xmrig | 5f8885713eb3f536bb2015e0431b9a44ace55da8ea02aacc0099c393fd15a602

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
Size 1.5MB
Sample240614-l2b4qszarr
SHA256 5f8885713eb3f536bb2015e0431b9a44ace55da8ea02aacc0099c393fd15a602
MD5 b68d1eaae210c3f95a53b025d0fe16f0
SHA1 ec2fb5538117b96d5fd27fd4e23691e310adf94d
SHA512 6ca026d714c1ac0b340663b6a56007b3cf58e31a4ad306eb860cc8e10ba9c3693ca3662fb4b2d10721321e32448407cbedcf1643e9803a19bea9514583996848
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRK:Lz071uv4BPMkHC0IlnASEx/RiN9RK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 47 IoCs

miner

resource	yara_rule
behavioral2/memory/3416-269-0x00007FF70CDF0000-0x00007FF70D1E2000-memory.dmp	xmrig
behavioral2/memory/5088-296-0x00007FF63ED80000-0x00007FF63F172000-memory.dmp	xmrig
behavioral2/memory/3152-306-0x00007FF61D200000-0x00007FF61D5F2000-memory.dmp	xmrig
behavioral2/memory/4532-315-0x00007FF7A7E00000-0x00007FF7A81F2000-memory.dmp	xmrig
behavioral2/memory/3948-314-0x00007FF6A6E20000-0x00007FF6A7212000-memory.dmp	xmrig
behavioral2/memory/4072-313-0x00007FF6FF760000-0x00007FF6FFB52000-memory.dmp	xmrig
behavioral2/memory/2928-312-0x00007FF6CD2C0000-0x00007FF6CD6B2000-memory.dmp	xmrig
behavioral2/memory/916-311-0x00007FF7990D0000-0x00007FF7994C2000-memory.dmp	xmrig
behavioral2/memory/3140-310-0x00007FF6F3A00000-0x00007FF6F3DF2000-memory.dmp	xmrig
behavioral2/memory/4620-309-0x00007FF7BF3B0000-0x00007FF7BF7A2000-memory.dmp	xmrig
behavioral2/memory/1748-308-0x00007FF7D1930000-0x00007FF7D1D22000-memory.dmp	xmrig
behavioral2/memory/2600-307-0x00007FF63E880000-0x00007FF63EC72000-memory.dmp	xmrig
behavioral2/memory/3412-305-0x00007FF7ECE90000-0x00007FF7ED282000-memory.dmp	xmrig
behavioral2/memory/1644-304-0x00007FF7D6F50000-0x00007FF7D7342000-memory.dmp	xmrig
behavioral2/memory/864-303-0x00007FF7F7A10000-0x00007FF7F7E02000-memory.dmp	xmrig
behavioral2/memory/708-302-0x00007FF71F7D0000-0x00007FF71FBC2000-memory.dmp	xmrig
behavioral2/memory/2160-301-0x00007FF7A6D60000-0x00007FF7A7152000-memory.dmp	xmrig
behavioral2/memory/4756-300-0x00007FF77C230000-0x00007FF77C622000-memory.dmp	xmrig
behavioral2/memory/4376-299-0x00007FF6FC950000-0x00007FF6FCD42000-memory.dmp	xmrig
behavioral2/memory/5044-298-0x00007FF738570000-0x00007FF738962000-memory.dmp	xmrig
behavioral2/memory/1312-297-0x00007FF6588A0000-0x00007FF658C92000-memory.dmp	xmrig
behavioral2/memory/3156-150-0x00007FF6FCE20000-0x00007FF6FD212000-memory.dmp	xmrig
behavioral2/memory/2336-127-0x00007FF731200000-0x00007FF7315F2000-memory.dmp	xmrig
behavioral2/memory/4812-2987-0x00007FF6AC340000-0x00007FF6AC732000-memory.dmp	xmrig
behavioral2/memory/2336-3030-0x00007FF731200000-0x00007FF7315F2000-memory.dmp	xmrig
behavioral2/memory/2160-3040-0x00007FF7A6D60000-0x00007FF7A7152000-memory.dmp	xmrig
behavioral2/memory/4756-3044-0x00007FF77C230000-0x00007FF77C622000-memory.dmp	xmrig
behavioral2/memory/4532-3042-0x00007FF7A7E00000-0x00007FF7A81F2000-memory.dmp	xmrig
behavioral2/memory/1312-3038-0x00007FF6588A0000-0x00007FF658C92000-memory.dmp	xmrig
behavioral2/memory/5088-3036-0x00007FF63ED80000-0x00007FF63F172000-memory.dmp	xmrig
behavioral2/memory/3416-3034-0x00007FF70CDF0000-0x00007FF70D1E2000-memory.dmp	xmrig
behavioral2/memory/3156-3033-0x00007FF6FCE20000-0x00007FF6FD212000-memory.dmp	xmrig
behavioral2/memory/3948-3020-0x00007FF6A6E20000-0x00007FF6A7212000-memory.dmp	xmrig
behavioral2/memory/4620-3085-0x00007FF7BF3B0000-0x00007FF7BF7A2000-memory.dmp	xmrig
behavioral2/memory/916-3081-0x00007FF7990D0000-0x00007FF7994C2000-memory.dmp	xmrig
behavioral2/memory/1748-3087-0x00007FF7D1930000-0x00007FF7D1D22000-memory.dmp	xmrig
behavioral2/memory/864-3079-0x00007FF7F7A10000-0x00007FF7F7E02000-memory.dmp	xmrig
behavioral2/memory/3152-3069-0x00007FF61D200000-0x00007FF61D5F2000-memory.dmp	xmrig
behavioral2/memory/2600-3068-0x00007FF63E880000-0x00007FF63EC72000-memory.dmp	xmrig
behavioral2/memory/1644-3064-0x00007FF7D6F50000-0x00007FF7D7342000-memory.dmp	xmrig
behavioral2/memory/3140-3083-0x00007FF6F3A00000-0x00007FF6F3DF2000-memory.dmp	xmrig
behavioral2/memory/3412-3063-0x00007FF7ECE90000-0x00007FF7ED282000-memory.dmp	xmrig
behavioral2/memory/2928-3062-0x00007FF6CD2C0000-0x00007FF6CD6B2000-memory.dmp	xmrig
behavioral2/memory/4072-3052-0x00007FF6FF760000-0x00007FF6FFB52000-memory.dmp	xmrig
behavioral2/memory/708-3051-0x00007FF71F7D0000-0x00007FF71FBC2000-memory.dmp	xmrig
behavioral2/memory/4376-3050-0x00007FF6FC950000-0x00007FF6FCD42000-memory.dmp	xmrig
behavioral2/memory/5044-3049-0x00007FF738570000-0x00007FF738962000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4940	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4812	tBtakAs.exe
3948	MAmsUAg.exe
2336	xPajFNc.exe
3156	NsyFkcj.exe
4532	xNvxBnr.exe
3416	derLtZX.exe
5088	XvbZyOF.exe
1312	WhekzrO.exe
5044	OkaWlpc.exe
4376	Fftetpb.exe
4756	xbkyuVm.exe
2160	IjqTRmQ.exe
708	KoZzWGC.exe
864	mdpiEjs.exe
1644	NpDXEmh.exe
3412	CIhOjFt.exe
3152	ZWvAUTj.exe
2600	FlULcGY.exe
1748	WDciFlE.exe
4620	WTnYtqK.exe
3140	qjBvCfR.exe
916	DlOfalP.exe
2928	unEVwZu.exe
4072	EFamtQP.exe
4624	SJtKEWf.exe
3552	WeQBOrC.exe
1960	YNPVpkA.exe
3336	maPHctu.exe
2324	jpWqvMQ.exe
2264	tBXJqFI.exe
3360	IFzKJJd.exe
3788	DmCDXlU.exe
3968	ZkHnApY.exe
1964	GxtvbOJ.exe
3092	SAuoOlu.exe
1468	UnnwKDB.exe
2896	ItorTAe.exe
4776	qhWNqnv.exe
4856	kyyXTUM.exe
2764	oNwryAJ.exe
4020	YqfoEGV.exe
3992	SllbYIW.exe
1508	DplVQfJ.exe
1108	MEpYrNC.exe
3228	kmmzSbf.exe
4808	CCTbzSv.exe
4988	qJTnawX.exe
3464	fFgfdVD.exe
1264	uUqPbvP.exe
1348	tSKoDqS.exe
3036	rGbHYFh.exe
2060	kSQxFRd.exe
2572	ncYfLFB.exe
4696	ZNVCeCQ.exe
4124	JsRqiun.exe
3548	afLiXGj.exe
4712	phFGtTc.exe
4556	PDrpPPH.exe
2052	GMNRciz.exe
2072	bsxplUU.exe
528	MYREfdH.exe
3168	hplXZFy.exe
1884	IOkJgMS.exe
948	ysbGMfC.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/380-0-0x00007FF6ECC80000-0x00007FF6ED072000-memory.dmp	upx
behavioral2/files/0x0007000000023469-7.dat	upx
behavioral2/files/0x000700000002346d-58.dat	upx
behavioral2/files/0x0007000000023477-91.dat	upx
behavioral2/files/0x0007000000023482-136.dat	upx
behavioral2/files/0x0007000000023476-153.dat	upx
behavioral2/files/0x000700000002348e-211.dat	upx
behavioral2/memory/3416-269-0x00007FF70CDF0000-0x00007FF70D1E2000-memory.dmp	upx
behavioral2/memory/5088-296-0x00007FF63ED80000-0x00007FF63F172000-memory.dmp	upx
behavioral2/memory/3152-306-0x00007FF61D200000-0x00007FF61D5F2000-memory.dmp	upx
behavioral2/memory/4532-315-0x00007FF7A7E00000-0x00007FF7A81F2000-memory.dmp	upx
behavioral2/memory/3948-314-0x00007FF6A6E20000-0x00007FF6A7212000-memory.dmp	upx
behavioral2/memory/4072-313-0x00007FF6FF760000-0x00007FF6FFB52000-memory.dmp	upx
behavioral2/memory/2928-312-0x00007FF6CD2C0000-0x00007FF6CD6B2000-memory.dmp	upx
