xmrig | 7227a777953526d46d3229632c8ba909b857566b51c72330e989be68db395ad2

Analysis

max time kernel
63s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
Size 1.6MB
Sample240612-phs5pavbkf
SHA256 7227a777953526d46d3229632c8ba909b857566b51c72330e989be68db395ad2
MD5 39fe9630cdf3190acc96ce3ed4e2d9a0
SHA1 0893800994fda84224003e4f0afb6a6f3bc4b717
SHA512 6180a49a22d9946b3040341898fcfee9a305592f9e35abbe7be8c9cc473d0657e83cddee21f7b9509b81a7469171f658bf5d1105cb8fd96f6adab1838b949243
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtd:Lz071uv4BPMkibTIA5LDGTUXaDma
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/880-574-0x00007FF75FF60000-0x00007FF760352000-memory.dmp	xmrig
behavioral2/memory/5116-631-0x00007FF6E1AC0000-0x00007FF6E1EB2000-memory.dmp	xmrig
behavioral2/memory/5008-637-0x00007FF61C380000-0x00007FF61C772000-memory.dmp	xmrig
behavioral2/memory/4552-646-0x00007FF7E2780000-0x00007FF7E2B72000-memory.dmp	xmrig
behavioral2/memory/3056-645-0x00007FF7B7FE0000-0x00007FF7B83D2000-memory.dmp	xmrig
behavioral2/memory/4940-644-0x00007FF7B7260000-0x00007FF7B7652000-memory.dmp	xmrig
behavioral2/memory/2096-643-0x00007FF7A15A0000-0x00007FF7A1992000-memory.dmp	xmrig
behavioral2/memory/2492-642-0x00007FF626A40000-0x00007FF626E32000-memory.dmp	xmrig
behavioral2/memory/60-641-0x00007FF6A5910000-0x00007FF6A5D02000-memory.dmp	xmrig
behavioral2/memory/1300-640-0x00007FF736340000-0x00007FF736732000-memory.dmp	xmrig
behavioral2/memory/3224-639-0x00007FF6D3470000-0x00007FF6D3862000-memory.dmp	xmrig
behavioral2/memory/2860-638-0x00007FF7CEE60000-0x00007FF7CF252000-memory.dmp	xmrig
behavioral2/memory/1228-636-0x00007FF70F720000-0x00007FF70FB12000-memory.dmp	xmrig
behavioral2/memory/1368-635-0x00007FF7C2A30000-0x00007FF7C2E22000-memory.dmp	xmrig
behavioral2/memory/5004-634-0x00007FF73FEC0000-0x00007FF7402B2000-memory.dmp	xmrig
behavioral2/memory/704-633-0x00007FF719240000-0x00007FF719632000-memory.dmp	xmrig
behavioral2/memory/3816-632-0x00007FF6F1ED0000-0x00007FF6F22C2000-memory.dmp	xmrig
behavioral2/memory/3008-630-0x00007FF6CBC30000-0x00007FF6CC022000-memory.dmp	xmrig
behavioral2/memory/1168-629-0x00007FF7C7360000-0x00007FF7C7752000-memory.dmp	xmrig
behavioral2/memory/1020-475-0x00007FF7C1240000-0x00007FF7C1632000-memory.dmp	xmrig
behavioral2/memory/3436-365-0x00007FF7AF230000-0x00007FF7AF622000-memory.dmp	xmrig
behavioral2/memory/1764-352-0x00007FF7B4030000-0x00007FF7B4422000-memory.dmp	xmrig
behavioral2/memory/752-122-0x00007FF6D6950000-0x00007FF6D6D42000-memory.dmp	xmrig
behavioral2/memory/4516-74-0x00007FF7BC1B0000-0x00007FF7BC5A2000-memory.dmp	xmrig
behavioral2/memory/4516-4053-0x00007FF7BC1B0000-0x00007FF7BC5A2000-memory.dmp	xmrig
behavioral2/memory/2096-4055-0x00007FF7A15A0000-0x00007FF7A1992000-memory.dmp	xmrig
behavioral2/memory/1764-4058-0x00007FF7B4030000-0x00007FF7B4422000-memory.dmp	xmrig
behavioral2/memory/752-4069-0x00007FF6D6950000-0x00007FF6D6D42000-memory.dmp	xmrig
behavioral2/memory/880-4073-0x00007FF75FF60000-0x00007FF760352000-memory.dmp	xmrig
behavioral2/memory/1168-4075-0x00007FF7C7360000-0x00007FF7C7752000-memory.dmp	xmrig
behavioral2/memory/2492-4077-0x00007FF626A40000-0x00007FF626E32000-memory.dmp	xmrig
behavioral2/memory/5116-4072-0x00007FF6E1AC0000-0x00007FF6E1EB2000-memory.dmp	xmrig
behavioral2/memory/3816-4065-0x00007FF6F1ED0000-0x00007FF6F22C2000-memory.dmp	xmrig
behavioral2/memory/3436-4068-0x00007FF7AF230000-0x00007FF7AF622000-memory.dmp	xmrig
behavioral2/memory/4940-4062-0x00007FF7B7260000-0x00007FF7B7652000-memory.dmp	xmrig
behavioral2/memory/1020-4063-0x00007FF7C1240000-0x00007FF7C1632000-memory.dmp	xmrig
behavioral2/memory/3008-4060-0x00007FF6CBC30000-0x00007FF6CC022000-memory.dmp	xmrig
behavioral2/memory/5004-4113-0x00007FF73FEC0000-0x00007FF7402B2000-memory.dmp	xmrig
behavioral2/memory/704-4103-0x00007FF719240000-0x00007FF719632000-memory.dmp	xmrig
behavioral2/memory/60-4091-0x00007FF6A5910000-0x00007FF6A5D02000-memory.dmp	xmrig
behavioral2/memory/4552-4087-0x00007FF7E2780000-0x00007FF7E2B72000-memory.dmp	xmrig
behavioral2/memory/1228-4107-0x00007FF70F720000-0x00007FF70FB12000-memory.dmp	xmrig
behavioral2/memory/3224-4085-0x00007FF6D3470000-0x00007FF6D3862000-memory.dmp	xmrig
behavioral2/memory/2860-4105-0x00007FF7CEE60000-0x00007FF7CF252000-memory.dmp	xmrig
behavioral2/memory/1368-4082-0x00007FF7C2A30000-0x00007FF7C2E22000-memory.dmp	xmrig
behavioral2/memory/3056-4101-0x00007FF7B7FE0000-0x00007FF7B83D2000-memory.dmp	xmrig
behavioral2/memory/5008-4089-0x00007FF61C380000-0x00007FF61C772000-memory.dmp	xmrig
behavioral2/memory/1300-4080-0x00007FF736340000-0x00007FF736732000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1560	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2096	jXrOknx.exe
4516	xBwAKaW.exe
752	vdWpsBS.exe
1764	mBJaoql.exe
3436	GNWKQUc.exe
1020	aqkoOWb.exe
880	mmzrAXq.exe
1168	eOnFuZN.exe
3008	GaMdfkl.exe
5116	KQElvLm.exe
4940	JCzAuWI.exe
3816	EmTimQu.exe
704	rKNmSOh.exe
5004	wtFKLDg.exe
1368	jTpRFkJ.exe
3056	OcxRfFQ.exe
1228	gVaQSlb.exe
5008	iasXlWg.exe
2860	hcpOyjj.exe
3224	SzNRotd.exe
1300	QLptLXw.exe
60	UAdnayq.exe
2492	xQEUrdr.exe
4552	YTItiuB.exe
964	IaUiMXJ.exe
4628	HQLtlzx.exe
2440	OsxYCqR.exe
4636	zbXeqpO.exe
3244	gkNQqKM.exe
4092	DZtaUIM.exe
1232	XsKGZNu.exe
3688	PUmYJDX.exe
3988	JwYGVMH.exe
3260	eiQgtkv.exe
3464	RvDUBwP.exe
2652	DQmxeon.exe
3348	QtsBRjp.exe
4632	EPCsMzg.exe
680	GLkJVmU.exe
1796	neNLOSc.exe
3748	Oqmyxcf.exe
3248	pCaoBnB.exe
2692	ophemUg.exe
664	aNwesoq.exe
2300	kopitbw.exe
2192	VDgwPdD.exe
4208	krofOWw.exe
1436	fXTEOgO.exe
2136	RsGPYVQ.exe
1988	kimwghT.exe
2248	IFwBSVO.exe
4924	iLoODBr.exe
2352	aFYqgBn.exe
4916	qzDRQCl.exe
5040	KiiEtcI.exe
2856	MaVIUJf.exe
1580	TmuTRgc.exe
5084	fszRweM.exe
3352	XEayzdy.exe
4452	zZMHeKh.exe
3992	RKlilxr.exe
1676	cEqhxso.exe
536	JNkAJjG.exe
4044	bAfbkoj.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5076-0-0x00007FF6095B0000-0x00007FF6099A2000-memory.dmp	upx
behavioral2/files/0x0007000000023407-6.dat	upx
behavioral2/files/0x0008000000023405-11.dat	upx
behavioral2/files/0x0007000000023406-8.dat	upx
behavioral2/files/0x000700000002341e-129.dat	upx
behavioral2/files/0x0007000000023421-133.dat	upx
behavioral2/memory/880-574-0x00007FF75FF60000-0x00007FF760352000-memory.dmp	upx
behavioral2/memory/5116-631-0x00007FF6E1AC0000-0x00007FF6E1EB2000-memory.dmp	upx
behavioral2/memory/5008-637-0x00007FF61C380000-0x00007FF61C772000-memory.dmp	upx
behavioral2/memory/4552-646-0x00007FF7E2780000-0x00007FF7E2B72000-memory.dmp	upx
behavioral2/memory/3056-645-0x00007FF7B7FE0000-0x00007FF7B83D2000-memory.dmp	upx
behavioral2/memory/4940-644-0x00007FF7B7260000-0x00007FF7B7652000-memory.dmp	upx
behavioral2/memory/2096-643-0x00007FF7A15A0000-0x00007FF7A1992000-memory.dmp	upx
behavioral2/memory/2492-642-0x00007FF626A40000-0x00007FF626E32000-memory.dmp	upx
behavioral2/memory/60-641-0x00007FF6A5910000-0x00007FF6A5D02000-memory.dmp	upx
behavioral2/memory/1300-640-0x00007FF736340000-0x00007FF736732000-memory.dmp	upx
behavioral2/memory/3224-639-0x00007FF6D3470000-0x00007FF6D3862000-memory.dmp	upx
behavioral2/memory/2860-638-0x00007FF7CEE60000-0x00007FF7CF252000-memory.dmp	upx
behavioral2/memory/1228-636-0x00007FF70F720000-0x00007FF70FB12000-memory.dmp	upx
behavioral2/memory/1368-635-0x00007FF7C2A30000-0x00007FF7C2E22000-memory.dmp	upx
behavioral2/memory/5004-634-0x00007FF73FEC0000-0x00007FF7402B2000-memory.dmp	upx
behavioral2/memory/704-633-0x00007FF719240000-0x00007FF719632000-memory.dmp	upx
behavioral2/memory/3816-632-0x00007FF6F1ED0000-0x00007FF6F22C2000-memory.dmp	upx
behavioral2/memory/3008-630-0x00007FF6CBC30000-0x00007FF6CC022000-memory.dmp	upx
behavioral2/memory/1168-629-0x00007FF7C7360000-0x00007FF7C7752000-memory.dmp	upx
behavioral2/memory/1020-475-0x00007FF7C1240000-0x00007FF7C1632000-memory.dmp	upx
behavioral2/memory/3436-365-0x00007FF7AF230000-0x00007FF7AF622000-memory.dmp	upx
behavioral2/memory/1764-352-0x00007FF7B4030000-0x00007FF7B4422000-memory.dmp	upx
behavioral2/files/0x0007000000023424-193.dat	upx
behavioral2/files/0x0007000000023419-190.dat	upx
behavioral2/files/0x0007000000023411-188.dat	upx
behavioral2/files/0x000700000002342b-187.dat	upx
behavioral2/files/0x0007000000023418-180.dat	upx
behavioral2/files/0x0007000000023428-177.dat	upx
behavioral2/files/0x000700000002341f-173.dat	upx
behavioral2/files/0x0007000000023416-164.dat	upx
behavioral2/files/0x0007000000023415-156.dat	upx
behavioral2/files/0x0007000000023427-155.dat	upx
behavioral2/files/0x0007000000023426-154.dat	upx
behavioral2/files/0x0007000000023425-153.dat	upx
behavioral2/files/0x000700000002341a-152.dat	upx
behavioral2/files/0x0007000000023414-148.dat	upx
behavioral2/files/0x000700000002342a-185.dat	upx
behavioral2/files/0x0007000000023413-139.dat	upx
behavioral2/files/0x0007000000023412-137.dat	upx
behavioral2/files/0x0007000000023417-179.dat	upx
behavioral2/files/0x0007000000023420-132.dat	upx
behavioral2/files/0x000700000002341d-169.dat	upx
behavioral2/memory/752-122-0x00007FF6D6950000-0x00007FF6D6D42000-memory.dmp	upx
behavioral2/files/0x000700000002341c-117.dat	upx
behavioral2/files/0x0007000000023423-140.dat	upx
behavioral2/files/0x0007000000023422-136.dat	upx
behavioral2/files/0x000700000002340c-99.dat	upx
behavioral2/files/0x000700000002340b-95.dat	upx
behavioral2/files/0x000700000002340e-92.dat	upx
behavioral2/files/0x000700000002340d-82.dat	upx
behavioral2/files/0x000700000002341b-115.dat	upx
behavioral2/files/0x000700000002340f-77.dat	upx
behavioral2/memory/4516-74-0x00007FF7BC1B0000-0x00007FF7BC5A2000-memory.dmp	upx
behavioral2/files/0x0007000000023410-60.dat	upx
behavioral2/files/0x000700000002340a-59.dat	upx
behavioral2/files/0x0007000000023409-40.dat	upx
behavioral2/files/0x0007000000023408-32.dat	upx
behavioral2/memory/4516-4053-0x00007FF7BC1B0000-0x00007FF7BC5A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bEnLPxO.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\nRjvvtB.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\riyAWrC.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\iBLgWyP.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\xxcnhmH.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\plFGPnr.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\NVrtseF.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\XHBisff.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\OsxYCqR.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\wTmJVls.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\vfqKaGR.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\nvnVuTD.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\YIGjVfC.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\xKWnFfh.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\eOnFuZN.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\JyDvDKP.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\VzGlOGj.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\aFAcXnE.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\gACjGrP.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\nHHZUOd.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\UWALKYr.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\KXSAXyf.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\PiIyAxM.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\qdprmvT.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\BtNJwLz.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\KlQDkis.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ziIyTtq.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ofCblRK.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\XEayzdy.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\heQqJgR.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\XGovRMK.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\JNkAJjG.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\Kqrbwrl.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\JMrolQA.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\ATarwbh.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\hyOsoII.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\HwylvJW.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\LaDRYXo.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\iBKMdrU.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\kjJbTfc.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\pZekVoi.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\FsWycdG.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\baIIiRf.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\TtWGpcO.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\KhhMfGc.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\STPuHnY.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\vNOxcPS.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\lhBvWKO.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\gpnumtJ.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\mzZBobC.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\UCxLfYL.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\VxkaqnH.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\yEPZGMO.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\xZnzggE.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\OzbNmqi.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\SjWYtyM.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\qBWydkw.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\HRoOgTW.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\gFOaNZX.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\MjToLKu.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\YAixkoN.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\HcoRuky.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\dRPOJer.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
