xmrig | bd8be8e8487326cf370ba0be4514392a17ba3c9024c6bae094b188deb993b91b

Analysis

max time kernel
143s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
Size 3.3MB
Sample240614-dd779swfpq
SHA256 bd8be8e8487326cf370ba0be4514392a17ba3c9024c6bae094b188deb993b91b
MD5 9ce4c034196ddec79da0046f8232cca0
SHA1 2bb99db6b2272379a78d827056bd004b1914456b
SHA512 a2ce61e22c0800dc7b9e943dc14e01e07fe4ce27ce627069d099b90e8fd8565d873ee374a645b967df49f486e908638ac9ac2f7afe0ddc992b1e37440a8d9e38
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWe:7bBeSFkS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2060-0-0x00007FF737850000-0x00007FF737C46000-memory.dmp	xmrig
behavioral2/files/0x000800000002350e-5.dat	xmrig
behavioral2/memory/464-8-0x00007FF627C40000-0x00007FF628036000-memory.dmp	xmrig
behavioral2/files/0x0007000000023513-15.dat	xmrig
behavioral2/files/0x0007000000023515-25.dat	xmrig
behavioral2/files/0x0007000000023519-47.dat	xmrig
behavioral2/files/0x0007000000023516-51.dat	xmrig
behavioral2/memory/2316-55-0x00007FF6B0F10000-0x00007FF6B1306000-memory.dmp	xmrig
behavioral2/memory/4844-57-0x00007FF67EC80000-0x00007FF67F076000-memory.dmp	xmrig
behavioral2/memory/1632-52-0x00007FF703CE0000-0x00007FF7040D6000-memory.dmp	xmrig
behavioral2/memory/2148-50-0x00007FF750C20000-0x00007FF751016000-memory.dmp	xmrig
behavioral2/memory/4308-48-0x00007FF6EC580000-0x00007FF6EC976000-memory.dmp	xmrig
behavioral2/memory/2208-45-0x00007FF770150000-0x00007FF770546000-memory.dmp	xmrig
behavioral2/files/0x0007000000023514-38.dat	xmrig
behavioral2/files/0x0007000000023512-17.dat	xmrig
behavioral2/files/0x0008000000023518-59.dat	xmrig
behavioral2/memory/2544-64-0x00007FF705530000-0x00007FF705926000-memory.dmp	xmrig
behavioral2/files/0x000800000002350f-67.dat	xmrig
behavioral2/files/0x0008000000023517-73.dat	xmrig
behavioral2/memory/4396-69-0x00007FF742BE0000-0x00007FF742FD6000-memory.dmp	xmrig
behavioral2/memory/1640-75-0x00007FF7963A0000-0x00007FF796796000-memory.dmp	xmrig
behavioral2/files/0x000700000002351a-78.dat	xmrig
behavioral2/files/0x000700000002351b-86.dat	xmrig
behavioral2/files/0x000700000002351d-90.dat	xmrig
behavioral2/memory/4656-105-0x00007FF75A0B0000-0x00007FF75A4A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023520-115.dat	xmrig
behavioral2/memory/3376-117-0x00007FF76AE80000-0x00007FF76B276000-memory.dmp	xmrig
behavioral2/memory/656-118-0x00007FF716DE0000-0x00007FF7171D6000-memory.dmp	xmrig
behavioral2/memory/768-119-0x00007FF73C2A0000-0x00007FF73C696000-memory.dmp	xmrig
behavioral2/files/0x0007000000023521-122.dat	xmrig
behavioral2/files/0x000700000002351f-113.dat	xmrig
behavioral2/memory/3184-111-0x00007FF6C96A0000-0x00007FF6C9A96000-memory.dmp	xmrig
behavioral2/files/0x000700000002351e-108.dat	xmrig
behavioral2/files/0x000700000002351c-100.dat	xmrig
behavioral2/memory/5016-98-0x00007FF6D92C0000-0x00007FF6D96B6000-memory.dmp	xmrig
behavioral2/memory/4108-91-0x00007FF721B40000-0x00007FF721F36000-memory.dmp	xmrig
behavioral2/memory/1100-84-0x00007FF72B370000-0x00007FF72B766000-memory.dmp	xmrig
behavioral2/files/0x0007000000023522-127.dat	xmrig
behavioral2/files/0x0002000000022a46-132.dat	xmrig
behavioral2/files/0x0002000000022a48-137.dat	xmrig
behavioral2/files/0x000f0000000232bc-141.dat	xmrig
behavioral2/files/0x0007000000023526-175.dat	xmrig
behavioral2/files/0x0007000000023528-185.dat	xmrig
behavioral2/files/0x000700000002352b-194.dat	xmrig
behavioral2/files/0x0007000000023529-190.dat	xmrig
behavioral2/files/0x000700000002352a-189.dat	xmrig
behavioral2/memory/2060-570-0x00007FF737850000-0x00007FF737C46000-memory.dmp	xmrig
behavioral2/files/0x0007000000023527-179.dat	xmrig
behavioral2/files/0x0007000000023525-170.dat	xmrig
behavioral2/files/0x0007000000023524-165.dat	xmrig
behavioral2/files/0x000c0000000232c8-160.dat	xmrig
behavioral2/files/0x000d0000000232c7-155.dat	xmrig
behavioral2/files/0x00090000000232c0-150.dat	xmrig
behavioral2/memory/1604-591-0x00007FF72E760000-0x00007FF72EB56000-memory.dmp	xmrig
behavioral2/memory/4856-586-0x00007FF608CF0000-0x00007FF6090E6000-memory.dmp	xmrig
behavioral2/memory/2296-600-0x00007FF71C860000-0x00007FF71CC56000-memory.dmp	xmrig
behavioral2/memory/464-613-0x00007FF627C40000-0x00007FF628036000-memory.dmp	xmrig
behavioral2/memory/4476-610-0x00007FF6C0990000-0x00007FF6C0D86000-memory.dmp	xmrig
behavioral2/memory/2292-595-0x00007FF709830000-0x00007FF709C26000-memory.dmp	xmrig
behavioral2/memory/704-578-0x00007FF751B90000-0x00007FF751F86000-memory.dmp	xmrig
behavioral2/memory/2544-1555-0x00007FF705530000-0x00007FF705926000-memory.dmp	xmrig
behavioral2/memory/3184-2678-0x00007FF6C96A0000-0x00007FF6C9A96000-memory.dmp	xmrig
behavioral2/memory/3376-2680-0x00007FF76AE80000-0x00007FF76B276000-memory.dmp	xmrig
behavioral2/memory/2316-4086-0x00007FF6B0F10000-0x00007FF6B1306000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
760	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
464	PERgJqn.exe
1632	mkEBAnM.exe
2208	tfsZLtB.exe
4308	aCeedeL.exe
2148	FRVVCFs.exe
2316	MWUFnZB.exe
4844	xDuspIg.exe
2544	wKHmehF.exe
4396	GTlfOaP.exe
1640	MLYjtdV.exe
1100	VbYDZld.exe
4108	IvNRTYq.exe
5016	slMmxAl.exe
4656	GzKQxzt.exe
656	YKFCIdh.exe
3184	pcbBAWN.exe
768	gYkVMuB.exe
3376	hxPVuun.exe
704	NMmqPSh.exe
4476	kdnxhIP.exe
4856	yDdhBSx.exe
1604	TTKjrLA.exe
2292	SKlNyqR.exe
2296	lPuNblq.exe
2408	XwViUFS.exe
3704	icozioG.exe
1400	bukklJd.exe
532	ubuBZVq.exe
4288	xqPqrRU.exe
4684	LbNRuHZ.exe
1296	FrFUrAp.exe
3108	grMcRWX.exe
3492	GhEDxyx.exe
2368	FzBgDoB.exe
740	RgxANQr.exe
2160	VzoCZWE.exe
3076	BCemoOG.exe
1132	uAlvget.exe
804	rmMSPFW.exe
4692	USwIsYu.exe
2608	GxiVIYC.exe
1952	aIikicE.exe
4912	jTkXkiT.exe
1744	zGzcdgo.exe
4612	NsTmiKD.exe
4980	pSdOIyT.exe
3336	kpvRtqd.exe
4192	joQUwtP.exe
5140	oHmhBfM.exe
5168	FqheeDL.exe
5196	PvNIeKI.exe
5220	twpwSGJ.exe
5252	RIPYnGc.exe
5280	hvBjpdM.exe
5308	wNIMbdD.exe
5336	mocVusO.exe
5364	gzKAMcq.exe
5392	NJUdhJU.exe
5420	iyhBhlf.exe
5448	rOPMAoe.exe
5476	YOrdKHK.exe
5504	xzVItoC.exe
5540	xMhNqOG.exe
5560	pQuNlsp.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2060-0-0x00007FF737850000-0x00007FF737C46000-memory.dmp	upx
behavioral2/files/0x000800000002350e-5.dat	upx
behavioral2/memory/464-8-0x00007FF627C40000-0x00007FF628036000-memory.dmp	upx
behavioral2/files/0x0007000000023513-15.dat	upx
behavioral2/files/0x0007000000023515-25.dat	upx
behavioral2/files/0x0007000000023519-47.dat	upx
behavioral2/files/0x0007000000023516-51.dat	upx
behavioral2/memory/2316-55-0x00007FF6B0F10000-0x00007FF6B1306000-memory.dmp	upx
behavioral2/memory/4844-57-0x00007FF67EC80000-0x00007FF67F076000-memory.dmp	upx
behavioral2/memory/1632-52-0x00007FF703CE0000-0x00007FF7040D6000-memory.dmp	upx
behavioral2/memory/2148-50-0x00007FF750C20000-0x00007FF751016000-memory.dmp	upx
behavioral2/memory/4308-48-0x00007FF6EC580000-0x00007FF6EC976000-memory.dmp	upx
behavioral2/memory/2208-45-0x00007FF770150000-0x00007FF770546000-memory.dmp	upx
behavioral2/files/0x0007000000023514-38.dat	upx
behavioral2/files/0x0007000000023512-17.dat	upx
behavioral2/files/0x0008000000023518-59.dat	upx
behavioral2/memory/2544-64-0x00007FF705530000-0x00007FF705926000-memory.dmp	upx
behavioral2/files/0x000800000002350f-67.dat	upx
behavioral2/files/0x0008000000023517-73.dat	upx
behavioral2/memory/4396-69-0x00007FF742BE0000-0x00007FF742FD6000-memory.dmp	upx
behavioral2/memory/1640-75-0x00007FF7963A0000-0x00007FF796796000-memory.dmp	upx
behavioral2/files/0x000700000002351a-78.dat	upx
behavioral2/files/0x000700000002351b-86.dat	upx
behavioral2/files/0x000700000002351d-90.dat	upx
behavioral2/memory/4656-105-0x00007FF75A0B0000-0x00007FF75A4A6000-memory.dmp	upx
behavioral2/files/0x0007000000023520-115.dat	upx
behavioral2/memory/3376-117-0x00007FF76AE80000-0x00007FF76B276000-memory.dmp	upx
behavioral2/memory/656-118-0x00007FF716DE0000-0x00007FF7171D6000-memory.dmp	upx
behavioral2/memory/768-119-0x00007FF73C2A0000-0x00007FF73C696000-memory.dmp	upx
behavioral2/files/0x0007000000023521-122.dat	upx
behavioral2/files/0x000700000002351f-113.dat	upx
behavioral2/memory/3184-111-0x00007FF6C96A0000-0x00007FF6C9A96000-memory.dmp	upx
behavioral2/files/0x000700000002351e-108.dat	upx
behavioral2/files/0x000700000002351c-100.dat	upx
behavioral2/memory/5016-98-0x00007FF6D92C0000-0x00007FF6D96B6000-memory.dmp	upx
behavioral2/memory/4108-91-0x00007FF721B40000-0x00007FF721F36000-memory.dmp	upx
behavioral2/memory/1100-84-0x00007FF72B370000-0x00007FF72B766000-memory.dmp	upx
behavioral2/files/0x0007000000023522-127.dat	upx
behavioral2/files/0x0002000000022a46-132.dat	upx
behavioral2/files/0x0002000000022a48-137.dat	upx
behavioral2/files/0x000f0000000232bc-141.dat	upx
behavioral2/files/0x0007000000023526-175.dat	upx
behavioral2/files/0x0007000000023528-185.dat	upx
behavioral2/files/0x000700000002352b-194.dat	upx
behavioral2/files/0x0007000000023529-190.dat	upx
behavioral2/files/0x000700000002352a-189.dat	upx
behavioral2/memory/2060-570-0x00007FF737850000-0x00007FF737C46000-memory.dmp	upx
behavioral2/files/0x0007000000023527-179.dat	upx
behavioral2/files/0x0007000000023525-170.dat	upx
behavioral2/files/0x0007000000023524-165.dat	upx
behavioral2/files/0x000c0000000232c8-160.dat	upx
behavioral2/files/0x000d0000000232c7-155.dat	upx
behavioral2/files/0x00090000000232c0-150.dat	upx
behavioral2/memory/1604-591-0x00007FF72E760000-0x00007FF72EB56000-memory.dmp	upx
behavioral2/memory/4856-586-0x00007FF608CF0000-0x00007FF6090E6000-memory.dmp	upx
behavioral2/memory/2296-600-0x00007FF71C860000-0x00007FF71CC56000-memory.dmp	upx
behavioral2/memory/464-613-0x00007FF627C40000-0x00007FF628036000-memory.dmp	upx
behavioral2/memory/4476-610-0x00007FF6C0990000-0x00007FF6C0D86000-memory.dmp	upx
behavioral2/memory/2292-595-0x00007FF709830000-0x00007FF709C26000-memory.dmp	upx
behavioral2/memory/704-578-0x00007FF751B90000-0x00007FF751F86000-memory.dmp	upx
behavioral2/memory/2544-1555-0x00007FF705530000-0x00007FF705926000-memory.dmp	upx
behavioral2/memory/3184-2678-0x00007FF6C96A0000-0x00007FF6C9A96000-memory.dmp	upx
behavioral2/memory/3376-2680-0x00007FF76AE80000-0x00007FF76B276000-memory.dmp	upx
behavioral2/memory/2316-4086-0x00007FF6B0F10000-0x00007FF6B1306000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BUJpjvk.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\ljxDjWv.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\swmLucM.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\ahCGjVq.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\neNVkfJ.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\zGjtemF.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\OdMAGJp.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\kpIOrnF.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\pLRzYxn.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\TAupPCy.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\qSHPaSo.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\JbwrORM.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\QuSUQmY.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\RAztFhh.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\jHKvtYH.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\MTvbUKu.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\gUYcBLZ.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\nsbvGzh.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\WTkSthx.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\ZUHEtXV.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\aWjaDLv.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\zNxBfmp.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\HWvdHDl.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\tBIfKie.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\HkieATy.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\AGJMQzU.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\IieuCgK.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\lUsxKIX.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\PDAyVxW.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\PWhhmdS.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\HTmJQNW.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\DEsNbLf.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\aqbrIBU.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\SVBzVOy.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\mAzcTND.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\ylYkVZw.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\Dhwizam.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\DWKkmoy.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\FHydbJK.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\qmpNrwJ.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\xAiRSTy.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\CYbcHzx.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\XUjfXZE.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\eSJGKIZ.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\GQVWlbM.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\SQDsbjE.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\BFNWvIx.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\KAJDGKf.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\qfwsmwv.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\xvMOKSX.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\NJdiXnS.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\QtvmQqC.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\XiJdqyp.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\BdptvfZ.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\MxGbDAv.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\GrBKxag.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\CTmqazo.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\mhPatgz.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\KTAVcnh.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\qsaTrwV.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\hMBMjMR.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\TBYVGoU.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\uEXAteS.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
File created	C:\Windows\System\rMTRFRc.exe	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
760	powershell.exe
760	powershell.exe
760	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
Token: SeDebugPrivilege	760	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 760	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	93
PID 2060 wrote to memory of 760	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	93
PID 2060 wrote to memory of 464	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	94
PID 2060 wrote to memory of 464	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	94
PID 2060 wrote to memory of 1632	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	95
PID 2060 wrote to memory of 1632	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	95
PID 2060 wrote to memory of 2208	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	96
PID 2060 wrote to memory of 2208	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	96
PID 2060 wrote to memory of 4308	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	97
PID 2060 wrote to memory of 4308	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	97
PID 2060 wrote to memory of 2148	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	98
PID 2060 wrote to memory of 2148	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	98
PID 2060 wrote to memory of 2316	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	99
PID 2060 wrote to memory of 2316	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	99
PID 2060 wrote to memory of 4844	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	100
PID 2060 wrote to memory of 4844	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	100
PID 2060 wrote to memory of 2544	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	101
PID 2060 wrote to memory of 2544	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	101
PID 2060 wrote to memory of 4396	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	103
PID 2060 wrote to memory of 4396	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	103
PID 2060 wrote to memory of 1640	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	104
PID 2060 wrote to memory of 1640	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	104
PID 2060 wrote to memory of 1100	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	105
PID 2060 wrote to memory of 1100	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	105
PID 2060 wrote to memory of 4108	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	108
PID 2060 wrote to memory of 4108	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	108
PID 2060 wrote to memory of 5016	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	109
PID 2060 wrote to memory of 5016	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	109
PID 2060 wrote to memory of 4656	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	110
PID 2060 wrote to memory of 4656	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	110
PID 2060 wrote to memory of 656	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	111
PID 2060 wrote to memory of 656	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	111
PID 2060 wrote to memory of 3184	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	112
PID 2060 wrote to memory of 3184	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	112
PID 2060 wrote to memory of 768	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	113
PID 2060 wrote to memory of 768	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	113
PID 2060 wrote to memory of 3376	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	114
PID 2060 wrote to memory of 3376	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	114
PID 2060 wrote to memory of 704	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	115
PID 2060 wrote to memory of 704	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	115
PID 2060 wrote to memory of 4476	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	116
PID 2060 wrote to memory of 4476	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	116
PID 2060 wrote to memory of 4856	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	117
PID 2060 wrote to memory of 4856	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	117
PID 2060 wrote to memory of 1604	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	118
PID 2060 wrote to memory of 1604	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	118
PID 2060 wrote to memory of 2292	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	119
PID 2060 wrote to memory of 2292	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	119
PID 2060 wrote to memory of 2296	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	120
PID 2060 wrote to memory of 2296	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	120
PID 2060 wrote to memory of 2408	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	121
PID 2060 wrote to memory of 2408	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	121
PID 2060 wrote to memory of 3704	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	122
PID 2060 wrote to memory of 3704	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	122
PID 2060 wrote to memory of 1400	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	123
PID 2060 wrote to memory of 1400	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	123
PID 2060 wrote to memory of 532	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	124
PID 2060 wrote to memory of 532	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	124
PID 2060 wrote to memory of 4288	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	125
PID 2060 wrote to memory of 4288	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	125
PID 2060 wrote to memory of 4684	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	126
PID 2060 wrote to memory of 4684	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	126
PID 2060 wrote to memory of 1296	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	127
PID 2060 wrote to memory of 1296	2060	9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe	127