behavioral2/memory/916-311-0x00007FF7990D0000-0x00007FF7994C2000-memory.dmp	upx
behavioral2/memory/3140-310-0x00007FF6F3A00000-0x00007FF6F3DF2000-memory.dmp	upx
behavioral2/memory/4620-309-0x00007FF7BF3B0000-0x00007FF7BF7A2000-memory.dmp	upx
behavioral2/memory/1748-308-0x00007FF7D1930000-0x00007FF7D1D22000-memory.dmp	upx
behavioral2/memory/2600-307-0x00007FF63E880000-0x00007FF63EC72000-memory.dmp	upx
behavioral2/memory/3412-305-0x00007FF7ECE90000-0x00007FF7ED282000-memory.dmp	upx
behavioral2/memory/1644-304-0x00007FF7D6F50000-0x00007FF7D7342000-memory.dmp	upx
behavioral2/memory/864-303-0x00007FF7F7A10000-0x00007FF7F7E02000-memory.dmp	upx
behavioral2/memory/708-302-0x00007FF71F7D0000-0x00007FF71FBC2000-memory.dmp	upx
behavioral2/memory/2160-301-0x00007FF7A6D60000-0x00007FF7A7152000-memory.dmp	upx
behavioral2/memory/4756-300-0x00007FF77C230000-0x00007FF77C622000-memory.dmp	upx
behavioral2/memory/4376-299-0x00007FF6FC950000-0x00007FF6FCD42000-memory.dmp	upx
behavioral2/memory/5044-298-0x00007FF738570000-0x00007FF738962000-memory.dmp	upx
behavioral2/memory/1312-297-0x00007FF6588A0000-0x00007FF658C92000-memory.dmp	upx
behavioral2/files/0x0008000000023466-210.dat	upx
behavioral2/files/0x000700000002348d-207.dat	upx
behavioral2/files/0x000700000002347c-203.dat	upx
behavioral2/files/0x0007000000023475-192.dat	upx
behavioral2/files/0x000700000002347a-186.dat	upx
behavioral2/files/0x0007000000023479-180.dat	upx
behavioral2/memory/3156-150-0x00007FF6FCE20000-0x00007FF6FD212000-memory.dmp	upx
behavioral2/files/0x000700000002348c-209.dat	upx
behavioral2/files/0x000700000002348b-149.dat	upx
behavioral2/files/0x000700000002348a-148.dat	upx
behavioral2/files/0x0007000000023489-147.dat	upx
behavioral2/files/0x0007000000023488-146.dat	upx
behavioral2/files/0x000700000002347d-144.dat	upx
behavioral2/files/0x0007000000023487-143.dat	upx
behavioral2/files/0x0007000000023486-142.dat	upx
behavioral2/files/0x0007000000023470-140.dat	upx
behavioral2/files/0x0007000000023485-139.dat	upx
behavioral2/files/0x000700000002347b-199.dat	upx
behavioral2/files/0x0007000000023483-137.dat	upx
behavioral2/files/0x0007000000023478-176.dat	upx
behavioral2/files/0x0007000000023481-135.dat	upx
behavioral2/files/0x0007000000023480-134.dat	upx
behavioral2/files/0x000700000002347f-133.dat	upx
behavioral2/memory/2336-127-0x00007FF731200000-0x00007FF7315F2000-memory.dmp	upx
behavioral2/files/0x0007000000023471-126.dat	upx
behavioral2/files/0x000700000002347e-118.dat	upx
behavioral2/files/0x0007000000023484-138.dat	upx
behavioral2/files/0x0007000000023474-74.dat	upx
behavioral2/files/0x0007000000023473-68.dat	upx
behavioral2/files/0x000700000002346f-62.dat	upx
behavioral2/files/0x000700000002346e-60.dat	upx
behavioral2/files/0x000700000002346c-79.dat	upx
behavioral2/files/0x0007000000023472-50.dat	upx
behavioral2/files/0x0008000000023468-49.dat	upx
behavioral2/files/0x000700000002346a-39.dat	upx
behavioral2/memory/4812-19-0x00007FF6AC340000-0x00007FF6AC732000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tYLPVFF.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\KGbiJEi.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\wSlydlG.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\qYGSXFT.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\RUvngVy.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\RvoFAEg.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\pZPBByX.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\MYREfdH.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\pSctEru.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\hplXZFy.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\yxbDNkD.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\wEANbSx.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\UtTResP.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\VcBoTeq.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\LfFjaye.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\CUEVeIR.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\uUqPbvP.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\zJCZPds.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\sSBLgQt.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\myEEeUn.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\keaySLv.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\FBuVXIN.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\NqFvuXB.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\ovUFSkB.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\FxkYVoa.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\NmmnnWS.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\KCkBkJi.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\fGacFqB.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\rPQcrqQ.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\FxjyVUn.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\JZhfCKi.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\lcwwAZE.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\WifEChB.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\xPaKooI.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\gVXibBm.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\wTbUiPg.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\LDJzgnC.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\VyjsDyP.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\MNsqkts.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\JHiJphP.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\HFlLPRe.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\obKGxxd.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\dPzckDk.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\pWVVpRz.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\FRQxxwT.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\XpJzOXL.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\NQZcfME.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\AdbQUSl.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\yKMSZVN.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\UnrrYVj.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\ijuCGrO.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\LovyVBX.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\GloicNK.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\UFookJE.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\zXBQHrv.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\SBBuIrs.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\HuzZNyK.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\MePnUdq.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\QWLhReA.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\phYIdCN.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\eydyRfQ.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\NYZpBcH.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\DYdwxyk.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
