xmrig | 97fb2fdb82bf93123da819ce5fe7135a01a5a41ffec7484ad4c7a895c8e00f61

Analysis

max time kernel
57s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
Size 1.8MB
Sample240610-nvrxqaab28
SHA256 97fb2fdb82bf93123da819ce5fe7135a01a5a41ffec7484ad4c7a895c8e00f61
MD5 10bc55433688c0a4bc0224310c0ed660
SHA1 230fbd8acfde12bf705dcf4a0d936d4dd1bcfdc5
SHA512 a4cd7d7650ffc520d065e549f217a5cb3bba787646f89fcdd262233abc170f4bce4bb024388548f87c93784fed999bc7753cd11f315f3fbbf029097b3d2836a1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bo0:Lz071uv4BPMkiFGlObO11jB7F
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/3228-60-0x00007FF6ABD90000-0x00007FF6AC182000-memory.dmp	xmrig
behavioral2/memory/4512-114-0x00007FF65EB70000-0x00007FF65EF62000-memory.dmp	xmrig
behavioral2/memory/4576-117-0x00007FF6EE410000-0x00007FF6EE802000-memory.dmp	xmrig
behavioral2/memory/696-115-0x00007FF736040000-0x00007FF736432000-memory.dmp	xmrig
behavioral2/memory/4480-102-0x00007FF728A70000-0x00007FF728E62000-memory.dmp	xmrig
behavioral2/memory/4924-100-0x00007FF744CF0000-0x00007FF7450E2000-memory.dmp	xmrig
behavioral2/memory/4024-91-0x00007FF7BF0C0000-0x00007FF7BF4B2000-memory.dmp	xmrig
behavioral2/memory/3132-61-0x00007FF7FA4C0000-0x00007FF7FA8B2000-memory.dmp	xmrig
behavioral2/memory/3972-49-0x00007FF708370000-0x00007FF708762000-memory.dmp	xmrig
behavioral2/memory/2768-27-0x00007FF7083D0000-0x00007FF7087C2000-memory.dmp	xmrig
behavioral2/memory/4480-124-0x00007FF728A70000-0x00007FF728E62000-memory.dmp	xmrig
behavioral2/memory/3692-128-0x00007FF66DC70000-0x00007FF66E062000-memory.dmp	xmrig
behavioral2/memory/3172-146-0x00007FF693470000-0x00007FF693862000-memory.dmp	xmrig
behavioral2/memory/4604-159-0x00007FF6C6180000-0x00007FF6C6572000-memory.dmp	xmrig
behavioral2/memory/1100-175-0x00007FF761520000-0x00007FF761912000-memory.dmp	xmrig
behavioral2/memory/2132-178-0x00007FF771680000-0x00007FF771A72000-memory.dmp	xmrig
behavioral2/memory/1828-167-0x00007FF62BDF0000-0x00007FF62C1E2000-memory.dmp	xmrig
behavioral2/memory/4248-140-0x00007FF698B40000-0x00007FF698F32000-memory.dmp	xmrig
behavioral2/memory/3980-187-0x00007FF638B60000-0x00007FF638F52000-memory.dmp	xmrig
behavioral2/memory/2480-200-0x00007FF638A30000-0x00007FF638E22000-memory.dmp	xmrig
behavioral2/memory/3088-205-0x00007FF6E24F0000-0x00007FF6E28E2000-memory.dmp	xmrig
behavioral2/memory/1564-204-0x00007FF630CE0000-0x00007FF6310D2000-memory.dmp	xmrig
behavioral2/memory/4948-199-0x00007FF6C8E10000-0x00007FF6C9202000-memory.dmp	xmrig
behavioral2/memory/4988-189-0x00007FF62A060000-0x00007FF62A452000-memory.dmp	xmrig
behavioral2/memory/3908-185-0x00007FF6841E0000-0x00007FF6845D2000-memory.dmp	xmrig
behavioral2/memory/4804-183-0x00007FF704C90000-0x00007FF705082000-memory.dmp	xmrig
behavioral2/memory/3908-1682-0x00007FF6841E0000-0x00007FF6845D2000-memory.dmp	xmrig
behavioral2/memory/4024-1652-0x00007FF7BF0C0000-0x00007FF7BF4B2000-memory.dmp	xmrig
behavioral2/memory/4948-1674-0x00007FF6C8E10000-0x00007FF6C9202000-memory.dmp	xmrig
behavioral2/memory/4988-1671-0x00007FF62A060000-0x00007FF62A452000-memory.dmp	xmrig
behavioral2/memory/4804-1630-0x00007FF704C90000-0x00007FF705082000-memory.dmp	xmrig
behavioral2/memory/3172-1585-0x00007FF693470000-0x00007FF693862000-memory.dmp	xmrig
behavioral2/memory/4576-1512-0x00007FF6EE410000-0x00007FF6EE802000-memory.dmp	xmrig
behavioral2/memory/3132-1518-0x00007FF7FA4C0000-0x00007FF7FA8B2000-memory.dmp	xmrig
behavioral2/memory/3692-2174-0x00007FF66DC70000-0x00007FF66E062000-memory.dmp	xmrig
behavioral2/memory/2480-2157-0x00007FF638A30000-0x00007FF638E22000-memory.dmp	xmrig
behavioral2/memory/1828-2134-0x00007FF62BDF0000-0x00007FF62C1E2000-memory.dmp	xmrig
behavioral2/memory/3980-2139-0x00007FF638B60000-0x00007FF638F52000-memory.dmp	xmrig
behavioral2/memory/2132-2138-0x00007FF771680000-0x00007FF771A72000-memory.dmp	xmrig
behavioral2/memory/4604-2137-0x00007FF6C6180000-0x00007FF6C6572000-memory.dmp	xmrig
behavioral2/memory/3088-2136-0x00007FF6E24F0000-0x00007FF6E28E2000-memory.dmp	xmrig
behavioral2/memory/1100-2135-0x00007FF761520000-0x00007FF761912000-memory.dmp	xmrig
behavioral2/memory/1564-2133-0x00007FF630CE0000-0x00007FF6310D2000-memory.dmp	xmrig
behavioral2/memory/3228-1495-0x00007FF6ABD90000-0x00007FF6AC182000-memory.dmp	xmrig
behavioral2/memory/4248-1492-0x00007FF698B40000-0x00007FF698F32000-memory.dmp	xmrig
behavioral2/memory/3972-1491-0x00007FF708370000-0x00007FF708762000-memory.dmp	xmrig
behavioral2/memory/696-1476-0x00007FF736040000-0x00007FF736432000-memory.dmp	xmrig
behavioral2/memory/2768-1453-0x00007FF7083D0000-0x00007FF7087C2000-memory.dmp	xmrig
behavioral2/memory/4512-1451-0x00007FF65EB70000-0x00007FF65EF62000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	3528	powershell.exe
9	3528	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3528	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4512	ahYuIoN.exe
696	KqujRsr.exe
4576	UeBcaID.exe
2768	cQyCUfz.exe
4248	dMTMAZI.exe
3972	bqzJINq.exe
3228	rHmUZKu.exe
3172	qafbErA.exe
3132	wfCfZvX.exe
4804	bRfRDob.exe
3908	pcNMssi.exe
4024	aeGdlax.exe
3980	UdOFXJC.exe
4924	YfknKGe.exe
4988	VQNTqWQ.exe
4948	teNqfFw.exe
2480	DRvvMBa.exe
3692	OllBlPj.exe
4604	JkKARDg.exe
1828	NQvLuGt.exe
1564	CUfkQrp.exe
1100	zEdkUnw.exe
3088	ZCoQUXg.exe
2132	ELSIyLb.exe
3948	CewaSoi.exe
1480	NvEgSvd.exe
5020	cQSuYMF.exe
4324	UkPGSrk.exe
3668	NBmxGmS.exe
4360	sYrYvtY.exe
2668	XnLLiSV.exe
2916	TdNVrCV.exe
2688	xiDKTlJ.exe
3860	aBVDtOi.exe
4072	UzmbSKP.exe
3348	aSVBOlc.exe
4680	SqYWDeC.exe
4196	KIcZaZb.exe
2008	uWQINJL.exe
2780	TqAhFTu.exe
4528	vMeCkva.exe
4356	kHaSCat.exe
3484	rLKOAZG.exe
3776	DxrohXO.exe
1260	vxNiaJj.exe
4796	jjPWIfK.exe
4128	OeegRiv.exe
1056	uJzUGpm.exe
2608	jYxzxax.exe
1992	ijXEFkc.exe
1884	cYOfNJQ.exe
3576	rnbLLAG.exe
2960	KGihSFB.exe
3904	ARSMgCx.exe
3092	auTHAgB.exe
2816	ciKVXju.exe
3164	JTLlOkv.exe
112	HRJRnwv.exe
3812	lCMvkxW.exe
2628	ujjmonG.exe
2932	PNRseVa.exe
1708	yVGqobX.exe
3428	WnwMQFP.exe
4780	ilVDSjJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4480-0-0x00007FF728A70000-0x00007FF728E62000-memory.dmp	upx
behavioral2/files/0x000900000002324b-5.dat	upx
behavioral2/files/0x0008000000023251-10.dat	upx
behavioral2/files/0x0007000000023252-7.dat	upx
behavioral2/files/0x0007000000023254-31.dat	upx
behavioral2/files/0x0007000000023255-35.dat	upx
behavioral2/files/0x0007000000023256-42.dat	upx
behavioral2/files/0x000800000002324f-43.dat	upx
behavioral2/memory/3172-47-0x00007FF693470000-0x00007FF693862000-memory.dmp	upx
behavioral2/memory/3228-60-0x00007FF6ABD90000-0x00007FF6AC182000-memory.dmp	upx
behavioral2/files/0x0007000000023258-63.dat	upx
behavioral2/memory/4804-64-0x00007FF704C90000-0x00007FF705082000-memory.dmp	upx
behavioral2/files/0x000700000002325a-74.dat	upx
behavioral2/files/0x000700000002325b-85.dat	upx
behavioral2/memory/3980-92-0x00007FF638B60000-0x00007FF638F52000-memory.dmp	upx
behavioral2/files/0x000800000002325e-97.dat	upx
behavioral2/files/0x000700000002325f-108.dat	upx
behavioral2/memory/4512-114-0x00007FF65EB70000-0x00007FF65EF62000-memory.dmp	upx
behavioral2/memory/4576-117-0x00007FF6EE410000-0x00007FF6EE802000-memory.dmp	upx
behavioral2/memory/2480-116-0x00007FF638A30000-0x00007FF638E22000-memory.dmp	upx
behavioral2/memory/696-115-0x00007FF736040000-0x00007FF736432000-memory.dmp	upx
behavioral2/memory/4948-113-0x00007FF6C8E10000-0x00007FF6C9202000-memory.dmp	upx
behavioral2/files/0x000800000002325d-110.dat	upx
behavioral2/memory/4988-107-0x00007FF62A060000-0x00007FF62A452000-memory.dmp	upx
behavioral2/memory/4480-102-0x00007FF728A70000-0x00007FF728E62000-memory.dmp	upx
behavioral2/memory/4924-100-0x00007FF744CF0000-0x00007FF7450E2000-memory.dmp	upx
behavioral2/files/0x000700000002325c-93.dat	upx
behavioral2/memory/4024-91-0x00007FF7BF0C0000-0x00007FF7BF4B2000-memory.dmp	upx
behavioral2/memory/3908-69-0x00007FF6841E0000-0x00007FF6845D2000-memory.dmp	upx
behavioral2/files/0x0007000000023259-66.dat	upx
behavioral2/memory/3132-61-0x00007FF7FA4C0000-0x00007FF7FA8B2000-memory.dmp	upx
behavioral2/files/0x0007000000023257-55.dat	upx
behavioral2/memory/3972-49-0x00007FF708370000-0x00007FF708762000-memory.dmp	upx
behavioral2/memory/4248-41-0x00007FF698B40000-0x00007FF698F32000-memory.dmp	upx
behavioral2/memory/2768-27-0x00007FF7083D0000-0x00007FF7087C2000-memory.dmp	upx
behavioral2/memory/4576-22-0x00007FF6EE410000-0x00007FF6EE802000-memory.dmp	upx
behavioral2/files/0x0007000000023253-21.dat	upx
behavioral2/memory/696-17-0x00007FF736040000-0x00007FF736432000-memory.dmp	upx
behavioral2/memory/4512-9-0x00007FF65EB70000-0x00007FF65EF62000-memory.dmp	upx
behavioral2/files/0x0007000000023260-118.dat	upx
behavioral2/memory/4480-124-0x00007FF728A70000-0x00007FF728E62000-memory.dmp	upx
behavioral2/memory/3692-128-0x00007FF66DC70000-0x00007FF66E062000-memory.dmp	upx
behavioral2/files/0x0007000000023261-127.dat	upx
behavioral2/files/0x0007000000023262-133.dat	upx
behavioral2/files/0x0007000000023263-144.dat	upx
behavioral2/memory/3172-146-0x00007FF693470000-0x00007FF693862000-memory.dmp	upx
behavioral2/files/0x0007000000023266-153.dat	upx
behavioral2/memory/4604-159-0x00007FF6C6180000-0x00007FF6C6572000-memory.dmp	upx
behavioral2/files/0x0007000000023268-165.dat	upx
behavioral2/files/0x0007000000023269-173.dat	upx
behavioral2/memory/1100-175-0x00007FF761520000-0x00007FF761912000-memory.dmp	upx
behavioral2/memory/2132-178-0x00007FF771680000-0x00007FF771A72000-memory.dmp	upx
behavioral2/files/0x000700000002326a-174.dat	upx
behavioral2/memory/1828-167-0x00007FF62BDF0000-0x00007FF62C1E2000-memory.dmp	upx
behavioral2/files/0x0007000000023267-162.dat	upx
behavioral2/files/0x0007000000023264-152.dat	upx
behavioral2/memory/4248-140-0x00007FF698B40000-0x00007FF698F32000-memory.dmp	upx
behavioral2/memory/3980-187-0x00007FF638B60000-0x00007FF638F52000-memory.dmp	upx
behavioral2/memory/2480-200-0x00007FF638A30000-0x00007FF638E22000-memory.dmp	upx
behavioral2/files/0x000700000002326d-206.dat	upx
behavioral2/memory/3088-205-0x00007FF6E24F0000-0x00007FF6E28E2000-memory.dmp	upx
behavioral2/files/0x000700000002326c-207.dat	upx
behavioral2/memory/1564-204-0x00007FF630CE0000-0x00007FF6310D2000-memory.dmp	upx
behavioral2/memory/4948-199-0x00007FF6C8E10000-0x00007FF6C9202000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UgCmUtX.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\LIAkKRF.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\ZXWrwRD.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\XIktDXk.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\UcbbDJV.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\CewaSoi.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\UkPGSrk.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\SGIBHso.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\aYpdzwJ.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\HoxXYqP.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\BZnfYae.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\qtCvIYT.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\AQCSOnc.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\fmAbWPV.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\sYTUbfk.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\EdpcMWG.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\IglhuSf.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\dpqlRit.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\BIueRmP.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\ZFjrVHm.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\TysQpgy.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\qauXiuv.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\NuFJSUH.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\ggkWjQt.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\ciKVXju.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\UIlCoeL.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\DThyfRh.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\xWablWo.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\KtHITRt.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\nzkdAXz.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\xwxXeBQ.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\lzINBvD.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\ogHzhjl.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\nyXpDYQ.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\wcevGxB.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\KIcZaZb.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\CGLXkTV.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\QGksJja.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\HASkvXV.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\kjptisC.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\aiFzUjD.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\gVOrFyg.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\wwlQcNg.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\jiBxqKQ.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\SWHCYeN.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\FmIBEwi.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\kGDWTrO.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\hYvYPIu.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\sWJxIaJ.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\gOYJjHm.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\pcNMssi.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\UzmbSKP.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\AmpsEil.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\VQhpjHD.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\wLYKzxd.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\DtQlrUT.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\rjMHjjM.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\KEakBlw.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\jYxzxax.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\ARSMgCx.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\sKBKFwB.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\vUsofAp.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\QKydeqN.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
File created	C:\Windows\System\cIeFpLx.exe	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3528	powershell.exe
3528	powershell.exe
3528	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
Token: SeDebugPrivilege	3528	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 3528	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	93
PID 4480 wrote to memory of 3528	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	93
PID 4480 wrote to memory of 4512	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	94
PID 4480 wrote to memory of 4512	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	94
PID 4480 wrote to memory of 696	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	95
PID 4480 wrote to memory of 696	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	95
PID 4480 wrote to memory of 4576	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	96
PID 4480 wrote to memory of 4576	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	96
PID 4480 wrote to memory of 2768	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	97
PID 4480 wrote to memory of 2768	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	97
PID 4480 wrote to memory of 4248	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	98
PID 4480 wrote to memory of 4248	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	98
PID 4480 wrote to memory of 3972	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	99
PID 4480 wrote to memory of 3972	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	99
PID 4480 wrote to memory of 3228	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	100
PID 4480 wrote to memory of 3228	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	100
PID 4480 wrote to memory of 3172	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	101
PID 4480 wrote to memory of 3172	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	101
PID 4480 wrote to memory of 3132	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	102
PID 4480 wrote to memory of 3132	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	102
PID 4480 wrote to memory of 4804	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	103
PID 4480 wrote to memory of 4804	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	103
PID 4480 wrote to memory of 3908	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	104
PID 4480 wrote to memory of 3908	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	104
PID 4480 wrote to memory of 4024	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	105
PID 4480 wrote to memory of 4024	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	105
PID 4480 wrote to memory of 3980	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	106
PID 4480 wrote to memory of 3980	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	106
PID 4480 wrote to memory of 4924	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	107
PID 4480 wrote to memory of 4924	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	107
PID 4480 wrote to memory of 4988	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	108
PID 4480 wrote to memory of 4988	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	108
PID 4480 wrote to memory of 4948	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	109
PID 4480 wrote to memory of 4948	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	109
PID 4480 wrote to memory of 2480	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	110
PID 4480 wrote to memory of 2480	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	110
PID 4480 wrote to memory of 3692	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	111
PID 4480 wrote to memory of 3692	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	111
PID 4480 wrote to memory of 4604	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	112
PID 4480 wrote to memory of 4604	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	112
PID 4480 wrote to memory of 1828	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	113
PID 4480 wrote to memory of 1828	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	113
PID 4480 wrote to memory of 1564	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	114
PID 4480 wrote to memory of 1564	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	114
PID 4480 wrote to memory of 1100	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	115
PID 4480 wrote to memory of 1100	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	115
PID 4480 wrote to memory of 3088	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	116
PID 4480 wrote to memory of 3088	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	116
PID 4480 wrote to memory of 2132	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	117
PID 4480 wrote to memory of 2132	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	117
PID 4480 wrote to memory of 3948	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	118
PID 4480 wrote to memory of 3948	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	118
PID 4480 wrote to memory of 1480	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	119
PID 4480 wrote to memory of 1480	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	119
PID 4480 wrote to memory of 5020	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	120
PID 4480 wrote to memory of 5020	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	120
PID 4480 wrote to memory of 4324	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	121
PID 4480 wrote to memory of 4324	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	121
PID 4480 wrote to memory of 3668	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	122
PID 4480 wrote to memory of 3668	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	122
PID 4480 wrote to memory of 4360	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	123
PID 4480 wrote to memory of 4360	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	123
PID 4480 wrote to memory of 2668	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	124
PID 4480 wrote to memory of 2668	4480	10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe	124