C:\Users\Admin\AppData\Local\Temp\9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9ce4c034196ddec79da0046f8232cca0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:760
- C:\Windows\System\PERgJqn.exe
  C:\Windows\System\PERgJqn.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\mkEBAnM.exe
  C:\Windows\System\mkEBAnM.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\tfsZLtB.exe
  C:\Windows\System\tfsZLtB.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\aCeedeL.exe
  C:\Windows\System\aCeedeL.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\FRVVCFs.exe
  C:\Windows\System\FRVVCFs.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\MWUFnZB.exe
  C:\Windows\System\MWUFnZB.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\xDuspIg.exe
  C:\Windows\System\xDuspIg.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\wKHmehF.exe
  C:\Windows\System\wKHmehF.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\GTlfOaP.exe
  C:\Windows\System\GTlfOaP.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\MLYjtdV.exe
  C:\Windows\System\MLYjtdV.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\VbYDZld.exe
  C:\Windows\System\VbYDZld.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\IvNRTYq.exe
  C:\Windows\System\IvNRTYq.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\slMmxAl.exe
  C:\Windows\System\slMmxAl.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\GzKQxzt.exe
  C:\Windows\System\GzKQxzt.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\YKFCIdh.exe
  C:\Windows\System\YKFCIdh.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\pcbBAWN.exe
  C:\Windows\System\pcbBAWN.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\gYkVMuB.exe
  C:\Windows\System\gYkVMuB.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\hxPVuun.exe
  C:\Windows\System\hxPVuun.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\NMmqPSh.exe
  C:\Windows\System\NMmqPSh.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\kdnxhIP.exe
  C:\Windows\System\kdnxhIP.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\yDdhBSx.exe
  C:\Windows\System\yDdhBSx.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\TTKjrLA.exe
  C:\Windows\System\TTKjrLA.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\SKlNyqR.exe
  C:\Windows\System\SKlNyqR.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\lPuNblq.exe
  C:\Windows\System\lPuNblq.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\XwViUFS.exe
  C:\Windows\System\XwViUFS.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\icozioG.exe
  C:\Windows\System\icozioG.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\bukklJd.exe
  C:\Windows\System\bukklJd.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\ubuBZVq.exe
  C:\Windows\System\ubuBZVq.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\xqPqrRU.exe
  C:\Windows\System\xqPqrRU.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\LbNRuHZ.exe
  C:\Windows\System\LbNRuHZ.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\FrFUrAp.exe
  C:\Windows\System\FrFUrAp.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\grMcRWX.exe
  C:\Windows\System\grMcRWX.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\GhEDxyx.exe
  C:\Windows\System\GhEDxyx.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\FzBgDoB.exe
  C:\Windows\System\FzBgDoB.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\RgxANQr.exe
  C:\Windows\System\RgxANQr.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\VzoCZWE.exe
  C:\Windows\System\VzoCZWE.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\BCemoOG.exe
  C:\Windows\System\BCemoOG.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\uAlvget.exe
  C:\Windows\System\uAlvget.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\rmMSPFW.exe
  C:\Windows\System\rmMSPFW.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\USwIsYu.exe
  C:\Windows\System\USwIsYu.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\GxiVIYC.exe
  C:\Windows\System\GxiVIYC.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\aIikicE.exe
  C:\Windows\System\aIikicE.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\jTkXkiT.exe
  C:\Windows\System\jTkXkiT.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\zGzcdgo.exe
  C:\Windows\System\zGzcdgo.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\NsTmiKD.exe
  C:\Windows\System\NsTmiKD.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\pSdOIyT.exe
  C:\Windows\System\pSdOIyT.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\kpvRtqd.exe
  C:\Windows\System\kpvRtqd.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\joQUwtP.exe
  C:\Windows\System\joQUwtP.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\oHmhBfM.exe
  C:\Windows\System\oHmhBfM.exe
  2⤵
  - Executes dropped EXE
  PID:5140
- C:\Windows\System\FqheeDL.exe
  C:\Windows\System\FqheeDL.exe
  2⤵
  - Executes dropped EXE
  PID:5168
- C:\Windows\System\PvNIeKI.exe
  C:\Windows\System\PvNIeKI.exe
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\System\twpwSGJ.exe
  C:\Windows\System\twpwSGJ.exe
  2⤵
  - Executes dropped EXE
  PID:5220
- C:\Windows\System\RIPYnGc.exe
  C:\Windows\System\RIPYnGc.exe
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Windows\System\hvBjpdM.exe
  C:\Windows\System\hvBjpdM.exe
  2⤵
  - Executes dropped EXE
  PID:5280
- C:\Windows\System\wNIMbdD.exe
  C:\Windows\System\wNIMbdD.exe
  2⤵
  - Executes dropped EXE
  PID:5308
- C:\Windows\System\mocVusO.exe
  C:\Windows\System\mocVusO.exe
  2⤵
  - Executes dropped EXE
  PID:5336
- C:\Windows\System\gzKAMcq.exe
  C:\Windows\System\gzKAMcq.exe
  2⤵
  - Executes dropped EXE
  PID:5364
- C:\Windows\System\NJUdhJU.exe
  C:\Windows\System\NJUdhJU.exe
  2⤵
  - Executes dropped EXE
  PID:5392
- C:\Windows\System\iyhBhlf.exe
  C:\Windows\System\iyhBhlf.exe
  2⤵
  - Executes dropped EXE
  PID:5420
- C:\Windows\System\rOPMAoe.exe
  C:\Windows\System\rOPMAoe.exe
  2⤵
  - Executes dropped EXE
  PID:5448
- C:\Windows\System\YOrdKHK.exe
  C:\Windows\System\YOrdKHK.exe
  2⤵
  - Executes dropped EXE
  PID:5476
- C:\Windows\System\xzVItoC.exe
  C:\Windows\System\xzVItoC.exe
  2⤵
  - Executes dropped EXE
  PID:5504
- C:\Windows\System\xMhNqOG.exe
  C:\Windows\System\xMhNqOG.exe
  2⤵
  - Executes dropped EXE
  PID:5540
- C:\Windows\System\pQuNlsp.exe
  C:\Windows\System\pQuNlsp.exe
  2⤵
  - Executes dropped EXE
  PID:5560
- C:\Windows\System\QXaRcZO.exe
  C:\Windows\System\QXaRcZO.exe
  2⤵
  PID:5588
- C:\Windows\System\ktVZWmo.exe
  C:\Windows\System\ktVZWmo.exe
  2⤵
  PID:5616
- C:\Windows\System\wMZxdQU.exe
  C:\Windows\System\wMZxdQU.exe
  2⤵
  PID:5644
- C:\Windows\System\YwxWfFu.exe
  C:\Windows\System\YwxWfFu.exe
  2⤵
  PID:5672
- C:\Windows\System\mlrcJzD.exe
  C:\Windows\System\mlrcJzD.exe
  2⤵
  PID:5700
- C:\Windows\System\VDvxbaL.exe
  C:\Windows\System\VDvxbaL.exe
  2⤵
  PID:5732
- C:\Windows\System\fWbNKsi.exe
  C:\Windows\System\fWbNKsi.exe
  2⤵
  PID:5756
- C:\Windows\System\RnFhXOn.exe
  C:\Windows\System\RnFhXOn.exe
  2⤵
  PID:5784
- C:\Windows\System\hpqEKLF.exe
  C:\Windows\System\hpqEKLF.exe
  2⤵
  PID:5812
- C:\Windows\System\fyTkAdq.exe
  C:\Windows\System\fyTkAdq.exe
  2⤵
  PID:5840
- C:\Windows\System\CCyIWcn.exe
  C:\Windows\System\CCyIWcn.exe
  2⤵
  PID:5868
- C:\Windows\System\rgidwhA.exe
  C:\Windows\System\rgidwhA.exe
  2⤵
  PID:5896
- C:\Windows\System\qCdEmpp.exe
  C:\Windows\System\qCdEmpp.exe
  2⤵
  PID:5924
- C:\Windows\System\feDvEJU.exe
  C:\Windows\System\feDvEJU.exe
  2⤵
  PID:5952
- C:\Windows\System\cychsBS.exe
  C:\Windows\System\cychsBS.exe
  2⤵
  PID:5980
- C:\Windows\System\eMMSZSQ.exe
  C:\Windows\System\eMMSZSQ.exe
  2⤵
  PID:6008
- C:\Windows\System\pNrObin.exe
  C:\Windows\System\pNrObin.exe
  2⤵
  PID:6036
- C:\Windows\System\LTzkEog.exe
  C:\Windows\System\LTzkEog.exe
  2⤵
  PID:6064
- C:\Windows\System\ukkmnpv.exe
  C:\Windows\System\ukkmnpv.exe
  2⤵
  PID:6092
- C:\Windows\System\zHHUdaL.exe
  C:\Windows\System\zHHUdaL.exe
  2⤵
  PID:6120
- C:\Windows\System\XWRVZtL.exe
  C:\Windows\System\XWRVZtL.exe
  2⤵
  PID:3844
- C:\Windows\System\DSrEvBF.exe
  C:\Windows\System\DSrEvBF.exe
  2⤵
  PID:4580
- C:\Windows\System\sAyvwoL.exe
  C:\Windows\System\sAyvwoL.exe
  2⤵
  PID:3812
- C:\Windows\System\KpIXpRE.exe
  C:\Windows\System\KpIXpRE.exe
  2⤵
  PID:5124
- C:\Windows\System\ydSMhwI.exe
  C:\Windows\System\ydSMhwI.exe
  2⤵
  PID:5184
- C:\Windows\System\aEwgiQw.exe
  C:\Windows\System\aEwgiQw.exe
  2⤵
  PID:5244
- C:\Windows\System\JShYzoc.exe
  C:\Windows\System\JShYzoc.exe
  2⤵
  PID:5320
- C:\Windows\System\bCHrDjB.exe
  C:\Windows\System\bCHrDjB.exe
  2⤵
  PID:5380
- C:\Windows\System\ATjXdhc.exe
  C:\Windows\System\ATjXdhc.exe
  2⤵
  PID:5432
- C:\Windows\System\UcqGKmp.exe
  C:\Windows\System\UcqGKmp.exe
  2⤵
  PID:5492
- C:\Windows\System\otOoXEq.exe
  C:\Windows\System\otOoXEq.exe
  2⤵
  PID:5556
- C:\Windows\System\gauveXg.exe
  C:\Windows\System\gauveXg.exe
  2⤵
  PID:5628
- C:\Windows\System\lmlLJAl.exe
  C:\Windows\System\lmlLJAl.exe
  2⤵
  PID:5684
- C:\Windows\System\pjHTIuj.exe
  C:\Windows\System\pjHTIuj.exe
  2⤵
  PID:5748
- C:\Windows\System\vAnIKtw.exe
  C:\Windows\System\vAnIKtw.exe
  2⤵
  PID:5796
- C:\Windows\System\UWXJFYD.exe
  C:\Windows\System\UWXJFYD.exe
  2⤵
  PID:5852
- C:\Windows\System\iCmFhAw.exe
  C:\Windows\System\iCmFhAw.exe
  2⤵
  PID:5912
- C:\Windows\System\bnaGNdn.exe
  C:\Windows\System\bnaGNdn.exe
  2⤵
  PID:5968
- C:\Windows\System\gNevUOK.exe
  C:\Windows\System\gNevUOK.exe
  2⤵
  PID:6024
- C:\Windows\System\uCLCLNl.exe
  C:\Windows\System\uCLCLNl.exe
  2⤵
  PID:6084
- C:\Windows\System\fvZqLam.exe
  C:\Windows\System\fvZqLam.exe
  2⤵
  PID:4552
- C:\Windows\System\cEkGedh.exe
  C:\Windows\System\cEkGedh.exe
  2⤵
  PID:3452
- C:\Windows\System\MvEhmGY.exe
  C:\Windows\System\MvEhmGY.exe
  2⤵
  PID:1724
- C:\Windows\System\xxmcBFO.exe
  C:\Windows\System\xxmcBFO.exe
  2⤵
  PID:5348
- C:\Windows\System\GbwTauA.exe
  C:\Windows\System\GbwTauA.exe
  2⤵
  PID:5464
- C:\Windows\System\wMANLZF.exe
  C:\Windows\System\wMANLZF.exe
  2⤵
  PID:5600
- C:\Windows\System\RSJPrtz.exe
  C:\Windows\System\RSJPrtz.exe
  2⤵
  PID:5716
- C:\Windows\System\oRXrXip.exe
  C:\Windows\System\oRXrXip.exe
  2⤵
  PID:3652
- C:\Windows\System\KWhkaSr.exe
  C:\Windows\System\KWhkaSr.exe
  2⤵
  PID:5944
- C:\Windows\System\RqqwvFZ.exe
  C:\Windows\System\RqqwvFZ.exe
  2⤵
  PID:6056
- C:\Windows\System\zxkYmsa.exe
  C:\Windows\System\zxkYmsa.exe
  2⤵
  PID:1196
- C:\Windows\System\twItlvR.exe
  C:\Windows\System\twItlvR.exe
  2⤵
  PID:5272
- C:\Windows\System\doiUrTt.exe
  C:\Windows\System\doiUrTt.exe
  2⤵
  PID:5580
- C:\Windows\System\eTVaCRK.exe
  C:\Windows\System\eTVaCRK.exe
  2⤵
  PID:5880
- C:\Windows\System\NKOvpry.exe
  C:\Windows\System\NKOvpry.exe
  2⤵
  PID:6164
- C:\Windows\System\ZsCKyvy.exe
  C:\Windows\System\ZsCKyvy.exe
  2⤵
  PID:6192
- C:\Windows\System\yvQycDX.exe
  C:\Windows\System\yvQycDX.exe
  2⤵
  PID:6220
- C:\Windows\System\VuyjVfm.exe
  C:\Windows\System\VuyjVfm.exe
  2⤵
  PID:6248
- C:\Windows\System\lTwyQuN.exe
  C:\Windows\System\lTwyQuN.exe
  2⤵
  PID:6276
- C:\Windows\System\mUlNhfz.exe
  C:\Windows\System\mUlNhfz.exe
  2⤵
  PID:6304
- C:\Windows\System\ZdscWej.exe
  C:\Windows\System\ZdscWej.exe
  2⤵
  PID:6332
- C:\Windows\System\YgAVdbc.exe
  C:\Windows\System\YgAVdbc.exe
  2⤵
  PID:6360
- C:\Windows\System\SjiacZb.exe
  C:\Windows\System\SjiacZb.exe
  2⤵
  PID:6388
- C:\Windows\System\RAgxOvN.exe
  C:\Windows\System\RAgxOvN.exe
  2⤵
  PID:6416
- C:\Windows\System\kxtDmSS.exe
  C:\Windows\System\kxtDmSS.exe
  2⤵
  PID:6444
- C:\Windows\System\BAvTRYU.exe
  C:\Windows\System\BAvTRYU.exe
  2⤵
  PID:6472
- C:\Windows\System\wnTnlxr.exe
  C:\Windows\System\wnTnlxr.exe
  2⤵
  PID:6500
- C:\Windows\System\PlDsuCq.exe
  C:\Windows\System\PlDsuCq.exe
  2⤵
  PID:6528
- C:\Windows\System\AuaszDM.exe
  C:\Windows\System\AuaszDM.exe
  2⤵
  PID:6556
- C:\Windows\System\wDkGOIt.exe
  C:\Windows\System\wDkGOIt.exe
  2⤵
  PID:6584
- C:\Windows\System\eYmjHqU.exe
  C:\Windows\System\eYmjHqU.exe
  2⤵
  PID:6612
- C:\Windows\System\ddtqRPA.exe
  C:\Windows\System\ddtqRPA.exe
  2⤵
  PID:6640
- C:\Windows\System\NCWtdOf.exe
  C:\Windows\System\NCWtdOf.exe
  2⤵
  PID:6668
- C:\Windows\System\FXYfQka.exe
  C:\Windows\System\FXYfQka.exe
  2⤵
  PID:6696
- C:\Windows\System\sOUfESr.exe
  C:\Windows\System\sOUfESr.exe
  2⤵
  PID:6724
- C:\Windows\System\NbuBYfI.exe
  C:\Windows\System\NbuBYfI.exe
  2⤵
  PID:6752
- C:\Windows\System\hXOklVH.exe
  C:\Windows\System\hXOklVH.exe
  2⤵
  PID:6780
- C:\Windows\System\BYnfvBI.exe
  C:\Windows\System\BYnfvBI.exe
  2⤵
  PID:6808
- C:\Windows\System\CtudUCV.exe
  C:\Windows\System\CtudUCV.exe
  2⤵
  PID:6836
- C:\Windows\System\udpmEdN.exe
  C:\Windows\System\udpmEdN.exe
  2⤵
  PID:6864
- C:\Windows\System\UJOzJjf.exe
  C:\Windows\System\UJOzJjf.exe
  2⤵
  PID:6892
- C:\Windows\System\ESAEMpH.exe
  C:\Windows\System\ESAEMpH.exe
  2⤵
  PID:6920
- C:\Windows\System\YprBlHz.exe
  C:\Windows\System\YprBlHz.exe
  2⤵
  PID:6948
- C:\Windows\System\UzVLZBA.exe
  C:\Windows\System\UzVLZBA.exe
  2⤵
  PID:6976
- C:\Windows\System\LDabdrP.exe
  C:\Windows\System\LDabdrP.exe
  2⤵
  PID:7004
- C:\Windows\System\VQndCPj.exe
  C:\Windows\System\VQndCPj.exe
  2⤵
  PID:7032
- C:\Windows\System\whJymHp.exe
  C:\Windows\System\whJymHp.exe
  2⤵
  PID:7060
- C:\Windows\System\fnfmIcl.exe
  C:\Windows\System\fnfmIcl.exe
  2⤵
  PID:7088
- C:\Windows\System\yhyChAn.exe
  C:\Windows\System\yhyChAn.exe
  2⤵
  PID:7116
- C:\Windows\System\tegqXbN.exe
  C:\Windows\System\tegqXbN.exe
  2⤵
  PID:7144
- C:\Windows\System\osfyCmh.exe
  C:\Windows\System\osfyCmh.exe
  2⤵
  PID:6000
- C:\Windows\System\swCEAOl.exe
  C:\Windows\System\swCEAOl.exe
  2⤵
  PID:5152
- C:\Windows\System\KZQRcEu.exe
  C:\Windows\System\KZQRcEu.exe
  2⤵
  PID:5772
- C:\Windows\System\CdSOpPJ.exe
  C:\Windows\System\CdSOpPJ.exe
  2⤵
  PID:6184
- C:\Windows\System\yOzknSn.exe
  C:\Windows\System\yOzknSn.exe
  2⤵
  PID:6260
- C:\Windows\System\wTmAIEU.exe
  C:\Windows\System\wTmAIEU.exe
  2⤵
  PID:6324
- C:\Windows\System\ZuMCaAa.exe
  C:\Windows\System\ZuMCaAa.exe
  2⤵
  PID:6380
- C:\Windows\System\RgJgWkE.exe
  C:\Windows\System\RgJgWkE.exe
  2⤵
  PID:6432
- C:\Windows\System\MFyNgGs.exe
  C:\Windows\System\MFyNgGs.exe
  2⤵
  PID:6492
- C:\Windows\System\cxJJVvL.exe
  C:\Windows\System\cxJJVvL.exe
  2⤵
  PID:6548
- C:\Windows\System\XAHfPeV.exe
  C:\Windows\System\XAHfPeV.exe
  2⤵
  PID:6600
- C:\Windows\System\fkXBCiq.exe
  C:\Windows\System\fkXBCiq.exe
  2⤵
  PID:6656
- C:\Windows\System\yvLdhke.exe
  C:\Windows\System\yvLdhke.exe
  2⤵
  PID:6736
- C:\Windows\System\JiXGdks.exe
  C:\Windows\System\JiXGdks.exe
  2⤵
  PID:6852
- C:\Windows\System\urOvqSP.exe
  C:\Windows\System\urOvqSP.exe
  2⤵
  PID:6904
- C:\Windows\System\uBWKfOE.exe
  C:\Windows\System\uBWKfOE.exe
  2⤵
  PID:6964
- C:\Windows\System\FwkBcqs.exe
  C:\Windows\System\FwkBcqs.exe
  2⤵
  PID:7016
- C:\Windows\System\Ocvtywz.exe
  C:\Windows\System\Ocvtywz.exe
  2⤵
  PID:7108
- C:\Windows\System\GLuqkCY.exe
  C:\Windows\System\GLuqkCY.exe
  2⤵
  PID:6212
- C:\Windows\System\JRVpaFX.exe
  C:\Windows\System\JRVpaFX.exe
  2⤵
  PID:6156
- C:\Windows\System\MfCkNpe.exe
  C:\Windows\System\MfCkNpe.exe
  2⤵
  PID:6408
- C:\Windows\System\ZqCbWCZ.exe
  C:\Windows\System\ZqCbWCZ.exe
  2⤵
  PID:2264
- C:\Windows\System\GTGviZP.exe
  C:\Windows\System\GTGviZP.exe
  2⤵
  PID:4960
- C:\Windows\System\FnfEddl.exe
  C:\Windows\System\FnfEddl.exe
  2⤵
  PID:6652
- C:\Windows\System\pBfaLqM.exe
  C:\Windows\System\pBfaLqM.exe
  2⤵
  PID:6512
- C:\Windows\System\namLrYG.exe
  C:\Windows\System\namLrYG.exe
  2⤵
  PID:6792
- C:\Windows\System\hptTkPU.exe
  C:\Windows\System\hptTkPU.exe
  2⤵
  PID:6988
- C:\Windows\System\BPsRLjA.exe
  C:\Windows\System\BPsRLjA.exe
  2⤵
  PID:7072
- C:\Windows\System\vffqLjL.exe
  C:\Windows\System\vffqLjL.exe
  2⤵
  PID:5996
- C:\Windows\System\DdBUgWs.exe
  C:\Windows\System\DdBUgWs.exe
  2⤵
  PID:4548
- C:\Windows\System\xikwIHA.exe
  C:\Windows\System\xikwIHA.exe
  2⤵
  PID:6352
- C:\Windows\System\QggGwLO.exe
