xmrig | 62ea50d1a5a322bdbf314ed1c92afa9a577ca5dcaad4cd79a45a96765a4bafe3

Analysis

max time kernel
80s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
Size 1.5MB
Sample240610-rr72bazcpj
SHA256 62ea50d1a5a322bdbf314ed1c92afa9a577ca5dcaad4cd79a45a96765a4bafe3
MD5 19a8be2fb4a27ccb301e891ef6ca7de0
SHA1 bda1d39ff573c42b961c3dc66046604550679105
SHA512 6cce53f96f9fe2d493762f9fbcb559ddef49a88c3a919b456ac3241b99fd92580dbb278de85e1c0d8bc66dbf548ed6ced8af07606c967e9d33fa169042f46145
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xug9:Lz071uv4BPMkHC0IlnASEx/RiNleM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/4772-390-0x00007FF7CB050000-0x00007FF7CB442000-memory.dmp	xmrig
behavioral2/memory/4480-554-0x00007FF71D190000-0x00007FF71D582000-memory.dmp	xmrig
behavioral2/memory/684-668-0x00007FF6E4530000-0x00007FF6E4922000-memory.dmp	xmrig
behavioral2/memory/4948-675-0x00007FF764F00000-0x00007FF7652F2000-memory.dmp	xmrig
behavioral2/memory/2488-680-0x00007FF7DDDD0000-0x00007FF7DE1C2000-memory.dmp	xmrig
behavioral2/memory/3180-679-0x00007FF62DA80000-0x00007FF62DE72000-memory.dmp	xmrig
behavioral2/memory/824-678-0x00007FF701F00000-0x00007FF7022F2000-memory.dmp	xmrig
behavioral2/memory/2124-677-0x00007FF6E6E70000-0x00007FF6E7262000-memory.dmp	xmrig
behavioral2/memory/1640-676-0x00007FF72DF00000-0x00007FF72E2F2000-memory.dmp	xmrig
behavioral2/memory/4424-674-0x00007FF75C330000-0x00007FF75C722000-memory.dmp	xmrig
behavioral2/memory/4828-673-0x00007FF7AC850000-0x00007FF7ACC42000-memory.dmp	xmrig
behavioral2/memory/2616-672-0x00007FF6BC520000-0x00007FF6BC912000-memory.dmp	xmrig
behavioral2/memory/2172-671-0x00007FF629E80000-0x00007FF62A272000-memory.dmp	xmrig
behavioral2/memory/4488-670-0x00007FF79C770000-0x00007FF79CB62000-memory.dmp	xmrig
behavioral2/memory/2820-669-0x00007FF700FC0000-0x00007FF7013B2000-memory.dmp	xmrig
behavioral2/memory/1524-667-0x00007FF6ECB80000-0x00007FF6ECF72000-memory.dmp	xmrig
behavioral2/memory/2580-666-0x00007FF696EA0000-0x00007FF697292000-memory.dmp	xmrig
behavioral2/memory/2848-664-0x00007FF664730000-0x00007FF664B22000-memory.dmp	xmrig
behavioral2/memory/4836-333-0x00007FF6722E0000-0x00007FF6726D2000-memory.dmp	xmrig
behavioral2/memory/4872-332-0x00007FF676140000-0x00007FF676532000-memory.dmp	xmrig
behavioral2/memory/4908-305-0x00007FF70D730000-0x00007FF70DB22000-memory.dmp	xmrig
behavioral2/memory/4388-248-0x00007FF7E7F40000-0x00007FF7E8332000-memory.dmp	xmrig
behavioral2/memory/4376-129-0x00007FF7593C0000-0x00007FF7597B2000-memory.dmp	xmrig
behavioral2/memory/2956-91-0x00007FF635280000-0x00007FF635672000-memory.dmp	xmrig
behavioral2/memory/2956-2960-0x00007FF635280000-0x00007FF635672000-memory.dmp	xmrig
behavioral2/memory/3180-2962-0x00007FF62DA80000-0x00007FF62DE72000-memory.dmp	xmrig
behavioral2/memory/4376-2964-0x00007FF7593C0000-0x00007FF7597B2000-memory.dmp	xmrig
behavioral2/memory/4388-2966-0x00007FF7E7F40000-0x00007FF7E8332000-memory.dmp	xmrig
behavioral2/memory/4908-2969-0x00007FF70D730000-0x00007FF70DB22000-memory.dmp	xmrig
behavioral2/memory/4872-2970-0x00007FF676140000-0x00007FF676532000-memory.dmp	xmrig
behavioral2/memory/2580-3015-0x00007FF696EA0000-0x00007FF697292000-memory.dmp	xmrig
behavioral2/memory/2848-3012-0x00007FF664730000-0x00007FF664B22000-memory.dmp	xmrig
behavioral2/memory/4480-3011-0x00007FF71D190000-0x00007FF71D582000-memory.dmp	xmrig
behavioral2/memory/1524-3028-0x00007FF6ECB80000-0x00007FF6ECF72000-memory.dmp	xmrig
behavioral2/memory/2172-3042-0x00007FF629E80000-0x00007FF62A272000-memory.dmp	xmrig
behavioral2/memory/2488-3064-0x00007FF7DDDD0000-0x00007FF7DE1C2000-memory.dmp	xmrig
behavioral2/memory/2820-3063-0x00007FF700FC0000-0x00007FF7013B2000-memory.dmp	xmrig
behavioral2/memory/2616-3046-0x00007FF6BC520000-0x00007FF6BC912000-memory.dmp	xmrig
behavioral2/memory/684-3047-0x00007FF6E4530000-0x00007FF6E4922000-memory.dmp	xmrig
behavioral2/memory/4828-3112-0x00007FF7AC850000-0x00007FF7ACC42000-memory.dmp	xmrig
behavioral2/memory/4488-3101-0x00007FF79C770000-0x00007FF79CB62000-memory.dmp	xmrig
behavioral2/memory/2124-3080-0x00007FF6E6E70000-0x00007FF6E7262000-memory.dmp	xmrig
behavioral2/memory/1640-3078-0x00007FF72DF00000-0x00007FF72E2F2000-memory.dmp	xmrig
behavioral2/memory/824-3098-0x00007FF701F00000-0x00007FF7022F2000-memory.dmp	xmrig
behavioral2/memory/4948-3091-0x00007FF764F00000-0x00007FF7652F2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2672	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2956	TmetiUC.exe
3180	RZAJWxw.exe
4376	WCeSWQz.exe
4388	bBVbbHm.exe
4908	ACUrExk.exe
4872	mYuxRms.exe
4836	wfwKKzP.exe
4772	aWoNZTl.exe
4480	TDYaGws.exe
2848	pvuJjAK.exe
2580	IBWZRyN.exe
1524	igrGwmO.exe
684	UcCaGsW.exe
2820	rmbGGvU.exe
4488	hbhPhMH.exe
2172	MsPYQCI.exe
2616	LUBRMmZ.exe
4828	OpjhuRW.exe
4424	bhINVpK.exe
2488	ARpHGrZ.exe
4948	mJNdAly.exe
1640	ZceAraw.exe
2124	NoKngaR.exe
824	TttVCrK.exe
1584	dcDOBoA.exe
4624	mOmVcUU.exe
2916	DOGqXNt.exe
4904	oMkuFiw.exe
2432	JwAahNd.exe
1176	epXqSuA.exe
4832	MoizVLJ.exe
2008	WqsoZQh.exe
5080	tfTbmGI.exe
2320	erBpsCs.exe
2832	VXHIcyi.exe
1220	owdNtyM.exe
876	uTeZSjA.exe
1632	sdCmIyG.exe
3900	YIopZfJ.exe
3684	QREgSgX.exe
2024	urMBOrG.exe
4796	xBlzEpn.exe
740	KOEAkiF.exe
2440	TvxvCSF.exe
4344	ErUNSfE.exe
312	iOsDYsX.exe
2004	lDXtqgw.exe
2292	wzSdFOk.exe
2656	JGUhFTR.exe
3260	ldzYbIA.exe
3580	LFQheQP.exe
4980	LPuyXIs.exe
4516	eUXCzPO.exe
2800	gneKRkH.exe
1916	GtzAXgG.exe
2200	YghOJkw.exe
3576	qLBJnjH.exe
1600	OEpyaXK.exe
3100	SFNLZGT.exe
3812	yadeKjl.exe
4436	ndlUbxl.exe
2344	EzPWPMU.exe
4984	BXBsgvW.exe
5044	TjFCoPg.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4640-0-0x00007FF7D6E60000-0x00007FF7D7252000-memory.dmp	upx
behavioral2/files/0x00090000000233ed-7.dat	upx
behavioral2/files/0x00070000000233f3-24.dat	upx
behavioral2/files/0x00070000000233f4-66.dat	upx
behavioral2/files/0x00070000000233fd-121.dat	upx
behavioral2/files/0x0007000000023411-162.dat	upx
behavioral2/memory/4772-390-0x00007FF7CB050000-0x00007FF7CB442000-memory.dmp	upx
behavioral2/memory/4480-554-0x00007FF71D190000-0x00007FF71D582000-memory.dmp	upx
behavioral2/memory/684-668-0x00007FF6E4530000-0x00007FF6E4922000-memory.dmp	upx
behavioral2/memory/4948-675-0x00007FF764F00000-0x00007FF7652F2000-memory.dmp	upx
behavioral2/memory/2488-680-0x00007FF7DDDD0000-0x00007FF7DE1C2000-memory.dmp	upx
behavioral2/memory/3180-679-0x00007FF62DA80000-0x00007FF62DE72000-memory.dmp	upx
behavioral2/memory/824-678-0x00007FF701F00000-0x00007FF7022F2000-memory.dmp	upx
behavioral2/memory/2124-677-0x00007FF6E6E70000-0x00007FF6E7262000-memory.dmp	upx
behavioral2/memory/1640-676-0x00007FF72DF00000-0x00007FF72E2F2000-memory.dmp	upx
behavioral2/memory/4424-674-0x00007FF75C330000-0x00007FF75C722000-memory.dmp	upx
behavioral2/memory/4828-673-0x00007FF7AC850000-0x00007FF7ACC42000-memory.dmp	upx
behavioral2/memory/2616-672-0x00007FF6BC520000-0x00007FF6BC912000-memory.dmp	upx
behavioral2/memory/2172-671-0x00007FF629E80000-0x00007FF62A272000-memory.dmp	upx
behavioral2/memory/4488-670-0x00007FF79C770000-0x00007FF79CB62000-memory.dmp	upx
behavioral2/memory/2820-669-0x00007FF700FC0000-0x00007FF7013B2000-memory.dmp	upx
behavioral2/memory/1524-667-0x00007FF6ECB80000-0x00007FF6ECF72000-memory.dmp	upx
behavioral2/memory/2580-666-0x00007FF696EA0000-0x00007FF697292000-memory.dmp	upx
behavioral2/memory/2848-664-0x00007FF664730000-0x00007FF664B22000-memory.dmp	upx
behavioral2/memory/4836-333-0x00007FF6722E0000-0x00007FF6726D2000-memory.dmp	upx
behavioral2/memory/4872-332-0x00007FF676140000-0x00007FF676532000-memory.dmp	upx
behavioral2/memory/4908-305-0x00007FF70D730000-0x00007FF70DB22000-memory.dmp	upx
behavioral2/memory/4388-248-0x00007FF7E7F40000-0x00007FF7E8332000-memory.dmp	upx
behavioral2/files/0x0007000000023416-206.dat	upx
behavioral2/files/0x0007000000023407-196.dat	upx
behavioral2/files/0x0007000000023406-192.dat	upx
behavioral2/files/0x0007000000023402-183.dat	upx
behavioral2/files/0x0007000000023415-182.dat	upx
behavioral2/files/0x000700000002340b-180.dat	upx
behavioral2/files/0x0007000000023414-177.dat	upx
behavioral2/files/0x0007000000023413-167.dat	upx
behavioral2/files/0x0007000000023412-163.dat	upx
behavioral2/files/0x0007000000023410-161.dat	upx
behavioral2/files/0x0007000000023404-157.dat	upx
behavioral2/files/0x00070000000233fe-153.dat	upx
behavioral2/files/0x000700000002340e-146.dat	upx
behavioral2/files/0x0007000000023405-189.dat	upx
behavioral2/files/0x0007000000023403-145.dat	upx
behavioral2/files/0x000700000002340d-141.dat	upx
behavioral2/files/0x000700000002340c-140.dat	upx
behavioral2/files/0x000700000002340a-136.dat	upx
behavioral2/memory/4376-129-0x00007FF7593C0000-0x00007FF7597B2000-memory.dmp	upx
behavioral2/files/0x0007000000023408-119.dat	upx
behavioral2/files/0x00070000000233fc-114.dat	upx
behavioral2/files/0x0007000000023401-144.dat	upx
behavioral2/files/0x00070000000233fb-102.dat	upx
behavioral2/files/0x00070000000233fa-97.dat	upx
behavioral2/files/0x0007000000023400-133.dat	upx
behavioral2/files/0x0007000000023409-132.dat	upx
behavioral2/files/0x00070000000233ff-122.dat	upx
behavioral2/memory/2956-91-0x00007FF635280000-0x00007FF635672000-memory.dmp	upx
behavioral2/files/0x00070000000233f8-79.dat	upx
behavioral2/files/0x00070000000233f7-76.dat	upx
behavioral2/files/0x00070000000233f6-93.dat	upx
behavioral2/files/0x00070000000233f9-86.dat	upx
behavioral2/files/0x00070000000233f2-49.dat	upx
behavioral2/files/0x00070000000233f5-45.dat	upx
behavioral2/files/0x00070000000233f1-36.dat	upx
behavioral2/memory/2956-2960-0x00007FF635280000-0x00007FF635672000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YOVCcjn.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\BJixGyG.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\mhEmNxy.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\UuGGHtr.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\FhCtyej.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\MiNwqmm.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\ciUgUVc.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\tElDEiI.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\HZPfAHG.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\SeHaXmh.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\dgvdJxR.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\WlpTnJc.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\djQvdOS.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\folWXha.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\TwSlVDv.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\visatMb.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\UxJmZpo.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\GikHrbJ.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\mYuxRms.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\RgsMKcP.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\sNTJxAX.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\NrnKqDx.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\caGgSUD.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\EEjhfea.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\HJqThGq.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\yiYiyHn.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\AMlwErf.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\owdNtyM.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\lDXtqgw.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\gfgYAzj.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\DdzmPNA.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\XNoBZdL.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\ZYRkztS.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\ACmVxsO.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\erahfru.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\wGHFYqA.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\JTCcnkE.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\jKFJTGR.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\UrRXdsV.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\QAJuktL.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\ZHoaHqA.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\QHElomY.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\aksQOrJ.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\fqNOvBF.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\MoKuVOt.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\QCwVhaP.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\ggkxgFB.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\JTGlsif.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\COxkKAy.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\HcXxrsy.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\xHHHBby.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\qxCucgp.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\QpZuDCl.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\NCWslzn.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\xosWXhA.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\uPVrUDM.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\WCcgZWk.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\QTvojHC.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\gyZwaaM.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\QytPyoS.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\uYyoPsP.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\fzPUQYK.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\ndlUbxl.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