File created	C:\Windows\System\eYnjoqZ.exe	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4940	powershell.exe
4940	powershell.exe
4940	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4940	powershell.exe
Token: SeLockMemoryPrivilege	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 4940	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	83
PID 380 wrote to memory of 4940	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	83
PID 380 wrote to memory of 4812	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	85
PID 380 wrote to memory of 4812	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	85
PID 380 wrote to memory of 4532	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	86
PID 380 wrote to memory of 4532	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	86
PID 380 wrote to memory of 3948	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	87
PID 380 wrote to memory of 3948	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	87
PID 380 wrote to memory of 2336	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	88
PID 380 wrote to memory of 2336	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	88
PID 380 wrote to memory of 3156	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	89
PID 380 wrote to memory of 3156	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	89
PID 380 wrote to memory of 5044	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	90
PID 380 wrote to memory of 5044	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	90
PID 380 wrote to memory of 3416	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	91
PID 380 wrote to memory of 3416	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	91
PID 380 wrote to memory of 5088	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	92
PID 380 wrote to memory of 5088	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	92
PID 380 wrote to memory of 1312	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	93
PID 380 wrote to memory of 1312	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	93
PID 380 wrote to memory of 4376	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	94
PID 380 wrote to memory of 4376	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	94
PID 380 wrote to memory of 708	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	95
PID 380 wrote to memory of 708	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	95
PID 380 wrote to memory of 4756	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	96
PID 380 wrote to memory of 4756	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	96
PID 380 wrote to memory of 2160	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	97
PID 380 wrote to memory of 2160	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	97
PID 380 wrote to memory of 864	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	98
PID 380 wrote to memory of 864	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	98
PID 380 wrote to memory of 4620	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	99
PID 380 wrote to memory of 4620	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	99
PID 380 wrote to memory of 1644	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	100
PID 380 wrote to memory of 1644	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	100
PID 380 wrote to memory of 3412	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	101
PID 380 wrote to memory of 3412	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	101
PID 380 wrote to memory of 3152	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	102
PID 380 wrote to memory of 3152	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	102
PID 380 wrote to memory of 2600	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	103
PID 380 wrote to memory of 2600	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	103
PID 380 wrote to memory of 1748	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	104
PID 380 wrote to memory of 1748	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	104
PID 380 wrote to memory of 3140	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	105
PID 380 wrote to memory of 3140	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	105
PID 380 wrote to memory of 916	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	106
PID 380 wrote to memory of 916	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	106
PID 380 wrote to memory of 2928	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	107
PID 380 wrote to memory of 2928	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	107
PID 380 wrote to memory of 4072	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	108
PID 380 wrote to memory of 4072	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	108
PID 380 wrote to memory of 4624	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	109
PID 380 wrote to memory of 4624	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	109
PID 380 wrote to memory of 3552	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	110
PID 380 wrote to memory of 3552	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	110
PID 380 wrote to memory of 1960	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	111
PID 380 wrote to memory of 1960	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	111
PID 380 wrote to memory of 3336	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	112
PID 380 wrote to memory of 3336	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	112
PID 380 wrote to memory of 2324	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	113
PID 380 wrote to memory of 2324	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	113
PID 380 wrote to memory of 2264	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	114
PID 380 wrote to memory of 2264	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	114
PID 380 wrote to memory of 3360	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	115
PID 380 wrote to memory of 3360	380	b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b68d1eaae210c3f95a53b025d0fe16f0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\System\tBtakAs.exe
  C:\Windows\System\tBtakAs.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\xNvxBnr.exe
  C:\Windows\System\xNvxBnr.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\MAmsUAg.exe
  C:\Windows\System\MAmsUAg.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\xPajFNc.exe