  C:\Windows\System\QggGwLO.exe
  2⤵
  PID:6824
- C:\Windows\System\vRlJsxt.exe
  C:\Windows\System\vRlJsxt.exe
  2⤵
  PID:6992
- C:\Windows\System\uiCnDeR.exe
  C:\Windows\System\uiCnDeR.exe
  2⤵
  PID:2504
- C:\Windows\System\pGxuoBO.exe
  C:\Windows\System\pGxuoBO.exe
  2⤵
  PID:7048
- C:\Windows\System\VhxOoAb.exe
  C:\Windows\System\VhxOoAb.exe
  2⤵
  PID:6540
- C:\Windows\System\ANhcdGV.exe
  C:\Windows\System\ANhcdGV.exe
  2⤵
  PID:7180
- C:\Windows\System\MdVTdZw.exe
  C:\Windows\System\MdVTdZw.exe
  2⤵
  PID:7196
- C:\Windows\System\FDggogD.exe
  C:\Windows\System\FDggogD.exe
  2⤵
  PID:7216
- C:\Windows\System\bwFrGBq.exe
  C:\Windows\System\bwFrGBq.exe
  2⤵
  PID:7240
- C:\Windows\System\zviQeCU.exe
  C:\Windows\System\zviQeCU.exe
  2⤵
  PID:7308
- C:\Windows\System\YSINkLy.exe
  C:\Windows\System\YSINkLy.exe
  2⤵
  PID:7336
- C:\Windows\System\gllqiDI.exe
  C:\Windows\System\gllqiDI.exe
  2⤵
  PID:7388
- C:\Windows\System\EWfvRLN.exe
  C:\Windows\System\EWfvRLN.exe
  2⤵
  PID:7416
- C:\Windows\System\bGwlEkC.exe
  C:\Windows\System\bGwlEkC.exe
  2⤵
  PID:7440
- C:\Windows\System\xsRJRik.exe
  C:\Windows\System\xsRJRik.exe
  2⤵
  PID:7460
- C:\Windows\System\meYWIqi.exe
  C:\Windows\System\meYWIqi.exe
  2⤵
  PID:7500
- C:\Windows\System\rMMUOPJ.exe
  C:\Windows\System\rMMUOPJ.exe
  2⤵
  PID:7516
- C:\Windows\System\xTunALa.exe
  C:\Windows\System\xTunALa.exe
  2⤵
  PID:7556
- C:\Windows\System\gZcSZKQ.exe
  C:\Windows\System\gZcSZKQ.exe
  2⤵
  PID:7588
- C:\Windows\System\WmoyqUQ.exe
  C:\Windows\System\WmoyqUQ.exe
  2⤵
  PID:7616
- C:\Windows\System\YBKXxtV.exe
  C:\Windows\System\YBKXxtV.exe
  2⤵
  PID:7636
- C:\Windows\System\CruVTJT.exe
  C:\Windows\System\CruVTJT.exe
  2⤵
  PID:7668
- C:\Windows\System\DIzYtLp.exe
  C:\Windows\System\DIzYtLp.exe
  2⤵
  PID:7708
- C:\Windows\System\YsXdrBP.exe
  C:\Windows\System\YsXdrBP.exe
  2⤵
  PID:7728
- C:\Windows\System\yOuDJdN.exe
  C:\Windows\System\yOuDJdN.exe
  2⤵
  PID:7764
- C:\Windows\System\onryRRN.exe
  C:\Windows\System\onryRRN.exe
  2⤵
  PID:7780
- C:\Windows\System\iHvrFtN.exe
  C:\Windows\System\iHvrFtN.exe
  2⤵
  PID:7820
- C:\Windows\System\GUMbQFB.exe
  C:\Windows\System\GUMbQFB.exe
  2⤵
  PID:7848
- C:\Windows\System\xJlOIfN.exe
  C:\Windows\System\xJlOIfN.exe
  2⤵
  PID:7896
- C:\Windows\System\KuXZYjo.exe
  C:\Windows\System\KuXZYjo.exe
  2⤵
  PID:7940
- C:\Windows\System\HGyEsCF.exe
  C:\Windows\System\HGyEsCF.exe
  2⤵
  PID:7956
- C:\Windows\System\UjsxRVC.exe
  C:\Windows\System\UjsxRVC.exe
  2⤵
  PID:8004
- C:\Windows\System\wNRjXNU.exe
  C:\Windows\System\wNRjXNU.exe
  2⤵
  PID:8036
- C:\Windows\System\SGyTDrV.exe
  C:\Windows\System\SGyTDrV.exe
  2⤵
  PID:8064
- C:\Windows\System\MdwClHJ.exe
  C:\Windows\System\MdwClHJ.exe
  2⤵
  PID:8092
- C:\Windows\System\YMpCtuD.exe
  C:\Windows\System\YMpCtuD.exe
  2⤵
  PID:8108
- C:\Windows\System\SYYTtka.exe
  C:\Windows\System\SYYTtka.exe
  2⤵
  PID:8136
- C:\Windows\System\gKVzyFN.exe
  C:\Windows\System\gKVzyFN.exe
  2⤵
  PID:8180
- C:\Windows\System\TZKXwgq.exe
  C:\Windows\System\TZKXwgq.exe
  2⤵
  PID:6572
- C:\Windows\System\HpBJqQj.exe
  C:\Windows\System\HpBJqQj.exe
  2⤵
  PID:6520
- C:\Windows\System\gqccxMv.exe
  C:\Windows\System\gqccxMv.exe
  2⤵
  PID:7252
- C:\Windows\System\oAlckSO.exe
  C:\Windows\System\oAlckSO.exe
  2⤵
  PID:6348
- C:\Windows\System\CbFoBfk.exe
  C:\Windows\System\CbFoBfk.exe
  2⤵
  PID:7368
- C:\Windows\System\LbtqXnk.exe
  C:\Windows\System\LbtqXnk.exe
  2⤵
  PID:7456
- C:\Windows\System\XxhAGoq.exe
  C:\Windows\System\XxhAGoq.exe
  2⤵
  PID:7480
- C:\Windows\System\GgSPxPz.exe
  C:\Windows\System\GgSPxPz.exe
  2⤵
  PID:7580
- C:\Windows\System\zkLwIXZ.exe
  C:\Windows\System\zkLwIXZ.exe
  2⤵
  PID:7628
- C:\Windows\System\SLWVFup.exe
  C:\Windows\System\SLWVFup.exe
  2⤵
  PID:7720
- C:\Windows\System\IfRAxOW.exe
  C:\Windows\System\IfRAxOW.exe
  2⤵
  PID:7744
- C:\Windows\System\iexTZdm.exe
  C:\Windows\System\iexTZdm.exe
  2⤵
  PID:7844
- C:\Windows\System\gefJijO.exe
  C:\Windows\System\gefJijO.exe
  2⤵
  PID:7932
- C:\Windows\System\KFBjLoW.exe
  C:\Windows\System\KFBjLoW.exe
  2⤵
  PID:3856
- C:\Windows\System\XKNhYlO.exe
  C:\Windows\System\XKNhYlO.exe
  2⤵
  PID:8076
- C:\Windows\System\MyeqCeZ.exe
  C:\Windows\System\MyeqCeZ.exe
  2⤵
  PID:8128
- C:\Windows\System\JCaagWo.exe
  C:\Windows\System\JCaagWo.exe
  2⤵
  PID:7156
- C:\Windows\System\PkfXmyb.exe
  C:\Windows\System\PkfXmyb.exe
  2⤵
  PID:7224
- C:\Windows\System\cytyNoo.exe
  C:\Windows\System\cytyNoo.exe
  2⤵
  PID:6112
- C:\Windows\System\oOzSdPw.exe
  C:\Windows\System\oOzSdPw.exe
  2⤵
  PID:7584
- C:\Windows\System\qYDwIzY.exe
  C:\Windows\System\qYDwIzY.exe
  2⤵
  PID:7644
- C:\Windows\System\gIBwMxy.exe
  C:\Windows\System\gIBwMxy.exe
  2⤵
  PID:7872
- C:\Windows\System\dOVULVn.exe
  C:\Windows\System\dOVULVn.exe
  2⤵
  PID:8056
- C:\Windows\System\bSeVoDM.exe
  C:\Windows\System\bSeVoDM.exe
  2⤵
  PID:8172
- C:\Windows\System\tTplPLw.exe
  C:\Windows\System\tTplPLw.exe
  2⤵
  PID:7448
- C:\Windows\System\tpgjshh.exe
  C:\Windows\System\tpgjshh.exe
  2⤵
  PID:7804
- C:\Windows\System\igfwAzJ.exe
  C:\Windows\System\igfwAzJ.exe
  2⤵
  PID:8104
- C:\Windows\System\kQGrKfA.exe
  C:\Windows\System\kQGrKfA.exe
  2⤵
  PID:7736
- C:\Windows\System\FHVQrzA.exe
  C:\Windows\System\FHVQrzA.exe
  2⤵
  PID:8200
- C:\Windows\System\wLmJMOc.exe
  C:\Windows\System\wLmJMOc.exe
  2⤵
  PID:8220
- C:\Windows\System\coEqDvO.exe
  C:\Windows\System\coEqDvO.exe
  2⤵
  PID:8240
- C:\Windows\System\rTPOyXn.exe
  C:\Windows\System\rTPOyXn.exe
  2⤵
  PID:8256
- C:\Windows\System\YzkzuHW.exe
  C:\Windows\System\YzkzuHW.exe
  2⤵
  PID:8320
- C:\Windows\System\nTByKzp.exe
  C:\Windows\System\nTByKzp.exe
  2⤵
  PID:8348
- C:\Windows\System\AMwKMlj.exe
  C:\Windows\System\AMwKMlj.exe
  2⤵
  PID:8376
- C:\Windows\System\dcpiBtT.exe
  C:\Windows\System\dcpiBtT.exe
  2⤵
  PID:8412
- C:\Windows\System\rdfSxar.exe
  C:\Windows\System\rdfSxar.exe
  2⤵
  PID:8428
- C:\Windows\System\VEBjKVO.exe
  C:\Windows\System\VEBjKVO.exe
  2⤵
  PID:8460
- C:\Windows\System\hpFYrEh.exe
  C:\Windows\System\hpFYrEh.exe
  2⤵
  PID:8476
- C:\Windows\System\qWtbscJ.exe
  C:\Windows\System\qWtbscJ.exe
  2⤵
  PID:8528
- C:\Windows\System\NJGjXIq.exe
  C:\Windows\System\NJGjXIq.exe
  2⤵
  PID:8552
- C:\Windows\System\xVpzyrm.exe
  C:\Windows\System\xVpzyrm.exe
  2⤵
  PID:8584
- C:\Windows\System\hrGLVkS.exe
  C:\Windows\System\hrGLVkS.exe
  2⤵
  PID:8616
- C:\Windows\System\qipihHs.exe
  C:\Windows\System\qipihHs.exe
  2⤵
  PID:8640
- C:\Windows\System\lDlfUjJ.exe
  C:\Windows\System\lDlfUjJ.exe
  2⤵
  PID:8672
- C:\Windows\System\QezeMKc.exe
  C:\Windows\System\QezeMKc.exe
  2⤵
  PID:8692
- C:\Windows\System\tJbffCG.exe
  C:\Windows\System\tJbffCG.exe
  2⤵
  PID:8716
- C:\Windows\System\PchAWtr.exe
  C:\Windows\System\PchAWtr.exe
  2⤵
  PID:8756
- C:\Windows\System\HMhjjUj.exe
  C:\Windows\System\HMhjjUj.exe
  2⤵
  PID:8784
- C:\Windows\System\inaGxgn.exe
  C:\Windows\System\inaGxgn.exe
  2⤵
  PID:8808
- C:\Windows\System\GnYskol.exe
  C:\Windows\System\GnYskol.exe
  2⤵
  PID:8852
- C:\Windows\System\BSchjdn.exe
  C:\Windows\System\BSchjdn.exe
  2⤵
  PID:8868
- C:\Windows\System\aXLapSD.exe
  C:\Windows\System\aXLapSD.exe
  2⤵
  PID:8896
- C:\Windows\System\KHahIdG.exe
  C:\Windows\System\KHahIdG.exe
  2⤵
  PID:8916
- C:\Windows\System\uhGLvYQ.exe
  C:\Windows\System\uhGLvYQ.exe
  2⤵
  PID:8948
- C:\Windows\System\pBgwJgn.exe
  C:\Windows\System\pBgwJgn.exe
  2⤵
  PID:8972
- C:\Windows\System\mDqEuHb.exe
  C:\Windows\System\mDqEuHb.exe
  2⤵
  PID:9012
- C:\Windows\System\YVNTIne.exe
  C:\Windows\System\YVNTIne.exe
  2⤵
  PID:9040
- C:\Windows\System\ClLOfmK.exe
  C:\Windows\System\ClLOfmK.exe
  2⤵
  PID:9068
- C:\Windows\System\vqhlevj.exe
  C:\Windows\System\vqhlevj.exe
  2⤵
  PID:9096
- C:\Windows\System\JCNXaUS.exe
  C:\Windows\System\JCNXaUS.exe
  2⤵
  PID:9124
- C:\Windows\System\BYXMovm.exe
  C:\Windows\System\BYXMovm.exe
  2⤵
  PID:9140
- C:\Windows\System\vvFksDr.exe
  C:\Windows\System\vvFksDr.exe
  2⤵
  PID:9180
- C:\Windows\System\ZNnbJNI.exe
  C:\Windows\System\ZNnbJNI.exe
  2⤵
  PID:9196
- C:\Windows\System\yAHIaOL.exe
  C:\Windows\System\yAHIaOL.exe
  2⤵
  PID:8216
- C:\Windows\System\OratNSh.exe
  C:\Windows\System\OratNSh.exe
  2⤵
  PID:8288
- C:\Windows\System\GGztuUt.exe
  C:\Windows\System\GGztuUt.exe
  2⤵
  PID:8360
- C:\Windows\System\hYQmqKn.exe
  C:\Windows\System\hYQmqKn.exe
  2⤵
  PID:8400
- C:\Windows\System\GAIHENV.exe
  C:\Windows\System\GAIHENV.exe
  2⤵
  PID:8424
- C:\Windows\System\QjDUoAy.exe
  C:\Windows\System\QjDUoAy.exe
  2⤵
  PID:3680
- C:\Windows\System\aRLrrXe.exe
  C:\Windows\System\aRLrrXe.exe
  2⤵
  PID:4616
- C:\Windows\System\zYRFNPB.exe
  C:\Windows\System\zYRFNPB.exe
  2⤵
  PID:8512
- C:\Windows\System\MTcRwNp.exe
  C:\Windows\System\MTcRwNp.exe
  2⤵
  PID:8540
- C:\Windows\System\YugKEvv.exe
  C:\Windows\System\YugKEvv.exe
  2⤵
  PID:8576
- C:\Windows\System\WjdphtL.exe
  C:\Windows\System\WjdphtL.exe
  2⤵
  PID:8664
- C:\Windows\System\vdnXPGb.exe
  C:\Windows\System\vdnXPGb.exe
  2⤵
  PID:8752
- C:\Windows\System\rflGxst.exe
  C:\Windows\System\rflGxst.exe
  2⤵
  PID:8820
- C:\Windows\System\NjwOkmD.exe
  C:\Windows\System\NjwOkmD.exe
  2⤵
  PID:8888
- C:\Windows\System\bCvgWHC.exe
  C:\Windows\System\bCvgWHC.exe
  2⤵
  PID:8964
- C:\Windows\System\CFYwrkh.exe
  C:\Windows\System\CFYwrkh.exe
  2⤵
  PID:9032
- C:\Windows\System\BqXvrUO.exe
  C:\Windows\System\BqXvrUO.exe
  2⤵
  PID:9080
- C:\Windows\System\KgmTFkw.exe
  C:\Windows\System\KgmTFkw.exe
  2⤵
  PID:9132
- C:\Windows\System\GprqrzC.exe
  C:\Windows\System\GprqrzC.exe
  2⤵
  PID:9188
- C:\Windows\System\yEMwFvC.exe
  C:\Windows\System\yEMwFvC.exe
  2⤵
  PID:8336
- C:\Windows\System\DcqheuO.exe
  C:\Windows\System\DcqheuO.exe
  2⤵
  PID:8396
- C:\Windows\System\nrFIQrG.exe
  C:\Windows\System\nrFIQrG.exe
  2⤵
  PID:2856
- C:\Windows\System\jvxrjcG.exe
  C:\Windows\System\jvxrjcG.exe
  2⤵
  PID:8524
- C:\Windows\System\FFYkZJy.exe
  C:\Windows\System\FFYkZJy.exe
  2⤵
  PID:8740
- C:\Windows\System\yylsEMY.exe
  C:\Windows\System\yylsEMY.exe
  2⤵
  PID:8792
- C:\Windows\System\QqGRfUQ.exe
  C:\Windows\System\QqGRfUQ.exe
  2⤵
  PID:9036
- C:\Windows\System\FsPcVmW.exe
  C:\Windows\System\FsPcVmW.exe
  2⤵
  PID:9088
- C:\Windows\System\SgzemZS.exe
  C:\Windows\System\SgzemZS.exe
  2⤵
  PID:8276
- C:\Windows\System\hLfGYRz.exe
  C:\Windows\System\hLfGYRz.exe
  2⤵
  PID:8492
- C:\Windows\System\PepvNjx.exe
  C:\Windows\System\PepvNjx.exe
  2⤵
  PID:8984
- C:\Windows\System\sOCLaqS.exe
  C:\Windows\System\sOCLaqS.exe
  2⤵
  PID:2876
- C:\Windows\System\ZzUIruy.exe
  C:\Windows\System\ZzUIruy.exe
  2⤵
  PID:9008
- C:\Windows\System\CfvWUfv.exe
  C:\Windows\System\CfvWUfv.exe
  2⤵
  PID:8776
- C:\Windows\System\ITsforT.exe
  C:\Windows\System\ITsforT.exe
  2⤵
  PID:9252
- C:\Windows\System\wOgSUVu.exe
  C:\Windows\System\wOgSUVu.exe
  2⤵
  PID:9280
- C:\Windows\System\LuhrqYW.exe
  C:\Windows\System\LuhrqYW.exe
  2⤵
  PID:9308
- C:\Windows\System\PQNXmmJ.exe
  C:\Windows\System\PQNXmmJ.exe
  2⤵
  PID:9336
- C:\Windows\System\JNqepjs.exe
  C:\Windows\System\JNqepjs.exe
  2⤵
  PID:9364
- C:\Windows\System\xuuJxNx.exe
  C:\Windows\System\xuuJxNx.exe
  2⤵
  PID:9392
- C:\Windows\System\CqNSQpB.exe
  C:\Windows\System\CqNSQpB.exe
  2⤵
  PID:9408
- C:\Windows\System\UevmiSY.exe
  C:\Windows\System\UevmiSY.exe
  2⤵
  PID:9452
- C:\Windows\System\OcNlVtn.exe
  C:\Windows\System\OcNlVtn.exe
  2⤵
  PID:9480
- C:\Windows\System\OfAdCde.exe
  C:\Windows\System\OfAdCde.exe
  2⤵
  PID:9508
- C:\Windows\System\yZpQsGw.exe
  C:\Windows\System\yZpQsGw.exe
  2⤵
  PID:9536
- C:\Windows\System\rLRvoUe.exe
  C:\Windows\System\rLRvoUe.exe
  2⤵
  PID:9556
- C:\Windows\System\BXuEbwy.exe
  C:\Windows\System\BXuEbwy.exe
  2⤵
  PID:9592
- C:\Windows\System\AwTWNdc.exe
  C:\Windows\System\AwTWNdc.exe
  2⤵
  PID:9620
- C:\Windows\System\VtfYAln.exe
  C:\Windows\System\VtfYAln.exe
  2⤵
  PID:9648
- C:\Windows\System\KwJFTok.exe
  C:\Windows\System\KwJFTok.exe
  2⤵
  PID:9676
- C:\Windows\System\qYVcTVc.exe
  C:\Windows\System\qYVcTVc.exe
  2⤵
  PID:9704
- C:\Windows\System\zNHrYiA.exe
  C:\Windows\System\zNHrYiA.exe
  2⤵
  PID:9732
- C:\Windows\System\lvZWmkb.exe
  C:\Windows\System\lvZWmkb.exe
  2⤵
  PID:9760
- C:\Windows\System\gVGRAEi.exe
  C:\Windows\System\gVGRAEi.exe
  2⤵
  PID:9788
- C:\Windows\System\IPoptpi.exe
  C:\Windows\System\IPoptpi.exe
  2⤵
  PID:9816
- C:\Windows\System\wVFYBaw.exe
  C:\Windows\System\wVFYBaw.exe
  2⤵
  PID:9844
- C:\Windows\System\RYXsZSP.exe
  C:\Windows\System\RYXsZSP.exe
  2⤵
  PID:9872
- C:\Windows\System\GYKReLz.exe
  C:\Windows\System\GYKReLz.exe
  2⤵
  PID:9900
- C:\Windows\System\JaktzzK.exe
  C:\Windows\System\JaktzzK.exe
  2⤵
  PID:9928
- C:\Windows\System\xydXSuz.exe
  C:\Windows\System\xydXSuz.exe
  2⤵
  PID:9956
- C:\Windows\System\EPdOnis.exe
  C:\Windows\System\EPdOnis.exe
  2⤵
  PID:9984
- C:\Windows\System\gdolSbs.exe
  C:\Windows\System\gdolSbs.exe
  2⤵
  PID:10012
- C:\Windows\System\mFiRwLQ.exe
  C:\Windows\System\mFiRwLQ.exe
  2⤵
  PID:10040
- C:\Windows\System\nVNNunl.exe
  C:\Windows\System\nVNNunl.exe
  2⤵
  PID:10068
- C:\Windows\System\LbDLPuv.exe
  C:\Windows\System\LbDLPuv.exe
  2⤵
  PID:10096
- C:\Windows\System\kkgIJMP.exe
  C:\Windows\System\kkgIJMP.exe
  2⤵
  PID:10124
- C:\Windows\System\EcpFdYj.exe
  C:\Windows\System\EcpFdYj.exe
  2⤵
  PID:10152
- C:\Windows\System\hOndBji.exe
  C:\Windows\System\hOndBji.exe
  2⤵
  PID:10180
- C:\Windows\System\hQoiNkr.exe
  C:\Windows\System\hQoiNkr.exe
  2⤵
  PID:10208
- C:\Windows\System\roVLrrz.exe
  C:\Windows\System\roVLrrz.exe
  2⤵
  PID:10236
- C:\Windows\System\PhmEnnf.exe
  C:\Windows\System\PhmEnnf.exe
  2⤵
  PID:9248
- C:\Windows\System\OkzKGjP.exe
  C:\Windows\System\OkzKGjP.exe
  2⤵
  PID:9324
- C:\Windows\System\CXBohFf.exe
  C:\Windows\System\CXBohFf.exe
  2⤵
  PID:9380
- C:\Windows\System\BzOrWeX.exe
  C:\Windows\System\BzOrWeX.exe
  2⤵
  PID:9448
- C:\Windows\System\TjJAZCi.exe
  C:\Windows\System\TjJAZCi.exe
  2⤵
  PID:9524
- C:\Windows\System\HnNLfXi.exe
  C:\Windows\System\HnNLfXi.exe
  2⤵
  PID:9584
- C:\Windows\System\vxtxzrz.exe
  C:\Windows\System\vxtxzrz.exe
  2⤵
  PID:9644
- C:\Windows\System\UPiTMmt.exe
  C:\Windows\System\UPiTMmt.exe
  2⤵
  PID:9720
- C:\Windows\System\cjXUeXz.exe
  C:\Windows\System\cjXUeXz.exe
  2⤵
  PID:9772
- C:\Windows\System\AslsjKO.exe
  C:\Windows\System\AslsjKO.exe
  2⤵
  PID:9840
- C:\Windows\System\RLZungl.exe
  C:\Windows\System\RLZungl.exe
  2⤵
  PID:9912
- C:\Windows\System\gftmDKO.exe
  C:\Windows\System\gftmDKO.exe
  2⤵
  PID:9976
- C:\Windows\System\DjjSFXt.exe
  C:\Windows\System\DjjSFXt.exe
  2⤵
  PID:10036
- C:\Windows\System\sCLQaNS.exe
  C:\Windows\System\sCLQaNS.exe
  2⤵
  PID:10108
- C:\Windows\System\oTuEbaD.exe
  C:\Windows\System\oTuEbaD.exe
  2⤵
  PID:10172
- C:\Windows\System\eUAnPTN.exe
  C:\Windows\System\eUAnPTN.exe
  2⤵
  PID:10232
- C:\Windows\System\ufGpfBK.exe
  C:\Windows\System\ufGpfBK.exe
  2⤵
  PID:9348
- C:\Windows\System\iIEiDVu.exe
  C:\Windows\System\iIEiDVu.exe
  2⤵
  PID:9500
- C:\Windows\System\NLULunM.exe
  C:\Windows\System\NLULunM.exe
  2⤵
  PID:9640
- C:\Windows\System\kiWRTQu.exe
  C:\Windows\System\kiWRTQu.exe
  2⤵
  PID:9808
- C:\Windows\System\sXDsyEm.exe
  C:\Windows\System\sXDsyEm.exe
  2⤵
  PID:9952
- C:\Windows\System\zCYmdzu.exe
  C:\Windows\System\zCYmdzu.exe
  2⤵
  PID:10092
- C:\Windows\System\PaSELee.exe
  C:\Windows\System\PaSELee.exe
  2⤵
  PID:9240
- C:\Windows\System\SicEIBP.exe
  C:\Windows\System\SicEIBP.exe
  2⤵
  PID:9612
- C:\Windows\System\mSfTonI.exe
  C:\Windows\System\mSfTonI.exe
  2⤵
  PID:9948
- C:\Windows\System\acDAQue.exe
  C:\Windows\System\acDAQue.exe
  2⤵
  PID:9404
- C:\Windows\System\czAmDRm.exe
  C:\Windows\System\czAmDRm.exe
  2⤵
  PID:9776
- C:\Windows\System\dnmyIWe.exe
  C:\Windows\System\dnmyIWe.exe
  2⤵
  PID:1168
- C:\Windows\System\OSTZFVG.exe
  C:\Windows\System\OSTZFVG.exe
  2⤵
  PID:4556
- C:\Windows\System\sBwlmPo.exe
  C:\Windows\System\sBwlmPo.exe
  2⤵
  PID:4524