File created	C:\Windows\System\zAXxGmK.exe	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe
2672	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2672	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 2672	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	83
PID 4640 wrote to memory of 2672	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	83
PID 4640 wrote to memory of 2956	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	84
PID 4640 wrote to memory of 2956	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	84
PID 4640 wrote to memory of 3180	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	85
PID 4640 wrote to memory of 3180	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	85
PID 4640 wrote to memory of 4376	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	86
PID 4640 wrote to memory of 4376	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	86
PID 4640 wrote to memory of 4388	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	87
PID 4640 wrote to memory of 4388	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	87
PID 4640 wrote to memory of 4908	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	88
PID 4640 wrote to memory of 4908	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	88
PID 4640 wrote to memory of 4872	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	89
PID 4640 wrote to memory of 4872	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	89
PID 4640 wrote to memory of 4836	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	90
PID 4640 wrote to memory of 4836	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	90
PID 4640 wrote to memory of 4772	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	91
PID 4640 wrote to memory of 4772	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	91
PID 4640 wrote to memory of 4480	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	92
PID 4640 wrote to memory of 4480	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	92
PID 4640 wrote to memory of 2848	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	93
PID 4640 wrote to memory of 2848	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	93
PID 4640 wrote to memory of 2580	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	94
PID 4640 wrote to memory of 2580	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	94
PID 4640 wrote to memory of 1524	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	95
PID 4640 wrote to memory of 1524	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	95
PID 4640 wrote to memory of 684	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	96
PID 4640 wrote to memory of 684	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	96
PID 4640 wrote to memory of 2820	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	97
PID 4640 wrote to memory of 2820	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	97
PID 4640 wrote to memory of 4488	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	98
PID 4640 wrote to memory of 4488	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	98
PID 4640 wrote to memory of 2172	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	99
PID 4640 wrote to memory of 2172	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	99
PID 4640 wrote to memory of 2616	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	100
PID 4640 wrote to memory of 2616	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	100
PID 4640 wrote to memory of 4828	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	101
PID 4640 wrote to memory of 4828	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	101
PID 4640 wrote to memory of 4948	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	102
PID 4640 wrote to memory of 4948	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	102
PID 4640 wrote to memory of 4424	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	103
PID 4640 wrote to memory of 4424	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	103
PID 4640 wrote to memory of 2488	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	104
PID 4640 wrote to memory of 2488	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	104
PID 4640 wrote to memory of 1640	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	105
PID 4640 wrote to memory of 1640	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	105
PID 4640 wrote to memory of 2124	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	106
PID 4640 wrote to memory of 2124	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	106
PID 4640 wrote to memory of 824	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	107
PID 4640 wrote to memory of 824	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	107
PID 4640 wrote to memory of 1584	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	108
PID 4640 wrote to memory of 1584	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	108
PID 4640 wrote to memory of 4624	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	109
PID 4640 wrote to memory of 4624	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	109
PID 4640 wrote to memory of 2916	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	110
PID 4640 wrote to memory of 2916	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	110
PID 4640 wrote to memory of 4904	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	111
PID 4640 wrote to memory of 4904	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	111
PID 4640 wrote to memory of 2432	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	112
PID 4640 wrote to memory of 2432	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	112
PID 4640 wrote to memory of 1176	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	113
PID 4640 wrote to memory of 1176	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	113
PID 4640 wrote to memory of 4832	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	114
PID 4640 wrote to memory of 4832	4640	19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\19a8be2fb4a27ccb301e891ef6ca7de0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\System\TmetiUC.exe
  C:\Windows\System\TmetiUC.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\RZAJWxw.exe
  C:\Windows\System\RZAJWxw.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\WCeSWQz.exe
  C:\Windows\System\WCeSWQz.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\bBVbbHm.exe
  C:\Windows\System\bBVbbHm.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\ACUrExk.exe
  C:\Windows\System\ACUrExk.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\mYuxRms.exe
  C:\Windows\System\mYuxRms.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\wfwKKzP.exe
  C:\Windows\System\wfwKKzP.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\aWoNZTl.exe
  C:\Windows\System\aWoNZTl.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\TDYaGws.exe
  C:\Windows\System\TDYaGws.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\pvuJjAK.exe
  C:\Windows\System\pvuJjAK.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\IBWZRyN.exe
  C:\Windows\System\IBWZRyN.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\igrGwmO.exe
  C:\Windows\System\igrGwmO.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\UcCaGsW.exe
  C:\Windows\System\UcCaGsW.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\rmbGGvU.exe
  C:\Windows\System\rmbGGvU.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\hbhPhMH.exe
  C:\Windows\System\hbhPhMH.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\MsPYQCI.exe
  C:\Windows\System\MsPYQCI.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\LUBRMmZ.exe
  C:\Windows\System\LUBRMmZ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\OpjhuRW.exe
  C:\Windows\System\OpjhuRW.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\mJNdAly.exe
  C:\Windows\System\mJNdAly.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\bhINVpK.exe
  C:\Windows\System\bhINVpK.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\ARpHGrZ.exe
  C:\Windows\System\ARpHGrZ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\ZceAraw.exe
  C:\Windows\System\ZceAraw.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\NoKngaR.exe
  C:\Windows\System\NoKngaR.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\TttVCrK.exe
  C:\Windows\System\TttVCrK.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\dcDOBoA.exe
  C:\Windows\System\dcDOBoA.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\mOmVcUU.exe
  C:\Windows\System\mOmVcUU.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\DOGqXNt.exe
  C:\Windows\System\DOGqXNt.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\oMkuFiw.exe
  C:\Windows\System\oMkuFiw.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\JwAahNd.exe
  C:\Windows\System\JwAahNd.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\epXqSuA.exe
  C:\Windows\System\epXqSuA.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\MoizVLJ.exe
  C:\Windows\System\MoizVLJ.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\QREgSgX.exe
  C:\Windows\System\QREgSgX.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\WqsoZQh.exe
  C:\Windows\System\WqsoZQh.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\tfTbmGI.exe
  C:\Windows\System\tfTbmGI.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\erBpsCs.exe
  C:\Windows\System\erBpsCs.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\VXHIcyi.exe
  C:\Windows\System\VXHIcyi.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\owdNtyM.exe
  C:\Windows\System\owdNtyM.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\uTeZSjA.exe
  C:\Windows\System\uTeZSjA.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\sdCmIyG.exe
  C:\Windows\System\sdCmIyG.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\YIopZfJ.exe
  C:\Windows\System\YIopZfJ.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\urMBOrG.exe
  C:\Windows\System\urMBOrG.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\xBlzEpn.exe
  C:\Windows\System\xBlzEpn.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\KOEAkiF.exe
  C:\Windows\System\KOEAkiF.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\TvxvCSF.exe
  C:\Windows\System\TvxvCSF.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\ErUNSfE.exe
  C:\Windows\System\ErUNSfE.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\iOsDYsX.exe
  C:\Windows\System\iOsDYsX.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\lDXtqgw.exe
  C:\Windows\System\lDXtqgw.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\wzSdFOk.exe
  C:\Windows\System\wzSdFOk.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\JGUhFTR.exe
  C:\Windows\System\JGUhFTR.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ndlUbxl.exe
  C:\Windows\System\ndlUbxl.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\EzPWPMU.exe
  C:\Windows\System\EzPWPMU.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\kqsIEZG.exe
  C:\Windows\System\kqsIEZG.exe
  2⤵
  PID:2888
- C:\Windows\System\ldzYbIA.exe
  C:\Windows\System\ldzYbIA.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\LFQheQP.exe
  C:\Windows\System\LFQheQP.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\LPuyXIs.exe
  C:\Windows\System\LPuyXIs.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\eUXCzPO.exe
  C:\Windows\System\eUXCzPO.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\gneKRkH.exe
  C:\Windows\System\gneKRkH.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\GtzAXgG.exe
  C:\Windows\System\GtzAXgG.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\YghOJkw.exe
  C:\Windows\System\YghOJkw.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\qLBJnjH.exe
  C:\Windows\System\qLBJnjH.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\OEpyaXK.exe
  C:\Windows\System\OEpyaXK.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\SFNLZGT.exe
  C:\Windows\System\SFNLZGT.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\yadeKjl.exe
  C:\Windows\System\yadeKjl.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\BXBsgvW.exe
  C:\Windows\System\BXBsgvW.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\TjFCoPg.exe
  C:\Windows\System\TjFCoPg.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\tUAsYWg.exe
  C:\Windows\System\tUAsYWg.exe
  2⤵
  PID:3904
- C:\Windows\System\WmJvkPB.exe
  C:\Windows\System\WmJvkPB.exe
  2⤵
  PID:1700
- C:\Windows\System\AEwMcQs.exe
  C:\Windows\System\AEwMcQs.exe
  2⤵
  PID:4208
- C:\Windows\System\bXqqqpD.exe
  C:\Windows\System\bXqqqpD.exe
  2⤵
  PID:3252
- C:\Windows\System\vzxEIKe.exe
  C:\Windows\System\vzxEIKe.exe
  2⤵
  PID:4448
- C:\Windows\System\fsHMsOi.exe
  C:\Windows\System\fsHMsOi.exe
  2⤵
  PID:524
- C:\Windows\System\HWnOhVq.exe
  C:\Windows\System\HWnOhVq.exe
  2⤵
  PID:2840
- C:\Windows\System\yNXIqdP.exe
  C:\Windows\System\yNXIqdP.exe
  2⤵