C:\Users\Admin\AppData\Local\Temp\10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\10bc55433688c0a4bc0224310c0ed660_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3528
- C:\Windows\System\ahYuIoN.exe
  C:\Windows\System\ahYuIoN.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\KqujRsr.exe
  C:\Windows\System\KqujRsr.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\UeBcaID.exe
  C:\Windows\System\UeBcaID.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\cQyCUfz.exe
  C:\Windows\System\cQyCUfz.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\dMTMAZI.exe
  C:\Windows\System\dMTMAZI.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\bqzJINq.exe
  C:\Windows\System\bqzJINq.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\rHmUZKu.exe
  C:\Windows\System\rHmUZKu.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\qafbErA.exe
  C:\Windows\System\qafbErA.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\wfCfZvX.exe
  C:\Windows\System\wfCfZvX.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\bRfRDob.exe
  C:\Windows\System\bRfRDob.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\pcNMssi.exe
  C:\Windows\System\pcNMssi.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\aeGdlax.exe
  C:\Windows\System\aeGdlax.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\UdOFXJC.exe
  C:\Windows\System\UdOFXJC.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\YfknKGe.exe
  C:\Windows\System\YfknKGe.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\VQNTqWQ.exe
  C:\Windows\System\VQNTqWQ.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\teNqfFw.exe
  C:\Windows\System\teNqfFw.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\DRvvMBa.exe
  C:\Windows\System\DRvvMBa.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\OllBlPj.exe
  C:\Windows\System\OllBlPj.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\JkKARDg.exe
  C:\Windows\System\JkKARDg.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\NQvLuGt.exe
  C:\Windows\System\NQvLuGt.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\CUfkQrp.exe
  C:\Windows\System\CUfkQrp.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\zEdkUnw.exe
  C:\Windows\System\zEdkUnw.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\ZCoQUXg.exe
  C:\Windows\System\ZCoQUXg.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\ELSIyLb.exe
  C:\Windows\System\ELSIyLb.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\CewaSoi.exe
  C:\Windows\System\CewaSoi.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\NvEgSvd.exe
  C:\Windows\System\NvEgSvd.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\cQSuYMF.exe
  C:\Windows\System\cQSuYMF.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\UkPGSrk.exe
  C:\Windows\System\UkPGSrk.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\NBmxGmS.exe
  C:\Windows\System\NBmxGmS.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\sYrYvtY.exe
  C:\Windows\System\sYrYvtY.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\XnLLiSV.exe
  C:\Windows\System\XnLLiSV.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\TdNVrCV.exe
  C:\Windows\System\TdNVrCV.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\xiDKTlJ.exe
  C:\Windows\System\xiDKTlJ.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\aBVDtOi.exe
  C:\Windows\System\aBVDtOi.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\UzmbSKP.exe
  C:\Windows\System\UzmbSKP.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\aSVBOlc.exe
  C:\Windows\System\aSVBOlc.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\SqYWDeC.exe
  C:\Windows\System\SqYWDeC.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\KIcZaZb.exe
  C:\Windows\System\KIcZaZb.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\uWQINJL.exe
  C:\Windows\System\uWQINJL.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\TqAhFTu.exe
  C:\Windows\System\TqAhFTu.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\vMeCkva.exe
  C:\Windows\System\vMeCkva.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\kHaSCat.exe
  C:\Windows\System\kHaSCat.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\rLKOAZG.exe
  C:\Windows\System\rLKOAZG.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\DxrohXO.exe
  C:\Windows\System\DxrohXO.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\vxNiaJj.exe
  C:\Windows\System\vxNiaJj.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\jjPWIfK.exe
  C:\Windows\System\jjPWIfK.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\OeegRiv.exe
  C:\Windows\System\OeegRiv.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\uJzUGpm.exe
  C:\Windows\System\uJzUGpm.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\jYxzxax.exe
  C:\Windows\System\jYxzxax.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\ijXEFkc.exe
  C:\Windows\System\ijXEFkc.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\cYOfNJQ.exe
  C:\Windows\System\cYOfNJQ.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\rnbLLAG.exe
  C:\Windows\System\rnbLLAG.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\KGihSFB.exe
  C:\Windows\System\KGihSFB.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\ARSMgCx.exe
  C:\Windows\System\ARSMgCx.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\auTHAgB.exe
  C:\Windows\System\auTHAgB.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\ciKVXju.exe
  C:\Windows\System\ciKVXju.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\JTLlOkv.exe
  C:\Windows\System\JTLlOkv.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\HRJRnwv.exe
  C:\Windows\System\HRJRnwv.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\lCMvkxW.exe
  C:\Windows\System\lCMvkxW.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\ujjmonG.exe
  C:\Windows\System\ujjmonG.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\PNRseVa.exe
  C:\Windows\System\PNRseVa.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\yVGqobX.exe
  C:\Windows\System\yVGqobX.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\WnwMQFP.exe
  C:\Windows\System\WnwMQFP.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\ilVDSjJ.exe
  C:\Windows\System\ilVDSjJ.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\UNuosyg.exe
  C:\Windows\System\UNuosyg.exe
  2⤵
  PID:4404
- C:\Windows\System\loEyScK.exe
  C:\Windows\System\loEyScK.exe
  2⤵
  PID:3292
- C:\Windows\System\SSKYSbd.exe
  C:\Windows\System\SSKYSbd.exe
  2⤵
  PID:3768
- C:\Windows\System\dMVxiLT.exe
  C:\Windows\System\dMVxiLT.exe
  2⤵
  PID:4968
- C:\Windows\System\xVLESBZ.exe
  C:\Windows\System\xVLESBZ.exe
  2⤵
  PID:2496
- C:\Windows\System\LIuCqYM.exe
  C:\Windows\System\LIuCqYM.exe
  2⤵
  PID:1240
- C:\Windows\System\sCWwjuT.exe
  C:\Windows\System\sCWwjuT.exe
  2⤵
  PID:5152
- C:\Windows\System\tbKnFCb.exe
  C:\Windows\System\tbKnFCb.exe
  2⤵
  PID:5180
- C:\Windows\System\HRFXboS.exe
  C:\Windows\System\HRFXboS.exe
  2⤵
  PID:5200
- C:\Windows\System\hqRbSvd.exe
  C:\Windows\System\hqRbSvd.exe
  2⤵
  PID:5240
- C:\Windows\System\csByyIz.exe
  C:\Windows\System\csByyIz.exe
  2⤵
  PID:5260
- C:\Windows\System\AmpsEil.exe
  C:\Windows\System\AmpsEil.exe
  2⤵
  PID:5296
- C:\Windows\System\JggZfwl.exe
  C:\Windows\System\JggZfwl.exe
  2⤵
  PID:5324
- C:\Windows\System\rqzZtLb.exe
  C:\Windows\System\rqzZtLb.exe
  2⤵
  PID:5352
- C:\Windows\System\BsuwMXL.exe
  C:\Windows\System\BsuwMXL.exe
  2⤵
  PID:5376
- C:\Windows\System\UIlCoeL.exe
  C:\Windows\System\UIlCoeL.exe
  2⤵
  PID:5404
- C:\Windows\System\DQKDonu.exe
  C:\Windows\System\DQKDonu.exe
  2⤵
  PID:5432
- C:\Windows\System\CGLXkTV.exe
  C:\Windows\System\CGLXkTV.exe
  2⤵
  PID:5456
- C:\Windows\System\FyZOthz.exe
  C:\Windows\System\FyZOthz.exe
  2⤵
  PID:5504
- C:\Windows\System\OaqqGbo.exe
  C:\Windows\System\OaqqGbo.exe
  2⤵
  PID:5536
- C:\Windows\System\aPmqsWx.exe
  C:\Windows\System\aPmqsWx.exe
  2⤵
  PID:5556
- C:\Windows\System\YtGfaKy.exe
  C:\Windows\System\YtGfaKy.exe
  2⤵
  PID:5576
- C:\Windows\System\BGfwgkX.exe
  C:\Windows\System\BGfwgkX.exe
  2⤵
  PID:5616
- C:\Windows\System\XnWLNak.exe
  C:\Windows\System\XnWLNak.exe
  2⤵
  PID:5644
- C:\Windows\System\gVZVVVS.exe
  C:\Windows\System\gVZVVVS.exe
  2⤵
  PID:5672
- C:\Windows\System\YUYDRjf.exe
  C:\Windows\System\YUYDRjf.exe
  2⤵
  PID:5700
- C:\Windows\System\ZZHwaRe.exe
  C:\Windows\System\ZZHwaRe.exe
  2⤵
  PID:5720
- C:\Windows\System\xUtICcd.exe
  C:\Windows\System\xUtICcd.exe
  2⤵
  PID:5744
- C:\Windows\System\aFRgZBh.exe
  C:\Windows\System\aFRgZBh.exe
  2⤵
  PID:5772
- C:\Windows\System\KLwNDzK.exe
  C:\Windows\System\KLwNDzK.exe
  2⤵
  PID:5800
- C:\Windows\System\heiXIat.exe
  C:\Windows\System\heiXIat.exe
  2⤵
  PID:5832
- C:\Windows\System\YmdLyLK.exe
  C:\Windows\System\YmdLyLK.exe
  2⤵
  PID:5852
- C:\Windows\System\wSiTZZa.exe
  C:\Windows\System\wSiTZZa.exe
  2⤵
  PID:5880
- C:\Windows\System\UZKKgpo.exe
  C:\Windows\System\UZKKgpo.exe
  2⤵
  PID:5900
- C:\Windows\System\EYZkgsd.exe
  C:\Windows\System\EYZkgsd.exe
  2⤵
  PID:5948
- C:\Windows\System\FTmzCvq.exe
  C:\Windows\System\FTmzCvq.exe
  2⤵
  PID:5968
- C:\Windows\System\LCwTuiW.exe
  C:\Windows\System\LCwTuiW.exe
  2⤵
  PID:5992
- C:\Windows\System\jiBxqKQ.exe
  C:\Windows\System\jiBxqKQ.exe
  2⤵
  PID:6012
- C:\Windows\System\iwrWDZF.exe
  C:\Windows\System\iwrWDZF.exe
  2⤵
  PID:6060
- C:\Windows\System\sgmVFpI.exe
  C:\Windows\System\sgmVFpI.exe
  2⤵
  PID:6076
- C:\Windows\System\QRcymMy.exe
  C:\Windows\System\QRcymMy.exe
  2⤵
  PID:6096
- C:\Windows\System\xwxXeBQ.exe
  C:\Windows\System\xwxXeBQ.exe
  2⤵
  PID:5160
- C:\Windows\System\HzuLsyU.exe
  C:\Windows\System\HzuLsyU.exe
  2⤵
  PID:5192
- C:\Windows\System\cEHBpbu.exe
  C:\Windows\System\cEHBpbu.exe
  2⤵
  PID:5212
- C:\Windows\System\GqyCRSi.exe
  C:\Windows\System\GqyCRSi.exe
  2⤵
  PID:5276
- C:\Windows\System\VQhpjHD.exe
  C:\Windows\System\VQhpjHD.exe
  2⤵
  PID:5312
- C:\Windows\System\aWOMNAd.exe
  C:\Windows\System\aWOMNAd.exe
  2⤵
  PID:5368
- C:\Windows\System\BLcChgr.exe
  C:\Windows\System\BLcChgr.exe
  2⤵
  PID:5440
- C:\Windows\System\UgCmUtX.exe
  C:\Windows\System\UgCmUtX.exe
  2⤵
  PID:5512
- C:\Windows\System\EWlmrUF.exe
  C:\Windows\System\EWlmrUF.exe
  2⤵
  PID:5564
- C:\Windows\System\rkYQsOm.exe
  C:\Windows\System\rkYQsOm.exe
  2⤵
  PID:5632
- C:\Windows\System\phgupkf.exe
  C:\Windows\System\phgupkf.exe
  2⤵
  PID:5712
- C:\Windows\System\OZtJDYf.exe
  C:\Windows\System\OZtJDYf.exe
  2⤵
  PID:5788
- C:\Windows\System\DaVyxXe.exe
  C:\Windows\System\DaVyxXe.exe
  2⤵
  PID:5828
- C:\Windows\System\pBQsLAJ.exe
  C:\Windows\System\pBQsLAJ.exe
  2⤵
  PID:5896
- C:\Windows\System\xsMoxZz.exe
  C:\Windows\System\xsMoxZz.exe
  2⤵
  PID:5956
- C:\Windows\System\KQDudJc.exe
  C:\Windows\System\KQDudJc.exe
  2⤵
  PID:6056
- C:\Windows\System\uWZOrJj.exe
  C:\Windows\System\uWZOrJj.exe
  2⤵
  PID:6092
- C:\Windows\System\FXqYffB.exe
  C:\Windows\System\FXqYffB.exe
  2⤵
  PID:6120
- C:\Windows\System\dOVmEED.exe
  C:\Windows\System\dOVmEED.exe
  2⤵
  PID:4288
- C:\Windows\System\SiWEDfH.exe
  C:\Windows\System\SiWEDfH.exe
  2⤵
  PID:5452
- C:\Windows\System\brPpYZK.exe
  C:\Windows\System\brPpYZK.exe
  2⤵
  PID:5548
- C:\Windows\System\cPZvMPZ.exe
  C:\Windows\System\cPZvMPZ.exe
  2⤵
  PID:5780
- C:\Windows\System\AyqXORb.exe
  C:\Windows\System\AyqXORb.exe
  2⤵
  PID:6068
- C:\Windows\System\YWnUZPU.exe
  C:\Windows\System\YWnUZPU.exe
  2⤵
  PID:5196
- C:\Windows\System\VtcJUKM.exe
  C:\Windows\System\VtcJUKM.exe
  2⤵
  PID:5340
- C:\Windows\System\FmIBEwi.exe
  C:\Windows\System\FmIBEwi.exe
  2⤵
  PID:5908
- C:\Windows\System\ZJsfkyI.exe
  C:\Windows\System\ZJsfkyI.exe
  2⤵
  PID:5932
- C:\Windows\System\uVEMymS.exe
  C:\Windows\System\uVEMymS.exe
  2⤵
  PID:6036
- C:\Windows\System\lzINBvD.exe
  C:\Windows\System\lzINBvD.exe
  2⤵
  PID:5756
- C:\Windows\System\vrggNZS.exe
  C:\Windows\System\vrggNZS.exe
  2⤵
  PID:6164
- C:\Windows\System\ESbHICA.exe
  C:\Windows\System\ESbHICA.exe
  2⤵
  PID:6180
- C:\Windows\System\spihhIm.exe
  C:\Windows\System\spihhIm.exe
  2⤵
  PID:6220
- C:\Windows\System\aOkXQQW.exe
  C:\Windows\System\aOkXQQW.exe
  2⤵
  PID:6236
- C:\Windows\System\srWBieD.exe
  C:\Windows\System\srWBieD.exe
  2⤵
  PID:6260
- C:\Windows\System\wLYKzxd.exe
  C:\Windows\System\wLYKzxd.exe
  2⤵
  PID:6344
- C:\Windows\System\iHzahIc.exe
  C:\Windows\System\iHzahIc.exe
  2⤵
  PID:6372
- C:\Windows\System\ZGJBAnB.exe
  C:\Windows\System\ZGJBAnB.exe
  2⤵
  PID:6392
- C:\Windows\System\PJHYfbY.exe
  C:\Windows\System\PJHYfbY.exe
  2⤵
  PID:6424
- C:\Windows\System\SWHCYeN.exe
  C:\Windows\System\SWHCYeN.exe
  2⤵
  PID:6448
- C:\Windows\System\VwBFcoC.exe
  C:\Windows\System\VwBFcoC.exe
  2⤵
  PID:6472
- C:\Windows\System\qbPFxtF.exe
  C:\Windows\System\qbPFxtF.exe
  2⤵
  PID:6492
- C:\Windows\System\BHpsLIh.exe
  C:\Windows\System\BHpsLIh.exe
  2⤵
  PID:6512
- C:\Windows\System\eBEJmJn.exe
  C:\Windows\System\eBEJmJn.exe
  2⤵
  PID:6536
- C:\Windows\System\yCycWfz.exe
  C:\Windows\System\yCycWfz.exe
  2⤵
  PID:6556
- C:\Windows\System\owOREYG.exe
  C:\Windows\System\owOREYG.exe
  2⤵
  PID:6572
- C:\Windows\System\WfoHnEr.exe
  C:\Windows\System\WfoHnEr.exe
  2⤵
  PID:6596
- C:\Windows\System\iTymnoc.exe
  C:\Windows\System\iTymnoc.exe
  2⤵
  PID:6612
- C:\Windows\System\nxRfgms.exe
  C:\Windows\System\nxRfgms.exe
  2⤵
  PID:6676
- C:\Windows\System\PlUPelH.exe
  C:\Windows\System\PlUPelH.exe
  2⤵
  PID:6744
- C:\Windows\System\OppzOce.exe
  C:\Windows\System\OppzOce.exe
  2⤵
  PID:6764
- C:\Windows\System\zKHCSwq.exe
  C:\Windows\System\zKHCSwq.exe
  2⤵
  PID:6788
- C:\Windows\System\vwsQdqG.exe
  C:\Windows\System\vwsQdqG.exe
  2⤵
  PID:6804
- C:\Windows\System\aYpdzwJ.exe
  C:\Windows\System\aYpdzwJ.exe
  2⤵
  PID:6832
- C:\Windows\System\EzZFLaV.exe
  C:\Windows\System\EzZFLaV.exe
  2⤵
  PID:6872
- C:\Windows\System\CTOFHBK.exe
  C:\Windows\System\CTOFHBK.exe
  2⤵
  PID:6896
- C:\Windows\System\tEsKDEx.exe
  C:\Windows\System\tEsKDEx.exe
  2⤵
  PID:6912
- C:\Windows\System\KIsNSeW.exe
  C:\Windows\System\KIsNSeW.exe
  2⤵
  PID:6948
- C:\Windows\System\gGaNNoi.exe
  C:\Windows\System\gGaNNoi.exe
  2⤵
  PID:6988
- C:\Windows\System\OWOZmUW.exe
  C:\Windows\System\OWOZmUW.exe
  2⤵
  PID:7024
- C:\Windows\System\MhCmXwU.exe
  C:\Windows\System\MhCmXwU.exe
  2⤵
  PID:7040
- C:\Windows\System\fmAbWPV.exe
  C:\Windows\System\fmAbWPV.exe
  2⤵
  PID:7060
- C:\Windows\System\sEpOeUM.exe
  C:\Windows\System\sEpOeUM.exe
  2⤵
  PID:7084
- C:\Windows\System\ZdhhXBJ.exe
  C:\Windows\System\ZdhhXBJ.exe
  2⤵
  PID:7104
- C:\Windows\System\UMBSAMD.exe
  C:\Windows\System\UMBSAMD.exe
  2⤵
  PID:7128
- C:\Windows\System\PTRFJXj.exe
  C:\Windows\System\PTRFJXj.exe
  2⤵
  PID:7148
- C:\Windows\System\uCYYZUq.exe
  C:\Windows\System\uCYYZUq.exe
  2⤵
  PID:5252
- C:\Windows\System\HoxXYqP.exe
  C:\Windows\System\HoxXYqP.exe
  2⤵
  PID:6176
- C:\Windows\System\tjQwKyg.exe
  C:\Windows\System\tjQwKyg.exe
  2⤵
  PID:5732
- C:\Windows\System\KQKrmga.exe
  C:\Windows\System\KQKrmga.exe
  2⤵
  PID:6216
- C:\Windows\System\FEEXtaU.exe
  C:\Windows\System\FEEXtaU.exe
  2⤵
  PID:6420
- C:\Windows\System\ABnRRYT.exe
  C:\Windows\System\ABnRRYT.exe
  2⤵
  PID:6444
- C:\Windows\System\npWEKIi.exe
  C:\Windows\System\npWEKIi.exe
  2⤵
  PID:6620
- C:\Windows\System\KtHITRt.exe
  C:\Windows\System\KtHITRt.exe
  2⤵
  PID:6640
- C:\Windows\System\BnfHGkE.exe
  C:\Windows\System\BnfHGkE.exe
  2⤵
  PID:6732
- C:\Windows\System\yZQUDvB.exe
  C:\Windows\System\yZQUDvB.exe
  2⤵
  PID:6828
- C:\Windows\System\yTiueGX.exe
  C:\Windows\System\yTiueGX.exe
  2⤵
  PID:6812
- C:\Windows\System\TyGvJbs.exe
  C:\Windows\System\TyGvJbs.exe
  2⤵
  PID:6868
- C:\Windows\System\GNBVfwZ.exe
  C:\Windows\System\GNBVfwZ.exe
  2⤵
  PID:6904
- C:\Windows\System\OFknipD.exe
  C:\Windows\System\OFknipD.exe
  2⤵
  PID:7048
- C:\Windows\System\MzflNOO.exe
  C:\Windows\System\MzflNOO.exe
  2⤵
  PID:7056
- C:\Windows\System\BjekdAh.exe
  C:\Windows\System\BjekdAh.exe
  2⤵
  PID:7100
- C:\Windows\System\OrxdHuq.exe
  C:\Windows\System\OrxdHuq.exe
  2⤵
  PID:6280
- C:\Windows\System\vHmQEoy.exe
  C:\Windows\System\vHmQEoy.exe
  2⤵
  PID:5228
- C:\Windows\System\JDcAjDU.exe
  C:\Windows\System\JDcAjDU.exe
  2⤵
  PID:6404
- C:\Windows\System\WnraQeC.exe
  C:\Windows\System\WnraQeC.exe
  2⤵
  PID:6592
- C:\Windows\System\QImlkxd.exe
  C:\Windows\System\QImlkxd.exe
  2⤵
  PID:6864
- C:\Windows\System\JmYMsAd.exe
  C:\Windows\System\JmYMsAd.exe
  2⤵
  PID:7068
- C:\Windows\System\vxjKVsG.exe
  C:\Windows\System\vxjKVsG.exe
  2⤵
  PID:6800
- C:\Windows\System\OGYYZNd.exe
  C:\Windows\System\OGYYZNd.exe
  2⤵
  PID:6920
- C:\Windows\System\Tpbfobn.exe
  C:\Windows\System\Tpbfobn.exe
  2⤵
  PID:4064
- C:\Windows\System\XkRIONj.exe