File created	C:\Windows\System\CtphshU.exe	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1560	powershell.exe
1560	powershell.exe
1560	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeLockMemoryPrivilege	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 1560	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	83
PID 5076 wrote to memory of 1560	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	83
PID 5076 wrote to memory of 4516	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	84
PID 5076 wrote to memory of 4516	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	84
PID 5076 wrote to memory of 2096	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	85
PID 5076 wrote to memory of 2096	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	85
PID 5076 wrote to memory of 752	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	86
PID 5076 wrote to memory of 752	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	86
PID 5076 wrote to memory of 1764	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	87
PID 5076 wrote to memory of 1764	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	87
PID 5076 wrote to memory of 3436	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	88
PID 5076 wrote to memory of 3436	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	88
PID 5076 wrote to memory of 1020	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	89
PID 5076 wrote to memory of 1020	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	89
PID 5076 wrote to memory of 880	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	90
PID 5076 wrote to memory of 880	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	90
PID 5076 wrote to memory of 1168	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	91
PID 5076 wrote to memory of 1168	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	91
PID 5076 wrote to memory of 3008	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	92
PID 5076 wrote to memory of 3008	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	92
PID 5076 wrote to memory of 5116	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	93
PID 5076 wrote to memory of 5116	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	93
PID 5076 wrote to memory of 4940	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	94
PID 5076 wrote to memory of 4940	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	94
PID 5076 wrote to memory of 3816	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	95
PID 5076 wrote to memory of 3816	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	95
PID 5076 wrote to memory of 704	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	96
PID 5076 wrote to memory of 704	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	96
PID 5076 wrote to memory of 5004	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	97
PID 5076 wrote to memory of 5004	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	97
PID 5076 wrote to memory of 1368	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	98
PID 5076 wrote to memory of 1368	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	98
PID 5076 wrote to memory of 3056	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	99
PID 5076 wrote to memory of 3056	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	99
PID 5076 wrote to memory of 1228	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	100
PID 5076 wrote to memory of 1228	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	100
PID 5076 wrote to memory of 5008	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	101
PID 5076 wrote to memory of 5008	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	101
PID 5076 wrote to memory of 2860	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	102
PID 5076 wrote to memory of 2860	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	102
PID 5076 wrote to memory of 3224	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	103
PID 5076 wrote to memory of 3224	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	103
PID 5076 wrote to memory of 1300	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	104
PID 5076 wrote to memory of 1300	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	104
PID 5076 wrote to memory of 3688	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	105
PID 5076 wrote to memory of 3688	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	105
PID 5076 wrote to memory of 60	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	106
PID 5076 wrote to memory of 60	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	106
PID 5076 wrote to memory of 2492	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	107
PID 5076 wrote to memory of 2492	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	107
PID 5076 wrote to memory of 4552	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	108
PID 5076 wrote to memory of 4552	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	108
PID 5076 wrote to memory of 964	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	109
PID 5076 wrote to memory of 964	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	109
PID 5076 wrote to memory of 4628	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	110
PID 5076 wrote to memory of 4628	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	110
PID 5076 wrote to memory of 2440	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	111
PID 5076 wrote to memory of 2440	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	111
PID 5076 wrote to memory of 4636	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	112
PID 5076 wrote to memory of 4636	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	112
PID 5076 wrote to memory of 3244	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	113
PID 5076 wrote to memory of 3244	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	113
PID 5076 wrote to memory of 4092	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	114
PID 5076 wrote to memory of 4092	5076	39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\39fe9630cdf3190acc96ce3ed4e2d9a0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\System\xBwAKaW.exe
  C:\Windows\System\xBwAKaW.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\jXrOknx.exe
  C:\Windows\System\jXrOknx.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\vdWpsBS.exe
  C:\Windows\System\vdWpsBS.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\mBJaoql.exe
  C:\Windows\System\mBJaoql.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\GNWKQUc.exe
  C:\Windows\System\GNWKQUc.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\aqkoOWb.exe
  C:\Windows\System\aqkoOWb.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\mmzrAXq.exe
  C:\Windows\System\mmzrAXq.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\eOnFuZN.exe
  C:\Windows\System\eOnFuZN.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\GaMdfkl.exe
  C:\Windows\System\GaMdfkl.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\KQElvLm.exe
  C:\Windows\System\KQElvLm.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\JCzAuWI.exe
  C:\Windows\System\JCzAuWI.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\EmTimQu.exe
  C:\Windows\System\EmTimQu.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\rKNmSOh.exe
  C:\Windows\System\rKNmSOh.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\wtFKLDg.exe
  C:\Windows\System\wtFKLDg.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\jTpRFkJ.exe
  C:\Windows\System\jTpRFkJ.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\OcxRfFQ.exe
  C:\Windows\System\OcxRfFQ.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\gVaQSlb.exe
  C:\Windows\System\gVaQSlb.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\iasXlWg.exe
  C:\Windows\System\iasXlWg.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\hcpOyjj.exe
  C:\Windows\System\hcpOyjj.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\SzNRotd.exe
  C:\Windows\System\SzNRotd.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\QLptLXw.exe
  C:\Windows\System\QLptLXw.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\PUmYJDX.exe
  C:\Windows\System\PUmYJDX.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\UAdnayq.exe
  C:\Windows\System\UAdnayq.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\xQEUrdr.exe
  C:\Windows\System\xQEUrdr.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\YTItiuB.exe
  C:\Windows\System\YTItiuB.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\IaUiMXJ.exe
  C:\Windows\System\IaUiMXJ.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\HQLtlzx.exe
  C:\Windows\System\HQLtlzx.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\OsxYCqR.exe
  C:\Windows\System\OsxYCqR.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\zbXeqpO.exe
  C:\Windows\System\zbXeqpO.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\gkNQqKM.exe
  C:\Windows\System\gkNQqKM.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\DZtaUIM.exe
  C:\Windows\System\DZtaUIM.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\XsKGZNu.exe
  C:\Windows\System\XsKGZNu.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\JwYGVMH.exe
  C:\Windows\System\JwYGVMH.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\eiQgtkv.exe
  C:\Windows\System\eiQgtkv.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\RvDUBwP.exe
  C:\Windows\System\RvDUBwP.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\DQmxeon.exe
  C:\Windows\System\DQmxeon.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\fXTEOgO.exe
  C:\Windows\System\fXTEOgO.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\QtsBRjp.exe
  C:\Windows\System\QtsBRjp.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\EPCsMzg.exe
  C:\Windows\System\EPCsMzg.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\GLkJVmU.exe
  C:\Windows\System\GLkJVmU.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\neNLOSc.exe
  C:\Windows\System\neNLOSc.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\Oqmyxcf.exe
  C:\Windows\System\Oqmyxcf.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\pCaoBnB.exe
  C:\Windows\System\pCaoBnB.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\ophemUg.exe
  C:\Windows\System\ophemUg.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\aNwesoq.exe
  C:\Windows\System\aNwesoq.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\kopitbw.exe
  C:\Windows\System\kopitbw.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\VDgwPdD.exe
  C:\Windows\System\VDgwPdD.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\krofOWw.exe
  C:\Windows\System\krofOWw.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\RsGPYVQ.exe
  C:\Windows\System\RsGPYVQ.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\kimwghT.exe
  C:\Windows\System\kimwghT.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\IFwBSVO.exe
  C:\Windows\System\IFwBSVO.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\iLoODBr.exe
  C:\Windows\System\iLoODBr.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\aFYqgBn.exe
  C:\Windows\System\aFYqgBn.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\qzDRQCl.exe
  C:\Windows\System\qzDRQCl.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\KiiEtcI.exe
  C:\Windows\System\KiiEtcI.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\MaVIUJf.exe
  C:\Windows\System\MaVIUJf.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\TmuTRgc.exe
  C:\Windows\System\TmuTRgc.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\fszRweM.exe
  C:\Windows\System\fszRweM.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\XEayzdy.exe
  C:\Windows\System\XEayzdy.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\zZMHeKh.exe
  C:\Windows\System\zZMHeKh.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\RKlilxr.exe
  C:\Windows\System\RKlilxr.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\cEqhxso.exe
  C:\Windows\System\cEqhxso.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\JNkAJjG.exe
  C:\Windows\System\JNkAJjG.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\bAfbkoj.exe
  C:\Windows\System\bAfbkoj.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\kEybrGZ.exe
  C:\Windows\System\kEybrGZ.exe
  2⤵
  PID:4392
- C:\Windows\System\mwTBmfL.exe
  C:\Windows\System\mwTBmfL.exe
  2⤵
  PID:4292
- C:\Windows\System\PRBDCwJ.exe
  C:\Windows\System\PRBDCwJ.exe
  2⤵
  PID:2756
- C:\Windows\System\cAECNhx.exe
  C:\Windows\System\cAECNhx.exe
  2⤵
  PID:1060
- C:\Windows\System\ybMZfFr.exe
  C:\Windows\System\ybMZfFr.exe
  2⤵
  PID:4996