  C:\Windows\System\xPajFNc.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\NsyFkcj.exe
  C:\Windows\System\NsyFkcj.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\OkaWlpc.exe
  C:\Windows\System\OkaWlpc.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\derLtZX.exe
  C:\Windows\System\derLtZX.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\XvbZyOF.exe
  C:\Windows\System\XvbZyOF.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\WhekzrO.exe
  C:\Windows\System\WhekzrO.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\Fftetpb.exe
  C:\Windows\System\Fftetpb.exe
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Windows\System\KoZzWGC.exe
  C:\Windows\System\KoZzWGC.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\xbkyuVm.exe
  C:\Windows\System\xbkyuVm.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\IjqTRmQ.exe
  C:\Windows\System\IjqTRmQ.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\mdpiEjs.exe
  C:\Windows\System\mdpiEjs.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\WTnYtqK.exe
  C:\Windows\System\WTnYtqK.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\NpDXEmh.exe
  C:\Windows\System\NpDXEmh.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\CIhOjFt.exe
  C:\Windows\System\CIhOjFt.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\ZWvAUTj.exe
  C:\Windows\System\ZWvAUTj.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\FlULcGY.exe
  C:\Windows\System\FlULcGY.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\WDciFlE.exe
  C:\Windows\System\WDciFlE.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\qjBvCfR.exe
  C:\Windows\System\qjBvCfR.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\DlOfalP.exe
  C:\Windows\System\DlOfalP.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\unEVwZu.exe
  C:\Windows\System\unEVwZu.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\EFamtQP.exe
  C:\Windows\System\EFamtQP.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\SJtKEWf.exe
  C:\Windows\System\SJtKEWf.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\WeQBOrC.exe
  C:\Windows\System\WeQBOrC.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\YNPVpkA.exe
  C:\Windows\System\YNPVpkA.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\maPHctu.exe
  C:\Windows\System\maPHctu.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\jpWqvMQ.exe
  C:\Windows\System\jpWqvMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\tBXJqFI.exe
  C:\Windows\System\tBXJqFI.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\IFzKJJd.exe
  C:\Windows\System\IFzKJJd.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\DmCDXlU.exe
  C:\Windows\System\DmCDXlU.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\ZkHnApY.exe
  C:\Windows\System\ZkHnApY.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\GxtvbOJ.exe
  C:\Windows\System\GxtvbOJ.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\SAuoOlu.exe
  C:\Windows\System\SAuoOlu.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\UnnwKDB.exe
  C:\Windows\System\UnnwKDB.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\ItorTAe.exe
  C:\Windows\System\ItorTAe.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\kyyXTUM.exe
  C:\Windows\System\kyyXTUM.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\qhWNqnv.exe
  C:\Windows\System\qhWNqnv.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\oNwryAJ.exe
  C:\Windows\System\oNwryAJ.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\YqfoEGV.exe
  C:\Windows\System\YqfoEGV.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\SllbYIW.exe
  C:\Windows\System\SllbYIW.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\DplVQfJ.exe
  C:\Windows\System\DplVQfJ.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\MEpYrNC.exe
  C:\Windows\System\MEpYrNC.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\kmmzSbf.exe
  C:\Windows\System\kmmzSbf.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\CCTbzSv.exe
  C:\Windows\System\CCTbzSv.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\qJTnawX.exe
  C:\Windows\System\qJTnawX.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\fFgfdVD.exe
  C:\Windows\System\fFgfdVD.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\uUqPbvP.exe
  C:\Windows\System\uUqPbvP.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\tSKoDqS.exe
  C:\Windows\System\tSKoDqS.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\rGbHYFh.exe
  C:\Windows\System\rGbHYFh.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\MYREfdH.exe
  C:\Windows\System\MYREfdH.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\kSQxFRd.exe
  C:\Windows\System\kSQxFRd.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\ncYfLFB.exe
  C:\Windows\System\ncYfLFB.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\ZNVCeCQ.exe
  C:\Windows\System\ZNVCeCQ.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\JsRqiun.exe
  C:\Windows\System\JsRqiun.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\afLiXGj.exe
  C:\Windows\System\afLiXGj.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\phFGtTc.exe
  C:\Windows\System\phFGtTc.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\PDrpPPH.exe
  C:\Windows\System\PDrpPPH.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\GMNRciz.exe
  C:\Windows\System\GMNRciz.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\fwgpFOg.exe
  C:\Windows\System\fwgpFOg.exe
  2⤵
  PID:2568
- C:\Windows\System\rtRsQOV.exe
  C:\Windows\System\rtRsQOV.exe
  2⤵
  PID:2584
- C:\Windows\System\bsxplUU.exe
  C:\Windows\System\bsxplUU.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\hplXZFy.exe
  C:\Windows\System\hplXZFy.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\IOkJgMS.exe
  C:\Windows\System\IOkJgMS.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\ysbGMfC.exe
  C:\Windows\System\ysbGMfC.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\QlXjDyw.exe
  C:\Windows\System\QlXjDyw.exe
  2⤵
  PID:400
- C:\Windows\System\owCvEMX.exe
  C:\Windows\System\owCvEMX.exe
  2⤵
  PID:4600
- C:\Windows\System\CDtiUKw.exe
  C:\Windows\System\CDtiUKw.exe
  2⤵
  PID:1660
- C:\Windows\System\QWLhReA.exe
  C:\Windows\System\QWLhReA.exe
  2⤵
  PID:1624
- C:\Windows\System\DQBUjiG.exe
  C:\Windows\System\DQBUjiG.exe
  2⤵
  PID:4820
- C:\Windows\System\cIIUQKZ.exe
  C:\Windows\System\cIIUQKZ.exe
  2⤵
  PID:3628
- C:\Windows\System\WWEtSEb.exe
  C:\Windows\System\WWEtSEb.exe
  2⤵
  PID:2240
- C:\Windows\System\ASjPACA.exe
  C:\Windows\System\ASjPACA.exe
  2⤵
  PID:2660
- C:\Windows\System\ovtAouH.exe
  C:\Windows\System\ovtAouH.exe
  2⤵
  PID:2284
- C:\Windows\System\gpfdQGn.exe
  C:\Windows\System\gpfdQGn.exe