  PID:4792
- C:\Windows\System\CpvlnCQ.exe
  C:\Windows\System\CpvlnCQ.exe
  2⤵
  PID:4888
- C:\Windows\System\VsStccN.exe
  C:\Windows\System\VsStccN.exe
  2⤵
  PID:1044
- C:\Windows\System\RMBNeOd.exe
  C:\Windows\System\RMBNeOd.exe
  2⤵
  PID:4916
- C:\Windows\System\MbEbowN.exe
  C:\Windows\System\MbEbowN.exe
  2⤵
  PID:4460
- C:\Windows\System\KgxIaEy.exe
  C:\Windows\System\KgxIaEy.exe
  2⤵
  PID:4440
- C:\Windows\System\VqavEMV.exe
  C:\Windows\System\VqavEMV.exe
  2⤵
  PID:4332
- C:\Windows\System\ZakqyIK.exe
  C:\Windows\System\ZakqyIK.exe
  2⤵
  PID:424
- C:\Windows\System\RAQdbbd.exe
  C:\Windows\System\RAQdbbd.exe
  2⤵
  PID:988
- C:\Windows\System\ykKUrCD.exe
  C:\Windows\System\ykKUrCD.exe
  2⤵
  PID:3708
- C:\Windows\System\YxVIveQ.exe
  C:\Windows\System\YxVIveQ.exe
  2⤵
  PID:2428
- C:\Windows\System\IINvUWF.exe
  C:\Windows\System\IINvUWF.exe
  2⤵
  PID:4300
- C:\Windows\System\DsBuSlA.exe
  C:\Windows\System\DsBuSlA.exe
  2⤵
  PID:4952
- C:\Windows\System\UVyTCeF.exe
  C:\Windows\System\UVyTCeF.exe
  2⤵
  PID:1884
- C:\Windows\System\joqGwBY.exe
  C:\Windows\System\joqGwBY.exe
  2⤵
  PID:5128
- C:\Windows\System\xQKOJBt.exe
  C:\Windows\System\xQKOJBt.exe
  2⤵
  PID:5148
- C:\Windows\System\vGTEPla.exe
  C:\Windows\System\vGTEPla.exe
  2⤵
  PID:5164
- C:\Windows\System\dQYWrys.exe
  C:\Windows\System\dQYWrys.exe
  2⤵
  PID:5184
- C:\Windows\System\hZGSGzP.exe
  C:\Windows\System\hZGSGzP.exe
  2⤵
  PID:5204
- C:\Windows\System\SIvDoLi.exe
  C:\Windows\System\SIvDoLi.exe
  2⤵
  PID:5224
- C:\Windows\System\ZbNwOVp.exe
  C:\Windows\System\ZbNwOVp.exe
  2⤵
  PID:5244
- C:\Windows\System\LmKyzcq.exe
  C:\Windows\System\LmKyzcq.exe
  2⤵
  PID:5264
- C:\Windows\System\OejEvZS.exe
  C:\Windows\System\OejEvZS.exe
  2⤵
  PID:5288
- C:\Windows\System\tFPxyAo.exe
  C:\Windows\System\tFPxyAo.exe
  2⤵
  PID:5348
- C:\Windows\System\EnpCLrd.exe
  C:\Windows\System\EnpCLrd.exe
  2⤵
  PID:5368
- C:\Windows\System\fXfIIRY.exe
  C:\Windows\System\fXfIIRY.exe
  2⤵
  PID:5384
- C:\Windows\System\VajQSbi.exe
  C:\Windows\System\VajQSbi.exe
  2⤵
  PID:5400
- C:\Windows\System\DRUfjrw.exe
  C:\Windows\System\DRUfjrw.exe
  2⤵
  PID:5416
- C:\Windows\System\wjkZpdN.exe
  C:\Windows\System\wjkZpdN.exe
  2⤵
  PID:5432
- C:\Windows\System\xxYuwYN.exe
  C:\Windows\System\xxYuwYN.exe
  2⤵
  PID:5448
- C:\Windows\System\DzBIPEz.exe
  C:\Windows\System\DzBIPEz.exe
  2⤵
  PID:5476
- C:\Windows\System\cpmlljO.exe
  C:\Windows\System\cpmlljO.exe
  2⤵
  PID:5492
- C:\Windows\System\oqXGnie.exe
  C:\Windows\System\oqXGnie.exe
  2⤵
  PID:5516
- C:\Windows\System\XVUjhDH.exe
  C:\Windows\System\XVUjhDH.exe
  2⤵
  PID:5532
- C:\Windows\System\gfgYAzj.exe
  C:\Windows\System\gfgYAzj.exe
  2⤵
  PID:5552
- C:\Windows\System\yxfyEcx.exe
  C:\Windows\System\yxfyEcx.exe
  2⤵
  PID:5580
- C:\Windows\System\nfZNMtn.exe
  C:\Windows\System\nfZNMtn.exe
  2⤵
  PID:5600
- C:\Windows\System\sdudcgC.exe
  C:\Windows\System\sdudcgC.exe
  2⤵
  PID:5620
- C:\Windows\System\vZyDrTy.exe
  C:\Windows\System\vZyDrTy.exe
  2⤵
  PID:5636
- C:\Windows\System\KMITKHA.exe
  C:\Windows\System\KMITKHA.exe
  2⤵
  PID:5660
- C:\Windows\System\sSFzjoF.exe
  C:\Windows\System\sSFzjoF.exe
  2⤵
  PID:5676
- C:\Windows\System\iIbaAAy.exe
  C:\Windows\System\iIbaAAy.exe
  2⤵
  PID:5700
- C:\Windows\System\ZDScGet.exe
  C:\Windows\System\ZDScGet.exe
  2⤵
  PID:5720
- C:\Windows\System\GhPoxfI.exe
  C:\Windows\System\GhPoxfI.exe
  2⤵
  PID:5744
- C:\Windows\System\laEschZ.exe
  C:\Windows\System\laEschZ.exe
  2⤵
  PID:5760
- C:\Windows\System\wmpBIAy.exe
  C:\Windows\System\wmpBIAy.exe
  2⤵
  PID:5780
- C:\Windows\System\wgSRwVw.exe
  C:\Windows\System\wgSRwVw.exe
  2⤵
  PID:5812
- C:\Windows\System\jDfGZSE.exe
  C:\Windows\System\jDfGZSE.exe
  2⤵
  PID:5828
- C:\Windows\System\VxbYDTe.exe
  C:\Windows\System\VxbYDTe.exe
  2⤵
  PID:5844
- C:\Windows\System\pRNTgik.exe
  C:\Windows\System\pRNTgik.exe
  2⤵
  PID:5868
- C:\Windows\System\rtJLapQ.exe
  C:\Windows\System\rtJLapQ.exe
  2⤵
  PID:5888
- C:\Windows\System\MkNRuRz.exe
  C:\Windows\System\MkNRuRz.exe
  2⤵
  PID:5936
- C:\Windows\System\IzoimYa.exe
  C:\Windows\System\IzoimYa.exe
  2⤵
  PID:5952
- C:\Windows\System\bkZirma.exe
  C:\Windows\System\bkZirma.exe
  2⤵
  PID:5972
- C:\Windows\System\iTUgMeh.exe
  C:\Windows\System\iTUgMeh.exe
  2⤵
  PID:5992
- C:\Windows\System\ChhaKDO.exe
  C:\Windows\System\ChhaKDO.exe
  2⤵
  PID:6008
- C:\Windows\System\OgYyABc.exe
  C:\Windows\System\OgYyABc.exe
  2⤵
  PID:6036
- C:\Windows\System\hAzMyWr.exe
  C:\Windows\System\hAzMyWr.exe
  2⤵
  PID:6052
- C:\Windows\System\jFulyJw.exe
  C:\Windows\System\jFulyJw.exe
  2⤵
  PID:6084
- C:\Windows\System\clfJxFt.exe
  C:\Windows\System\clfJxFt.exe
  2⤵
  PID:6104
- C:\Windows\System\PUXLsTy.exe
  C:\Windows\System\PUXLsTy.exe
  2⤵
  PID:6128
- C:\Windows\System\HEhyQXW.exe
  C:\Windows\System\HEhyQXW.exe
  2⤵
  PID:2500
- C:\Windows\System\aDqWUus.exe
  C:\Windows\System\aDqWUus.exe
  2⤵
  PID:3960
- C:\Windows\System\Ozctolk.exe
  C:\Windows\System\Ozctolk.exe
  2⤵
  PID:4808
- C:\Windows\System\wGHFYqA.exe
  C:\Windows\System\wGHFYqA.exe
  2⤵
  PID:5112
- C:\Windows\System\IoDmuPq.exe
  C:\Windows\System\IoDmuPq.exe
  2⤵
  PID:2360
- C:\Windows\System\cUElyEd.exe
  C:\Windows\System\cUElyEd.exe
  2⤵
  PID:3852
- C:\Windows\System\nbvkZLG.exe
  C:\Windows\System\nbvkZLG.exe
  2⤵
  PID:1520
- C:\Windows\System\ZcwZNXB.exe
  C:\Windows\System\ZcwZNXB.exe
  2⤵
  PID:4356
- C:\Windows\System\gsTeLze.exe
  C:\Windows\System\gsTeLze.exe
  2⤵
  PID:4556
- C:\Windows\System\UjuIXvK.exe
  C:\Windows\System\UjuIXvK.exe
  2⤵
  PID:4620
- C:\Windows\System\TlDRkJD.exe
  C:\Windows\System\TlDRkJD.exe
  2⤵
  PID:4868
- C:\Windows\System\izDRAJc.exe
  C:\Windows\System\izDRAJc.exe
  2⤵
  PID:4548
- C:\Windows\System\TnIBgaU.exe
  C:\Windows\System\TnIBgaU.exe
  2⤵
  PID:5696
- C:\Windows\System\LKPRZaZ.exe
  C:\Windows\System\LKPRZaZ.exe
  2⤵
  PID:6148
- C:\Windows\System\MGmKjBm.exe
  C:\Windows\System\MGmKjBm.exe
  2⤵
  PID:6172
- C:\Windows\System\DMTGRlr.exe
  C:\Windows\System\DMTGRlr.exe
  2⤵
  PID:6188
- C:\Windows\System\SRKZyOv.exe
  C:\Windows\System\SRKZyOv.exe
  2⤵
  PID:6212
- C:\Windows\System\IrCwoxi.exe
  C:\Windows\System\IrCwoxi.exe
  2⤵
  PID:6232
- C:\Windows\System\YEixDxQ.exe
  C:\Windows\System\YEixDxQ.exe
  2⤵
  PID:6256
- C:\Windows\System\kuIiCmf.exe
  C:\Windows\System\kuIiCmf.exe
  2⤵
  PID:6280
- C:\Windows\System\kLrBaTw.exe
  C:\Windows\System\kLrBaTw.exe
  2⤵
  PID:6304
- C:\Windows\System\pwzQQEC.exe
  C:\Windows\System\pwzQQEC.exe
  2⤵
  PID:6324
- C:\Windows\System\vDCCgoC.exe
  C:\Windows\System\vDCCgoC.exe
  2⤵
  PID:6340
- C:\Windows\System\OmzCasx.exe
  C:\Windows\System\OmzCasx.exe
  2⤵
  PID:6364
- C:\Windows\System\DepRBaC.exe
  C:\Windows\System\DepRBaC.exe
  2⤵
  PID:6380
- C:\Windows\System\qekAnEi.exe
  C:\Windows\System\qekAnEi.exe
  2⤵
  PID:6408
- C:\Windows\System\SCkweAu.exe
  C:\Windows\System\SCkweAu.exe
  2⤵
  PID:6424
- C:\Windows\System\lPzMZmN.exe
  C:\Windows\System\lPzMZmN.exe
  2⤵
  PID:6448
- C:\Windows\System\OUVQyaz.exe
  C:\Windows\System\OUVQyaz.exe
  2⤵
  PID:6464
- C:\Windows\System\QeDBHed.exe
  C:\Windows\System\QeDBHed.exe
  2⤵
  PID:6488
- C:\Windows\System\FSFyTgb.exe
  C:\Windows\System\FSFyTgb.exe
  2⤵
  PID:6512
- C:\Windows\System\VyuHUyK.exe
  C:\Windows\System\VyuHUyK.exe
  2⤵
  PID:6528
- C:\Windows\System\ipNmLdw.exe
  C:\Windows\System\ipNmLdw.exe
  2⤵
  PID:6552
- C:\Windows\System\BAgZTmC.exe
  C:\Windows\System\BAgZTmC.exe
  2⤵
  PID:6568
- C:\Windows\System\ueSXfQg.exe
  C:\Windows\System\ueSXfQg.exe
  2⤵
  PID:6592
- C:\Windows\System\ucOTBlQ.exe
  C:\Windows\System\ucOTBlQ.exe
  2⤵
  PID:6608
- C:\Windows\System\GKpuaan.exe
  C:\Windows\System\GKpuaan.exe
  2⤵
  PID:6636
- C:\Windows\System\GBHBEWy.exe
  C:\Windows\System\GBHBEWy.exe
  2⤵
  PID:6652
- C:\Windows\System\AiJAMsT.exe
  C:\Windows\System\AiJAMsT.exe
  2⤵
  PID:6672
- C:\Windows\System\avkCQBb.exe
  C:\Windows\System\avkCQBb.exe
  2⤵
  PID:6688
- C:\Windows\System\FTJTKJw.exe
  C:\Windows\System\FTJTKJw.exe
  2⤵
  PID:6712
- C:\Windows\System\bRExRIy.exe
  C:\Windows\System\bRExRIy.exe
  2⤵
  PID:6728
- C:\Windows\System\pxNLtbM.exe
  C:\Windows\System\pxNLtbM.exe
  2⤵
  PID:6744
- C:\Windows\System\zAXxGmK.exe
  C:\Windows\System\zAXxGmK.exe
  2⤵
  PID:6768
- C:\Windows\System\RHQiYsL.exe
  C:\Windows\System\RHQiYsL.exe
  2⤵
  PID:6784
- C:\Windows\System\eIPIYvr.exe
  C:\Windows\System\eIPIYvr.exe
  2⤵
  PID:6812
- C:\Windows\System\ofWtDis.exe
  C:\Windows\System\ofWtDis.exe
  2⤵
  PID:6836
- C:\Windows\System\dgvdJxR.exe
  C:\Windows\System\dgvdJxR.exe
  2⤵
  PID:6868
- C:\Windows\System\DdzmPNA.exe
  C:\Windows\System\DdzmPNA.exe
  2⤵
  PID:6884
- C:\Windows\System\dVaoJAu.exe
  C:\Windows\System\dVaoJAu.exe
  2⤵
  PID:6900
- C:\Windows\System\MUWwiHz.exe
  C:\Windows\System\MUWwiHz.exe
  2⤵
  PID:6916
- C:\Windows\System\mvTyPug.exe
  C:\Windows\System\mvTyPug.exe
  2⤵
  PID:6972
- C:\Windows\System\eqiydOn.exe
  C:\Windows\System\eqiydOn.exe
  2⤵
  PID:6992
- C:\Windows\System\XLwuJZU.exe
  C:\Windows\System\XLwuJZU.exe
  2⤵
  PID:7012
- C:\Windows\System\cgcYvVg.exe
  C:\Windows\System\cgcYvVg.exe
  2⤵
  PID:7036
- C:\Windows\System\caGgSUD.exe
  C:\Windows\System\caGgSUD.exe
  2⤵
  PID:7060
- C:\Windows\System\vxUtqnW.exe
  C:\Windows\System\vxUtqnW.exe
  2⤵
  PID:7076
- C:\Windows\System\kKyPuhM.exe
  C:\Windows\System\kKyPuhM.exe
  2⤵
  PID:7092
- C:\Windows\System\EEjhfea.exe
  C:\Windows\System\EEjhfea.exe
  2⤵
  PID:7108
- C:\Windows\System\dLoKVVy.exe
  C:\Windows\System\dLoKVVy.exe
  2⤵
  PID:7128
- C:\Windows\System\fNZXbUb.exe
  C:\Windows\System\fNZXbUb.exe
  2⤵
  PID:7144
- C:\Windows\System\FGOBvSy.exe
  C:\Windows\System\FGOBvSy.exe
  2⤵
  PID:7160
- C:\Windows\System\TZixUOL.exe
  C:\Windows\System\TZixUOL.exe
  2⤵
  PID:4692
- C:\Windows\System\luCGMzZ.exe
  C:\Windows\System\luCGMzZ.exe
  2⤵
  PID:1312
- C:\Windows\System\OQxJdFE.exe
  C:\Windows\System\OQxJdFE.exe
  2⤵
  PID:2612
- C:\Windows\System\jtJbhKE.exe
  C:\Windows\System\jtJbhKE.exe
  2⤵
  PID:2108
- C:\Windows\System\OpTKacv.exe
  C:\Windows\System\OpTKacv.exe
  2⤵
  PID:4752
- C:\Windows\System\hVSpPwj.exe
  C:\Windows\System\hVSpPwj.exe
  2⤵
  PID:1516
- C:\Windows\System\gDuNoOc.exe
  C:\Windows\System\gDuNoOc.exe
  2⤵
  PID:2556
- C:\Windows\System\nEQMzOZ.exe
  C:\Windows\System\nEQMzOZ.exe
  2⤵
  PID:5180
- C:\Windows\System\wdezxNd.exe
  C:\Windows\System\wdezxNd.exe
  2⤵
  PID:5216
- C:\Windows\System\WgqmhJQ.exe
  C:\Windows\System\WgqmhJQ.exe
  2⤵
  PID:5260
- C:\Windows\System\tLOAhKE.exe
  C:\Windows\System\tLOAhKE.exe
  2⤵
  PID:6024
- C:\Windows\System\eLnMEcN.exe
  C:\Windows\System\eLnMEcN.exe
  2⤵
  PID:5596
- C:\Windows\System\GkRmwEh.exe
  C:\Windows\System\GkRmwEh.exe
  2⤵
  PID:1996
- C:\Windows\System\LRbxdIp.exe
  C:\Windows\System\LRbxdIp.exe
  2⤵
  PID:3772
- C:\Windows\System\EDjgMQJ.exe
  C:\Windows\System\EDjgMQJ.exe
  2⤵
  PID:6292
- C:\Windows\System\bvPkXov.exe
  C:\Windows\System\bvPkXov.exe
  2⤵
  PID:6600
- C:\Windows\System\SHPMMfl.exe
  C:\Windows\System\SHPMMfl.exe
  2⤵
  PID:7192
- C:\Windows\System\PQvMgtJ.exe
  C:\Windows\System\PQvMgtJ.exe
  2⤵
  PID:7212
- C:\Windows\System\zAFbcbg.exe
  C:\Windows\System\zAFbcbg.exe
  2⤵
  PID:7232
- C:\Windows\System\YRWnWNF.exe
  C:\Windows\System\YRWnWNF.exe
  2⤵
  PID:7248
- C:\Windows\System\gFfmAIP.exe
  C:\Windows\System\gFfmAIP.exe
  2⤵
  PID:7276
- C:\Windows\System\IAovmId.exe
  C:\Windows\System\IAovmId.exe
  2⤵
  PID:7304
- C:\Windows\System\hyRqEnU.exe
  C:\Windows\System\hyRqEnU.exe
  2⤵
  PID:7328
- C:\Windows\System\CZrQNjI.exe
  C:\Windows\System\CZrQNjI.exe
  2⤵
  PID:7344
- C:\Windows\System\HAGGmhp.exe
  C:\Windows\System\HAGGmhp.exe
  2⤵
  PID:7372
- C:\Windows\System\sCIjxNm.exe
  C:\Windows\System\sCIjxNm.exe
  2⤵
  PID:7388
- C:\Windows\System\XBtEZRE.exe
  C:\Windows\System\XBtEZRE.exe
  2⤵
  PID:7416
- C:\Windows\System\SgYIkUL.exe
  C:\Windows\System\SgYIkUL.exe
  2⤵
  PID:7432
- C:\Windows\System\RortoGg.exe
  C:\Windows\System\RortoGg.exe
  2⤵
  PID:7460
- C:\Windows\System\VBUadau.exe
  C:\Windows\System\VBUadau.exe
  2⤵
  PID:7480
- C:\Windows\System\uRpVWKw.exe
  C:\Windows\System\uRpVWKw.exe
  2⤵
  PID:7504
- C:\Windows\System\JTCcnkE.exe
  C:\Windows\System\JTCcnkE.exe
  2⤵
  PID:7520
- C:\Windows\System\yOyQUGJ.exe
  C:\Windows\System\yOyQUGJ.exe
  2⤵
  PID:7540
- C:\Windows\System\DPWWyan.exe
  C:\Windows\System\DPWWyan.exe
  2⤵
  PID:7576
- C:\Windows\System\zpnCiHW.exe
  C:\Windows\System\zpnCiHW.exe
  2⤵
  PID:7596
- C:\Windows\System\GHfGwoP.exe
  C:\Windows\System\GHfGwoP.exe
  2⤵
  PID:7620
- C:\Windows\System\UYwCxNP.exe
  C:\Windows\System\UYwCxNP.exe
  2⤵
  PID:7636
- C:\Windows\System\eMOXdNY.exe
  C:\Windows\System\eMOXdNY.exe
  2⤵
  PID:7652
- C:\Windows\System\GLMuxxL.exe
  C:\Windows\System\GLMuxxL.exe
  2⤵
  PID:7668
- C:\Windows\System\aUcJvAA.exe
  C:\Windows\System\aUcJvAA.exe
  2⤵
  PID:7700
- C:\Windows\System\YNAHkzn.exe
  C:\Windows\System\YNAHkzn.exe
  2⤵
  PID:7720
- C:\Windows\System\KcSJQMG.exe
  C:\Windows\System\KcSJQMG.exe