- C:\Windows\System\duSqYCq.exe
  C:\Windows\System\duSqYCq.exe
  2⤵
  PID:4380
- C:\Windows\System\RtWxDfD.exe
  C:\Windows\System\RtWxDfD.exe
  2⤵
  PID:10264
- C:\Windows\System\YHbPtQL.exe
  C:\Windows\System\YHbPtQL.exe
  2⤵
  PID:10292
- C:\Windows\System\GrVTjEL.exe
  C:\Windows\System\GrVTjEL.exe
  2⤵
  PID:10332
- C:\Windows\System\AFToQDy.exe
  C:\Windows\System\AFToQDy.exe
  2⤵
  PID:10360
- C:\Windows\System\vRpsXqv.exe
  C:\Windows\System\vRpsXqv.exe
  2⤵
  PID:10388
- C:\Windows\System\QxHqKYg.exe
  C:\Windows\System\QxHqKYg.exe
  2⤵
  PID:10416
- C:\Windows\System\XoGYlQV.exe
  C:\Windows\System\XoGYlQV.exe
  2⤵
  PID:10444
- C:\Windows\System\uSBPZxr.exe
  C:\Windows\System\uSBPZxr.exe
  2⤵
  PID:10472
- C:\Windows\System\TDTcbmk.exe
  C:\Windows\System\TDTcbmk.exe
  2⤵
  PID:10500
- C:\Windows\System\WBCtlkX.exe
  C:\Windows\System\WBCtlkX.exe
  2⤵
  PID:10528
- C:\Windows\System\YOdLqQb.exe
  C:\Windows\System\YOdLqQb.exe
  2⤵
  PID:10556
- C:\Windows\System\CwrMfTk.exe
  C:\Windows\System\CwrMfTk.exe
  2⤵
  PID:10584
- C:\Windows\System\GaItkPM.exe
  C:\Windows\System\GaItkPM.exe
  2⤵
  PID:10612
- C:\Windows\System\zBhiAGS.exe
  C:\Windows\System\zBhiAGS.exe
  2⤵
  PID:10640
- C:\Windows\System\bJOAqbu.exe
  C:\Windows\System\bJOAqbu.exe
  2⤵
  PID:10668
- C:\Windows\System\koDCOfF.exe
  C:\Windows\System\koDCOfF.exe
  2⤵
  PID:10696
- C:\Windows\System\neHRmft.exe
  C:\Windows\System\neHRmft.exe
  2⤵
  PID:10724
- C:\Windows\System\rMsDVbp.exe
  C:\Windows\System\rMsDVbp.exe
  2⤵
  PID:10752
- C:\Windows\System\RvDaiJV.exe
  C:\Windows\System\RvDaiJV.exe
  2⤵
  PID:10780
- C:\Windows\System\sVgPSlA.exe
  C:\Windows\System\sVgPSlA.exe
  2⤵
  PID:10808
- C:\Windows\System\kTnZLfn.exe
  C:\Windows\System\kTnZLfn.exe
  2⤵
  PID:10836
- C:\Windows\System\wDCgmjM.exe
  C:\Windows\System\wDCgmjM.exe
  2⤵
  PID:10864
- C:\Windows\System\iMEuSeW.exe
  C:\Windows\System\iMEuSeW.exe
  2⤵
  PID:10892
- C:\Windows\System\lpalRAg.exe
  C:\Windows\System\lpalRAg.exe
  2⤵
  PID:10920
- C:\Windows\System\Awmzija.exe
  C:\Windows\System\Awmzija.exe
  2⤵
  PID:10948
- C:\Windows\System\nARcZic.exe
  C:\Windows\System\nARcZic.exe
  2⤵
  PID:10976
- C:\Windows\System\HizWBYw.exe
  C:\Windows\System\HizWBYw.exe
  2⤵
  PID:11016
- C:\Windows\System\bMujFcn.exe
  C:\Windows\System\bMujFcn.exe
  2⤵
  PID:11032
- C:\Windows\System\rlWJCNy.exe
  C:\Windows\System\rlWJCNy.exe
  2⤵
  PID:11060
- C:\Windows\System\SACFYwG.exe
  C:\Windows\System\SACFYwG.exe
  2⤵
  PID:11088
- C:\Windows\System\HwgGCth.exe
  C:\Windows\System\HwgGCth.exe
  2⤵
  PID:11116
- C:\Windows\System\kGxfGFV.exe
  C:\Windows\System\kGxfGFV.exe
  2⤵
  PID:11148
- C:\Windows\System\CbxaSfx.exe
  C:\Windows\System\CbxaSfx.exe
  2⤵
  PID:11176
- C:\Windows\System\PzFKQJu.exe
  C:\Windows\System\PzFKQJu.exe
  2⤵
  PID:11204
- C:\Windows\System\sTKauRQ.exe
  C:\Windows\System\sTKauRQ.exe
  2⤵
  PID:11232
- C:\Windows\System\LeJCUrK.exe
  C:\Windows\System\LeJCUrK.exe
  2⤵
  PID:11260
- C:\Windows\System\CYAACSs.exe
  C:\Windows\System\CYAACSs.exe
  2⤵
  PID:10260
- C:\Windows\System\ZoNFzCR.exe
  C:\Windows\System\ZoNFzCR.exe
  2⤵
  PID:10324
- C:\Windows\System\TROYLwQ.exe
  C:\Windows\System\TROYLwQ.exe
  2⤵
  PID:10384
- C:\Windows\System\bKLdRbB.exe
  C:\Windows\System\bKLdRbB.exe
  2⤵
  PID:10456
- C:\Windows\System\nvVcHhh.exe
  C:\Windows\System\nvVcHhh.exe
  2⤵
  PID:10520
- C:\Windows\System\fHsrPjF.exe
  C:\Windows\System\fHsrPjF.exe
  2⤵
  PID:10580
- C:\Windows\System\kGcNxnP.exe
  C:\Windows\System\kGcNxnP.exe
  2⤵
  PID:10652
- C:\Windows\System\isIEHkL.exe
  C:\Windows\System\isIEHkL.exe
  2⤵
  PID:10716
- C:\Windows\System\XOPjFHB.exe
  C:\Windows\System\XOPjFHB.exe
  2⤵
  PID:10776
- C:\Windows\System\xFfSTzb.exe
  C:\Windows\System\xFfSTzb.exe
  2⤵
  PID:9436
- C:\Windows\System\SASYHdx.exe
  C:\Windows\System\SASYHdx.exe
  2⤵
  PID:10904
- C:\Windows\System\yPQTrIP.exe
  C:\Windows\System\yPQTrIP.exe
  2⤵
  PID:10968
- C:\Windows\System\ifdALdN.exe
  C:\Windows\System\ifdALdN.exe
  2⤵
  PID:11028
- C:\Windows\System\IBsEfRX.exe
  C:\Windows\System\IBsEfRX.exe
  2⤵
  PID:11100
- C:\Windows\System\rsSyyuf.exe
  C:\Windows\System\rsSyyuf.exe
  2⤵
  PID:5028
- C:\Windows\System\yNfnynP.exe
  C:\Windows\System\yNfnynP.exe
  2⤵
  PID:11224
- C:\Windows\System\skbczDa.exe
  C:\Windows\System\skbczDa.exe
  2⤵
  PID:2940
- C:\Windows\System\xeeucFi.exe
  C:\Windows\System\xeeucFi.exe
  2⤵
  PID:10412
- C:\Windows\System\oNJnBMU.exe
  C:\Windows\System\oNJnBMU.exe
  2⤵
  PID:10572
- C:\Windows\System\YctMSmx.exe
  C:\Windows\System\YctMSmx.exe
  2⤵
  PID:10708
- C:\Windows\System\BUneQxr.exe
  C:\Windows\System\BUneQxr.exe
  2⤵
  PID:10860
- C:\Windows\System\dfbBIau.exe
  C:\Windows\System\dfbBIau.exe
  2⤵
  PID:11000
- C:\Windows\System\qdnVecL.exe
  C:\Windows\System\qdnVecL.exe
  2⤵
  PID:11160
- C:\Windows\System\YOeEXqG.exe
  C:\Windows\System\YOeEXqG.exe
  2⤵
  PID:10320
- C:\Windows\System\GpfFOFL.exe
  C:\Windows\System\GpfFOFL.exe
  2⤵
  PID:10680
- C:\Windows\System\JPvjVnh.exe
  C:\Windows\System\JPvjVnh.exe
  2⤵
  PID:10996
- C:\Windows\System\wOhpRtx.exe
  C:\Windows\System\wOhpRtx.exe
  2⤵
  PID:10488
- C:\Windows\System\qSfLYDu.exe
  C:\Windows\System\qSfLYDu.exe
  2⤵
  PID:10960
- C:\Windows\System\xulzYaK.exe
  C:\Windows\System\xulzYaK.exe
  2⤵
  PID:1360
- C:\Windows\System\nxBGSUW.exe
  C:\Windows\System\nxBGSUW.exe
  2⤵
  PID:11284
- C:\Windows\System\YHvQkkA.exe
  C:\Windows\System\YHvQkkA.exe
  2⤵
  PID:11312
- C:\Windows\System\HffOLef.exe
  C:\Windows\System\HffOLef.exe
  2⤵
  PID:11340
- C:\Windows\System\qQcXuqB.exe
  C:\Windows\System\qQcXuqB.exe
  2⤵
  PID:11368
- C:\Windows\System\UREIkQB.exe
  C:\Windows\System\UREIkQB.exe
  2⤵
  PID:11396
- C:\Windows\System\vaOCNbm.exe
  C:\Windows\System\vaOCNbm.exe
  2⤵
  PID:11424
- C:\Windows\System\xcmkLDJ.exe
  C:\Windows\System\xcmkLDJ.exe
  2⤵
  PID:11452
- C:\Windows\System\MykJpif.exe
  C:\Windows\System\MykJpif.exe
  2⤵
  PID:11480
- C:\Windows\System\KhbzwYK.exe
  C:\Windows\System\KhbzwYK.exe
  2⤵
  PID:11508
- C:\Windows\System\msWDLNi.exe
  C:\Windows\System\msWDLNi.exe
  2⤵
  PID:11536
- C:\Windows\System\gbSRQSZ.exe
  C:\Windows\System\gbSRQSZ.exe
  2⤵
  PID:11564
- C:\Windows\System\cxxjHZi.exe
  C:\Windows\System\cxxjHZi.exe
  2⤵
  PID:11592
- C:\Windows\System\ycZAYNh.exe
  C:\Windows\System\ycZAYNh.exe
  2⤵
  PID:11620
- C:\Windows\System\zVObOUS.exe
  C:\Windows\System\zVObOUS.exe
  2⤵
  PID:11648
- C:\Windows\System\MvZfsBe.exe
  C:\Windows\System\MvZfsBe.exe
  2⤵
  PID:11676
- C:\Windows\System\EbzVVUd.exe
  C:\Windows\System\EbzVVUd.exe
  2⤵
  PID:11704
- C:\Windows\System\VGMUeJK.exe
  C:\Windows\System\VGMUeJK.exe
  2⤵
  PID:11732
- C:\Windows\System\rpsHXdi.exe
  C:\Windows\System\rpsHXdi.exe
  2⤵
  PID:11764
- C:\Windows\System\YmZvKCx.exe
  C:\Windows\System\YmZvKCx.exe
  2⤵
  PID:11792
- C:\Windows\System\bTRsCZd.exe
  C:\Windows\System\bTRsCZd.exe
  2⤵
  PID:11820
- C:\Windows\System\wWejAJN.exe
  C:\Windows\System\wWejAJN.exe
  2⤵
  PID:11848
- C:\Windows\System\EIvDrIE.exe
  C:\Windows\System\EIvDrIE.exe
  2⤵
  PID:11876
- C:\Windows\System\GoLCgyC.exe
  C:\Windows\System\GoLCgyC.exe
  2⤵
  PID:11904
- C:\Windows\System\uByRlsk.exe
  C:\Windows\System\uByRlsk.exe
  2⤵
  PID:11932
- C:\Windows\System\TXpNplA.exe
  C:\Windows\System\TXpNplA.exe
  2⤵
  PID:11960
- C:\Windows\System\yrzrKar.exe
  C:\Windows\System\yrzrKar.exe
  2⤵
  PID:11988
- C:\Windows\System\YUPYTDI.exe
  C:\Windows\System\YUPYTDI.exe
  2⤵
  PID:12016
- C:\Windows\System\ETVFYaz.exe
  C:\Windows\System\ETVFYaz.exe
  2⤵
  PID:12044
- C:\Windows\System\vYKdOpm.exe
  C:\Windows\System\vYKdOpm.exe
  2⤵
  PID:12072
- C:\Windows\System\MnJWcWD.exe
  C:\Windows\System\MnJWcWD.exe
  2⤵
  PID:12100
- C:\Windows\System\rZbTxeK.exe
  C:\Windows\System\rZbTxeK.exe
  2⤵
  PID:12132
- C:\Windows\System\WhvigMt.exe
  C:\Windows\System\WhvigMt.exe
  2⤵
  PID:12156
- C:\Windows\System\iupuanI.exe
  C:\Windows\System\iupuanI.exe
  2⤵
  PID:12180
- C:\Windows\System\PMThFPH.exe
  C:\Windows\System\PMThFPH.exe
  2⤵
  PID:12216
- C:\Windows\System\xzbZPrl.exe
  C:\Windows\System\xzbZPrl.exe
  2⤵
  PID:12236
- C:\Windows\System\XqvuDGQ.exe
  C:\Windows\System\XqvuDGQ.exe
  2⤵
  PID:12272
- C:\Windows\System\TkDDcvl.exe
  C:\Windows\System\TkDDcvl.exe
  2⤵
  PID:11324
- C:\Windows\System\ATYzMoE.exe
  C:\Windows\System\ATYzMoE.exe
  2⤵
  PID:11360
- C:\Windows\System\SsHIAPm.exe
  C:\Windows\System\SsHIAPm.exe
  2⤵
  PID:11416
- C:\Windows\System\XhHdaNS.exe
  C:\Windows\System\XhHdaNS.exe
  2⤵
  PID:11476
- C:\Windows\System\txlFIiy.exe
  C:\Windows\System\txlFIiy.exe
  2⤵
  PID:11552
- C:\Windows\System\BPfpZoQ.exe
  C:\Windows\System\BPfpZoQ.exe
  2⤵
  PID:11612
- C:\Windows\System\VcGGXSo.exe
  C:\Windows\System\VcGGXSo.exe
  2⤵
  PID:11672
- C:\Windows\System\CxSWBHP.exe
  C:\Windows\System\CxSWBHP.exe
  2⤵
  PID:11752
- C:\Windows\System\IieuCgK.exe
  C:\Windows\System\IieuCgK.exe
  2⤵
  PID:11812
- C:\Windows\System\ALTeiZL.exe
  C:\Windows\System\ALTeiZL.exe
  2⤵
  PID:11872
- C:\Windows\System\DcmTUhm.exe
  C:\Windows\System\DcmTUhm.exe
  2⤵
  PID:11944
- C:\Windows\System\YRwiDAl.exe
  C:\Windows\System\YRwiDAl.exe
  2⤵
  PID:12008
- C:\Windows\System\usuiJAI.exe
  C:\Windows\System\usuiJAI.exe
  2⤵
  PID:12068
- C:\Windows\System\uUahVFc.exe
  C:\Windows\System\uUahVFc.exe
  2⤵
  PID:12120
- C:\Windows\System\FRxOyka.exe
  C:\Windows\System\FRxOyka.exe
  2⤵
  PID:12204
- C:\Windows\System\NKNdxJO.exe
  C:\Windows\System\NKNdxJO.exe
  2⤵
  PID:12260
- C:\Windows\System\AhIxqru.exe
  C:\Windows\System\AhIxqru.exe
  2⤵
  PID:11352
- C:\Windows\System\dxKNEpZ.exe
  C:\Windows\System\dxKNEpZ.exe
  2⤵
  PID:11504
- C:\Windows\System\kEEGPli.exe
  C:\Windows\System\kEEGPli.exe
  2⤵
  PID:11664
- C:\Windows\System\WJFcnKN.exe
  C:\Windows\System\WJFcnKN.exe
  2⤵
  PID:11804
- C:\Windows\System\TRjlzAW.exe
  C:\Windows\System\TRjlzAW.exe
  2⤵
  PID:11972
- C:\Windows\System\PYBfwqN.exe
  C:\Windows\System\PYBfwqN.exe
  2⤵
  PID:12124
- C:\Windows\System\mgTiWQj.exe
  C:\Windows\System\mgTiWQj.exe
  2⤵
  PID:11308
- C:\Windows\System\goMhVrI.exe
  C:\Windows\System\goMhVrI.exe
  2⤵
  PID:11576
- C:\Windows\System\icbpqyt.exe
  C:\Windows\System\icbpqyt.exe
  2⤵
  PID:11924
- C:\Windows\System\TfjgKyU.exe
  C:\Windows\System\TfjgKyU.exe
  2⤵
  PID:12256
- C:\Windows\System\zsNqKjo.exe
  C:\Windows\System\zsNqKjo.exe
  2⤵
  PID:12196
- C:\Windows\System\KiDZsxN.exe
  C:\Windows\System\KiDZsxN.exe
  2⤵
  PID:12296
- C:\Windows\System\StbLhDP.exe
  C:\Windows\System\StbLhDP.exe
  2⤵
  PID:12324
- C:\Windows\System\AykWBBL.exe
  C:\Windows\System\AykWBBL.exe
  2⤵
  PID:12352
- C:\Windows\System\NwzNtuh.exe
  C:\Windows\System\NwzNtuh.exe
  2⤵
  PID:12380
- C:\Windows\System\EZrtuxK.exe
  C:\Windows\System\EZrtuxK.exe
  2⤵
  PID:12408
- C:\Windows\System\edQiVps.exe
  C:\Windows\System\edQiVps.exe
  2⤵
  PID:12436
- C:\Windows\System\ohJynxG.exe
  C:\Windows\System\ohJynxG.exe
  2⤵
  PID:12464
- C:\Windows\System\JXwYnHt.exe
  C:\Windows\System\JXwYnHt.exe
  2⤵
  PID:12492
- C:\Windows\System\gIneQTC.exe
  C:\Windows\System\gIneQTC.exe
  2⤵
  PID:12520
- C:\Windows\System\iZgkMvk.exe
  C:\Windows\System\iZgkMvk.exe
  2⤵
  PID:12548
- C:\Windows\System\ONajTvq.exe
  C:\Windows\System\ONajTvq.exe
  2⤵
  PID:12576
- C:\Windows\System\XkLxKTD.exe
  C:\Windows\System\XkLxKTD.exe
  2⤵
  PID:12604
- C:\Windows\System\PBmEwzH.exe
  C:\Windows\System\PBmEwzH.exe
  2⤵
  PID:12632
- C:\Windows\System\nLDeYNs.exe
  C:\Windows\System\nLDeYNs.exe
  2⤵
  PID:12660
- C:\Windows\System\CHLtzPt.exe
  C:\Windows\System\CHLtzPt.exe
  2⤵
  PID:12688
- C:\Windows\System\HfAXUWK.exe
  C:\Windows\System\HfAXUWK.exe
  2⤵
  PID:12716
- C:\Windows\System\PWZNnyi.exe
  C:\Windows\System\PWZNnyi.exe
  2⤵
  PID:12744
- C:\Windows\System\vuADEux.exe
  C:\Windows\System\vuADEux.exe
  2⤵
  PID:12772
- C:\Windows\System\qxTpUuj.exe
  C:\Windows\System\qxTpUuj.exe
  2⤵
  PID:12800
- C:\Windows\System\BukaanX.exe
  C:\Windows\System\BukaanX.exe
  2⤵
  PID:12828
- C:\Windows\System\ZAIUPfV.exe
  C:\Windows\System\ZAIUPfV.exe
  2⤵
  PID:12856
- C:\Windows\System\KkySqnU.exe
  C:\Windows\System\KkySqnU.exe
  2⤵
  PID:12884
- C:\Windows\System\hIfvLmp.exe
  C:\Windows\System\hIfvLmp.exe
  2⤵
  PID:12912
- C:\Windows\System\qwBlOKb.exe
  C:\Windows\System\qwBlOKb.exe
  2⤵
  PID:12940
- C:\Windows\System\haRnBKw.exe
  C:\Windows\System\haRnBKw.exe
  2⤵
  PID:12968
- C:\Windows\System\bAlUmCZ.exe
  C:\Windows\System\bAlUmCZ.exe
  2⤵
  PID:12996
- C:\Windows\System\CCvYQJn.exe
  C:\Windows\System\CCvYQJn.exe
  2⤵
  PID:13024
- C:\Windows\System\nArgdoJ.exe
  C:\Windows\System\nArgdoJ.exe
  2⤵
  PID:13052
- C:\Windows\System\CToLQdu.exe
  C:\Windows\System\CToLQdu.exe
  2⤵
  PID:13080
- C:\Windows\System\JaBNkre.exe
  C:\Windows\System\JaBNkre.exe
  2⤵
  PID:13108
- C:\Windows\System\pjTgwnQ.exe
  C:\Windows\System\pjTgwnQ.exe
  2⤵
  PID:13136
- C:\Windows\System\SdRtpqp.exe
  C:\Windows\System\SdRtpqp.exe
  2⤵
  PID:13164
- C:\Windows\System\wTRKSqs.exe
  C:\Windows\System\wTRKSqs.exe
  2⤵
  PID:13192
- C:\Windows\System\ErigeAo.exe
  C:\Windows\System\ErigeAo.exe
  2⤵
  PID:13220
- C:\Windows\System\cNPhHbh.exe
  C:\Windows\System\cNPhHbh.exe
  2⤵
  PID:13248
- C:\Windows\System\dgvPikB.exe
  C:\Windows\System\dgvPikB.exe
  2⤵
  PID:13276
- C:\Windows\System\bpjDqwy.exe
  C:\Windows\System\bpjDqwy.exe
  2⤵
  PID:13304
- C:\Windows\System\cIkJNVl.exe
  C:\Windows\System\cIkJNVl.exe
  2⤵
  PID:12336
- C:\Windows\System\vfikCUL.exe
  C:\Windows\System\vfikCUL.exe
  2⤵
  PID:12400
- C:\Windows\System\FYbYYVV.exe
  C:\Windows\System\FYbYYVV.exe
  2⤵
  PID:12460
- C:\Windows\System\VvYCknH.exe
  C:\Windows\System\VvYCknH.exe
  2⤵
  PID:12536
- C:\Windows\System\TkCJUlp.exe
  C:\Windows\System\TkCJUlp.exe
  2⤵
  PID:12596
- C:\Windows\System\zfglmKa.exe
  C:\Windows\System\zfglmKa.exe
  2⤵
  PID:12656
- C:\Windows\System\inXBSVf.exe
  C:\Windows\System\inXBSVf.exe
  2⤵
  PID:12732
- C:\Windows\System\ouRcvKT.exe
  C:\Windows\System\ouRcvKT.exe
  2⤵
  PID:12792
- C:\Windows\System\efcOsyq.exe
  C:\Windows\System\efcOsyq.exe
  2⤵
  PID:12852
- C:\Windows\System\FnIfmxT.exe
  C:\Windows\System\FnIfmxT.exe
  2⤵
  PID:12928
- C:\Windows\System\LvWmuyb.exe
  C:\Windows\System\LvWmuyb.exe
  2⤵
  PID:12988
- C:\Windows\System\DCakbsO.exe
  C:\Windows\System\DCakbsO.exe
  2⤵
  PID:13048
- C:\Windows\System\IQpGIXv.exe
  C:\Windows\System\IQpGIXv.exe
  2⤵
  PID:13120
- C:\Windows\System\HSgNklW.exe
  C:\Windows\System\HSgNklW.exe
  2⤵
  PID:13184
- C:\Windows\System\poJSVOj.exe
  C:\Windows\System\poJSVOj.exe
  2⤵
  PID:13260
- C:\Windows\System\xOcwAqL.exe
  C:\Windows\System\xOcwAqL.exe
  2⤵
  PID:12316
- C:\Windows\System\NjUcIiP.exe
  C:\Windows\System\NjUcIiP.exe
  2⤵
  PID:12452
- C:\Windows\System\aiRxsAt.exe
  C:\Windows\System\aiRxsAt.exe
  2⤵
  PID:12588
- C:\Windows\System\EZUWNrr.exe
  C:\Windows\System\EZUWNrr.exe
  2⤵
  PID:12712
- C:\Windows\System\EhtCilC.exe
  C:\Windows\System\EhtCilC.exe
  2⤵
  PID:12880
- C:\Windows\System\VYQnKdF.exe
  C:\Windows\System\VYQnKdF.exe
  2⤵
  PID:13036
- C:\Windows\System\GDJUVeP.exe
  C:\Windows\System\GDJUVeP.exe
  2⤵
  PID:13176
- C:\Windows\System\SNaZqPt.exe
  C:\Windows\System\SNaZqPt.exe
  2⤵
  PID:11784
- C:\Windows\System\FkRwOon.exe
  C:\Windows\System\FkRwOon.exe
  2⤵
  PID:12844
- C:\Windows\System\thRvurJ.exe
  C:\Windows\System\thRvurJ.exe
  2⤵
  PID:13016
- C:\Windows\System\KlRRVpO.exe
  C:\Windows\System\KlRRVpO.exe
  2⤵
  PID:12512
- C:\Windows\System\YOjzxyJ.exe
  C:\Windows\System\YOjzxyJ.exe
  2⤵
  PID:13300
- C:\Windows\System\lZAeTtd.exe
  C:\Windows\System\lZAeTtd.exe
  2⤵
  PID:13320
- C:\Windows\System\ZzqeWNv.exe
  C:\Windows\System\ZzqeWNv.exe
  2⤵
  PID:13348
- C:\Windows\System\eYjXJHO.exe
  C:\Windows\System\eYjXJHO.exe
  2⤵
  PID:13384
- C:\Windows\System\PIdYUsL.exe
  C:\Windows\System\PIdYUsL.exe
  2⤵
  PID:13404
- C:\Windows\System\SPLFQzm.exe
  C:\Windows\System\SPLFQzm.exe
  2⤵
  PID:13432
- C:\Windows\System\FsukFAL.exe
  C:\Windows\System\FsukFAL.exe