- C:\Windows\System\ZgtLlIs.exe
  C:\Windows\System\ZgtLlIs.exe
  2⤵
  PID:4456
- C:\Windows\System\dcVgryr.exe
  C:\Windows\System\dcVgryr.exe
  2⤵
  PID:212
- C:\Windows\System\bdQIjDk.exe
  C:\Windows\System\bdQIjDk.exe
  2⤵
  PID:3732
- C:\Windows\System\AQVlepl.exe
  C:\Windows\System\AQVlepl.exe
  2⤵
  PID:1608
- C:\Windows\System\CsMotMU.exe
  C:\Windows\System\CsMotMU.exe
  2⤵
  PID:4984
- C:\Windows\System\sptOJBO.exe
  C:\Windows\System\sptOJBO.exe
  2⤵
  PID:3064
- C:\Windows\System\uMwyyvn.exe
  C:\Windows\System\uMwyyvn.exe
  2⤵
  PID:5068
- C:\Windows\System\tacXWbB.exe
  C:\Windows\System\tacXWbB.exe
  2⤵
  PID:2812
- C:\Windows\System\NNmVjQn.exe
  C:\Windows\System\NNmVjQn.exe
  2⤵
  PID:3152
- C:\Windows\System\MmFZbRt.exe
  C:\Windows\System\MmFZbRt.exe
  2⤵
  PID:516
- C:\Windows\System\DkuCCGj.exe
  C:\Windows\System\DkuCCGj.exe
  2⤵
  PID:2980
- C:\Windows\System\IOGmZmp.exe
  C:\Windows\System\IOGmZmp.exe
  2⤵
  PID:4348
- C:\Windows\System\tjmLxZd.exe
  C:\Windows\System\tjmLxZd.exe
  2⤵
  PID:2916
- C:\Windows\System\oSBGMzI.exe
  C:\Windows\System\oSBGMzI.exe
  2⤵
  PID:4780
- C:\Windows\System\rXJFtHh.exe
  C:\Windows\System\rXJFtHh.exe
  2⤵
  PID:2124
- C:\Windows\System\EINbbfl.exe
  C:\Windows\System\EINbbfl.exe
  2⤵
  PID:5128
- C:\Windows\System\fkGJhFW.exe
  C:\Windows\System\fkGJhFW.exe
  2⤵
  PID:5148
- C:\Windows\System\BlyXoqv.exe
  C:\Windows\System\BlyXoqv.exe
  2⤵
  PID:5164
- C:\Windows\System\yHwcJfd.exe
  C:\Windows\System\yHwcJfd.exe
  2⤵
  PID:5184
- C:\Windows\System\QYkpzVA.exe
  C:\Windows\System\QYkpzVA.exe
  2⤵
  PID:5204
- C:\Windows\System\pYTcgRf.exe
  C:\Windows\System\pYTcgRf.exe
  2⤵
  PID:5224
- C:\Windows\System\QQDAbae.exe
  C:\Windows\System\QQDAbae.exe
  2⤵
  PID:5244
- C:\Windows\System\hUNIQKW.exe
  C:\Windows\System\hUNIQKW.exe
  2⤵
  PID:5272
- C:\Windows\System\GTLzzRw.exe
  C:\Windows\System\GTLzzRw.exe
  2⤵
  PID:5288
- C:\Windows\System\eYjKvYX.exe
  C:\Windows\System\eYjKvYX.exe
  2⤵
  PID:5308
- C:\Windows\System\gjrcfSi.exe
  C:\Windows\System\gjrcfSi.exe
  2⤵
  PID:5328
- C:\Windows\System\BzgeOgK.exe
  C:\Windows\System\BzgeOgK.exe
  2⤵
  PID:5352
- C:\Windows\System\fxocOAZ.exe
  C:\Windows\System\fxocOAZ.exe
  2⤵
  PID:5376
- C:\Windows\System\xZnzggE.exe
  C:\Windows\System\xZnzggE.exe
  2⤵
  PID:5396
- C:\Windows\System\JyBhwma.exe
  C:\Windows\System\JyBhwma.exe
  2⤵
  PID:5412
- C:\Windows\System\gWIwMqt.exe
  C:\Windows\System\gWIwMqt.exe
  2⤵
  PID:5428
- C:\Windows\System\pZekVoi.exe
  C:\Windows\System\pZekVoi.exe
  2⤵
  PID:5444
- C:\Windows\System\qdjnBYM.exe
  C:\Windows\System\qdjnBYM.exe
  2⤵
  PID:5472
- C:\Windows\System\ZqgVWjX.exe
  C:\Windows\System\ZqgVWjX.exe
  2⤵
  PID:5504
- C:\Windows\System\uVogrMX.exe
  C:\Windows\System\uVogrMX.exe
  2⤵
  PID:5532
- C:\Windows\System\SLzUjgQ.exe
  C:\Windows\System\SLzUjgQ.exe
  2⤵
  PID:5556
- C:\Windows\System\gPznGnn.exe
  C:\Windows\System\gPznGnn.exe
  2⤵
  PID:5576
- C:\Windows\System\zmgOkQM.exe
  C:\Windows\System\zmgOkQM.exe
  2⤵
  PID:5600
- C:\Windows\System\LKOjNsX.exe
  C:\Windows\System\LKOjNsX.exe
  2⤵
  PID:5620
- C:\Windows\System\MIxTpBu.exe
  C:\Windows\System\MIxTpBu.exe
  2⤵
  PID:5648
- C:\Windows\System\ulkGKVo.exe
  C:\Windows\System\ulkGKVo.exe
  2⤵
  PID:5668
- C:\Windows\System\sgOaSJy.exe
  C:\Windows\System\sgOaSJy.exe
  2⤵
  PID:5692
- C:\Windows\System\ThOCZtF.exe
  C:\Windows\System\ThOCZtF.exe
  2⤵
  PID:5712
- C:\Windows\System\gHkvbRh.exe
  C:\Windows\System\gHkvbRh.exe
  2⤵
  PID:5728
- C:\Windows\System\sezUWUX.exe
  C:\Windows\System\sezUWUX.exe
  2⤵
  PID:5752
- C:\Windows\System\fiiNFQq.exe
  C:\Windows\System\fiiNFQq.exe
  2⤵
  PID:5768
- C:\Windows\System\ZNJQAmD.exe
  C:\Windows\System\ZNJQAmD.exe
  2⤵
  PID:5792
- C:\Windows\System\cbUlMrN.exe
  C:\Windows\System\cbUlMrN.exe
  2⤵
  PID:5812
- C:\Windows\System\JBAVYDC.exe
  C:\Windows\System\JBAVYDC.exe
  2⤵
  PID:5832
- C:\Windows\System\APkVkpx.exe
  C:\Windows\System\APkVkpx.exe
  2⤵
  PID:5852
- C:\Windows\System\hckQzSV.exe
  C:\Windows\System\hckQzSV.exe
  2⤵
  PID:5872
- C:\Windows\System\UePnAoc.exe
  C:\Windows\System\UePnAoc.exe
  2⤵
  PID:5892
- C:\Windows\System\rTbkAhX.exe
  C:\Windows\System\rTbkAhX.exe
  2⤵
  PID:5908
- C:\Windows\System\qNfLAOF.exe
  C:\Windows\System\qNfLAOF.exe
  2⤵
  PID:5932
- C:\Windows\System\ANUvDXu.exe
  C:\Windows\System\ANUvDXu.exe
  2⤵
  PID:5948
- C:\Windows\System\omNDkZB.exe
  C:\Windows\System\omNDkZB.exe
  2⤵
  PID:5972
- C:\Windows\System\sDtwJPD.exe
  C:\Windows\System\sDtwJPD.exe
  2⤵
  PID:5992
- C:\Windows\System\eVkpNET.exe
  C:\Windows\System\eVkpNET.exe
  2⤵
  PID:6012
- C:\Windows\System\aVuhfBW.exe
  C:\Windows\System\aVuhfBW.exe
  2⤵
  PID:6036
- C:\Windows\System\ybbPZWj.exe
  C:\Windows\System\ybbPZWj.exe
  2⤵
  PID:6052
- C:\Windows\System\daogvLI.exe
  C:\Windows\System\daogvLI.exe
  2⤵
  PID:6072
- C:\Windows\System\AqDgPix.exe
  C:\Windows\System\AqDgPix.exe
  2⤵
  PID:6096
- C:\Windows\System\QwkvbOT.exe
  C:\Windows\System\QwkvbOT.exe
  2⤵
  PID:6116
- C:\Windows\System\eLkOGPe.exe
  C:\Windows\System\eLkOGPe.exe
  2⤵
  PID:6140
- C:\Windows\System\fbmbtke.exe
  C:\Windows\System\fbmbtke.exe
  2⤵
  PID:1224
- C:\Windows\System\bDjGzXL.exe
  C:\Windows\System\bDjGzXL.exe
  2⤵
  PID:1828
- C:\Windows\System\sePmCuq.exe
  C:\Windows\System\sePmCuq.exe
  2⤵
  PID:1732
- C:\Windows\System\lpuGxAy.exe
  C:\Windows\System\lpuGxAy.exe
  2⤵
  PID:2592
- C:\Windows\System\WvRjhKO.exe
  C:\Windows\System\WvRjhKO.exe
  2⤵
  PID:5140
- C:\Windows\System\USbKroT.exe
  C:\Windows\System\USbKroT.exe
  2⤵
  PID:5064
- C:\Windows\System\fBkMzPW.exe
  C:\Windows\System\fBkMzPW.exe
  2⤵
  PID:3292
- C:\Windows\System\jxgLBAo.exe
  C:\Windows\System\jxgLBAo.exe
  2⤵
  PID:3556
- C:\Windows\System\ouBmHaY.exe
  C:\Windows\System\ouBmHaY.exe
  2⤵
  PID:2964
- C:\Windows\System\vKRfWoe.exe
  C:\Windows\System\vKRfWoe.exe
  2⤵
  PID:2384
- C:\Windows\System\xyAilTx.exe
  C:\Windows\System\xyAilTx.exe
  2⤵
  PID:5360
- C:\Windows\System\eLBgoCk.exe
  C:\Windows\System\eLBgoCk.exe
  2⤵
  PID:3100
- C:\Windows\System\JaOrYsx.exe
  C:\Windows\System\JaOrYsx.exe
  2⤵
  PID:3848
- C:\Windows\System\ALzpcuE.exe
  C:\Windows\System\ALzpcuE.exe
  2⤵
  PID:5572
- C:\Windows\System\dmhfCez.exe
  C:\Windows\System\dmhfCez.exe
  2⤵
  PID:2140
- C:\Windows\System\trWsrGZ.exe
  C:\Windows\System\trWsrGZ.exe
  2⤵
  PID:6164
- C:\Windows\System\plgUuae.exe
  C:\Windows\System\plgUuae.exe
  2⤵
  PID:6180
- C:\Windows\System\VfrIitO.exe
  C:\Windows\System\VfrIitO.exe
  2⤵
  PID:6204
- C:\Windows\System\wUqLmgi.exe
  C:\Windows\System\wUqLmgi.exe
  2⤵
  PID:6228
- C:\Windows\System\fNUxcll.exe
  C:\Windows\System\fNUxcll.exe
  2⤵
  PID:6244
- C:\Windows\System\UwQUUOl.exe
  C:\Windows\System\UwQUUOl.exe
  2⤵
  PID:6268
- C:\Windows\System\iHaKMJL.exe
  C:\Windows\System\iHaKMJL.exe
  2⤵
  PID:6284
- C:\Windows\System\cZlRLhN.exe
  C:\Windows\System\cZlRLhN.exe
  2⤵
  PID:6300
- C:\Windows\System\FOGgXhy.exe
  C:\Windows\System\FOGgXhy.exe
  2⤵
  PID:6324
- C:\Windows\System\UfWuiJs.exe
  C:\Windows\System\UfWuiJs.exe
  2⤵
  PID:6344
- C:\Windows\System\DwlQYSK.exe
  C:\Windows\System\DwlQYSK.exe
  2⤵
  PID:6364
- C:\Windows\System\HRoOgTW.exe
  C:\Windows\System\HRoOgTW.exe
  2⤵
  PID:6380
- C:\Windows\System\AuDzYWt.exe
  C:\Windows\System\AuDzYWt.exe
  2⤵
  PID:6396
- C:\Windows\System\UrjRHcu.exe
  C:\Windows\System\UrjRHcu.exe
  2⤵
  PID:6416
- C:\Windows\System\jmZxmgF.exe
  C:\Windows\System\jmZxmgF.exe
  2⤵
  PID:6444
- C:\Windows\System\bDRDmKS.exe
  C:\Windows\System\bDRDmKS.exe
  2⤵
  PID:6460
- C:\Windows\System\nuCfbfn.exe
  C:\Windows\System\nuCfbfn.exe
  2⤵
  PID:6484
- C:\Windows\System\PCGGJbZ.exe
  C:\Windows\System\PCGGJbZ.exe
  2⤵
  PID:6500
- C:\Windows\System\QdKIUJH.exe
  C:\Windows\System\QdKIUJH.exe
  2⤵
  PID:6524
- C:\Windows\System\blCJDfx.exe
  C:\Windows\System\blCJDfx.exe
  2⤵
  PID:6540
- C:\Windows\System\oFgmwcG.exe
  C:\Windows\System\oFgmwcG.exe
  2⤵
  PID:6568
- C:\Windows\System\SrSQOLr.exe
  C:\Windows\System\SrSQOLr.exe
  2⤵
  PID:6596
- C:\Windows\System\pMnEhZz.exe
  C:\Windows\System\pMnEhZz.exe
  2⤵
  PID:6612
- C:\Windows\System\BgqtwGz.exe
  C:\Windows\System\BgqtwGz.exe
  2⤵
  PID:6640
- C:\Windows\System\KBseBOh.exe
  C:\Windows\System\KBseBOh.exe
  2⤵
  PID:6656
- C:\Windows\System\DpEvhFC.exe
  C:\Windows\System\DpEvhFC.exe
  2⤵
  PID:6676
- C:\Windows\System\LSDGdzq.exe
  C:\Windows\System\LSDGdzq.exe
  2⤵
  PID:6696
- C:\Windows\System\jsNfKdF.exe
  C:\Windows\System\jsNfKdF.exe
  2⤵
  PID:6720
- C:\Windows\System\yOJwWcL.exe
  C:\Windows\System\yOJwWcL.exe
  2⤵
  PID:6736
- C:\Windows\System\YUirSUA.exe
  C:\Windows\System\YUirSUA.exe
  2⤵
  PID:6760
- C:\Windows\System\sVPsmUO.exe
  C:\Windows\System\sVPsmUO.exe
  2⤵
  PID:6792
- C:\Windows\System\Dafoulw.exe
  C:\Windows\System\Dafoulw.exe
  2⤵
  PID:6808
- C:\Windows\System\HzewrcQ.exe
  C:\Windows\System\HzewrcQ.exe
  2⤵
  PID:6860
- C:\Windows\System\OgIeGui.exe
  C:\Windows\System\OgIeGui.exe
  2⤵
  PID:6876
- C:\Windows\System\BJUzcRF.exe
  C:\Windows\System\BJUzcRF.exe
  2⤵
  PID:6892
- C:\Windows\System\sAdmxcy.exe
  C:\Windows\System\sAdmxcy.exe
  2⤵
  PID:6912
- C:\Windows\System\wbOMfJd.exe
  C:\Windows\System\wbOMfJd.exe
  2⤵
  PID:6928
- C:\Windows\System\gApTXID.exe
  C:\Windows\System\gApTXID.exe
  2⤵
  PID:6948
- C:\Windows\System\KBeiUUY.exe
  C:\Windows\System\KBeiUUY.exe
  2⤵
  PID:6972
- C:\Windows\System\MWvMQaa.exe
  C:\Windows\System\MWvMQaa.exe
  2⤵
  PID:6992
- C:\Windows\System\QwWbhxL.exe
  C:\Windows\System\QwWbhxL.exe
  2⤵
  PID:7020
- C:\Windows\System\eTnQuNM.exe
  C:\Windows\System\eTnQuNM.exe
  2⤵
  PID:7040
- C:\Windows\System\RQXLWju.exe
  C:\Windows\System\RQXLWju.exe
  2⤵
  PID:7060
- C:\Windows\System\GIrmpWQ.exe
  C:\Windows\System\GIrmpWQ.exe
  2⤵
  PID:7080
- C:\Windows\System\WeUIoLd.exe
  C:\Windows\System\WeUIoLd.exe
  2⤵
  PID:7096
- C:\Windows\System\oPkGjvl.exe
  C:\Windows\System\oPkGjvl.exe
  2⤵
  PID:7112
- C:\Windows\System\pCqTqcg.exe
  C:\Windows\System\pCqTqcg.exe
  2⤵
  PID:7140
- C:\Windows\System\OzbNmqi.exe
  C:\Windows\System\OzbNmqi.exe
  2⤵
  PID:7160
- C:\Windows\System\XENCvIk.exe
  C:\Windows\System\XENCvIk.exe
  2⤵
  PID:1288
- C:\Windows\System\jqjxFuJ.exe
  C:\Windows\System\jqjxFuJ.exe
  2⤵
  PID:916
- C:\Windows\System\EGZiYuo.exe
  C:\Windows\System\EGZiYuo.exe
  2⤵
  PID:5680
- C:\Windows\System\dhoPvMU.exe
  C:\Windows\System\dhoPvMU.exe
  2⤵
  PID:5744
- C:\Windows\System\xnHIQRR.exe
  C:\Windows\System\xnHIQRR.exe
  2⤵
  PID:5760
- C:\Windows\System\TYkhdjf.exe
  C:\Windows\System\TYkhdjf.exe
  2⤵
  PID:5788
- C:\Windows\System\AFkJfbg.exe
  C:\Windows\System\AFkJfbg.exe
  2⤵
  PID:5828
- C:\Windows\System\aXFutqr.exe
  C:\Windows\System\aXFutqr.exe
  2⤵
  PID:5868
- C:\Windows\System\CxOyCOj.exe
  C:\Windows\System\CxOyCOj.exe
  2⤵
  PID:3148
- C:\Windows\System\iXtTEnX.exe
  C:\Windows\System\iXtTEnX.exe
  2⤵
  PID:5980
- C:\Windows\System\QRttGpR.exe
  C:\Windows\System\QRttGpR.exe
  2⤵
  PID:4220
- C:\Windows\System\TzZtFVb.exe
  C:\Windows\System\TzZtFVb.exe
  2⤵
  PID:2488
- C:\Windows\System\fIwwjcK.exe
  C:\Windows\System\fIwwjcK.exe
  2⤵
  PID:5268
- C:\Windows\System\GkEWWHF.exe
  C:\Windows\System\GkEWWHF.exe
  2⤵
  PID:2908
- C:\Windows\System\ZhCUvOU.exe
  C:\Windows\System\ZhCUvOU.exe
  2⤵
  PID:3948
- C:\Windows\System\TBjNUAb.exe
  C:\Windows\System\TBjNUAb.exe
  2⤵
  PID:2444
- C:\Windows\System\qIMZspB.exe
  C:\Windows\System\qIMZspB.exe
  2⤵
  PID:1492
- C:\Windows\System\qGrEwYs.exe
  C:\Windows\System\qGrEwYs.exe
  2⤵
  PID:5544
- C:\Windows\System\LxMrwGm.exe
  C:\Windows\System\LxMrwGm.exe
  2⤵
  PID:6156
- C:\Windows\System\TkVVJpv.exe
  C:\Windows\System\TkVVJpv.exe
  2⤵
  PID:5708
- C:\Windows\System\UWALKYr.exe
  C:\Windows\System\UWALKYr.exe
  2⤵
  PID:5804
- C:\Windows\System\riyAWrC.exe
  C:\Windows\System\riyAWrC.exe
  2⤵
  PID:6424
- C:\Windows\System\IEFPDpI.exe
  C:\Windows\System\IEFPDpI.exe
  2⤵
  PID:5840
- C:\Windows\System\RiIinBB.exe
  C:\Windows\System\RiIinBB.exe
  2⤵
  PID:6508
- C:\Windows\System\ZbKceNA.exe
  C:\Windows\System\ZbKceNA.exe
  2⤵
  PID:5160
- C:\Windows\System\EXMjxvW.exe
  C:\Windows\System\EXMjxvW.exe
  2⤵
  PID:6580
- C:\Windows\System\qCKYkrb.exe
  C:\Windows\System\qCKYkrb.exe
  2⤵
  PID:7172
- C:\Windows\System\NxWRSCy.exe
  C:\Windows\System\NxWRSCy.exe
  2⤵
  PID:7192
- C:\Windows\System\QQKPDvX.exe
  C:\Windows\System\QQKPDvX.exe
  2⤵
  PID:7212
- C:\Windows\System\sDhfgQL.exe
  C:\Windows\System\sDhfgQL.exe
  2⤵
  PID:7400
- C:\Windows\System\cVPNXfU.exe
  C:\Windows\System\cVPNXfU.exe
  2⤵
  PID:7416
- C:\Windows\System\VwOcdVs.exe
  C:\Windows\System\VwOcdVs.exe
  2⤵
  PID:7432
- C:\Windows\System\mxkhvOT.exe
  C:\Windows\System\mxkhvOT.exe
  2⤵
  PID:7448
- C:\Windows\System\DvNamUT.exe
  C:\Windows\System\DvNamUT.exe
  2⤵
  PID:7464
- C:\Windows\System\mEcQONF.exe
  C:\Windows\System\mEcQONF.exe
  2⤵
  PID:7480
- C:\Windows\System\BLGiyNz.exe
  C:\Windows\System\BLGiyNz.exe
  2⤵
  PID:7496
- C:\Windows\System\lLYMuXe.exe
  C:\Windows\System\lLYMuXe.exe