  C:\Windows\System\XkRIONj.exe
  2⤵
  PID:7172
- C:\Windows\System\HcWBVda.exe
  C:\Windows\System\HcWBVda.exe
  2⤵
  PID:7196
- C:\Windows\System\FoVbzmH.exe
  C:\Windows\System\FoVbzmH.exe
  2⤵
  PID:7216
- C:\Windows\System\JtJewgl.exe
  C:\Windows\System\JtJewgl.exe
  2⤵
  PID:7260
- C:\Windows\System\nyAEVcN.exe
  C:\Windows\System\nyAEVcN.exe
  2⤵
  PID:7280
- C:\Windows\System\bKvajXf.exe
  C:\Windows\System\bKvajXf.exe
  2⤵
  PID:7300
- C:\Windows\System\QlhSgTi.exe
  C:\Windows\System\QlhSgTi.exe
  2⤵
  PID:7368
- C:\Windows\System\jXUoZBq.exe
  C:\Windows\System\jXUoZBq.exe
  2⤵
  PID:7408
- C:\Windows\System\ujGyLdT.exe
  C:\Windows\System\ujGyLdT.exe
  2⤵
  PID:7424
- C:\Windows\System\fyLbJba.exe
  C:\Windows\System\fyLbJba.exe
  2⤵
  PID:7452
- C:\Windows\System\NZqAPAU.exe
  C:\Windows\System\NZqAPAU.exe
  2⤵
  PID:7476
- C:\Windows\System\asoWlux.exe
  C:\Windows\System\asoWlux.exe
  2⤵
  PID:7520
- C:\Windows\System\BIueRmP.exe
  C:\Windows\System\BIueRmP.exe
  2⤵
  PID:7536
- C:\Windows\System\luqHFpo.exe
  C:\Windows\System\luqHFpo.exe
  2⤵
  PID:7572
- C:\Windows\System\yUIQwFN.exe
  C:\Windows\System\yUIQwFN.exe
  2⤵
  PID:7604
- C:\Windows\System\KsyigBr.exe
  C:\Windows\System\KsyigBr.exe
  2⤵
  PID:7628
- C:\Windows\System\cuuaOOf.exe
  C:\Windows\System\cuuaOOf.exe
  2⤵
  PID:7672
- C:\Windows\System\GQbvmJN.exe
  C:\Windows\System\GQbvmJN.exe
  2⤵
  PID:7732
- C:\Windows\System\eodtLLT.exe
  C:\Windows\System\eodtLLT.exe
  2⤵
  PID:7772
- C:\Windows\System\SGIBHso.exe
  C:\Windows\System\SGIBHso.exe
  2⤵
  PID:7792
- C:\Windows\System\aWgKeqs.exe
  C:\Windows\System\aWgKeqs.exe
  2⤵
  PID:7820
- C:\Windows\System\ZjBfLvv.exe
  C:\Windows\System\ZjBfLvv.exe
  2⤵
  PID:7836
- C:\Windows\System\eayLltv.exe
  C:\Windows\System\eayLltv.exe
  2⤵
  PID:7856
- C:\Windows\System\yWNucNt.exe
  C:\Windows\System\yWNucNt.exe
  2⤵
  PID:7876
- C:\Windows\System\IyfVPIF.exe
  C:\Windows\System\IyfVPIF.exe
  2⤵
  PID:7896
- C:\Windows\System\kqBZABr.exe
  C:\Windows\System\kqBZABr.exe
  2⤵
  PID:7920
- C:\Windows\System\FThMjly.exe
  C:\Windows\System\FThMjly.exe
  2⤵
  PID:7936
- C:\Windows\System\dxDmZWv.exe
  C:\Windows\System\dxDmZWv.exe
  2⤵
  PID:7980
- C:\Windows\System\LIAkKRF.exe
  C:\Windows\System\LIAkKRF.exe
  2⤵
  PID:8000
- C:\Windows\System\ZIusOLB.exe
  C:\Windows\System\ZIusOLB.exe
  2⤵
  PID:8048
- C:\Windows\System\AnjVBYS.exe
  C:\Windows\System\AnjVBYS.exe
  2⤵
  PID:8076
- C:\Windows\System\RHXXoZq.exe
  C:\Windows\System\RHXXoZq.exe
  2⤵
  PID:8104
- C:\Windows\System\deRICtz.exe
  C:\Windows\System\deRICtz.exe
  2⤵
  PID:1192
- C:\Windows\System\xBAFzYq.exe
  C:\Windows\System\xBAFzYq.exe
  2⤵
  PID:7184
- C:\Windows\System\sYTUbfk.exe
  C:\Windows\System\sYTUbfk.exe
  2⤵
  PID:7240
- C:\Windows\System\VxSyYzZ.exe
  C:\Windows\System\VxSyYzZ.exe
  2⤵
  PID:7268
- C:\Windows\System\vXNPTyZ.exe
  C:\Windows\System\vXNPTyZ.exe
  2⤵
  PID:7324
- C:\Windows\System\fgCQKHk.exe
  C:\Windows\System\fgCQKHk.exe
  2⤵
  PID:7420
- C:\Windows\System\JnWTlWd.exe
  C:\Windows\System\JnWTlWd.exe
  2⤵
  PID:7468
- C:\Windows\System\ytLRVAD.exe
  C:\Windows\System\ytLRVAD.exe
  2⤵
  PID:7564
- C:\Windows\System\cWGxjJN.exe
  C:\Windows\System\cWGxjJN.exe
  2⤵
  PID:7728
- C:\Windows\System\gkSBRHJ.exe
  C:\Windows\System\gkSBRHJ.exe
  2⤵
  PID:7668
- C:\Windows\System\ZFjrVHm.exe
  C:\Windows\System\ZFjrVHm.exe
  2⤵
  PID:7832
- C:\Windows\System\KcmQaLg.exe
  C:\Windows\System\KcmQaLg.exe
  2⤵
  PID:7908
- C:\Windows\System\qmefoZF.exe
  C:\Windows\System\qmefoZF.exe
  2⤵
  PID:7868
- C:\Windows\System\FkBRNzT.exe
  C:\Windows\System\FkBRNzT.exe
  2⤵
  PID:8040
- C:\Windows\System\ogHzhjl.exe
  C:\Windows\System\ogHzhjl.exe
  2⤵
  PID:8044
- C:\Windows\System\IerOVcl.exe
  C:\Windows\System\IerOVcl.exe
  2⤵
  PID:8120
- C:\Windows\System\wqHAmaI.exe
  C:\Windows\System\wqHAmaI.exe
  2⤵
  PID:8176
- C:\Windows\System\eVADMJW.exe
  C:\Windows\System\eVADMJW.exe
  2⤵
  PID:7516
- C:\Windows\System\KzXjBnL.exe
  C:\Windows\System\KzXjBnL.exe
  2⤵
  PID:7764
- C:\Windows\System\RaRUGsS.exe
  C:\Windows\System\RaRUGsS.exe
  2⤵
  PID:7972
- C:\Windows\System\QGksJja.exe
  C:\Windows\System\QGksJja.exe
  2⤵
  PID:7956
- C:\Windows\System\hYKuwqp.exe
  C:\Windows\System\hYKuwqp.exe
  2⤵
  PID:8188
- C:\Windows\System\crwuxBH.exe
  C:\Windows\System\crwuxBH.exe
  2⤵
  PID:8032
- C:\Windows\System\noVvjAb.exe
  C:\Windows\System\noVvjAb.exe
  2⤵
  PID:7296
- C:\Windows\System\HdCBJsZ.exe
  C:\Windows\System\HdCBJsZ.exe
  2⤵
  PID:7640
- C:\Windows\System\lLvFEYc.exe
  C:\Windows\System\lLvFEYc.exe
  2⤵
  PID:7664
- C:\Windows\System\DYOKIvn.exe
  C:\Windows\System\DYOKIvn.exe
  2⤵
  PID:7276
- C:\Windows\System\TfVRJWh.exe
  C:\Windows\System\TfVRJWh.exe
  2⤵
  PID:8208
- C:\Windows\System\HrqhoBK.exe
  C:\Windows\System\HrqhoBK.exe
  2⤵
  PID:8232
- C:\Windows\System\EpyoWhA.exe
  C:\Windows\System\EpyoWhA.exe
  2⤵
  PID:8252
- C:\Windows\System\CjSkoyZ.exe
  C:\Windows\System\CjSkoyZ.exe
  2⤵
  PID:8280
- C:\Windows\System\mMXdOTn.exe
  C:\Windows\System\mMXdOTn.exe
  2⤵
  PID:8296
- C:\Windows\System\ctybVku.exe
  C:\Windows\System\ctybVku.exe
  2⤵
  PID:8320
- C:\Windows\System\svFyKJK.exe
  C:\Windows\System\svFyKJK.exe
  2⤵
  PID:8340
- C:\Windows\System\zqKPJoZ.exe
  C:\Windows\System\zqKPJoZ.exe
  2⤵
  PID:8360
- C:\Windows\System\QNeuDPu.exe
  C:\Windows\System\QNeuDPu.exe
  2⤵
  PID:8376
- C:\Windows\System\LwnJsMV.exe
  C:\Windows\System\LwnJsMV.exe
  2⤵
  PID:8396
- C:\Windows\System\ERSBJPS.exe
  C:\Windows\System\ERSBJPS.exe
  2⤵
  PID:8416
- C:\Windows\System\KprHyTq.exe
  C:\Windows\System\KprHyTq.exe
  2⤵
  PID:8440
- C:\Windows\System\DaMglRA.exe
  C:\Windows\System\DaMglRA.exe
  2⤵
  PID:8456
- C:\Windows\System\STngGkx.exe
  C:\Windows\System\STngGkx.exe
  2⤵
  PID:8476
- C:\Windows\System\QBhBbCr.exe
  C:\Windows\System\QBhBbCr.exe
  2⤵
  PID:8496
- C:\Windows\System\TgCxrzU.exe
  C:\Windows\System\TgCxrzU.exe
  2⤵
  PID:8512
- C:\Windows\System\dYDaTJE.exe
  C:\Windows\System\dYDaTJE.exe
  2⤵
  PID:8544
- C:\Windows\System\QdmIZpf.exe
  C:\Windows\System\QdmIZpf.exe
  2⤵
  PID:8564
- C:\Windows\System\TmvLdCr.exe
  C:\Windows\System\TmvLdCr.exe
  2⤵
  PID:8588
- C:\Windows\System\nhGjODE.exe
  C:\Windows\System\nhGjODE.exe
  2⤵
  PID:8608
- C:\Windows\System\qxwiqkD.exe
  C:\Windows\System\qxwiqkD.exe
  2⤵
  PID:8624
- C:\Windows\System\PIbyKyx.exe
  C:\Windows\System\PIbyKyx.exe
  2⤵
  PID:8648
- C:\Windows\System\KytOEJW.exe
  C:\Windows\System\KytOEJW.exe
  2⤵
  PID:8672
- C:\Windows\System\xSfgRBo.exe
  C:\Windows\System\xSfgRBo.exe
  2⤵
  PID:8692
- C:\Windows\System\keflWbe.exe
  C:\Windows\System\keflWbe.exe
  2⤵
  PID:8712
- C:\Windows\System\BZnfYae.exe
  C:\Windows\System\BZnfYae.exe
  2⤵
  PID:8736
- C:\Windows\System\kGDWTrO.exe
  C:\Windows\System\kGDWTrO.exe
  2⤵
  PID:8756
- C:\Windows\System\RuZLiLy.exe
  C:\Windows\System\RuZLiLy.exe
  2⤵
  PID:8784
- C:\Windows\System\XVWWcLD.exe
  C:\Windows\System\XVWWcLD.exe
  2⤵
  PID:8884
- C:\Windows\System\XPjsPEJ.exe
  C:\Windows\System\XPjsPEJ.exe
  2⤵
  PID:8944
- C:\Windows\System\iRmyxdi.exe
  C:\Windows\System\iRmyxdi.exe
  2⤵
  PID:8964
- C:\Windows\System\NDQRDiL.exe
  C:\Windows\System\NDQRDiL.exe
  2⤵
  PID:8992
- C:\Windows\System\FpcZnxK.exe
  C:\Windows\System\FpcZnxK.exe
  2⤵
  PID:9008
- C:\Windows\System\BUzPHDT.exe
  C:\Windows\System\BUzPHDT.exe
  2⤵
  PID:9028
- C:\Windows\System\jFyZRxq.exe
  C:\Windows\System\jFyZRxq.exe
  2⤵
  PID:9052
- C:\Windows\System\rREaXMy.exe
  C:\Windows\System\rREaXMy.exe
  2⤵
  PID:9068
- C:\Windows\System\ZHypBoR.exe
  C:\Windows\System\ZHypBoR.exe
  2⤵
  PID:9092
- C:\Windows\System\fXonyCI.exe
  C:\Windows\System\fXonyCI.exe
  2⤵
  PID:9112
- C:\Windows\System\eQkoBVW.exe
  C:\Windows\System\eQkoBVW.exe
  2⤵
  PID:9128
- C:\Windows\System\fTdIPPY.exe
  C:\Windows\System\fTdIPPY.exe
  2⤵
  PID:9148
- C:\Windows\System\fvGwjZe.exe
  C:\Windows\System\fvGwjZe.exe
  2⤵
  PID:9172
- C:\Windows\System\UfKghcc.exe
  C:\Windows\System\UfKghcc.exe
  2⤵
  PID:9192
- C:\Windows\System\fKVRhOT.exe
  C:\Windows\System\fKVRhOT.exe
  2⤵
  PID:7500
- C:\Windows\System\LCYaInq.exe
  C:\Windows\System\LCYaInq.exe
  2⤵
  PID:7528
- C:\Windows\System\isPIGVL.exe
  C:\Windows\System\isPIGVL.exe
  2⤵
  PID:1844
- C:\Windows\System\wirxbcc.exe
  C:\Windows\System\wirxbcc.exe
  2⤵
  PID:8240
- C:\Windows\System\IYqczmu.exe
  C:\Windows\System\IYqczmu.exe
  2⤵
  PID:8288
- C:\Windows\System\OPimgnv.exe
  C:\Windows\System\OPimgnv.exe
  2⤵
  PID:8268
- C:\Windows\System\JxvIqgx.exe
  C:\Windows\System\JxvIqgx.exe
  2⤵
  PID:8448
- C:\Windows\System\RbzrRcD.exe
  C:\Windows\System\RbzrRcD.exe
  2⤵
  PID:8404
- C:\Windows\System\INUYHBI.exe
  C:\Windows\System\INUYHBI.exe
  2⤵
  PID:8436
- C:\Windows\System\OKTjNUz.exe
  C:\Windows\System\OKTjNUz.exe
  2⤵
  PID:8488
- C:\Windows\System\GRAhzJl.exe
  C:\Windows\System\GRAhzJl.exe
  2⤵
  PID:8792
- C:\Windows\System\delzAcY.exe
  C:\Windows\System\delzAcY.exe
  2⤵
  PID:8644
- C:\Windows\System\mjTBbxh.exe
  C:\Windows\System\mjTBbxh.exe
  2⤵
  PID:8796
- C:\Windows\System\PtuxmnX.exe
  C:\Windows\System\PtuxmnX.exe
  2⤵
  PID:8916
- C:\Windows\System\SdURKfB.exe
  C:\Windows\System\SdURKfB.exe
  2⤵
  PID:8620
- C:\Windows\System\hXmllKY.exe
  C:\Windows\System\hXmllKY.exe
  2⤵
  PID:8708
- C:\Windows\System\wmMPoWS.exe
  C:\Windows\System\wmMPoWS.exe
  2⤵
  PID:8752
- C:\Windows\System\nzkdAXz.exe
  C:\Windows\System\nzkdAXz.exe
  2⤵
  PID:9004
- C:\Windows\System\MrTVIzK.exe
  C:\Windows\System\MrTVIzK.exe
  2⤵
  PID:4208
- C:\Windows\System\cNmtRsa.exe
  C:\Windows\System\cNmtRsa.exe
  2⤵
  PID:9188
- C:\Windows\System\AbjfUQI.exe
  C:\Windows\System\AbjfUQI.exe
  2⤵
  PID:8952
- C:\Windows\System\DrZQobN.exe
  C:\Windows\System\DrZQobN.exe
  2⤵
  PID:9228
- C:\Windows\System\DUorJrn.exe
  C:\Windows\System\DUorJrn.exe
  2⤵
  PID:9248
- C:\Windows\System\pDCXDQd.exe
  C:\Windows\System\pDCXDQd.exe
  2⤵
  PID:9280
- C:\Windows\System\WwYYCZI.exe
  C:\Windows\System\WwYYCZI.exe
  2⤵
  PID:9296
- C:\Windows\System\KvZlBZd.exe
  C:\Windows\System\KvZlBZd.exe
  2⤵
  PID:9316
- C:\Windows\System\sGYYWha.exe
  C:\Windows\System\sGYYWha.exe
  2⤵
  PID:9340
- C:\Windows\System\esyorOy.exe
  C:\Windows\System\esyorOy.exe
  2⤵
  PID:9360
- C:\Windows\System\aeNkcXc.exe
  C:\Windows\System\aeNkcXc.exe
  2⤵
  PID:9384
- C:\Windows\System\UGlqEJT.exe
  C:\Windows\System\UGlqEJT.exe
  2⤵
  PID:9400
- C:\Windows\System\WLeGNhM.exe
  C:\Windows\System\WLeGNhM.exe
  2⤵
  PID:9420
- C:\Windows\System\ujnfSuU.exe
  C:\Windows\System\ujnfSuU.exe
  2⤵
  PID:9444
- C:\Windows\System\TKJzkyp.exe
  C:\Windows\System\TKJzkyp.exe
  2⤵
  PID:9464
- C:\Windows\System\VrpohMI.exe
  C:\Windows\System\VrpohMI.exe
  2⤵
  PID:9484
- C:\Windows\System\HEZocIK.exe
  C:\Windows\System\HEZocIK.exe
  2⤵
  PID:9504
- C:\Windows\System\xWDaKGt.exe
  C:\Windows\System\xWDaKGt.exe
  2⤵
  PID:9524
- C:\Windows\System\OnnssIL.exe
  C:\Windows\System\OnnssIL.exe
  2⤵
  PID:9544
- C:\Windows\System\Pmhhury.exe
  C:\Windows\System\Pmhhury.exe
  2⤵
  PID:9564
- C:\Windows\System\ROdaSQA.exe
  C:\Windows\System\ROdaSQA.exe
  2⤵
  PID:9588
- C:\Windows\System\zJDyPJP.exe
  C:\Windows\System\zJDyPJP.exe
  2⤵
  PID:9604
- C:\Windows\System\HoPBKqr.exe
  C:\Windows\System\HoPBKqr.exe
  2⤵
  PID:9632
- C:\Windows\System\fVJLZea.exe
  C:\Windows\System\fVJLZea.exe
  2⤵
  PID:9652
- C:\Windows\System\DtQlrUT.exe
  C:\Windows\System\DtQlrUT.exe
  2⤵
  PID:9672
- C:\Windows\System\FoacvPw.exe
  C:\Windows\System\FoacvPw.exe
  2⤵
  PID:9696
- C:\Windows\System\eYxWIKy.exe
  C:\Windows\System\eYxWIKy.exe
  2⤵
  PID:9712
- C:\Windows\System\wBkWYCz.exe
  C:\Windows\System\wBkWYCz.exe
  2⤵
  PID:9736
- C:\Windows\System\BYeYevB.exe
  C:\Windows\System\BYeYevB.exe
  2⤵
  PID:9756
- C:\Windows\System\lTbYcYM.exe
  C:\Windows\System\lTbYcYM.exe
  2⤵
  PID:9772
- C:\Windows\System\GvlUWrP.exe
  C:\Windows\System\GvlUWrP.exe
  2⤵
  PID:9792
- C:\Windows\System\saZpqmh.exe
  C:\Windows\System\saZpqmh.exe
  2⤵
  PID:9812
- C:\Windows\System\UFAXirc.exe
  C:\Windows\System\UFAXirc.exe
  2⤵
  PID:9836
- C:\Windows\System\AiuYEwi.exe
  C:\Windows\System\AiuYEwi.exe
  2⤵
  PID:9856
- C:\Windows\System\bjdIbrJ.exe
  C:\Windows\System\bjdIbrJ.exe
  2⤵
  PID:9880
- C:\Windows\System\EdpcMWG.exe
  C:\Windows\System\EdpcMWG.exe
  2⤵
  PID:9900
- C:\Windows\System\DKonaAu.exe
  C:\Windows\System\DKonaAu.exe
  2⤵
  PID:9920
- C:\Windows\System\rjMHjjM.exe
  C:\Windows\System\rjMHjjM.exe
  2⤵
  PID:9940
- C:\Windows\System\HASkvXV.exe
  C:\Windows\System\HASkvXV.exe
  2⤵
  PID:9960
- C:\Windows\System\hfZLDdp.exe
  C:\Windows\System\hfZLDdp.exe
  2⤵
  PID:9984
- C:\Windows\System\KEakBlw.exe
  C:\Windows\System\KEakBlw.exe
  2⤵
  PID:10044
- C:\Windows\System\eLdsnKH.exe
  C:\Windows\System\eLdsnKH.exe
  2⤵
  PID:10060
- C:\Windows\System\TysQpgy.exe
  C:\Windows\System\TysQpgy.exe
  2⤵
  PID:10076
- C:\Windows\System\lUKikuJ.exe
  C:\Windows\System\lUKikuJ.exe
  2⤵
  PID:10100
- C:\Windows\System\IwtUazJ.exe
  C:\Windows\System\IwtUazJ.exe
  2⤵
  PID:10116
- C:\Windows\System\yQBbCZn.exe
  C:\Windows\System\yQBbCZn.exe
  2⤵
  PID:10144
- C:\Windows\System\tdrQjhc.exe
  C:\Windows\System\tdrQjhc.exe
  2⤵
  PID:10164
- C:\Windows\System\aJjyBGi.exe
  C:\Windows\System\aJjyBGi.exe
  2⤵
  PID:10188
- C:\Windows\System\ezoDKVC.exe
  C:\Windows\System\ezoDKVC.exe
  2⤵
  PID:10208
- C:\Windows\System\pXeLrSg.exe
  C:\Windows\System\pXeLrSg.exe
  2⤵
  PID:10228
- C:\Windows\System\XUwPiSB.exe
  C:\Windows\System\XUwPiSB.exe
  2⤵
  PID:8304
- C:\Windows\System\ZUhrMOB.exe
  C:\Windows\System\ZUhrMOB.exe
  2⤵
  PID:8604
- C:\Windows\System\bALnvhc.exe
  C:\Windows\System\bALnvhc.exe
  2⤵
  PID:9120
- C:\Windows\System\UAEPwNV.exe
  C:\Windows\System\UAEPwNV.exe
  2⤵
  PID:8940
- C:\Windows\System\FfNmmTj.exe
  C:\Windows\System\FfNmmTj.exe
  2⤵
  PID:7808
- C:\Windows\System\FMBDEyB.exe
  C:\Windows\System\FMBDEyB.exe
  2⤵
  PID:9264
- C:\Windows\System\lvKmjdo.exe
  C:\Windows\System\lvKmjdo.exe
  2⤵
  PID:9292
- C:\Windows\System\QKydeqN.exe
  C:\Windows\System\QKydeqN.exe
  2⤵
  PID:9064
- C:\Windows\System\PlPHYMD.exe
  C:\Windows\System\PlPHYMD.exe
  2⤵
  PID:9124
- C:\Windows\System\SaRKvio.exe
  C:\Windows\System\SaRKvio.exe
  2⤵
  PID:9104
- C:\Windows\System\xeitOah.exe
  C:\Windows\System\xeitOah.exe
  2⤵
  PID:9472
- C:\Windows\System\DLgWwCu.exe
  C:\Windows\System\DLgWwCu.exe
  2⤵
  PID:9512
- C:\Windows\System\oaxivOf.exe
  C:\Windows\System\oaxivOf.exe
  2⤵
  PID:10368
- C:\Windows\System\HPEdYnP.exe
  C:\Windows\System\HPEdYnP.exe
  2⤵
  PID:10488
- C:\Windows\System\BXhIjbJ.exe
  C:\Windows\System\BXhIjbJ.exe
  2⤵
  PID:10508
- C:\Windows\System\ErsHibT.exe
  C:\Windows\System\ErsHibT.exe
  2⤵
  PID:10536
- C:\Windows\System\kjptisC.exe
  C:\Windows\System\kjptisC.exe
  2⤵
  PID:10556
- C:\Windows\System\cIeFpLx.exe
  C:\Windows\System\cIeFpLx.exe
  2⤵
  PID:10580
- C:\Windows\System\aeChicZ.exe
  C:\Windows\System\aeChicZ.exe
  2⤵
  PID:10596
- C:\Windows\System\nyXpDYQ.exe
  C:\Windows\System\nyXpDYQ.exe
  2⤵
  PID:10612
- C:\Windows\System\DThyfRh.exe
  C:\Windows\System\DThyfRh.exe
  2⤵
  PID:10628
- C:\Windows\System\XHFLItb.exe
  C:\Windows\System\XHFLItb.exe
  2⤵
  PID:10644
- C:\Windows\System\nAjLlpb.exe
  C:\Windows\System\nAjLlpb.exe
  2⤵
  PID:10660
- C:\Windows\System\KYpZpUg.exe
  C:\Windows\System\KYpZpUg.exe
  2⤵
  PID:10680
- C:\Windows\System\DMOatrh.exe
  C:\Windows\System\DMOatrh.exe
  2⤵
  PID:10700
- C:\Windows\System\akAMnTv.exe
  C:\Windows\System\akAMnTv.exe
  2⤵
  PID:10716
- C:\Windows\System\aiFzUjD.exe
  C:\Windows\System\aiFzUjD.exe
  2⤵
  PID:10748
- C:\Windows\System\iBgedxC.exe
  C:\Windows\System\iBgedxC.exe
  2⤵
  PID:10780
- C:\Windows\System\hYvYPIu.exe
  C:\Windows\System\hYvYPIu.exe
  2⤵
  PID:10804
- C:\Windows\System\jSRGYQu.exe
  C:\Windows\System\jSRGYQu.exe
  2⤵
  PID:10820
- C:\Windows\System\rfKCBIu.exe
  C:\Windows\System\rfKCBIu.exe
  2⤵
  PID:10836
- C:\Windows\System\ReChiIa.exe
  C:\Windows\System\ReChiIa.exe
  2⤵
  PID:10852
- C:\Windows\System\fknUGLm.exe
  C:\Windows\System\fknUGLm.exe
  2⤵
  PID:10868
- C:\Windows\System\ldDYKOg.exe
  C:\Windows\System\ldDYKOg.exe
  2⤵
  PID:10884
- C:\Windows\System\HubYBfd.exe
  C:\Windows\System\HubYBfd.exe
  2⤵
  PID:10904
- C:\Windows\System\imSMziZ.exe
  C:\Windows\System\imSMziZ.exe
  2⤵
  PID:10920
- C:\Windows\System\GHOezGM.exe
  C:\Windows\System\GHOezGM.exe
  2⤵
  PID:10936
- C:\Windows\System\chuUzTs.exe
  C:\Windows\System\chuUzTs.exe
  2⤵
  PID:10952
- C:\Windows\System\oBhSaGt.exe
  C:\Windows\System\oBhSaGt.exe
  2⤵
  PID:10968
- C:\Windows\System\plBlreQ.exe