  2⤵
  PID:13460
- C:\Windows\System\XNiUKKJ.exe
  C:\Windows\System\XNiUKKJ.exe
  2⤵
  PID:13488
- C:\Windows\System\nrqlIXc.exe
  C:\Windows\System\nrqlIXc.exe
  2⤵
  PID:13516
- C:\Windows\System\QtSfFZe.exe
  C:\Windows\System\QtSfFZe.exe
  2⤵
  PID:13544
- C:\Windows\System\Onunexp.exe
  C:\Windows\System\Onunexp.exe
  2⤵
  PID:13572
- C:\Windows\System\LAMQEGW.exe
  C:\Windows\System\LAMQEGW.exe
  2⤵
  PID:13608
- C:\Windows\System\MMoLKQC.exe
  C:\Windows\System\MMoLKQC.exe
  2⤵
  PID:14312
- C:\Windows\System\RBLVnBd.exe
  C:\Windows\System\RBLVnBd.exe
  2⤵
  PID:13340
- C:\Windows\System\chfUdSj.exe
  C:\Windows\System\chfUdSj.exe
  2⤵
  PID:3760
- C:\Windows\System\ikbbvAD.exe
  C:\Windows\System\ikbbvAD.exe
  2⤵
  PID:13916
- C:\Windows\System\VoUhZQc.exe
  C:\Windows\System\VoUhZQc.exe
  2⤵
  PID:4252
- C:\Windows\System\AUmbVpU.exe
  C:\Windows\System\AUmbVpU.exe
  2⤵
  PID:13976
- C:\Windows\System\BjiWtkf.exe
  C:\Windows\System\BjiWtkf.exe
  2⤵
  PID:14004
- C:\Windows\System\FwgnuRD.exe
  C:\Windows\System\FwgnuRD.exe
  2⤵
  PID:13648
- C:\Windows\System\qVRTRSW.exe
  C:\Windows\System\qVRTRSW.exe
  2⤵
  PID:5680
- C:\Windows\System\XeZHHCD.exe
  C:\Windows\System\XeZHHCD.exe
  2⤵
  PID:13736
- C:\Windows\System\JEJPCze.exe
  C:\Windows\System\JEJPCze.exe
  2⤵
  PID:14112
- C:\Windows\System\SFAuDOZ.exe
  C:\Windows\System\SFAuDOZ.exe
  2⤵
  PID:14136
- C:\Windows\System\ZMvuRLz.exe
  C:\Windows\System\ZMvuRLz.exe
  2⤵
  PID:14284
- C:\Windows\System\FYRnsiw.exe
  C:\Windows\System\FYRnsiw.exe
  2⤵
  PID:14300
- C:\Windows\System\jNgIYgw.exe
  C:\Windows\System\jNgIYgw.exe
  2⤵
  PID:14072
- C:\Windows\System\vwcFIBI.exe
  C:\Windows\System\vwcFIBI.exe
  2⤵
  PID:4996
- C:\Windows\System\TdRrKOs.exe
  C:\Windows\System\TdRrKOs.exe
  2⤵
  PID:14032
- C:\Windows\System\KjpZQyK.exe
  C:\Windows\System\KjpZQyK.exe
  2⤵
  PID:6884
- C:\Windows\System\zBvJHSW.exe
  C:\Windows\System\zBvJHSW.exe
  2⤵
  PID:3008
- C:\Windows\System\JXIXKxj.exe
  C:\Windows\System\JXIXKxj.exe
  2⤵
  PID:3940
- C:\Windows\System\ukgFYad.exe
  C:\Windows\System\ukgFYad.exe
  2⤵
  PID:13692
- C:\Windows\System\szfHpNf.exe
  C:\Windows\System\szfHpNf.exe
  2⤵
  PID:7176
- C:\Windows\System\jPKTQak.exe
  C:\Windows\System\jPKTQak.exe
  2⤵
  PID:14076
- C:\Windows\System\VSsNQwB.exe
  C:\Windows\System\VSsNQwB.exe
  2⤵
  PID:4828
- C:\Windows\System\eZvruUE.exe
  C:\Windows\System\eZvruUE.exe
  2⤵
  PID:1592
- C:\Windows\System\CVyCaGx.exe
  C:\Windows\System\CVyCaGx.exe
  2⤵
  PID:13884
- C:\Windows\System\EKScGTw.exe
  C:\Windows\System\EKScGTw.exe
  2⤵
  PID:14148
- C:\Windows\System\PNOCDBF.exe
  C:\Windows\System\PNOCDBF.exe
  2⤵
  PID:14220
- C:\Windows\System\qkKtoCw.exe
  C:\Windows\System\qkKtoCw.exe
  2⤵
  PID:5532
- C:\Windows\System\fwGvMDE.exe
  C:\Windows\System\fwGvMDE.exe
  2⤵
  PID:13396
- C:\Windows\System\bnozUtW.exe
  C:\Windows\System\bnozUtW.exe
  2⤵
  PID:3180
- C:\Windows\System\DECovKO.exe
  C:\Windows\System\DECovKO.exe
  2⤵
  PID:13452
- C:\Windows\System\QzXerga.exe
  C:\Windows\System\QzXerga.exe
  2⤵
  PID:4260
- C:\Windows\System\eKwFXfA.exe
  C:\Windows\System\eKwFXfA.exe
  2⤵
  PID:13508
- C:\Windows\System\kJWJVZK.exe
  C:\Windows\System\kJWJVZK.exe
  2⤵
  PID:7524
- C:\Windows\System\nplCiHN.exe
  C:\Windows\System\nplCiHN.exe
  2⤵
  PID:1852
- C:\Windows\System\wPaRkLo.exe
  C:\Windows\System\wPaRkLo.exe
  2⤵
  PID:6288
- C:\Windows\System\kaXphgZ.exe
  C:\Windows\System\kaXphgZ.exe
  2⤵
  PID:7608
- C:\Windows\System\kgpoRDP.exe
  C:\Windows\System\kgpoRDP.exe
  2⤵
  PID:8992
- C:\Windows\System\SbHmBjx.exe
  C:\Windows\System\SbHmBjx.exe
  2⤵
  PID:9020
- C:\Windows\System\IQcRJAi.exe
  C:\Windows\System\IQcRJAi.exe
  2⤵
  PID:4136
- C:\Windows\System\DXdVzhI.exe
  C:\Windows\System\DXdVzhI.exe
  2⤵
  PID:3684
- C:\Windows\System\sKhRMMW.exe
  C:\Windows\System\sKhRMMW.exe
  2⤵
  PID:13636
- C:\Windows\System\UjgOYxY.exe
  C:\Windows\System\UjgOYxY.exe
  2⤵
  PID:9104
- C:\Windows\System\ucrurfL.exe
  C:\Windows\System\ucrurfL.exe
  2⤵
  PID:836
- C:\Windows\System\sLNjyCz.exe
  C:\Windows\System\sLNjyCz.exe
  2⤵
  PID:1648
- C:\Windows\System\rkOzBkX.exe
  C:\Windows\System\rkOzBkX.exe
  2⤵
  PID:9152
- C:\Windows\System\KTDCGrg.exe
  C:\Windows\System\KTDCGrg.exe
  2⤵
  PID:13712
- C:\Windows\System\KkbcJnR.exe
  C:\Windows\System\KkbcJnR.exe
  2⤵
  PID:5728
- C:\Windows\System\xRrLqPv.exe
  C:\Windows\System\xRrLqPv.exe
  2⤵
  PID:13716
- C:\Windows\System\kUlUbvG.exe
  C:\Windows\System\kUlUbvG.exe
  2⤵
  PID:13780
- C:\Windows\System\mMwMmOX.exe
  C:\Windows\System\mMwMmOX.exe
  2⤵
  PID:13796
- C:\Windows\System\frUfFpe.exe
  C:\Windows\System\frUfFpe.exe
  2⤵
  PID:13820
- C:\Windows\System\qZxvUTF.exe
  C:\Windows\System\qZxvUTF.exe
  2⤵
  PID:7964
- C:\Windows\System\mZkZZkM.exe
  C:\Windows\System\mZkZZkM.exe
  2⤵
  PID:2364
- C:\Windows\System\TKaQSIY.exe
  C:\Windows\System\TKaQSIY.exe
  2⤵
  PID:1792
- C:\Windows\System\nWevlYg.exe
  C:\Windows\System\nWevlYg.exe
  2⤵
  PID:13852
- C:\Windows\System\IKNqSga.exe
  C:\Windows\System\IKNqSga.exe
  2⤵
  PID:13872
- C:\Windows\System\OsRnnZt.exe
  C:\Windows\System\OsRnnZt.exe
  2⤵
  PID:8648
- C:\Windows\System\RlAjhoJ.exe
  C:\Windows\System\RlAjhoJ.exe
  2⤵
  PID:8152
- C:\Windows\System\uwryAMR.exe
  C:\Windows\System\uwryAMR.exe
  2⤵
  PID:3176
- C:\Windows\System\TQuyjOh.exe
  C:\Windows\System\TQuyjOh.exe
  2⤵
  PID:7376
- C:\Windows\System\QpvPGwE.exe
  C:\Windows\System\QpvPGwE.exe
  2⤵
  PID:4752
- C:\Windows\System\AiLJudv.exe
  C:\Windows\System\AiLJudv.exe
  2⤵
  PID:624
- C:\Windows\System\CJoYiTE.exe
  C:\Windows\System\CJoYiTE.exe
  2⤵
  PID:5076
- C:\Windows\System\OBZhQYq.exe
  C:\Windows\System\OBZhQYq.exe
  2⤵
  PID:7792
- C:\Windows\System\cCbPhRf.exe
  C:\Windows\System\cCbPhRf.exe
  2⤵
  PID:8028
- C:\Windows\System\SwWegdS.exe
  C:\Windows\System\SwWegdS.exe
  2⤵
  PID:8188
- C:\Windows\System\OySQazJ.exe
  C:\Windows\System\OySQazJ.exe
  2⤵
  PID:7356
- C:\Windows\System\hQhyChl.exe
  C:\Windows\System\hQhyChl.exe
  2⤵
  PID:7680
- C:\Windows\System\KgDAozT.exe
  C:\Windows\System\KgDAozT.exe
  2⤵
  PID:8232
- C:\Windows\System\vxWoJWT.exe
  C:\Windows\System\vxWoJWT.exe
  2⤵
  PID:3792
- C:\Windows\System\rJmJksL.exe
  C:\Windows\System\rJmJksL.exe
  2⤵
  PID:14080
- C:\Windows\System\vdIwFHz.exe
  C:\Windows\System\vdIwFHz.exe
  2⤵
  PID:3216
- C:\Windows\System\IHNpgxj.exe
  C:\Windows\System\IHNpgxj.exe
  2⤵
  PID:8520
- C:\Windows\System\XUEhZCl.exe
  C:\Windows\System\XUEhZCl.exe
  2⤵
  PID:6628
- C:\Windows\System\vbVRCiM.exe
  C:\Windows\System\vbVRCiM.exe
  2⤵
  PID:8880
- C:\Windows\System\ENvUxwr.exe
  C:\Windows\System\ENvUxwr.exe
  2⤵
  PID:6296
- C:\Windows\System\QMAoMAa.exe
  C:\Windows\System\QMAoMAa.exe
  2⤵
  PID:8388
- C:\Windows\System\GmSTkfd.exe
  C:\Windows\System\GmSTkfd.exe
  2⤵
  PID:2288
- C:\Windows\System\othaDZT.exe
  C:\Windows\System\othaDZT.exe
  2⤵
  PID:8600
- C:\Windows\System\llWKKPp.exe
  C:\Windows\System\llWKKPp.exe
  2⤵
  PID:9172
- C:\Windows\System\RCgMfdD.exe
  C:\Windows\System\RCgMfdD.exe
  2⤵
  PID:6900
- C:\Windows\System\gVWqzPv.exe
  C:\Windows\System\gVWqzPv.exe
  2⤵
  PID:7056
- C:\Windows\System\LPiJlwd.exe
  C:\Windows\System\LPiJlwd.exe
  2⤵
  PID:7124
- C:\Windows\System\jMbCsrb.exe
  C:\Windows\System\jMbCsrb.exe
  2⤵
  PID:14132
- C:\Windows\System\PIDvBZr.exe
  C:\Windows\System\PIDvBZr.exe
  2⤵
  PID:14016
- C:\Windows\System\xNlpTLn.exe
  C:\Windows\System\xNlpTLn.exe
  2⤵
  PID:4568
- C:\Windows\System\bOrzdtJ.exe
  C:\Windows\System\bOrzdtJ.exe
  2⤵
  PID:9332
- C:\Windows\System\PXfeoLt.exe
  C:\Windows\System\PXfeoLt.exe
  2⤵
  PID:14176
- C:\Windows\System\PoUPgTS.exe
  C:\Windows\System\PoUPgTS.exe
  2⤵
  PID:14192
- C:\Windows\System\LNFBhRU.exe
  C:\Windows\System\LNFBhRU.exe
  2⤵
  PID:14204
- C:\Windows\System\lxqKBgk.exe
  C:\Windows\System\lxqKBgk.exe
  2⤵
  PID:9416
- C:\Windows\System\VgmAIkG.exe
  C:\Windows\System\VgmAIkG.exe
  2⤵
  PID:9428
- C:\Windows\System\uNavpXx.exe
  C:\Windows\System\uNavpXx.exe
  2⤵
  PID:8624
- C:\Windows\System\PdMuFcf.exe
  C:\Windows\System\PdMuFcf.exe
  2⤵
  PID:5428
- C:\Windows\System\gpqVDKb.exe
  C:\Windows\System\gpqVDKb.exe
  2⤵
  PID:9516
- C:\Windows\System\vaIPIXy.exe
  C:\Windows\System\vaIPIXy.exe
  2⤵
  PID:9552
- C:\Windows\System\SBtUzrY.exe
  C:\Windows\System\SBtUzrY.exe
  2⤵
  PID:14256
- C:\Windows\System\PpXAQVf.exe
  C:\Windows\System\PpXAQVf.exe
  2⤵
  PID:8684
- C:\Windows\System\AKklDQC.exe
  C:\Windows\System\AKklDQC.exe
  2⤵
  PID:9604
- C:\Windows\System\gYtMKdS.exe
  C:\Windows\System\gYtMKdS.exe
  2⤵
  PID:7372
- C:\Windows\System\IHuhTkK.exe
  C:\Windows\System\IHuhTkK.exe
  2⤵
  PID:7404
- C:\Windows\System\RwcNBnj.exe
  C:\Windows\System\RwcNBnj.exe
  2⤵
  PID:1908
- C:\Windows\System\cXxoXSz.exe
  C:\Windows\System\cXxoXSz.exe
  2⤵
  PID:13372
- C:\Windows\System\MdemeVM.exe
  C:\Windows\System\MdemeVM.exe
  2⤵
  PID:1216
- C:\Windows\System\Pzsxmad.exe
  C:\Windows\System\Pzsxmad.exe
  2⤵
  PID:13428
- C:\Windows\System\PmUBnQQ.exe
  C:\Windows\System\PmUBnQQ.exe
  2⤵
  PID:9784
- C:\Windows\System\umjxvpF.exe
  C:\Windows\System\umjxvpF.exe
  2⤵
  PID:3092
- C:\Windows\System\WvUuMji.exe
  C:\Windows\System\WvUuMji.exe
  2⤵
  PID:6940
- C:\Windows\System\hRdfESe.exe
  C:\Windows\System\hRdfESe.exe
  2⤵
  PID:9936
- C:\Windows\System\TKnWskz.exe
  C:\Windows\System\TKnWskz.exe
  2⤵
  PID:9996
- C:\Windows\System\wyOhpzC.exe
  C:\Windows\System\wyOhpzC.exe
  2⤵
  PID:10048
- C:\Windows\System\zMrKPLP.exe
  C:\Windows\System\zMrKPLP.exe
  2⤵
  PID:10104
- C:\Windows\System\ykngTYF.exe
  C:\Windows\System\ykngTYF.exe
  2⤵
  PID:10168
- C:\Windows\System\MVHMnVs.exe
  C:\Windows\System\MVHMnVs.exe
  2⤵
  PID:2244
- C:\Windows\System\tqfsCXo.exe
  C:\Windows\System\tqfsCXo.exe
  2⤵
  PID:5344
- C:\Windows\System\bwqTcBA.exe
  C:\Windows\System\bwqTcBA.exe
  2⤵
  PID:9328
- C:\Windows\System\JMuohNU.exe
  C:\Windows\System\JMuohNU.exe
  2⤵
  PID:3368
- C:\Windows\System\GAuQReC.exe
  C:\Windows\System\GAuQReC.exe
  2⤵
  PID:9608
- C:\Windows\System\AdKkPvz.exe
  C:\Windows\System\AdKkPvz.exe
  2⤵
  PID:5484
- C:\Windows\System\znrofkJ.exe
  C:\Windows\System\znrofkJ.exe
  2⤵
  PID:8980
- C:\Windows\System\GFMcBrL.exe
  C:\Windows\System\GFMcBrL.exe
  2⤵
  PID:9924
- C:\Windows\System\kPzanSX.exe
  C:\Windows\System\kPzanSX.exe
  2⤵
  PID:10080
- C:\Windows\System\kQDVJGV.exe
  C:\Windows\System\kQDVJGV.exe
  2⤵
  PID:2848
- C:\Windows\System\vtFueUP.exe
  C:\Windows\System\vtFueUP.exe
  2⤵
  PID:5668
- C:\Windows\System\WodKEQE.exe
  C:\Windows\System\WodKEQE.exe
  2⤵
  PID:9544
- C:\Windows\System\QIgvJiR.exe
  C:\Windows\System\QIgvJiR.exe
  2⤵
  PID:9868
- C:\Windows\System\wbFdtry.exe
  C:\Windows\System\wbFdtry.exe
  2⤵
  PID:10204
- C:\Windows\System\ZFXtPlf.exe
  C:\Windows\System\ZFXtPlf.exe
  2⤵
  PID:9300
- C:\Windows\System\ASFNGoZ.exe
  C:\Windows\System\ASFNGoZ.exe
  2⤵
  PID:5836
- C:\Windows\System\TviZzmf.exe
  C:\Windows\System\TviZzmf.exe
  2⤵
  PID:13660
- C:\Windows\System\tfEkDfE.exe
  C:\Windows\System\tfEkDfE.exe
  2⤵
  PID:5864
- C:\Windows\System\asPuIaU.exe
  C:\Windows\System\asPuIaU.exe
  2⤵
  PID:3104
- C:\Windows\System\UFVvQkl.exe
  C:\Windows\System\UFVvQkl.exe
  2⤵
  PID:3556
- C:\Windows\System\DFBlwTp.exe
  C:\Windows\System\DFBlwTp.exe
  2⤵
  PID:1844
- C:\Windows\System\bPYBIVa.exe
  C:\Windows\System\bPYBIVa.exe
  2⤵
  PID:6016
- C:\Windows\System\PfIgVuk.exe
  C:\Windows\System\PfIgVuk.exe
  2⤵
  PID:5060
- C:\Windows\System\HHOZnix.exe
  C:\Windows\System\HHOZnix.exe
  2⤵
  PID:10304
- C:\Windows\System\MTHnXul.exe
  C:\Windows\System\MTHnXul.exe
  2⤵
  PID:6116
- C:\Windows\System\okfZskN.exe
  C:\Windows\System\okfZskN.exe
  2⤵
  PID:2116
- C:\Windows\System\ZptZiOP.exe
  C:\Windows\System\ZptZiOP.exe
  2⤵
  PID:10452
- C:\Windows\System\xHPMHIu.exe
  C:\Windows\System\xHPMHIu.exe
  2⤵
  PID:4728
- C:\Windows\System\jiKMbyJ.exe
  C:\Windows\System\jiKMbyJ.exe
  2⤵
  PID:10544
- C:\Windows\System\NQjSbqL.exe
  C:\Windows\System\NQjSbqL.exe
  2⤵
  PID:10600
- C:\Windows\System\ZjQGBDc.exe
  C:\Windows\System\ZjQGBDc.exe
  2⤵
  PID:4036
- C:\Windows\System\VKZqPse.exe
  C:\Windows\System\VKZqPse.exe
  2⤵
  PID:10676
- C:\Windows\System\TkSSaFp.exe
  C:\Windows\System\TkSSaFp.exe
  2⤵
  PID:5792
- C:\Windows\System\hrNKnoM.exe
  C:\Windows\System\hrNKnoM.exe
  2⤵
  PID:10768
- C:\Windows\System\ZlNvSVY.exe
  C:\Windows\System\ZlNvSVY.exe
  2⤵
  PID:1228
- C:\Windows\System\MCUQgrC.exe
  C:\Windows\System\MCUQgrC.exe
  2⤵
  PID:4140
- C:\Windows\System\tKvoYhx.exe
  C:\Windows\System\tKvoYhx.exe
  2⤵
  PID:10900
- C:\Windows\System\IkcFcwq.exe
  C:\Windows\System\IkcFcwq.exe
  2⤵
  PID:10964
- C:\Windows\System\SVBzVOy.exe
  C:\Windows\System\SVBzVOy.exe
  2⤵
  PID:2604
- C:\Windows\System\sYkkqom.exe
  C:\Windows\System\sYkkqom.exe
  2⤵
  PID:5804
- C:\Windows\System\QLaPqxl.exe
  C:\Windows\System\QLaPqxl.exe
  2⤵
  PID:14108
- C:\Windows\System\IpTmIJn.exe
  C:\Windows\System\IpTmIJn.exe
  2⤵
  PID:11104
- C:\Windows\System\tkxkqTl.exe
  C:\Windows\System\tkxkqTl.exe
  2⤵
  PID:11164
- C:\Windows\System\jtUWkNW.exe
  C:\Windows\System\jtUWkNW.exe
  2⤵
  PID:11216
- C:\Windows\System\XxRTlTm.exe
  C:\Windows\System\XxRTlTm.exe
  2⤵
  PID:11240
- C:\Windows\System\FbSlaSs.exe
  C:\Windows\System\FbSlaSs.exe
  2⤵
  PID:10276
- C:\Windows\System\jpsipRy.exe
  C:\Windows\System\jpsipRy.exe
  2⤵
  PID:5216
- C:\Windows\System\ZSCFPAC.exe
  C:\Windows\System\ZSCFPAC.exe
  2⤵
  PID:2712
- C:\Windows\System\BKEsMqx.exe
  C:\Windows\System\BKEsMqx.exe
  2⤵
  PID:5520
- C:\Windows\System\GcWZNju.exe
  C:\Windows\System\GcWZNju.exe
  2⤵
  PID:10688
- C:\Windows\System\tXoQRlT.exe
  C:\Windows\System\tXoQRlT.exe
  2⤵
  PID:10736
- C:\Windows\System\fUixSQH.exe
  C:\Windows\System\fUixSQH.exe
  2⤵
  PID:10876
- C:\Windows\System\LIRTTtA.exe
  C:\Windows\System\LIRTTtA.exe
  2⤵
  PID:3052
- C:\Windows\System\UjoYlrE.exe
  C:\Windows\System\UjoYlrE.exe
  2⤵
  PID:11052
- C:\Windows\System\noHmbWy.exe
  C:\Windows\System\noHmbWy.exe
  2⤵
  PID:5536
- C:\Windows\System\XJuOOWt.exe
  C:\Windows\System\XJuOOWt.exe
  2⤵
  PID:1356
- C:\Windows\System\KxJuwJB.exe
  C:\Windows\System\KxJuwJB.exe
  2⤵
  PID:10824
- C:\Windows\System\Nabvssk.exe
  C:\Windows\System\Nabvssk.exe
  2⤵
  PID:11220
- C:\Windows\System\yfNJJqK.exe
  C:\Windows\System\yfNJJqK.exe
  2⤵
  PID:10828
- C:\Windows\System\tJYfsUL.exe
  C:\Windows\System\tJYfsUL.exe
  2⤵
  PID:11292
- C:\Windows\System\rXEfzRc.exe
  C:\Windows\System\rXEfzRc.exe
  2⤵
  PID:11376
- C:\Windows\System\zWzcVGG.exe
  C:\Windows\System\zWzcVGG.exe
  2⤵
  PID:11488
- C:\Windows\System\ZabQpwx.exe
  C:\Windows\System\ZabQpwx.exe
  2⤵
  PID:11572
- C:\Windows\System\SXXqWIV.exe
  C:\Windows\System\SXXqWIV.exe
  2⤵
  PID:11684
- C:\Windows\System\bKvFzuw.exe
  C:\Windows\System\bKvFzuw.exe
  2⤵
  PID:6284
- C:\Windows\System\SvKkcpE.exe
  C:\Windows\System\SvKkcpE.exe
  2⤵
  PID:6160
- C:\Windows\System\xLRVYqn.exe
  C:\Windows\System\xLRVYqn.exe
  2⤵
  PID:6272
- C:\Windows\System\oyRqyrR.exe
  C:\Windows\System\oyRqyrR.exe
  2⤵
  PID:6424
- C:\Windows\System\wYdQpcX.exe
  C:\Windows\System\wYdQpcX.exe
  2⤵
  PID:6620
- C:\Windows\System\ZaliwAq.exe
  C:\Windows\System\ZaliwAq.exe
  2⤵
  PID:6592
- C:\Windows\System\hLZExhH.exe
  C:\Windows\System\hLZExhH.exe
  2⤵
  PID:11800
- C:\Windows\System\DQdXtPU.exe
  C:\Windows\System\DQdXtPU.exe
  2⤵
  PID:6704
- C:\Windows\System\UmzIzvk.exe
  C:\Windows\System\UmzIzvk.exe
  2⤵
  PID:11892
- C:\Windows\System\lHLfWTL.exe
  C:\Windows\System\lHLfWTL.exe
  2⤵
  PID:7324
- C:\Windows\System\pqqkcMu.exe
  C:\Windows\System\pqqkcMu.exe
  2⤵
  PID:12004
- C:\Windows\System\POrVvkH.exe
  C:\Windows\System\POrVvkH.exe
  2⤵
  PID:12060
- C:\Windows\System\sBKEhfC.exe
  C:\Windows\System\sBKEhfC.exe
  2⤵
  PID:12108
- C:\Windows\System\gSxYsVz.exe
  C:\Windows\System\gSxYsVz.exe
  2⤵
  PID:12192
- C:\Windows\System\unJxHPO.exe
  C:\Windows\System\unJxHPO.exe
  2⤵
  PID:12244
- C:\Windows\System\yThpCKH.exe