  2⤵
  PID:7512
- C:\Windows\System\VpNndym.exe
  C:\Windows\System\VpNndym.exe
  2⤵
  PID:7528
- C:\Windows\System\rBdhhzW.exe
  C:\Windows\System\rBdhhzW.exe
  2⤵
  PID:7544
- C:\Windows\System\aCLcQyo.exe
  C:\Windows\System\aCLcQyo.exe
  2⤵
  PID:7560
- C:\Windows\System\dMxpDTQ.exe
  C:\Windows\System\dMxpDTQ.exe
  2⤵
  PID:7576
- C:\Windows\System\nOTZMzO.exe
  C:\Windows\System\nOTZMzO.exe
  2⤵
  PID:7592
- C:\Windows\System\MgdHxYD.exe
  C:\Windows\System\MgdHxYD.exe
  2⤵
  PID:7608
- C:\Windows\System\syuviEU.exe
  C:\Windows\System\syuviEU.exe
  2⤵
  PID:7624
- C:\Windows\System\GhueqpT.exe
  C:\Windows\System\GhueqpT.exe
  2⤵
  PID:7640
- C:\Windows\System\pNueoXn.exe
  C:\Windows\System\pNueoXn.exe
  2⤵
  PID:7656
- C:\Windows\System\lvBuLje.exe
  C:\Windows\System\lvBuLje.exe
  2⤵
  PID:7672
- C:\Windows\System\UoryweK.exe
  C:\Windows\System\UoryweK.exe
  2⤵
  PID:7688
- C:\Windows\System\KdVGMKu.exe
  C:\Windows\System\KdVGMKu.exe
  2⤵
  PID:7708
- C:\Windows\System\SLltQoL.exe
  C:\Windows\System\SLltQoL.exe
  2⤵
  PID:8064
- C:\Windows\System\pfxyZLO.exe
  C:\Windows\System\pfxyZLO.exe
  2⤵
  PID:8080
- C:\Windows\System\nHWMCdn.exe
  C:\Windows\System\nHWMCdn.exe
  2⤵
  PID:8100
- C:\Windows\System\TwSmEpo.exe
  C:\Windows\System\TwSmEpo.exe
  2⤵
  PID:8116
- C:\Windows\System\FDIsAcq.exe
  C:\Windows\System\FDIsAcq.exe
  2⤵
  PID:8132
- C:\Windows\System\zvrpThK.exe
  C:\Windows\System\zvrpThK.exe
  2⤵
  PID:8148
- C:\Windows\System\anafOwr.exe
  C:\Windows\System\anafOwr.exe
  2⤵
  PID:8164
- C:\Windows\System\oktPdmR.exe
  C:\Windows\System\oktPdmR.exe
  2⤵
  PID:8180
- C:\Windows\System\cLJZfwz.exe
  C:\Windows\System\cLJZfwz.exe
  2⤵
  PID:6608
- C:\Windows\System\GMyGjXO.exe
  C:\Windows\System\GMyGjXO.exe
  2⤵
  PID:5212
- C:\Windows\System\PJJueHF.exe
  C:\Windows\System\PJJueHF.exe
  2⤵
  PID:1180
- C:\Windows\System\NOdjDyK.exe
  C:\Windows\System\NOdjDyK.exe
  2⤵
  PID:5296
- C:\Windows\System\IqIPZXO.exe
  C:\Windows\System\IqIPZXO.exe
  2⤵
  PID:1448
- C:\Windows\System\AYSakzH.exe
  C:\Windows\System\AYSakzH.exe
  2⤵
  PID:5404
- C:\Windows\System\grSZhff.exe
  C:\Windows\System\grSZhff.exe
  2⤵
  PID:5452
- C:\Windows\System\dIsuXaO.exe
  C:\Windows\System\dIsuXaO.exe
  2⤵
  PID:5512
- C:\Windows\System\iBLgWyP.exe
  C:\Windows\System\iBLgWyP.exe
  2⤵
  PID:5660
- C:\Windows\System\vFySJzm.exe
  C:\Windows\System\vFySJzm.exe
  2⤵
  PID:6472
- C:\Windows\System\DmfnwXa.exe
  C:\Windows\System\DmfnwXa.exe
  2⤵
  PID:6044
- C:\Windows\System\zdjXpsB.exe
  C:\Windows\System\zdjXpsB.exe
  2⤵
  PID:6136
- C:\Windows\System\BqVWfEs.exe
  C:\Windows\System\BqVWfEs.exe
  2⤵
  PID:2220
- C:\Windows\System\VneoGPc.exe
  C:\Windows\System\VneoGPc.exe
  2⤵
  PID:4396
- C:\Windows\System\YdcWDbm.exe
  C:\Windows\System\YdcWDbm.exe
  2⤵
  PID:2224
- C:\Windows\System\hbBshHG.exe
  C:\Windows\System\hbBshHG.exe
  2⤵
  PID:6212
- C:\Windows\System\HkXuBvv.exe
  C:\Windows\System\HkXuBvv.exe
  2⤵
  PID:6260
- C:\Windows\System\lZUsGUh.exe
  C:\Windows\System\lZUsGUh.exe
  2⤵
  PID:6356
- C:\Windows\System\KRCzBeM.exe
  C:\Windows\System\KRCzBeM.exe
  2⤵
  PID:6548
- C:\Windows\System\bhmAzTV.exe
  C:\Windows\System\bhmAzTV.exe
  2⤵
  PID:6744
- C:\Windows\System\vbLPWGF.exe
  C:\Windows\System\vbLPWGF.exe
  2⤵
  PID:7032
- C:\Windows\System\LKjhRxY.exe
  C:\Windows\System\LKjhRxY.exe
  2⤵
  PID:5256
- C:\Windows\System\zNGNycM.exe
  C:\Windows\System\zNGNycM.exe
  2⤵
  PID:1952
- C:\Windows\System\nvloBld.exe
  C:\Windows\System\nvloBld.exe
  2⤵
  PID:6672
- C:\Windows\System\JfttuRc.exe
  C:\Windows\System\JfttuRc.exe
  2⤵
  PID:6716
- C:\Windows\System\UXwHQoQ.exe
  C:\Windows\System\UXwHQoQ.exe
  2⤵
  PID:6804
- C:\Windows\System\elGCDbo.exe
  C:\Windows\System\elGCDbo.exe
  2⤵
  PID:6900
- C:\Windows\System\kvjtEhf.exe
  C:\Windows\System\kvjtEhf.exe
  2⤵
  PID:6944
- C:\Windows\System\vTTzbtT.exe
  C:\Windows\System\vTTzbtT.exe
  2⤵
  PID:7028
- C:\Windows\System\nnvEooM.exe
  C:\Windows\System\nnvEooM.exe
  2⤵
  PID:7092
- C:\Windows\System\ICLGnUD.exe
  C:\Windows\System\ICLGnUD.exe
  2⤵
  PID:7132
- C:\Windows\System\xesHXGi.exe
  C:\Windows\System\xesHXGi.exe
  2⤵
  PID:4764
- C:\Windows\System\yvORwkB.exe
  C:\Windows\System\yvORwkB.exe
  2⤵
  PID:5048
- C:\Windows\System\iAXSmjS.exe
  C:\Windows\System\iAXSmjS.exe
  2⤵
  PID:2636
- C:\Windows\System\onZDuCh.exe
  C:\Windows\System\onZDuCh.exe
  2⤵
  PID:5196
- C:\Windows\System\uphAGNK.exe
  C:\Windows\System\uphAGNK.exe
  2⤵
  PID:3012
- C:\Windows\System\pJNngwL.exe
  C:\Windows\System\pJNngwL.exe
  2⤵
  PID:5596
- C:\Windows\System\HOSTKxf.exe
  C:\Windows\System\HOSTKxf.exe
  2⤵
  PID:6392
- C:\Windows\System\SOamhRc.exe
  C:\Windows\System\SOamhRc.exe
  2⤵
  PID:6492
- C:\Windows\System\ayYWuqz.exe
  C:\Windows\System\ayYWuqz.exe
  2⤵
  PID:7180
- C:\Windows\System\RQnDDzP.exe
  C:\Windows\System\RQnDDzP.exe
  2⤵
  PID:8212
- C:\Windows\System\qXlNiMk.exe
  C:\Windows\System\qXlNiMk.exe
  2⤵
  PID:8232
- C:\Windows\System\AHXWwcx.exe
  C:\Windows\System\AHXWwcx.exe
  2⤵
  PID:8256
- C:\Windows\System\hZowBrb.exe
  C:\Windows\System\hZowBrb.exe
  2⤵
  PID:8280
- C:\Windows\System\lVfKOOJ.exe
  C:\Windows\System\lVfKOOJ.exe
  2⤵
  PID:8296
- C:\Windows\System\frTZzcI.exe
  C:\Windows\System\frTZzcI.exe
  2⤵
  PID:8312
- C:\Windows\System\FouodwL.exe
  C:\Windows\System\FouodwL.exe
  2⤵
  PID:8332
- C:\Windows\System\tubPsVO.exe
  C:\Windows\System\tubPsVO.exe
  2⤵
  PID:8352
- C:\Windows\System\lfCpkzr.exe
  C:\Windows\System\lfCpkzr.exe
  2⤵
  PID:8368
- C:\Windows\System\naxNOOr.exe
  C:\Windows\System\naxNOOr.exe
  2⤵
  PID:8384
- C:\Windows\System\RlpzRXT.exe
  C:\Windows\System\RlpzRXT.exe
  2⤵
  PID:8408
- C:\Windows\System\aNayfIV.exe
  C:\Windows\System\aNayfIV.exe
  2⤵
  PID:8424
- C:\Windows\System\DXYzGeX.exe
  C:\Windows\System\DXYzGeX.exe
  2⤵
  PID:8444
- C:\Windows\System\aOljOPl.exe
  C:\Windows\System\aOljOPl.exe
  2⤵
  PID:8464
- C:\Windows\System\XVQsrVe.exe
  C:\Windows\System\XVQsrVe.exe
  2⤵
  PID:8484
- C:\Windows\System\KCfTznf.exe
  C:\Windows\System\KCfTznf.exe
  2⤵
  PID:8504
- C:\Windows\System\NzRJmbV.exe
  C:\Windows\System\NzRJmbV.exe
  2⤵
  PID:8520
- C:\Windows\System\HptGbPR.exe
  C:\Windows\System\HptGbPR.exe
  2⤵
  PID:8540
- C:\Windows\System\irWlNPr.exe
  C:\Windows\System\irWlNPr.exe
  2⤵
  PID:8560
- C:\Windows\System\sxBRonJ.exe
  C:\Windows\System\sxBRonJ.exe
  2⤵
  PID:8576
- C:\Windows\System\jBxdYDc.exe
  C:\Windows\System\jBxdYDc.exe
  2⤵
  PID:8596
- C:\Windows\System\dDBHAyV.exe
  C:\Windows\System\dDBHAyV.exe
  2⤵
  PID:8616
- C:\Windows\System\jUZyJAx.exe
  C:\Windows\System\jUZyJAx.exe
  2⤵
  PID:8632
- C:\Windows\System\xdCZQWO.exe
  C:\Windows\System\xdCZQWO.exe
  2⤵
  PID:8652
- C:\Windows\System\jbTIpOI.exe
  C:\Windows\System\jbTIpOI.exe
  2⤵
  PID:8672
- C:\Windows\System\eEFrVKQ.exe
  C:\Windows\System\eEFrVKQ.exe
  2⤵
  PID:8688
- C:\Windows\System\RMJOpZC.exe
  C:\Windows\System\RMJOpZC.exe
  2⤵
  PID:8708
- C:\Windows\System\fRlSeUw.exe
  C:\Windows\System\fRlSeUw.exe
  2⤵
  PID:8728
- C:\Windows\System\hDDrbMy.exe
  C:\Windows\System\hDDrbMy.exe
  2⤵
  PID:8748
- C:\Windows\System\SUssdCB.exe
  C:\Windows\System\SUssdCB.exe
  2⤵
  PID:8764
- C:\Windows\System\QjINRXa.exe
  C:\Windows\System\QjINRXa.exe
  2⤵
  PID:8784
- C:\Windows\System\HuBpFLk.exe
  C:\Windows\System\HuBpFLk.exe
  2⤵
  PID:8804
- C:\Windows\System\DxfkUMi.exe
  C:\Windows\System\DxfkUMi.exe
  2⤵
  PID:8820
- C:\Windows\System\RojQaja.exe
  C:\Windows\System\RojQaja.exe
  2⤵
  PID:8836
- C:\Windows\System\qtXHLxr.exe
  C:\Windows\System\qtXHLxr.exe
  2⤵
  PID:8852
- C:\Windows\System\PbfMuOj.exe
  C:\Windows\System\PbfMuOj.exe
  2⤵
  PID:8868
- C:\Windows\System\vgfvDGw.exe
  C:\Windows\System\vgfvDGw.exe
  2⤵
  PID:8888
- C:\Windows\System\jOBFkqY.exe
  C:\Windows\System\jOBFkqY.exe
  2⤵
  PID:8904
- C:\Windows\System\cbwHOni.exe
  C:\Windows\System\cbwHOni.exe
  2⤵
  PID:8924
- C:\Windows\System\tkWhMko.exe
  C:\Windows\System\tkWhMko.exe
  2⤵
  PID:8948
- C:\Windows\System\vpSOsgV.exe
  C:\Windows\System\vpSOsgV.exe
  2⤵
  PID:8968
- C:\Windows\System\LByNfyc.exe
  C:\Windows\System\LByNfyc.exe
  2⤵
  PID:8988
- C:\Windows\System\aKaUnIN.exe
  C:\Windows\System\aKaUnIN.exe
  2⤵
  PID:9008
- C:\Windows\System\aPhagJJ.exe
  C:\Windows\System\aPhagJJ.exe
  2⤵
  PID:9032
- C:\Windows\System\hhIUYSU.exe
  C:\Windows\System\hhIUYSU.exe
  2⤵
  PID:9052
- C:\Windows\System\IIOmhlv.exe
  C:\Windows\System\IIOmhlv.exe
  2⤵
  PID:9072
- C:\Windows\System\ploehzr.exe
  C:\Windows\System\ploehzr.exe
  2⤵
  PID:9088
- C:\Windows\System\qtLKTho.exe
  C:\Windows\System\qtLKTho.exe
  2⤵
  PID:9104
- C:\Windows\System\LpPjREN.exe
  C:\Windows\System\LpPjREN.exe
  2⤵
  PID:9120
- C:\Windows\System\fJkovxk.exe
  C:\Windows\System\fJkovxk.exe
  2⤵
  PID:9388
- C:\Windows\System\mhMrQhg.exe
  C:\Windows\System\mhMrQhg.exe
  2⤵
  PID:9404
- C:\Windows\System\iwahsUI.exe
  C:\Windows\System\iwahsUI.exe
  2⤵
  PID:9420
- C:\Windows\System\TlMBGjn.exe
  C:\Windows\System\TlMBGjn.exe
  2⤵
  PID:9444
- C:\Windows\System\PkKzhUw.exe
  C:\Windows\System\PkKzhUw.exe
  2⤵
  PID:9464
- C:\Windows\System\CDJSkIm.exe
  C:\Windows\System\CDJSkIm.exe
  2⤵
  PID:9480
- C:\Windows\System\jPwBjyX.exe
  C:\Windows\System\jPwBjyX.exe
  2⤵
  PID:9496
- C:\Windows\System\XXIoVva.exe
  C:\Windows\System\XXIoVva.exe
  2⤵
  PID:9520
- C:\Windows\System\eCIVARb.exe
  C:\Windows\System\eCIVARb.exe
  2⤵
  PID:9540
- C:\Windows\System\Ecirhdw.exe
  C:\Windows\System\Ecirhdw.exe
  2⤵
  PID:9556
- C:\Windows\System\zOriaen.exe
  C:\Windows\System\zOriaen.exe
  2⤵
  PID:9576
- C:\Windows\System\GJCrKdT.exe
  C:\Windows\System\GJCrKdT.exe
  2⤵
  PID:9596
- C:\Windows\System\uWvtkAB.exe
  C:\Windows\System\uWvtkAB.exe
  2⤵
  PID:9612
- C:\Windows\System\lYyRJQl.exe
  C:\Windows\System\lYyRJQl.exe
  2⤵
  PID:9636
- C:\Windows\System\nNCareK.exe
  C:\Windows\System\nNCareK.exe
  2⤵
  PID:9656
- C:\Windows\System\NyUeNQh.exe
  C:\Windows\System\NyUeNQh.exe
  2⤵
  PID:9672
- C:\Windows\System\NGKzaoJ.exe
  C:\Windows\System\NGKzaoJ.exe
  2⤵
  PID:9692
- C:\Windows\System\vNOxcPS.exe
  C:\Windows\System\vNOxcPS.exe
  2⤵
  PID:9712
- C:\Windows\System\PgIpolS.exe
  C:\Windows\System\PgIpolS.exe
  2⤵
  PID:9732
- C:\Windows\System\uraMWFn.exe
  C:\Windows\System\uraMWFn.exe
  2⤵
  PID:9748
- C:\Windows\System\LwMIQiB.exe
  C:\Windows\System\LwMIQiB.exe
  2⤵
  PID:9780
- C:\Windows\System\fSGyOoo.exe
  C:\Windows\System\fSGyOoo.exe
  2⤵
  PID:9800
- C:\Windows\System\ZBjYUKU.exe
  C:\Windows\System\ZBjYUKU.exe
  2⤵
  PID:9816
- C:\Windows\System\uYElQVp.exe
  C:\Windows\System\uYElQVp.exe
  2⤵
  PID:9832
- C:\Windows\System\NIqYLjU.exe
  C:\Windows\System\NIqYLjU.exe
  2⤵
  PID:9856
- C:\Windows\System\HHJWKPy.exe
  C:\Windows\System\HHJWKPy.exe
  2⤵
  PID:9872
- C:\Windows\System\fAyqsxU.exe
  C:\Windows\System\fAyqsxU.exe
  2⤵
  PID:9896
- C:\Windows\System\RwoHOOi.exe
  C:\Windows\System\RwoHOOi.exe
  2⤵
  PID:9912
- C:\Windows\System\xsGLrLw.exe
  C:\Windows\System\xsGLrLw.exe
  2⤵
  PID:9932
- C:\Windows\System\lDYnOaY.exe
  C:\Windows\System\lDYnOaY.exe
  2⤵
  PID:9948
- C:\Windows\System\jsxbtxw.exe
  C:\Windows\System\jsxbtxw.exe
  2⤵
  PID:9964
- C:\Windows\System\vOkValZ.exe
  C:\Windows\System\vOkValZ.exe
  2⤵
  PID:9980
- C:\Windows\System\QctcVNF.exe
  C:\Windows\System\QctcVNF.exe
  2⤵
  PID:10008
- C:\Windows\System\HKfgHxP.exe
  C:\Windows\System\HKfgHxP.exe
  2⤵
  PID:10032
- C:\Windows\System\kbcZWzr.exe
  C:\Windows\System\kbcZWzr.exe
  2⤵
  PID:10060
- C:\Windows\System\awUgHvL.exe
  C:\Windows\System\awUgHvL.exe
  2⤵
  PID:10092
- C:\Windows\System\zqdoDgC.exe
  C:\Windows\System\zqdoDgC.exe
  2⤵
  PID:10120
- C:\Windows\System\KprrcpR.exe
  C:\Windows\System\KprrcpR.exe
  2⤵
  PID:10152
- C:\Windows\System\OSsLxOf.exe
  C:\Windows\System\OSsLxOf.exe
  2⤵
  PID:10184
- C:\Windows\System\KfkYrWe.exe
  C:\Windows\System\KfkYrWe.exe
  2⤵
  PID:10204
- C:\Windows\System\hscEAbf.exe
  C:\Windows\System\hscEAbf.exe
  2⤵
  PID:7984
- C:\Windows\System\DNjgzej.exe
  C:\Windows\System\DNjgzej.exe
  2⤵
  PID:8156
- C:\Windows\System\ThZXTvM.exe
  C:\Windows\System\ThZXTvM.exe
  2⤵
  PID:5216
- C:\Windows\System\jifGKoS.exe
  C:\Windows\System\jifGKoS.exe
  2⤵
  PID:5628
- C:\Windows\System\uCURIlD.exe
  C:\Windows\System\uCURIlD.exe
  2⤵
  PID:4728
- C:\Windows\System\yiaPisu.exe
  C:\Windows\System\yiaPisu.exe
  2⤵
  PID:1068
- C:\Windows\System\qWHzOxF.exe
  C:\Windows\System\qWHzOxF.exe
  2⤵
  PID:6868
- C:\Windows\System\bsnpjkO.exe
  C:\Windows\System\bsnpjkO.exe
  2⤵
  PID:7000
- C:\Windows\System\lIQPNwA.exe
  C:\Windows\System\lIQPNwA.exe
  2⤵
  PID:4012
- C:\Windows\System\FCEaAQE.exe
  C:\Windows\System\FCEaAQE.exe
  2⤵
  PID:10256
- C:\Windows\System\rmTFHSf.exe
  C:\Windows\System\rmTFHSf.exe
  2⤵
  PID:10292
- C:\Windows\System\uvEOzgs.exe
  C:\Windows\System\uvEOzgs.exe
  2⤵
  PID:10316
- C:\Windows\System\RIbSwKQ.exe
  C:\Windows\System\RIbSwKQ.exe
  2⤵
  PID:10336
- C:\Windows\System\TFftBMz.exe
  C:\Windows\System\TFftBMz.exe
  2⤵
  PID:10352
- C:\Windows\System\amputai.exe