  C:\Windows\System\plBlreQ.exe
  2⤵
  PID:10984
- C:\Windows\System\LVlTjCG.exe
  C:\Windows\System\LVlTjCG.exe
  2⤵
  PID:11000
- C:\Windows\System\QmNKjXb.exe
  C:\Windows\System\QmNKjXb.exe
  2⤵
  PID:11016
- C:\Windows\System\bEcquBB.exe
  C:\Windows\System\bEcquBB.exe
  2⤵
  PID:11032
- C:\Windows\System\JWtWSYR.exe
  C:\Windows\System\JWtWSYR.exe
  2⤵
  PID:11056
- C:\Windows\System\KitEWLV.exe
  C:\Windows\System\KitEWLV.exe
  2⤵
  PID:11076
- C:\Windows\System\DJKzrum.exe
  C:\Windows\System\DJKzrum.exe
  2⤵
  PID:11100
- C:\Windows\System\NETEvUl.exe
  C:\Windows\System\NETEvUl.exe
  2⤵
  PID:11116
- C:\Windows\System\jPIwNPt.exe
  C:\Windows\System\jPIwNPt.exe
  2⤵
  PID:11132
- C:\Windows\System\Vkpawrz.exe
  C:\Windows\System\Vkpawrz.exe
  2⤵
  PID:11156
- C:\Windows\System\QkfbIuG.exe
  C:\Windows\System\QkfbIuG.exe
  2⤵
  PID:11172
- C:\Windows\System\CtkcFqo.exe
  C:\Windows\System\CtkcFqo.exe
  2⤵
  PID:9980
- C:\Windows\System\pzFAQkB.exe
  C:\Windows\System\pzFAQkB.exe
  2⤵
  PID:8748
- C:\Windows\System\ZJxuqVk.exe
  C:\Windows\System\ZJxuqVk.exe
  2⤵
  PID:9020
- C:\Windows\System\wBUFFxX.exe
  C:\Windows\System\wBUFFxX.exe
  2⤵
  PID:10068
- C:\Windows\System\jTfEivp.exe
  C:\Windows\System\jTfEivp.exe
  2⤵
  PID:10052
- C:\Windows\System\jMWnLio.exe
  C:\Windows\System\jMWnLio.exe
  2⤵
  PID:10352
- C:\Windows\System\doSpjcB.exe
  C:\Windows\System\doSpjcB.exe
  2⤵
  PID:10360
- C:\Windows\System\xWablWo.exe
  C:\Windows\System\xWablWo.exe
  2⤵
  PID:10388
- C:\Windows\System\HmAThVY.exe
  C:\Windows\System\HmAThVY.exe
  2⤵
  PID:10420
- C:\Windows\System\gksCQnE.exe
  C:\Windows\System\gksCQnE.exe
  2⤵
  PID:10844
- C:\Windows\System\iCBaqYZ.exe
  C:\Windows\System\iCBaqYZ.exe
  2⤵
  PID:10624
- C:\Windows\System\EHciQil.exe
  C:\Windows\System\EHciQil.exe
  2⤵
  PID:11192
- C:\Windows\System\ipXuYNc.exe
  C:\Windows\System\ipXuYNc.exe
  2⤵
  PID:11072
- C:\Windows\System\RSNsToy.exe
  C:\Windows\System\RSNsToy.exe
  2⤵
  PID:11128
- C:\Windows\System\rbuCIoA.exe
  C:\Windows\System\rbuCIoA.exe
  2⤵
  PID:11164
- C:\Windows\System\uarnndA.exe
  C:\Windows\System\uarnndA.exe
  2⤵
  PID:8352
- C:\Windows\System\SkOETmb.exe
  C:\Windows\System\SkOETmb.exe
  2⤵
  PID:11204
- C:\Windows\System\jcbkxUx.exe
  C:\Windows\System\jcbkxUx.exe
  2⤵
  PID:10992
- C:\Windows\System\VfuvRhS.exe
  C:\Windows\System\VfuvRhS.exe
  2⤵
  PID:10396
- C:\Windows\System\oyUYZZq.exe
  C:\Windows\System\oyUYZZq.exe
  2⤵
  PID:7716
- C:\Windows\System\YYlXhBe.exe
  C:\Windows\System\YYlXhBe.exe
  2⤵
  PID:11236
- C:\Windows\System\ddrVNsr.exe
  C:\Windows\System\ddrVNsr.exe
  2⤵
  PID:8536
- C:\Windows\System\TaUCgwP.exe
  C:\Windows\System\TaUCgwP.exe
  2⤵
  PID:10528
- C:\Windows\System\ErDqMZn.exe
  C:\Windows\System\ErDqMZn.exe
  2⤵
  PID:11260
- C:\Windows\System\iJvMaVS.exe
  C:\Windows\System\iJvMaVS.exe
  2⤵
  PID:1140
- C:\Windows\System\BvsYdNu.exe
  C:\Windows\System\BvsYdNu.exe
  2⤵
  PID:9432
- C:\Windows\System\grNfLBq.exe
  C:\Windows\System\grNfLBq.exe
  2⤵
  PID:9720
- C:\Windows\System\myulHIS.exe
  C:\Windows\System\myulHIS.exe
  2⤵
  PID:10408
- C:\Windows\System\eCBUAdX.exe
  C:\Windows\System\eCBUAdX.exe
  2⤵
  PID:3604
- C:\Windows\System\mmhgPCa.exe
  C:\Windows\System\mmhgPCa.exe
  2⤵
  PID:11276
- C:\Windows\System\TiLoybP.exe
  C:\Windows\System\TiLoybP.exe
  2⤵
  PID:11304
- C:\Windows\System\wqTVlnZ.exe
  C:\Windows\System\wqTVlnZ.exe
  2⤵
  PID:11328
- C:\Windows\System\PiCYvYp.exe
  C:\Windows\System\PiCYvYp.exe
  2⤵
  PID:11352
- C:\Windows\System\hluEaaG.exe
  C:\Windows\System\hluEaaG.exe
  2⤵
  PID:11372
- C:\Windows\System\qtCvIYT.exe
  C:\Windows\System\qtCvIYT.exe
  2⤵
  PID:11388
- C:\Windows\System\IGOdVHt.exe
  C:\Windows\System\IGOdVHt.exe
  2⤵
  PID:11412
- C:\Windows\System\uiKLBqp.exe
  C:\Windows\System\uiKLBqp.exe
  2⤵
  PID:11428
- C:\Windows\System\NqTYoqj.exe
  C:\Windows\System\NqTYoqj.exe
  2⤵
  PID:11444
- C:\Windows\System\keJNMwi.exe
  C:\Windows\System\keJNMwi.exe
  2⤵
  PID:11460
- C:\Windows\System\HjaoyPs.exe
  C:\Windows\System\HjaoyPs.exe
  2⤵
  PID:11480
- C:\Windows\System\bTzEzUc.exe
  C:\Windows\System\bTzEzUc.exe
  2⤵
  PID:11504
- C:\Windows\System\aHStTir.exe
  C:\Windows\System\aHStTir.exe
  2⤵
  PID:11520
- C:\Windows\System\MgEzZbQ.exe
  C:\Windows\System\MgEzZbQ.exe
  2⤵
  PID:11540
- C:\Windows\System\tkOkQJK.exe
  C:\Windows\System\tkOkQJK.exe
  2⤵
  PID:11556
- C:\Windows\System\LhdoEpm.exe
  C:\Windows\System\LhdoEpm.exe
  2⤵
  PID:11572
- C:\Windows\System\YQwIiSU.exe
  C:\Windows\System\YQwIiSU.exe
  2⤵
  PID:11588
- C:\Windows\System\pVkTjsw.exe
  C:\Windows\System\pVkTjsw.exe
  2⤵
  PID:11616
- C:\Windows\System\JytlpEM.exe
  C:\Windows\System\JytlpEM.exe
  2⤵
  PID:11632
- C:\Windows\System\jLDsvpT.exe
  C:\Windows\System\jLDsvpT.exe
  2⤵
  PID:11648
- C:\Windows\System\FihPJBz.exe
  C:\Windows\System\FihPJBz.exe
  2⤵
  PID:11676
- C:\Windows\System\eMVKABS.exe
  C:\Windows\System\eMVKABS.exe
  2⤵
  PID:11696
- C:\Windows\System\YIbteNg.exe
  C:\Windows\System\YIbteNg.exe
  2⤵
  PID:11716
- C:\Windows\System\llGPHib.exe
  C:\Windows\System\llGPHib.exe
  2⤵
  PID:11736
- C:\Windows\System\PUflwKF.exe
  C:\Windows\System\PUflwKF.exe
  2⤵
  PID:11752
- C:\Windows\System\zmHgHKI.exe
  C:\Windows\System\zmHgHKI.exe
  2⤵
  PID:11780
- C:\Windows\System\KVYpucE.exe
  C:\Windows\System\KVYpucE.exe
  2⤵
  PID:11800
- C:\Windows\System\jtsqKkX.exe
  C:\Windows\System\jtsqKkX.exe
  2⤵
  PID:11820
- C:\Windows\System\BTDhetJ.exe
  C:\Windows\System\BTDhetJ.exe
  2⤵
  PID:11844
- C:\Windows\System\YupXOug.exe
  C:\Windows\System\YupXOug.exe
  2⤵
  PID:11864
- C:\Windows\System\DMwNDdj.exe
  C:\Windows\System\DMwNDdj.exe
  2⤵
  PID:11884
- C:\Windows\System\zLPSVzA.exe
  C:\Windows\System\zLPSVzA.exe
  2⤵
  PID:11900
- C:\Windows\System\oddqKmU.exe
  C:\Windows\System\oddqKmU.exe
  2⤵
  PID:11916
- C:\Windows\System\XtqSIcY.exe
  C:\Windows\System\XtqSIcY.exe
  2⤵
  PID:11936
- C:\Windows\System\HJXoFtP.exe
  C:\Windows\System\HJXoFtP.exe
  2⤵
  PID:11956
- C:\Windows\System\MqKDfQm.exe
  C:\Windows\System\MqKDfQm.exe
  2⤵
  PID:11976
- C:\Windows\System\HiQRgip.exe
  C:\Windows\System\HiQRgip.exe
  2⤵
  PID:11992
- C:\Windows\System\FHbWlCh.exe
  C:\Windows\System\FHbWlCh.exe
  2⤵
  PID:12008
- C:\Windows\System\XWHjWVo.exe
  C:\Windows\System\XWHjWVo.exe
  2⤵
  PID:12032
- C:\Windows\System\grJAdPe.exe
  C:\Windows\System\grJAdPe.exe
  2⤵
  PID:12056
- C:\Windows\System\zOKuYpV.exe
  C:\Windows\System\zOKuYpV.exe
  2⤵
  PID:12076
- C:\Windows\System\uihTXOs.exe
  C:\Windows\System\uihTXOs.exe
  2⤵
  PID:12104
- C:\Windows\System\mOCWmMn.exe
  C:\Windows\System\mOCWmMn.exe
  2⤵
  PID:12120
- C:\Windows\System\sWJxIaJ.exe
  C:\Windows\System\sWJxIaJ.exe
  2⤵
  PID:12136
- C:\Windows\System\anxZFax.exe
  C:\Windows\System\anxZFax.exe
  2⤵
  PID:12156
- C:\Windows\System\EtJeFKL.exe
  C:\Windows\System\EtJeFKL.exe
  2⤵
  PID:12176
- C:\Windows\System\HltKuEH.exe
  C:\Windows\System\HltKuEH.exe
  2⤵
  PID:12192
- C:\Windows\System\HqOicop.exe
  C:\Windows\System\HqOicop.exe
  2⤵
  PID:12212
- C:\Windows\System\WPDEbml.exe
  C:\Windows\System\WPDEbml.exe
  2⤵
  PID:12232
- C:\Windows\System\PuZXLjq.exe
  C:\Windows\System\PuZXLjq.exe
  2⤵
  PID:12248
- C:\Windows\System\JFQSrPg.exe
  C:\Windows\System\JFQSrPg.exe
  2⤵
  PID:12264
- C:\Windows\System\TeAgERk.exe
  C:\Windows\System\TeAgERk.exe
  2⤵
  PID:12280
- C:\Windows\System\eMHFAIk.exe
  C:\Windows\System\eMHFAIk.exe
  2⤵
  PID:4676
- C:\Windows\System\CRmqYiT.exe
  C:\Windows\System\CRmqYiT.exe
  2⤵
  PID:8640
- C:\Windows\System\GbkunSm.exe
  C:\Windows\System\GbkunSm.exe
  2⤵
  PID:10496
- C:\Windows\System\DSdwZEE.exe
  C:\Windows\System\DSdwZEE.exe
  2⤵
  PID:11296
- C:\Windows\System\gdmAcRb.exe
  C:\Windows\System\gdmAcRb.exe
  2⤵
  PID:11344
- C:\Windows\System\ADmKhdD.exe
  C:\Windows\System\ADmKhdD.exe
  2⤵
  PID:11436
- C:\Windows\System\vfcwVUT.exe
  C:\Windows\System\vfcwVUT.exe
  2⤵
  PID:4556
- C:\Windows\System\KZjeOrE.exe
  C:\Windows\System\KZjeOrE.exe
  2⤵
  PID:8520
- C:\Windows\System\rfxbFVF.exe
  C:\Windows\System\rfxbFVF.exe
  2⤵
  PID:11872
- C:\Windows\System\FuFbjgt.exe
  C:\Windows\System\FuFbjgt.exe
  2⤵
  PID:10976
- C:\Windows\System\qBVWMUQ.exe
  C:\Windows\System\qBVWMUQ.exe
  2⤵
  PID:2228
- C:\Windows\System\rkGkkZw.exe
  C:\Windows\System\rkGkkZw.exe
  2⤵
  PID:4284
- C:\Windows\System\HbKTkFG.exe
  C:\Windows\System\HbKTkFG.exe
  2⤵
  PID:3996
- C:\Windows\System\rpnXETo.exe
  C:\Windows\System\rpnXETo.exe
  2⤵
  PID:10252
- C:\Windows\System\qauXiuv.exe
  C:\Windows\System\qauXiuv.exe
  2⤵
  PID:12152
- C:\Windows\System\yUGvfUK.exe
  C:\Windows\System\yUGvfUK.exe
  2⤵
  PID:11404
- C:\Windows\System\DoZUepg.exe
  C:\Windows\System\DoZUepg.exe
  2⤵
  PID:11472
- C:\Windows\System\gwpftny.exe
  C:\Windows\System\gwpftny.exe
  2⤵
  PID:11040
- C:\Windows\System\YBAYovN.exe
  C:\Windows\System\YBAYovN.exe
  2⤵
  PID:11068
- C:\Windows\System\RHnMIQV.exe
  C:\Windows\System\RHnMIQV.exe
  2⤵
  PID:11708
- C:\Windows\System\CRRlPji.exe
  C:\Windows\System\CRRlPji.exe
  2⤵
  PID:11924
- C:\Windows\System\GMsterK.exe
  C:\Windows\System\GMsterK.exe
  2⤵
  PID:11928
- C:\Windows\System\OYrPJEu.exe
  C:\Windows\System\OYrPJEu.exe
  2⤵
  PID:11952
- C:\Windows\System\XNorqZd.exe
  C:\Windows\System\XNorqZd.exe
  2⤵
  PID:11108
- C:\Windows\System\WQdpzcP.exe
  C:\Windows\System\WQdpzcP.exe
  2⤵
  PID:4348
- C:\Windows\System\yNwNwYr.exe
  C:\Windows\System\yNwNwYr.exe
  2⤵
  PID:4892
- C:\Windows\System\sCQEmju.exe
  C:\Windows\System\sCQEmju.exe
  2⤵
  PID:12300
- C:\Windows\System\AmdWVRd.exe
  C:\Windows\System\AmdWVRd.exe
  2⤵
  PID:12324
- C:\Windows\System\cjWtOgX.exe
  C:\Windows\System\cjWtOgX.exe
  2⤵
  PID:12344
- C:\Windows\System\TuekBCV.exe
  C:\Windows\System\TuekBCV.exe
  2⤵
  PID:12372
- C:\Windows\System\HUVhJuF.exe
  C:\Windows\System\HUVhJuF.exe
  2⤵
  PID:12392
- C:\Windows\System\SmTvaLa.exe
  C:\Windows\System\SmTvaLa.exe
  2⤵
  PID:12412
- C:\Windows\System\gVOrFyg.exe
  C:\Windows\System\gVOrFyg.exe
  2⤵
  PID:12436
- C:\Windows\System\pqiZxQZ.exe
  C:\Windows\System\pqiZxQZ.exe
  2⤵
  PID:12456
- C:\Windows\System\ZXWrwRD.exe
  C:\Windows\System\ZXWrwRD.exe
  2⤵
  PID:12476
- C:\Windows\System\qINtiHE.exe
  C:\Windows\System\qINtiHE.exe
  2⤵
  PID:12496
- C:\Windows\System\XlonJNX.exe
  C:\Windows\System\XlonJNX.exe
  2⤵
  PID:12516
- C:\Windows\System\IHmGGFB.exe
  C:\Windows\System\IHmGGFB.exe
  2⤵
  PID:12536
- C:\Windows\System\uhDzpBq.exe
  C:\Windows\System\uhDzpBq.exe
  2⤵
  PID:12560
- C:\Windows\System\iAgAWqp.exe
  C:\Windows\System\iAgAWqp.exe
  2⤵
  PID:12580
- C:\Windows\System\NJmggEA.exe
  C:\Windows\System\NJmggEA.exe
  2⤵
  PID:12600
- C:\Windows\System\FcEBipF.exe
  C:\Windows\System\FcEBipF.exe
  2⤵
  PID:12616
- C:\Windows\System\SLsFxBm.exe
  C:\Windows\System\SLsFxBm.exe
  2⤵
  PID:12640
- C:\Windows\System\YNopGoH.exe
  C:\Windows\System\YNopGoH.exe
  2⤵
  PID:12664
- C:\Windows\System\LhJrvoM.exe
  C:\Windows\System\LhJrvoM.exe
  2⤵
  PID:12680
- C:\Windows\System\Vaxtlnw.exe
  C:\Windows\System\Vaxtlnw.exe
  2⤵
  PID:12700
- C:\Windows\System\wcevGxB.exe
  C:\Windows\System\wcevGxB.exe
  2⤵
  PID:12716
- C:\Windows\System\AUsBaGi.exe
  C:\Windows\System\AUsBaGi.exe
  2⤵
  PID:13016
- C:\Windows\System\WUoTpeb.exe
  C:\Windows\System\WUoTpeb.exe
  2⤵
  PID:13168
- C:\Windows\System\PPstNbq.exe
  C:\Windows\System\PPstNbq.exe
  2⤵
  PID:13184
- C:\Windows\System\NrcScgI.exe
  C:\Windows\System\NrcScgI.exe
  2⤵
  PID:13204
- C:\Windows\System\BWsVHBF.exe
  C:\Windows\System\BWsVHBF.exe
  2⤵
  PID:13232
- C:\Windows\System\ZaMXBcv.exe
  C:\Windows\System\ZaMXBcv.exe
  2⤵
  PID:13252
- C:\Windows\System\IYGlJml.exe
  C:\Windows\System\IYGlJml.exe
  2⤵
  PID:13288
- C:\Windows\System\ysgcjnj.exe
  C:\Windows\System\ysgcjnj.exe
  2⤵
  PID:13308
- C:\Windows\System\zPOyTDz.exe
  C:\Windows\System\zPOyTDz.exe
  2⤵
  PID:11360
- C:\Windows\System\IXOCskB.exe
  C:\Windows\System\IXOCskB.exe
  2⤵
  PID:1688
- C:\Windows\System\FNtOUHv.exe
  C:\Windows\System\FNtOUHv.exe
  2⤵
  PID:12772
- C:\Windows\System\ZPowpLQ.exe
  C:\Windows\System\ZPowpLQ.exe
  2⤵
  PID:852
- C:\Windows\System\rQrLCol.exe
  C:\Windows\System\rQrLCol.exe
  2⤵
  PID:11892
- C:\Windows\System\OVkDnzQ.exe
  C:\Windows\System\OVkDnzQ.exe
  2⤵
  PID:10756
- C:\Windows\System\rpGAxRb.exe
  C:\Windows\System\rpGAxRb.exe
  2⤵
  PID:2720
- C:\Windows\System\vKMLntW.exe
  C:\Windows\System\vKMLntW.exe
  2⤵
  PID:5072
- C:\Windows\System\DKNLFpW.exe
  C:\Windows\System\DKNLFpW.exe
  2⤵
  PID:7708
- C:\Windows\System\iLNkJNv.exe
  C:\Windows\System\iLNkJNv.exe
  2⤵
  PID:12336
- C:\Windows\System\SwtHHrt.exe
  C:\Windows\System\SwtHHrt.exe
  2⤵
  PID:12420
- C:\Windows\System\ZIlIUtV.exe
  C:\Windows\System\ZIlIUtV.exe
  2⤵
  PID:12588
- C:\Windows\System\iTrqzoU.exe
  C:\Windows\System\iTrqzoU.exe
  2⤵
  PID:12612
- C:\Windows\System\dyRiveI.exe
  C:\Windows\System\dyRiveI.exe
  2⤵
  PID:10200
- C:\Windows\System\AHiqhAq.exe
  C:\Windows\System\AHiqhAq.exe
  2⤵
  PID:13008
- C:\Windows\System\IglhuSf.exe
  C:\Windows\System\IglhuSf.exe
  2⤵
  PID:5044
- C:\Windows\System\jqTyaoX.exe
  C:\Windows\System\jqTyaoX.exe
  2⤵
  PID:4820
- C:\Windows\System\xKvqqyM.exe
  C:\Windows\System\xKvqqyM.exe
  2⤵
  PID:12044
- C:\Windows\System\IjTyrTC.exe
  C:\Windows\System\IjTyrTC.exe
  2⤵
  PID:10712
- C:\Windows\System\BLBMngN.exe
  C:\Windows\System\BLBMngN.exe
  2⤵
  PID:2656
- C:\Windows\System\JefBmDM.exe
  C:\Windows\System\JefBmDM.exe
  2⤵
  PID:10356
- C:\Windows\System\FWOhtfP.exe
  C:\Windows\System\FWOhtfP.exe
  2⤵
  PID:1728
- C:\Windows\System\LswrxMM.exe
  C:\Windows\System\LswrxMM.exe
  2⤵
  PID:12368
- C:\Windows\System\aDVELxx.exe
  C:\Windows\System\aDVELxx.exe
  2⤵
  PID:12428
- C:\Windows\System\vTmwALM.exe
  C:\Windows\System\vTmwALM.exe
  2⤵
  PID:12472
- C:\Windows\System\KSZkliA.exe
  C:\Windows\System\KSZkliA.exe
  2⤵
  PID:12708
- C:\Windows\System\HQQNjOC.exe
  C:\Windows\System\HQQNjOC.exe
  2⤵
  PID:12868
- C:\Windows\System\loAzFsh.exe
  C:\Windows\System\loAzFsh.exe
  2⤵
  PID:4500
- C:\Windows\System\IMdBwlw.exe
  C:\Windows\System\IMdBwlw.exe
  2⤵
  PID:3852
- C:\Windows\System\NuFJSUH.exe
  C:\Windows\System\NuFJSUH.exe
  2⤵
  PID:13224
- C:\Windows\System\QpZihoF.exe
  C:\Windows\System\QpZihoF.exe
  2⤵
  PID:11512
- C:\Windows\System\XCvcoUB.exe
  C:\Windows\System\XCvcoUB.exe
  2⤵
  PID:10348
- C:\Windows\System\uioZuSL.exe
  C:\Windows\System\uioZuSL.exe
  2⤵
  PID:13320
- C:\Windows\System\GSZuEQv.exe
  C:\Windows\System\GSZuEQv.exe
  2⤵
  PID:13336
- C:\Windows\System\XsAJhPK.exe
  C:\Windows\System\XsAJhPK.exe
  2⤵
  PID:13532
- C:\Windows\System\sKBKFwB.exe
  C:\Windows\System\sKBKFwB.exe
  2⤵
  PID:13548
- C:\Windows\System\WZpelCM.exe
  C:\Windows\System\WZpelCM.exe
  2⤵
  PID:13608
- C:\Windows\System\OeOyZZW.exe
  C:\Windows\System\OeOyZZW.exe
  2⤵
  PID:14248
- C:\Windows\System\NhWOctO.exe
  C:\Windows\System\NhWOctO.exe
  2⤵
  PID:14320
- C:\Windows\System\pdAJGmu.exe
  C:\Windows\System\pdAJGmu.exe
  2⤵
  PID:11760
- C:\Windows\System\mEIFoIV.exe
  C:\Windows\System\mEIFoIV.exe
  2⤵
  PID:13132
- C:\Windows\System\vDkSxWk.exe
  C:\Windows\System\vDkSxWk.exe
  2⤵
  PID:12380
- C:\Windows\System\LsMPbDI.exe
  C:\Windows\System\LsMPbDI.exe
  2⤵
  PID:3844
- C:\Windows\System\vPSCgQr.exe
  C:\Windows\System\vPSCgQr.exe
  2⤵
  PID:2088
- C:\Windows\System\SRdUIkU.exe
  C:\Windows\System\SRdUIkU.exe
  2⤵
  PID:4292
- C:\Windows\System\epEYRLA.exe
  C:\Windows\System\epEYRLA.exe
  2⤵
  PID:4912
- C:\Windows\System\EbUezSH.exe
  C:\Windows\System\EbUezSH.exe
  2⤵
  PID:2436
- C:\Windows\System\CnObXoV.exe
  C:\Windows\System\CnObXoV.exe
  2⤵
  PID:3556
- C:\Windows\System\DeoCoAK.exe
  C:\Windows\System\DeoCoAK.exe
  2⤵
  PID:12168
- C:\Windows\System\HoGSKVY.exe
  C:\Windows\System\HoGSKVY.exe
  2⤵
  PID:11456
- C:\Windows\System\PRCnMIr.exe
  C:\Windows\System\PRCnMIr.exe
  2⤵
  PID:12292
- C:\Windows\System\jMQLmWv.exe
  C:\Windows\System\jMQLmWv.exe
  2⤵
  PID:12360
- C:\Windows\System\oErroQN.exe
  C:\Windows\System\oErroQN.exe
  2⤵
  PID:11624
- C:\Windows\System\cKrJiei.exe
  C:\Windows\System\cKrJiei.exe
  2⤵
  PID:544
- C:\Windows\System\ZRbiLSr.exe
  C:\Windows\System\ZRbiLSr.exe
  2⤵
  PID:12072
- C:\Windows\System\QpkseYH.exe
  C:\Windows\System\QpkseYH.exe
  2⤵
  PID:12312
- C:\Windows\System\iFgTZnR.exe
  C:\Windows\System\iFgTZnR.exe
  2⤵
  PID:12220
- C:\Windows\System\xLzJRkR.exe
  C:\Windows\System\xLzJRkR.exe
  2⤵
  PID:13628
- C:\Windows\System\SCCMLzD.exe
  C:\Windows\System\SCCMLzD.exe
  2⤵
  PID:13844
- C:\Windows\System\wovBHuD.exe
  C:\Windows\System\wovBHuD.exe
  2⤵
  PID:11492
- C:\Windows\System\wYBuIGB.exe