  C:\Windows\System\yThpCKH.exe
  2⤵
  PID:11276
- C:\Windows\System\FDjuqOT.exe
  C:\Windows\System\FDjuqOT.exe
  2⤵
  PID:8364
- C:\Windows\System\PqiXcEZ.exe
  C:\Windows\System\PqiXcEZ.exe
  2⤵
  PID:7140
- C:\Windows\System\cyEjhdb.exe
  C:\Windows\System\cyEjhdb.exe
  2⤵
  PID:7164
- C:\Windows\System\YSUxZhB.exe
  C:\Windows\System\YSUxZhB.exe
  2⤵
  PID:11696
- C:\Windows\System\HARNhRU.exe
  C:\Windows\System\HARNhRU.exe
  2⤵
  PID:8508
- C:\Windows\System\IpEiXSp.exe
  C:\Windows\System\IpEiXSp.exe
  2⤵
  PID:11896
- C:\Windows\System\mwtgyVL.exe
  C:\Windows\System\mwtgyVL.exe
  2⤵
  PID:12040
- C:\Windows\System\PjMDlZe.exe
  C:\Windows\System\PjMDlZe.exe
  2⤵
  PID:1944
- C:\Windows\System\KLsThhq.exe
  C:\Windows\System\KLsThhq.exe
  2⤵
  PID:6372
- C:\Windows\System\FzIpovX.exe
  C:\Windows\System\FzIpovX.exe
  2⤵
  PID:11444
- C:\Windows\System\HJxHvaS.exe
  C:\Windows\System\HJxHvaS.exe
  2⤵
  PID:6912
- C:\Windows\System\RtfcbBo.exe
  C:\Windows\System\RtfcbBo.exe
  2⤵
  PID:12000
- C:\Windows\System\fwbcmtX.exe
  C:\Windows\System\fwbcmtX.exe
  2⤵
  PID:7000
- C:\Windows\System\nEvbimz.exe
  C:\Windows\System\nEvbimz.exe
  2⤵
  PID:6848
- C:\Windows\System\gQGWmQG.exe
  C:\Windows\System\gQGWmQG.exe
  2⤵
  PID:6716
- C:\Windows\System\rawTxJF.exe
  C:\Windows\System\rawTxJF.exe
  2⤵
  PID:11728
- C:\Windows\System\rYftUao.exe
  C:\Windows\System\rYftUao.exe
  2⤵
  PID:12332
- C:\Windows\System\KGQqyFh.exe
  C:\Windows\System\KGQqyFh.exe
  2⤵
  PID:7044
- C:\Windows\System\EGZljpB.exe
  C:\Windows\System\EGZljpB.exe
  2⤵
  PID:12424
- C:\Windows\System\YrYEsdq.exe
  C:\Windows\System\YrYEsdq.exe
  2⤵
  PID:4916
- C:\Windows\System\BuwCjAJ.exe
  C:\Windows\System\BuwCjAJ.exe
  2⤵
  PID:12504
- C:\Windows\System\rzEzjID.exe
  C:\Windows\System\rzEzjID.exe
  2⤵
  PID:12528
- C:\Windows\System\ciDADOo.exe
  C:\Windows\System\ciDADOo.exe
  2⤵
  PID:12584
- C:\Windows\System\VsqXkIq.exe
  C:\Windows\System\VsqXkIq.exe
  2⤵
  PID:12672
- C:\Windows\System\TaZvuff.exe
  C:\Windows\System\TaZvuff.exe
  2⤵
  PID:12724
- C:\Windows\System\rSVGDoo.exe
  C:\Windows\System\rSVGDoo.exe
  2⤵
  PID:13732
- C:\Windows\System\FeRVXFD.exe
  C:\Windows\System\FeRVXFD.exe
  2⤵
  PID:2196
- C:\Windows\System\kJyMbjC.exe
  C:\Windows\System\kJyMbjC.exe
  2⤵
  PID:12920
- C:\Windows\System\ynnsGfY.exe
  C:\Windows\System\ynnsGfY.exe
  2⤵
  PID:5044
- C:\Windows\System\DaRHIyC.exe
  C:\Windows\System\DaRHIyC.exe
  2⤵
  PID:13068
- C:\Windows\System\GSJkYXg.exe
  C:\Windows\System\GSJkYXg.exe
  2⤵
  PID:13116
- C:\Windows\System\JTOMLfx.exe
  C:\Windows\System\JTOMLfx.exe
  2⤵
  PID:13172
- C:\Windows\System\gsbGUZQ.exe
  C:\Windows\System\gsbGUZQ.exe
  2⤵
  PID:13264
- C:\Windows\System\YIAwDWt.exe
  C:\Windows\System\YIAwDWt.exe
  2⤵
  PID:12308
- C:\Windows\System\fHWuwMI.exe
  C:\Windows\System\fHWuwMI.exe
  2⤵
  PID:12428
- C:\Windows\System\YzDByuO.exe
  C:\Windows\System\YzDByuO.exe
  2⤵
  PID:9496
- C:\Windows\System\MuHxabS.exe
  C:\Windows\System\MuHxabS.exe
  2⤵
  PID:12736
- C:\Windows\System\msJHBqB.exe
  C:\Windows\System\msJHBqB.exe
  2⤵
  PID:12876
- C:\Windows\System\yvYdlXy.exe
  C:\Windows\System\yvYdlXy.exe
  2⤵
  PID:9600
- C:\Windows\System\gYhUish.exe
  C:\Windows\System\gYhUish.exe
  2⤵
  PID:13212
- C:\Windows\System\vOlRRlZ.exe
  C:\Windows\System\vOlRRlZ.exe
  2⤵
  PID:8736
- C:\Windows\System\nMXtefy.exe
  C:\Windows\System\nMXtefy.exe
  2⤵
  PID:14276
- C:\Windows\System\KzQHBnZ.exe
  C:\Windows\System\KzQHBnZ.exe
  2⤵
  PID:9664
- C:\Windows\System\hkPWZLe.exe
  C:\Windows\System\hkPWZLe.exe
  2⤵
  PID:8816
- C:\Windows\System\jjNzkLn.exe
  C:\Windows\System\jjNzkLn.exe
  2⤵
  PID:6936
- C:\Windows\System\YCygoTu.exe
  C:\Windows\System\YCygoTu.exe
  2⤵
  PID:12952
- C:\Windows\System\uCjaAZy.exe
  C:\Windows\System\uCjaAZy.exe
  2⤵
  PID:6876
- C:\Windows\System\OYdhQbI.exe
  C:\Windows\System\OYdhQbI.exe
  2⤵
  PID:13364
- C:\Windows\System\HsqgTik.exe
  C:\Windows\System\HsqgTik.exe
  2⤵
  PID:13412
- C:\Windows\System\zsxMoMu.exe
  C:\Windows\System\zsxMoMu.exe
  2⤵
  PID:13472
- C:\Windows\System\pLeMSBi.exe
  C:\Windows\System\pLeMSBi.exe
  2⤵
  PID:6796
- C:\Windows\System\tqDAJuR.exe
  C:\Windows\System\tqDAJuR.exe
  2⤵
  PID:13552
- C:\Windows\System\NrBcazC.exe
  C:\Windows\System\NrBcazC.exe
  2⤵
  PID:13604
- C:\Windows\System\UjxmxAV.exe
  C:\Windows\System\UjxmxAV.exe
  2⤵
  PID:7288
- C:\Windows\System\uBfNgLq.exe
  C:\Windows\System\uBfNgLq.exe
  2⤵
  PID:10076
- C:\Windows\System\VqQvoOK.exe
  C:\Windows\System\VqQvoOK.exe
  2⤵
  PID:7436
- C:\Windows\System\tdRzDfu.exe
  C:\Windows\System\tdRzDfu.exe
  2⤵
  PID:9232
- C:\Windows\System\hEPNMmz.exe
  C:\Windows\System\hEPNMmz.exe
  2⤵
  PID:9400
- C:\Windows\System\IcCUtUd.exe
  C:\Windows\System\IcCUtUd.exe
  2⤵
  PID:7812
- C:\Windows\System\juSUsJz.exe
  C:\Windows\System\juSUsJz.exe
  2⤵
  PID:7908
- C:\Windows\System\WsMxDZw.exe
  C:\Windows\System\WsMxDZw.exe
  2⤵
  PID:5512
- C:\Windows\System\FNuhqZk.exe
  C:\Windows\System\FNuhqZk.exe
  2⤵
  PID:5596
- C:\Windows\System\HXnFUJP.exe
  C:\Windows\System\HXnFUJP.exe
  2⤵
  PID:9292
- C:\Windows\System\YlIuRaC.exe
  C:\Windows\System\YlIuRaC.exe
  2⤵
  PID:5696
- C:\Windows\System\Jjogvdb.exe
  C:\Windows\System\Jjogvdb.exe
  2⤵
  PID:7704
- C:\Windows\System\QbMqLVJ.exe
  C:\Windows\System\QbMqLVJ.exe
  2⤵
  PID:9700
- C:\Windows\System\jcaOiXe.exe
  C:\Windows\System\jcaOiXe.exe
  2⤵
  PID:1444
- C:\Windows\System\sxaysHb.exe
  C:\Windows\System\sxaysHb.exe
  2⤵
  PID:9164
- C:\Windows\System\GSEwuDW.exe
  C:\Windows\System\GSEwuDW.exe
  2⤵
  PID:9204
- C:\Windows\System\aYKlhQk.exe
  C:\Windows\System\aYKlhQk.exe
  2⤵
  PID:6060
- C:\Windows\System\sESLUZw.exe
  C:\Windows\System\sESLUZw.exe
  2⤵
  PID:8488
- C:\Windows\System\BEBWWzo.exe
  C:\Windows\System\BEBWWzo.exe
  2⤵
  PID:7864
- C:\Windows\System\uEXAteS.exe
  C:\Windows\System\uEXAteS.exe
  2⤵
  PID:4468
- C:\Windows\System\JFqVpno.exe
  C:\Windows\System\JFqVpno.exe
  2⤵
  PID:10656
- C:\Windows\System\rWPYzBe.exe
  C:\Windows\System\rWPYzBe.exe
  2⤵
  PID:10732
- C:\Windows\System\EhWvZGk.exe
  C:\Windows\System\EhWvZGk.exe
  2⤵
  PID:5516
- C:\Windows\System\ySoEPhP.exe
  C:\Windows\System\ySoEPhP.exe
  2⤵
  PID:10928
- C:\Windows\System\asJaRAQ.exe
  C:\Windows\System\asJaRAQ.exe
  2⤵
  PID:11008
- C:\Windows\System\rTtyPue.exe
  C:\Windows\System\rTtyPue.exe
  2⤵
  PID:11068
- C:\Windows\System\SiWoXld.exe
  C:\Windows\System\SiWoXld.exe
  2⤵
  PID:8088
- C:\Windows\System\vsLwVGS.exe
  C:\Windows\System\vsLwVGS.exe
  2⤵
  PID:10284
- C:\Windows\System\GgPWCHF.exe
  C:\Windows\System\GgPWCHF.exe
  2⤵
  PID:10428
- C:\Windows\System\kUvJLze.exe
  C:\Windows\System\kUvJLze.exe
  2⤵
  PID:10624
- C:\Windows\System\jzNXNEp.exe
  C:\Windows\System\jzNXNEp.exe
  2⤵
  PID:10804
- C:\Windows\System\AUWvezD.exe
  C:\Windows\System\AUWvezD.exe
  2⤵
  PID:10988
- C:\Windows\System\eSeUNAx.exe
  C:\Windows\System\eSeUNAx.exe
  2⤵
  PID:9000
- C:\Windows\System\NtVcDJt.exe
  C:\Windows\System\NtVcDJt.exe
  2⤵
  PID:10516
- C:\Windows\System\UZSABzJ.exe
  C:\Windows\System\UZSABzJ.exe
  2⤵
  PID:11348
- C:\Windows\System\OafJZEd.exe
  C:\Windows\System\OafJZEd.exe
  2⤵
  PID:11580
- C:\Windows\System\ETTWEqz.exe
  C:\Windows\System\ETTWEqz.exe
  2⤵
  PID:6172
- C:\Windows\System\OgYbIpi.exe
  C:\Windows\System\OgYbIpi.exe
  2⤵
  PID:6496
- C:\Windows\System\EaxPsjA.exe
  C:\Windows\System\EaxPsjA.exe
  2⤵
  PID:6608
- C:\Windows\System\EcdBcHI.exe
  C:\Windows\System\EcdBcHI.exe
  2⤵
  PID:11856
- C:\Windows\System\KStqtoL.exe
  C:\Windows\System\KStqtoL.exe
  2⤵
  PID:11968
- C:\Windows\System\MSFdIGc.exe
  C:\Windows\System\MSFdIGc.exe
  2⤵
  PID:12116
- C:\Windows\System\qNUUtIj.exe
  C:\Windows\System\qNUUtIj.exe
  2⤵
  PID:8280
- C:\Windows\System\oboRfTC.exe
  C:\Windows\System\oboRfTC.exe
  2⤵
  PID:14040
- C:\Windows\System\hXDeWNa.exe
  C:\Windows\System\hXDeWNa.exe
  2⤵
  PID:6132
- C:\Windows\System\qbNiqBd.exe
  C:\Windows\System\qbNiqBd.exe
  2⤵
  PID:11916
- C:\Windows\System\iCvxzwT.exe
  C:\Windows\System\iCvxzwT.exe
  2⤵
  PID:12164
- C:\Windows\System\RrBnWtL.exe
  C:\Windows\System\RrBnWtL.exe
  2⤵
  PID:6488
- C:\Windows\System\cOErBYq.exe
  C:\Windows\System\cOErBYq.exe
  2⤵
  PID:13392
- C:\Windows\System\EMpBzVc.exe
  C:\Windows\System\EMpBzVc.exe
  2⤵
  PID:12096
- C:\Windows\System\WPXdpll.exe
  C:\Windows\System\WPXdpll.exe
  2⤵
  PID:12340
- C:\Windows\System\FuUpRMm.exe
  C:\Windows\System\FuUpRMm.exe
  2⤵
  PID:14120
- C:\Windows\System\VBLutHx.exe
  C:\Windows\System\VBLutHx.exe
  2⤵
  PID:5660
- C:\Windows\System\oMdqBHV.exe
  C:\Windows\System\oMdqBHV.exe
  2⤵
  PID:12668
- C:\Windows\System\jSzZTaL.exe
  C:\Windows\System\jSzZTaL.exe
  2⤵
  PID:12808
- C:\Windows\System\ydqzFpM.exe
  C:\Windows\System\ydqzFpM.exe
  2⤵
  PID:8592
- C:\Windows\System\tzXSqWP.exe
  C:\Windows\System\tzXSqWP.exe
  2⤵
  PID:13096
- C:\Windows\System\WBjrUDV.exe
  C:\Windows\System\WBjrUDV.exe
  2⤵
  PID:6984
- C:\Windows\System\kpNpekY.exe
  C:\Windows\System\kpNpekY.exe
  2⤵
  PID:12508
- C:\Windows\System\EjulGJR.exe
  C:\Windows\System\EjulGJR.exe
  2⤵
  PID:9580
- C:\Windows\System\WahIgcu.exe
  C:\Windows\System\WahIgcu.exe
  2⤵
  PID:13008
- C:\Windows\System\SnVtYrR.exe
  C:\Windows\System\SnVtYrR.exe
  2⤵
  PID:12516
- C:\Windows\System\qFCZgVK.exe
  C:\Windows\System\qFCZgVK.exe
  2⤵
  PID:13232
- C:\Windows\System\RBkkMjU.exe
  C:\Windows\System\RBkkMjU.exe
  2⤵
  PID:5080
- C:\Windows\System\UMkvQXt.exe
  C:\Windows\System\UMkvQXt.exe
  2⤵
  PID:9860
- C:\Windows\System\vaBpoNs.exe
  C:\Windows\System\vaBpoNs.exe
  2⤵
  PID:13496
- C:\Windows\System\pylULoo.exe
  C:\Windows\System\pylULoo.exe
  2⤵
  PID:13584
- C:\Windows\System\TtuTWxk.exe
  C:\Windows\System\TtuTWxk.exe
  2⤵
  PID:5228
- C:\Windows\System\csPyUxN.exe
  C:\Windows\System\csPyUxN.exe
  2⤵
  PID:9268
- C:\Windows\System\ICkCdag.exe
  C:\Windows\System\ICkCdag.exe
  2⤵
  PID:13540
- C:\Windows\System\HxAKBbm.exe
  C:\Windows\System\HxAKBbm.exe
  2⤵
  PID:8116
- C:\Windows\System\HHaqiMd.exe
  C:\Windows\System\HHaqiMd.exe
  2⤵
  PID:7688
- C:\Windows\System\vJSvSxu.exe
  C:\Windows\System\vJSvSxu.exe
  2⤵
  PID:10228
- C:\Windows\System\evGcTZW.exe
  C:\Windows\System\evGcTZW.exe
  2⤵
  PID:5088
- C:\Windows\System\MDJxLBZ.exe
  C:\Windows\System\MDJxLBZ.exe
  2⤵
  PID:8484
- C:\Windows\System\hsywHCs.exe
  C:\Windows\System\hsywHCs.exe
  2⤵
  PID:1544
- C:\Windows\System\BQPlTbX.exe
  C:\Windows\System\BQPlTbX.exe
  2⤵
  PID:392
- C:\Windows\System\zajidLh.exe
  C:\Windows\System\zajidLh.exe
  2⤵
  PID:13992
- C:\Windows\System\qiRYABL.exe
  C:\Windows\System\qiRYABL.exe
  2⤵
  PID:384
- C:\Windows\System\kasYNal.exe
  C:\Windows\System\kasYNal.exe
  2⤵
  PID:5972
- C:\Windows\System\RAKCKaX.exe
  C:\Windows\System\RAKCKaX.exe
  2⤵
  PID:4944
- C:\Windows\System\RPsaDVT.exe
  C:\Windows\System\RPsaDVT.exe
  2⤵
  PID:8928
- C:\Windows\System\jGkjGYm.exe
  C:\Windows\System\jGkjGYm.exe
  2⤵
  PID:10436
- C:\Windows\System\ilsvhqX.exe
  C:\Windows\System\ilsvhqX.exe
  2⤵
  PID:11464
- C:\Windows\System\EhsginH.exe
  C:\Windows\System\EhsginH.exe
  2⤵
  PID:6524
- C:\Windows\System\zjPRuqG.exe
  C:\Windows\System\zjPRuqG.exe
  2⤵
  PID:6732
- C:\Windows\System\jrxKzkK.exe
  C:\Windows\System\jrxKzkK.exe
  2⤵
  PID:8296
- C:\Windows\System\VJdrFua.exe
  C:\Windows\System\VJdrFua.exe
  2⤵
  PID:6452
- C:\Windows\System\WVFXCNc.exe
  C:\Windows\System\WVFXCNc.exe
  2⤵
  PID:6268
- C:\Windows\System\sBbJakr.exe
  C:\Windows\System\sBbJakr.exe
  2⤵
  PID:12144
- C:\Windows\System\mYxUEEh.exe
  C:\Windows\System\mYxUEEh.exe
  2⤵
  PID:12368
- C:\Windows\System\VRAaFYN.exe
  C:\Windows\System\VRAaFYN.exe
  2⤵
  PID:12696
- C:\Windows\System\dAGBPJC.exe
  C:\Windows\System\dAGBPJC.exe
  2⤵
  PID:9440
- C:\Windows\System\xfjDKof.exe
  C:\Windows\System\xfjDKof.exe
  2⤵
  PID:12420
- C:\Windows\System\OhOinQm.exe
  C:\Windows\System\OhOinQm.exe
  2⤵
  PID:764
- C:\Windows\System\OxQpLXk.exe
  C:\Windows\System\OxQpLXk.exe
  2⤵
  PID:1848
- C:\Windows\System\DKFmWGu.exe
  C:\Windows\System\DKFmWGu.exe
  2⤵
  PID:9908
- C:\Windows\System\xrnQDmY.exe
  C:\Windows\System\xrnQDmY.exe
  2⤵
  PID:7300
- C:\Windows\System\gPtrVwd.exe
  C:\Windows\System\gPtrVwd.exe
  2⤵
  PID:7888
- C:\Windows\System\XSTFYES.exe
  C:\Windows\System\XSTFYES.exe
  2⤵
  PID:9444
- C:\Windows\System\NChRCmg.exe
  C:\Windows\System\NChRCmg.exe
  2⤵
  PID:8504
- C:\Windows\System\diZHIFV.exe
  C:\Windows\System\diZHIFV.exe
  2⤵
  PID:13960
- C:\Windows\System\LHXFeyj.exe
  C:\Windows\System\LHXFeyj.exe
  2⤵
  PID:8044
- C:\Windows\System\tknaHoR.exe
  C:\Windows\System\tknaHoR.exe
  2⤵
  PID:5296
- C:\Windows\System\DOgHJkh.exe
  C:\Windows\System\DOgHJkh.exe
  2⤵
  PID:10512
- C:\Windows\System\xJReRRK.exe
  C:\Windows\System\xJReRRK.exe
  2⤵
  PID:6300
- C:\Windows\System\pvQuvAu.exe
  C:\Windows\System\pvQuvAu.exe
  2⤵
  PID:1220
- C:\Windows\System\hOcuBAx.exe
  C:\Windows\System\hOcuBAx.exe
  2⤵
  PID:11500
- C:\Windows\System\oBVdCqI.exe
  C:\Windows\System\oBVdCqI.exe
  2⤵
  PID:11772
- C:\Windows\System\ToLLbRu.exe
  C:\Windows\System\ToLLbRu.exe
  2⤵
  PID:12892
- C:\Windows\System\CrMUtDS.exe
  C:\Windows\System\CrMUtDS.exe
  2⤵
  PID:12936
- C:\Windows\System\ojiIrRq.exe
  C:\Windows\System\ojiIrRq.exe
  2⤵
  PID:13560
- C:\Windows\System\UkRIANU.exe
  C:\Windows\System\UkRIANU.exe
  2⤵
  PID:7236
- C:\Windows\System\VYuHzsI.exe
  C:\Windows\System\VYuHzsI.exe
  2⤵
  PID:13804
- C:\Windows\System\RLPLLdA.exe
  C:\Windows\System\RLPLLdA.exe
  2⤵
  PID:2404
- C:\Windows\System\YogHQNX.exe
  C:\Windows\System\YogHQNX.exe
  2⤵
  PID:14324
- C:\Windows\System\SRvjhgz.exe
  C:\Windows\System\SRvjhgz.exe
  2⤵
  PID:14152
- C:\Windows\System\zqZaDCt.exe
  C:\Windows\System\zqZaDCt.exe
  2⤵
  PID:13152
- C:\Windows\System\tOecmiy.exe
  C:\Windows\System\tOecmiy.exe
  2⤵
  PID:680
- C:\Windows\System\rSnuQUM.exe
  C:\Windows\System\rSnuQUM.exe
  2⤵
  PID:13760
- C:\Windows\System\IIXOHQH.exe
  C:\Windows\System\IIXOHQH.exe
  2⤵
  PID:11280
- C:\Windows\System\NOAsSZB.exe
  C:\Windows\System\NOAsSZB.exe
  2⤵
  PID:10480
- C:\Windows\System\qfwsmwv.exe
  C:\Windows\System\qfwsmwv.exe
  2⤵
  PID:4776
- C:\Windows\System\aCZPDCV.exe
  C:\Windows\System\aCZPDCV.exe
  2⤵
  PID:528
- C:\Windows\System\JcAfyJI.exe
  C:\Windows\System\JcAfyJI.exe
  2⤵
  PID:14352
- C:\Windows\System\YQeAAzg.exe
  C:\Windows\System\YQeAAzg.exe
  2⤵
  PID:14380
- C:\Windows\System\myNaENq.exe
  C:\Windows\System\myNaENq.exe
  2⤵
  PID:14408
- C:\Windows\System\dVsjbUn.exe
  C:\Windows\System\dVsjbUn.exe
  2⤵
  PID:14436
- C:\Windows\System\RHROTIQ.exe
  C:\Windows\System\RHROTIQ.exe
  2⤵
  PID:14464
- C:\Windows\System\PJzdBsU.exe
  C:\Windows\System\PJzdBsU.exe
  2⤵
  PID:14492
- C:\Windows\System\xyFLdNS.exe
  C:\Windows\System\xyFLdNS.exe
  2⤵
  PID:14520
- C:\Windows\System\ORNNcGh.exe
  C:\Windows\System\ORNNcGh.exe
  2⤵
  PID:14548
- C:\Windows\System\zuDLsZx.exe
  C:\Windows\System\zuDLsZx.exe
  2⤵
  PID:14576
- C:\Windows\System\CUjPkHn.exe
  C:\Windows\System\CUjPkHn.exe
  2⤵
  PID:15020
- C:\Windows\System\WSKeDAx.exe
  C:\Windows\System\WSKeDAx.exe
  2⤵
  PID:15056
- C:\Windows\System\zPhEvqR.exe
  C:\Windows\System\zPhEvqR.exe
  2⤵
  PID:7816
- C:\Windows\System\rwrCYgC.exe
  C:\Windows\System\rwrCYgC.exe
  2⤵
  PID:14748
- C:\Windows\System\IzZMDMN.exe
  C:\Windows\System\IzZMDMN.exe
  2⤵
  PID:14796
- C:\Windows\System\RwWVagb.exe
  C:\Windows\System\RwWVagb.exe
  2⤵
  PID:15148
- C:\Windows\System\kFjjDmM.exe
  C:\Windows\System\kFjjDmM.exe
  2⤵
  PID:15240
- C:\Windows\System\aojegiz.exe
  C:\Windows\System\aojegiz.exe
  2⤵
  PID:15264
- C:\Windows\System\PHRKMOL.exe
  C:\Windows\System\PHRKMOL.exe
  2⤵
  PID:15304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2700,i,14648456027158448592,4956305794400220180,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:8
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_jq4ha23m.mnw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jq4ha23m.mnw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