  C:\Windows\System\amputai.exe
  2⤵
  PID:10376
- C:\Windows\System\BOgyezI.exe
  C:\Windows\System\BOgyezI.exe
  2⤵
  PID:10392
- C:\Windows\System\xtBqRVL.exe
  C:\Windows\System\xtBqRVL.exe
  2⤵
  PID:10408
- C:\Windows\System\KtDErRS.exe
  C:\Windows\System\KtDErRS.exe
  2⤵
  PID:10424
- C:\Windows\System\fYWhGif.exe
  C:\Windows\System\fYWhGif.exe
  2⤵
  PID:10440
- C:\Windows\System\UwzYmJf.exe
  C:\Windows\System\UwzYmJf.exe
  2⤵
  PID:10456
- C:\Windows\System\LRGCURG.exe
  C:\Windows\System\LRGCURG.exe
  2⤵
  PID:10476
- C:\Windows\System\iBKMdrU.exe
  C:\Windows\System\iBKMdrU.exe
  2⤵
  PID:10496
- C:\Windows\System\VZSsVIb.exe
  C:\Windows\System\VZSsVIb.exe
  2⤵
  PID:10516
- C:\Windows\System\IqofcoI.exe
  C:\Windows\System\IqofcoI.exe
  2⤵
  PID:10536
- C:\Windows\System\JozCQZV.exe
  C:\Windows\System\JozCQZV.exe
  2⤵
  PID:10556
- C:\Windows\System\LPESnbc.exe
  C:\Windows\System\LPESnbc.exe
  2⤵
  PID:10576
- C:\Windows\System\vFVKDVj.exe
  C:\Windows\System\vFVKDVj.exe
  2⤵
  PID:10592
- C:\Windows\System\AmISkcT.exe
  C:\Windows\System\AmISkcT.exe
  2⤵
  PID:10612
- C:\Windows\System\MziuUPP.exe
  C:\Windows\System\MziuUPP.exe
  2⤵
  PID:10628
- C:\Windows\System\nBvzSTP.exe
  C:\Windows\System\nBvzSTP.exe
  2⤵
  PID:10644
- C:\Windows\System\EadninE.exe
  C:\Windows\System\EadninE.exe
  2⤵
  PID:10668
- C:\Windows\System\TLtcJYd.exe
  C:\Windows\System\TLtcJYd.exe
  2⤵
  PID:10684
- C:\Windows\System\UEIUvxN.exe
  C:\Windows\System\UEIUvxN.exe
  2⤵
  PID:10704
- C:\Windows\System\QKoQalX.exe
  C:\Windows\System\QKoQalX.exe
  2⤵
  PID:10724
- C:\Windows\System\vEARDsm.exe
  C:\Windows\System\vEARDsm.exe
  2⤵
  PID:10740
- C:\Windows\System\IjRWXOj.exe
  C:\Windows\System\IjRWXOj.exe
  2⤵
  PID:10756
- C:\Windows\System\GneZZzv.exe
  C:\Windows\System\GneZZzv.exe
  2⤵
  PID:10772
- C:\Windows\System\LOiuKxg.exe
  C:\Windows\System\LOiuKxg.exe
  2⤵
  PID:10788
- C:\Windows\System\AiFacmF.exe
  C:\Windows\System\AiFacmF.exe
  2⤵
  PID:10812
- C:\Windows\System\xveZUEo.exe
  C:\Windows\System\xveZUEo.exe
  2⤵
  PID:10836
- C:\Windows\System\jxeyujY.exe
  C:\Windows\System\jxeyujY.exe
  2⤵
  PID:10856
- C:\Windows\System\WZWoriS.exe
  C:\Windows\System\WZWoriS.exe
  2⤵
  PID:10880
- C:\Windows\System\oSwEwSi.exe
  C:\Windows\System\oSwEwSi.exe
  2⤵
  PID:10896
- C:\Windows\System\bDjttpd.exe
  C:\Windows\System\bDjttpd.exe
  2⤵
  PID:10964
- C:\Windows\System\rziyobj.exe
  C:\Windows\System\rziyobj.exe
  2⤵
  PID:10980
- C:\Windows\System\DMFBLeP.exe
  C:\Windows\System\DMFBLeP.exe
  2⤵
  PID:10996
- C:\Windows\System\WfgQScy.exe
  C:\Windows\System\WfgQScy.exe
  2⤵
  PID:11012
- C:\Windows\System\tdGyxye.exe
  C:\Windows\System\tdGyxye.exe
  2⤵
  PID:11028
- C:\Windows\System\OOCcFFS.exe
  C:\Windows\System\OOCcFFS.exe
  2⤵
  PID:11044
- C:\Windows\System\STfoaPR.exe
  C:\Windows\System\STfoaPR.exe
  2⤵
  PID:11060
- C:\Windows\System\nomEOUV.exe
  C:\Windows\System\nomEOUV.exe
  2⤵
  PID:11076
- C:\Windows\System\cftbYdh.exe
  C:\Windows\System\cftbYdh.exe
  2⤵
  PID:11096
- C:\Windows\System\kcpPbPn.exe
  C:\Windows\System\kcpPbPn.exe
  2⤵
  PID:11116
- C:\Windows\System\NpXUexf.exe
  C:\Windows\System\NpXUexf.exe
  2⤵
  PID:11132
- C:\Windows\System\IhOCuPV.exe
  C:\Windows\System\IhOCuPV.exe
  2⤵
  PID:11148
- C:\Windows\System\zJTHFVb.exe
  C:\Windows\System\zJTHFVb.exe
  2⤵
  PID:11164
- C:\Windows\System\PyYeAdz.exe
  C:\Windows\System\PyYeAdz.exe
  2⤵
  PID:11180
- C:\Windows\System\brivgLH.exe
  C:\Windows\System\brivgLH.exe
  2⤵
  PID:11196
- C:\Windows\System\aYKzART.exe
  C:\Windows\System\aYKzART.exe
  2⤵
  PID:11216
- C:\Windows\System\pCgDYrZ.exe
  C:\Windows\System\pCgDYrZ.exe
  2⤵
  PID:11232
- C:\Windows\System\ieGISWo.exe
  C:\Windows\System\ieGISWo.exe
  2⤵
  PID:11252
- C:\Windows\System\Baptchb.exe
  C:\Windows\System\Baptchb.exe
  2⤵
  PID:8224
- C:\Windows\System\QokQxvI.exe
  C:\Windows\System\QokQxvI.exe
  2⤵
  PID:8324
- C:\Windows\System\vHFInYx.exe
  C:\Windows\System\vHFInYx.exe
  2⤵
  PID:8396
- C:\Windows\System\vwGGTPY.exe
  C:\Windows\System\vwGGTPY.exe
  2⤵
  PID:8496
- C:\Windows\System\dtiqggj.exe
  C:\Windows\System\dtiqggj.exe
  2⤵
  PID:8528
- C:\Windows\System\qYRRkpd.exe
  C:\Windows\System\qYRRkpd.exe
  2⤵
  PID:8816
- C:\Windows\System\dDJxEFW.exe
  C:\Windows\System\dDJxEFW.exe
  2⤵
  PID:8920
- C:\Windows\System\CrhlWIo.exe
  C:\Windows\System\CrhlWIo.exe
  2⤵
  PID:8976
- C:\Windows\System\juHqHAI.exe
  C:\Windows\System\juHqHAI.exe
  2⤵
  PID:9020
- C:\Windows\System\dgTINXi.exe
  C:\Windows\System\dgTINXi.exe
  2⤵
  PID:9048
- C:\Windows\System\efmHanY.exe
  C:\Windows\System\efmHanY.exe
  2⤵
  PID:8012
- C:\Windows\System\EvUGwog.exe
  C:\Windows\System\EvUGwog.exe
  2⤵
  PID:1940
- C:\Windows\System\Kqrbwrl.exe
  C:\Windows\System\Kqrbwrl.exe
  2⤵
  PID:6320
- C:\Windows\System\pYikuXk.exe
  C:\Windows\System\pYikuXk.exe
  2⤵
  PID:5456
- C:\Windows\System\JEhZIKc.exe
  C:\Windows\System\JEhZIKc.exe
  2⤵
  PID:2308
- C:\Windows\System\IIuezSD.exe
  C:\Windows\System\IIuezSD.exe
  2⤵
  PID:6520
- C:\Windows\System\pHKoRrK.exe
  C:\Windows\System\pHKoRrK.exe
  2⤵
  PID:8264
- C:\Windows\System\bLVSkgT.exe
  C:\Windows\System\bLVSkgT.exe
  2⤵
  PID:10324
- C:\Windows\System\uLSZGJx.exe
  C:\Windows\System\uLSZGJx.exe
  2⤵
  PID:10364
- C:\Windows\System\dZetfDF.exe
  C:\Windows\System\dZetfDF.exe
  2⤵
  PID:10432
- C:\Windows\System\zaeATDO.exe
  C:\Windows\System\zaeATDO.exe
  2⤵
  PID:10492
- C:\Windows\System\CaUBQMz.exe
  C:\Windows\System\CaUBQMz.exe
  2⤵
  PID:10696
- C:\Windows\System\vijcSxe.exe
  C:\Windows\System\vijcSxe.exe
  2⤵
  PID:11288
- C:\Windows\System\ugARVJE.exe
  C:\Windows\System\ugARVJE.exe
  2⤵
  PID:11312
- C:\Windows\System\WJsDJtS.exe
  C:\Windows\System\WJsDJtS.exe
  2⤵
  PID:11328
- C:\Windows\System\cSotFwG.exe
  C:\Windows\System\cSotFwG.exe
  2⤵
  PID:11344
- C:\Windows\System\PMlXZTd.exe
  C:\Windows\System\PMlXZTd.exe
  2⤵
  PID:11360
- C:\Windows\System\amWdZuA.exe
  C:\Windows\System\amWdZuA.exe
  2⤵
  PID:11380
- C:\Windows\System\wTmJVls.exe
  C:\Windows\System\wTmJVls.exe
  2⤵
  PID:11404
- C:\Windows\System\DjbEIkU.exe
  C:\Windows\System\DjbEIkU.exe
  2⤵
  PID:11420
- C:\Windows\System\FtVfkmX.exe
  C:\Windows\System\FtVfkmX.exe
  2⤵
  PID:11448
- C:\Windows\System\VxRbhTr.exe
  C:\Windows\System\VxRbhTr.exe
  2⤵
  PID:11472
- C:\Windows\System\LaRNwQK.exe
  C:\Windows\System\LaRNwQK.exe
  2⤵
  PID:11488
- C:\Windows\System\XLbXnwU.exe
  C:\Windows\System\XLbXnwU.exe
  2⤵
  PID:11512
- C:\Windows\System\qXlJnLm.exe
  C:\Windows\System\qXlJnLm.exe
  2⤵
  PID:11528
- C:\Windows\System\VGstWUE.exe
  C:\Windows\System\VGstWUE.exe
  2⤵
  PID:11552
- C:\Windows\System\ZKJbGVN.exe
  C:\Windows\System\ZKJbGVN.exe
  2⤵
  PID:11572
- C:\Windows\System\pGeeMlq.exe
  C:\Windows\System\pGeeMlq.exe
  2⤵
  PID:11588
- C:\Windows\System\KXSAXyf.exe
  C:\Windows\System\KXSAXyf.exe
  2⤵
  PID:11608
- C:\Windows\System\qyWNUOo.exe
  C:\Windows\System\qyWNUOo.exe
  2⤵
  PID:11628
- C:\Windows\System\PMOXcEt.exe
  C:\Windows\System\PMOXcEt.exe
  2⤵
  PID:11660
- C:\Windows\System\uJxQHSL.exe
  C:\Windows\System\uJxQHSL.exe
  2⤵
  PID:11680
- C:\Windows\System\LZvKDJx.exe
  C:\Windows\System\LZvKDJx.exe
  2⤵
  PID:11696
- C:\Windows\System\EBSrcUg.exe
  C:\Windows\System\EBSrcUg.exe
  2⤵
  PID:11720
- C:\Windows\System\zggtIZX.exe
  C:\Windows\System\zggtIZX.exe
  2⤵
  PID:11744
- C:\Windows\System\fEPfJlg.exe
  C:\Windows\System\fEPfJlg.exe
  2⤵
  PID:11772
- C:\Windows\System\NtyhWhL.exe
  C:\Windows\System\NtyhWhL.exe
  2⤵
  PID:11792
- C:\Windows\System\QASwatQ.exe
  C:\Windows\System\QASwatQ.exe
  2⤵
  PID:11812
- C:\Windows\System\SaHAqrz.exe
  C:\Windows\System\SaHAqrz.exe
  2⤵
  PID:11836
- C:\Windows\System\cLvvjxn.exe
  C:\Windows\System\cLvvjxn.exe
  2⤵
  PID:11856
- C:\Windows\System\fTsNfUv.exe
  C:\Windows\System\fTsNfUv.exe
  2⤵
  PID:11876
- C:\Windows\System\GguNgWv.exe
  C:\Windows\System\GguNgWv.exe
  2⤵
  PID:11900
- C:\Windows\System\llvhBeX.exe
  C:\Windows\System\llvhBeX.exe
  2⤵
  PID:11920
- C:\Windows\System\OfZSAJY.exe
  C:\Windows\System\OfZSAJY.exe
  2⤵
  PID:11940
- C:\Windows\System\YHkaidj.exe
  C:\Windows\System\YHkaidj.exe
  2⤵
  PID:11964
- C:\Windows\System\XeShqzx.exe
  C:\Windows\System\XeShqzx.exe
  2⤵
  PID:11988
- C:\Windows\System\RLjlbDA.exe
  C:\Windows\System\RLjlbDA.exe
  2⤵
  PID:12004
- C:\Windows\System\qkIQmRO.exe
  C:\Windows\System\qkIQmRO.exe
  2⤵
  PID:12020
- C:\Windows\System\NdeKKvu.exe
  C:\Windows\System\NdeKKvu.exe
  2⤵
  PID:12036
- C:\Windows\System\tpDynbb.exe
  C:\Windows\System\tpDynbb.exe
  2⤵
  PID:12052
- C:\Windows\System\JafWjRK.exe
  C:\Windows\System\JafWjRK.exe
  2⤵
  PID:12068
- C:\Windows\System\jWsVreh.exe
  C:\Windows\System\jWsVreh.exe
  2⤵
  PID:12084
- C:\Windows\System\FuONoLi.exe
  C:\Windows\System\FuONoLi.exe
  2⤵
  PID:12100
- C:\Windows\System\JoZHWkF.exe
  C:\Windows\System\JoZHWkF.exe
  2⤵
  PID:12132
- C:\Windows\System\RIOMRPv.exe
  C:\Windows\System\RIOMRPv.exe
  2⤵
  PID:12148
- C:\Windows\System\PoeMAoM.exe
  C:\Windows\System\PoeMAoM.exe
  2⤵
  PID:12168
- C:\Windows\System\zvqSegb.exe
  C:\Windows\System\zvqSegb.exe
  2⤵
  PID:12184
- C:\Windows\System\zNLKCkK.exe
  C:\Windows\System\zNLKCkK.exe
  2⤵
  PID:12204
- C:\Windows\System\RifOjeL.exe
  C:\Windows\System\RifOjeL.exe
  2⤵
  PID:12228
- C:\Windows\System\IcgMtRA.exe
  C:\Windows\System\IcgMtRA.exe
  2⤵
  PID:12248
- C:\Windows\System\fbsGZSN.exe
  C:\Windows\System\fbsGZSN.exe
  2⤵
  PID:12272
- C:\Windows\System\rVVdarZ.exe
  C:\Windows\System\rVVdarZ.exe
  2⤵
  PID:10720
- C:\Windows\System\rSdBNyP.exe
  C:\Windows\System\rSdBNyP.exe
  2⤵
  PID:8740
- C:\Windows\System\hRIEvtG.exe
  C:\Windows\System\hRIEvtG.exe
  2⤵
  PID:8860
- C:\Windows\System\bHgydrU.exe
  C:\Windows\System\bHgydrU.exe
  2⤵
  PID:8936
- C:\Windows\System\irQbjGp.exe
  C:\Windows\System\irQbjGp.exe
  2⤵
  PID:10872
- C:\Windows\System\qzMkHCR.exe
  C:\Windows\System\qzMkHCR.exe
  2⤵
  PID:7408
- C:\Windows\System\KblQlDD.exe
  C:\Windows\System\KblQlDD.exe
  2⤵
  PID:7440
- C:\Windows\System\ZroSZYk.exe
  C:\Windows\System\ZroSZYk.exe
  2⤵
  PID:7488
- C:\Windows\System\MaeVsWq.exe
  C:\Windows\System\MaeVsWq.exe
  2⤵
  PID:7524
- C:\Windows\System\KVkdiJP.exe
  C:\Windows\System\KVkdiJP.exe
  2⤵
  PID:7568
- C:\Windows\System\JGTUXNk.exe
  C:\Windows\System\JGTUXNk.exe
  2⤵
  PID:7604
- C:\Windows\System\NwnsSks.exe
  C:\Windows\System\NwnsSks.exe
  2⤵
  PID:7648
- C:\Windows\System\IWgpuHc.exe
  C:\Windows\System\IWgpuHc.exe
  2⤵
  PID:7764
- C:\Windows\System\MFuOgNW.exe
  C:\Windows\System\MFuOgNW.exe
  2⤵
  PID:7976
- C:\Windows\System\cYhHaQI.exe
  C:\Windows\System\cYhHaQI.exe
  2⤵
  PID:8016
- C:\Windows\System\PiIyAxM.exe
  C:\Windows\System\PiIyAxM.exe
  2⤵
  PID:8036
- C:\Windows\System\uNLvypC.exe
  C:\Windows\System\uNLvypC.exe
  2⤵
  PID:8060
- C:\Windows\System\lhBvWKO.exe
  C:\Windows\System\lhBvWKO.exe
  2⤵
  PID:8112
- C:\Windows\System\IiTBUUg.exe
  C:\Windows\System\IiTBUUg.exe
  2⤵
  PID:5280
- C:\Windows\System\dxSxNVX.exe
  C:\Windows\System\dxSxNVX.exe
  2⤵
  PID:5388
- C:\Windows\System\BhRNbFA.exe
  C:\Windows\System\BhRNbFA.exe
  2⤵
  PID:6060
- C:\Windows\System\mdFWlXb.exe
  C:\Windows\System\mdFWlXb.exe
  2⤵
  PID:6332
- C:\Windows\System\ZoVzpam.exe
  C:\Windows\System\ZoVzpam.exe
  2⤵
  PID:6632
- C:\Windows\System\ISkeHYq.exe
  C:\Windows\System\ISkeHYq.exe
  2⤵
  PID:6844
- C:\Windows\System\ycVkBvd.exe
  C:\Windows\System\ycVkBvd.exe
  2⤵
  PID:11004
- C:\Windows\System\pjexrTO.exe
  C:\Windows\System\pjexrTO.exe
  2⤵
  PID:5740
- C:\Windows\System\SzYTPMA.exe
  C:\Windows\System\SzYTPMA.exe
  2⤵
  PID:11160
- C:\Windows\System\HoOQhAU.exe
  C:\Windows\System\HoOQhAU.exe
  2⤵
  PID:1728
- C:\Windows\System\YsvUiUG.exe
  C:\Windows\System\YsvUiUG.exe
  2⤵
  PID:10552
- C:\Windows\System\jBOhscf.exe
  C:\Windows\System\jBOhscf.exe
  2⤵
  PID:10584
- C:\Windows\System\WTTzysM.exe
  C:\Windows\System\WTTzysM.exe
  2⤵
  PID:8556
- C:\Windows\System\dKENpLa.exe
  C:\Windows\System\dKENpLa.exe
  2⤵
  PID:10608
- C:\Windows\System\PEosaVt.exe
  C:\Windows\System\PEosaVt.exe
  2⤵
  PID:8660
- C:\Windows\System\HalNqRf.exe
  C:\Windows\System\HalNqRf.exe
  2⤵
  PID:8704
- C:\Windows\System\MrEWAyO.exe
  C:\Windows\System\MrEWAyO.exe
  2⤵
  PID:10636
- C:\Windows\System\jSXMLxw.exe
  C:\Windows\System\jSXMLxw.exe
  2⤵
  PID:4364
- C:\Windows\System\fFygaeW.exe
  C:\Windows\System\fFygaeW.exe
  2⤵
  PID:10400
- C:\Windows\System\kEIZRYb.exe
  C:\Windows\System\kEIZRYb.exe
  2⤵
  PID:10700
- C:\Windows\System\hHZvumg.exe
  C:\Windows\System\hHZvumg.exe
  2⤵
  PID:8724
- C:\Windows\System\TCeQylo.exe
  C:\Windows\System\TCeQylo.exe
  2⤵
  PID:10736
- C:\Windows\System\qPTcjTN.exe
  C:\Windows\System\qPTcjTN.exe
  2⤵
  PID:8876
- C:\Windows\System\QJxdVVg.exe
  C:\Windows\System\QJxdVVg.exe
  2⤵
  PID:11412
- C:\Windows\System\upsFjLc.exe
  C:\Windows\System\upsFjLc.exe
  2⤵
  PID:12320
- C:\Windows\System\EkNBZRv.exe
  C:\Windows\System\EkNBZRv.exe
  2⤵
  PID:12336
- C:\Windows\System\siNsftQ.exe
  C:\Windows\System\siNsftQ.exe