  C:\Windows\System\wYBuIGB.exe
  2⤵
  PID:1704
- C:\Windows\System\JxPetLF.exe
  C:\Windows\System\JxPetLF.exe
  2⤵
  PID:13780
- C:\Windows\System\VtnDORp.exe
  C:\Windows\System\VtnDORp.exe
  2⤵
  PID:2892
- C:\Windows\System\EyIEdrA.exe
  C:\Windows\System\EyIEdrA.exe
  2⤵
  PID:13732
- C:\Windows\System\nODbIsE.exe
  C:\Windows\System\nODbIsE.exe
  2⤵
  PID:5224
- C:\Windows\System\RBrrWuc.exe
  C:\Windows\System\RBrrWuc.exe
  2⤵
  PID:5344
- C:\Windows\System\hJmNBwN.exe
  C:\Windows\System\hJmNBwN.exe
  2⤵
  PID:13956
- C:\Windows\System\BpixtXz.exe
  C:\Windows\System\BpixtXz.exe
  2⤵
  PID:5428
- C:\Windows\System\mEYJDZr.exe
  C:\Windows\System\mEYJDZr.exe
  2⤵
  PID:10468
- C:\Windows\System\IYXDgMd.exe
  C:\Windows\System\IYXDgMd.exe
  2⤵
  PID:5636
- C:\Windows\System\AFzRTQK.exe
  C:\Windows\System\AFzRTQK.exe
  2⤵
  PID:5736
- C:\Windows\System\snyFQgr.exe
  C:\Windows\System\snyFQgr.exe
  2⤵
  PID:14100
- C:\Windows\System\kDkIuwI.exe
  C:\Windows\System\kDkIuwI.exe
  2⤵
  PID:2876
- C:\Windows\System\YElyInN.exe
  C:\Windows\System\YElyInN.exe
  2⤵
  PID:11724
- C:\Windows\System\LkVRzhY.exe
  C:\Windows\System\LkVRzhY.exe
  2⤵
  PID:11660
- C:\Windows\System\JNjipcD.exe
  C:\Windows\System\JNjipcD.exe
  2⤵
  PID:13368
- C:\Windows\System\FtIjpAq.exe
  C:\Windows\System\FtIjpAq.exe
  2⤵
  PID:3640
- C:\Windows\System\RMfZjLr.exe
  C:\Windows\System\RMfZjLr.exe
  2⤵
  PID:3684
- C:\Windows\System\dVBfbCw.exe
  C:\Windows\System\dVBfbCw.exe
  2⤵
  PID:13452
- C:\Windows\System\UAimGtZ.exe
  C:\Windows\System\UAimGtZ.exe
  2⤵
  PID:3572
- C:\Windows\System\orjwilE.exe
  C:\Windows\System\orjwilE.exe
  2⤵
  PID:6664
- C:\Windows\System\eXhMzrz.exe
  C:\Windows\System\eXhMzrz.exe
  2⤵
  PID:6820
- C:\Windows\System\bYmqtuU.exe
  C:\Windows\System\bYmqtuU.exe
  2⤵
  PID:11988
- C:\Windows\System\MckeCfI.exe
  C:\Windows\System\MckeCfI.exe
  2⤵
  PID:13372
- C:\Windows\System\dhAUynP.exe
  C:\Windows\System\dhAUynP.exe
  2⤵
  PID:10652
- C:\Windows\System\VGcLqki.exe
  C:\Windows\System\VGcLqki.exe
  2⤵
  PID:11664
- C:\Windows\System\FPYIsdN.exe
  C:\Windows\System\FPYIsdN.exe
  2⤵
  PID:4980
- C:\Windows\System\iorhvQQ.exe
  C:\Windows\System\iorhvQQ.exe
  2⤵
  PID:12224
- C:\Windows\System\DWuMpOR.exe
  C:\Windows\System\DWuMpOR.exe
  2⤵
  PID:14004
- C:\Windows\System\EFIBicw.exe
  C:\Windows\System\EFIBicw.exe
  2⤵
  PID:13828
- C:\Windows\System\yasdDQJ.exe
  C:\Windows\System\yasdDQJ.exe
  2⤵
  PID:14012
- C:\Windows\System\UgisWKE.exe
  C:\Windows\System\UgisWKE.exe
  2⤵
  PID:13568
- C:\Windows\System\AmAYeMj.exe
  C:\Windows\System\AmAYeMj.exe
  2⤵
  PID:13268
- C:\Windows\System\yojPZLs.exe
  C:\Windows\System\yojPZLs.exe
  2⤵
  PID:4972
- C:\Windows\System\VvyXJdh.exe
  C:\Windows\System\VvyXJdh.exe
  2⤵
  PID:14096
- C:\Windows\System\riFhRHi.exe
  C:\Windows\System\riFhRHi.exe
  2⤵
  PID:13036
- C:\Windows\System\aWxMBzb.exe
  C:\Windows\System\aWxMBzb.exe
  2⤵
  PID:4044
- C:\Windows\System\GZTtDQO.exe
  C:\Windows\System\GZTtDQO.exe
  2⤵
  PID:3836
- C:\Windows\System\ExLjEFy.exe
  C:\Windows\System\ExLjEFy.exe
  2⤵
  PID:13656
- C:\Windows\System\pmcIUSx.exe
  C:\Windows\System\pmcIUSx.exe
  2⤵
  PID:2704
- C:\Windows\System\djGQieH.exe
  C:\Windows\System\djGQieH.exe
  2⤵
  PID:12204
- C:\Windows\System\kgngWnP.exe
  C:\Windows\System\kgngWnP.exe
  2⤵
  PID:10448
- C:\Windows\System\uUEWfIc.exe
  C:\Windows\System\uUEWfIc.exe
  2⤵
  PID:3084
- C:\Windows\System\NGbhglf.exe
  C:\Windows\System\NGbhglf.exe
  2⤵
  PID:12932
- C:\Windows\System\AElcYUF.exe
  C:\Windows\System\AElcYUF.exe
  2⤵
  PID:13776
- C:\Windows\System\LZdIhZi.exe
  C:\Windows\System\LZdIhZi.exe
  2⤵
  PID:13800
- C:\Windows\System\SnQVlur.exe
  C:\Windows\System\SnQVlur.exe
  2⤵
  PID:13832
- C:\Windows\System\xcecTzu.exe
  C:\Windows\System\xcecTzu.exe
  2⤵
  PID:14276
- C:\Windows\System\zlSoCps.exe
  C:\Windows\System\zlSoCps.exe
  2⤵
  PID:4608
- C:\Windows\System\HLCsolo.exe
  C:\Windows\System\HLCsolo.exe
  2⤵
  PID:14272
- C:\Windows\System\kIEQjwn.exe
  C:\Windows\System\kIEQjwn.exe
  2⤵
  PID:14264
- C:\Windows\System\BGZClrH.exe
  C:\Windows\System\BGZClrH.exe
  2⤵
  PID:4216
- C:\Windows\System\lUExnrz.exe
  C:\Windows\System\lUExnrz.exe
  2⤵
  PID:5696
- C:\Windows\System\MbiMjvZ.exe
  C:\Windows\System\MbiMjvZ.exe
  2⤵
  PID:2356
- C:\Windows\System\xcEZlNz.exe
  C:\Windows\System\xcEZlNz.exe
  2⤵
  PID:1132
- C:\Windows\System\SnShJNE.exe
  C:\Windows\System\SnShJNE.exe
  2⤵
  PID:13424
- C:\Windows\System\sVUfYTU.exe
  C:\Windows\System\sVUfYTU.exe
  2⤵
  PID:5820
- C:\Windows\System\zauNMqq.exe
  C:\Windows\System\zauNMqq.exe
  2⤵
  PID:5940
- C:\Windows\System\QuqpGui.exe
  C:\Windows\System\QuqpGui.exe
  2⤵
  PID:6108
- C:\Windows\System\ieEypcb.exe
  C:\Windows\System\ieEypcb.exe
  2⤵
  PID:6112
- C:\Windows\System\LiLThkl.exe
  C:\Windows\System\LiLThkl.exe
  2⤵
  PID:12128
- C:\Windows\System\JWpScNR.exe
  C:\Windows\System\JWpScNR.exe
  2⤵
  PID:4540
- C:\Windows\System\wUICoKC.exe
  C:\Windows\System\wUICoKC.exe
  2⤵
  PID:2260
- C:\Windows\System\kOBycxr.exe
  C:\Windows\System\kOBycxr.exe
  2⤵
  PID:10944
- C:\Windows\System\eiUmoea.exe
  C:\Windows\System\eiUmoea.exe
  2⤵
  PID:3976
- C:\Windows\System\wBgTyzj.exe
  C:\Windows\System\wBgTyzj.exe
  2⤵
  PID:5336
- C:\Windows\System\DaPpbfh.exe
  C:\Windows\System\DaPpbfh.exe
  2⤵
  PID:13528
- C:\Windows\System\yZBcfLK.exe
  C:\Windows\System\yZBcfLK.exe
  2⤵
  PID:964
- C:\Windows\System\XUmXzmm.exe
  C:\Windows\System\XUmXzmm.exe
  2⤵
  PID:6020
- C:\Windows\System\pYRpmAF.exe
  C:\Windows\System\pYRpmAF.exe
  2⤵
  PID:13492
- C:\Windows\System\LGiQvtt.exe
  C:\Windows\System\LGiQvtt.exe
  2⤵
  PID:2940
- C:\Windows\System\ftZdRYu.exe
  C:\Windows\System\ftZdRYu.exe
  2⤵
  PID:14284
- C:\Windows\System\ZCClyrC.exe
  C:\Windows\System\ZCClyrC.exe
  2⤵
  PID:5688
- C:\Windows\System\xkcDNyF.exe
  C:\Windows\System\xkcDNyF.exe
  2⤵
  PID:3288
- C:\Windows\System\MRWBMxm.exe
  C:\Windows\System\MRWBMxm.exe
  2⤵
  PID:13924
- C:\Windows\System\OPozJmy.exe
  C:\Windows\System\OPozJmy.exe
  2⤵
  PID:6400
- C:\Windows\System\RUstzpN.exe
  C:\Windows\System\RUstzpN.exe
  2⤵
  PID:6364
- C:\Windows\System\zKaGwcD.exe
  C:\Windows\System\zKaGwcD.exe
  2⤵
  PID:13152
- C:\Windows\System\siAKdDN.exe
  C:\Windows\System\siAKdDN.exe
  2⤵
  PID:6856
- C:\Windows\System\ylCeJPk.exe
  C:\Windows\System\ylCeJPk.exe
  2⤵
  PID:6636
- C:\Windows\System\McbSDIx.exe
  C:\Windows\System\McbSDIx.exe
  2⤵
  PID:5960
- C:\Windows\System\IrqvlLj.exe
  C:\Windows\System\IrqvlLj.exe
  2⤵
  PID:6724
- C:\Windows\System\acdcXhW.exe
  C:\Windows\System\acdcXhW.exe
  2⤵
  PID:5764
- C:\Windows\System\JWNhPTh.exe
  C:\Windows\System\JWNhPTh.exe
  2⤵
  PID:5484
- C:\Windows\System\ZAIdIiG.exe
  C:\Windows\System\ZAIdIiG.exe
  2⤵
  PID:6136
- C:\Windows\System\tvACEuT.exe
  C:\Windows\System\tvACEuT.exe
  2⤵
  PID:6760
- C:\Windows\System\irdaqRl.exe
  C:\Windows\System\irdaqRl.exe
  2⤵
  PID:7124
- C:\Windows\System\DHXnvVK.exe
  C:\Windows\System\DHXnvVK.exe
  2⤵
  PID:6888
- C:\Windows\System\EeWaUVW.exe
  C:\Windows\System\EeWaUVW.exe
  2⤵
  PID:3520
- C:\Windows\System\SCkjkbm.exe
  C:\Windows\System\SCkjkbm.exe
  2⤵
  PID:12404
- C:\Windows\System\WXtViZS.exe
  C:\Windows\System\WXtViZS.exe
  2⤵
  PID:5976
- C:\Windows\System\IzZcfYA.exe
  C:\Windows\System\IzZcfYA.exe
  2⤵
  PID:6956
- C:\Windows\System\GCguCyw.exe
  C:\Windows\System\GCguCyw.exe
  2⤵
  PID:11096
- C:\Windows\System\vJIzEla.exe
  C:\Windows\System\vJIzEla.exe
  2⤵
  PID:5752
- C:\Windows\System\MaRwlAO.exe
  C:\Windows\System\MaRwlAO.exe
  2⤵
  PID:6852
- C:\Windows\System\erkyTch.exe
  C:\Windows\System\erkyTch.exe
  2⤵
  PID:6196
- C:\Windows\System\lWgKXov.exe
  C:\Windows\System\lWgKXov.exe
  2⤵
  PID:14244
- C:\Windows\System\ghdBNzp.exe
  C:\Windows\System\ghdBNzp.exe
  2⤵
  PID:6360
- C:\Windows\System\yxiYvNf.exe
  C:\Windows\System\yxiYvNf.exe
  2⤵
  PID:5132
- C:\Windows\System\MvStzri.exe
  C:\Windows\System\MvStzri.exe
  2⤵
  PID:6580
- C:\Windows\System\lhMauEw.exe
  C:\Windows\System\lhMauEw.exe
  2⤵
  PID:7144
- C:\Windows\System\IMxNjGv.exe
  C:\Windows\System\IMxNjGv.exe
  2⤵
  PID:5864
- C:\Windows\System\cUmyjur.exe
  C:\Windows\System\cUmyjur.exe
  2⤵
  PID:5216
- C:\Windows\System\UyDSOUD.exe
  C:\Windows\System\UyDSOUD.exe
  2⤵
  PID:6944
- C:\Windows\System\BAMGApv.exe
  C:\Windows\System\BAMGApv.exe
  2⤵
  PID:5740
- C:\Windows\System\NjVaBbu.exe
  C:\Windows\System\NjVaBbu.exe
  2⤵
  PID:13944
- C:\Windows\System\fXnDMry.exe
  C:\Windows\System\fXnDMry.exe
  2⤵
  PID:7160
- C:\Windows\System\eZjchRi.exe
  C:\Windows\System\eZjchRi.exe
  2⤵
  PID:4620
- C:\Windows\System\WOfFOPC.exe
  C:\Windows\System\WOfFOPC.exe
  2⤵
  PID:7252
- C:\Windows\System\aHuBQsT.exe
  C:\Windows\System\aHuBQsT.exe
  2⤵
  PID:7488
- C:\Windows\System\EbHiFnJ.exe
  C:\Windows\System\EbHiFnJ.exe
  2⤵
  PID:7288
- C:\Windows\System\ygdwpTK.exe
  C:\Windows\System\ygdwpTK.exe
  2⤵
  PID:5984
- C:\Windows\System\YtFnqBe.exe
  C:\Windows\System\YtFnqBe.exe
  2⤵
  PID:13660
- C:\Windows\System\bCBqlcg.exe
  C:\Windows\System\bCBqlcg.exe
  2⤵
  PID:2168
- C:\Windows\System\PZEuJgX.exe
  C:\Windows\System\PZEuJgX.exe
  2⤵
  PID:10676
- C:\Windows\System\xrwctIv.exe
  C:\Windows\System\xrwctIv.exe
  2⤵
  PID:7388
- C:\Windows\System\NlCKryG.exe
  C:\Windows\System\NlCKryG.exe
  2⤵
  PID:6648
- C:\Windows\System\gbBKQXE.exe
  C:\Windows\System\gbBKQXE.exe
  2⤵
  PID:6588
- C:\Windows\System\RhaPPUF.exe
  C:\Windows\System\RhaPPUF.exe
  2⤵
  PID:5928
- C:\Windows\System\gGaGgeK.exe
  C:\Windows\System\gGaGgeK.exe
  2⤵
  PID:7660
- C:\Windows\System\SgrIsgz.exe
  C:\Windows\System\SgrIsgz.exe
  2⤵
  PID:6552
- C:\Windows\System\ZDEGuIj.exe
  C:\Windows\System\ZDEGuIj.exe
  2⤵
  PID:6412
- C:\Windows\System\EWBkEvv.exe
  C:\Windows\System\EWBkEvv.exe
  2⤵
  PID:7136
- C:\Windows\System\XWmZuTz.exe
  C:\Windows\System\XWmZuTz.exe
  2⤵
  PID:7548
- C:\Windows\System\MNCpUsG.exe
  C:\Windows\System\MNCpUsG.exe
  2⤵
  PID:7844
- C:\Windows\System\NUmBPJQ.exe
  C:\Windows\System\NUmBPJQ.exe
  2⤵
  PID:5944
- C:\Windows\System\vrrrwqS.exe
  C:\Windows\System\vrrrwqS.exe
  2⤵
  PID:12096
- C:\Windows\System\JxbflQE.exe
  C:\Windows\System\JxbflQE.exe
  2⤵
  PID:14308
- C:\Windows\System\BePYxDf.exe
  C:\Windows\System\BePYxDf.exe
  2⤵
  PID:6244
- C:\Windows\System\zwYLyvz.exe
  C:\Windows\System\zwYLyvz.exe
  2⤵
  PID:8168
- C:\Windows\System\Gqofiym.exe
  C:\Windows\System\Gqofiym.exe
  2⤵
  PID:11968
- C:\Windows\System\YUZfgXV.exe
  C:\Windows\System\YUZfgXV.exe
  2⤵
  PID:7988
- C:\Windows\System\GpFYQGh.exe
  C:\Windows\System\GpFYQGh.exe
  2⤵
  PID:13888
- C:\Windows\System\SDCMpvh.exe
  C:\Windows\System\SDCMpvh.exe
  2⤵
  PID:6384
- C:\Windows\System\CvZvmdb.exe
  C:\Windows\System\CvZvmdb.exe
  2⤵
  PID:6932
- C:\Windows\System\zMNoPdj.exe
  C:\Windows\System\zMNoPdj.exe
  2⤵
  PID:6520
- C:\Windows\System\pyAXiag.exe
  C:\Windows\System\pyAXiag.exe
  2⤵
  PID:7352
- C:\Windows\System\mEzERIB.exe
  C:\Windows\System\mEzERIB.exe
  2⤵
  PID:8172
- C:\Windows\System\zRwZouw.exe
  C:\Windows\System\zRwZouw.exe
  2⤵
  PID:7212
- C:\Windows\System\aPLqktm.exe
  C:\Windows\System\aPLqktm.exe
  2⤵
  PID:7964
- C:\Windows\System\EuYUnTl.exe
  C:\Windows\System\EuYUnTl.exe
  2⤵
  PID:8128
- C:\Windows\System\OyYMVfy.exe
  C:\Windows\System\OyYMVfy.exe
  2⤵
  PID:6532
- C:\Windows\System\wyqpsZG.exe
  C:\Windows\System\wyqpsZG.exe
  2⤵
  PID:2204
- C:\Windows\System\hBAyvUM.exe
  C:\Windows\System\hBAyvUM.exe
  2⤵
  PID:8184
- C:\Windows\System\gkVAmEL.exe
  C:\Windows\System\gkVAmEL.exe
  2⤵
  PID:6608
- C:\Windows\System\yejDYmK.exe
  C:\Windows\System\yejDYmK.exe
  2⤵
  PID:7080
- C:\Windows\System\eUnXLAs.exe
  C:\Windows\System\eUnXLAs.exe
  2⤵
  PID:4588
- C:\Windows\System\qybmOUQ.exe
  C:\Windows\System\qybmOUQ.exe
  2⤵
  PID:2444
- C:\Windows\System\leKZsnS.exe
  C:\Windows\System\leKZsnS.exe
  2⤵
  PID:6824
- C:\Windows\System\AExHkwH.exe
  C:\Windows\System\AExHkwH.exe
  2⤵
  PID:7580
- C:\Windows\System\Opcspbs.exe
  C:\Windows\System\Opcspbs.exe
  2⤵
  PID:7020
- C:\Windows\System\efkKIFK.exe
  C:\Windows\System\efkKIFK.exe
  2⤵
  PID:7448
- C:\Windows\System\XPeZtCM.exe
  C:\Windows\System\XPeZtCM.exe
  2⤵
  PID:8596
- C:\Windows\System\nMSrTfQ.exe
  C:\Windows\System\nMSrTfQ.exe
  2⤵
  PID:6188
- C:\Windows\System\ggPHrcr.exe
  C:\Windows\System\ggPHrcr.exe
  2⤵
  PID:7332
- C:\Windows\System\hIImhUx.exe
  C:\Windows\System\hIImhUx.exe
  2⤵
  PID:7052
- C:\Windows\System\BgiKEuh.exe
  C:\Windows\System\BgiKEuh.exe
  2⤵
  PID:7544
- C:\Windows\System\vSWrNZX.exe
  C:\Windows\System\vSWrNZX.exe
  2⤵
  PID:13576
- C:\Windows\System\ZZWHVMV.exe
  C:\Windows\System\ZZWHVMV.exe
  2⤵
  PID:7692
- C:\Windows\System\lzZGnBR.exe
  C:\Windows\System\lzZGnBR.exe
  2⤵
  PID:13760
- C:\Windows\System\fPCaLfs.exe
  C:\Windows\System\fPCaLfs.exe
  2⤵
  PID:7228
- C:\Windows\System\ZEAvzfZ.exe
  C:\Windows\System\ZEAvzfZ.exe
  2⤵
  PID:7344
- C:\Windows\System\ljZKFTh.exe
  C:\Windows\System\ljZKFTh.exe
  2⤵
  PID:5444
- C:\Windows\System\PastiwL.exe
  C:\Windows\System\PastiwL.exe
  2⤵
  PID:11860
- C:\Windows\System\wnTXzeA.exe
  C:\Windows\System\wnTXzeA.exe
  2⤵
  PID:14344
- C:\Windows\System\jwBbZrD.exe
  C:\Windows\System\jwBbZrD.exe
  2⤵
  PID:14584
- C:\Windows\System\ziqhPwf.exe
  C:\Windows\System\ziqhPwf.exe
  2⤵
  PID:14608
- C:\Windows\System\wjftqAh.exe
  C:\Windows\System\wjftqAh.exe
  2⤵
  PID:14640
- C:\Windows\System\NOLNGWi.exe
  C:\Windows\System\NOLNGWi.exe
  2⤵
  PID:14664
- C:\Windows\System\xIgfxQH.exe
  C:\Windows\System\xIgfxQH.exe
  2⤵
  PID:14700
- C:\Windows\System\FPJSgFU.exe
  C:\Windows\System\FPJSgFU.exe
  2⤵
  PID:14720
- C:\Windows\System\uCebUOu.exe
  C:\Windows\System\uCebUOu.exe
  2⤵
  PID:14740
- C:\Windows\System\ObBpQyG.exe
  C:\Windows\System\ObBpQyG.exe
  2⤵
  PID:14764
- C:\Windows\System\ZWGgrSw.exe
  C:\Windows\System\ZWGgrSw.exe
  2⤵
  PID:14784
- C:\Windows\System\NWTvvUd.exe
  C:\Windows\System\NWTvvUd.exe
  2⤵
  PID:14808
- C:\Windows\System\TxmieFG.exe
  C:\Windows\System\TxmieFG.exe
  2⤵
  PID:14828
- C:\Windows\System\OBCwpXv.exe
  C:\Windows\System\OBCwpXv.exe
  2⤵
  PID:14844
- C:\Windows\System\tTHQHDC.exe
  C:\Windows\System\tTHQHDC.exe
  2⤵
  PID:14864
- C:\Windows\System\LrSGWyU.exe
  C:\Windows\System\LrSGWyU.exe
  2⤵
  PID:14884
- C:\Windows\System\QXMWSKe.exe
  C:\Windows\System\QXMWSKe.exe
  2⤵
  PID:14908
- C:\Windows\System\BsstTiL.exe
  C:\Windows\System\BsstTiL.exe
  2⤵
  PID:14928
- C:\Windows\System\RERGDVw.exe
  C:\Windows\System\RERGDVw.exe
  2⤵
  PID:14948
- C:\Windows\System\psVNPQK.exe
  C:\Windows\System\psVNPQK.exe
  2⤵
  PID:14964
- C:\Windows\System\vtgeCNA.exe
  C:\Windows\System\vtgeCNA.exe
  2⤵
  PID:14984
- C:\Windows\System\CgcHjlv.exe
  C:\Windows\System\CgcHjlv.exe
  2⤵
  PID:15004
- C:\Windows\System\NieuyXh.exe
  C:\Windows\System\NieuyXh.exe
  2⤵
  PID:15024
- C:\Windows\System\ULLdJLM.exe
  C:\Windows\System\ULLdJLM.exe
  2⤵
  PID:15044
- C:\Windows\System\wVxWQuJ.exe
  C:\Windows\System\wVxWQuJ.exe
  2⤵
  PID:15340
- C:\Windows\System\NmqMhUm.exe
  C:\Windows\System\NmqMhUm.exe
  2⤵
  PID:15356
- C:\Windows\System\qTNBZUb.exe
  C:\Windows\System\qTNBZUb.exe
  2⤵
  PID:8428
- C:\Windows\System\SFrwGbg.exe
  C:\Windows\System\SFrwGbg.exe
  2⤵
  PID:13332
- C:\Windows\System\rVfixft.exe
  C:\Windows\System\rVfixft.exe
  2⤵
  PID:8744
- C:\Windows\System\iTgrwTM.exe
  C:\Windows\System\iTgrwTM.exe
  2⤵
  PID:9644
- C:\Windows\System\WrRbGvm.exe
  C:\Windows\System\WrRbGvm.exe
  2⤵
  PID:13500
- C:\Windows\System\VqQyJvC.exe
  C:\Windows\System\VqQyJvC.exe
  2⤵
  PID:7416
- C:\Windows\System\JnZRFkN.exe
  C:\Windows\System\JnZRFkN.exe
  2⤵
  PID:6780
- C:\Windows\System\sMwBGyh.exe
  C:\Windows\System\sMwBGyh.exe
  2⤵
  PID:6124
- C:\Windows\System\ILZpQqq.exe
  C:\Windows\System\ILZpQqq.exe
  2⤵
  PID:8560
- C:\Windows\System\JyddfNb.exe
  C:\Windows\System\JyddfNb.exe
  2⤵
  PID:8920
- C:\Windows\System\MjiNVxP.exe
  C:\Windows\System\MjiNVxP.exe
  2⤵
  PID:9328
- C:\Windows\System\dKpQRXV.exe
  C:\Windows\System\dKpQRXV.exe
  2⤵
  PID:8092
- C:\Windows\System\xLyNtHj.exe
  C:\Windows\System\xLyNtHj.exe
  2⤵
  PID:9408
- C:\Windows\System\IZhPoFO.exe
  C:\Windows\System\IZhPoFO.exe
  2⤵
  PID:13836
- C:\Windows\System\eCvtLEo.exe
  C:\Windows\System\eCvtLEo.exe
  2⤵
  PID:14380
- C:\Windows\System\ayoSEXQ.exe
  C:\Windows\System\ayoSEXQ.exe
  2⤵
  PID:7004
- C:\Windows\System\nnEMJYN.exe
  C:\Windows\System\nnEMJYN.exe
  2⤵
  PID:8164
- C:\Windows\System\nUTIQed.exe
  C:\Windows\System\nUTIQed.exe
  2⤵
  PID:13284
- C:\Windows\System\hmNnPMk.exe
  C:\Windows\System\hmNnPMk.exe
  2⤵
  PID:6892
