256 870bdc4b5c1e42e421cfe924c9b99066a12fbfe312a36303043c3c1acb401cbe
MD5 4e5c412f13a6df6a10da3f75937d1160
SHA1 c29e0406362d7fb434aac06dd7d25c7c727e1029
SHA512 7fd9d79d2aa088a45e0250300ac5121ea3387bb19328b8b42b69cb73c43ca6d813de53bc6bfe31a70bb0f2abc3762e16dd88fbe0fb5e4a08b394c3b4d882eebf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1G:Lz071uv4BPMkFfdg6NsIRSwV7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

NzBezyq.exe

Path C:\Windows\System\NzBezyq.exe
Size 1.8MB
SHA256 96e687ca60cb791ee422a4a91df649beef98785db76b3f905bc0ad701e5b3d4c
MD5 d2d2ae2b0e1871fa062fbda133be421e
SHA1 f5624e04c029e2e31664d3cfecff41448f0e16af
SHA512 87a3352e4c55bc68cfdb68ebb1bde79c6f181a717e7b2ce64502d88a96a4ebd07f3710a7a06bafd897b52acfbfb1b7f7588ca18a579953a3e6b57ae7a31cdbbd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD13:Lz071uv4BPMkFfdg6NsIRSwV7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

QnKroZN.exe

Path C:\Windows\System\QnKroZN.exe
Size 1.8MB
SHA256 45101835792b4865c923fafbe80e926c686f16a27d1cd8ed723104845d6099f3
MD5 cfa63f7bba462bc52216d6e3c64daf61
SHA1 b38897f7158ac491a6dde5b1566aeb73fce67b1e
SHA512 0323a8157a84901d03b263ffecdc06f4f21aa54a9278105d31b4ac0fea32798c3eee9fdb05eec1bc89375063088c1019b5d2a27f3cb3d8c823f0052d5b8a2f26
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1U:Lz071uv4BPMkFfdg6NsIRSwV7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

TJlhCHG.exe

Path C:\Windows\System\TJlhCHG.exe
Size 1.8MB
SHA256 977c8324b1658825e61d2c8e78697a856fb4d207379d701fe4ea3c2fed2c1c79
MD5 a818a91ee254a9975df9c64b69107a88
SHA1 c1802394f0f9444b29b3d8e41ac880b467848272
SHA512 2f6b9070db1ad150c32b686c7f07fa9bad2101f5f818066817a9f5bc21c264f1ba1b06f015d6145a20632052eb33a72fee3b650a32216a7298c61c6b68a816ea
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1P:Lz071uv4BPMkFfdg6NsIRSwV7x
MD5 SHA1 SHA512 SSDEEP

Submit Download

UeVNwVL.exe

Path C:\Windows\System\UeVNwVL.exe
Size 1.8MB
SHA256 1c3a64e3f3d5f2892741044e6309bbb5a21a55e60a973195f0f1ab4680e1f6a2
MD5 401c8332c37465d87ce277bd89e0c026
SHA1 2f21e9455af9432c390e4cd57d9bb2280eebe393
SHA512 03717e4a585139ad6363ab8b559fcdac4b3878c43367be8b0c92c362c26750daa3cf156aa06c8a445c4088000ab3654cce45ddaea3c8066c6bc5b01297438885
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1c:Lz071uv4BPMkFfdg6NsIRSwV7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

WKsULmJ.exe

Path C:\Windows\System\WKsULmJ.exe
Size 1.8MB
SHA256 7fdafe7f4dc4aa479fafadd4c94e87c952a33c07e1ac2c9db8946c64fffdca0a
MD5 cf45479cf8973a59b04b2c39b752bf8a
SHA1 f68cb48f29d71070b076712512a88a9b4b7fde74
SHA512 a4507e9024ce569206aebaf654c3f4e208747af4f687bf405b5a1badad7b8c0db8643b90d98244ce7a7a158de4a08e872444bada6f0669ecf14fb8b4a11bb657
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD17a:Lz071uv4BPMkFfdg6NsIRSwV7Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