  2⤵
  PID:12352
- C:\Windows\System\VtMNuCo.exe
  C:\Windows\System\VtMNuCo.exe
  2⤵
  PID:12376
- C:\Windows\System\ongGTVw.exe
  C:\Windows\System\ongGTVw.exe
  2⤵
  PID:12396
- C:\Windows\System\AWAIexB.exe
  C:\Windows\System\AWAIexB.exe
  2⤵
  PID:12416
- C:\Windows\System\nKArILD.exe
  C:\Windows\System\nKArILD.exe
  2⤵
  PID:12444
- C:\Windows\System\WxuIAGD.exe
  C:\Windows\System\WxuIAGD.exe
  2⤵
  PID:12464
- C:\Windows\System\wZAyAXq.exe
  C:\Windows\System\wZAyAXq.exe
  2⤵
  PID:12492
- C:\Windows\System\rNtmPvb.exe
  C:\Windows\System\rNtmPvb.exe
  2⤵
  PID:12512
- C:\Windows\System\mfBzLso.exe
  C:\Windows\System\mfBzLso.exe
  2⤵
  PID:12536
- C:\Windows\System\njBDIbp.exe
  C:\Windows\System\njBDIbp.exe
  2⤵
  PID:12556
- C:\Windows\System\PLmFyMs.exe
  C:\Windows\System\PLmFyMs.exe
  2⤵
  PID:12580
- C:\Windows\System\poRiKfP.exe
  C:\Windows\System\poRiKfP.exe
  2⤵
  PID:12600
- C:\Windows\System\hpKqydp.exe
  C:\Windows\System\hpKqydp.exe
  2⤵
  PID:12628
- C:\Windows\System\dpQging.exe
  C:\Windows\System\dpQging.exe
  2⤵
  PID:12648
- C:\Windows\System\bzRrJRI.exe
  C:\Windows\System\bzRrJRI.exe
  2⤵
  PID:12668
- C:\Windows\System\pceFTui.exe
  C:\Windows\System\pceFTui.exe
  2⤵
  PID:12692
- C:\Windows\System\JxNPbbH.exe
  C:\Windows\System\JxNPbbH.exe
  2⤵
  PID:12712
- C:\Windows\System\RqWulAL.exe
  C:\Windows\System\RqWulAL.exe
  2⤵
  PID:12728
- C:\Windows\System\UInwHPp.exe
  C:\Windows\System\UInwHPp.exe
  2⤵
  PID:12744
- C:\Windows\System\HUlDxWk.exe
  C:\Windows\System\HUlDxWk.exe
  2⤵
  PID:12760
- C:\Windows\System\EqRTliW.exe
  C:\Windows\System\EqRTliW.exe
  2⤵
  PID:12776
- C:\Windows\System\GjNCXDQ.exe
  C:\Windows\System\GjNCXDQ.exe
  2⤵
  PID:12792
- C:\Windows\System\yTPPgrO.exe
  C:\Windows\System\yTPPgrO.exe
  2⤵
  PID:12808
- C:\Windows\System\XvnzRyt.exe
  C:\Windows\System\XvnzRyt.exe
  2⤵
  PID:12832
- C:\Windows\System\OKHqnGn.exe
  C:\Windows\System\OKHqnGn.exe
  2⤵
  PID:12892
- C:\Windows\System\PzbsBqB.exe
  C:\Windows\System\PzbsBqB.exe
  2⤵
  PID:12916
- C:\Windows\System\llIdMVs.exe
  C:\Windows\System\llIdMVs.exe
  2⤵
  PID:12940
- C:\Windows\System\FYIZfze.exe
  C:\Windows\System\FYIZfze.exe
  2⤵
  PID:848
- C:\Windows\System\IVQBGyQ.exe
  C:\Windows\System\IVQBGyQ.exe
  2⤵
  PID:11308
- C:\Windows\System\bfZnqLG.exe
  C:\Windows\System\bfZnqLG.exe
  2⤵
  PID:11356
- C:\Windows\System\EmxbjZL.exe
  C:\Windows\System\EmxbjZL.exe
  2⤵
  PID:11460
- C:\Windows\System\HxANSVQ.exe
  C:\Windows\System\HxANSVQ.exe
  2⤵
  PID:11912
- C:\Windows\System\gLGnKTo.exe
  C:\Windows\System\gLGnKTo.exe
  2⤵
  PID:12244
- C:\Windows\System\yjfPLtY.exe
  C:\Windows\System\yjfPLtY.exe
  2⤵
  PID:8000
- C:\Windows\System\zRqYucx.exe
  C:\Windows\System\zRqYucx.exe
  2⤵
  PID:8172
- C:\Windows\System\ZFJlnAE.exe
  C:\Windows\System\ZFJlnAE.exe
  2⤵
  PID:12924
- C:\Windows\System\uHBcDaJ.exe
  C:\Windows\System\uHBcDaJ.exe
  2⤵
  PID:13000
- C:\Windows\System\fHxwzet.exe
  C:\Windows\System\fHxwzet.exe
  2⤵
  PID:13208
- C:\Windows\System\hAiBxyb.exe
  C:\Windows\System\hAiBxyb.exe
  2⤵
  PID:13188
- C:\Windows\System\suXplbG.exe
  C:\Windows\System\suXplbG.exe
  2⤵
  PID:13260
- C:\Windows\System\VnkLBwm.exe
  C:\Windows\System\VnkLBwm.exe
  2⤵
  PID:11716
- C:\Windows\System\iusdhFi.exe
  C:\Windows\System\iusdhFi.exe
  2⤵
  PID:12284
- C:\Windows\System\oPTJGoi.exe
  C:\Windows\System\oPTJGoi.exe
  2⤵
  PID:9488
- C:\Windows\System\DjaJzxi.exe
  C:\Windows\System\DjaJzxi.exe
  2⤵
  PID:9572
- C:\Windows\System\JAmdURt.exe
  C:\Windows\System\JAmdURt.exe
  2⤵
  PID:9652
- C:\Windows\System\eQYCimL.exe
  C:\Windows\System\eQYCimL.exe
  2⤵
  PID:9760
- C:\Windows\System\yDoRAJW.exe
  C:\Windows\System\yDoRAJW.exe
  2⤵
  PID:10844
- C:\Windows\System\rsAEnhd.exe
  C:\Windows\System\rsAEnhd.exe
  2⤵
  PID:9956
- C:\Windows\System\KZWiORz.exe
  C:\Windows\System\KZWiORz.exe
  2⤵
  PID:6800
- C:\Windows\System\lDMXzMd.exe
  C:\Windows\System\lDMXzMd.exe
  2⤵
  PID:12524
- C:\Windows\System\vzjoIXu.exe
  C:\Windows\System\vzjoIXu.exe
  2⤵
  PID:13164
- C:\Windows\System\COZejCR.exe
  C:\Windows\System\COZejCR.exe
  2⤵
  PID:12044
- C:\Windows\System\dswmGiA.exe
  C:\Windows\System\dswmGiA.exe
  2⤵
  PID:11692
- C:\Windows\System\DthrpdJ.exe
  C:\Windows\System\DthrpdJ.exe
  2⤵
  PID:7632
- C:\Windows\System\PyATHnF.exe
  C:\Windows\System\PyATHnF.exe
  2⤵
  PID:11500
- C:\Windows\System\NhtaulC.exe
  C:\Windows\System\NhtaulC.exe
  2⤵
  PID:9756
- C:\Windows\System\UVpVvLr.exe
  C:\Windows\System\UVpVvLr.exe
  2⤵
  PID:9924
- C:\Windows\System\fevheoU.exe
  C:\Windows\System\fevheoU.exe
  2⤵
  PID:13108
- C:\Windows\System\mWIZMNS.exe
  C:\Windows\System\mWIZMNS.exe
  2⤵
  PID:3708
- C:\Windows\System\HDIXIzG.exe
  C:\Windows\System\HDIXIzG.exe
  2⤵
  PID:13180
- C:\Windows\System\gYFklkl.exe
  C:\Windows\System\gYFklkl.exe
  2⤵
  PID:5988
- C:\Windows\System\JyDvDKP.exe
  C:\Windows\System\JyDvDKP.exe
  2⤵
  PID:13248
- C:\Windows\System\LmGJRbK.exe
  C:\Windows\System\LmGJRbK.exe
  2⤵
  PID:13252
- C:\Windows\System\fmKOteR.exe
  C:\Windows\System\fmKOteR.exe
  2⤵
  PID:468
- C:\Windows\System\kTttuJR.exe
  C:\Windows\System\kTttuJR.exe
  2⤵
  PID:8572
- C:\Windows\System\zCXQbvU.exe
  C:\Windows\System\zCXQbvU.exe
  2⤵
  PID:12784
- C:\Windows\System\xarQKyl.exe
  C:\Windows\System\xarQKyl.exe
  2⤵
  PID:12080
- C:\Windows\System\ZLGzyiz.exe
  C:\Windows\System\ZLGzyiz.exe
  2⤵
  PID:3620
- C:\Windows\System\xSxNFEi.exe
  C:\Windows\System\xSxNFEi.exe
  2⤵
  PID:9880
- C:\Windows\System\LExyNnx.exe
  C:\Windows\System\LExyNnx.exe
  2⤵
  PID:8480
- C:\Windows\System\JfjwrcQ.exe
  C:\Windows\System\JfjwrcQ.exe
  2⤵
  PID:12432
- C:\Windows\System\IrbQEBr.exe
  C:\Windows\System\IrbQEBr.exe
  2⤵
  PID:10508
- C:\Windows\System\pjfZHlI.exe
  C:\Windows\System\pjfZHlI.exe
  2⤵
  PID:11056
- C:\Windows\System\gKMwhUg.exe
  C:\Windows\System\gKMwhUg.exe
  2⤵
  PID:11520
- C:\Windows\System\XFTPuWr.exe
  C:\Windows\System\XFTPuWr.exe
  2⤵
  PID:13240
- C:\Windows\System\ISFNjSt.exe
  C:\Windows\System\ISFNjSt.exe
  2⤵
  PID:13236
- C:\Windows\System\JjvRYtz.exe
  C:\Windows\System\JjvRYtz.exe
  2⤵
  PID:11960
- C:\Windows\System\gyykRWk.exe
  C:\Windows\System\gyykRWk.exe
  2⤵
  PID:10972
- C:\Windows\System\lRPwMuU.exe
  C:\Windows\System\lRPwMuU.exe
  2⤵
  PID:11688
- C:\Windows\System\yjQaLmH.exe
  C:\Windows\System\yjQaLmH.exe
  2⤵
  PID:12660
- C:\Windows\System\HDyvHAL.exe
  C:\Windows\System\HDyvHAL.exe
  2⤵
  PID:11400
- C:\Windows\System\mbKLlQr.exe
  C:\Windows\System\mbKLlQr.exe
  2⤵
  PID:12332
- C:\Windows\System\JcsaJAu.exe
  C:\Windows\System\JcsaJAu.exe
  2⤵
  PID:12620
- C:\Windows\System\lhhWQZB.exe
  C:\Windows\System\lhhWQZB.exe
  2⤵
  PID:12220
- C:\Windows\System\rnXPSCt.exe
  C:\Windows\System\rnXPSCt.exe
  2⤵
  PID:12956
- C:\Windows\System\YwrULvZ.exe
  C:\Windows\System\YwrULvZ.exe
  2⤵
  PID:13128
- C:\Windows\System\ZYNTSWD.exe
  C:\Windows\System\ZYNTSWD.exe
  2⤵
  PID:11712
- C:\Windows\System\cHXLgmt.exe
  C:\Windows\System\cHXLgmt.exe
  2⤵
  PID:9460
- C:\Windows\System\mZikeod.exe
  C:\Windows\System\mZikeod.exe
  2⤵
  PID:9604
- C:\Windows\System\zjEFeuN.exe
  C:\Windows\System\zjEFeuN.exe
  2⤵
  PID:9812
- C:\Windows\System\hNNKSfO.exe
  C:\Windows\System\hNNKSfO.exe
  2⤵
  PID:9976
- C:\Windows\System\bzSjGaJ.exe
  C:\Windows\System\bzSjGaJ.exe
  2⤵
  PID:10084
- C:\Windows\System\OGimMDT.exe
  C:\Windows\System\OGimMDT.exe
  2⤵
  PID:10136
- C:\Windows\System\RizOElt.exe
  C:\Windows\System\RizOElt.exe
  2⤵
  PID:8028
- C:\Windows\System\lSPUVWu.exe
  C:\Windows\System\lSPUVWu.exe
  2⤵
  PID:11108
- C:\Windows\System\IKnpUFs.exe
  C:\Windows\System\IKnpUFs.exe
  2⤵
  PID:3672
- C:\Windows\System\zvNlHIs.exe
  C:\Windows\System\zvNlHIs.exe
  2⤵
  PID:3320
- C:\Windows\System\IqKFIwh.exe
  C:\Windows\System\IqKFIwh.exe
  2⤵
  PID:11440
- C:\Windows\System\UweKulS.exe
  C:\Windows\System\UweKulS.exe
  2⤵
  PID:2152
- C:\Windows\System\uEXBGqQ.exe
  C:\Windows\System\uEXBGqQ.exe
  2⤵
  PID:4908
- C:\Windows\System\fHnTNru.exe
  C:\Windows\System\fHnTNru.exe
  2⤵
  PID:13284
- C:\Windows\System\nOfwNfq.exe
  C:\Windows\System\nOfwNfq.exe
  2⤵
  PID:12144
- C:\Windows\System\YxOSifl.exe
  C:\Windows\System\YxOSifl.exe
  2⤵
  PID:12368
- C:\Windows\System\ZtlKZKp.exe
  C:\Windows\System\ZtlKZKp.exe
  2⤵
  PID:12424
- C:\Windows\System\RsJllNd.exe
  C:\Windows\System\RsJllNd.exe
  2⤵
  PID:5092
- C:\Windows\System\SPeSSkE.exe
  C:\Windows\System\SPeSSkE.exe
  2⤵
  PID:3604
- C:\Windows\System\aXxqdMd.exe
  C:\Windows\System\aXxqdMd.exe
  2⤵
  PID:1996
- C:\Windows\System\liMacbf.exe
  C:\Windows\System\liMacbf.exe
  2⤵
  PID:10056
- C:\Windows\System\aqLbnyU.exe
  C:\Windows\System\aqLbnyU.exe
  2⤵
  PID:12200
- C:\Windows\System\TPkYZsK.exe
  C:\Windows\System\TPkYZsK.exe
  2⤵
  PID:11300
- C:\Windows\System\YNkOqHE.exe
  C:\Windows\System\YNkOqHE.exe
  2⤵
  PID:11736
- C:\Windows\System\ulaVleX.exe
  C:\Windows\System\ulaVleX.exe
  2⤵
  PID:10104
- C:\Windows\System\tqOJVjk.exe
  C:\Windows\System\tqOJVjk.exe
  2⤵
  PID:1044
- C:\Windows\System\KoRmtUQ.exe
  C:\Windows\System\KoRmtUQ.exe
  2⤵
  PID:10904
- C:\Windows\System\KJQADXA.exe
  C:\Windows\System\KJQADXA.exe
  2⤵
  PID:11932
- C:\Windows\System\MMXpANv.exe
  C:\Windows\System\MMXpANv.exe
  2⤵
  PID:2424
- C:\Windows\System\mqehNBF.exe
  C:\Windows\System\mqehNBF.exe
  2⤵
  PID:8552
- C:\Windows\System\PcyioYw.exe
  C:\Windows\System\PcyioYw.exe
  2⤵
  PID:13092
- C:\Windows\System\XvPEEFT.exe
  C:\Windows\System\XvPEEFT.exe
  2⤵
  PID:10048
- C:\Windows\System\IGqGLxS.exe
  C:\Windows\System\IGqGLxS.exe
  2⤵
  PID:12064
- C:\Windows\System\plFGPnr.exe
  C:\Windows\System\plFGPnr.exe
  2⤵
  PID:440
- C:\Windows\System\RHAUmMT.exe
  C:\Windows\System\RHAUmMT.exe
  2⤵
  PID:4296
- C:\Windows\System\FwKAavK.exe
  C:\Windows\System\FwKAavK.exe
  2⤵
  PID:10908
- C:\Windows\System\LHxPVbD.exe
  C:\Windows\System\LHxPVbD.exe
  2⤵
  PID:3360
- C:\Windows\System\zOliWif.exe
  C:\Windows\System\zOliWif.exe
  2⤵
  PID:4596
- C:\Windows\System\zzGbhhm.exe
  C:\Windows\System\zzGbhhm.exe
  2⤵
  PID:10620
- C:\Windows\System\NsCSnEV.exe
  C:\Windows\System\NsCSnEV.exe
  2⤵
  PID:3312
- C:\Windows\System\XmYdBOU.exe
  C:\Windows\System\XmYdBOU.exe
  2⤵
  PID:7552
- C:\Windows\System\uTFXEQl.exe
  C:\Windows\System\uTFXEQl.exe
  2⤵
  PID:2788
- C:\Windows\System\wulBNHx.exe
  C:\Windows\System\wulBNHx.exe
  2⤵
  PID:4288
- C:\Windows\System\gwtRkSU.exe
  C:\Windows\System\gwtRkSU.exe
  2⤵
  PID:5800
- C:\Windows\System\JyUMvnW.exe
  C:\Windows\System\JyUMvnW.exe
  2⤵
  PID:13320
- C:\Windows\System\MeFykGw.exe
  C:\Windows\System\MeFykGw.exe
  2⤵
  PID:13340
- C:\Windows\System\YJfIDsC.exe
  C:\Windows\System\YJfIDsC.exe
  2⤵
  PID:13360
- C:\Windows\System\uyDyoqe.exe
  C:\Windows\System\uyDyoqe.exe
  2⤵
  PID:13388
- C:\Windows\System\VwIEoDz.exe
  C:\Windows\System\VwIEoDz.exe
  2⤵
  PID:13532
- C:\Windows\System\lXkhGgQ.exe
  C:\Windows\System\lXkhGgQ.exe
  2⤵
  PID:13548
- C:\Windows\System\lVbKOnE.exe
  C:\Windows\System\lVbKOnE.exe
  2⤵
  PID:13572
- C:\Windows\System\CzpESpM.exe
  C:\Windows\System\CzpESpM.exe
  2⤵
  PID:13592
- C:\Windows\System\nlbaQdg.exe
  C:\Windows\System\nlbaQdg.exe
  2⤵
  PID:13632
- C:\Windows\System\lhMxzXx.exe
  C:\Windows\System\lhMxzXx.exe
  2⤵
  PID:13680
- C:\Windows\System\BvqNjaC.exe
  C:\Windows\System\BvqNjaC.exe
  2⤵
  PID:13704
- C:\Windows\System\bIclYbX.exe
  C:\Windows\System\bIclYbX.exe
  2⤵
  PID:13728
- C:\Windows\System\WUPqekA.exe
  C:\Windows\System\WUPqekA.exe
  2⤵
  PID:13748
- C:\Windows\System\xcApxRs.exe
  C:\Windows\System\xcApxRs.exe
  2⤵
  PID:13808
- C:\Windows\System\cWEJNlj.exe
  C:\Windows\System\cWEJNlj.exe
  2⤵
  PID:13840
- C:\Windows\System\RjhdbKw.exe
  C:\Windows\System\RjhdbKw.exe
  2⤵
  PID:13864
- C:\Windows\System\kYvrWML.exe
  C:\Windows\System\kYvrWML.exe
  2⤵
  PID:13900
- C:\Windows\System\FjwClxc.exe
  C:\Windows\System\FjwClxc.exe
  2⤵
  PID:13972
- C:\Windows\System\UcLDiNG.exe
  C:\Windows\System\UcLDiNG.exe
  2⤵
  PID:14180
- C:\Windows\System\NMMDycs.exe
  C:\Windows\System\NMMDycs.exe
  2⤵
  PID:14228
- C:\Windows\System\UkRUDxN.exe
  C:\Windows\System\UkRUDxN.exe
  2⤵
  PID:14248
- C:\Windows\System\QwUpAek.exe
  C:\Windows\System\QwUpAek.exe
  2⤵
  PID:14272
- C:\Windows\System\MmlpCld.exe
  C:\Windows\System\MmlpCld.exe
  2⤵
  PID:13316
- C:\Windows\System\NXdZwZo.exe
  C:\Windows\System\NXdZwZo.exe
  2⤵
  PID:7272
- C:\Windows\System\cnbxRDZ.exe
  C:\Windows\System\cnbxRDZ.exe
  2⤵
  PID:12000
- C:\Windows\System\HFZNHGt.exe
  C:\Windows\System\HFZNHGt.exe
  2⤵
  PID:13172
- C:\Windows\System\jyMFkUK.exe
  C:\Windows\System\jyMFkUK.exe
  2⤵
  PID:12316
- C:\Windows\System\VMIqukR.exe
  C:\Windows\System\VMIqukR.exe
  2⤵
  PID:13600
- C:\Windows\System\NEVsdwi.exe
  C:\Windows\System\NEVsdwi.exe
  2⤵
  PID:13756
- C:\Windows\System\oGwRlXl.exe
  C:\Windows\System\oGwRlXl.exe
  2⤵
  PID:13928
- C:\Windows\System\GqBkpac.exe
  C:\Windows\System\GqBkpac.exe
  2⤵
  PID:13800
- C:\Windows\System\oZDYpOU.exe
  C:\Windows\System\oZDYpOU.exe
  2⤵
  PID:13912