- C:\Windows\System\kMknFUc.exe
  C:\Windows\System\kMknFUc.exe
  2⤵
  PID:8864
- C:\Windows\System\urzPRKL.exe
  C:\Windows\System\urzPRKL.exe
  2⤵
  PID:9680
- C:\Windows\System\eEOTiuv.exe
  C:\Windows\System\eEOTiuv.exe
  2⤵
  PID:8388
- C:\Windows\System\ruQGeCp.exe
  C:\Windows\System\ruQGeCp.exe
  2⤵
  PID:14936
- C:\Windows\System\oncUFds.exe
  C:\Windows\System\oncUFds.exe
  2⤵
  PID:8984
- C:\Windows\System\YJxejwP.exe
  C:\Windows\System\YJxejwP.exe
  2⤵
  PID:15292
- C:\Windows\System\mBHRlpi.exe
  C:\Windows\System\mBHRlpi.exe
  2⤵
  PID:9044
- C:\Windows\System\qdPaXwX.exe
  C:\Windows\System\qdPaXwX.exe
  2⤵
  PID:9436
- C:\Windows\System\zdAIuhh.exe
  C:\Windows\System\zdAIuhh.exe
  2⤵
  PID:14536
- C:\Windows\System\PVADLtL.exe
  C:\Windows\System\PVADLtL.exe
  2⤵
  PID:14600
- C:\Windows\System\rdonoxV.exe
  C:\Windows\System\rdonoxV.exe
  2⤵
  PID:14632
- C:\Windows\System\VlmPoOQ.exe
  C:\Windows\System\VlmPoOQ.exe
  2⤵
  PID:14652
- C:\Windows\System\nxkvbiQ.exe
  C:\Windows\System\nxkvbiQ.exe
  2⤵
  PID:14696
- C:\Windows\System\RreYUzQ.exe
  C:\Windows\System\RreYUzQ.exe
  2⤵
  PID:9660
- C:\Windows\System\CSgOBtD.exe
  C:\Windows\System\CSgOBtD.exe
  2⤵
  PID:15172
- C:\Windows\System\WbobGZn.exe
  C:\Windows\System\WbobGZn.exe
  2⤵
  PID:9892
- C:\Windows\System\qgegmUx.exe
  C:\Windows\System\qgegmUx.exe
  2⤵
  PID:9916
- C:\Windows\System\FtrAKgC.exe
  C:\Windows\System\FtrAKgC.exe
  2⤵
  PID:14800
- C:\Windows\System\xJeaVHw.exe
  C:\Windows\System\xJeaVHw.exe
  2⤵
  PID:10256
- C:\Windows\System\ikKdiVL.exe
  C:\Windows\System\ikKdiVL.exe
  2⤵
  PID:14924
- C:\Windows\System\KAyLeQt.exe
  C:\Windows\System\KAyLeQt.exe
  2⤵
  PID:9372
- C:\Windows\System\AZbmHrU.exe
  C:\Windows\System\AZbmHrU.exe
  2⤵
  PID:14340
- C:\Windows\System\hmewdbI.exe
  C:\Windows\System\hmewdbI.exe
  2⤵
  PID:8392
- C:\Windows\System\CpOzFrM.exe
  C:\Windows\System\CpOzFrM.exe
  2⤵
  PID:15156
- C:\Windows\System\qsNfTbm.exe
  C:\Windows\System\qsNfTbm.exe
  2⤵
  PID:9724
- C:\Windows\System\UlnkuJO.exe
  C:\Windows\System\UlnkuJO.exe
  2⤵
  PID:8412
- C:\Windows\System\AfgiLqC.exe
  C:\Windows\System\AfgiLqC.exe
  2⤵
  PID:7336
- C:\Windows\System\BuyVcPZ.exe
  C:\Windows\System\BuyVcPZ.exe
  2⤵
  PID:15280
- C:\Windows\System\aSjWUKT.exe
  C:\Windows\System\aSjWUKT.exe
  2⤵
  PID:15324
- C:\Windows\System\aNkRkTe.exe
  C:\Windows\System\aNkRkTe.exe
  2⤵
  PID:9668
- C:\Windows\System\FomEZzn.exe
  C:\Windows\System\FomEZzn.exe
  2⤵
  PID:7884
- C:\Windows\System\OiVCOiy.exe
  C:\Windows\System\OiVCOiy.exe
  2⤵
  PID:9976
- C:\Windows\System\WhoiTER.exe
  C:\Windows\System\WhoiTER.exe
  2⤵
  PID:10324
- C:\Windows\System\PkahOvW.exe
  C:\Windows\System\PkahOvW.exe
  2⤵
  PID:8036
- C:\Windows\System\gSWzuUY.exe
  C:\Windows\System\gSWzuUY.exe
  2⤵
  PID:10028
- C:\Windows\System\XCYkRQO.exe
  C:\Windows\System\XCYkRQO.exe
  2⤵
  PID:6416
- C:\Windows\System\sKTZFWS.exe
  C:\Windows\System\sKTZFWS.exe
  2⤵
  PID:14432
- C:\Windows\System\EeoPSLL.exe
  C:\Windows\System\EeoPSLL.exe
  2⤵
  PID:8732
- C:\Windows\System\AiEqPJB.exe
  C:\Windows\System\AiEqPJB.exe
  2⤵
  PID:9312
- C:\Windows\System\woEWHOm.exe
  C:\Windows\System\woEWHOm.exe
  2⤵
  PID:10688
- C:\Windows\System\roUwOAH.exe
  C:\Windows\System\roUwOAH.exe
  2⤵
  PID:15144
- C:\Windows\System\NcUlXXa.exe
  C:\Windows\System\NcUlXXa.exe
  2⤵
  PID:7656
- C:\Windows\System\OtfUhBh.exe
  C:\Windows\System\OtfUhBh.exe
  2⤵
  PID:14876
- C:\Windows\System\UvQADVC.exe
  C:\Windows\System\UvQADVC.exe
  2⤵
  PID:10404
- C:\Windows\System\QCPazJF.exe
  C:\Windows\System\QCPazJF.exe
  2⤵
  PID:10264
- C:\Windows\System\ASqXuBX.exe
  C:\Windows\System\ASqXuBX.exe
  2⤵
  PID:14496
- C:\Windows\System\QauJxAt.exe
  C:\Windows\System\QauJxAt.exe
  2⤵
  PID:10476
- C:\Windows\System\mqIuwLG.exe
  C:\Windows\System\mqIuwLG.exe
  2⤵
  PID:11896
- C:\Windows\System\vlrnnNF.exe
  C:\Windows\System\vlrnnNF.exe
  2⤵
  PID:10472
- C:\Windows\System\DAteAce.exe
  C:\Windows\System\DAteAce.exe
  2⤵
  PID:9620
- C:\Windows\System\WTCLIbz.exe
  C:\Windows\System\WTCLIbz.exe
  2⤵
  PID:10088
- C:\Windows\System\ZwFCIas.exe
  C:\Windows\System\ZwFCIas.exe
  2⤵
  PID:15232
- C:\Windows\System\mSMJKWc.exe
  C:\Windows\System\mSMJKWc.exe
  2⤵
  PID:10180
- C:\Windows\System\DcimRHa.exe
  C:\Windows\System\DcimRHa.exe
  2⤵
  PID:10768
- C:\Windows\System\aPdUJae.exe
  C:\Windows\System\aPdUJae.exe
  2⤵
  PID:10436
- C:\Windows\System\KTKbKbH.exe
  C:\Windows\System\KTKbKbH.exe
  2⤵
  PID:10280
- C:\Windows\System\LCYOrqX.exe
  C:\Windows\System\LCYOrqX.exe
  2⤵
  PID:14920
- C:\Windows\System\wtVCTnn.exe
  C:\Windows\System\wtVCTnn.exe
  2⤵
  PID:1404
- C:\Windows\System\eafCXDk.exe
  C:\Windows\System\eafCXDk.exe
  2⤵
  PID:8228
- C:\Windows\System\ZHnLUYc.exe
  C:\Windows\System\ZHnLUYc.exe
  2⤵
  PID:10220
- C:\Windows\System\fpUELHM.exe
  C:\Windows\System\fpUELHM.exe
  2⤵
  PID:10292
- C:\Windows\System\IFHxAcx.exe
  C:\Windows\System\IFHxAcx.exe
  2⤵
  PID:8140
- C:\Windows\System\YJwrCJe.exe
  C:\Windows\System\YJwrCJe.exe
  2⤵
  PID:10912
- C:\Windows\System\ycTVDTE.exe
  C:\Windows\System\ycTVDTE.exe
  2⤵
  PID:10260
- C:\Windows\System\yJaUCyq.exe
  C:\Windows\System\yJaUCyq.exe
  2⤵
  PID:13872
- C:\Windows\System\NWgaLaT.exe
  C:\Windows\System\NWgaLaT.exe
  2⤵
  PID:2188
- C:\Windows\System\AdrSETN.exe
  C:\Windows\System\AdrSETN.exe
  2⤵
  PID:9752
- C:\Windows\System\nTGpbxZ.exe
  C:\Windows\System\nTGpbxZ.exe
  2⤵
  PID:12148
- C:\Windows\System\rWnMcMY.exe
  C:\Windows\System\rWnMcMY.exe
  2⤵
  PID:15104
- C:\Windows\System\RzLmlCm.exe
  C:\Windows\System\RzLmlCm.exe
  2⤵
  PID:15276
- C:\Windows\System\ARizGki.exe
  C:\Windows\System\ARizGki.exe
  2⤵
  PID:8848
- C:\Windows\System\PzkDWZP.exe
  C:\Windows\System\PzkDWZP.exe
  2⤵
  PID:9088
- C:\Windows\System\QsMqKor.exe
  C:\Windows\System\QsMqKor.exe
  2⤵
  PID:15328
- C:\Windows\System\DEuKsPt.exe
  C:\Windows\System\DEuKsPt.exe
  2⤵
  PID:13040
- C:\Windows\System\ozvJPce.exe
  C:\Windows\System\ozvJPce.exe
  2⤵
  PID:15180
- C:\Windows\System\pUlAvkG.exe
  C:\Windows\System\pUlAvkG.exe
  2⤵
  PID:9480
- C:\Windows\System\QcWzAzR.exe
  C:\Windows\System\QcWzAzR.exe
  2⤵
  PID:10608
- C:\Windows\System\vNwPjDC.exe
  C:\Windows\System\vNwPjDC.exe
  2⤵
  PID:14824
- C:\Windows\System\CxFwvDm.exe
  C:\Windows\System\CxFwvDm.exe
  2⤵
  PID:4376
- C:\Windows\System\TopiNrk.exe
  C:\Windows\System\TopiNrk.exe
  2⤵
  PID:11092
- C:\Windows\System\Wikcksy.exe
  C:\Windows\System\Wikcksy.exe
  2⤵
  PID:8960
- C:\Windows\System\EOJVWVW.exe
  C:\Windows\System\EOJVWVW.exe
  2⤵
  PID:14856
- C:\Windows\System\WUhQRTP.exe
  C:\Windows\System\WUhQRTP.exe
  2⤵
  PID:10932
- C:\Windows\System\nIUwLTd.exe
  C:\Windows\System\nIUwLTd.exe
  2⤵
  PID:10520
- C:\Windows\System\vLKraTF.exe
  C:\Windows\System\vLKraTF.exe
  2⤵
  PID:13860
- C:\Windows\System\JKbPQhR.exe
  C:\Windows\System\JKbPQhR.exe
  2⤵
  PID:10376
- C:\Windows\System\vpHOvGs.exe
  C:\Windows\System\vpHOvGs.exe
  2⤵
  PID:7112
- C:\Windows\System\ELXKYhi.exe
  C:\Windows\System\ELXKYhi.exe
  2⤵
  PID:9876
- C:\Windows\System\ZrxVjuW.exe
  C:\Windows\System\ZrxVjuW.exe
  2⤵
  PID:14660
- C:\Windows\System\ujmwdMn.exe
  C:\Windows\System\ujmwdMn.exe
  2⤵
  PID:15016
- C:\Windows\System\BgOMKll.exe
  C:\Windows\System\BgOMKll.exe
  2⤵
  PID:12028
- C:\Windows\System\AtOLVqy.exe
  C:\Windows\System\AtOLVqy.exe
  2⤵
  PID:10384
- C:\Windows\System\RwpqRqn.exe
  C:\Windows\System\RwpqRqn.exe
  2⤵
  PID:12820
- C:\Windows\System\gNbHFqT.exe
  C:\Windows\System\gNbHFqT.exe
  2⤵
  PID:8724
- C:\Windows\System\kQNQplP.exe
  C:\Windows\System\kQNQplP.exe
  2⤵
  PID:9476
- C:\Windows\System\mISwWSy.exe
  C:\Windows\System\mISwWSy.exe
  2⤵
  PID:12888
- C:\Windows\System\GuleYfD.exe
  C:\Windows\System\GuleYfD.exe
  2⤵
  PID:12952
- C:\Windows\System\sjFiCPM.exe
  C:\Windows\System\sjFiCPM.exe
  2⤵
  PID:5840
- C:\Windows\System\Pldaewp.exe
  C:\Windows\System\Pldaewp.exe
  2⤵
  PID:12892
- C:\Windows\System\MPktEjV.exe
  C:\Windows\System\MPktEjV.exe
  2⤵
  PID:12332
- C:\Windows\System\Onpstvz.exe
  C:\Windows\System\Onpstvz.exe
  2⤵
  PID:12976
- C:\Windows\System\IglDgvv.exe
  C:\Windows\System\IglDgvv.exe
  2⤵
  PID:9704
- C:\Windows\System\yqEzpme.exe
  C:\Windows\System\yqEzpme.exe
  2⤵
  PID:8988
- C:\Windows\System\WxPVYzx.exe
  C:\Windows\System\WxPVYzx.exe
  2⤵
  PID:13112
- C:\Windows\System\AtNaIti.exe
  C:\Windows\System\AtNaIti.exe
  2⤵
  PID:12316
- C:\Windows\System\EVGJcbN.exe
  C:\Windows\System\EVGJcbN.exe
  2⤵
  PID:11140
- C:\Windows\System\ZfNhMGT.exe
  C:\Windows\System\ZfNhMGT.exe
  2⤵
  PID:13084
- C:\Windows\System\PnHBYSA.exe
  C:\Windows\System\PnHBYSA.exe
  2⤵
  PID:4548
- C:\Windows\System\rJnQiGN.exe
  C:\Windows\System\rJnQiGN.exe
  2⤵
  PID:10948
- C:\Windows\System\nedjLBu.exe
  C:\Windows\System\nedjLBu.exe
  2⤵
  PID:10980
- C:\Windows\System\ChVZumr.exe
  C:\Windows\System\ChVZumr.exe
  2⤵
  PID:10736
- C:\Windows\System\SfoIiLn.exe
  C:\Windows\System\SfoIiLn.exe
  2⤵
  PID:13004
- C:\Windows\System\yXdpRbS.exe
  C:\Windows\System\yXdpRbS.exe
  2⤵
  PID:14748
- C:\Windows\System\onKpGaB.exe
  C:\Windows\System\onKpGaB.exe
  2⤵
  PID:11656
- C:\Windows\System\rBaNVGH.exe
  C:\Windows\System\rBaNVGH.exe
  2⤵
  PID:7492
- C:\Windows\System\UUxMkQG.exe
  C:\Windows\System\UUxMkQG.exe
  2⤵
  PID:9932
- C:\Windows\System\PirBOfo.exe
  C:\Windows\System\PirBOfo.exe
  2⤵
  PID:10708
- C:\Windows\System\bBNeCeD.exe
  C:\Windows\System\bBNeCeD.exe
  2⤵
  PID:13904
- C:\Windows\System\fbGJkzG.exe
  C:\Windows\System\fbGJkzG.exe
  2⤵
  PID:11932
- C:\Windows\System\NAQnuwU.exe
  C:\Windows\System\NAQnuwU.exe
  2⤵
  PID:12852
- C:\Windows\System\LrBWdJp.exe
  C:\Windows\System\LrBWdJp.exe
  2⤵
  PID:13824
- C:\Windows\System\ydYOevu.exe
  C:\Windows\System\ydYOevu.exe
  2⤵
  PID:8332
- C:\Windows\System\RHMLxQH.exe
  C:\Windows\System\RHMLxQH.exe
  2⤵
  PID:13100
- C:\Windows\System\TrKplAa.exe
  C:\Windows\System\TrKplAa.exe
  2⤵
  PID:12908
- C:\Windows\System\jiBuyjj.exe
  C:\Windows\System\jiBuyjj.exe
  2⤵
  PID:12400
- C:\Windows\System\KTEMfPA.exe
  C:\Windows\System\KTEMfPA.exe
  2⤵
  PID:13064
- C:\Windows\System\NhqtEQV.exe
  C:\Windows\System\NhqtEQV.exe
  2⤵
  PID:11424
- C:\Windows\System\JyPtGAU.exe
  C:\Windows\System\JyPtGAU.exe
  2⤵
  PID:10184
- C:\Windows\System\dyKDDXA.exe
  C:\Windows\System\dyKDDXA.exe
  2⤵
  PID:11732
- C:\Windows\System\nRtJBKo.exe
  C:\Windows\System\nRtJBKo.exe
  2⤵
  PID:11476
- C:\Windows\System\fPjhVaw.exe
  C:\Windows\System\fPjhVaw.exe
  2⤵
  PID:12940
- C:\Windows\System\WoBQloO.exe
  C:\Windows\System\WoBQloO.exe
  2⤵
  PID:12836
- C:\Windows\System\cAtSUbW.exe
  C:\Windows\System\cAtSUbW.exe
  2⤵
  PID:12724
- C:\Windows\System\IFSQfHW.exe
  C:\Windows\System\IFSQfHW.exe
  2⤵
  PID:12256
- C:\Windows\System\iedHUDI.exe
  C:\Windows\System\iedHUDI.exe
  2⤵
  PID:13516
- C:\Windows\System\peMuUgY.exe
  C:\Windows\System\peMuUgY.exe
  2⤵
  PID:13896
- C:\Windows\System\fzPRGRF.exe
  C:\Windows\System\fzPRGRF.exe
  2⤵
  PID:13920
- C:\Windows\System\ROQRnZd.exe
  C:\Windows\System\ROQRnZd.exe
  2⤵
  PID:14008
- C:\Windows\System\VFcUSDw.exe
  C:\Windows\System\VFcUSDw.exe
  2⤵
  PID:1268
- C:\Windows\System\sVwxoKF.exe
  C:\Windows\System\sVwxoKF.exe
  2⤵
  PID:12912
- C:\Windows\System\QmgqmBY.exe
  C:\Windows\System\QmgqmBY.exe
  2⤵
  PID:13052
- C:\Windows\System\nfRjJbb.exe
  C:\Windows\System\nfRjJbb.exe
  2⤵
  PID:13416
- C:\Windows\System\QQnyqdo.exe
  C:\Windows\System\QQnyqdo.exe
  2⤵
  PID:13596
- C:\Windows\System\ymEvenp.exe
  C:\Windows\System\ymEvenp.exe
  2⤵
  PID:11088
- C:\Windows\System\bdhZliH.exe
  C:\Windows\System\bdhZliH.exe
  2⤵
  PID:7784
- C:\Windows\System\KgYWvHE.exe
  C:\Windows\System\KgYWvHE.exe
  2⤵
  PID:10672
- C:\Windows\System\ZQSDwBl.exe
  C:\Windows\System\ZQSDwBl.exe
  2⤵
  PID:13916
- C:\Windows\System\kPaIWhd.exe
  C:\Windows\System\kPaIWhd.exe
  2⤵
  PID:13700
- C:\Windows\System\gQFPnPv.exe
  C:\Windows\System\gQFPnPv.exe
  2⤵
  PID:11400
- C:\Windows\System\kDZBhWK.exe
  C:\Windows\System\kDZBhWK.exe
  2⤵
  PID:12996
- C:\Windows\System\jenjrpl.exe
  C:\Windows\System\jenjrpl.exe
  2⤵
  PID:1208
- C:\Windows\System\QmyWuBN.exe
  C:\Windows\System\QmyWuBN.exe
  2⤵
  PID:12544
- C:\Windows\System\cXDyuvp.exe
  C:\Windows\System\cXDyuvp.exe
  2⤵
  PID:436
- C:\Windows\System\XRxsAGT.exe
  C:\Windows\System\XRxsAGT.exe
  2⤵
  PID:13136
- C:\Windows\System\PONwjPf.exe
  C:\Windows\System\PONwjPf.exe
  2⤵
  PID:13564
- C:\Windows\System\NWZpYMG.exe
  C:\Windows\System\NWZpYMG.exe
  2⤵
  PID:11704
- C:\Windows\System\PRPFafx.exe
  C:\Windows\System\PRPFafx.exe
  2⤵
  PID:12840
- C:\Windows\System\rGFTVId.exe
  C:\Windows\System\rGFTVId.exe
  2⤵
  PID:12092
- C:\Windows\System\rPtQuVp.exe
  C:\Windows\System\rPtQuVp.exe
  2⤵
  PID:13116
- C:\Windows\System\nPyfgYa.exe
  C:\Windows\System\nPyfgYa.exe
  2⤵
  PID:5172
- C:\Windows\System\AwUoMNS.exe
  C:\Windows\System\AwUoMNS.exe
  2⤵
  PID:10412
- C:\Windows\System\AkIPEwd.exe
  C:\Windows\System\AkIPEwd.exe
  2⤵
  PID:10796
- C:\Windows\System\utxzoSy.exe
  C:\Windows\System\utxzoSy.exe
  2⤵
  PID:11816
- C:\Windows\System\proyBbV.exe
  C:\Windows\System\proyBbV.exe
  2⤵
  PID:14092
- C:\Windows\System\nmwzpRG.exe
  C:\Windows\System\nmwzpRG.exe
  2⤵
  PID:2296
- C:\Windows\System\xbQgxxn.exe
  C:\Windows\System\xbQgxxn.exe
  2⤵
  PID:11748
- C:\Windows\System\vljrwMZ.exe
  C:\Windows\System\vljrwMZ.exe
  2⤵
  PID:13704
- C:\Windows\System\BivFXaH.exe
  C:\Windows\System\BivFXaH.exe
  2⤵
  PID:11828
- C:\Windows\System\XPFyMOy.exe
  C:\Windows\System\XPFyMOy.exe
  2⤵
  PID:11564
- C:\Windows\System\SMoAzki.exe
  C:\Windows\System\SMoAzki.exe
  2⤵
  PID:13120
- C:\Windows\System\lqFbuqo.exe
  C:\Windows\System\lqFbuqo.exe
  2⤵
  PID:11228
- C:\Windows\System\uCZJxbx.exe
  C:\Windows\System\uCZJxbx.exe
  2⤵
  PID:13640
- C:\Windows\System\RDXKmUb.exe
  C:\Windows\System\RDXKmUb.exe
  2⤵
  PID:14916
- C:\Windows\System\DjTcfQC.exe
  C:\Windows\System\DjTcfQC.exe
  2⤵
  PID:11528
- C:\Windows\System\OuJhThM.exe
  C:\Windows\System\OuJhThM.exe
  2⤵
  PID:15372
- C:\Windows\System\zhGDftZ.exe
  C:\Windows\System\zhGDftZ.exe
  2⤵
  PID:15396
- C:\Windows\System\SyIVGWH.exe
  C:\Windows\System\SyIVGWH.exe
  2⤵
  PID:15420
- C:\Windows\System\UljEeoe.exe
  C:\Windows\System\UljEeoe.exe
  2⤵
  PID:15488
- C:\Windows\System\qTcBlbQ.exe
  C:\Windows\System\qTcBlbQ.exe
  2⤵
  PID:15588
- C:\Windows\System\vitAVbB.exe
  C:\Windows\System\vitAVbB.exe
  2⤵
  PID:15612
- C:\Windows\System\aRjRgxn.exe
  C:\Windows\System\aRjRgxn.exe
  2⤵
  PID:15640
- C:\Windows\System\MLHbRkg.exe
  C:\Windows\System\MLHbRkg.exe
  2⤵
  PID:15656
- C:\Windows\System\LWmjkBd.exe
  C:\Windows\System\LWmjkBd.exe
  2⤵
  PID:15676
- C:\Windows\System\ZNoIyog.exe
  C:\Windows\System\ZNoIyog.exe
  2⤵
  PID:15692
- C:\Windows\System\jFQPVJb.exe
  C:\Windows\System\jFQPVJb.exe
  2⤵
  PID:15716
- C:\Windows\System\LADKjwe.exe
  C:\Windows\System\LADKjwe.exe
  2⤵
  PID:15740
- C:\Windows\System\NtOuKvi.exe
  C:\Windows\System\NtOuKvi.exe
  2⤵
  PID:15772
- C:\Windows\System\AGyDERS.exe
  C:\Windows\System\AGyDERS.exe
  2⤵
  PID:15800
- C:\Windows\System\rOZXCEY.exe
  C:\Windows\System\rOZXCEY.exe
  2⤵
  PID:15828
- C:\Windows\System\SujlsAY.exe
  C:\Windows\System\SujlsAY.exe
  2⤵
  PID:15852
- C:\Windows\System\xfbeEUC.exe
  C:\Windows\System\xfbeEUC.exe
  2⤵
  PID:15872
- C:\Windows\System\ItezYLN.exe
  C:\Windows\System\ItezYLN.exe
  2⤵
  PID:15892
- C:\Windows\System\VggDGGv.exe
  C:\Windows\System\VggDGGv.exe
  2⤵
  PID:15920
- C:\Windows\System\FxOzlsv.exe
  C:\Windows\System\FxOzlsv.exe
  2⤵
  PID:15940
- C:\Windows\System\zpdvhIX.exe
  C:\Windows\System\zpdvhIX.exe
  2⤵
  PID:15956
- C:\Windows\System\QHvTkQq.exe
  C:\Windows\System\QHvTkQq.exe
  2⤵
  PID:15980
- C:\Windows\System\lNMNkXT.exe
  C:\Windows\System\lNMNkXT.exe
  2⤵
  PID:16012
- C:\Windows\System\zVsQHPO.exe
  C:\Windows\System\zVsQHPO.exe
  2⤵
  PID:16032
- C:\Windows\System\LLlMoLM.exe
  C:\Windows\System\LLlMoLM.exe
  2⤵
  PID:16052
- C:\Windows\System\QBNnNbg.exe
  C:\Windows\System\QBNnNbg.exe
  2⤵
  PID:16076
- C:\Windows\System\KHzyQcD.exe
  C:\Windows\System\KHzyQcD.exe
  2⤵
  PID:16100
- C:\Windows\System\DOaMKUb.exe
  C:\Windows\System\DOaMKUb.exe
  2⤵
  PID:16116
- C:\Windows\System\zAjVYMZ.exe
  C:\Windows\System\zAjVYMZ.exe
  2⤵
  PID:16140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3680 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:11396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_p0ihz3x2.21f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p0ihz3x2.21f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