XQeJoHr.exe

Path C:\Windows\System\XQeJoHr.exe
Size 1.8MB
SHA256 b82577eb5ac0e844ee719648868a21a45081abde86a4d77325d4e74e116a01e4
MD5 d55fd62789b1e98e572762c13884449c
SHA1 0d2db5214fc2331bbaf607d2232922acaaf6463e
SHA512 dcb6d50fd66565d8ad0b7df02f7b8057704ab0f2298fefcbc780191e6239c107064235f9ffac7f9ce32576e33e43552ad30ae80fc09c033dcef66c6e8aca0edb
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD17:Lz071uv4BPMkFfdg6NsIRSwV7N
MD5 SHA1 SHA512 SSDEEP

Submit Download

XUCpQIr.exe

Path C:\Windows\System\XUCpQIr.exe
Size 1.8MB
SHA256 81bf55a06ff578a72b08ed53fbfb57df71747d3f8226bade69c084c74127c60d
MD5 a66d16477bdee13b6418d131d7ac16b6
SHA1 23ab4412b946eaa61a47cffd4ac6c30938fdbd44
SHA512 8d5ec6ef8bd2b4b50b2219ff2467c86d30a6d086716b1eb161de43714bdf50ee39c1dbee4a79fb05a83e2318507ccaab32ea59e92c3e2d9968c942df637372ed
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1a:Lz071uv4BPMkFfdg6NsIRSwV7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZGYhLfG.exe

Path C:\Windows\System\ZGYhLfG.exe
Size 1.8MB
SHA256 4f6c4397ea8f3ab4b2cdf1f127ea8772eb6e7fbb5e5272a179cdb2b9fcb830fe
MD5 272142ff9b4d44cc994cfde82e397967
SHA1 c0fb26526ea10fe249038d7f64b648022e361d64
SHA512 9595f63529ad896ee1f02588db6c071796cfa30815f57d1afd5277ded263732b22643bcf2b1121b519b7bd13af7c463f3eb0d5b15648bd9712edf694e8bd66b4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1m:Lz071uv4BPMkFfdg6NsIRSwV7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZVmvTdu.exe

Path C:\Windows\System\ZVmvTdu.exe
Size 1.8MB
SHA256 a34f585d9e6480882c53ae50dc3ee6c2ce8236d31d9faa8d110b8c25efd54481
MD5 a77e2f1732946d2100e87059187e5b56
SHA1 fc1375fec71114e655bf63ee8a0a263835102946
SHA512 c4f6ac9ebecda234e68c8de2d1b5599392066b39c4596e147bd427076bbf46fb01e46fbcbd31a32cdb23ea277c7a3b47e9edcfbe0db272ebcb14703b25557604
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1rnE:Lz071uv4BPMkFfdg6NsIRSwV7tE
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZlPTmAk.exe

Path C:\Windows\System\ZlPTmAk.exe
Size 1.8MB
SHA256 bf74525e7771aee26d8283c108d37ff5e405839cb4ec1a5166cdefd1f6862218
MD5 4dc54b4aa6c7ee05e4367ced3c14bc13
SHA1 211978645d6d185f591177f6d6e3b9a1835149ac
SHA512 e157158a8d6f0b7ea340202b6285db68a424bb1efecf3095d4dd6e9c99bfc2f04e1bf4da0c4a5aa32b1b483638313283876d532a221d94d4a65f65f05893b477
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1TO:Lz071uv4BPMkFfdg6NsIRSwV7FO
MD5 SHA1 SHA512 SSDEEP

Submit Download

bDeJfpj.exe

Path C:\Windows\System\bDeJfpj.exe
Size 1.8MB
SHA256 865cd2e401afaa1c27db5d7ca44b71c8c704be9e0d992884d781bdba35532718
MD5 dc315794e82aa013c79d848326286c45
SHA1 c21326e1e52d213b711c121d6f5e04bcb199b25f
SHA512 c70972b2cbd26016c9993f736919452704c3c0a9f6ee114fad5998c831fc07f622a49adf55ff307aa296592d720612327b6ec55a607f283d319abdf20375df8d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1jQ:Lz071uv4BPMkFfdg6NsIRSwV7hQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