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 9780 -ip 9780
1⤵
PID:12368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_sfubyi5o.vpm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sfubyi5o.vpm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

DQmxeon.exe

Path C:\Windows\System\DQmxeon.exe
Size 1.6MB
SHA256 196ee2175f4ad339dd832603f6ad25160b91cd7489d5871f6c21a2a993283122
MD5 17960a45db1a82ae6a033a91a3bc2945
SHA1 066145b6877a6f7f58f03e97a9d32eaeaa93d6ea
SHA512 35cc8b8b8d8b579a19e469b6b34cc75803e59e0c7b69fb8526bba731624891508fc392aee8b714b1315e0541d0144a6390725ea362fbb2168d7c41aeed030e28
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jto:Lz071uv4BPMkibTIA5LDGTUXaDmV
MD5 SHA1 SHA512 SSDEEP

Submit Download

DZtaUIM.exe

Path C:\Windows\System\DZtaUIM.exe
Size 1.6MB
SHA256 b6802b12f76c1f95bd968c5110832a3a3cecb1a820fe1e9e20b81ca4a997c51c
MD5 7c63a98b76cc2d7238a31e0269ce96cf
SHA1 24d4053e9c0352b31d476ecbed9a46c2d4e82166
SHA512 f8eefeba52d56c2102915a3cee9b953b0c70a0474e88c19f6d2399e1d891c3b06f79da50de932ebb07b0fa3fe3b09c25945c8307c5f4f666eddca5348caec384
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtb:Lz071uv4BPMkibTIA5LDGTUXaDmt2
MD5 SHA1 SHA512 SSDEEP

Submit Download

EPCsMzg.exe

Path C:\Windows\System\EPCsMzg.exe
Size 1.6MB
SHA256 495d6ffe6822c1a9d66395fb97882b19ac2ce265d93f3b40b106e476c4cb2c18
MD5 d29b966765c2da0e43f547c845d6c723
SHA1 ae4a92fbc8d39c6e4326ba36af11f5ee7063614d
SHA512 9e93be4eee83525a5365b91964c7c3de2adeaca657497d4ff3c711f00dcafe3ba176f109842e02c1aa3af917e9bfeb74f62dc23cc13ed9665ad2ef9e73a6a3ba
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jt7:Lz071uv4BPMkibTIA5LDGTUXaDmw
MD5 SHA1 SHA512 SSDEEP

Submit Download

EmTimQu.exe

Path C:\Windows\System\EmTimQu.exe
Size 1.6MB
SHA256 65d6101aa8e895fc43afc7240bc5013fe9a1854a3133f3efb2f7d12ef4a82f7b
MD5 ca3b656d24257dbc4d036f967d3c7ca1
SHA1 b9f9a09c87a2b751953545dfd9cf77b38c79f02c
SHA512 a6c5cd6f189d9989e07a12d66b506e78538d8cc4dba1d5be7bee19069d7ae3e47d6ee45538cabd13f034d48eab42f54d48cfa37efa1a3144d32dafb4d56500d5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jts:Lz071uv4BPMkibTIA5LDGTUXaDmljH
MD5 SHA1 SHA512 SSDEEP

Submit Download

GNWKQUc.exe

Path C:\Windows\System\GNWKQUc.exe
Size 1.6MB
SHA256 2a05054852d18ec3ef34d8c4c72f39f10c2a2fbfc078de84495dfab3fb8bf5a2
MD5 6091aadd069690b45817c01b869fca6a
SHA1 87dc7a730d287cf8469f0ab281cdc494e598f4e2
SHA512 624c1e827c1e11b13b5a91cc34cbca99ead8e5de110a34fe964805d871a0b42f8fa427a050270ab5c0d581afd92029dddbd5ecc964a0d01242841b395be40c3d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtj:Lz071uv4BPMkibTIA5LDGTUXaDmY
MD5 SHA1 SHA512 SSDEEP

Submit Download

GaMdfkl.exe

Path C:\Windows\System\GaMdfkl.exe
Size 1.6MB
SHA256 325cfb1bfb26efb34f753397b283d21b3c7738a46fd84d483f22d3c4ce1de940
MD5 54ed58efdb762bc0c7987ac24aa9462e
SHA1 df4e99ef89b35775387539c187c657ef0d9b7f05
SHA512 38445ffe5d5526842db6e0555c50e65c1d9bb4adb03ba737d0a82cb740098c871478cce6ee2ef576a6264d0d89116b84883989a676e1133b2f4cbfecc12ec534
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9JtH:Lz071uv4BPMkibTIA5LDGTUXaDmA
MD5 SHA1 SHA512 SSDEEP

Submit Download

HQLtlzx.exe

Path C:\Windows\System\HQLtlzx.exe
Size 1.6MB
SHA256 646921792f6af6abfb3e95068255c94376a7d57f2de4e0a9555a37b6613650c7
MD5 62a2e776fa17fc554e248e16f6c28210
SHA1 bbf70a50ce43da13d334f8059df235bf9d9d2d1b
SHA512 909ba7d989d1cbbaff18c5b6ef900b5df4b6bdad1ff555b5ffc3a5457e48c34fcfb1b28481b2102f85b13460a5f82cc512b336cbbc1963990b4d969aff86c842
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9JtI:Lz071uv4BPMkibTIA5LDGTUXaDm/
MD5 SHA1 SHA512 SSDEEP

Submit Download

IaUiMXJ.exe

Path C:\Windows\System\IaUiMXJ.exe
Size 1.6MB
SHA256 27efae6a386c0c6ee582d98093c5ddbbf8a9133e4629a37350193eb815295d5d
MD5 3997b648fb296e2c69b95aed6567fbcd
SHA1 772a79eb3c89535870a21378acac935e66d31a91
SHA512 cf6e92d508c0a8c2b16126f0a2898cecac078c0c3c4d39c9c70567ac153a04044c24f3c989bfdadf131857e5a8f1b6ae69bbb4a5727df95866ff344a2a75c5c5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jt9:Lz071uv4BPMkibTIA5LDGTUXaDmk
MD5 SHA1 SHA512 SSDEEP

Submit Download

JCzAuWI.exe

Path C:\Windows\System\JCzAuWI.exe
Size 1.6MB
SHA256 44a98e22135571a6f7659c815d235c93400134565d7d87b0e0279c1d6d886485
MD5 c495642fc4d00f0d70706fa0bbe9b733
SHA1 94f3a5881e1ba9fb29eb49a21044823a9fd35def
SHA512 43dc0226aa9469c7235bda573636fcd37e2474ca3f3739d98c3ec483197acca52cbabe5f5226e44df395671a8938abb84a689d04cd8995d0ff6b039e4a7f8ce5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9JtJ:Lz071uv4BPMkibTIA5LDGTUXaDm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

JwYGVMH.exe

Path C:\Windows\System\JwYGVMH.exe
Size 1.6MB
SHA256 d590736e41dcef59e566d6a2501e3e5f47f4b0e63d9310aa0d72b85407f442c5
MD5 9c4fa29eb039b7ff6a3b600b808c1e37
SHA1 5daa45a0b0cc11b4b040838878ba758f90e08766
SHA512 1ab96aea841711ae491f8fa9a37024633a04e2155fc5915ef34c8522f210f8c8808017b14f7382bae5fdfea2f96b439f80dc9a2a103c2cea667ad7ad8ad5ae60
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtn:Lz071uv4BPMkibTIA5LDGTUXaDmI
MD5 SHA1 SHA512 SSDEEP

Submit Download

KQElvLm.exe

Path C:\Windows\System\KQElvLm.exe
Size 1.6MB
SHA256 6f0186640d32b485e1ebac5ded821e4628596d634bc5d8fdbc86bdc409e64357
MD5 c41af84f3e4cd9948ce644a9bc413183
SHA1 1f3b47909663d6e597b29bf13596d76f84e2fd97
SHA512 d2fbea37b9aefbb69d6d3e7b0b03a055dfded0e8ed00478ea578ce885bd74efa815a9b5befa635197d99c7269ba78e2c1453b431e09ad09b271111ad4f85413f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtn:Lz071uv4BPMkibTIA5LDGTUXaDm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

NNxSsSw.exe

Path C:\Windows\System\NNxSsSw.exe
Size 8B
SHA256 2f18658787aeca4d305f9fde7c9bc7343e5969bd51ec0e2c8583a2e506b9b404
MD5 7e1e9fcc71af27d4f3a70b3e20ac77b9
SHA1 09ec64762a6dbe9e03ecdb61ea5de2d274d170f0
SHA512 3beada4b1cd8ead153972e6e1293d504f7cea2d7323223a87897681d13a0872baba6942b9d88c8943892c0ad02e1f51ed3730edd702cc7d53ab31d006770ca91
MD5 SHA1 SHA512

Submit Download

OcxRfFQ.exe

Path C:\Windows\System\OcxRfFQ.exe
Size 1.6MB
SHA256 320b85a78e3ee330fbd3d82d0f20f857181e8e8027845ad84e17281986571485
MD5 c67c54d599cd98a73146f25f58a04a41
SHA1 ed9c8672c4a4e544fbe3a0178567187ad19b08c9
SHA512 786941a398f319be5bbe9b34c8fc89833b1777a4e29f2a35fbe9700fa5ec78b4215a1cde3acbeac63f470dbb4aa52251f839ba42a489a63f7df0e0c86c6cb6e1
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtg:Lz071uv4BPMkibTIA5LDGTUXaDmZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OsxYCqR.exe

Path C:\Windows\System\OsxYCqR.exe
Size 1.6MB
SHA256 4c37d3c1701863173c86cb4ee8119028a49be1a281c63a84e23c76891caf81b3
MD5 2a6692ec2a29b62319306cd195773889
SHA1 cab67d647e17963500f53e0481f27972baab176c
SHA512 7de4554014180eaf33a82666643a0073d09b6abfc97dbc44af06ffa63eb849bce7ab2e93ae893126f07981ff9dc3f4833c6f584d75c4f8fecd9348a9d92d423a
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtz:Lz071uv4BPMkibTIA5LDGTUXaDmK
MD5 SHA1 SHA512 SSDEEP

Submit Download

PUmYJDX.exe

Path C:\Windows\System\PUmYJDX.exe
Size 1.6MB
SHA256 1bbf8ece25c57aeb7c8c17eafef571e6b546e6bd7006f6c50bb018444eb81c92
MD5 753a096b04779d9a4f56680c52129f58
SHA1 7f24bd6dce5cfb6c5ec25a34b821ecf3056d42be
SHA512 7a87cefc57ec90bb3a02fa13730ff8fcc30b14e4f2e3e6377293844236b991f56744465c38efd1f0e9901035501b8bd7bc29887e36713f1278ee863702af063e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jt4:Lz071uv4BPMkibTIA5LDGTUXaDmp
MD5 SHA1 SHA512 SSDEEP

Submit Download

QLptLXw.exe

Path C:\Windows\System\QLptLXw.exe
Size 1.6MB
SHA256 9c6ca1ee6d5316d0ea56995fca467a3ad35b369d9d41061857cd9c2bbf289733
MD5 2f8a2b75099855c39c07adfaeafde5cb
SHA1 5781abb2b773de7b0d09b5e9b73d9dd995a14e8c
SHA512 dc66ff548c4f970da48894d5ca0e6e305f6a7295ae6bdabc132faa8fede8565a21197d2ca552912d99f1041eb7400d8b2f82ba7b111b11d13e6c9d86b0e8486c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jt5:Lz071uv4BPMkibTIA5LDGTUXaDm2
MD5 SHA1 SHA512 SSDEEP

Submit Download

QtsBRjp.exe

Path C:\Windows\System\QtsBRjp.exe
Size 1.6MB
SHA256 33803854b5b20bf3377756f66dbb2ab4336b323421ed03ad793f3ee814b7a736
MD5 85e1415d4bdb8eab8f4a07b39943106e
SHA1 d8cb03ade1af818c37cc8cdb56db8068b1949f36
SHA512 c703e870cb665e8ac3f032be4debccde874a592ce3a9e111d63dfd13cbe7812449e1835d8c01499281a4ec9c9f9c4b209c7362913ea5214a11bab5505ac22fc5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jt7:Lz071uv4BPMkibTIA5LDGTUXaDm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

RvDUBwP.exe

Path C:\Windows\System\RvDUBwP.exe
Size 1.6MB
SHA256 592c65f8e03c1ed4b0400e6591470c8afadb409ce1a7a42294168ad6f71eff7a
MD5 99e0238c4df9958ab28ca892082833e6
SHA1 db644f47388c7607293ee53732f793c171305fb6
SHA512 7b1160c10455436143f03757b294fcb791e2051eec59a1e0ad69b4073e2410fc8fb5fc8f5bd0c2f92e65a0fc080ea45949137ec19608b731246a0eb73eef0acf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtt:Lz071uv4BPMkibTIA5LDGTUXaDmK
MD5 SHA1 SHA512 SSDEEP

Submit Download

SzNRotd.exe

Path C:\Windows\System\SzNRotd.exe
Size 1.6MB
SHA256 c40913efe1018e5fd912535172c6f79ff4fdfa06122376f06ff580d7473a2c95
MD5 8b678794e9d2adf97351775f5043384e
SHA1 d7b9b01882ac3cd87018dfffa560a12bfc57df1e
SHA512 8dab84d6679ddd3343fd562a8ae90b6691280b420bed62446d3e403c397b1177f3b13352cdf7ebabade452a2eb53b86ba3d274b8f075254faf9fc5548c80c889
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9JtW:Lz071uv4BPMkibTIA5LDGTUXaDmr
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAdnayq.exe

Path C:\Windows\System\UAdnayq.exe
Size 1.6MB
SHA256 838a1a185e7f59a7e1973dcdbebe50aefbe317b26e85e36d18d4f007d5021447
MD5 27d88ce303d6bf503011b43610392bd5
SHA1 d304422b3bbfa795f7f81624f5555982f60aa83c
SHA512 c9e1819178c8cc2b0c88fc8d5e8d08e2def8700ee21bc69298cd2ab68f8add2593ef5e2d9b3eebd06c49676188b25c1980403e83d36d889af3164d64b02b219d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jt5:Lz071uv4BPMkibTIA5LDGTUXaDmC
MD5 SHA1 SHA512 SSDEEP

Submit Download

XsKGZNu.exe

Path C:\Windows\System\XsKGZNu.exe
Size 1.6MB
SHA256 e128af514a71aaa3341beb2bb0155bac99e289e5af3e265c98ce8bb05cc18e52
MD5 ee2a64bb2abf0b77c23bcffa42f1d42c
SHA1 70214b276be808fef9bc11103c4eb0fc9c42e9fa
SHA512 b025a37190c7f2a67f7a9c85aca5b8d4dbf559fbdeb30bc7771180ddd992e562c517cef72105baf9d79b22395bc0cfff8e60e1f863c54943ba609931d9e57921
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtp:Lz071uv4BPMkibTIA5LDGTUXaDmQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

YTItiuB.exe

Path C:\Windows\System\YTItiuB.exe
Size 1.6MB
SHA256 6610541f5ae6ba8c4d89ac4028ef272297958f61e54caee4351fa31abd28d159
MD5 ca013cab8d9a459202dee8de10f42ade
SHA1 82c6816cd201e123049cafe11ec8f5e307cb4aec
SHA512 d007ad89eb2c17831fa28bf54b7a8477054158e878a6ad1f3753ed2cfd96e00d825eee49b2784f195aa45d0ec6279c840d726148383685bb74a7880e7d47224f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9JtZ:Lz071uv4BPMkibTIA5LDGTUXaDmG
MD5 SHA1 SHA512 SSDEEP