FRVVCFs.exe

Path C:\Windows\System\FRVVCFs.exe
Size 3.3MB
SHA256 fa0d286565189c8deb617e112e3834a54cd338c302786a7660100709785c18f8
MD5 f2814971c40fe899ebcc22769d81b799
SHA1 de13c30b67b5e00e6ad25949c4567ccc6967677e
SHA512 f61cc591c62b26762d893ed8e22e90ab7a31823762cf2d7d968afab626e078178cb65e3e5ed360157f1935cc6543d4cf8356fa3b94ab2020a44850953589ee1c
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWl:7bBeSFkp
MD5 SHA1 SHA512 SSDEEP

Submit Download

FrFUrAp.exe

Path C:\Windows\System\FrFUrAp.exe
Size 3.3MB
SHA256 601a9ce605b6c7c200b48768c3faf1b3fb5bac155aeb97eaae0882de360646e6
MD5 9ba8860d12bb99c3024283c27626d815
SHA1 6724b93e3d3a34e43780043bbd1a408d5e9ec6fd
SHA512 980755cd9648e0e3c4689caa87803e904de60178ef0492319b7739d0dbc44427af612d121668a11f192c6dfd5402d15caafde2407f8896b6fbf71f53dc5eb09b
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWj:7bBeSFkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

GTlfOaP.exe

Path C:\Windows\System\GTlfOaP.exe
Size 3.3MB
SHA256 206aeefea4628e259918e2efac6c3186321c8f75a863c3d4fc5e7ad57a4ff38f
MD5 5c207f90fb40c8770b653ea5ae68336f
SHA1 c54779b7ca22a1e6e1ed47d7c6d770c26a740bfb
SHA512 3b95b874ceb55c9c7a8d19c173d7e97ec2fba5dabdc3c58588b8e4ca116d701d9310bea91983dd134454eb0db9d460c85ca8097bc6c2a96b3e89f37b64f945c9
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWT:7bBeSFkP
MD5 SHA1 SHA512 SSDEEP

Submit Download

GhEDxyx.exe

Path C:\Windows\System\GhEDxyx.exe
Size 3.3MB
SHA256 c254fa5ff1b0546d0f0ae56624b09a959d593832ceeb864173f9e0a95d070bfc
MD5 e8abf881f39909a9fd3604f403e8643f
SHA1 8a78fb3f4b5cb14a4edb25476168ed0f1c2c8b5b
SHA512 e87d75fc086f7ccce5b467f26dd0a95f08a3c2257c8d727d306358980d78ccc23a5f3c7d55aa2abf8c440fdebcb2b32de5775b3f3fa0b244a3675bdae80ffba5
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWZ:7bBeSFkl
MD5 SHA1 SHA512 SSDEEP

Submit Download

GzKQxzt.exe

Path C:\Windows\System\GzKQxzt.exe
Size 3.3MB
SHA256 aa25b8c6a4c3bf06a245ddc2ccd0ba7b2343e67f00690392db9a0702af8f0722
MD5 7a2f5c53904372064e2028c57480a294
SHA1 c1f61f377698fec69b34260834437fce732190e7
SHA512 93083c13e6826297393608f3ff64089182a6b9f552de9ca97775c64d17248b86f7a85dc33d591389d7dc3d1d0949aa2769c4c9cd0a31554a677580bc63323755
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWg:7bBeSFk0
MD5 SHA1 SHA512 SSDEEP

Submit Download

IvNRTYq.exe

Path C:\Windows\System\IvNRTYq.exe
Size 3.3MB
SHA256 d056ae4315a25a9740fa23fbf248b2fb410228b1fd7f4385e8951471b26e8dfe
MD5 8e4701c03246097160b757c33c7f7206
SHA1 8bbd672ce1e75ee6b8a0000e5ce5cbb6696b7055
SHA512 0c15b67e500814c680dbf25e48c4145269b337c9d029429a6d2e15b3c943b34742c1804093a0b84ec3e3973ab34b5fa9fba7f77c522b38514e83ab54c9a393f6
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWx:7bBeSFkd
MD5 SHA1 SHA512 SSDEEP

Submit Download

LbNRuHZ.exe

Path C:\Windows\System\LbNRuHZ.exe
Size 3.3MB
SHA256 961fadb5263002d669b74e5c409c144aa254508502caeacadead87180a651d20
MD5 b0974b5f2f9047f471ef66f102135433
SHA1 fba8d1f29b5290c321b0cc01cf44ac986f7f072d
SHA512 8fb33544ef7f44ac3c139b68608f2cc9d7a6dc68c8b85719dfca15b40e0a3d03a054be185739eb755c3992885013899dc46a37292d95aa84aa50bb72383dc76a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWQ:7bBeSFkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

MLYjtdV.exe

Path C:\Windows\System\MLYjtdV.exe
Size 3.3MB
SHA256 a7f9e61417aabe197db0ae421a77e6b1358b86f56411fcb39cabd4588dc6024d
MD5 2833ca3a9ee953100ac1fb40533fa046
SHA1 ce3a8b82104d30bf32dcb2cd5533d4b1707a0d73
SHA512 f3ab337c966a80a79b208f07b9972c375aa5e615604642577bc2234baa5f11c5d50523487c9eab460f498dda907d6715e931fa95c2674bd33b7b4723e5c6c096
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWz:7bBeSFkP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MWUFnZB.exe

Path C:\Windows\System\MWUFnZB.exe
Size 3.3MB
SHA256 eebc8e81a544eb06c02c82b750ef598b5855d65cccb6914670cbfd2a8071abe3
MD5 e1058a89d7f03f0a7bb98650e6def9b6
SHA1 738e693fb023f9b420d62b1584218a3ddbf25cf4
SHA512 4624b6784d9e681dfc3f0dfb527d4d9faf84881a94599f94b9e25bbce34494d2ca643a16e5f21a322f66db4081caba476e33f21293d9afdeab81106354c1aa2a
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW2:7bBeSFkC
MD5 SHA1 SHA512 SSDEEP