  2⤵
  PID:7820
- C:\Windows\System\mTjZsmb.exe
  C:\Windows\System\mTjZsmb.exe
  2⤵
  PID:7892
- C:\Windows\System\bRrfEMU.exe
  C:\Windows\System\bRrfEMU.exe
  2⤵
  PID:7908
- C:\Windows\System\xyTFzFA.exe
  C:\Windows\System\xyTFzFA.exe
  2⤵
  PID:7924
- C:\Windows\System\hJoeRVO.exe
  C:\Windows\System\hJoeRVO.exe
  2⤵
  PID:7940
- C:\Windows\System\ZYbfPoI.exe
  C:\Windows\System\ZYbfPoI.exe
  2⤵
  PID:7956
- C:\Windows\System\lWSVJOd.exe
  C:\Windows\System\lWSVJOd.exe
  2⤵
  PID:7972
- C:\Windows\System\kLNhTBS.exe
  C:\Windows\System\kLNhTBS.exe
  2⤵
  PID:7988
- C:\Windows\System\CLFIZQO.exe
  C:\Windows\System\CLFIZQO.exe
  2⤵
  PID:8004
- C:\Windows\System\iDJBbqI.exe
  C:\Windows\System\iDJBbqI.exe
  2⤵
  PID:8020
- C:\Windows\System\JTGlsif.exe
  C:\Windows\System\JTGlsif.exe
  2⤵
  PID:8036
- C:\Windows\System\bNKUHPD.exe
  C:\Windows\System\bNKUHPD.exe
  2⤵
  PID:8052
- C:\Windows\System\xLfHUOs.exe
  C:\Windows\System\xLfHUOs.exe
  2⤵
  PID:8068
- C:\Windows\System\vUlMktR.exe
  C:\Windows\System\vUlMktR.exe
  2⤵
  PID:8084
- C:\Windows\System\lyAbEwd.exe
  C:\Windows\System\lyAbEwd.exe
  2⤵
  PID:8100
- C:\Windows\System\YvfzptU.exe
  C:\Windows\System\YvfzptU.exe
  2⤵
  PID:8116
- C:\Windows\System\tSijFzr.exe
  C:\Windows\System\tSijFzr.exe
  2⤵
  PID:8132
- C:\Windows\System\zNYYyRh.exe
  C:\Windows\System\zNYYyRh.exe
  2⤵
  PID:8148
- C:\Windows\System\OQlMNZQ.exe
  C:\Windows\System\OQlMNZQ.exe
  2⤵
  PID:8164
- C:\Windows\System\YYLWXre.exe
  C:\Windows\System\YYLWXre.exe
  2⤵
  PID:8180
- C:\Windows\System\KIYhDJr.exe
  C:\Windows\System\KIYhDJr.exe
  2⤵
  PID:6740
- C:\Windows\System\Jmgezpw.exe
  C:\Windows\System\Jmgezpw.exe
  2⤵
  PID:6896
- C:\Windows\System\ILAXedx.exe
  C:\Windows\System\ILAXedx.exe
  2⤵
  PID:5424
- C:\Windows\System\BcxNIhI.exe
  C:\Windows\System\BcxNIhI.exe
  2⤵
  PID:5468
- C:\Windows\System\DQWuISU.exe
  C:\Windows\System\DQWuISU.exe
  2⤵
  PID:5296
- C:\Windows\System\JrViTzR.exe
  C:\Windows\System\JrViTzR.exe
  2⤵
  PID:5964
- C:\Windows\System\ARksbry.exe
  C:\Windows\System\ARksbry.exe
  2⤵
  PID:6004
- C:\Windows\System\ffgMnep.exe
  C:\Windows\System\ffgMnep.exe
  2⤵
  PID:6100
- C:\Windows\System\FCBZrCQ.exe
  C:\Windows\System\FCBZrCQ.exe
  2⤵
  PID:3856
- C:\Windows\System\EGCSZvf.exe
  C:\Windows\System\EGCSZvf.exe
  2⤵
  PID:4820
- C:\Windows\System\ccioTAy.exe
  C:\Windows\System\ccioTAy.exe
  2⤵
  PID:2044
- C:\Windows\System\YtkVqbC.exe
  C:\Windows\System\YtkVqbC.exe
  2⤵
  PID:2020
- C:\Windows\System\aGzrxtg.exe
  C:\Windows\System\aGzrxtg.exe
  2⤵
  PID:4540
- C:\Windows\System\kxJZAeV.exe
  C:\Windows\System\kxJZAeV.exe
  2⤵
  PID:5024
- C:\Windows\System\rOMLupm.exe
  C:\Windows\System\rOMLupm.exe
  2⤵
  PID:6160
- C:\Windows\System\XwxIcWz.exe
  C:\Windows\System\XwxIcWz.exe
  2⤵
  PID:6224
- C:\Windows\System\ytjdLnX.exe
  C:\Windows\System\ytjdLnX.exe
  2⤵
  PID:6268
- C:\Windows\System\XsdgDRq.exe
  C:\Windows\System\XsdgDRq.exe
  2⤵
  PID:6316
- C:\Windows\System\pdZwHNd.exe
  C:\Windows\System\pdZwHNd.exe
  2⤵
  PID:6352
- C:\Windows\System\kOcmqvm.exe
  C:\Windows\System\kOcmqvm.exe
  2⤵
  PID:6404
- C:\Windows\System\dJFchus.exe
  C:\Windows\System\dJFchus.exe
  2⤵
  PID:6440
- C:\Windows\System\TZppPZL.exe
  C:\Windows\System\TZppPZL.exe
  2⤵
  PID:6508
- C:\Windows\System\sdmEeSH.exe
  C:\Windows\System\sdmEeSH.exe
  2⤵
  PID:6544
- C:\Windows\System\CaPholm.exe
  C:\Windows\System\CaPholm.exe
  2⤵
  PID:6576
- C:\Windows\System\bGNcrKK.exe
  C:\Windows\System\bGNcrKK.exe
  2⤵
  PID:6616
- C:\Windows\System\bGtoZRh.exe
  C:\Windows\System\bGtoZRh.exe
  2⤵
  PID:6648
- C:\Windows\System\IaISVND.exe
  C:\Windows\System\IaISVND.exe
  2⤵
  PID:6680
- C:\Windows\System\uoRZsTR.exe
  C:\Windows\System\uoRZsTR.exe
  2⤵
  PID:6708
- C:\Windows\System\nHzNzJP.exe
  C:\Windows\System\nHzNzJP.exe
  2⤵
  PID:6760
- C:\Windows\System\aadCNRz.exe
  C:\Windows\System\aadCNRz.exe
  2⤵
  PID:6792
- C:\Windows\System\GRJLOcf.exe
  C:\Windows\System\GRJLOcf.exe
  2⤵
  PID:6824
- C:\Windows\System\VmYieOK.exe
  C:\Windows\System\VmYieOK.exe
  2⤵
  PID:6852
- C:\Windows\System\ECibRaN.exe
  C:\Windows\System\ECibRaN.exe
  2⤵
  PID:6908
- C:\Windows\System\MewzGYU.exe
  C:\Windows\System\MewzGYU.exe
  2⤵
  PID:6940
- C:\Windows\System\noftjlT.exe
  C:\Windows\System\noftjlT.exe
  2⤵
  PID:3592
- C:\Windows\System\xIfFuVo.exe
  C:\Windows\System\xIfFuVo.exe
  2⤵
  PID:7316
- C:\Windows\System\affnLUo.exe
  C:\Windows\System\affnLUo.exe
  2⤵
  PID:7472
- C:\Windows\System\jKFJTGR.exe
  C:\Windows\System\jKFJTGR.exe
  2⤵
  PID:7564
- C:\Windows\System\SJPnTzG.exe
  C:\Windows\System\SJPnTzG.exe
  2⤵
  PID:7760
- C:\Windows\System\wCoveMx.exe
  C:\Windows\System\wCoveMx.exe
  2⤵
  PID:7048
- C:\Windows\System\mrlnhuj.exe
  C:\Windows\System\mrlnhuj.exe
  2⤵
  PID:7088
- C:\Windows\System\jJaLkmH.exe
  C:\Windows\System\jJaLkmH.exe
  2⤵
  PID:7124
- C:\Windows\System\wvceBVX.exe
  C:\Windows\System\wvceBVX.exe
  2⤵
  PID:7156
- C:\Windows\System\cWWpGMN.exe
  C:\Windows\System\cWWpGMN.exe
  2⤵
  PID:3992
- C:\Windows\System\oaVRLdu.exe
  C:\Windows\System\oaVRLdu.exe
  2⤵
  PID:4884
- C:\Windows\System\FqGmIYV.exe
  C:\Windows\System\FqGmIYV.exe
  2⤵
  PID:4092
- C:\Windows\System\yWqMsKM.exe
  C:\Windows\System\yWqMsKM.exe
  2⤵
  PID:5200
- C:\Windows\System\ydQIoHo.exe
  C:\Windows\System\ydQIoHo.exe
  2⤵
  PID:6016
- C:\Windows\System\mpmcatI.exe
  C:\Windows\System\mpmcatI.exe
  2⤵
  PID:5684
- C:\Windows\System\vQnCmqd.exe
  C:\Windows\System\vQnCmqd.exe
  2⤵
  PID:6480
- C:\Windows\System\JBEUthP.exe
  C:\Windows\System\JBEUthP.exe
  2⤵
  PID:7220
- C:\Windows\System\IyJEfVe.exe
  C:\Windows\System\IyJEfVe.exe
  2⤵
  PID:7256
- C:\Windows\System\VyMhQZz.exe
  C:\Windows\System\VyMhQZz.exe
  2⤵
  PID:7312
- C:\Windows\System\rnbFwwG.exe
  C:\Windows\System\rnbFwwG.exe
  2⤵
  PID:7380
- C:\Windows\System\AlqbkyN.exe
  C:\Windows\System\AlqbkyN.exe
  2⤵
  PID:7424
- C:\Windows\System\TaxJWKC.exe
  C:\Windows\System\TaxJWKC.exe
  2⤵
  PID:7468
- C:\Windows\System\ARgMmbh.exe
  C:\Windows\System\ARgMmbh.exe
  2⤵
  PID:7512
- C:\Windows\System\hSdHXHr.exe
  C:\Windows\System\hSdHXHr.exe
  2⤵
  PID:7552
- C:\Windows\System\vtLVuVS.exe
  C:\Windows\System\vtLVuVS.exe
  2⤵
  PID:7592
- C:\Windows\System\igfictC.exe
  C:\Windows\System\igfictC.exe
  2⤵
  PID:7632
- C:\Windows\System\vvkcWMs.exe
  C:\Windows\System\vvkcWMs.exe
  2⤵
  PID:7664
- C:\Windows\System\BgUKjvi.exe
  C:\Windows\System\BgUKjvi.exe
  2⤵
  PID:8200
- C:\Windows\System\aocdCqX.exe
  C:\Windows\System\aocdCqX.exe
  2⤵
  PID:8220
- C:\Windows\System\wsaFaHO.exe
  C:\Windows\System\wsaFaHO.exe
  2⤵
  PID:8244
- C:\Windows\System\vxwwvCN.exe
  C:\Windows\System\vxwwvCN.exe
  2⤵
  PID:8268
- C:\Windows\System\VxVYnZc.exe
  C:\Windows\System\VxVYnZc.exe
  2⤵
  PID:8292
- C:\Windows\System\kQjCBLg.exe
  C:\Windows\System\kQjCBLg.exe
  2⤵
  PID:8568
- C:\Windows\System\nBUZkcy.exe
  C:\Windows\System\nBUZkcy.exe
  2⤵
  PID:8584
- C:\Windows\System\PAxwbsP.exe
  C:\Windows\System\PAxwbsP.exe
  2⤵
  PID:8600
- C:\Windows\System\ycxsHef.exe
  C:\Windows\System\ycxsHef.exe
  2⤵
  PID:8616
- C:\Windows\System\IYLAiBi.exe
  C:\Windows\System\IYLAiBi.exe
  2⤵
  PID:8632
- C:\Windows\System\KuTfArf.exe
  C:\Windows\System\KuTfArf.exe
  2⤵
  PID:8648
- C:\Windows\System\lXlNQZH.exe
  C:\Windows\System\lXlNQZH.exe
  2⤵
  PID:8664
- C:\Windows\System\qnMBKQl.exe
  C:\Windows\System\qnMBKQl.exe
  2⤵
  PID:8680
- C:\Windows\System\mOeCHgD.exe
  C:\Windows\System\mOeCHgD.exe
  2⤵
  PID:8696
- C:\Windows\System\EIvXwSB.exe
  C:\Windows\System\EIvXwSB.exe
  2⤵
  PID:9012
- C:\Windows\System\acRDfMM.exe
  C:\Windows\System\acRDfMM.exe
  2⤵
  PID:9036
- C:\Windows\System\MhYqJOz.exe
  C:\Windows\System\MhYqJOz.exe
  2⤵
  PID:9052
- C:\Windows\System\gfJChfZ.exe
  C:\Windows\System\gfJChfZ.exe
  2⤵
  PID:9068
- C:\Windows\System\FFSMbHx.exe
  C:\Windows\System\FFSMbHx.exe
  2⤵
  PID:9084
- C:\Windows\System\xwfEnDo.exe
  C:\Windows\System\xwfEnDo.exe
  2⤵
  PID:9104
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 9104 -s 184
    3⤵
    PID:14104
- C:\Windows\System\XRVGVAz.exe
  C:\Windows\System\XRVGVAz.exe
  2⤵
  PID:9136
- C:\Windows\System\vsCRTxX.exe
  C:\Windows\System\vsCRTxX.exe
  2⤵
  PID:9152
- C:\Windows\System\WxSEBfF.exe
  C:\Windows\System\WxSEBfF.exe
  2⤵
  PID:9176
- C:\Windows\System\sGltaXY.exe
  C:\Windows\System\sGltaXY.exe
  2⤵
  PID:9192
- C:\Windows\System\uZRWufs.exe
  C:\Windows\System\uZRWufs.exe
  2⤵
  PID:4484
- C:\Windows\System\yDHSCMu.exe
  C:\Windows\System\yDHSCMu.exe
  2⤵
  PID:7608
- C:\Windows\System\MIxdTxe.exe
  C:\Windows\System\MIxdTxe.exe
  2⤵
  PID:7448
- C:\Windows\System\lWZpaGZ.exe
  C:\Windows\System\lWZpaGZ.exe
  2⤵
  PID:9236
- C:\Windows\System\CTLMdqR.exe
  C:\Windows\System\CTLMdqR.exe
  2⤵
  PID:9260
- C:\Windows\System\PTkJxhV.exe
  C:\Windows\System\PTkJxhV.exe
  2⤵
  PID:9276
- C:\Windows\System\cfVfoKM.exe
  C:\Windows\System\cfVfoKM.exe
  2⤵
  PID:9300
- C:\Windows\System\YoMJNLI.exe
  C:\Windows\System\YoMJNLI.exe
  2⤵
  PID:9324
- C:\Windows\System\QmNgzuG.exe
  C:\Windows\System\QmNgzuG.exe
  2⤵
  PID:9340
- C:\Windows\System\oNLmBRk.exe
  C:\Windows\System\oNLmBRk.exe
  2⤵
  PID:9364
- C:\Windows\System\xosWXhA.exe
  C:\Windows\System\xosWXhA.exe
  2⤵
  PID:9388
- C:\Windows\System\jtYcfPm.exe
  C:\Windows\System\jtYcfPm.exe
  2⤵
  PID:9408
- C:\Windows\System\KxEcpdQ.exe
  C:\Windows\System\KxEcpdQ.exe
  2⤵
  PID:9424
- C:\Windows\System\pGKfBoO.exe
  C:\Windows\System\pGKfBoO.exe
  2⤵
  PID:9452
- C:\Windows\System\MlNbCAu.exe
  C:\Windows\System\MlNbCAu.exe
  2⤵
  PID:9476
- C:\Windows\System\WJPyYeF.exe
  C:\Windows\System\WJPyYeF.exe
  2⤵
  PID:9496
- C:\Windows\System\evzBlpj.exe
  C:\Windows\System\evzBlpj.exe
  2⤵
  PID:9520
- C:\Windows\System\dRKPGTH.exe
  C:\Windows\System\dRKPGTH.exe
  2⤵
  PID:9556
- C:\Windows\System\FhCtyej.exe
  C:\Windows\System\FhCtyej.exe
  2⤵
  PID:9572
- C:\Windows\System\lRlnfPX.exe
  C:\Windows\System\lRlnfPX.exe
  2⤵
  PID:9596
- C:\Windows\System\lwFSapw.exe
  C:\Windows\System\lwFSapw.exe
  2⤵
  PID:9616
- C:\Windows\System\COxkKAy.exe
  C:\Windows\System\COxkKAy.exe
  2⤵
  PID:9636
- C:\Windows\System\bDRilFy.exe
  C:\Windows\System\bDRilFy.exe
  2⤵
  PID:9660
- C:\Windows\System\XsuHNay.exe
  C:\Windows\System\XsuHNay.exe
  2⤵
  PID:9696
- C:\Windows\System\gDxrBXw.exe
  C:\Windows\System\gDxrBXw.exe
  2⤵
  PID:9712
- C:\Windows\System\cDhpuAm.exe
  C:\Windows\System\cDhpuAm.exe
  2⤵
  PID:9736
- C:\Windows\System\wsLJhKk.exe
  C:\Windows\System\wsLJhKk.exe
  2⤵
  PID:9760
- C:\Windows\System\KjsYEJI.exe
  C:\Windows\System\KjsYEJI.exe
  2⤵
  PID:9780
- C:\Windows\System\JiWnwLT.exe
  C:\Windows\System\JiWnwLT.exe
  2⤵
  PID:9804
- C:\Windows\System\CwfoQtN.exe
  C:\Windows\System\CwfoQtN.exe
  2⤵
  PID:9832
- C:\Windows\System\SXQcVpc.exe
  C:\Windows\System\SXQcVpc.exe
  2⤵
  PID:9852
- C:\Windows\System\wNFfzhR.exe
  C:\Windows\System\wNFfzhR.exe
  2⤵
  PID:9872
- C:\Windows\System\MiNwqmm.exe
  C:\Windows\System\MiNwqmm.exe
  2⤵
  PID:9904
- C:\Windows\System\ClfgpZa.exe
  C:\Windows\System\ClfgpZa.exe
  2⤵
  PID:9920
- C:\Windows\System\kUqItvd.exe
  C:\Windows\System\kUqItvd.exe
  2⤵
  PID:9944
- C:\Windows\System\yrBYVVR.exe
  C:\Windows\System\yrBYVVR.exe
  2⤵
  PID:9960
- C:\Windows\System\thMvlXG.exe
  C:\Windows\System\thMvlXG.exe
  2⤵
  PID:9980
- C:\Windows\System\vxQhuhe.exe
  C:\Windows\System\vxQhuhe.exe
  2⤵
  PID:10176
- C:\Windows\System\cYLZsTV.exe
  C:\Windows\System\cYLZsTV.exe
  2⤵
  PID:10192
- C:\Windows\System\KFwjjcZ.exe
  C:\Windows\System\KFwjjcZ.exe
  2⤵
  PID:10208
- C:\Windows\System\WxUAVaV.exe
  C:\Windows\System\WxUAVaV.exe
  2⤵
  PID:10228
- C:\Windows\System\CXQGwvD.exe
  C:\Windows\System\CXQGwvD.exe
  2⤵
  PID:2084
- C:\Windows\System\RVOBMZW.exe
  C:\Windows\System\RVOBMZW.exe
  2⤵
  PID:9160
- C:\Windows\System\rAzfjTB.exe
  C:\Windows\System\rAzfjTB.exe
  2⤵
  PID:9208
- C:\Windows\System\KPFDNoU.exe
  C:\Windows\System\KPFDNoU.exe
  2⤵
  PID:10244
- C:\Windows\System\yWhzTnj.exe
  C:\Windows\System\yWhzTnj.exe
  2⤵
  PID:10260
- C:\Windows\System\PtAEmTn.exe
  C:\Windows\System\PtAEmTn.exe
  2⤵
  PID:10284
- C:\Windows\System\kTejRZy.exe
  C:\Windows\System\kTejRZy.exe
  2⤵
  PID:10304
- C:\Windows\System\fgVNLOo.exe
  C:\Windows\System\fgVNLOo.exe
  2⤵
  PID:10324
- C:\Windows\System\nCHIODU.exe
  C:\Windows\System\nCHIODU.exe
  2⤵
  PID:10348
- C:\Windows\System\ZJddHul.exe
  C:\Windows\System\ZJddHul.exe
  2⤵
  PID:10368
- C:\Windows\System\jWJMqlJ.exe
  C:\Windows\System\jWJMqlJ.exe
  2⤵
  PID:10392
- C:\Windows\System\FcNldTQ.exe
  C:\Windows\System\FcNldTQ.exe
  2⤵
  PID:10408
- C:\Windows\System\kkJpqqf.exe
  C:\Windows\System\kkJpqqf.exe
  2⤵
  PID:10428
- C:\Windows\System\DetIIhL.exe
  C:\Windows\System\DetIIhL.exe
  2⤵
  PID:10452
- C:\Windows\System\jzZwRiI.exe
  C:\Windows\System\jzZwRiI.exe
  2⤵
  PID:10468
- C:\Windows\System\GEPPWHk.exe
  C:\Windows\System\GEPPWHk.exe
  2⤵
  PID:10492
- C:\Windows\System\jubZBhG.exe
  C:\Windows\System\jubZBhG.exe
  2⤵
  PID:10512
- C:\Windows\System\nWCuOSX.exe