cRJdLvB.exe

Path C:\Windows\System\cRJdLvB.exe
Size 1.8MB
SHA256 60d7ae72c0ab3e7eca686373bba18e3d77bdfdb729fa013bfcfd9858c1a99067
MD5 886f7e2714245c8fdfef4cbe693397af
SHA1 485dc56df0532e9e1e5a1be44ffaeef6c78d586d
SHA512 9a0661910cccca9829fbcf32e8d0d00d34c583ab833e71b323dba45125ca3783e787852da20fdc43c54c5ca0b6b827a4872e7a2403c69ed3472a9def0ef525c5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1u:Lz071uv4BPMkFfdg6NsIRSwV7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

gCgBoqN.exe

Path C:\Windows\System\gCgBoqN.exe
Size 1.8MB
SHA256 8242252e5f6ab13c7672bdf637816daded662e91ffd4f5cc030166289539aa9c
MD5 c18c95380587e1560427ca983568d152
SHA1 175bc9baa69eb3685d454a1d1db542c5011316f4
SHA512 32c3f622c4bd0eade13f1d670e316d3d81f54b97c1ba9f2bdd223c59653d40793eac68e36814b107c1068ef41b8a1056b79593c03ff48c28546c87abaa38734e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1G:Lz071uv4BPMkFfdg6NsIRSwV7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

jeDtVeI.exe

Path C:\Windows\System\jeDtVeI.exe
Size 1.8MB
SHA256 202cdcbbad2a2cb20ef4d29e6d30682a5e0e3d261e774da4bbd04675c8822217
MD5 ff5ded3b9ce93338ccd8080922885061
SHA1 3ca128b558f3c8158c87036d5dab5f17f327528e
SHA512 91efab0de37eb0dacd9e5efddda63c4e6c866296ce660106383c59b5831a4d560020dc8ee90a5b9304cc5302a21cf7335186e03fabf7595042b5ac81b7f80e33
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1w:Lz071uv4BPMkFfdg6NsIRSwV7y
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhrsRUi.exe

Path C:\Windows\System\jhrsRUi.exe
Size 1.8MB
SHA256 b17250ef8d608f7e581364927e18523f5a43bb41089720bb5bd5684fd490b644
MD5 438bfbfd6613261d917119290ea94590
SHA1 cff71f232f522eb6d22c8ca31a038a763e8c2778
SHA512 81819581218a47bd1423174c7dacd35a8570d3a2a3767fd9d7467bd8f36306a73defbb09c9e6b8509f008f879b63afc472b70bdefd0d777a277e0baba62388ff
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD12:Lz071uv4BPMkFfdg6NsIRSwV7g
MD5 SHA1 SHA512 SSDEEP

Submit Download

klcHRBf.exe

Path C:\Windows\System\klcHRBf.exe
Size 1.8MB
SHA256 695fc4380c09d654c6a9fa26ccdb0f7c82f0b9e6f8cd5d411d845c909d5f8fce
MD5 669d50f9d9adae22e700560ec3d90849
SHA1 45ed9afa729635d1391a0ca83f856a7cc6aa7e64
SHA512 db03fbc110e491be9c506f9d0c0aafd2a275c2a00408c964a529274acaf1b52aa3a2f2a0a9033fc290d00280df107a956d6f8e1a8d3459d12398e2b90cbe4592
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD11I:Lz071uv4BPMkFfdg6NsIRSwV7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

nMzRTKe.exe

Path C:\Windows\System\nMzRTKe.exe
Size 1.8MB
SHA256 aa039b90c186840b4a4e313475cd6e9d1ace2cc5e266c071ef637c2c056be099
MD5 4aa17608cfac22a03263f1ad7fee2291
SHA1 54eef6ee190f87f947591ee4496e80c69f7e7332
SHA512 49e9ebf104a35b639c9aa8822f63b7dc000c8e3178c39c59e1a7936e4f8ace319d64bb01ccad4af743967abd0d9cbe20a3e9b57e633edc89fa3778d47433bdaa
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1l:Lz071uv4BPMkFfdg6NsIRSwV7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

oontZLu.exe

Path C:\Windows\System\oontZLu.exe
Size 1.8MB
SHA256 d582cc77b9458820a7812fbb1d00eb82ab3d9cafdcc9fcde17b039e44b482df4
MD5 ea05a5f8dc9a6e344d92859442d6d425
SHA1 340b2989a85cea01356aff37f4ea459b89224a9b
SHA512 1944cac8193d54a3d7f7eec3f6b36dec42a4203218bcc80b63a961fc2e16939ef70a9071fded66249a6fee022dacd9d22e2e6dc59a917849cf318909c79d2d27
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD17I:Lz071uv4BPMkFfdg6NsIRSwV75I
MD5 SHA1 SHA512 SSDEEP