Submit Download

NMmqPSh.exe

Path C:\Windows\System\NMmqPSh.exe
Size 3.3MB
SHA256 9be70ea293e03dc55729c9794d34ef4caf1de3c6b35eba6d6f34e40581b398e5
MD5 39c059f28c33e052ee9a45e8051888c0
SHA1 17255902e7ba6f4c58774774e3d129ad12e65485
SHA512 d2e4048204fd16553fdc391339fbbbb0716e39e6a239fa4859ba3e0f8b7df87010d6aedb7c29d826756e6c9819bd3ff1126d57eb7266c33ecb2d3a1c9268db47
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWK:7bBeSFkG
MD5 SHA1 SHA512 SSDEEP

Submit Download

PERgJqn.exe

Path C:\Windows\System\PERgJqn.exe
Size 3.3MB
SHA256 2eedd50a78cf1418f144bb8211d7d4a8fc483ab5b7fb01a4db7fcb93ff4546db
MD5 b3a8e9c42a4ec38ba62921bf466f694f
SHA1 b7e9c63f0d4f5a1a24fdf57f16239595504ce0e7
SHA512 0043b84e63edf957f8bddafe3e391bbb396bd1e09df4d5f2ad78986b279ffc78329080814f0c8301b655874b1248110bd43d270a4e57a550f3b9a6724f45fbe6
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW5:7bBeSFk1
MD5 SHA1 SHA512 SSDEEP

Submit Download

SKlNyqR.exe

Path C:\Windows\System\SKlNyqR.exe
Size 3.3MB
SHA256 61e63ec1642aabc162cd70e183a6b6c0f3cf53a21ca9f67b06da755a3c8bcef3
MD5 e40d17cf68cd0e624e197e4ebb87a86e
SHA1 31c2989ccf84a462a8d5d3c1b845cc50740bcffd
SHA512 9d24ed76dd923150ba2d3add32b04be773ab39497053b75ac8baec016947878b0f51d684b8502a545f105837d33a60acdee9b8863b4687c5ca2e7546a1920769
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWc:7bBeSFko
MD5 SHA1 SHA512 SSDEEP

Submit Download

TTKjrLA.exe

Path C:\Windows\System\TTKjrLA.exe
Size 3.3MB
SHA256 1039e6890c75ecb97c90547c7539a826ce5a8e9542b82d800960d5a7b3a75a9a
MD5 182f7fc3d6055aec110838fe000cea0b
SHA1 9159411f9aee6c5c91b68ad423cc182c807e8db3
SHA512 096f685e0278595f954251fcc6e1bec6db09498a6a408aee9c94ef06b11f01cca804a498d643830eae0efa12f558de11da66cf666569aca6722d1e9d281fb024
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW/:7bBeSFkz
MD5 SHA1 SHA512 SSDEEP

Submit Download

VbYDZld.exe

Path C:\Windows\System\VbYDZld.exe
Size 3.3MB
SHA256 078206e50a0f44d195aa4da6b205721a2b5544eb0ec8e9eb0b0ceff32fbbc6e7
MD5 ffc2c90d88ce9fa70f2b9813a91eca41
SHA1 8b4528db5e2fd8edd6d9696db8e87be8c29264d2
SHA512 7aaa44b625090edcb70ad39322c80e5fe4ed90e0a31d4df95f672811b693e095de7cd26a39b3f3bf6529f20aba677a3fef2a4b51670b751d2dc691a9817bc1e2
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWU:7bBeSFkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

XwViUFS.exe

Path C:\Windows\System\XwViUFS.exe
Size 3.3MB
SHA256 ba784b14a11f32ebbc6c1141a917c9ad71e0ff477e7e7e07ec0ac6d70b3d099e
MD5 2500e04cd2eb3f8eff179b85b5a3fc78
SHA1 71d7921dc35c930dcbb033b561735ac6ea54318a
SHA512 3b09c0a24d68b99b4f37008719f70162af9b2de767a9c0d3f2e6f0f18fa45a2fe977d198bdfe2d5bef4f68116bc1b9395c2ae53cdab9955f939f7a5370a2a6fb
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWx:7bBeSFkF
MD5 SHA1 SHA512 SSDEEP

Submit Download

YKFCIdh.exe

Path C:\Windows\System\YKFCIdh.exe
Size 3.3MB
SHA256 b4c2d426302c4293133c4b59e23f5f62c49272169a54490b02a77965f3a30812
MD5 189b6e50cd5c93993677e74aae04678a
SHA1 a9f42ea129af73e6fa42609523dd26fe0b36d652
SHA512 330ce5d9040020a61f6c173cc7b6c06baab7a4573da36e6a8cfea281a34cee04a028bede407e1ba1d1cbab143cac7f4f64f63d1893c4a16d654b5aaf2c1f89a3
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWq:7bBeSFk+
MD5 SHA1 SHA512 SSDEEP

Submit Download

YeduepK.exe

Path C:\Windows\System\YeduepK.exe
Size 8B
SHA256 44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4
MD5 30a9dfceb37577cb23b97b50ee0ca790
SHA1 b56360a546aafbfa7ce003cd05916a7ab7239259
SHA512 f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57
MD5 SHA1 SHA512

Submit Download

aCeedeL.exe

Path C:\Windows\System\aCeedeL.exe
Size 3.3MB
SHA256 97495eefaaad7d25d80dda950515df3423dcf543061541eddf726b497a86d567
MD5 14c0db6e611c1f9f33c5bab021ad58db
SHA1 f83c317f23dfde1f4992b599647276a93aadca33
SHA512 5c4c008803c170fa4865579f6efbf9f0a0278efcc2db82f8788ae9af7bc188a6806cb35c7e4b078fd9c09bd5e21e87e0a4fa7f30daa24b13d663e77012cc510b
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWg:7bBeSFkU
MD5 SHA1 SHA512 SSDEEP

Submit Download

bukklJd.exe

Path C:\Windows\System\bukklJd.exe
Size 3.3MB
SHA256 1c5ccf55ed5370983e48c9df0b96bde180de1e3ff56c9d5fb43791b35b35386d
MD5 abeb429f90424513ef72252b6341dce3
SHA1 9f04596b5bceba90d070006f69b8db39402e0b4b
SHA512 9b641a4a7f3489a51be5b42d121cf1d56a239cb45d94d8a2ae2390a71f27ebe03be8be396a9991a1ba2377a47bbaaeb3b7ecb8d5e4cb1dd0027a56891cb6c2c6
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWa:7bBeSFkO
MD5 SHA1 SHA512 SSDEEP

Submit Download

gLZyIEq.exe

Path C:\Windows\System\gLZyIEq.exe
Size 18B
SHA256 22fad68840942c3468f5bd85214408fef29e825f9fa4402f948647dd9bfcfbbf
MD5 12d764af0242c5e9d5789b2b47191cab
SHA1 27c955d8895a3dd74067d2c8c2ddd4db89461025
SHA512 345f6542208a71772d6f12acd8a7a946bff3a5b0364922fdfdbb97f70b74edd2676762bb63e6f4b3817ce1c84a3d722837cfba2c47e6d30027d13c7c41912d58
MD5 SHA1 SHA512

Submit Download

gYkVMuB.exe

Path C:\Windows\System\gYkVMuB.exe
Size 3.3MB
SHA256 c45dccad8b53a339f3b0e3035445d2102b5223f4fdab289adfab00149e4777f0
MD5 dd9b4f96d062353576ae8b744313217b
SHA1 f067b46e7a7fde8e06308120c32003a50fdf7230
SHA512 8349619e29de247496027fda89da12d2169d03645c8372eab5dee403db2fac26fdbc4d7bbd13db6b53484587d9a52eeebc7639fc8d21992ad17549a694c9d710
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWD:7bBeSFkP
MD5 SHA1 SHA512 SSDEEP

Submit Download

grMcRWX.exe

Path C:\Windows\System\grMcRWX.exe
Size 3.3MB
SHA256 eb087b4e2ac8e9e5b19d21cd38e2a72c2e8141e8244263f434ee544d396bfd19
MD5 cf32e377180420a55540c44fd7647b2f
SHA1 9979330518af85d4cbc8bb6f867a0bf2fc9acb2e
SHA512 cb06db905e0e733c060488fb5d6c4f08fe213658c9df2b19021a0fa92660d08427e92490b767cfc4173f4fdd5cf8c01fc338dd7792cd718f2ab0f68cfd70698e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWp:7bBeSFkV
MD5 SHA1 SHA512 SSDEEP

Submit Download

hxPVuun.exe

Path C:\Windows\System\hxPVuun.exe
Size 3.3MB
SHA256 0f193358f8891cf0f7c356ae99007a97d75149f77277b634d370aa3179fb809d
MD5 5654faa47e757584b199625c6e456f89
SHA1 ea72aa049d8b898440b02384ff184146789f8afb
SHA512 be4c74fdfd1ad759017a9ed1d23f1e450c7ad8f78d72b058a9cf835c8a086cff1ad93f7bfa1636e7c5e1270cd2ec42b82b8a61982a01b8f5738e1e26d299bf38
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWE:7bBeSFko
MD5 SHA1 SHA512 SSDEEP

Submit Download

icozioG.exe

Path C:\Windows\System\icozioG.exe
Size 3.3MB
SHA256 29fa88aeca7b92d0e848be078f9322b0265c4bcd53e3180c81e6c4a7e2036d67
MD5 749e6315e3fe3d187f5bb6b0336dd98c
SHA1 d0db31be553099536f67263cc934172c3c0d8377
SHA512 fbfe24565ad714c0056e3e320ea6fcf72f5a8d69851b89f310807130b9c0db39f91f098d40c733bec6580d6ba688a8568ada48bb0cf06171597b1c09987f129f
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWJ:7bBeSFkF
MD5 SHA1 SHA512 SSDEEP

Submit Download

kdnxhIP.exe

Path C:\Windows\System\kdnxhIP.exe
Size 3.3MB
SHA256 c79a69cb2c61b6a83f58efb72c8539dc300a7f75b88db38544306232d050134e
MD5 ade7fc16e0d135572cf43f285c01ab18
SHA1 4c9ec2b427a075659932da694b8a252c14bc5e4b
SHA512 4ab6e2dc36f236c82fc21341baa490113f0a2516a09f801c104d5af94cc436fbd3be9689fafce214f48a750f3e2130c65bc5ae1e48f1a41b11b74ad5c605f734
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWV:7bBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lPuNblq.exe

Path C:\Windows\System\lPuNblq.exe
Size 3.3MB
SHA256 0d19ad1b8e6db2b992e1e3c91691d2fd575770b869ba29b465b9e8f19701d2cc
MD5 c438fc4d825c1f35491b3e43d8402a62
SHA1 bdcf0cda247c2eb83da85b441372a453291ad96d
SHA512 02a636ce654fc8d57927044ad0dff0ad33d6424e5bbece74a193f96adbb95cfb50abf7280f29b8d565a855238cbed7e203a1f5539b0816b787b27415d51ccd1f
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWl:7bBeSFkJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mkEBAnM.exe

Path C:\Windows\System\mkEBAnM.exe
Size 3.3MB
SHA256 6e4e298aa72267f27bc9e19f08f8efdf818cb58ce3718a5707d159fa8c4e9f8c
MD5 f29c61b1d8d139a93e9498fe25780e92
SHA1 6697a3e31341fc62f38f0d9a2ba882e1675131e8
SHA512 b2a203a8db8720a011bb4e7125e6967ca21a6563f214d5d30a90eb2bc434d8aa381f169eccdba637008f5454a0d157d96c32d4f9a053ced18b1251e244ed750f
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWR:7bBeSFkt
MD5 SHA1 SHA512 SSDEEP

Submit Download

pcbBAWN.exe

Path C:\Windows\System\pcbBAWN.exe
Size 3.3MB
SHA256 69957970a3010f187cb25286961c08f4b4df4cd21b88d4f08ba279b0d90e186f
MD5 a0875246c09546f12c2f0382cdf08526
SHA1 90eb0d3c8c710b7ec6d23f0bf61a4c7fdac37534
SHA512 51ac60886ea786aad86a54b54cee0a9ae9db322339aa15e1f824a70341b9b069e66190c96c365162556cf3f085087c8ba9cc879a77b4d8fd4fdb468872f94a78
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWs:7bBeSFkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

slMmxAl.exe

Path C:\Windows\System\slMmxAl.exe
Size 3.3MB
SHA256 22a37507fece235fba45e6b6fe5b924c7d8e70a06d6e133b66e77bec934a0f1c
MD5 f4002a3b85560cd65b5e076f8efad420
SHA1 22c3accf5d7f4c7294dd32e084644d71328a2394
SHA512 29cc193d600f1311f7d714923ea7afe696887f2b9e0422e8e170f67a2d89b58ad853edee428f59ffe928e7926123a20572b516d1569fbe818a7781784781e3d8
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW0:7bBeSFkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

tfsZLtB.exe

Path C:\Windows\System\tfsZLtB.exe
Size 3.3MB
SHA256 1a3bee373be8bb75b7468b88c78f721c516b6fddc1c3b791e8d454588fb73451
MD5 aba95a9479028b581c49e2cbd8c827ce
SHA1 0b7d7e368601463f0c56c4559d36f33dceeac1a8
SHA512 aa53379e261dc3cce69d9f624808d86877894767597fb89e5356f589076b4064bd362c1c43d616f00506bb788b202f3d0f7186bc2ddd882fb9c10e673473b1c5
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWi:7bBeSFke
MD5 SHA1 SHA512 SSDEEP

Submit Download

ubuBZVq.exe

Path C:\Windows\System\ubuBZVq.exe
Size 3.3MB
SHA256 f621cc79d8980c7adf6c27695e1e3fab4d054bac06006642d40385b133564a32
MD5 979bea3bfdbb45a4a27a15233e621d2b
SHA1 189e27509d19975c00e52d27ddbe7ff4224b7043
SHA512 f259b13701965c1fa9416e04743d8c14e1ab4aa5b0d4236dd560b80f54e99d7dc303a5b7292d4e869b35b4c7c010b55f89bee6c8ab84ead7fa28d82e2a7e544d
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWD:7bBeSFkv
MD5 SHA1 SHA512 SSDEEP

Submit Download

wKHmehF.exe

Path C:\Windows\System\wKHmehF.exe
Size 3.3MB
SHA256 eb9a2817fe30a0ec39c64484385b78c931ec966f4ee8303df93fc9d679f31eb4
MD5 ae9ea0f18fe92b4ddf083a424916f7cd
SHA1 3460eb3760c58a88b3b8a193495ebd36f4e924bb
SHA512 afa7f6d4ba9e14f7b7a4b2b15895beab2fc35368ef52844cede38c8a016a0eb4163dbc145c93a0abe69974a90b14ffc5d019f4fc6b185b110c68cc9f479ab5d2
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWr:7bBeSFkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

xDuspIg.exe

Path C:\Windows\System\xDuspIg.exe
Size 3.3MB
SHA256 f91565af09c10829f639627c36d826e97944574c7f6cea96c32787ee63f2429d
MD5 a8b4679bad76d15f68dd0b960257e0b0
SHA1 3e6f614c7dcfefe7a88a058a2b2f15036894270f
SHA512 e702a861c998b8164064416adfaaca024e54df3c4a8b9c99c0ea050ab3c91bfc8561cafaba63a21f05e8055d3c74d29337e217e43952285ad8e5a458053c31f5
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrW4:7bBeSFkk
MD5 SHA1 SHA512 SSDEEP

Submit Download

xqPqrRU.exe

Path C:\Windows\System\xqPqrRU.exe
Size 3.3MB
SHA256 b8e0d70e9eab04cdc267c79f996f94e2c98a2f48e332a33667f27c0c4a7e1f9c
MD5 2c40c7bf3c9c1c0b34f406bc11737da7
SHA1 8633a49607d5560f10c31c43cfeaf711875db84c
SHA512 0ab7c815c14df76d66c614810e5b3bd31e61c4820186bcaf7c80571304faf6e1764631321dc2c3efe90a3055941fe9bff860b0629d07bfa839535e7bb7409c88
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWO:7bBeSFkS
MD5 SHA1 SHA512 SSDEEP

Submit Download

yDdhBSx.exe

Path C:\Windows\System\yDdhBSx.exe
Size 3.3MB
SHA256 ccb9e0d9ee87de75c560d94699fcefb81994adbe70fad5ec96062ac8c6d5381f
MD5 7689bd99379208953ce6cd53cc369bc8
SHA1 ebb1408d2860d3ceeaa681756c096837fb0dd974
SHA512 6fd7399100a375b62ea655e1d51bb6f763903759ad48ff9e7abfbf9dd35c5106d2def7afac8d2fed0338c9d9c7fa5a80fd0f8ad8bd1c9c780e585a3ba1c8044e
SSDEEP 98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWo:7bBeSFkc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/464-613-0x00007FF627C40000-0x00007FF628036000-memory.dmp

Download

memory/464-8-0x00007FF627C40000-0x00007FF628036000-memory.dmp

Download

memory/656-118-0x00007FF716DE0000-0x00007FF7171D6000-memory.dmp

Download

memory/656-5003-0x00007FF716DE0000-0x00007FF7171D6000-memory.dmp

Download

memory/704-578-0x00007FF751B90000-0x00007FF751F86000-memory.dmp

Download

memory/760-11-0x00007FFC3EFE3000-0x00007FFC3EFE5000-memory.dmp

Download

memory/760-885-0x00007FFC3EFE0000-0x00007FFC3FAA1000-memory.dmp

Download

memory/760-41-0x00007FFC3EFE0000-0x00007FFC3FAA1000-memory.dmp

Download

memory/760-39-0x000001DFC46C0000-0x000001DFC46E2000-memory.dmp

Download

memory/760-24-0x00007FFC3EFE0000-0x00007FFC3FAA1000-memory.dmp

Download

memory/760-618-0x00007FFC3EFE0000-0x00007FFC3FAA1000-memory.dmp

Download

memory/768-119-0x00007FF73C2A0000-0x00007FF73C696000-memory.dmp

Download

memory/768-5005-0x00007FF73C2A0000-0x00007FF73C696000-memory.dmp

Download

memory/1100-84-0x00007FF72B370000-0x00007FF72B766000-memory.dmp

Download

memory/1604-591-0x00007FF72E760000-0x00007FF72EB56000-memory.dmp

Download

memory/1632-52-0x00007FF703CE0000-0x00007FF7040D6000-memory.dmp

Download

memory/1632-4100-0x00007FF703CE0000-0x00007FF7040D6000-memory.dmp

Download

memory/1640-75-0x00007FF7963A0000-0x00007FF796796000-memory.dmp

Download

memory/2060-0-0x00007FF737850000-0x00007FF737C46000-memory.dmp

Download

memory/2060-570-0x00007FF737850000-0x00007FF737C46000-memory.dmp

Download

memory/2060-1-0x0000013BB0AC0000-0x0000013BB0AD0000-memory.dmp

Download

memory/2148-50-0x00007FF750C20000-0x00007FF751016000-memory.dmp

Download

memory/2148-4087-0x00007FF750C20000-0x00007FF751016000-memory.dmp

Download

memory/2208-45-0x00007FF770150000-0x00007FF770546000-memory.dmp

Download

memory/2292-595-0x00007FF709830000-0x00007FF709C26000-memory.dmp

Download

memory/2296-600-0x00007FF71C860000-0x00007FF71CC56000-memory.dmp

Download

memory/2316-55-0x00007FF6B0F10000-0x00007FF6B1306000-memory.dmp

Download

memory/2316-4086-0x00007FF6B0F10000-0x00007FF6B1306000-memory.dmp

Download

memory/2544-64-0x00007FF705530000-0x00007FF705926000-memory.dmp

Download

memory/2544-1555-0x00007FF705530000-0x00007FF705926000-memory.dmp

Download

memory/3184-2678-0x00007FF6C96A0000-0x00007FF6C9A96000-memory.dmp

Download

memory/3184-5004-0x00007FF6C96A0000-0x00007FF6C9A96000-memory.dmp

Download

memory/3184-111-0x00007FF6C96A0000-0x00007FF6C9A96000-memory.dmp

Download

memory/3376-2680-0x00007FF76AE80000-0x00007FF76B276000-memory.dmp

Download

memory/3376-5006-0x00007FF76AE80000-0x00007FF76B276000-memory.dmp

Download

memory/3376-117-0x00007FF76AE80000-0x00007FF76B276000-memory.dmp

Download

memory/4108-91-0x00007FF721B40000-0x00007FF721F36000-memory.dmp

Download

memory/4108-5000-0x00007FF721B40000-0x00007FF721F36000-memory.dmp

Download

memory/4308-48-0x00007FF6EC580000-0x00007FF6EC976000-memory.dmp

Download

memory/4396-4818-0x00007FF742BE0000-0x00007FF742FD6000-memory.dmp

Download

memory/4396-69-0x00007FF742BE0000-0x00007FF742FD6000-memory.dmp

Download

memory/4476-610-0x00007FF6C0990000-0x00007FF6C0D86000-memory.dmp

Download

memory/4656-105-0x00007FF75A0B0000-0x00007FF75A4A6000-memory.dmp

Download

memory/4844-57-0x00007FF67EC80000-0x00007FF67F076000-memory.dmp

Download

memory/4856-586-0x00007FF608CF0000-0x00007FF6090E6000-memory.dmp

Download

memory/5016-98-0x00007FF6D92C0000-0x00007FF6D96B6000-memory.dmp

Download

memory/5016-5002-0x00007FF6D92C0000-0x00007FF6D96B6000-memory.dmp

Download