  C:\Windows\System\nWCuOSX.exe
  2⤵
  PID:10528
- C:\Windows\System\iGzGHPn.exe
  C:\Windows\System\iGzGHPn.exe
  2⤵
  PID:10544
- C:\Windows\System\tzvFeCl.exe
  C:\Windows\System\tzvFeCl.exe
  2⤵
  PID:10560
- C:\Windows\System\fvEQGrB.exe
  C:\Windows\System\fvEQGrB.exe
  2⤵
  PID:10576
- C:\Windows\System\iFHVqAv.exe
  C:\Windows\System\iFHVqAv.exe
  2⤵
  PID:10592
- C:\Windows\System\gAEAKKf.exe
  C:\Windows\System\gAEAKKf.exe
  2⤵
  PID:10608
- C:\Windows\System\NvOPTmP.exe
  C:\Windows\System\NvOPTmP.exe
  2⤵
  PID:10624
- C:\Windows\System\ktPfXyQ.exe
  C:\Windows\System\ktPfXyQ.exe
  2⤵
  PID:10644
- C:\Windows\System\UrRXdsV.exe
  C:\Windows\System\UrRXdsV.exe
  2⤵
  PID:10660
- C:\Windows\System\iQKNllK.exe
  C:\Windows\System\iQKNllK.exe
  2⤵
  PID:10684
- C:\Windows\System\qULBJeK.exe
  C:\Windows\System\qULBJeK.exe
  2⤵
  PID:10704
- C:\Windows\System\zZeJLBc.exe
  C:\Windows\System\zZeJLBc.exe
  2⤵
  PID:10728
- C:\Windows\System\igFKcGh.exe
  C:\Windows\System\igFKcGh.exe
  2⤵
  PID:10744
- C:\Windows\System\tezGxlJ.exe
  C:\Windows\System\tezGxlJ.exe
  2⤵
  PID:10780
- C:\Windows\System\xBlpuzy.exe
  C:\Windows\System\xBlpuzy.exe
  2⤵
  PID:10800
- C:\Windows\System\tbgpqvA.exe
  C:\Windows\System\tbgpqvA.exe
  2⤵
  PID:10832
- C:\Windows\System\QsdbnfW.exe
  C:\Windows\System\QsdbnfW.exe
  2⤵
  PID:10852
- C:\Windows\System\wLOBGdS.exe
  C:\Windows\System\wLOBGdS.exe
  2⤵
  PID:10868
- C:\Windows\System\SkbxDNw.exe
  C:\Windows\System\SkbxDNw.exe
  2⤵
  PID:10888
- C:\Windows\System\JBXOLWd.exe
  C:\Windows\System\JBXOLWd.exe
  2⤵
  PID:10908
- C:\Windows\System\ioCoqYy.exe
  C:\Windows\System\ioCoqYy.exe
  2⤵
  PID:10932
- C:\Windows\System\QnZaDJy.exe
  C:\Windows\System\QnZaDJy.exe
  2⤵
  PID:10948
- C:\Windows\System\UKuvVpH.exe
  C:\Windows\System\UKuvVpH.exe
  2⤵
  PID:10972
- C:\Windows\System\UMVHbba.exe
  C:\Windows\System\UMVHbba.exe
  2⤵
  PID:10996
- C:\Windows\System\XJPOhqe.exe
  C:\Windows\System\XJPOhqe.exe
  2⤵
  PID:11012
- C:\Windows\System\vNNeOZO.exe
  C:\Windows\System\vNNeOZO.exe
  2⤵
  PID:11036
- C:\Windows\System\dbXTHoF.exe
  C:\Windows\System\dbXTHoF.exe
  2⤵
  PID:11076
- C:\Windows\System\hXxgWSE.exe
  C:\Windows\System\hXxgWSE.exe
  2⤵
  PID:11100
- C:\Windows\System\Gegrpns.exe
  C:\Windows\System\Gegrpns.exe
  2⤵
  PID:11128
- C:\Windows\System\jrSDWRi.exe
  C:\Windows\System\jrSDWRi.exe
  2⤵
  PID:11148
- C:\Windows\System\qEYHzSW.exe
  C:\Windows\System\qEYHzSW.exe
  2⤵
  PID:11172
- C:\Windows\System\NStukDa.exe
  C:\Windows\System\NStukDa.exe
  2⤵
  PID:11188
- C:\Windows\System\zHcUhJU.exe
  C:\Windows\System\zHcUhJU.exe
  2⤵
  PID:11212
- C:\Windows\System\ZUyxMeG.exe
  C:\Windows\System\ZUyxMeG.exe
  2⤵
  PID:11236
- C:\Windows\System\BMvxkmY.exe
  C:\Windows\System\BMvxkmY.exe
  2⤵
  PID:11252
- C:\Windows\System\FrcaDxz.exe
  C:\Windows\System\FrcaDxz.exe
  2⤵
  PID:9268
- C:\Windows\System\UfYfUal.exe
  C:\Windows\System\UfYfUal.exe
  2⤵
  PID:9380
- C:\Windows\System\tetyAHa.exe
  C:\Windows\System\tetyAHa.exe
  2⤵
  PID:9508
- C:\Windows\System\oAHbSZY.exe
  C:\Windows\System\oAHbSZY.exe
  2⤵
  PID:9644
- C:\Windows\System\QLjJiSJ.exe
  C:\Windows\System\QLjJiSJ.exe
  2⤵
  PID:9728
- C:\Windows\System\TrhhbTV.exe
  C:\Windows\System\TrhhbTV.exe
  2⤵
  PID:9936
- C:\Windows\System\PLBIZbI.exe
  C:\Windows\System\PLBIZbI.exe
  2⤵
  PID:7904
- C:\Windows\System\tUiVZCZ.exe
  C:\Windows\System\tUiVZCZ.exe
  2⤵
  PID:7948
- C:\Windows\System\LZjKOgv.exe
  C:\Windows\System\LZjKOgv.exe
  2⤵
  PID:11268
- C:\Windows\System\RPGrVMP.exe
  C:\Windows\System\RPGrVMP.exe
  2⤵
  PID:11288
- C:\Windows\System\inCzziW.exe
  C:\Windows\System\inCzziW.exe
  2⤵
  PID:11308
- C:\Windows\System\XNoBZdL.exe
  C:\Windows\System\XNoBZdL.exe
  2⤵
  PID:11332
- C:\Windows\System\NxzzLRC.exe
  C:\Windows\System\NxzzLRC.exe
  2⤵
  PID:11400
- C:\Windows\System\oHRnGGa.exe
  C:\Windows\System\oHRnGGa.exe
  2⤵
  PID:11424
- C:\Windows\System\KVnttZc.exe
  C:\Windows\System\KVnttZc.exe
  2⤵
  PID:11440
- C:\Windows\System\QHOjrRp.exe
  C:\Windows\System\QHOjrRp.exe
  2⤵
  PID:11464
- C:\Windows\System\URxJUOq.exe
  C:\Windows\System\URxJUOq.exe
  2⤵
  PID:11488
- C:\Windows\System\DALTlXS.exe
  C:\Windows\System\DALTlXS.exe
  2⤵
  PID:11512
- C:\Windows\System\CUBQKcl.exe
  C:\Windows\System\CUBQKcl.exe
  2⤵
  PID:11532
- C:\Windows\System\yihVhKv.exe
  C:\Windows\System\yihVhKv.exe
  2⤵
  PID:11548
- C:\Windows\System\VKuQLtx.exe
  C:\Windows\System\VKuQLtx.exe
  2⤵
  PID:11572
- C:\Windows\System\NlMICTw.exe
  C:\Windows\System\NlMICTw.exe
  2⤵
  PID:11592
- C:\Windows\System\VPpPWxZ.exe
  C:\Windows\System\VPpPWxZ.exe
  2⤵
  PID:11616
- C:\Windows\System\xhjOAkL.exe
  C:\Windows\System\xhjOAkL.exe
  2⤵
  PID:11636
- C:\Windows\System\orpCXrI.exe
  C:\Windows\System\orpCXrI.exe
  2⤵
  PID:11656
- C:\Windows\System\wewZAZu.exe
  C:\Windows\System\wewZAZu.exe
  2⤵
  PID:11680
- C:\Windows\System\lCUyWmc.exe
  C:\Windows\System\lCUyWmc.exe
  2⤵
  PID:11700
- C:\Windows\System\bmijNIf.exe
  C:\Windows\System\bmijNIf.exe
  2⤵
  PID:11716
- C:\Windows\System\OhkgeUG.exe
  C:\Windows\System\OhkgeUG.exe
  2⤵
  PID:11740
- C:\Windows\System\nkQSDfm.exe
  C:\Windows\System\nkQSDfm.exe
  2⤵
  PID:11764
- C:\Windows\System\rqfsdRQ.exe
  C:\Windows\System\rqfsdRQ.exe
  2⤵
  PID:11780
- C:\Windows\System\ztXTqfW.exe
  C:\Windows\System\ztXTqfW.exe
  2⤵
  PID:11796
- C:\Windows\System\MfMtnYT.exe
  C:\Windows\System\MfMtnYT.exe
  2⤵
  PID:11812
- C:\Windows\System\NwRtPdm.exe
  C:\Windows\System\NwRtPdm.exe
  2⤵
  PID:11832
- C:\Windows\System\uThBhcW.exe
  C:\Windows\System\uThBhcW.exe
  2⤵
  PID:11852
- C:\Windows\System\esOLRJJ.exe
  C:\Windows\System\esOLRJJ.exe
  2⤵
  PID:11868
- C:\Windows\System\RtQDGxQ.exe
  C:\Windows\System\RtQDGxQ.exe
  2⤵
  PID:11884
- C:\Windows\System\tyTqnRd.exe
  C:\Windows\System\tyTqnRd.exe
  2⤵
  PID:11908
- C:\Windows\System\HRzFaKt.exe
  C:\Windows\System\HRzFaKt.exe
  2⤵
  PID:11924
- C:\Windows\System\zWdIDcj.exe
  C:\Windows\System\zWdIDcj.exe
  2⤵
  PID:11948
- C:\Windows\System\IwGstvD.exe
  C:\Windows\System\IwGstvD.exe
  2⤵
  PID:11972
- C:\Windows\System\WcEQSeo.exe
  C:\Windows\System\WcEQSeo.exe
  2⤵
  PID:11988
- C:\Windows\System\YUkpNAu.exe
  C:\Windows\System\YUkpNAu.exe
  2⤵
  PID:12012
- C:\Windows\System\xmNjycg.exe
  C:\Windows\System\xmNjycg.exe
  2⤵
  PID:12036
- C:\Windows\System\CkVoTBu.exe
  C:\Windows\System\CkVoTBu.exe
  2⤵
  PID:12052
- C:\Windows\System\rMVyyTV.exe
  C:\Windows\System\rMVyyTV.exe
  2⤵
  PID:12076
- C:\Windows\System\RUgZavY.exe
  C:\Windows\System\RUgZavY.exe
  2⤵
  PID:12100
- C:\Windows\System\CzPdYPZ.exe
  C:\Windows\System\CzPdYPZ.exe
  2⤵
  PID:12124
- C:\Windows\System\zguMAaI.exe
  C:\Windows\System\zguMAaI.exe
  2⤵
  PID:12140
- C:\Windows\System\ciUgUVc.exe
  C:\Windows\System\ciUgUVc.exe
  2⤵
  PID:12164
- C:\Windows\System\KSCkKgv.exe
  C:\Windows\System\KSCkKgv.exe
  2⤵
  PID:12184
- C:\Windows\System\VIMyVyQ.exe
  C:\Windows\System\VIMyVyQ.exe
  2⤵
  PID:12204
- C:\Windows\System\tyFTJko.exe
  C:\Windows\System\tyFTJko.exe
  2⤵
  PID:12228
- C:\Windows\System\WlpTnJc.exe
  C:\Windows\System\WlpTnJc.exe
  2⤵
  PID:12252
- C:\Windows\System\UUMRiQi.exe
  C:\Windows\System\UUMRiQi.exe
  2⤵
  PID:12268
- C:\Windows\System\djaWzVa.exe
  C:\Windows\System\djaWzVa.exe
  2⤵
  PID:8012
- C:\Windows\System\CoGadjH.exe
  C:\Windows\System\CoGadjH.exe
  2⤵
  PID:8048
- C:\Windows\System\zfXgyht.exe
  C:\Windows\System\zfXgyht.exe
  2⤵
  PID:8096
- C:\Windows\System\zHgIryi.exe
  C:\Windows\System\zHgIryi.exe
  2⤵
  PID:8140
- C:\Windows\System\yKLLeym.exe
  C:\Windows\System\yKLLeym.exe
  2⤵
  PID:8176
- C:\Windows\System\WMsOYKd.exe
  C:\Windows\System\WMsOYKd.exe
  2⤵
  PID:5408
- C:\Windows\System\wbPQIWU.exe
  C:\Windows\System\wbPQIWU.exe
  2⤵
  PID:5716
- C:\Windows\System\UbgdoTC.exe
  C:\Windows\System\UbgdoTC.exe
  2⤵
  PID:6072
- C:\Windows\System\arvxsQm.exe
  C:\Windows\System\arvxsQm.exe
  2⤵
  PID:5088
- C:\Windows\System\YoUGIPp.exe
  C:\Windows\System\YoUGIPp.exe
  2⤵
  PID:64
- C:\Windows\System\tyXRsgv.exe
  C:\Windows\System\tyXRsgv.exe
  2⤵
  PID:6184
- C:\Windows\System\DnzsAEv.exe
  C:\Windows\System\DnzsAEv.exe
  2⤵
  PID:6312
- C:\Windows\System\zgKdGth.exe
  C:\Windows\System\zgKdGth.exe
  2⤵
  PID:6484
- C:\Windows\System\UdsCSHa.exe
  C:\Windows\System\UdsCSHa.exe
  2⤵
  PID:6564
- C:\Windows\System\qbODUyt.exe
  C:\Windows\System\qbODUyt.exe
  2⤵
  PID:6664
- C:\Windows\System\DRasmeE.exe
  C:\Windows\System\DRasmeE.exe
  2⤵
  PID:6780
- C:\Windows\System\rEtVpIE.exe
  C:\Windows\System\rEtVpIE.exe
  2⤵
  PID:6848
- C:\Windows\System\RqIBWJw.exe
  C:\Windows\System\RqIBWJw.exe
  2⤵
  PID:2780
- C:\Windows\System\dUugXDU.exe
  C:\Windows\System\dUugXDU.exe
  2⤵
  PID:7440
- C:\Windows\System\jemVyvT.exe
  C:\Windows\System\jemVyvT.exe
  2⤵
  PID:4744
- C:\Windows\System\vHcuhRC.exe
  C:\Windows\System\vHcuhRC.exe
  2⤵
  PID:1036
- C:\Windows\System\LOSLTLv.exe
  C:\Windows\System\LOSLTLv.exe
  2⤵
  PID:5156
- C:\Windows\System\gFVPOqa.exe
  C:\Windows\System\gFVPOqa.exe
  2⤵
  PID:6460
- C:\Windows\System\AlELDsl.exe
  C:\Windows\System\AlELDsl.exe
  2⤵
  PID:7340
- C:\Windows\System\feqKjAR.exe
  C:\Windows\System\feqKjAR.exe
  2⤵
  PID:7496
- C:\Windows\System\IBzhlMB.exe
  C:\Windows\System\IBzhlMB.exe
  2⤵
  PID:7692
- C:\Windows\System\ZxnVKwj.exe
  C:\Windows\System\ZxnVKwj.exe
  2⤵
  PID:8256
- C:\Windows\System\tFPfjxt.exe
  C:\Windows\System\tFPfjxt.exe
  2⤵
  PID:7072
- C:\Windows\System\hTWdkvg.exe
  C:\Windows\System\hTWdkvg.exe
  2⤵
  PID:7104
- C:\Windows\System\SNafRZn.exe
  C:\Windows\System\SNafRZn.exe
  2⤵
  PID:10172
- C:\Windows\System\biCMgjP.exe
  C:\Windows\System\biCMgjP.exe
  2⤵
  PID:12304
- C:\Windows\System\ObkSuWm.exe
  C:\Windows\System\ObkSuWm.exe
  2⤵
  PID:12320
- C:\Windows\System\ekgJiwV.exe
  C:\Windows\System\ekgJiwV.exe
  2⤵
  PID:12336
- C:\Windows\System\FqYMEDZ.exe
  C:\Windows\System\FqYMEDZ.exe
  2⤵
  PID:12356
- C:\Windows\System\VFPmueY.exe
  C:\Windows\System\VFPmueY.exe
  2⤵
  PID:12376
- C:\Windows\System\dOhiehc.exe
  C:\Windows\System\dOhiehc.exe
  2⤵
  PID:12392
- C:\Windows\System\gKhHcXY.exe
  C:\Windows\System\gKhHcXY.exe
  2⤵
  PID:12408
- C:\Windows\System\wSdmoUP.exe
  C:\Windows\System\wSdmoUP.exe
  2⤵
  PID:12560
- C:\Windows\System\YeAPjIA.exe
  C:\Windows\System\YeAPjIA.exe
  2⤵
  PID:12576
- C:\Windows\System\HUrSAGQ.exe
  C:\Windows\System\HUrSAGQ.exe
  2⤵
  PID:12592
- C:\Windows\System\zhSluKw.exe
  C:\Windows\System\zhSluKw.exe
  2⤵
  PID:12612
- C:\Windows\System\uYPUMbV.exe
  C:\Windows\System\uYPUMbV.exe
  2⤵
  PID:12632
- C:\Windows\System\ECLWGbM.exe
  C:\Windows\System\ECLWGbM.exe
  2⤵
  PID:12664
- C:\Windows\System\oabPjwe.exe
  C:\Windows\System\oabPjwe.exe
  2⤵
  PID:12680
- C:\Windows\System\bEGDdZQ.exe
  C:\Windows\System\bEGDdZQ.exe
  2⤵
  PID:12704
- C:\Windows\System\pDQkeNe.exe
  C:\Windows\System\pDQkeNe.exe
  2⤵
  PID:12724
- C:\Windows\System\iWjbjJg.exe
  C:\Windows\System\iWjbjJg.exe
  2⤵
  PID:12744
- C:\Windows\System\exklkzH.exe
  C:\Windows\System\exklkzH.exe
  2⤵
  PID:12760
- C:\Windows\System\OcdJdFc.exe
  C:\Windows\System\OcdJdFc.exe
  2⤵
  PID:12788
- C:\Windows\System\OocUBPm.exe
  C:\Windows\System\OocUBPm.exe
  2⤵
  PID:12804
- C:\Windows\System\GHklxDZ.exe
  C:\Windows\System\GHklxDZ.exe
  2⤵
  PID:12832
- C:\Windows\System\sHHiMvb.exe
  C:\Windows\System\sHHiMvb.exe
  2⤵
  PID:12852
- C:\Windows\System\QmNnDXV.exe
  C:\Windows\System\QmNnDXV.exe
  2⤵
  PID:12868
- C:\Windows\System\dgfuKMm.exe
  C:\Windows\System\dgfuKMm.exe
  2⤵
  PID:12888
- C:\Windows\System\TwyCYOH.exe
  C:\Windows\System\TwyCYOH.exe
  2⤵
  PID:12908
- C:\Windows\System\YAqQDqo.exe
  C:\Windows\System\YAqQDqo.exe
  2⤵
  PID:12928
- C:\Windows\System\EAOOUgG.exe
  C:\Windows\System\EAOOUgG.exe
  2⤵
  PID:12948
- C:\Windows\System\FEvqTlX.exe
  C:\Windows\System\FEvqTlX.exe
  2⤵
  PID:12972
- C:\Windows\System\MyxxXyo.exe
  C:\Windows\System\MyxxXyo.exe
  2⤵
  PID:12992
- C:\Windows\System\WRYgwxJ.exe
  C:\Windows\System\WRYgwxJ.exe
  2⤵
  PID:13016
- C:\Windows\System\OMmcSvk.exe
  C:\Windows\System\OMmcSvk.exe
  2⤵
  PID:13036
- C:\Windows\System\Oapugib.exe
  C:\Windows\System\Oapugib.exe
  2⤵
  PID:13060
- C:\Windows\System\WOyPkjb.exe
  C:\Windows\System\WOyPkjb.exe
  2⤵
  PID:13080
- C:\Windows\System\VJMDfjh.exe
  C:\Windows\System\VJMDfjh.exe
  2⤵
  PID:13112
- C:\Windows\System\jQgOfIe.exe
  C:\Windows\System\jQgOfIe.exe
  2⤵
  PID:13128
- C:\Windows\System\vJWdcKe.exe
  C:\Windows\System\vJWdcKe.exe
  2⤵
  PID:13144
- C:\Windows\System\rLGJkMs.exe
  C:\Windows\System\rLGJkMs.exe
  2⤵
  PID:13164
- C:\Windows\System\OXMzqaG.exe
  C:\Windows\System\OXMzqaG.exe
  2⤵
  PID:13188
- C:\Windows\System\uwGXPqM.exe
  C:\Windows\System\uwGXPqM.exe
  2⤵
  PID:13204
- C:\Windows\System\hcoWZSN.exe
  C:\Windows\System\hcoWZSN.exe
  2⤵
  PID:13220
- C:\Windows\System\logaidJ.exe
  C:\Windows\System\logaidJ.exe
  2⤵
  PID:13276
- C:\Windows\System\JlbImdZ.exe
  C:\Windows\System\JlbImdZ.exe
  2⤵
  PID:13300
- C:\Windows\System\wCAHHdA.exe
  C:\Windows\System\wCAHHdA.exe