Submit Download

pbYAXSc.exe

Path C:\Windows\System\pbYAXSc.exe
Size 1.8MB
SHA256 5db5c03ea38485fb208719c8a322d6582eeb7513bd12ff29195458683e9f4cd7
MD5 c8adbd774e738521c31686fa291193d9
SHA1 34130edb367e10c7e7f878dfc003524083a802d7
SHA512 80b979ce4cbaaabc32abf7fe45269c0ee909a9f3989d9e2252bf29399845cf6a1bf81e9e4d740cb4d175ec53d19bd9c0ad8191f58c6d55646e18cf8683acc508
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1xY:Lz071uv4BPMkFfdg6NsIRSwV7U
MD5 SHA1 SHA512 SSDEEP

Submit Download

pueMwNs.exe

Path C:\Windows\System\pueMwNs.exe
Size 1.8MB
SHA256 2f728736cef4e7da9d46aee523290ac1a86c00ee8903aa0235e9610658c8dd86
MD5 16ccbc1a63c0a0f9db73dafd42dddaad
SHA1 6a674b1485f8b8a5aab2bc7d0e1160077ec14a74
SHA512 d1be934a8bf1904fa5359813316ee6e2d8915e44fbabb3cb3b5d0eaa10f98acb75ef8c68d7586d524286143d5edc13077942a158785b798fc953db9921dd7187
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1/3u:Lz071uv4BPMkFfdg6NsIRSwV7h+
MD5 SHA1 SHA512 SSDEEP

Submit Download

qtAkwde.exe

Path C:\Windows\System\qtAkwde.exe
Size 1.8MB
SHA256 9e3535f05f07e319a4f2aef9a044a5349b96489ffd860f3ac45ae928530ae46f
MD5 98dd35742f991a89c8be417b557e9610
SHA1 1e0d2ade2fef7951e37d012fc4690a79ba6fbbc9
SHA512 59ab2957ce3fbedecd06695e6f19648f028a333f39133a81ec7bd13c1e06510e0448a3d021c2bca487349d84c48a41829ce040bb7189b4d8aa819e3d7a14f7f7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1z:Lz071uv4BPMkFfdg6NsIRSwV7V
MD5 SHA1 SHA512 SSDEEP

Submit Download

qzlJVHv.exe

Path C:\Windows\System\qzlJVHv.exe
Size 1.8MB
SHA256 d0300498ed55c916de517d8db5a8146ac84648f09d47fecb6c4ecd96430682e6
MD5 ebc0ba71f705ac678f1fa09baccd2e2e
SHA1 7623ca944b7bbea01c10b317ec6d0ce7447d2c82
SHA512 37990a9c776d4a4f7dc0ddef90444eb84fef8a9412343aff43a693fb453625197aeb2c941185d66a511477784b644519c1756d0d20abd6344078e5e8d7dc9d46
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1h:Lz071uv4BPMkFfdg6NsIRSwV7L
MD5 SHA1 SHA512 SSDEEP

Submit Download

sgUdcub.exe

Path C:\Windows\System\sgUdcub.exe
Size 1.8MB
SHA256 1d1a3a1c4498421e2e0d7545ccc3406b103b6021e6d9f88747f43b3577d89844
MD5 5591a0a02de825b8b8140b51ba32c501
SHA1 fcf03ac048355eeafd11ce92e3ff66a02c200c33
SHA512 dffe905b8cb2623f7701556e5fcdd95cdfcd4ad14cd35d8d8f23ad40dc8d1db1ecac88871f0f919557987eb7d90fbae17ae79543d4df55ce16a92a62d5912e66
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1H+:Lz071uv4BPMkFfdg6NsIRSwV7E
MD5 SHA1 SHA512 SSDEEP