  2⤵
  PID:4652
- C:\Windows\System\ivzBbiu.exe
  C:\Windows\System\ivzBbiu.exe
  2⤵
  PID:3700
- C:\Windows\System\ZykuafP.exe
  C:\Windows\System\ZykuafP.exe
  2⤵
  PID:3316
- C:\Windows\System\XHfRROC.exe
  C:\Windows\System\XHfRROC.exe
  2⤵
  PID:3112
- C:\Windows\System\iKcmjLQ.exe
  C:\Windows\System\iKcmjLQ.exe
  2⤵
  PID:4372
- C:\Windows\System\tYLPVFF.exe
  C:\Windows\System\tYLPVFF.exe
  2⤵
  PID:1996
- C:\Windows\System\LcAYbTa.exe
  C:\Windows\System\LcAYbTa.exe
  2⤵
  PID:4240
- C:\Windows\System\nbYKVRH.exe
  C:\Windows\System\nbYKVRH.exe
  2⤵
  PID:1764
- C:\Windows\System\mxSOgZK.exe
  C:\Windows\System\mxSOgZK.exe
  2⤵
  PID:5136
- C:\Windows\System\oQJKxQi.exe
  C:\Windows\System\oQJKxQi.exe
  2⤵
  PID:5156
- C:\Windows\System\AaufbWt.exe
  C:\Windows\System\AaufbWt.exe
  2⤵
  PID:5436
- C:\Windows\System\ohWNBjk.exe
  C:\Windows\System\ohWNBjk.exe
  2⤵
  PID:5488
- C:\Windows\System\PJoIvMf.exe
  C:\Windows\System\PJoIvMf.exe
  2⤵
  PID:5508
- C:\Windows\System\KGbiJEi.exe
  C:\Windows\System\KGbiJEi.exe
  2⤵
  PID:5524
- C:\Windows\System\IaqjCUc.exe
  C:\Windows\System\IaqjCUc.exe
  2⤵
  PID:5568
- C:\Windows\System\IIVxEVO.exe
  C:\Windows\System\IIVxEVO.exe
  2⤵
  PID:5584
- C:\Windows\System\CxWKsCV.exe
  C:\Windows\System\CxWKsCV.exe
  2⤵
  PID:5604
- C:\Windows\System\iQATlge.exe
  C:\Windows\System\iQATlge.exe
  2⤵
  PID:5624
- C:\Windows\System\LyjYypa.exe
  C:\Windows\System\LyjYypa.exe
  2⤵
  PID:5640
- C:\Windows\System\IANdeUv.exe
  C:\Windows\System\IANdeUv.exe
  2⤵
  PID:5656
- C:\Windows\System\ymPjVUC.exe
  C:\Windows\System\ymPjVUC.exe
  2⤵
  PID:5672
- C:\Windows\System\hJmIJmQ.exe
  C:\Windows\System\hJmIJmQ.exe
  2⤵
  PID:5692
- C:\Windows\System\khKwUUC.exe
  C:\Windows\System\khKwUUC.exe
  2⤵
  PID:5712
- C:\Windows\System\uNpXzRV.exe
  C:\Windows\System\uNpXzRV.exe
  2⤵
  PID:5732
- C:\Windows\System\qAYjrzx.exe
  C:\Windows\System\qAYjrzx.exe
  2⤵
  PID:5752
- C:\Windows\System\kTeSnut.exe
  C:\Windows\System\kTeSnut.exe
  2⤵
  PID:5768
- C:\Windows\System\uEnocOS.exe
  C:\Windows\System\uEnocOS.exe
  2⤵
  PID:5784
- C:\Windows\System\tpGugvO.exe
  C:\Windows\System\tpGugvO.exe
  2⤵
  PID:5808
- C:\Windows\System\nLDVGyj.exe
  C:\Windows\System\nLDVGyj.exe
  2⤵
  PID:5824
- C:\Windows\System\fVUkCpe.exe
  C:\Windows\System\fVUkCpe.exe
  2⤵
  PID:5840
- C:\Windows\System\EbDuzUr.exe
  C:\Windows\System\EbDuzUr.exe
  2⤵
  PID:5860
- C:\Windows\System\fHIbKSI.exe
  C:\Windows\System\fHIbKSI.exe
  2⤵
  PID:5880
- C:\Windows\System\yQbTgBf.exe
  C:\Windows\System\yQbTgBf.exe
  2⤵
  PID:5896
- C:\Windows\System\EbwgrwP.exe
  C:\Windows\System\EbwgrwP.exe
  2⤵
  PID:5916
- C:\Windows\System\qBxurhw.exe
  C:\Windows\System\qBxurhw.exe
  2⤵
  PID:5936
- C:\Windows\System\vyPhKNx.exe
  C:\Windows\System\vyPhKNx.exe
  2⤵
  PID:5964
- C:\Windows\System\XlpTlNe.exe
  C:\Windows\System\XlpTlNe.exe
  2⤵
  PID:6004
- C:\Windows\System\cHxuSPZ.exe
  C:\Windows\System\cHxuSPZ.exe
  2⤵
  PID:6020
- C:\Windows\System\gxusgMs.exe
  C:\Windows\System\gxusgMs.exe
  2⤵
  PID:6044
- C:\Windows\System\XRdKraS.exe
  C:\Windows\System\XRdKraS.exe
  2⤵
  PID:6072
- C:\Windows\System\kCMbreb.exe
  C:\Windows\System\kCMbreb.exe
  2⤵
  PID:6088
- C:\Windows\System\hmwuUKf.exe
  C:\Windows\System\hmwuUKf.exe
  2⤵
  PID:6108
- C:\Windows\System\BZZaOjV.exe
  C:\Windows\System\BZZaOjV.exe
  2⤵
  PID:6128
- C:\Windows\System\ZZWqiPy.exe
  C:\Windows\System\ZZWqiPy.exe
  2⤵
  PID:3532
- C:\Windows\System\lptjCMG.exe
  C:\Windows\System\lptjCMG.exe
  2⤵
  PID:2280
- C:\Windows\System\YyYeQbm.exe
  C:\Windows\System\YyYeQbm.exe
  2⤵
  PID:2964
- C:\Windows\System\ekuQpoS.exe
  C:\Windows\System\ekuQpoS.exe
  2⤵
  PID:1128
- C:\Windows\System\iZpfavq.exe
  C:\Windows\System\iZpfavq.exe
  2⤵
  PID:2588
- C:\Windows\System\QJfgXOK.exe
  C:\Windows\System\QJfgXOK.exe
  2⤵
  PID:3736
- C:\Windows\System\YlLJqzx.exe
  C:\Windows\System\YlLJqzx.exe
  2⤵
  PID:3060
- C:\Windows\System\cAHTgaK.exe
  C:\Windows\System\cAHTgaK.exe
  2⤵
  PID:4056
- C:\Windows\System\rTYaPYE.exe
  C:\Windows\System\rTYaPYE.exe
  2⤵
  PID:2640
- C:\Windows\System\GjKwDEV.exe
  C:\Windows\System\GjKwDEV.exe
  2⤵
  PID:628
- C:\Windows\System\PaHQnLc.exe
  C:\Windows\System\PaHQnLc.exe
  2⤵
  PID:4352
- C:\Windows\System\SIqKrzG.exe
  C:\Windows\System\SIqKrzG.exe
  2⤵
  PID:1664
- C:\Windows\System\hEMxCLV.exe
  C:\Windows\System\hEMxCLV.exe
  2⤵
  PID:4612
- C:\Windows\System\rdMsmkk.exe
  C:\Windows\System\rdMsmkk.exe
  2⤵
  PID:1640
- C:\Windows\System\pATmcYz.exe
  C:\Windows\System\pATmcYz.exe
  2⤵
  PID:1600
- C:\Windows\System\rsWMwIs.exe
  C:\Windows\System\rsWMwIs.exe
  2⤵
  PID:2292
- C:\Windows\System\kuklNGV.exe
  C:\Windows\System\kuklNGV.exe
  2⤵
  PID:4308
- C:\Windows\System\ISQmZaq.exe
  C:\Windows\System\ISQmZaq.exe
  2⤵
  PID:1240
- C:\Windows\System\fWPaTjv.exe
  C:\Windows\System\fWPaTjv.exe
  2⤵
  PID:4872
- C:\Windows\System\Ojljzme.exe
  C:\Windows\System\Ojljzme.exe
  2⤵
  PID:1384
- C:\Windows\System\HUXznpi.exe
  C:\Windows\System\HUXznpi.exe
  2⤵
  PID:5152
- C:\Windows\System\csLJohn.exe
  C:\Windows\System\csLJohn.exe
  2⤵
  PID:384
- C:\Windows\System\mhWaFVN.exe
  C:\Windows\System\mhWaFVN.exe
  2⤵
  PID:3880
- C:\Windows\System\fvMqKaE.exe
  C:\Windows\System\fvMqKaE.exe
  2⤵
  PID:4700
- C:\Windows\System\HDDpWEi.exe
  C:\Windows\System\HDDpWEi.exe
  2⤵
  PID:5116
- C:\Windows\System\GsUPCTc.exe
  C:\Windows\System\GsUPCTc.exe
  2⤵
  PID:4896
- C:\Windows\System\DrCMBKA.exe
  C:\Windows\System\DrCMBKA.exe
  2⤵
  PID:1404
- C:\Windows\System\knJvCPb.exe
  C:\Windows\System\knJvCPb.exe
  2⤵
  PID:5072
- C:\Windows\System\kQQJuse.exe
  C:\Windows\System\kQQJuse.exe
  2⤵
  PID:1696
- C:\Windows\System\GKFHJjr.exe
  C:\Windows\System\GKFHJjr.exe
  2⤵
  PID:2724
- C:\Windows\System\zDgEopM.exe
  C:\Windows\System\zDgEopM.exe
  2⤵
  PID:3200
- C:\Windows\System\aTMIjsX.exe
  C:\Windows\System\aTMIjsX.exe
  2⤵
  PID:4928
- C:\Windows\System\tzmhZyB.exe
  C:\Windows\System\tzmhZyB.exe
  2⤵
  PID:3192
- C:\Windows\System\EXaINvs.exe
  C:\Windows\System\EXaINvs.exe
  2⤵
  PID:3592
- C:\Windows\System\fGuqhLG.exe
  C:\Windows\System\fGuqhLG.exe
  2⤵
  PID:4248
- C:\Windows\System\kzuKKuz.exe
  C:\Windows\System\kzuKKuz.exe
  2⤵
  PID:5320
- C:\Windows\System\WlOIIFy.exe
  C:\Windows\System\WlOIIFy.exe
  2⤵
  PID:5372
- C:\Windows\System\qPLNrFg.exe
  C:\Windows\System\qPLNrFg.exe
  2⤵
  PID:5428
- C:\Windows\System\oBxDwjR.exe
  C:\Windows\System\oBxDwjR.exe
  2⤵
  PID:5412
- C:\Windows\System\CXILJEq.exe
  C:\Windows\System\CXILJEq.exe
  2⤵
  PID:5432
- C:\Windows\System\fjJYNmV.exe
  C:\Windows\System\fjJYNmV.exe
  2⤵
  PID:5480