  2⤵
  PID:10216
- C:\Windows\System\lNSLFkz.exe
  C:\Windows\System\lNSLFkz.exe
  2⤵
  PID:9148
- C:\Windows\System\lLDHFCg.exe
  C:\Windows\System\lLDHFCg.exe
  2⤵
  PID:9220
- C:\Windows\System\mIPnMgF.exe
  C:\Windows\System\mIPnMgF.exe
  2⤵
  PID:9336
- C:\Windows\System\NXwnUpv.exe
  C:\Windows\System\NXwnUpv.exe
  2⤵
  PID:10320
- C:\Windows\System\DxxSGhV.exe
  C:\Windows\System\DxxSGhV.exe
  2⤵
  PID:10344
- C:\Windows\System\uPVrUDM.exe
  C:\Windows\System\uPVrUDM.exe
  2⤵
  PID:10700
- C:\Windows\System\eibgExK.exe
  C:\Windows\System\eibgExK.exe
  2⤵
  PID:9788
- C:\Windows\System\ytGfNcH.exe
  C:\Windows\System\ytGfNcH.exe
  2⤵
  PID:8284
- C:\Windows\System\MofiMBt.exe
  C:\Windows\System\MofiMBt.exe
  2⤵
  PID:10964
- C:\Windows\System\JUKCjiy.exe
  C:\Windows\System\JUKCjiy.exe
  2⤵
  PID:11004
- C:\Windows\System\lJcglrV.exe
  C:\Windows\System\lJcglrV.exe
  2⤵
  PID:11032
- C:\Windows\System\hBwnXWc.exe
  C:\Windows\System\hBwnXWc.exe
  2⤵
  PID:4544
- C:\Windows\System\wsuvYiW.exe
  C:\Windows\System\wsuvYiW.exe
  2⤵
  PID:11140
- C:\Windows\System\RgsMKcP.exe
  C:\Windows\System\RgsMKcP.exe
  2⤵
  PID:9460
- C:\Windows\System\RYcZnTw.exe
  C:\Windows\System\RYcZnTw.exe
  2⤵
  PID:7888
- C:\Windows\System\YrcunbO.exe
  C:\Windows\System\YrcunbO.exe
  2⤵
  PID:11296
- C:\Windows\System\JZorAFF.exe
  C:\Windows\System\JZorAFF.exe
  2⤵
  PID:11324
- C:\Windows\System\blnHzlP.exe
  C:\Windows\System\blnHzlP.exe
  2⤵
  PID:8480
- C:\Windows\System\FbmvKSk.exe
  C:\Windows\System\FbmvKSk.exe
  2⤵
  PID:8496
- C:\Windows\System\HbCZsFf.exe
  C:\Windows\System\HbCZsFf.exe
  2⤵
  PID:8512
- C:\Windows\System\yvauFhE.exe
  C:\Windows\System\yvauFhE.exe
  2⤵
  PID:8552
- C:\Windows\System\urmGMKW.exe
  C:\Windows\System\urmGMKW.exe
  2⤵
  PID:8596
- C:\Windows\System\uKRsAze.exe
  C:\Windows\System\uKRsAze.exe
  2⤵
  PID:8628
- C:\Windows\System\YjvqTjc.exe
  C:\Windows\System\YjvqTjc.exe
  2⤵
  PID:8716
- C:\Windows\System\EaQocOD.exe
  C:\Windows\System\EaQocOD.exe
  2⤵
  PID:8720
- C:\Windows\System\lbudHNu.exe
  C:\Windows\System\lbudHNu.exe
  2⤵
  PID:11624
- C:\Windows\System\ZefMFnt.exe
  C:\Windows\System\ZefMFnt.exe
  2⤵
  PID:11788
- C:\Windows\System\iBxMHqH.exe
  C:\Windows\System\iBxMHqH.exe
  2⤵
  PID:6644
- C:\Windows\System\HkfFyVw.exe
  C:\Windows\System\HkfFyVw.exe
  2⤵
  PID:7336
- C:\Windows\System\tElDEiI.exe
  C:\Windows\System\tElDEiI.exe
  2⤵
  PID:6696
- C:\Windows\System\UvgOAgZ.exe
  C:\Windows\System\UvgOAgZ.exe
  2⤵
  PID:5284
- C:\Windows\System\tGrnEwF.exe
  C:\Windows\System\tGrnEwF.exe
  2⤵
  PID:11828
- C:\Windows\System\FUYzOTK.exe
  C:\Windows\System\FUYzOTK.exe
  2⤵
  PID:9044
- C:\Windows\System\aJbzBrM.exe
  C:\Windows\System\aJbzBrM.exe
  2⤵
  PID:8984
- C:\Windows\System\bFBdDiX.exe
  C:\Windows\System\bFBdDiX.exe
  2⤵
  PID:8908
- C:\Windows\System\AFxuvCF.exe
  C:\Windows\System\AFxuvCF.exe
  2⤵
  PID:8860
- C:\Windows\System\eZVeQhv.exe
  C:\Windows\System\eZVeQhv.exe
  2⤵
  PID:8824
- C:\Windows\System\CiMlZFB.exe
  C:\Windows\System\CiMlZFB.exe
  2⤵
  PID:8728
- C:\Windows\System\uSlLLSF.exe
  C:\Windows\System\uSlLLSF.exe
  2⤵
  PID:8612
- C:\Windows\System\gCouHHX.exe
  C:\Windows\System\gCouHHX.exe
  2⤵
  PID:8492
- C:\Windows\System\djQvdOS.exe
  C:\Windows\System\djQvdOS.exe
  2⤵
  PID:11316
- C:\Windows\System\sNTJxAX.exe
  C:\Windows\System\sNTJxAX.exe
  2⤵
  PID:11180
- C:\Windows\System\mDFwoeL.exe
  C:\Windows\System\mDFwoeL.exe
  2⤵
  PID:11028
- C:\Windows\System\HokqWiQ.exe
  C:\Windows\System\HokqWiQ.exe
  2⤵
  PID:9880
- C:\Windows\System\icVGzot.exe
  C:\Windows\System\icVGzot.exe
  2⤵
  PID:9568
- C:\Windows\System\nqGxfuR.exe
  C:\Windows\System\nqGxfuR.exe
  2⤵
  PID:9284
- C:\Windows\System\PHIotwf.exe
  C:\Windows\System\PHIotwf.exe
  2⤵
  PID:1676
- C:\Windows\System\pdOBPMk.exe
  C:\Windows\System\pdOBPMk.exe
  2⤵
  PID:13268
- C:\Windows\System\Ahteztf.exe
  C:\Windows\System\Ahteztf.exe
  2⤵
  PID:13228
- C:\Windows\System\UgAKYoP.exe
  C:\Windows\System\UgAKYoP.exe
  2⤵
  PID:13176
- C:\Windows\System\KlWlipd.exe
  C:\Windows\System\KlWlipd.exe
  2⤵
  PID:13140
- C:\Windows\System\NuyywBn.exe
  C:\Windows\System\NuyywBn.exe
  2⤵
  PID:13100
- C:\Windows\System\HaLmyRw.exe
  C:\Windows\System\HaLmyRw.exe
  2⤵
  PID:13044
- C:\Windows\System\dgMBogJ.exe
  C:\Windows\System\dgMBogJ.exe
  2⤵
  PID:12988
- C:\Windows\System\QgqtOhr.exe
  C:\Windows\System\QgqtOhr.exe
  2⤵
  PID:12944
- C:\Windows\System\DVWluJc.exe
  C:\Windows\System\DVWluJc.exe
  2⤵
  PID:12900
- C:\Windows\System\oVCTUHT.exe
  C:\Windows\System\oVCTUHT.exe
  2⤵
  PID:12844
- C:\Windows\System\rFWYGuY.exe
  C:\Windows\System\rFWYGuY.exe
  2⤵
  PID:12800
- C:\Windows\System\ukUScOD.exe
  C:\Windows\System\ukUScOD.exe
  2⤵
  PID:12752
- C:\Windows\System\giOTjVH.exe
  C:\Windows\System\giOTjVH.exe
  2⤵
  PID:12696
- C:\Windows\System\HgrhzvP.exe
  C:\Windows\System\HgrhzvP.exe
  2⤵
  PID:12648
- C:\Windows\System\CkjWfaX.exe
  C:\Windows\System\CkjWfaX.exe
  2⤵
  PID:12604
- C:\Windows\System\hWclnOA.exe
  C:\Windows\System\hWclnOA.exe
  2⤵
  PID:3244
- C:\Windows\System\MqhZIni.exe
  C:\Windows\System\MqhZIni.exe
  2⤵
  PID:432
- C:\Windows\System\OkkQooZ.exe
  C:\Windows\System\OkkQooZ.exe
  2⤵
  PID:3800
- C:\Windows\System\EOOaXSm.exe
  C:\Windows\System\EOOaXSm.exe
  2⤵
  PID:12296
- C:\Windows\System\ihLZZfN.exe
  C:\Windows\System\ihLZZfN.exe
  2⤵
  PID:10864
- C:\Windows\System\wdqLxcy.exe
  C:\Windows\System\wdqLxcy.exe
  2⤵
  PID:9708
- C:\Windows\System\vgteGvm.exe
  C:\Windows\System\vgteGvm.exe
  2⤵
  PID:8688
- C:\Windows\System\UGBKoBR.exe
  C:\Windows\System\UGBKoBR.exe
  2⤵
  PID:11124
- C:\Windows\System\NbWJuiX.exe
  C:\Windows\System\NbWJuiX.exe
  2⤵
  PID:11244
- C:\Windows\System\dAAElOo.exe
  C:\Windows\System\dAAElOo.exe
  2⤵
  PID:13440
- C:\Windows\System\sIYNKcB.exe
  C:\Windows\System\sIYNKcB.exe
  2⤵
  PID:9184
- C:\Windows\System\UxAcOPV.exe
  C:\Windows\System\UxAcOPV.exe
  2⤵
  PID:10380
- C:\Windows\System\CRZgToO.exe
  C:\Windows\System\CRZgToO.exe
  2⤵
  PID:11564
- C:\Windows\System\DulZmzU.exe
  C:\Windows\System\DulZmzU.exe
  2⤵
  PID:13380
- C:\Windows\System\xZQWUxL.exe
  C:\Windows\System\xZQWUxL.exe
  2⤵
  PID:13360
- C:\Windows\System\yqGSwKp.exe
  C:\Windows\System\yqGSwKp.exe
  2⤵
  PID:13420
- C:\Windows\System\qrRlssf.exe
  C:\Windows\System\qrRlssf.exe
  2⤵
  PID:10692
- C:\Windows\System\faKGoXB.exe
  C:\Windows\System\faKGoXB.exe
  2⤵
  PID:8864
- C:\Windows\System\UMOHTWe.exe
  C:\Windows\System\UMOHTWe.exe
  2⤵
  PID:8732
- C:\Windows\System\iTJaGwk.exe
  C:\Windows\System\iTJaGwk.exe
  2⤵
  PID:14004
- C:\Windows\System\dROlcFx.exe
  C:\Windows\System\dROlcFx.exe
  2⤵
  PID:13052
- C:\Windows\System\WdmKJil.exe
  C:\Windows\System\WdmKJil.exe
  2⤵
  PID:12960
- C:\Windows\System\mWzXBgO.exe
  C:\Windows\System\mWzXBgO.exe
  2⤵
  PID:12672
- C:\Windows\System\LzxGdXA.exe
  C:\Windows\System\LzxGdXA.exe
  2⤵
  PID:9772
- C:\Windows\System\hRPkRrA.exe
  C:\Windows\System\hRPkRrA.exe
  2⤵
  PID:9932
- C:\Windows\System\QystfnT.exe
  C:\Windows\System\QystfnT.exe
  2⤵
  PID:8692
- C:\Windows\System\bzbcHCd.exe
  C:\Windows\System\bzbcHCd.exe
  2⤵
  PID:9004
- C:\Windows\System\WtKGMRY.exe
  C:\Windows\System\WtKGMRY.exe
  2⤵
  PID:13800
- C:\Windows\System\ysFbGer.exe
  C:\Windows\System\ysFbGer.exe
  2⤵
  PID:14012
- C:\Windows\System\dmMUbCe.exe
  C:\Windows\System\dmMUbCe.exe
  2⤵
  PID:13616
- C:\Windows\System\IyYeohe.exe
  C:\Windows\System\IyYeohe.exe
  2⤵
  PID:13832
- C:\Windows\System\giluhkK.exe
  C:\Windows\System\giluhkK.exe
  2⤵
  PID:13876
- C:\Windows\System\gRWwyJG.exe
  C:\Windows\System\gRWwyJG.exe
  2⤵
  PID:13952
- C:\Windows\System\lbqQilk.exe
  C:\Windows\System\lbqQilk.exe
  2⤵
  PID:13848
- C:\Windows\System\WmWPwai.exe
  C:\Windows\System\WmWPwai.exe
  2⤵
  PID:14144
- C:\Windows\System\ifgzMXf.exe
  C:\Windows\System\ifgzMXf.exe
  2⤵
  PID:10928
- C:\Windows\System\LCjEJSH.exe
  C:\Windows\System\LCjEJSH.exe
  2⤵
  PID:12572
- C:\Windows\System\UuGGHtr.exe
  C:\Windows\System\UuGGHtr.exe
  2⤵
  PID:12044
- C:\Windows\System\YSDHATJ.exe
  C:\Windows\System\YSDHATJ.exe
  2⤵
  PID:14024
- C:\Windows\System\vgTTKOn.exe
  C:\Windows\System\vgTTKOn.exe
  2⤵
  PID:3636
- C:\Windows\System\lQyvaAY.exe
  C:\Windows\System\lQyvaAY.exe
  2⤵
  PID:14248
- C:\Windows\System\gSEBgyQ.exe
  C:\Windows\System\gSEBgyQ.exe
  2⤵
  PID:14200
- C:\Windows\System\XloZBuf.exe
  C:\Windows\System\XloZBuf.exe
  2⤵
  PID:14168
- C:\Windows\System\gikpFYF.exe
  C:\Windows\System\gikpFYF.exe
  2⤵
  PID:368
- C:\Windows\System\iaWjGcm.exe
  C:\Windows\System\iaWjGcm.exe
  2⤵
  PID:13792
- C:\Windows\System\rNhuDCI.exe
  C:\Windows\System\rNhuDCI.exe
  2⤵
  PID:13568
- C:\Windows\System\VQsFdix.exe
  C:\Windows\System\VQsFdix.exe
  2⤵
  PID:13456
- C:\Windows\System\ipziqgO.exe
  C:\Windows\System\ipziqgO.exe
  2⤵
  PID:12824
- C:\Windows\System\UCpSIKm.exe
  C:\Windows\System\UCpSIKm.exe
  2⤵
  PID:14104
- C:\Windows\System\KtutUVG.exe
  C:\Windows\System\KtutUVG.exe
  2⤵
  PID:12388
- C:\Windows\System\zojkWxO.exe
  C:\Windows\System\zojkWxO.exe
  2⤵
  PID:13396
- C:\Windows\System\XbEcpsF.exe
  C:\Windows\System\XbEcpsF.exe
  2⤵
  PID:5008
- C:\Windows\System\UwjKChl.exe
  C:\Windows\System\UwjKChl.exe
  2⤵
  PID:5084
- C:\Windows\System\ahVUwNg.exe
  C:\Windows\System\ahVUwNg.exe
  2⤵
  PID:8208
- C:\Windows\System\tDmzwKp.exe
  C:\Windows\System\tDmzwKp.exe
  2⤵
  PID:13152
- C:\Windows\System\XZBKWEZ.exe
  C:\Windows\System\XZBKWEZ.exe
  2⤵
  PID:13008
- C:\Windows\System\orMOquP.exe
  C:\Windows\System\orMOquP.exe
  2⤵
  PID:13656
- C:\Windows\System\dSwEEWf.exe
  C:\Windows\System\dSwEEWf.exe
  2⤵
  PID:13336
- C:\Windows\System\sAKwvNQ.exe
  C:\Windows\System\sAKwvNQ.exe
  2⤵
  PID:13348
- C:\Windows\System\wLmyAng.exe
  C:\Windows\System\wLmyAng.exe
  2⤵
  PID:13908
- C:\Windows\System\dyPEhhM.exe
  C:\Windows\System\dyPEhhM.exe
  2⤵
  PID:13760
- C:\Windows\System\eUFxsSt.exe
  C:\Windows\System\eUFxsSt.exe
  2⤵
  PID:13584
- C:\Windows\System\sfDWmqB.exe
  C:\Windows\System\sfDWmqB.exe
  2⤵
  PID:13840
- C:\Windows\System\bVnXXgG.exe
  C:\Windows\System\bVnXXgG.exe
  2⤵
  PID:1408
- C:\Windows\System\JpEzPCQ.exe
  C:\Windows\System\JpEzPCQ.exe
  2⤵
  PID:4012
- C:\Windows\System\IiiKtqy.exe
  C:\Windows\System\IiiKtqy.exe
  2⤵
  PID:14220
- C:\Windows\System\BwPJmko.exe
  C:\Windows\System\BwPJmko.exe
  2⤵
  PID:8624
- C:\Windows\System\XQjndnI.exe
  C:\Windows\System\XQjndnI.exe
  2⤵
  PID:13196
- C:\Windows\System\xgvChVA.exe
  C:\Windows\System\xgvChVA.exe
  2⤵
  PID:4072
- C:\Windows\System\amdZOVW.exe
  C:\Windows\System\amdZOVW.exe
  2⤵
  PID:3024
- C:\Windows\System\HZPfAHG.exe
  C:\Windows\System\HZPfAHG.exe
  2⤵
  PID:8868
- C:\Windows\System\yMdcuVH.exe
  C:\Windows\System\yMdcuVH.exe
  2⤵
  PID:8080
- C:\Windows\System\iguTDda.exe
  C:\Windows\System\iguTDda.exe
  2⤵
  PID:10524
- C:\Windows\System\CKyUDsa.exe
  C:\Windows\System\CKyUDsa.exe
  2⤵
  PID:13632
- C:\Windows\System\fqNOvBF.exe
  C:\Windows\System\fqNOvBF.exe
  2⤵
  PID:12328
- C:\Windows\System\JTAiLqh.exe
  C:\Windows\System\JTAiLqh.exe
  2⤵
  PID:13976
- C:\Windows\System\xOBwBDb.exe
  C:\Windows\System\xOBwBDb.exe
  2⤵
  PID:12776
- C:\Windows\System\SZwoULu.exe
  C:\Windows\System\SZwoULu.exe
  2⤵
  PID:9444
- C:\Windows\System\QZOWsVc.exe
  C:\Windows\System\QZOWsVc.exe
  2⤵
  PID:9352
- C:\Windows\System\jhTvFNQ.exe
  C:\Windows\System\jhTvFNQ.exe
  2⤵
  PID:12688
- C:\Windows\System\LHkjIir.exe
  C:\Windows\System\LHkjIir.exe
  2⤵
  PID:12476
- C:\Windows\System\gaawvDw.exe
  C:\Windows\System\gaawvDw.exe
  2⤵
  PID:13528
- C:\Windows\System\SDneLcY.exe
  C:\Windows\System\SDneLcY.exe
  2⤵
  PID:9604
- C:\Windows\System\eyOhpOx.exe
  C:\Windows\System\eyOhpOx.exe
  2⤵
  PID:14008
- C:\Windows\System\JcAhRlR.exe
  C:\Windows\System\JcAhRlR.exe
  2⤵
  PID:13868
- C:\Windows\System\OvkqLdv.exe
  C:\Windows\System\OvkqLdv.exe
  2⤵
  PID:13748
- C:\Windows\System\pRCfxtM.exe
  C:\Windows\System\pRCfxtM.exe
  2⤵
  PID:13896
- C:\Windows\System\kaYkxtp.exe
  C:\Windows\System\kaYkxtp.exe
  2⤵
  PID:732
- C:\Windows\System\vEVEhzR.exe
  C:\Windows\System\vEVEhzR.exe
  2⤵
  PID:14192
- C:\Windows\System\AkgZbMa.exe
  C:\Windows\System\AkgZbMa.exe
  2⤵
  PID:3012
- C:\Windows\System\GkCJQDl.exe
  C:\Windows\System\GkCJQDl.exe
  2⤵
  PID:13488
- C:\Windows\System\JhmJdyb.exe
  C:\Windows\System\JhmJdyb.exe
  2⤵
  PID:13736
- C:\Windows\System\sEjKMWk.exe
  C:\Windows\System\sEjKMWk.exe
  2⤵
  PID:7836
- C:\Windows\System\jYwFvVt.exe
  C:\Windows\System\jYwFvVt.exe
  2⤵
  PID:3232
- C:\Windows\System\yFIoGpY.exe
  C:\Windows\System\yFIoGpY.exe
  2⤵
  PID:13288
- C:\Windows\System\YbeKXKu.exe
  C:\Windows\System\YbeKXKu.exe
  2⤵
  PID:9416
- C:\Windows\System\JFuBTOR.exe
  C:\Windows\System\JFuBTOR.exe
  2⤵
  PID:10444
- C:\Windows\System\ElEAkjo.exe
  C:\Windows\System\ElEAkjo.exe
  2⤵
  PID:11352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_uzzg5d4y.kgj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uzzg5d4y.kgj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ACUrExk.exe