CUfkQrp.exe

Path C:\Windows\System\CUfkQrp.exe
Size 1.9MB
SHA256 eb6ec2e23d7d298e2d608cfc17b92c0ee874fd4bf94e69e3db63420b6b2d63d5
MD5 feb15a039ff0f490f66853362ebc593a
SHA1 47e3888f2e375a3b6fa2b5209c191bdd14a2f052
SHA512 178a22aacc26ca6d600c5cb846b2b71ed5c3a7e2615611d56b27e82437ab10473837c8505cc79c26a74ccf228664a1b35318fc54defc862b62a874b0f24ff33f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boP:Lz071uv4BPMkiFGlObO11jB7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

CewaSoi.exe

Path C:\Windows\System\CewaSoi.exe
Size 1.9MB
SHA256 8f5309a45f092b4f5e9d27b30c9a36e28beca3ecf90d7f3acbfdf78bb64f48aa
MD5 976a0dc28e9cd60532cd3e47ba73f5d3
SHA1 7c394887dc94fab5817b99c347b8983d7a81b8ff
SHA512 9b6f102fa00e7316e621da3b3e5c96c13f82c1516c9a53ca1a876e7edbf74382c3f1c0f67e419e663868c3e81b06f4ff9a77acfe03022b17feac8a726bb28b5a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bov:Lz071uv4BPMkiFGlObO11jB7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

DRvvMBa.exe

Path C:\Windows\System\DRvvMBa.exe
Size 1.8MB
SHA256 5807a319a275ccc34a9ddf755abfafec4eac0d7340170c57ef4cab2380499e9c
MD5 ae29e8bae0567c2859c940c29a1a3a66
SHA1 29d0deebeee7e11a66eba3de2a5da88cb2cf9ffb
SHA512 e2a59042cc40f06eb6e3cac444ef89333b24af761e6ef8c06b126650f9ad5f6d1530425f96f03da1132d3b86fc0ba2e9c18f9b8ca62a3c01f81c7bf774feaaed
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bo/:Lz071uv4BPMkiFGlObO11jB7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

ELSIyLb.exe

Path C:\Windows\System\ELSIyLb.exe
Size 1.9MB
SHA256 f27e6bed71654d2d61697bf13aa923abf82de4ef31924ee3976ec4dcd102cb69
MD5 a3f0113a235d36c6cb71f8f4c33195d9
SHA1 82fc64e57c5713203b0135fb601983b780d22e83
SHA512 19fa12cd8cf190bd358a1186e5c79a23a05d51c59a2668a7ebb71a755674a4c8b7bfd6fac11b75099f625490a0ffb3db969dd8d093c98d7d5547024f3ce9c150
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boW:Lz071uv4BPMkiFGlObO11jB75
MD5 SHA1 SHA512 SSDEEP

Submit Download

JkKARDg.exe

Path C:\Windows\System\JkKARDg.exe
Size 1.8MB
SHA256 9f8a6d80e3130332b2e2d5089603870cf624807b1159796b5b0cd59593733c6e
MD5 e092b5bc894c2f7c912090c435fcad08
SHA1 e89e8ea4cb53648c94340d0beec17bf81543f1ac
SHA512 0a676bda11eea4ff5be1caadabfb824d8ae085a1c896f400f4e1ea530a10f03d337f81c8f37d4b771ea466297e833ecb0ff9e65b2269567c66ceda432e7d5aab
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boC:Lz071uv4BPMkiFGlObO11jB7T
MD5 SHA1 SHA512 SSDEEP

Submit Download

KqujRsr.exe

Path C:\Windows\System\KqujRsr.exe
Size 1.8MB
SHA256 1d58e611870ef8993ac336df7f0a509c748b94a584cb36cf2ecd4b0534085749
MD5 35b110898fbf8062cb9febfdbb787d4f
SHA1 f72fbb710f44ef84ab91ad34045ad2d4672e8a34
SHA512 edb2e1d068d4f88101c53effc7cd2a0d8f2b60fabf0de8878940e6dd3da6554114582058bf2e8bcd4614be4269d79ca9999b05018a7d46c7129b286b4cab8320
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boP:Lz071uv4BPMkiFGlObO11jB7w
MD5 SHA1 SHA512 SSDEEP

Submit Download

NBmxGmS.exe

Path C:\Windows\System\NBmxGmS.exe
Size 1.9MB
SHA256 231c3592b0bd0bf9008d16bf368b45cbe2731560f697d0900b56ac76edd4ecbf
MD5 b35dec266073130b940b15232da3e79a
SHA1 ecd3cb6d44ce334b32a71cc290201b47ab1d8b4f
SHA512 83fe6a26e8cbad94fadf327f71ad9c14dabab8142e7c2bfdcd4bcb79826561081428e1496cc99dae5d40e2f1d40ef9711b0bb03de0634d4d7e9cdb85af277691
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bof:Lz071uv4BPMkiFGlObO11jB7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

NQvLuGt.exe

Path C:\Windows\System\NQvLuGt.exe
Size 1.8MB
SHA256 7dca2869c9232716686f7fd5d27688001d4d0e5ee6b389d867ea89fb7cf41eb0
MD5 c9fa925207ae078145ab89455cad5a5f
SHA1 cef36ee1b3703d804a3b1f805a7819450dfaf7e7
SHA512 8a43c30b819ed35022179454396fbbaeee1db4a40874928fcc4f917c20edf3ceda956fea77b07274f7b1009d704843e2700394af64d573e41ce3b0f0a02fff2a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bo5:Lz071uv4BPMkiFGlObO11jB7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvEgSvd.exe

Path C:\Windows\System\NvEgSvd.exe
Size 1.9MB
SHA256 48b39811fe798f687d5e3ce59262fa6bd2004825b448729b5e5ffe9f0f1ef124
MD5 bf66a851e6035a387308ba23742afeae
SHA1 de98a8d13aa9926bafb3725858b4678ae0e19ab0
SHA512 f2480c05aa77e4b76adc1b0ebb8a2013140f0b33dc1619ce87a9ec85507d7aa7cd687f488bb9fa3a29539336e2810b09b2e15e634ecc79760fa1828604ff13c9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bo0:Lz071uv4BPMkiFGlObO11jB7/
MD5 SHA1 SHA512 SSDEEP