- C:\Windows\System\ifUSPTS.exe
  C:\Windows\System\ifUSPTS.exe
  2⤵
  PID:5648
- C:\Windows\System\wFDptdI.exe
  C:\Windows\System\wFDptdI.exe
  2⤵
  PID:5728
- C:\Windows\System\UqzLhxR.exe
  C:\Windows\System\UqzLhxR.exe
  2⤵
  PID:5764
- C:\Windows\System\cJjMlwU.exe
  C:\Windows\System\cJjMlwU.exe
  2⤵
  PID:5800
- C:\Windows\System\dMOadMY.exe
  C:\Windows\System\dMOadMY.exe
  2⤵
  PID:5848
- C:\Windows\System\eaIrrIU.exe
  C:\Windows\System\eaIrrIU.exe
  2⤵
  PID:5904
- C:\Windows\System\RuyJUNz.exe
  C:\Windows\System\RuyJUNz.exe
  2⤵
  PID:5944
- C:\Windows\System\lcwwAZE.exe
  C:\Windows\System\lcwwAZE.exe
  2⤵
  PID:5596
- C:\Windows\System\kSomezS.exe
  C:\Windows\System\kSomezS.exe
  2⤵
  PID:3080
- C:\Windows\System\ijuCGrO.exe
  C:\Windows\System\ijuCGrO.exe
  2⤵
  PID:2532
- C:\Windows\System\pqRoOFC.exe
  C:\Windows\System\pqRoOFC.exe
  2⤵
  PID:1684
- C:\Windows\System\SWGIBND.exe
  C:\Windows\System\SWGIBND.exe
  2⤵
  PID:4512
- C:\Windows\System\cgSkHmG.exe
  C:\Windows\System\cgSkHmG.exe
  2⤵
  PID:5536
- C:\Windows\System\NupUjBt.exe
  C:\Windows\System\NupUjBt.exe
  2⤵
  PID:6012
- C:\Windows\System\PIcvWyd.exe
  C:\Windows\System\PIcvWyd.exe
  2⤵
  PID:6156
- C:\Windows\System\spMlZcm.exe
  C:\Windows\System\spMlZcm.exe
  2⤵
  PID:6176
- C:\Windows\System\ieJSEYj.exe
  C:\Windows\System\ieJSEYj.exe
  2⤵
  PID:6196
- C:\Windows\System\iiUWnCy.exe
  C:\Windows\System\iiUWnCy.exe
  2⤵
  PID:6212
- C:\Windows\System\yVMapyH.exe
  C:\Windows\System\yVMapyH.exe
  2⤵
  PID:6232
- C:\Windows\System\AyXQKHI.exe
  C:\Windows\System\AyXQKHI.exe
  2⤵
  PID:6252
- C:\Windows\System\YDnCahS.exe
  C:\Windows\System\YDnCahS.exe
  2⤵
  PID:6272
- C:\Windows\System\QYmZkvR.exe
  C:\Windows\System\QYmZkvR.exe
  2⤵
  PID:6292
- C:\Windows\System\DhTqbRk.exe
  C:\Windows\System\DhTqbRk.exe
  2⤵
  PID:6312
- C:\Windows\System\lcQjVtf.exe
  C:\Windows\System\lcQjVtf.exe
  2⤵
  PID:6332
- C:\Windows\System\YQYfqJF.exe
  C:\Windows\System\YQYfqJF.exe
  2⤵
  PID:6352
- C:\Windows\System\XounWRp.exe
  C:\Windows\System\XounWRp.exe
  2⤵
  PID:6368
- C:\Windows\System\NjmhZhm.exe
  C:\Windows\System\NjmhZhm.exe
  2⤵
  PID:6384
- C:\Windows\System\XpJzOXL.exe
  C:\Windows\System\XpJzOXL.exe
  2⤵
  PID:6408
- C:\Windows\System\OtWwAkI.exe
  C:\Windows\System\OtWwAkI.exe
  2⤵
  PID:6424
- C:\Windows\System\jnOoaMn.exe
  C:\Windows\System\jnOoaMn.exe
  2⤵
  PID:6444
- C:\Windows\System\FDSWhvi.exe
  C:\Windows\System\FDSWhvi.exe
  2⤵
  PID:6464
- C:\Windows\System\eVMHfCS.exe
  C:\Windows\System\eVMHfCS.exe
  2⤵
  PID:6480
- C:\Windows\System\pvmBBvR.exe
  C:\Windows\System\pvmBBvR.exe
  2⤵
  PID:6504
- C:\Windows\System\rGYcgLo.exe
  C:\Windows\System\rGYcgLo.exe
  2⤵
  PID:6520
- C:\Windows\System\jKhtWeU.exe
  C:\Windows\System\jKhtWeU.exe
  2⤵
  PID:6544
- C:\Windows\System\skvhqQv.exe
  C:\Windows\System\skvhqQv.exe
  2⤵
  PID:6564
- C:\Windows\System\KpvZWTF.exe
  C:\Windows\System\KpvZWTF.exe
  2⤵
  PID:6584
- C:\Windows\System\OqpRYeH.exe
  C:\Windows\System\OqpRYeH.exe
  2⤵
  PID:6600
- C:\Windows\System\xCRDUpj.exe
  C:\Windows\System\xCRDUpj.exe
  2⤵
  PID:6620
- C:\Windows\System\uPdqQOH.exe
  C:\Windows\System\uPdqQOH.exe
  2⤵
  PID:6640
- C:\Windows\System\qvzKYlj.exe
  C:\Windows\System\qvzKYlj.exe
  2⤵
  PID:6664
- C:\Windows\System\UHbwzrT.exe
  C:\Windows\System\UHbwzrT.exe
  2⤵
  PID:6680
- C:\Windows\System\ipaiWPi.exe
  C:\Windows\System\ipaiWPi.exe
  2⤵
  PID:6704
- C:\Windows\System\kCURFcu.exe
  C:\Windows\System\kCURFcu.exe
  2⤵
  PID:6720
- C:\Windows\System\wSlydlG.exe
  C:\Windows\System\wSlydlG.exe
  2⤵
  PID:6744
- C:\Windows\System\klQtswh.exe
  C:\Windows\System\klQtswh.exe
  2⤵
  PID:6764
- C:\Windows\System\KseKkdZ.exe
  C:\Windows\System\KseKkdZ.exe
  2⤵
  PID:6784
- C:\Windows\System\ErpbaAw.exe
  C:\Windows\System\ErpbaAw.exe
  2⤵
  PID:6800
- C:\Windows\System\IQLjmSR.exe
  C:\Windows\System\IQLjmSR.exe
  2⤵
  PID:6824
- C:\Windows\System\GKXqoqT.exe
  C:\Windows\System\GKXqoqT.exe
  2⤵
  PID:6840
- C:\Windows\System\DYdwxyk.exe
  C:\Windows\System\DYdwxyk.exe
  2⤵
  PID:6860
- C:\Windows\System\PpQyPnv.exe
  C:\Windows\System\PpQyPnv.exe
  2⤵
  PID:6880
- C:\Windows\System\SMJMNPM.exe
  C:\Windows\System\SMJMNPM.exe
  2⤵
  PID:6904
- C:\Windows\System\RYesXhP.exe
  C:\Windows\System\RYesXhP.exe
  2⤵
  PID:6920
- C:\Windows\System\EvmqJPc.exe
  C:\Windows\System\EvmqJPc.exe
  2⤵
  PID:6948
- C:\Windows\System\HoqCTUm.exe
  C:\Windows\System\HoqCTUm.exe
  2⤵
  PID:6964
- C:\Windows\System\oTHXzqa.exe
  C:\Windows\System\oTHXzqa.exe
  2⤵
  PID:6988
- C:\Windows\System\suXHLAw.exe
  C:\Windows\System\suXHLAw.exe
  2⤵
  PID:7008
- C:\Windows\System\qFCFCnc.exe
  C:\Windows\System\qFCFCnc.exe
  2⤵
  PID:7032
- C:\Windows\System\qYGSXFT.exe
  C:\Windows\System\qYGSXFT.exe
  2⤵
  PID:7048
- C:\Windows\System\dVhgPWG.exe
  C:\Windows\System\dVhgPWG.exe
  2⤵
  PID:7064
- C:\Windows\System\wkuEWGG.exe
  C:\Windows\System\wkuEWGG.exe
  2⤵
  PID:7088
- C:\Windows\System\hUiCtAR.exe
  C:\Windows\System\hUiCtAR.exe
  2⤵
  PID:7108
- C:\Windows\System\rWCYyUl.exe
  C:\Windows\System\rWCYyUl.exe
  2⤵
  PID:7128
- C:\Windows\System\wVYwOdS.exe
  C:\Windows\System\wVYwOdS.exe
  2⤵
  PID:7152
- C:\Windows\System\MwonzOG.exe
  C:\Windows\System\MwonzOG.exe
  2⤵
  PID:6100
- C:\Windows\System\ysTlPSh.exe
  C:\Windows\System\ysTlPSh.exe
  2⤵
  PID:6120
- C:\Windows\System\peMwOSZ.exe
  C:\Windows\System\peMwOSZ.exe
  2⤵
  PID:2192
- C:\Windows\System\BICtKTH.exe
  C:\Windows\System\BICtKTH.exe
  2⤵
  PID:1188
- C:\Windows\System\enJzHGE.exe
  C:\Windows\System\enJzHGE.exe
  2⤵
  PID:2800
- C:\Windows\System\UHGTRac.exe
  C:\Windows\System\UHGTRac.exe
  2⤵
  PID:3164
- C:\Windows\System\VjvOvNq.exe
  C:\Windows\System\VjvOvNq.exe
  2⤵
  PID:4232
- C:\Windows\System\DPVGyUS.exe
  C:\Windows\System\DPVGyUS.exe
  2⤵
  PID:5688
- C:\Windows\System\phYIdCN.exe
  C:\Windows\System\phYIdCN.exe
  2⤵
  PID:4588
- C:\Windows\System\YnhUygO.exe
  C:\Windows\System\YnhUygO.exe
  2⤵
  PID:4844
- C:\Windows\System\uXrbzwD.exe
  C:\Windows\System\uXrbzwD.exe
  2⤵
  PID:5176
- C:\Windows\System\CASRAFB.exe
  C:\Windows\System\CASRAFB.exe
  2⤵
  PID:5612
- C:\Windows\System\gKNPECU.exe
  C:\Windows\System\gKNPECU.exe
  2⤵
  PID:5724
- C:\Windows\System\wzkYDsK.exe
  C:\Windows\System\wzkYDsK.exe
  2⤵
  PID:5872
- C:\Windows\System\ppqpKQq.exe
  C:\Windows\System\ppqpKQq.exe
  2⤵
  PID:5592
- C:\Windows\System\flLfzgY.exe
  C:\Windows\System\flLfzgY.exe
  2⤵
  PID:6036
- C:\Windows\System\txROrau.exe
  C:\Windows\System\txROrau.exe
  2⤵
  PID:3172
- C:\Windows\System\qTeOrPz.exe
  C:\Windows\System\qTeOrPz.exe
  2⤵
  PID:5888
- C:\Windows\System\gZLUFTn.exe