Path C:\Windows\System\ACUrExk.exe
Size 1.5MB
SHA256 5df267d7868d555508c304b1856e78434485319242ea231c68508ce0ef37e818
MD5 8b5c38380ca34a2eca41749d77fb7493
SHA1 f6fbae50bc258d35e83ecf9eab1b565e8a566431
SHA512 944b9f0fb411ba66182720076b562c628a7992b51314a81e22618268f60db48923eb8345a9b5baccd63e82fd9a6455ddd0cedc127745916486d78d91298f8d6f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugF:Lz071uv4BPMkHC0IlnASEx/RiNles
MD5 SHA1 SHA512 SSDEEP

Submit Download

ARpHGrZ.exe

Path C:\Windows\System\ARpHGrZ.exe
Size 1.5MB
SHA256 7afc58fc044cfb8fd1d3d8a2ab0b66b5214f548251e792d84ddc8c18ff969e9e
MD5 8d293b05d6d549ff3fa4b8d8fb86348c
SHA1 37f44c516c4c7b66e60c09b4085cb02270720b74
SHA512 0b602b13e1da6437150f4a8fcb546055a7c2eef4e8e47be84ca0b85b6efe1fb9946d30716ac259f184273e5c78bec805ae0b9081520d9b42beb9f6432a261d1a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugOg:Lz071uv4BPMkHC0IlnASEx/RiNlelg
MD5 SHA1 SHA512 SSDEEP

Submit Download

DOGqXNt.exe

Path C:\Windows\System\DOGqXNt.exe
Size 1.5MB
SHA256 e5019120af1ec91bb6d85fdeaaa5bfc8ae22bd75ae2201205bcf287be6c9378c
MD5 07202b6bc9b9e5dc950c31dbb223bffe
SHA1 80a328312508eceb5e117a165f393fa88f5f2dff
SHA512 f3d12cd76b7af2bf5700660f620e28cd5569a39502ef1e0403094f9b122672196c3f2c076f9f855b0cc5af069190c65e5796f53fcd15b58bcea2ec5290d4ca9a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xug2:Lz071uv4BPMkHC0IlnASEx/RiNle3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IBWZRyN.exe

Path C:\Windows\System\IBWZRyN.exe
Size 1.5MB
SHA256 b491e9c848c4f5ef4ac2adbda3a452a57c08f06b42efad7f9b8bc8c3512d91a1
MD5 911f1f5cb86f0c03ae317f2c5a584df0
SHA1 11956252b39a9eb090c8bb1287c40997c7d8de80
SHA512 32d1aba85717479173d38f8a23caf4bf78884026426c68f652e11a74bde2ce7b8aa1a711a6b74f60a24e1bf3da6804bf5ddef07b4e53f014c14dd413d4bd89eb
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xug7:Lz071uv4BPMkHC0IlnASEx/RiNleu
MD5 SHA1 SHA512 SSDEEP

Submit Download

JwAahNd.exe

Path C:\Windows\System\JwAahNd.exe
Size 1.5MB
SHA256 78de066f353dbb851247bbe6bc73c05fd5d33331bb7b0bee864147832d67da1a
MD5 85e1138b13eab5f0ec9fca7e1f63ab6e
SHA1 5d237d9279076234b101227332ca425014af037c
SHA512 81e93bde849720488eceaa11a7bd1cf279edd9034d249e04c4a5bed441d49466b605a50a4581afb78e0e54a0a3858e67770fe59727771e1269378a957b55c707
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugI:Lz071uv4BPMkHC0IlnASEx/RiNle1
MD5 SHA1 SHA512 SSDEEP

Submit Download

LUBRMmZ.exe

Path C:\Windows\System\LUBRMmZ.exe
Size 1.5MB
SHA256 c5aab7f6bd4dfe85c57d2fee9bd9a1f25b8cb0ec4c74d9dd2c50044b699540e7
MD5 9658e34f3b358833179c0ec91ace4b5c
SHA1 f39d8145dc77353364600aea4c71d5475d326090
SHA512 d77936993190ad7c172cc5abb5095e7bd2e4b308ed738716cea6f4c5e4862fdb920b759bdfcec4dbb7c72c858f85407465715fb77a9000326b110bcffda7ed88
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugO:Lz071uv4BPMkHC0IlnASEx/RiNleX
MD5 SHA1 SHA512 SSDEEP

Submit Download

MoizVLJ.exe

Path C:\Windows\System\MoizVLJ.exe
Size 1.5MB
SHA256 f1e9d2489715f9b9259b52e9764aa707efd382caa658e88bb4bf47b60ad6d922
MD5 abecd740e643e107918fbde42b64a3c8
SHA1 f8f0b4eaf87afb49b1dd4f24b7cecf012f2dea4e
SHA512 9be73e85cb06a9737cf616fc4a6164851b6c3f5c3e35634a539749b229d079fa934e1db65bb26d514738d975e4207d5b68df9e58d486f045d64633b172c14df1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xug1:Lz071uv4BPMkHC0IlnASEx/RiNlek
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsPYQCI.exe

Path C:\Windows\System\MsPYQCI.exe
Size 1.5MB
SHA256 8d4a3b5c2070fafc4b476dc9adccc0eac00cccd2d9d092fba215c63592f28fcd
MD5 e10e5d2b965ce5894c3ce6fd8e23dfce
SHA1 496c06cb4a8737d5c53970f8cf3fa28b86460056
SHA512 e8e9fbcc48df6d021b9de2b70470f1343063d7caa45765740c392d7dec47bf1797673041204ff3aacbed1366250f4e4be9fa33a72fc59b77961a7713b06642d6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugR:Lz071uv4BPMkHC0IlnASEx/RiNleC
MD5 SHA1 SHA512 SSDEEP

Submit Download

NoKngaR.exe

Path C:\Windows\System\NoKngaR.exe
Size 1.5MB
SHA256 d9ecc6b989113a9fbad9b7d8182793b9b705bae616fc23a45fb8d57b90911b1f
MD5 680376f004bb953e24db88623cf58dc2
SHA1 3916cbc6f4540e2ee4fc024b69287a0a52f6f3ee
SHA512 131233a65cb7ccda465489e042380f19cf0c588b10cfffb9abba69b0ee5cfc8b3c6eac523452b6833c25e3faed7b446654f1bea518d2320237d64b9b503eb4a2
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugV:Lz071uv4BPMkHC0IlnASEx/RiNleE
MD5 SHA1 SHA512 SSDEEP

Submit Download

OpjhuRW.exe

Path C:\Windows\System\OpjhuRW.exe
Size 1.5MB
SHA256 2bb197288647bf0887a26cc522166bdced04ddea32a45ead1805ff4fe37e3005
MD5 19774ed0727b20aa6d7c2b9978390600
SHA1 cc1d5c76dd99a5df09e9a76162a9341f4854bf39
SHA512 189f19577895a80c47a88e9df376a52d945f2dd52e304358379495dcf27cb471421eab7d0f8fa88b25d672ef783418392def70fb86180f6bd4bdf8f95adbf188
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugX:Lz071uv4BPMkHC0IlnASEx/RiNlew
MD5 SHA1 SHA512 SSDEEP

Submit Download

RZAJWxw.exe

Path C:\Windows\System\RZAJWxw.exe
Size 1.5MB
SHA256 ea7ba30f3c17909b3191aca28b8ed1124f2a3cb14f99477a2e2a3bf9a73ad8a8
MD5 28444caf028d5d28de8d0478dd8abb00
SHA1 134838304a77e79adb4bfab31b6ddd9650e77b99
SHA512 77d1e1eadc51703a387d2d32c98b694ce3021340403f33dca367a0d698612995b464c0feed8f527fb748ce46a2736e6bd1a2293eba1276f1229357af687083b6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xugd:Lz071uv4BPMkHC0IlnASEx/RiNleK
MD5 SHA1 SHA512 SSDEEP

Submit Download

TDYaGws.exe

Path C:\Windows\System\TDYaGws.exe
Size 1.5MB
SHA256 0f35a8d9d9bf42b1577cf9df74dd5320419e4e89995678af3f9807a9f8e8deef
MD5 6e0b0f1045312c4a095369c24d1c9026
SHA1 dea89e861271e80cd1ee125e9257180675855e3a
SHA512 af2b8050d176e0c1c4fc605dcbfe2013a0e5516fb3eaff0251cdd64ca83104d4c44cceb226c135c22085304225bd8552461d72f6ab39af329c58b064378c7b2a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xug+:Lz071uv4BPMkHC0IlnASEx/RiNleP
MD5 SHA1 SHA512 SSDEEP

Submit Download

TmetiUC.exe

Path C:\Windows\System\TmetiUC.exe
Size 1.5MB
SHA256 d95240676f37b20bf90b5f6c6ee79b4bd1ee59e5b19b9138ea9b3eebb0ea8a83
MD5 032c415fd22acaee278330505864d0bb
SHA1 2ed1f45994125c2182c5ebc067ba5dac104aebba
SHA512 5fae07cf0875c4d1fa156c9121b8853101a3320530728fd7ca3c5266b428bfb57a991a396c28d1675d57b22eaee65abd6e0e2da8044ad138cfa60577ded88e2e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xug0:Lz071uv4BPMkHC0IlnASEx/RiNle1
MD5 SHA1 SHA512 SSDEEP

Submit Download

TttVCrK.exe

Path C:\Windows\System\TttVCrK.exe
Size 1.5MB
SHA256 85e3e0c9a1e130cf12f322cb6e5d474cbcff84872e7a97caa619f5fcafa84276
MD5 5be2366223f63bfcab1d53f394528605
SHA1 5309d5abd3a74f7b89a45e9b17565e83fead5093
SHA512 1a00827bfed304203f755b5b648ca0d2483aca36aded849a2da1ca468f1758a969a4fd7d5b9fd8f7d2888a88ba7c1a539e59d8166006302d7ffe5e5772829ee8
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xug2:Lz071uv4BPMkHC0IlnASEx/RiNleJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

UcCaGsW.exe

Path C:\Windows\System\UcCaGsW.exe
Size 1.5MB
SHA256 836edfe0b76c1f4f8e0b55ebb45c9dfa5caa16d6b100f231f1ce67f242958086
MD5 35bedc824e5a46e93fe12a746fe663fe
SHA1 d314e18306b85da9f4c059bc576d02513e979de3
SHA512 8a9706a1d2ae9cf4ed55375745c831df03789a31e6768729d6463fe58e84c92b05b91ff1e3ee0beabc6bb7cfaea49b749b4b5bef952aee2a4a5e02fbec6dd9d6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugC:Lz071uv4BPMkHC0IlnASEx/RiNle/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VXHIcyi.exe

Path C:\Windows\System\VXHIcyi.exe
Size 1.5MB
SHA256 c976d14462fa51d002d02029995fadfb87c5d190421a3f2a130abacd96ff158f
MD5 be25906490cce8dd6f74d41643cc797a
SHA1 52fde4ee574806d0c380cf790ab66fd5193cd6d4
SHA512 aeb49a2c71b6ef206a8b4289fc2a7aef62766330f9459ef1e1e99ed0848488eeea0ab8bc863527d7bb61754fdf63996075119ccd2a0074aec7e5ad31c0ee64eb
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xugh:Lz071uv4BPMkHC0IlnASEx/RiNlei
MD5 SHA1 SHA512 SSDEEP

Submit Download

WCeSWQz.exe

Path C:\Windows\System\WCeSWQz.exe
Size 1.5MB
SHA256 5436ac302eefbc5e07ae1467d030c27e135bb9e404ca893c02003453cf32b7ba
MD5 5fdb01a8f8ff9c923272fe90ceb00a91
SHA1 db2cc9bc3228a944fe14b443139a27860ce2efac
SHA512 d70bd251d9b37d47e80944e3f557c6e064a190ac0cb401b32716da56740386d2ffaae78bdf3a747309381c32fc284b51158d689f9b1291faad9778c818cd5094
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xuga:Lz071uv4BPMkHC0IlnASEx/RiNlen
MD5 SHA1 SHA512 SSDEEP

Submit Download

WqsoZQh.exe

Path C:\Windows\System\WqsoZQh.exe
Size 1.5MB
SHA256 fcd834a670491568fd653de12068fa6dbed165ec89cc53f742934d9a34a5cc9e
MD5 40599f339dcba5c97f74fb428a0c76b2
SHA1 b9578e25d6d060a0272c7ca359240ac77d17a67c
SHA512 b89d2013322717a842dce5bd41399c85efabe680cd2ba96bbbfad5b84d814b4365d01ffd01acae234d5d8589067e669a2c1b474ee4b1acdb72b0ea98ed927823
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugYTa:Lz071uv4BPMkHC0IlnASEx/RiNle/2
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZceAraw.exe

Path C:\Windows\System\ZceAraw.exe
Size 1.5MB
SHA256 50e9a41354d660cf4bc88a319bb68b506b91c81a6eec401fc5b8325ec82ff799
MD5 f161f20e5adf6a0bfc0ab13d80180649
SHA1 325d639b6be5611badefb7ee6e6ecc2510f23a2a
SHA512 21a808e9658e6bc1175846d05fb73a5f21155529e332ff2b37578d8e164279cde7a6815ff79a796aed75ceefe11ce83c521b0988d241d6319f5bf5c135b37a59
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugIE:Lz071uv4BPMkHC0IlnASEx/RiNleg
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZeUcDUB.exe

Path C:\Windows\System\ZeUcDUB.exe
Size 8B
SHA256 9ba99dfe86f586665444906d4d6c065235a1faa079a57e34597feec2870450c4
MD5 fbef424b1922acb531e69f596a8b8921
SHA1 584ada3a02d95facb3db59252be930cc2019a07e
SHA512 b7c856eeb52f1f5b978a86cc276964a598136109586a3999d60402c0885755b7f0a6e5ca90b5856e8f2e8d74fc885b0d7e257ea62c297369572d765724b94880
MD5 SHA1 SHA512

Submit Download

aWoNZTl.exe

Path C:\Windows\System\aWoNZTl.exe
Size 1.5MB
SHA256 666167623471134c80f5e9ce5b9b5669b079c9c5870f1450220d0108eb0a805a
MD5 86bb3a9e5424de2b8a8ae2c914630352
SHA1 01790b3a0973fb8c0305fb94fdc31eb9067213b0
SHA512 f6e1744247f933cb5ac73ca8909d6e2c2b8c9d5362492c7047aa7e5c61a19910c05ebf75de4adf82aec6471f9990aad0f01826f53aeae3103fd24c0c0eb3c445
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xugn:Lz071uv4BPMkHC0IlnASEx/RiNles
MD5 SHA1 SHA512 SSDEEP