Submit Download

aqkoOWb.exe

Path C:\Windows\System\aqkoOWb.exe
Size 1.6MB
SHA256 7eb479fe17927578d7ef159d1619d6844f40df8b09891cc06387a3af875c5a13
MD5 607dbbc255d84dbd2f2257badc1dd73a
SHA1 9bfe4f0573a467b1ccd1214bd805ab39881d82e7
SHA512 aed81449eb134ba32d53728b6da5ec098b254d764221259d80de83614c71cbf3b30eec8459dd1e1fe5a0f447f8397e76ae2d5e4a221a173b3e0f917cda64cbfe
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtt:Lz071uv4BPMkibTIA5LDGTUXaDmw
MD5 SHA1 SHA512 SSDEEP

Submit Download

eOnFuZN.exe

Path C:\Windows\System\eOnFuZN.exe
Size 1.6MB
SHA256 ed0a34e6730e58f652e6418a2ad77f6015a06864670b48ce04f1dcd3a0bd700c
MD5 b4025c33fd47268273ab06bf973195ee
SHA1 dece3f92702bebe4a41d36ca073b7eb8a784e2ff
SHA512 c3e81e92c68737402402b6ce867ffd4f55084c38afe8102d25ec4660d5af267bb2f049e6f0090ce21dc6d7715c938dcc9ac5f1fc05221c97bd70d226c884966f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9JtX:Lz071uv4BPMkibTIA5LDGTUXaDm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

eiQgtkv.exe

Path C:\Windows\System\eiQgtkv.exe
Size 1.6MB
SHA256 424fb9d8e37080638fdf8ec1def0b344d064cdf30b1ce8875db50d9266a4306c
MD5 736ab17d26abed251c1b10b023a4ba27
SHA1 9d0f58f4bdb359bdd6bc60418a18915b95f47f05
SHA512 90891488bebf8b9d4f292c4182c32839d2f7858782ce5f8eec351065de8f3f50edb197f3a2c0ae51a1dea9cf9708353f9f2e7c629337f716666297549707804d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtq:Lz071uv4BPMkibTIA5LDGTUXaDmn
MD5 SHA1 SHA512 SSDEEP

Submit Download

gVaQSlb.exe

Path C:\Windows\System\gVaQSlb.exe
Size 1.6MB
SHA256 ca8d5838561f0437be1ba674b5cf458ee9d15c220d283a5d97ad8451b5ea9c0d
MD5 44ef98e56cc4bf4e895257bcc4949cdc
SHA1 ec99138b4ddcfb59cbe33f0152c51d77db111829
SHA512 ab02393fbf1563ae80b8c1ed8963f08752429b2bb08b39708e21ec8b412406385c45c328149bca7fa974c668545d6d5a4635e9a47917edefa07a335efca48db4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jt8:Lz071uv4BPMkibTIA5LDGTUXaDmv
MD5 SHA1 SHA512 SSDEEP

Submit Download

gkNQqKM.exe

Path C:\Windows\System\gkNQqKM.exe
Size 1.6MB
SHA256 f8284f5f02505a7fe23e9abad4958cc4accef08f5d28a41c6e0bf8436695094f
MD5 a04bd9b6f2264c856e2e0cb20bc545e3
SHA1 7ccbb77c1f5c7d067bc32a3e354d05a54969095e
SHA512 fa4b644b95ee606a0a1a818513ead0af56e4bafd1279ebac5a4ea77046e1b0feeaa02a2dcaadc22af11cdc26639e018a98cec5bbdaeceeee2ffe327da1cbe08e
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtl:Lz071uv4BPMkibTIA5LDGTUXaDmc
MD5 SHA1 SHA512 SSDEEP

Submit Download

hcpOyjj.exe

Path C:\Windows\System\hcpOyjj.exe
Size 1.6MB
SHA256 bf00658071549d68f58644c7f0ca9912bd4ba97605e905c7ee8572fbd123bde0
MD5 e1e49d556226a9de8380b64a129a594d
SHA1 43980057fb2d20a95664948e57ef1ed3aa02490f
SHA512 04ba940ae5dcb1bea6efb48a4d6b399faca071f1a7d7439ed0e3681a3005dbcf6bd2b71f1d7d8e9bce9346fc83fbcab3358d7c1b959f0c675652510c9c7118a7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jt1:Lz071uv4BPMkibTIA5LDGTUXaDme
MD5 SHA1 SHA512 SSDEEP

Submit Download

iasXlWg.exe

Path C:\Windows\System\iasXlWg.exe
Size 1.6MB
SHA256 04d5ab369ba381bdf0e5dbe63d3ebc7a5565867218b1e4ee14b50d3adffb315c
MD5 b0f506e7b00761eefa7e5b054ec430b3
SHA1 b89626a173736b0e999d7545e35e8365e3adc4be
SHA512 749f38909b4655ac13f2821f52779b98586f3c491044c5750fd7824c1226a687ea833006a431656fbea9c845e6ad4c7d75376c71cc68f0fd61af23df31e7bced
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtp:Lz071uv4BPMkibTIA5LDGTUXaDmo
MD5 SHA1 SHA512 SSDEEP

Submit Download

jTpRFkJ.exe

Path C:\Windows\System\jTpRFkJ.exe
Size 1.6MB
SHA256 c95d4cfd673e9b38a39e78cf3743d7c31db29a5395721079b53bc7ecfcff4ca4
MD5 84f485490844b85eb7e7b92ff0eeadd3
SHA1 8026727b740c9a89cdab4870b0bc770e74a49c63
SHA512 78628bc619ff66b369a357ff878155f0529ef2afeddbcdeebabb134b6fd89160c209223d55cf4d34b424abd14ef236f14d8942c5f3573f43b721e5a8d5f4b2b6
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9JtK:Lz071uv4BPMkibTIA5LDGTUXaDmJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

jXrOknx.exe

Path C:\Windows\System\jXrOknx.exe
Size 1.6MB
SHA256 49b2f5aefd6095878c5466504b6caa6651e6a9c18d2506929bb5a9e516662840
MD5 e9039ef550b125b4bec17fc50b966a1b
SHA1 bed98eb02604f97ac718e8551e1d7b3e733f6bea
SHA512 3247e6e7744052f2db9a018f5bd61acb0c3ccaf0da3238bb39d2695624355124923e2eb068dcdfc9ee088f8914d4db7141aa8337428f0864aa506e18360359ac
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtl:Lz071uv4BPMkibTIA5LDGTUXaDmE
MD5 SHA1 SHA512 SSDEEP

Submit Download

mBJaoql.exe

Path C:\Windows\System\mBJaoql.exe
Size 1.6MB
SHA256 20185aba0380a15fbc12adb3cafe9805d771b0709e3a7a05de510cbb5d072bcf
MD5 3f9e59e2ba41b0182226858c8b519c01
SHA1 e0e8f039ae3d7cd1a9dc8c823240961a93baaf99
SHA512 27f0fa90cbe05d20520a9b1edf91f3e213aae0554ac2c3c701ea1b0d72c9bf29dcb797457467a1505a0cc153dc4c60ea5cfde770489e6e7395f64e2c80855320
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtk:Lz071uv4BPMkibTIA5LDGTUXaDmR
MD5 SHA1 SHA512 SSDEEP

Submit Download

mmzrAXq.exe

Path C:\Windows\System\mmzrAXq.exe
Size 1.6MB
SHA256 44ae1533f8015117965669d219ccd081c7dc936f20e7fb07ffd46248a6b828c0
MD5 5a5ad7fa260eeccab17b3610fa0f717f
SHA1 3bb1bd8a1ad205937c0d99a48a4dfe6ba5b10e49
SHA512 9d5ac5f3837c4493e800794c8cc475195051c26a082a6f6b2fab67c5d5264e0c3d54314712f438e156cb191262e5e60ec1027181cffdc398b816965add91dc70
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9JtK:Lz071uv4BPMkibTIA5LDGTUXaDm1
MD5 SHA1 SHA512 SSDEEP

Submit Download

rKNmSOh.exe

Path C:\Windows\System\rKNmSOh.exe
Size 1.6MB
SHA256 e4f4ddb1e082abd61b071ce506646ed82cb6e130a1fabd62757b63b2f507f3ab
MD5 f37f2c75464f6fa9582ceded951e6ba8
SHA1 a30cec17145d3ebb14df93a593dbccd565e7847c
SHA512 23530ec1d8f6fd1d74701864cf8712543b1fa35445a48956d5a64342f819839abbb3592cd7395523607c534ec4abd3ea1c4b88ccef1b68282bafcf0d542ae00f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jt5:Lz071uv4BPMkibTIA5LDGTUXaDme
MD5 SHA1 SHA512 SSDEEP

Submit Download

vdWpsBS.exe

Path C:\Windows\System\vdWpsBS.exe
Size 1.6MB
SHA256 ecac673f1c93ced5dcfca67f53c8c208233b83d9e901967fd8fe8611e384df1b
MD5 65b2a6ba21b49f61601e27ee03a87646
SHA1 4238bdda598bd06aab5c5ed0ef53bb4794adeca9
SHA512 a8b1949a457a2f98fdced71961ec4af1d72afefc3ed473ccfa6c5470ce0e8fdd61657390e70b92ab07118789b5c812b9eea6c3116dc56515c49cc7bb3143f2e8
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtb:Lz071uv4BPMkibTIA5LDGTUXaDms
MD5 SHA1 SHA512 SSDEEP

Submit Download

wtFKLDg.exe

Path C:\Windows\System\wtFKLDg.exe
Size 1.6MB
SHA256 70c709329c831f956d82a75264481cff443101fa468ca79512e289dc60780a65
MD5 d58ed22a12cb0edeef2097eb05421eb8
SHA1 7ff2512d35557e7df26ac7bc1c1da36e951bfe32
SHA512 20884152c66a8285b86c5ee72bc56c5aa4861d03be581b95a7814b7b4a4658ce6b117ce36ad0c2cd447e70f21de948310b9b7235637e5d934c8ae58d49f51db4
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9JtS:Lz071uv4BPMkibTIA5LDGTUXaDmb
MD5 SHA1 SHA512 SSDEEP

Submit Download

xBwAKaW.exe

Path C:\Windows\System\xBwAKaW.exe
Size 1.6MB
SHA256 13b506ad86c272e68ddf619976f19dd1422c056bbc7749075ab81190f0b390c1
MD5 e6399ffd7dd630bc3438b1fb882b6bcd
SHA1 b975e151feeea5a57b6aa2d47a04e71b1456ce50
SHA512 19d3a2e99569b9bd051a82272922700f9b322701531ddf30236c6be5480b368b175647e9a6206bca6083a9c56764d4f99d7c8d78b79fca7ecd0c3b7c15b052ca
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtd:Lz071uv4BPMkibTIA5LDGTUXaDme
MD5 SHA1 SHA512 SSDEEP

Submit Download

xQEUrdr.exe

Path C:\Windows\System\xQEUrdr.exe
Size 1.6MB
SHA256 2b6b60b3e4b5e68e58096fd96494746bc588888e94bd64b9010c5990579dd0e4
MD5 892389664e06eb5c9be3deb850f13c77
SHA1 7a96e3789f3d2699aaaf155b4ecc0a09f57e9c66
SHA512 f9007ea96585492f86cccf3c1f348ac6c63440008b60923ea1c5be7cc4f23c2ae78487ab72de5524c8e000a883039fa2ea0fc84c358e9602d573d3144c28ec7b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jt3:Lz071uv4BPMkibTIA5LDGTUXaDmu
MD5 SHA1 SHA512 SSDEEP

Submit Download

zbXeqpO.exe

Path C:\Windows\System\zbXeqpO.exe
Size 1.6MB
SHA256 893a52a4ef29e832b871147af001493763a6ace751fc2f13041bccf47cffb9f8
MD5 d7728de103fb2d15270c9c7714e709b5
SHA1 c929dc69b55b5d7cd35556855709cde718c5bffd
SHA512 62171cdc1ed3677b7eeafef8cc92e7e341eb8355dcd6a26f86f6a8e3ed4c0fd08dc0d21bb81d30279a1d62545d250fd38a3c907c5377d7c92e884a9994a3458d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9Jtg:Lz071uv4BPMkibTIA5LDGTUXaDmT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/60-4091-0x00007FF6A5910000-0x00007FF6A5D02000-memory.dmp

Download

memory/60-641-0x00007FF6A5910000-0x00007FF6A5D02000-memory.dmp

Download

memory/704-4103-0x00007FF719240000-0x00007FF719632000-memory.dmp

Download

memory/704-633-0x00007FF719240000-0x00007FF719632000-memory.dmp

Download

memory/752-122-0x00007FF6D6950000-0x00007FF6D6D42000-memory.dmp

Download

memory/752-4069-0x00007FF6D6950000-0x00007FF6D6D42000-memory.dmp

Download

memory/880-4073-0x00007FF75FF60000-0x00007FF760352000-memory.dmp

Download

memory/880-574-0x00007FF75FF60000-0x00007FF760352000-memory.dmp

Download

memory/1020-4063-0x00007FF7C1240000-0x00007FF7C1632000-memory.dmp

Download

memory/1020-475-0x00007FF7C1240000-0x00007FF7C1632000-memory.dmp

Download

memory/1168-629-0x00007FF7C7360000-0x00007FF7C7752000-memory.dmp

Download

memory/1168-4075-0x00007FF7C7360000-0x00007FF7C7752000-memory.dmp

Download

memory/1228-636-0x00007FF70F720000-0x00007FF70FB12000-memory.dmp

Download

memory/1228-4107-0x00007FF70F720000-0x00007FF70FB12000-memory.dmp

Download

memory/1300-640-0x00007FF736340000-0x00007FF736732000-memory.dmp

Download

memory/1300-4080-0x00007FF736340000-0x00007FF736732000-memory.dmp

Download

memory/1368-635-0x00007FF7C2A30000-0x00007FF7C2E22000-memory.dmp

Download

memory/1368-4082-0x00007FF7C2A30000-0x00007FF7C2E22000-memory.dmp

Download

memory/1560-7-0x00007FF917AA3000-0x00007FF917AA5000-memory.dmp

Download

memory/1560-245-0x000001E5E2480000-0x000001E5E24A2000-memory.dmp

Download

memory/1560-209-0x00007FF917AA0000-0x00007FF918561000-memory.dmp

Download

memory/1560-53-0x00007FF917AA0000-0x00007FF918561000-memory.dmp

Download

memory/1764-352-0x00007FF7B4030000-0x00007FF7B4422000-memory.dmp

Download

memory/1764-4058-0x00007FF7B4030000-0x00007FF7B4422000-memory.dmp

Download

memory/2096-4055-0x00007FF7A15A0000-0x00007FF7A1992000-memory.dmp

Download

memory/2096-643-0x00007FF7A15A0000-0x00007FF7A1992000-memory.dmp

Download

memory/2492-4077-0x00007FF626A40000-0x00007FF626E32000-memory.dmp

Download

memory/2492-642-0x00007FF626A40000-0x00007FF626E32000-memory.dmp

Download

memory/2860-638-0x00007FF7CEE60000-0x00007FF7CF252000-memory.dmp

Download

memory/2860-4105-0x00007FF7CEE60000-0x00007FF7CF252000-memory.dmp

Download

memory/3008-630-0x00007FF6CBC30000-0x00007FF6CC022000-memory.dmp

Download

memory/3008-4060-0x00007FF6CBC30000-0x00007FF6CC022000-memory.dmp

Download

memory/3056-645-0x00007FF7B7FE0000-0x00007FF7B83D2000-memory.dmp

Download

memory/3056-4101-0x00007FF7B7FE0000-0x00007FF7B83D2000-memory.dmp

Download

memory/3224-4085-0x00007FF6D3470000-0x00007FF6D3862000-memory.dmp

Download

memory/3224-639-0x00007FF6D3470000-0x00007FF6D3862000-memory.dmp

Download

memory/3436-4068-0x00007FF7AF230000-0x00007FF7AF622000-memory.dmp

Download

memory/3436-365-0x00007FF7AF230000-0x00007FF7AF622000-memory.dmp

Download

memory/3816-4065-0x00007FF6F1ED0000-0x00007FF6F22C2000-memory.dmp

Download

memory/3816-632-0x00007FF6F1ED0000-0x00007FF6F22C2000-memory.dmp

Download

memory/4516-74-0x00007FF7BC1B0000-0x00007FF7BC5A2000-memory.dmp

Download

memory/4516-4053-0x00007FF7BC1B0000-0x00007FF7BC5A2000-memory.dmp

Download

memory/4552-646-0x00007FF7E2780000-0x00007FF7E2B72000-memory.dmp

Download

memory/4552-4087-0x00007FF7E2780000-0x00007FF7E2B72000-memory.dmp

Download

memory/4940-4062-0x00007FF7B7260000-0x00007FF7B7652000-memory.dmp

Download

memory/4940-644-0x00007FF7B7260000-0x00007FF7B7652000-memory.dmp

Download

memory/5004-634-0x00007FF73FEC0000-0x00007FF7402B2000-memory.dmp

Download

memory/5004-4113-0x00007FF73FEC0000-0x00007FF7402B2000-memory.dmp

Download

memory/5008-637-0x00007FF61C380000-0x00007FF61C772000-memory.dmp

Download

memory/5008-4089-0x00007FF61C380000-0x00007FF61C772000-memory.dmp

Download

memory/5076-1-0x000002004CE80000-0x000002004CE90000-memory.dmp

Download

memory/5076-0-0x00007FF6095B0000-0x00007FF6099A2000-memory.dmp

Download

memory/5116-4072-0x00007FF6E1AC0000-0x00007FF6E1EB2000-memory.dmp

Download

memory/5116-631-0x00007FF6E1AC0000-0x00007FF6E1EB2000-memory.dmp

Download