Submit Download

tMyHFHt.exe

Path C:\Windows\System\tMyHFHt.exe
Size 1.8MB
SHA256 b9566309582964dc39e6d4e3acffb25adfc0a273d4c01be608872395483f0313
MD5 8d9fa231b8d2e3229fda40708f4d3bfb
SHA1 54b7b73aa285565298dc37f0f792f0e32c3d11db
SHA512 02b94404c771170e84933b1e1f8c922e4c34ae22b0ae6626be0524c581b2a30578afd672b8e42d7d2f2f937b58359104a40063ccdaaa5e66d1f32a0f22c9a3a4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1W:Lz071uv4BPMkFfdg6NsIRSwV7k
MD5 SHA1 SHA512 SSDEEP

Submit Download

uJdxKAv.exe

Path C:\Windows\System\uJdxKAv.exe
Size 1.8MB
SHA256 934476f6e3602ea704f5fb357fea5977692f270db49e1f34e0f75ce43026661f
MD5 f7af2126f1b92393e69987756edf07b8
SHA1 16c1959aa2e531d1844aba46c62d10b3e0167950
SHA512 07eaa8c07c722451764ad3ce79dfd121c7752e7412ed17211b1b180035b278374c4336a18f10c44dcb852fc4ec27f70c82f4446a587ed20b119631f420ec441c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD19:Lz071uv4BPMkFfdg6NsIRSwV7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

uPqpMnD.exe

Path C:\Windows\System\uPqpMnD.exe
Size 1.8MB
SHA256 2e6a3c94e66697871fa94224c045e82366084f3c03261b451af396c2c8d0865b
MD5 3304f1d0f664843bec982369f8a42207
SHA1 575f98b0d98f88e90f16a14943359946d1480f69
SHA512 09edbb04c1735272aabcfeb473dfd387c3fead07c785fd3f51bb2ff94834e91bb95f54bd8f0df26330c5b975fd24afbde37bdab06aca4da3b66ef72a4de49d6e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD1h:Lz071uv4BPMkFfdg6NsIRSwV7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

zkdoqDm.exe

Path C:\Windows\System\zkdoqDm.exe
Size 1.8MB
SHA256 1e59595ba8d0f72822c23078f5e0504a6e12a54dec5104aceb53a50f900f51ed
MD5 a195872fa4dc34aecfe37324b3dd0cc0
SHA1 ae36ddd23192af594e7818d911a344d335413b0a
SHA512 df45bdcfe57f75ea4d9e88daddfd2248f1a16cddcc5a643b557405cc63e5f6d9e95d162359b2891aef69656fc4d6ab43a53a77c8eb8af1fca86a0925131dfa20
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkFfkeMlN675EgEPgspmBeQxWCLU0SwVUuD13:Lz071uv4BPMkFfdg6NsIRSwV7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/960-564-0x00007FF75B520000-0x00007FF75B912000-memory.dmp