Submit Download

bBVbbHm.exe

Path C:\Windows\System\bBVbbHm.exe
Size 1.5MB
SHA256 816233a174a1e4834ea79839845b6eb164697ae2f9a02cc3b8a9a6638b7718fb
MD5 6359991ddc14fc2142636a56fa0cd5a0
SHA1 34a0892bbdb6aed7a41016d827adb6c91486416d
SHA512 9028ec84484b5483dbb66082a0d3aa82d5fa5a6a1ec0bacd36174b54cc5ee511dc45747a232a40fd837c4aed72ae08eb1c01199d281d4beca5b559865be0fffe
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xugf:Lz071uv4BPMkHC0IlnASEx/RiNleM
MD5 SHA1 SHA512 SSDEEP

Submit Download

bhINVpK.exe

Path C:\Windows\System\bhINVpK.exe
Size 1.5MB
SHA256 4cc11e230cdb893a5cea4329e9700c7f3558e8c7b32198fed3bf48091dd18930
MD5 12241e7ca92bb64828f9064d20832ce5
SHA1 017be308bcf3b461d10c6bc543db31945c729999
SHA512 b9156acdeb1a0076e336de3824c52cffd9c49122c984b74b92c64d510673e63e5d52907501dcebb5c7f40ad896ef7b6bcdbc28f86ca0a22b6395423b7bb793f5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xug8C:Lz071uv4BPMkHC0IlnASEx/RiNleW
MD5 SHA1 SHA512 SSDEEP

Submit Download

dcDOBoA.exe

Path C:\Windows\System\dcDOBoA.exe
Size 1.5MB
SHA256 183e9e6fae321f725bb4b7aba921098629ec654575b0db5ddf01330f414dbb88
MD5 8e19647451d8617f7602d9d3d401a8a3
SHA1 3ad429c33b80283844a555c959a5fc49e570aa30
SHA512 f73dabc53b7a59d5d2923dfc231015e8cbb2c26ca727dfb47190a2b149b4f30c269d3023c606b8f29116f0067cb5590e96ed32c8e4bad37e8a809fb0677b4769
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugR:Lz071uv4BPMkHC0IlnASEx/RiNleQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

epXqSuA.exe

Path C:\Windows\System\epXqSuA.exe
Size 1.5MB
SHA256 a1de8f810c6d9270088862c8b3e073d092d9f6f26fa4bc38d9b7b4fac6d9a6b2
MD5 80246367437616c5639afb873a8f4313
SHA1 39fd7d6207670a1c3c8e87ab9122727e93a68780
SHA512 b38387646be35054ccb6c117cbb184b171842f20bcb2fdc3b83a006c5ac181324ba34b97077f694a926daf0d99a232bdff84473c7dd4110ac39691f6dd9c7949
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugV:Lz071uv4BPMkHC0IlnASEx/RiNle2
MD5 SHA1 SHA512 SSDEEP

Submit Download

erBpsCs.exe

Path C:\Windows\System\erBpsCs.exe
Size 1.5MB
SHA256 57f9063a9886ee7f388a148d4b34c8873c4e5e2f2c09b40c2de9608923d9b787
MD5 1bfc775e565959fcf4cec2706f847327
SHA1 9dc3a9ff1a8b1528e9632c8f5c7b00abf9fce407
SHA512 51e6792e0536f8e33dfbdf31eb5b4d5886e20b532026ec0f97ed2e977d8a9020b4e71ef209f1060b0c5ff746bb438af807c347f574e314cde38c7d2a4a62277d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xugipd:Lz071uv4BPMkHC0IlnASEx/RiNlet
MD5 SHA1 SHA512 SSDEEP

Submit Download

hbhPhMH.exe

Path C:\Windows\System\hbhPhMH.exe
Size 1.5MB
SHA256 def11c044e0ac7d5eebb9a75ea66dde98726c639038fbf03a35292d562316a5a
MD5 9e6c9884bdadcd3bfe7ca7cc9c434978
SHA1 6ea7139003365b9addc4cf410014e57cf2d87ea5
SHA512 2ab222a3f7e4e1fe172b30774cb805430fb68687a8cd36e8738e362ab2c937fade0060d6341c8f3d33903185745385db25b58b1d9d7814b4e0a181d36206f94e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xugq:Lz071uv4BPMkHC0IlnASEx/RiNlef
MD5 SHA1 SHA512 SSDEEP

Submit Download

igrGwmO.exe

Path C:\Windows\System\igrGwmO.exe
Size 1.5MB
SHA256 bff867c720c47d3de7b536ab9ad6aa97bb518ef5b5d21c86c935a14d38f4fa4b
MD5 59320eddacb0d256ba7c4fee0f9b21e6
SHA1 4b8d8991fc9f23fe5a97c69917c76ab2f82ff993
SHA512 7b1849e16990f7e15b939c03a62ee369a7e62f8955d188c5a4ac8dfffea35e74641c9a6f9297b8a1d2b9a6c6ac0caaae42106a4c096e0b4d5ac8147741c61a15
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugK:Lz071uv4BPMkHC0IlnASEx/RiNlex
MD5 SHA1 SHA512 SSDEEP

Submit Download

mJNdAly.exe

Path C:\Windows\System\mJNdAly.exe
Size 1.5MB
SHA256 0b2cbc1f0286945932c3c5b29dfe271bb0559016baddb4014b5f67b7b57cb53f
MD5 452c826bdccb991fd45b474bcfb6dbad
SHA1 aa5e72f459e019e32455e2bef0d46057545fa384
SHA512 5b14bec2ae0396a46d30182decd8b6771c1acf70dc7bd339aeaa7e67208c88c9f4b91c1f141e29a7794ed6c93e9366974fed9772ed078aa5dd320dae83a38a8c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xugv:Lz071uv4BPMkHC0IlnASEx/RiNleG
MD5 SHA1 SHA512 SSDEEP

Submit Download

mOmVcUU.exe

Path C:\Windows\System\mOmVcUU.exe
Size 1.5MB
SHA256 cf5a2c0c112982a554c20bd72bb0322e36b44478ea39bf57f390f48570621eb9
MD5 ec3e792d7800bb13d478e1cecea8e553
SHA1 8e87cd3b88f01cb9bcb41caf9ff36cad2028cf7b
SHA512 2bdc17c0c73774f724a19f42301498035e088695693bc90c0c9ab2cb5f149451c82e96b2f75332a40216a8c3d565ecd29b6b8cdf06caf1a5799ce4032d93c6d6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xug+:Lz071uv4BPMkHC0IlnASEx/RiNle9
MD5 SHA1 SHA512 SSDEEP

Submit Download

mYuxRms.exe

Path C:\Windows\System\mYuxRms.exe
Size 1.5MB
SHA256 90bcb5ee375427702aeafbda1925315e8ae002e33f329eb4aac28b5967eb39c2
MD5 3dc18d24fece5e418b0b7332e500ca19
SHA1 ad9d3799c97d59b96533b6af0ade8661d77df22d
SHA512 e21e0e90125566f6c958622613713e7c4eca80ec88ae83ab42f4945a4e93a48663ad33c50f820074c78e36ea9edc0821eebfdb8f42013cdd84aac367e36718ff
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xuge:Lz071uv4BPMkHC0IlnASEx/RiNleZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

oMkuFiw.exe

Path C:\Windows\System\oMkuFiw.exe
Size 1.5MB
SHA256 3091876fe1603cb239eeb3f26e45284b59da51a6d5dec12dcd62bdcb40bef5a4
MD5 7b7d107f629d208b2d30b8b4fbe6e5f8
SHA1 932da9dba0acf053eaebb828a413902955009048
SHA512 007b598209b9384395c0622d32c3de7db224237bcd5cdeb83989ddaee84124648320ea00f4553dbcc76a72fa46471c5a22def8151a833717c4c0b60a69c0c358
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xug3:Lz071uv4BPMkHC0IlnASEx/RiNle0
MD5 SHA1 SHA512 SSDEEP

Submit Download

owdNtyM.exe

Path C:\Windows\System\owdNtyM.exe
Size 1.5MB
SHA256 8200ae6e558211eb35f802aa4c68e795b97283243b7120ad8ec789ae288800d2
MD5 77af32662bd29610d7a448f04f9913d4
SHA1 6e935e4bdb02e1033319f2d5666d73ef70a4a781
SHA512 ab78fd331357d394f1d331555f2d9a39c7c0267a5d81e5fba51f4df1aa3b27f9ec610daa5fbec264f087eb3a5f021f8a8c95ba262e0c0fa230dd5b52e5952a33
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugEy:Lz071uv4BPMkHC0IlnASEx/RiNle+
MD5 SHA1 SHA512 SSDEEP

Submit Download

pvuJjAK.exe

Path C:\Windows\System\pvuJjAK.exe
Size 1.5MB
SHA256 1413da1669db40cd88a95e70ab7d78cbffc7602e26bbceeedfaf63463c41f7e5
MD5 7a86b436e5d19bf2ebf0f4d2d59484f2
SHA1 ef283873faa807aff5fc6e66520b137ca18bb14f
SHA512 14f8ac03b9d3f5d7ebe3a3fa32bdafe169d44f123a6af3d7029d64a7746271cce107a0ac9e0ce10177dc25b94afe78f0e4e3db30e8e69c94be00bafde88eec38
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xugh:Lz071uv4BPMkHC0IlnASEx/RiNleG
MD5 SHA1 SHA512 SSDEEP

Submit Download

rmbGGvU.exe

Path C:\Windows\System\rmbGGvU.exe
Size 1.5MB
SHA256 e71f7127be66b5b07e72e39326417295db96cee52661dbe99048b4e86639879b
MD5 c575cbf4a35f8650f7be15280ca742b8
SHA1 f685bf02d40ce504ccdeee535a76435df31d4b78
SHA512 eaf300d57e96c46ed27f12c1a70639c59ac9bec193cc66919ef252aa4a9c3b54dd36495a3ac21cd20ae1065ce6acd53b9c06f71e323339656d035762f41fe446
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xugm:Lz071uv4BPMkHC0IlnASEx/RiNleF
MD5 SHA1 SHA512 SSDEEP

Submit Download

sdCmIyG.exe

Path C:\Windows\System\sdCmIyG.exe
Size 1.5MB
SHA256 61cf555defc4816ad2ca491cb7979714fd36acd089dce098ff50414f96d6248c
MD5 035ee1a5050dd3f4647fce8a6e758006
SHA1 25114e9b50a4d4801d35050e0dff2c79ed4dd16a
SHA512 8e120a6ab587b741289a3e7a46a8e0714d1f6b965828aa2f6e3537663a5ffeef872771ce0c7c26f2ff2aedac7904db12b7739e3e8cdb828fa5ce3fb0e1b050b4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugXod:Lz071uv4BPMkHC0IlnASEx/RiNleLd
MD5 SHA1 SHA512 SSDEEP

Submit Download

tfTbmGI.exe

Path C:\Windows\System\tfTbmGI.exe
Size 1.5MB
SHA256 22e0fd831bf214642865e27d882ff00dd42e57179afbdde97ca15c7bbe106d79
MD5 f02d1f406a6870c537cf8aea7589fd9b
SHA1 e4b7e5113e2cb218533e6093979d8dde9c4bd91e
SHA512 9165c768a80ce42be83a10a32c8436c4449f908501a87e213a5e264b53c31b0ec90a098ababeff9d58764a8f41b096ed5ea05f902e5edda2947fcaed8124069f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugVR:Lz071uv4BPMkHC0IlnASEx/RiNleY
MD5 SHA1 SHA512 SSDEEP

Submit Download

uTeZSjA.exe

Path C:\Windows\System\uTeZSjA.exe
Size 1.5MB
SHA256 9c021058c1eee390a646f031598906a53f44c57dbc1e04537339a0c8b8a26041
MD5 b4f7fccca908067199b7d884897a0ca4
SHA1 a76bf4b8bb8693ed5f3e51ce8b8376fac27da3b8
SHA512 91d36022d6f6035443bbc21c73abf9b75e4b2a0ae61b6073442176fae47bfbcb272a4a4b52cc426e2eb22e5674260b1244c3eca87bc3f95ff2838b0cafb34bfd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1Xuga:Lz071uv4BPMkHC0IlnASEx/RiNleJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wfwKKzP.exe

Path C:\Windows\System\wfwKKzP.exe
Size 1.5MB
SHA256 37f9d0a70109289d67ea2860ed15f8a9fe45d8df449f82c6873bf0ec1e959cf5
MD5 54aae52957ea99f9f21ce3fb72b0af29
SHA1 716d31e136c69a5c4b43fafa9d42aac616d0ce9b
SHA512 63dc6dd0eb46080c5f841b8de7fb4b029c8fe6ef818f969faf60ee10c543703c4a34221cb00991e0d9cb5dd9aa14e7a053cb9f18278cdbf83cb64d13f2c79b43
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqah1XugJ:Lz071uv4BPMkHC0IlnASEx/RiNleg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/684-3047-0x00007FF6E4530000-0x00007FF6E4922000-memory.dmp

Download

memory/684-668-0x00007FF6E4530000-0x00007FF6E4922000-memory.dmp

Download

memory/824-3098-0x00007FF701F00000-0x00007FF7022F2000-memory.dmp

Download

memory/824-678-0x00007FF701F00000-0x00007FF7022F2000-memory.dmp

Download

memory/1524-3028-0x00007FF6ECB80000-0x00007FF6ECF72000-memory.dmp

Download

memory/1524-667-0x00007FF6ECB80000-0x00007FF6ECF72000-memory.dmp

Download

memory/1640-3078-0x00007FF72DF00000-0x00007FF72E2F2000-memory.dmp

Download

memory/1640-676-0x00007FF72DF00000-0x00007FF72E2F2000-memory.dmp

Download

memory/2124-677-0x00007FF6E6E70000-0x00007FF6E7262000-memory.dmp

Download

memory/2124-3080-0x00007FF6E6E70000-0x00007FF6E7262000-memory.dmp

Download

memory/2172-3042-0x00007FF629E80000-0x00007FF62A272000-memory.dmp

Download

memory/2172-671-0x00007FF629E80000-0x00007FF62A272000-memory.dmp

Download

memory/2488-680-0x00007FF7DDDD0000-0x00007FF7DE1C2000-memory.dmp

Download

memory/2488-3064-0x00007FF7DDDD0000-0x00007FF7DE1C2000-memory.dmp

Download

memory/2580-666-0x00007FF696EA0000-0x00007FF697292000-memory.dmp

Download

memory/2580-3015-0x00007FF696EA0000-0x00007FF697292000-memory.dmp

Download

memory/2616-3046-0x00007FF6BC520000-0x00007FF6BC912000-memory.dmp

Download

memory/2616-672-0x00007FF6BC520000-0x00007FF6BC912000-memory.dmp

Download

memory/2672-10-0x00007FFBF7F63000-0x00007FFBF7F65000-memory.dmp

Download

memory/2672-64-0x00007FFBF7F60000-0x00007FFBF8A21000-memory.dmp

Download

memory/2672-536-0x000001D558440000-0x000001D558462000-memory.dmp

Download

memory/2820-3063-0x00007FF700FC0000-0x00007FF7013B2000-memory.dmp

Download

memory/2820-669-0x00007FF700FC0000-0x00007FF7013B2000-memory.dmp

Download

memory/2848-664-0x00007FF664730000-0x00007FF664B22000-memory.dmp

Download

memory/2848-3012-0x00007FF664730000-0x00007FF664B22000-memory.dmp

Download

memory/2956-91-0x00007FF635280000-0x00007FF635672000-memory.dmp

Download

memory/2956-2960-0x00007FF635280000-0x00007FF635672000-memory.dmp

Download

memory/3180-679-0x00007FF62DA80000-0x00007FF62DE72000-memory.dmp

Download

memory/3180-2962-0x00007FF62DA80000-0x00007FF62DE72000-memory.dmp

Download

memory/4376-129-0x00007FF7593C0000-0x00007FF7597B2000-memory.dmp

Download

memory/4376-2964-0x00007FF7593C0000-0x00007FF7597B2000-memory.dmp

Download

memory/4388-248-0x00007FF7E7F40000-0x00007FF7E8332000-memory.dmp

Download

memory/4388-2966-0x00007FF7E7F40000-0x00007FF7E8332000-memory.dmp

Download

memory/4424-674-0x00007FF75C330000-0x00007FF75C722000-memory.dmp

Download

memory/4480-554-0x00007FF71D190000-0x00007FF71D582000-memory.dmp

Download

memory/4480-3011-0x00007FF71D190000-0x00007FF71D582000-memory.dmp

Download

memory/4488-670-0x00007FF79C770000-0x00007FF79CB62000-memory.dmp

Download

memory/4488-3101-0x00007FF79C770000-0x00007FF79CB62000-memory.dmp

Download

memory/4640-1-0x0000015E972D0000-0x0000015E972E0000-memory.dmp

Download

memory/4640-0-0x00007FF7D6E60000-0x00007FF7D7252000-memory.dmp

Download

memory/4772-390-0x00007FF7CB050000-0x00007FF7CB442000-memory.dmp

Download

memory/4828-3112-0x00007FF7AC850000-0x00007FF7ACC42000-memory.dmp

Download

memory/4828-673-0x00007FF7AC850000-0x00007FF7ACC42000-memory.dmp

Download

memory/4836-333-0x00007FF6722E0000-0x00007FF6726D2000-memory.dmp

Download

memory/4872-2970-0x00007FF676140000-0x00007FF676532000-memory.dmp

Download

memory/4872-332-0x00007FF676140000-0x00007FF676532000-memory.dmp

Download

memory/4908-2969-0x00007FF70D730000-0x00007FF70DB22000-memory.dmp

Download

memory/4908-305-0x00007FF70D730000-0x00007FF70DB22000-memory.dmp

Download

memory/4948-675-0x00007FF764F00000-0x00007FF7652F2000-memory.dmp

Download

memory/4948-3091-0x00007FF764F00000-0x00007FF7652F2000-memory.dmp

Download