Submit Download

OllBlPj.exe

Path C:\Windows\System\OllBlPj.exe
Size 1.8MB
SHA256 a6730ae38189965d155b23ead65ef4275903055c666c210d1aa4fff4e3a247fd
MD5 d1d676f985161e0209e316cfa9a106bd
SHA1 b09c625983ff19a7d027b6a02dcbd2e26ff4448d
SHA512 98533864570fbadbfb8f20a52eca3e01ad7c766e618fdcc5baadd5e34b6ae8394c5e2104ac813e06bd1acfa532f455fd53105e268c6bbf2062eca041ed603506
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boA:Lz071uv4BPMkiFGlObO11jB77
MD5 SHA1 SHA512 SSDEEP

Submit Download

TdNVrCV.exe

Path C:\Windows\System\TdNVrCV.exe
Size 1.9MB
SHA256 475ed0eb498936f4c85a7d3883f104671052b76a682aef66011a452c76c2fde3
MD5 2034d3cceed0c75b2800424a249545d4
SHA1 65e255afc235267f6a6c764938ba5ce19620c178
SHA512 4c51ff9c923503059eb79e0bcaff342f0009baffb2f158981207b7fcb2d76369b5db3ade2d0d0c2bafa5caf9bb2cdbb123df125101a021165d285c385e0f0cac
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boN:Lz071uv4BPMkiFGlObO11jB7u
MD5 SHA1 SHA512 SSDEEP

Submit Download

UdOFXJC.exe

Path C:\Windows\System\UdOFXJC.exe
Size 1.8MB
SHA256 a2b335294de7b3c63caa2b865ecc0b2b9498eb3b0fc19d5e1bb7fd5895421798
MD5 eb4746216c1927174dda0b1cea6e464c
SHA1 c784236d6fad391557dcbbce0f0afc6711b435d1
SHA512 8baebdad72fe42103aefc2c96aeee56783f24026b29205f0682b02c73bb1b0b317efca49a19d2efe603c4018bef5fd7af3d073ed8268da8c029024e89d15500a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bot:Lz071uv4BPMkiFGlObO11jB7o
MD5 SHA1 SHA512 SSDEEP

Submit Download

UeBcaID.exe

Path C:\Windows\System\UeBcaID.exe
Size 1.8MB
SHA256 66a26ed426a15f0e953516c0d358fafaa69e2529eaa4fa65714d572e41c0c05f
MD5 dde0c15563bc82585809f66590d1d9d7
SHA1 15708707385b6900b08c25f3ff8e6d470857b4e6
SHA512 51269076e91a423dfcfb27e58144e12c446d6368a573f10fbd685beb8f9b531cb2fb96fc7c5e5a19531b02d925cfb30d50fcb8a4c40e22da6e129622aaa65bc0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bo8:Lz071uv4BPMkiFGlObO11jB7t
MD5 SHA1 SHA512 SSDEEP

Submit Download

UkPGSrk.exe

Path C:\Windows\System\UkPGSrk.exe
Size 1.9MB
SHA256 7443c2daeef953e68f3cdb9c62ae680c14820fb4bad37f361aef0c7252669e82
MD5 9d1352cba74ec1936f3a8fbe12553f0c
SHA1 9a4eda92099664a658a2777923beb88e48ef765b
SHA512 a3c33b33b452bcebc42b9fed0aee5e1fb4266453a85213acf01b110d99f436318df898b67b345bd84d4b5931370f5516454318a57605c6f03c0345c9b84a96af
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boR:Lz071uv4BPMkiFGlObO11jB7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

VQNTqWQ.exe

Path C:\Windows\System\VQNTqWQ.exe
Size 1.8MB
SHA256 b451e39229f2cf2f4cbf997c775fec3291a031420f67e1b57b9f620615575983
MD5 c967bf139e75d2267f7af6f246026cc7
SHA1 8bae0435aa9f10b0660538708cc5724f3258b96c
SHA512 32e66844af7cd1ab657d2311e1b935e1f66fb33ba719f4b74a60dfee17f89817aca021d11f540425bafa9f6ff21b5c2e8726289f3f788e5d443d1618926eecb8
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bor:Lz071uv4BPMkiFGlObO11jB7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

XnLLiSV.exe

Path C:\Windows\System\XnLLiSV.exe
Size 1.9MB
SHA256 1bfd0862a15d69dedecfec169e58cda9da0b4d334cf1833101a22e8309110db4
MD5 7cb1244ee893d4cc4d4725c8b3937b79
SHA1 6e56479ae9e4419f04c21fd2a6193ea0d58a31ba
SHA512 7e70d79362b5885e50fd9c3fb8d47ebba44282d260e1cd865b0508e3280a282b2ee142c6a48c01310e1e7956c7c820acc4b4f02bc48497901327132b9e32dafc
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bo7:Lz071uv4BPMkiFGlObO11jB77i
MD5 SHA1 SHA512 SSDEEP

Submit Download

YfknKGe.exe

Path C:\Windows\System\YfknKGe.exe
Size 1.8MB
SHA256 c5301591ca0823491cc56a6db54328ee9f8226e3a24b2592589e65142a487884
MD5 9c82b4a83993677400c8aa5934b3fb46
SHA1 162bbe6084651741b7786f6558853bd0efaa9469
SHA512 22e67d943285cabc653d52e71ddddbcef3b64a53254334d7c30572ef88bf53b96c773f414c10f7458acd2d4e7365219abb5a3c9566804da86589b3cd5bf8350a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bon:Lz071uv4BPMkiFGlObO11jB7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZCoQUXg.exe

Path C:\Windows\System\ZCoQUXg.exe
Size 1.9MB
SHA256 73db02e3dbe65829b9fc058a694510763f17f9f1bd9eaeb6a06a7209bebb8eee
MD5 e70c73cef980d301b00b82e6a7e19aa3
SHA1 4d154653065d8f9b469f3abd7ae22679d57d18d6
SHA512 4bebf41be08d8d5f1e37ee774dd4cb3b79308642d6f4eab0c68a3792f374d68fd3d485d41d3881b367133f70d2a92f3f50a450130e8b6cbe7bfb7e85e4d5561c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boN:Lz071uv4BPMkiFGlObO11jB7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

aeGdlax.exe

Path C:\Windows\System\aeGdlax.exe
Size 1.8MB
SHA256 4afd5a39937e2c42963d11ed71d88e94b7cb2ed89e6369995d113cc252ce3001
MD5 e1f8bb4cd8a3f5a9c95d2f14bcb54580
SHA1 932ef9f5a6351791f54c2f1ed13d1b09ae64cb34
SHA512 b0935a9767e01025862d7694a66110df6a4afbd95874f8d6124c08af51ae024599533b8ab5ba4bef6d4ce035ba0a4bdd943739b736d111da74eb5cb4308934a2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boT:Lz071uv4BPMkiFGlObO11jB7Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ahYuIoN.exe

Path C:\Windows\System\ahYuIoN.exe
Size 1.8MB
SHA256 ce6ccdb952588821563b2109b4dbfa0b69e98644975d8774cbf319fb6f450541
MD5 0556d3e1f5a8375fb5ece2d7e5c008ee
SHA1 cd7b7e3c44de967d43ab5d23232230d9346dbb64
SHA512 63a2e7905400b798deb735dd654f2e5d512a0ae80b85b53fdbdc16b4092a7c17bd6e5895da3b27b7a34e2af8bb6f261d9ff377439725fbd569384fdb4c21a477
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bo6:Lz071uv4BPMkiFGlObO11jB7f
MD5 SHA1 SHA512 SSDEEP

Submit Download

bRfRDob.exe

Path C:\Windows\System\bRfRDob.exe
Size 1.8MB
SHA256 d8e1c31cb38795fd39403dcbe5e535849de580fa368e0dedc907f8db28a214c7
MD5 a0286bb9323918f17b40b44fe7f964fa
SHA1 28a9aebecabc207039b24c8051103a213c35f0dc
SHA512 dff446184f6873664a33da900f756f556c4650e3a9a08d7e6e125b31fc51d18eeecbc6a8aa0c2f063196863b91896e02108352d3c29720f63ecf610ccf47e91f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boV:Lz071uv4BPMkiFGlObO11jB7i
MD5 SHA1 SHA512 SSDEEP

Submit Download

bqzJINq.exe

Path C:\Windows\System\bqzJINq.exe
Size 1.8MB
SHA256 c15fbebc625943acf80960af74b98cc5f1f0570b6016f28028147da48a2de709
MD5 568fdc6532669d15634d1b968dcc797d
SHA1 aec38b13e645f5cac378a52c925662133325277e
SHA512 d20c9d348dc6dbd08f5f5362b5f7ad72f29e4ab69a2949ba4719087468a5f384bd4984cb0e2f3fc6eecc714db95a5ed59827088fdb9e8a76f646b4e58a7dbfdf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boX:Lz071uv4BPMkiFGlObO11jB7M
MD5 SHA1 SHA512 SSDEEP

Submit Download

cQSuYMF.exe

Path C:\Windows\System\cQSuYMF.exe
Size 1.9MB
SHA256 6a8424692a4d8ca4decdadca1117792cb40beb02ad668b9f0ba7a4b0b0ccbc71
MD5 6c67e8a389e2f94cf4af647a0bcf9fd2
SHA1 5430587a98d7f1069c311f9c52a573962d2cfd8e
SHA512 46240a326ffd7e94014ba9449bd01b8ef6b537a5edd2cefdedb1b99e884ba2e622d444cbba493f6cb41d18c0248c167a03c718d76292bdd36cd172ef93e633e0
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bog:Lz071uv4BPMkiFGlObO11jB7Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

cQyCUfz.exe

Path C:\Windows\System\cQyCUfz.exe
Size 1.8MB
SHA256 5ebc1dbb1f4faa1b8e3163d9af8f02b90fc442211bc3a5a31e0466f3226445c3
MD5 bc149b289e45bd5ac4570ffbb50cd80f
SHA1 5226b7e97f80ec8c5105ed4e343fb86dfa41db6a
SHA512 4c497878f35971621c03f44a8116b8bf893889f28e5ef55d0ec494d40d959452c5508f218b9bd5208666f5ac330fadf05a6a53597c0ea5fbf330dfaaf3ed09ad
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boM:Lz071uv4BPMkiFGlObO11jB7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

dMTMAZI.exe

Path C:\Windows\System\dMTMAZI.exe
Size 1.8MB
SHA256 b324cf1ec01d1d3c6edc8a346672f15950e8ec419ee66584edde03654a1a23fe
MD5 44802947c2048a49a3c5745962f95e11
SHA1 ffdd7c861c1187014b67c4d6fac1d4dea128f8d0
SHA512 7cde411b38f647153e7fcf5567bbff58c191bb81438ffe9f66cef70a8df0beed573a2593db7e718284adba2a81dfc8ecc22f59c71191f93dbd2bc09cf02f71d9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bof:Lz071uv4BPMkiFGlObO11jB7O
MD5 SHA1 SHA512 SSDEEP

Submit Download

pcNMssi.exe

Path C:\Windows\System\pcNMssi.exe
Size 1.8MB
SHA256 c241d9e199d3b07f104088c15915f9b9d0b5f29f970337bbfaa546fe5f6ff2fb
MD5 dbf889e6808adf4c09065e5a79bcf799
SHA1 36c032a554d0e4bd638da145612c22d4cc56688e
SHA512 0e0e7ca196ac0bbda5f290d4812bf2e761fcc5039f976f44d241e124c8b6ac2962f64d6cfc1e5b687c926ad0e20e9e0a55f414fc0b786ec82b4104a07307af43
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boQ:Lz071uv4BPMkiFGlObO11jB7d
MD5 SHA1 SHA512 SSDEEP

Submit Download

qafbErA.exe

Path C:\Windows\System\qafbErA.exe
Size 1.8MB
SHA256 76882896c961e827eab63e224d0ca3b1ebac71616eabfd8e440dab42be465e2a
MD5 7b81f383e196eac449ebb850f18b0c53
SHA1 c4edb0834040df97104bbe7ad9e7c726c42fc234
SHA512 0c8d0f6e4b11042d8b90a11b2770974f023073eda7cdac0362bf91b35f83a7aa0ae582092b5da0b38986685876dab7fc75ce1f01d568418051a124d9d0c83476
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bo5:Lz071uv4BPMkiFGlObO11jB7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

rHmUZKu.exe

Path C:\Windows\System\rHmUZKu.exe
Size 1.8MB
SHA256 0eb9bc8d01c502222835e9d80ef6e9915908fb568253b83d4da1058760121d1e
MD5 7921842dcd4073d892ccf05dc277390e
SHA1 a8ec1f60dce22b94ef44080e13eb5f7046d80f4c
SHA512 0460aa9ea389ad509cb575c364eecb62d2ec04762dc6d960e5b31aab0196558208bb7ef70638c11451abe35ff240bf34c55eb9e5f7390b3414c2a8d11a1dec33
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boe:Lz071uv4BPMkiFGlObO11jB7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

sYrYvtY.exe

Path C:\Windows\System\sYrYvtY.exe
Size 1.9MB
SHA256 af1bae590162001466c548eac2b7593de94ea1b670634ee8aba98ca91124c223
MD5 e339315bb3b73e9548e7ca077d82bdbf
SHA1 8c28a72028ba184b5d503cb676d583ca91924c9c
SHA512 5aa6216969d349a644b691c2fe1d0b9b323ad637b68df3e40f879a0c1c94d6c1dc6b194705978c53175072138551c34577c8ffb297abc8dbe55b56bc932b5a3c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boh:Lz071uv4BPMkiFGlObO11jB7dQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

teNqfFw.exe

Path C:\Windows\System\teNqfFw.exe
Size 1.8MB
SHA256 221a820c349b7c5de384abb8555d6e4098b405db9c1232b503729bd5c9accccf
MD5 411566397f5849275482e57a309daec3
SHA1 3c9ca0631207489b791a3201cfb941ecb38b84ee
SHA512 ec2e6c03f58d5cad2f0f8af54c690c2132e7b95570ed9284d32cd28db54522042ea4c2b942ed7354b820df6c6cc87330f96877abf605922c89c9bb82611b0103
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boA:Lz071uv4BPMkiFGlObO11jB7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

wfCfZvX.exe

Path C:\Windows\System\wfCfZvX.exe
Size 1.8MB
SHA256 d57e48a733e6267205b167728d8aae81665a75284c8a78b250ccdaa81c65d26c
MD5 27708456c57d32d6faf32b5c18b178d4
SHA1 b2b8afdcc452add7bb662a2a4773480b0e070210
SHA512 16699b7d5353c083027cc228e491d1c68205d208369d3f5b0394737b94ba8341a91dffb4739acf1f7c857954d217b27ad7ab526174640df67cca774a4db95788
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7boz:Lz071uv4BPMkiFGlObO11jB7G
MD5 SHA1 SHA512 SSDEEP

Submit Download

xiDKTlJ.exe

Path C:\Windows\System\xiDKTlJ.exe
Size 1.9MB
SHA256 f402ef5df8d89f170e485ff4f5620a32469ce3b16138d3a1c065d3ab9cbb197a
MD5 8f1abe078bfd4775329d42a9ec61ed6c
SHA1 9c34d126ae7b7790b764f179c3c0a4e18b653c7d
SHA512 d8df484a83a3b9205b2e11080accc0c074071081267fe26f21423c29b8f226480836c9c7c48998490edf3eb521a074f7af69af638351ddb1cb483812d9c86eec
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bo3:Lz071uv4BPMkiFGlObO11jB7+
MD5 SHA1 SHA512 SSDEEP

Submit Download

zEdkUnw.exe

Path C:\Windows\System\zEdkUnw.exe
Size 1.9MB
SHA256 8b2463126a59ee1e714649478a966d657dc45466af6e1a895b706b79091064aa
MD5 fabd4d17a14fb78b31c56f7cfabde9c3
SHA1 c43e7263f3bc77d0f08000db32e5faf26f866753
SHA512 9d9dce42e543f56f174117890283fa93d59e743e15f9fec3cbb48dfb5f7221e0fe79d91a17c992c0d3c936fa8b1159dcf24aa3e8d0426aec7eb504700863a24a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkipBh8tGxHIBWGlTqTGzk+lOagppeRbptGxSjx7bof:Lz071uv4BPMkiFGlObO11jB7ha
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/696-1476-0x00007FF736040000-0x00007FF736432000-memory.dmp

Download

memory/696-115-0x00007FF736040000-0x00007FF736432000-memory.dmp

Download

memory/696-17-0x00007FF736040000-0x00007FF736432000-memory.dmp

Download

memory/1100-2135-0x00007FF761520000-0x00007FF761912000-memory.dmp

Download

memory/1100-175-0x00007FF761520000-0x00007FF761912000-memory.dmp

Download

memory/1564-204-0x00007FF630CE0000-0x00007FF6310D2000-memory.dmp

Download

memory/1564-2133-0x00007FF630CE0000-0x00007FF6310D2000-memory.dmp

Download

memory/1828-2134-0x00007FF62BDF0000-0x00007FF62C1E2000-memory.dmp

Download

memory/1828-167-0x00007FF62BDF0000-0x00007FF62C1E2000-memory.dmp

Download

memory/2132-2138-0x00007FF771680000-0x00007FF771A72000-memory.dmp

Download

memory/2132-178-0x00007FF771680000-0x00007FF771A72000-memory.dmp

Download

memory/2480-200-0x00007FF638A30000-0x00007FF638E22000-memory.dmp

Download

memory/2480-2157-0x00007FF638A30000-0x00007FF638E22000-memory.dmp

Download

memory/2480-116-0x00007FF638A30000-0x00007FF638E22000-memory.dmp

Download

memory/2768-27-0x00007FF7083D0000-0x00007FF7087C2000-memory.dmp

Download

memory/2768-1453-0x00007FF7083D0000-0x00007FF7087C2000-memory.dmp

Download

memory/3088-205-0x00007FF6E24F0000-0x00007FF6E28E2000-memory.dmp

Download

memory/3088-2136-0x00007FF6E24F0000-0x00007FF6E28E2000-memory.dmp

Download

memory/3132-1518-0x00007FF7FA4C0000-0x00007FF7FA8B2000-memory.dmp

Download

memory/3132-61-0x00007FF7FA4C0000-0x00007FF7FA8B2000-memory.dmp

Download

memory/3172-47-0x00007FF693470000-0x00007FF693862000-memory.dmp

Download

memory/3172-146-0x00007FF693470000-0x00007FF693862000-memory.dmp

Download

memory/3172-1585-0x00007FF693470000-0x00007FF693862000-memory.dmp

Download

memory/3228-60-0x00007FF6ABD90000-0x00007FF6AC182000-memory.dmp

Download

memory/3228-1495-0x00007FF6ABD90000-0x00007FF6AC182000-memory.dmp

Download

memory/3528-212-0x000001F379B70000-0x000001F37A316000-memory.dmp

Download

memory/3528-87-0x000001F3785A0000-0x000001F3785C2000-memory.dmp

Download

memory/3692-2174-0x00007FF66DC70000-0x00007FF66E062000-memory.dmp

Download

memory/3692-128-0x00007FF66DC70000-0x00007FF66E062000-memory.dmp

Download

memory/3908-1682-0x00007FF6841E0000-0x00007FF6845D2000-memory.dmp

Download

memory/3908-185-0x00007FF6841E0000-0x00007FF6845D2000-memory.dmp

Download

memory/3908-69-0x00007FF6841E0000-0x00007FF6845D2000-memory.dmp

Download

memory/3972-1491-0x00007FF708370000-0x00007FF708762000-memory.dmp

Download

memory/3972-49-0x00007FF708370000-0x00007FF708762000-memory.dmp

Download

memory/3980-92-0x00007FF638B60000-0x00007FF638F52000-memory.dmp

Download

memory/3980-2139-0x00007FF638B60000-0x00007FF638F52000-memory.dmp

Download

memory/3980-187-0x00007FF638B60000-0x00007FF638F52000-memory.dmp

Download

memory/4024-1652-0x00007FF7BF0C0000-0x00007FF7BF4B2000-memory.dmp

Download

memory/4024-91-0x00007FF7BF0C0000-0x00007FF7BF4B2000-memory.dmp

Download

memory/4248-140-0x00007FF698B40000-0x00007FF698F32000-memory.dmp

Download

memory/4248-41-0x00007FF698B40000-0x00007FF698F32000-memory.dmp

Download

memory/4248-1492-0x00007FF698B40000-0x00007FF698F32000-memory.dmp

Download

memory/4480-1-0x0000025276B80000-0x0000025276B90000-memory.dmp

Download

memory/4480-124-0x00007FF728A70000-0x00007FF728E62000-memory.dmp

Download

memory/4480-102-0x00007FF728A70000-0x00007FF728E62000-memory.dmp

Download

memory/4480-0-0x00007FF728A70000-0x00007FF728E62000-memory.dmp

Download

memory/4512-114-0x00007FF65EB70000-0x00007FF65EF62000-memory.dmp

Download

memory/4512-9-0x00007FF65EB70000-0x00007FF65EF62000-memory.dmp

Download

memory/4512-1451-0x00007FF65EB70000-0x00007FF65EF62000-memory.dmp

Download

memory/4576-117-0x00007FF6EE410000-0x00007FF6EE802000-memory.dmp

Download

memory/4576-1512-0x00007FF6EE410000-0x00007FF6EE802000-memory.dmp

Download

memory/4576-22-0x00007FF6EE410000-0x00007FF6EE802000-memory.dmp

Download

memory/4604-2137-0x00007FF6C6180000-0x00007FF6C6572000-memory.dmp

Download

memory/4604-159-0x00007FF6C6180000-0x00007FF6C6572000-memory.dmp

Download

memory/4804-1630-0x00007FF704C90000-0x00007FF705082000-memory.dmp

Download

memory/4804-183-0x00007FF704C90000-0x00007FF705082000-memory.dmp

Download

memory/4804-64-0x00007FF704C90000-0x00007FF705082000-memory.dmp

Download

memory/4924-100-0x00007FF744CF0000-0x00007FF7450E2000-memory.dmp

Download

memory/4948-113-0x00007FF6C8E10000-0x00007FF6C9202000-memory.dmp

Download

memory/4948-1674-0x00007FF6C8E10000-0x00007FF6C9202000-memory.dmp

Download

memory/4948-199-0x00007FF6C8E10000-0x00007FF6C9202000-memory.dmp

Download

memory/4988-1671-0x00007FF62A060000-0x00007FF62A452000-memory.dmp

Download

memory/4988-189-0x00007FF62A060000-0x00007FF62A452000-memory.dmp

Download

memory/4988-107-0x00007FF62A060000-0x00007FF62A452000-memory.dmp

Download