Download

memory/960-2379-0x00007FF75B520000-0x00007FF75B912000-memory.dmp

Download

memory/1004-566-0x00007FF614EB0000-0x00007FF6152A2000-memory.dmp

Download

memory/1004-2406-0x00007FF614EB0000-0x00007FF6152A2000-memory.dmp

Download

memory/1412-563-0x00007FF755570000-0x00007FF755962000-memory.dmp

Download

memory/1412-2420-0x00007FF755570000-0x00007FF755962000-memory.dmp

Download

memory/1476-2375-0x00007FF637EF0000-0x00007FF6382E2000-memory.dmp

Download

memory/1476-407-0x00007FF637EF0000-0x00007FF6382E2000-memory.dmp

Download

memory/1652-2383-0x00007FF7289B0000-0x00007FF728DA2000-memory.dmp

Download

memory/1652-409-0x00007FF7289B0000-0x00007FF728DA2000-memory.dmp

Download

memory/1660-2395-0x00007FF698AA0000-0x00007FF698E92000-memory.dmp

Download

memory/1660-554-0x00007FF698AA0000-0x00007FF698E92000-memory.dmp

Download

memory/1820-2247-0x00007FF6CDA50000-0x00007FF6CDE42000-memory.dmp

Download

memory/1820-0-0x00007FF6CDA50000-0x00007FF6CDE42000-memory.dmp

Download

memory/1820-1-0x000001B835FF0000-0x000001B836000000-memory.dmp

Download

memory/1976-284-0x00007FF700800000-0x00007FF700BF2000-memory.dmp

Download

memory/1976-2377-0x00007FF700800000-0x00007FF700BF2000-memory.dmp

Download

memory/2360-2400-0x00007FF69DDF0000-0x00007FF69E1E2000-memory.dmp

Download

memory/2360-557-0x00007FF69DDF0000-0x00007FF69E1E2000-memory.dmp

Download

memory/2512-545-0x00007FF7E1360000-0x00007FF7E1752000-memory.dmp

Download

memory/2512-2389-0x00007FF7E1360000-0x00007FF7E1752000-memory.dmp

Download

memory/2548-383-0x00007FF68F8B0000-0x00007FF68FCA2000-memory.dmp

Download

memory/2548-2387-0x00007FF68F8B0000-0x00007FF68FCA2000-memory.dmp

Download

memory/2708-2373-0x00007FF7441B0000-0x00007FF7445A2000-memory.dmp

Download

memory/2708-565-0x00007FF7441B0000-0x00007FF7445A2000-memory.dmp

Download

memory/2728-2416-0x00007FF74A5A0000-0x00007FF74A992000-memory.dmp

Download

memory/2728-559-0x00007FF74A5A0000-0x00007FF74A992000-memory.dmp

Download

memory/2740-2414-0x00007FF6398E0000-0x00007FF639CD2000-memory.dmp

Download

memory/2740-558-0x00007FF6398E0000-0x00007FF639CD2000-memory.dmp

Download

memory/2868-2397-0x00007FF62A420000-0x00007FF62A812000-memory.dmp

Download

memory/2868-452-0x00007FF62A420000-0x00007FF62A812000-memory.dmp

Download

memory/3124-2381-0x00007FF6EF1A0000-0x00007FF6EF592000-memory.dmp

Download

memory/3124-406-0x00007FF6EF1A0000-0x00007FF6EF592000-memory.dmp

Download

memory/3300-20-0x00007FF84DBE3000-0x00007FF84DBE5000-memory.dmp

Download

memory/3300-198-0x00007FF84DBE0000-0x00007FF84E6A1000-memory.dmp

Download

memory/3300-2343-0x00007FF84DBE0000-0x00007FF84E6A1000-memory.dmp

Download

memory/3300-75-0x00007FF84DBE0000-0x00007FF84E6A1000-memory.dmp

Download

memory/3300-339-0x000002418DB20000-0x000002418DB42000-memory.dmp

Download

memory/3392-555-0x00007FF7CE820000-0x00007FF7CEC12000-memory.dmp

Download

memory/3392-2404-0x00007FF7CE820000-0x00007FF7CEC12000-memory.dmp

Download

memory/3880-103-0x00007FF76C7D0000-0x00007FF76CBC2000-memory.dmp

Download

memory/3880-2371-0x00007FF76C7D0000-0x00007FF76CBC2000-memory.dmp

Download

memory/4008-2391-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp

Download

memory/4008-552-0x00007FF6CF030000-0x00007FF6CF422000-memory.dmp

Download

memory/4336-556-0x00007FF6D1D20000-0x00007FF6D2112000-memory.dmp

Download

memory/4336-2402-0x00007FF6D1D20000-0x00007FF6D2112000-memory.dmp

Download

memory/4344-2369-0x00007FF640F70000-0x00007FF641362000-memory.dmp

Download

memory/4344-19-0x00007FF640F70000-0x00007FF641362000-memory.dmp

Download

memory/4344-2359-0x00007FF640F70000-0x00007FF641362000-memory.dmp

Download

memory/4828-562-0x00007FF6ECA20000-0x00007FF6ECE12000-memory.dmp

Download

memory/4828-2410-0x00007FF6ECA20000-0x00007FF6ECE12000-memory.dmp

Download

memory/4844-553-0x00007FF75A650000-0x00007FF75AA42000-memory.dmp

Download

memory/4844-2393-0x00007FF75A650000-0x00007FF75AA42000-memory.dmp

Download

memory/4888-2408-0x00007FF644F00000-0x00007FF6452F2000-memory.dmp

Download

memory/4888-561-0x00007FF644F00000-0x00007FF6452F2000-memory.dmp

Download

memory/4928-560-0x00007FF7B0A80000-0x00007FF7B0E72000-memory.dmp

Download

memory/4928-2385-0x00007FF7B0A80000-0x00007FF7B0E72000-memory.dmp

Download