  C:\Windows\System\gZLUFTn.exe
  2⤵
  PID:6084
- C:\Windows\System\gkQyedx.exe
  C:\Windows\System\gkQyedx.exe
  2⤵
  PID:7188
- C:\Windows\System\lUsuXjR.exe
  C:\Windows\System\lUsuXjR.exe
  2⤵
  PID:7204
- C:\Windows\System\chCmKKq.exe
  C:\Windows\System\chCmKKq.exe
  2⤵
  PID:7228
- C:\Windows\System\gTPcqGT.exe
  C:\Windows\System\gTPcqGT.exe
  2⤵
  PID:7244
- C:\Windows\System\gEatLCK.exe
  C:\Windows\System\gEatLCK.exe
  2⤵
  PID:7268
- C:\Windows\System\WmtknIq.exe
  C:\Windows\System\WmtknIq.exe
  2⤵
  PID:7284
- C:\Windows\System\HRtdFqL.exe
  C:\Windows\System\HRtdFqL.exe
  2⤵
  PID:7312
- C:\Windows\System\eydyRfQ.exe
  C:\Windows\System\eydyRfQ.exe
  2⤵
  PID:7720
- C:\Windows\System\EcrIbbx.exe
  C:\Windows\System\EcrIbbx.exe
  2⤵
  PID:7736
- C:\Windows\System\EKYFrcy.exe
  C:\Windows\System\EKYFrcy.exe
  2⤵
  PID:7760
- C:\Windows\System\iNbGROt.exe
  C:\Windows\System\iNbGROt.exe
  2⤵
  PID:7776
- C:\Windows\System\DYWpOVQ.exe
  C:\Windows\System\DYWpOVQ.exe
  2⤵
  PID:7804
- C:\Windows\System\eBmUYJq.exe
  C:\Windows\System\eBmUYJq.exe
  2⤵
  PID:7824
- C:\Windows\System\KBacDws.exe
  C:\Windows\System\KBacDws.exe
  2⤵
  PID:7848
- C:\Windows\System\CBajmVK.exe
  C:\Windows\System\CBajmVK.exe
  2⤵
  PID:7864
- C:\Windows\System\mGCghMz.exe
  C:\Windows\System\mGCghMz.exe
  2⤵
  PID:7888
- C:\Windows\System\JhDfffx.exe
  C:\Windows\System\JhDfffx.exe
  2⤵
  PID:7904
- C:\Windows\System\yqliBvg.exe
  C:\Windows\System\yqliBvg.exe
  2⤵
  PID:7924
- C:\Windows\System\kXZsDSV.exe
  C:\Windows\System\kXZsDSV.exe
  2⤵
  PID:7940
- C:\Windows\System\EUKNdpM.exe
  C:\Windows\System\EUKNdpM.exe
  2⤵
  PID:7964
- C:\Windows\System\mQFBqQS.exe
  C:\Windows\System\mQFBqQS.exe
  2⤵
  PID:7984
- C:\Windows\System\JaVCIBR.exe
  C:\Windows\System\JaVCIBR.exe
  2⤵
  PID:8000
- C:\Windows\System\cRGQdyy.exe
  C:\Windows\System\cRGQdyy.exe
  2⤵
  PID:8024
- C:\Windows\System\QidqEyC.exe
  C:\Windows\System\QidqEyC.exe
  2⤵
  PID:8044
- C:\Windows\System\wrEDNro.exe
  C:\Windows\System\wrEDNro.exe
  2⤵
  PID:8064
- C:\Windows\System\NmmnnWS.exe
  C:\Windows\System\NmmnnWS.exe
  2⤵
  PID:8080
- C:\Windows\System\tUhngKg.exe
  C:\Windows\System\tUhngKg.exe
  2⤵
  PID:8104
- C:\Windows\System\KCkBkJi.exe
  C:\Windows\System\KCkBkJi.exe
  2⤵
  PID:8124
- C:\Windows\System\AeBqhhQ.exe
  C:\Windows\System\AeBqhhQ.exe
  2⤵
  PID:8140
- C:\Windows\System\ogMtEzd.exe
  C:\Windows\System\ogMtEzd.exe
  2⤵
  PID:8160
- C:\Windows\System\ETRIlhH.exe
  C:\Windows\System\ETRIlhH.exe
  2⤵
  PID:8180
- C:\Windows\System\glCONlM.exe
  C:\Windows\System\glCONlM.exe
  2⤵
  PID:5052
- C:\Windows\System\zMieSAo.exe
  C:\Windows\System\zMieSAo.exe
  2⤵
  PID:6208
- C:\Windows\System\xjvDTJb.exe
  C:\Windows\System\xjvDTJb.exe
  2⤵
  PID:1812
- C:\Windows\System\JHiJphP.exe
  C:\Windows\System\JHiJphP.exe
  2⤵
  PID:6360
- C:\Windows\System\VtsUOnG.exe
  C:\Windows\System\VtsUOnG.exe
  2⤵
  PID:3660
- C:\Windows\System\xkjhRlV.exe
  C:\Windows\System\xkjhRlV.exe
  2⤵
  PID:6420
- C:\Windows\System\xqYdfid.exe
  C:\Windows\System\xqYdfid.exe
  2⤵
  PID:6776
- C:\Windows\System\LCFyarx.exe
  C:\Windows\System\LCFyarx.exe
  2⤵
  PID:6888
- C:\Windows\System\AsmGDxR.exe
  C:\Windows\System\AsmGDxR.exe
  2⤵
  PID:6916
- C:\Windows\System\pekRZUb.exe
  C:\Windows\System\pekRZUb.exe
  2⤵
  PID:6976
- C:\Windows\System\utxxtgT.exe
  C:\Windows\System\utxxtgT.exe
  2⤵
  PID:7004
- C:\Windows\System\IExboSg.exe
  C:\Windows\System\IExboSg.exe
  2⤵
  PID:5380
- C:\Windows\System\sAIAKps.exe
  C:\Windows\System\sAIAKps.exe
  2⤵
  PID:5972
- C:\Windows\System\cBPogbQ.exe
  C:\Windows\System\cBPogbQ.exe
  2⤵
  PID:5520
- C:\Windows\System\PoPmvMT.exe
  C:\Windows\System\PoPmvMT.exe
  2⤵
  PID:6148
- C:\Windows\System\jwOuEbO.exe
  C:\Windows\System\jwOuEbO.exe
  2⤵
  PID:7216
- C:\Windows\System\rtseDwz.exe
  C:\Windows\System\rtseDwz.exe
  2⤵
  PID:4016
- C:\Windows\System\gMmddYA.exe
  C:\Windows\System\gMmddYA.exe
  2⤵
  PID:6184
- C:\Windows\System\BWpuYjh.exe
  C:\Windows\System\BWpuYjh.exe
  2⤵
  PID:7224
- C:\Windows\System\LovyVBX.exe
  C:\Windows\System\LovyVBX.exe
  2⤵
  PID:6300
- C:\Windows\System\UWWoDSS.exe
  C:\Windows\System\UWWoDSS.exe
  2⤵
  PID:6396
- C:\Windows\System\HyQUuJY.exe
  C:\Windows\System\HyQUuJY.exe
  2⤵
  PID:6808
- C:\Windows\System\gqUKpTH.exe
  C:\Windows\System\gqUKpTH.exe
  2⤵
  PID:7472
- C:\Windows\System\dqtilky.exe
  C:\Windows\System\dqtilky.exe
  2⤵
  PID:8224
- C:\Windows\System\RyfVKLw.exe
  C:\Windows\System\RyfVKLw.exe
  2⤵
  PID:8252
- C:\Windows\System\kLPqDua.exe
  C:\Windows\System\kLPqDua.exe
  2⤵
  PID:8272
- C:\Windows\System\ikcUIKU.exe
  C:\Windows\System\ikcUIKU.exe
  2⤵
  PID:8296
- C:\Windows\System\JdNBOcx.exe
  C:\Windows\System\JdNBOcx.exe
  2⤵
  PID:8312
- C:\Windows\System\esFxJiR.exe
  C:\Windows\System\esFxJiR.exe
  2⤵
  PID:8336
- C:\Windows\System\aeBvfuT.exe
  C:\Windows\System\aeBvfuT.exe
  2⤵
  PID:8352
- C:\Windows\System\ATvnEQG.exe
  C:\Windows\System\ATvnEQG.exe
  2⤵
  PID:8376
- C:\Windows\System\gTOuEoU.exe
  C:\Windows\System\gTOuEoU.exe
  2⤵
  PID:8396
- C:\Windows\System\yxbDNkD.exe
  C:\Windows\System\yxbDNkD.exe
  2⤵
  PID:8428
- C:\Windows\System\hhFGBfe.exe
  C:\Windows\System\hhFGBfe.exe
  2⤵
  PID:8448
- C:\Windows\System\shgTaju.exe
  C:\Windows\System\shgTaju.exe
  2⤵
  PID:8488
- C:\Windows\System\mhuzfIz.exe
  C:\Windows\System\mhuzfIz.exe
  2⤵
  PID:8512
- C:\Windows\System\wmwqFrO.exe
  C:\Windows\System\wmwqFrO.exe
  2⤵
  PID:8544
- C:\Windows\System\fysTzDI.exe
  C:\Windows\System\fysTzDI.exe
  2⤵
  PID:8564
- C:\Windows\System\ZXxWXuH.exe
  C:\Windows\System\ZXxWXuH.exe
  2⤵
  PID:8596
- C:\Windows\System\iEwTujW.exe
  C:\Windows\System\iEwTujW.exe
  2⤵
  PID:8620
- C:\Windows\System\rqQIZWj.exe
  C:\Windows\System\rqQIZWj.exe
  2⤵
  PID:8648
- C:\Windows\System\mcNsdYu.exe
  C:\Windows\System\mcNsdYu.exe
  2⤵
  PID:8672
- C:\Windows\System\jjpdUwW.exe
  C:\Windows\System\jjpdUwW.exe
  2⤵
  PID:8688
- C:\Windows\System\fzwXyjj.exe
  C:\Windows\System\fzwXyjj.exe
  2⤵
  PID:8704
- C:\Windows\System\bqpYGnB.exe
  C:\Windows\System\bqpYGnB.exe
  2⤵
  PID:8728
- C:\Windows\System\GzgiWLA.exe
  C:\Windows\System\GzgiWLA.exe
  2⤵
  PID:8748
- C:\Windows\System\qcpdIHz.exe
  C:\Windows\System\qcpdIHz.exe
  2⤵
  PID:8772
- C:\Windows\System\AuTyxcS.exe
  C:\Windows\System\AuTyxcS.exe
  2⤵
  PID:8792
- C:\Windows\System\ZqLOpML.exe
  C:\Windows\System\ZqLOpML.exe
  2⤵
  PID:8816
- C:\Windows\System\NoUpTsU.exe
  C:\Windows\System\NoUpTsU.exe
  2⤵
  PID:8832
- C:\Windows\System\YgASZoe.exe
  C:\Windows\System\YgASZoe.exe
  2⤵
  PID:8856
- C:\Windows\System\rzvVfqO.exe
  C:\Windows\System\rzvVfqO.exe
  2⤵
  PID:8880
- C:\Windows\System\WBosNxg.exe
  C:\Windows\System\WBosNxg.exe
  2⤵
  PID:8900
- C:\Windows\System\YoirknG.exe
  C:\Windows\System\YoirknG.exe
  2⤵
  PID:8920
- C:\Windows\System\OaLpcwX.exe
  C:\Windows\System\OaLpcwX.exe
  2⤵
  PID:8936
- C:\Windows\System\QKtcxSb.exe
  C:\Windows\System\QKtcxSb.exe
  2⤵
  PID:8960
- C:\Windows\System\xEBJTRE.exe
  C:\Windows\System\xEBJTRE.exe
  2⤵
  PID:8980
- C:\Windows\System\wEANbSx.exe
  C:\Windows\System\wEANbSx.exe
  2⤵
  PID:9000
- C:\Windows\System\MAyHxgY.exe
  C:\Windows\System\MAyHxgY.exe
  2⤵
  PID:9024
- C:\Windows\System\RkhNWxb.exe
  C:\Windows\System\RkhNWxb.exe
  2⤵
  PID:9040
- C:\Windows\System\DpzYwnK.exe
  C:\Windows\System\DpzYwnK.exe
  2⤵
  PID:9064
- C:\Windows\System\uVzrJsX.exe
  C:\Windows\System\uVzrJsX.exe
  2⤵
  PID:9088
- C:\Windows\System\biekLJJ.exe
  C:\Windows\System\biekLJJ.exe
  2⤵
  PID:9104
- C:\Windows\System\jjbDprf.exe
  C:\Windows\System\jjbDprf.exe
  2⤵
  PID:9128
- C:\Windows\System\jybwyrX.exe
  C:\Windows\System\jybwyrX.exe
  2⤵
  PID:9156
- C:\Windows\System\nNFpqnj.exe
  C:\Windows\System\nNFpqnj.exe
  2⤵
  PID:9176
- C:\Windows\System\jzzpWxA.exe
  C:\Windows\System\jzzpWxA.exe
  2⤵
  PID:9200
- C:\Windows\System\bbjQkjC.exe
  C:\Windows\System\bbjQkjC.exe
  2⤵
  PID:4764
- C:\Windows\System\LOvqcvp.exe
  C:\Windows\System\LOvqcvp.exe
  2⤵
  PID:7568
- C:\Windows\System\pbWSEAl.exe
  C:\Windows\System\pbWSEAl.exe
  2⤵
  PID:3836
- C:\Windows\System\KRXzFil.exe
  C:\Windows\System\KRXzFil.exe
  2⤵
  PID:5504
- C:\Windows\System\NjPqjgk.exe
  C:\Windows\System\NjPqjgk.exe
  2⤵
  PID:6152
- C:\Windows\System\YOgZDwx.exe
  C:\Windows\System\YOgZDwx.exe
  2⤵
  PID:7252
- C:\Windows\System\mIEWGYX.exe
  C:\Windows\System\mIEWGYX.exe
  2⤵
  PID:7280
- C:\Windows\System\eLnQASa.exe
  C:\Windows\System\eLnQASa.exe
  2⤵
  PID:6248
- C:\Windows\System\kcFnxBJ.exe
  C:\Windows\System\kcFnxBJ.exe
  2⤵
  PID:7752
- C:\Windows\System\kmPpPrP.exe
  C:\Windows\System\kmPpPrP.exe
  2⤵
  PID:9220
- C:\Windows\System\PflbTNi.exe
  C:\Windows\System\PflbTNi.exe
  2⤵
  PID:9248
- C:\Windows\System\HrGWxMg.exe
  C:\Windows\System\HrGWxMg.exe
  2⤵
  PID:9264
- C:\Windows\System\ROQBisg.exe
  C:\Windows\System\ROQBisg.exe
  2⤵
  PID:9292
- C:\Windows\System\oejjdSG.exe
  C:\Windows\System\oejjdSG.exe
  2⤵
  PID:9308
- C:\Windows\System\vnoayiR.exe
  C:\Windows\System\vnoayiR.exe
  2⤵
  PID:9328
- C:\Windows\System\KXMjkDc.exe
  C:\Windows\System\KXMjkDc.exe
  2⤵
  PID:9348
- C:\Windows\System\qNhZHZC.exe
  C:\Windows\System\qNhZHZC.exe
  2⤵
  PID:9368
- C:\Windows\System\UFEMKNi.exe
  C:\Windows\System\UFEMKNi.exe
  2⤵
  PID:9388
- C:\Windows\System\fWrpjNS.exe
  C:\Windows\System\fWrpjNS.exe
  2⤵
  PID:9412
- C:\Windows\System\zIKKwdU.exe
  C:\Windows\System\zIKKwdU.exe
  2⤵
  PID:9432
- C:\Windows\System\kqEEEDs.exe
  C:\Windows\System\kqEEEDs.exe
  2⤵
  PID:9448
- C:\Windows\System\lXGdpVX.exe
  C:\Windows\System\lXGdpVX.exe
  2⤵
  PID:9472
- C:\Windows\System\WmysokT.exe
  C:\Windows\System\WmysokT.exe
  2⤵
  PID:9496
- C:\Windows\System\OTWgNaR.exe
  C:\Windows\System\OTWgNaR.exe
  2⤵
  PID:9512
- C:\Windows\System\fWkTsOP.exe
  C:\Windows\System\fWkTsOP.exe
  2⤵
  PID:9532
- C:\Windows\System\zuaeSpn.exe
  C:\Windows\System\zuaeSpn.exe
  2⤵
  PID:9552
- C:\Windows\System\XoeGmhb.exe
  C:\Windows\System\XoeGmhb.exe
  2⤵
  PID:9576
- C:\Windows\System\DtiQIXY.exe
  C:\Windows\System\DtiQIXY.exe
  2⤵
  PID:9596
- C:\Windows\System\gkOUmcn.exe
  C:\Windows\System\gkOUmcn.exe
  2⤵
  PID:9612
- C:\Windows\System\DbCFEHc.exe
  C:\Windows\System\DbCFEHc.exe
  2⤵
  PID:9640
- C:\Windows\System\VxwnhTO.exe
  C:\Windows\System\VxwnhTO.exe
  2⤵
  PID:9664
- C:\Windows\System\VkciCDT.exe
  C:\Windows\System\VkciCDT.exe
  2⤵
  PID:9684
- C:\Windows\System\choYXzo.exe
  C:\Windows\System\choYXzo.exe
  2⤵
  PID:9704
- C:\Windows\System\kNJoSfd.exe
  C:\Windows\System\kNJoSfd.exe
  2⤵
  PID:9720
- C:\Windows\System\nOkyDfy.exe
  C:\Windows\System\nOkyDfy.exe
  2⤵
  PID:9744
- C:\Windows\System\YULUUAX.exe
  C:\Windows\System\YULUUAX.exe
  2⤵
  PID:9764
- C:\Windows\System\gIlcCDh.exe
  C:\Windows\System\gIlcCDh.exe
  2⤵
  PID:9784
- C:\Windows\System\mGKcVZD.exe
  C:\Windows\System\mGKcVZD.exe
  2⤵
  PID:9804
- C:\Windows\System\sinKUne.exe
  C:\Windows\System\sinKUne.exe
  2⤵
  PID:9824
- C:\Windows\System\AGhfpAn.exe
  C:\Windows\System\AGhfpAn.exe
  2⤵
  PID:9848
- C:\Windows\System\JZfIWdw.exe
  C:\Windows\System\JZfIWdw.exe
  2⤵
  PID:9872
- C:\Windows\System\HDULVJR.exe
  C:\Windows\System\HDULVJR.exe
  2⤵
  PID:9892
- C:\Windows\System\AsaeBUr.exe
  C:\Windows\System\AsaeBUr.exe
  2⤵
  PID:9916
- C:\Windows\System\ivODvYh.exe
  C:\Windows\System\ivODvYh.exe
  2⤵
  PID:9936
- C:\Windows\System\DtSJNqy.exe
  C:\Windows\System\DtSJNqy.exe
  2⤵
  PID:9956
- C:\Windows\System\bzwWYzF.exe
  C:\Windows\System\bzwWYzF.exe
  2⤵
  PID:9976
- C:\Windows\System\MkOomHe.exe
  C:\Windows\System\MkOomHe.exe
  2⤵
  PID:9996
- C:\Windows\System\nXXdmIx.exe
  C:\Windows\System\nXXdmIx.exe
  2⤵
  PID:10020
- C:\Windows\System\OItqODH.exe
  C:\Windows\System\OItqODH.exe
  2⤵
  PID:10040
- C:\Windows\System\YlcIGvj.exe
  C:\Windows\System\YlcIGvj.exe
  2⤵
  PID:10060
- C:\Windows\System\MdHPnFD.exe
  C:\Windows\System\MdHPnFD.exe
  2⤵
  PID:10080
- C:\Windows\System\fBzdhyH.exe
  C:\Windows\System\fBzdhyH.exe
  2⤵
  PID:10100
- C:\Windows\System\GloicNK.exe
  C:\Windows\System\GloicNK.exe
  2⤵
  PID:10120
- C:\Windows\System\NXEDFWH.exe
  C:\Windows\System\NXEDFWH.exe
  2⤵
  PID:10144
- C:\Windows\System\YNRHnTd.exe
  C:\Windows\System\YNRHnTd.exe
  2⤵
  PID:10160
- C:\Windows\System\QoaXYSA.exe
  C:\Windows\System\QoaXYSA.exe
  2⤵
  PID:10184
- C:\Windows\System\MEqnrmp.exe
  C:\Windows\System\MEqnrmp.exe
  2⤵
  PID:10204
- C:\Windows\System\EAMoGDe.exe
  C:\Windows\System\EAMoGDe.exe
  2⤵
  PID:10220
- C:\Windows\System\uWvnwKE.exe
  C:\Windows\System\uWvnwKE.exe
  2⤵
  PID:7896
- C:\Windows\System\qICoIyB.exe
  C:\Windows\System\qICoIyB.exe
  2⤵
  PID:7956
- C:\Windows\System\UFookJE.exe
  C:\Windows\System\UFookJE.exe
  2⤵
  PID:8016
- C:\Windows\System\hoYJsYP.exe
  C:\Windows\System\hoYJsYP.exe
  2⤵
  PID:8116
- C:\Windows\System\DxEgzkB.exe
  C:\Windows\System\DxEgzkB.exe
  2⤵
  PID:8176
- C:\Windows\System\UtTResP.exe
  C:\Windows\System\UtTResP.exe
  2⤵
  PID:6460
- C:\Windows\System\qmhkwQc.exe
  C:\Windows\System\qmhkwQc.exe
  2⤵
  PID:6488
- C:\Windows\System\JaeFUdb.exe
  C:\Windows\System\JaeFUdb.exe
  2⤵
  PID:6528
- C:\Windows\System\eTwNGuz.exe
  C:\Windows\System\eTwNGuz.exe
  2⤵
  PID:6556
- C:\Windows\System\rQbOGQV.exe
  C:\Windows\System\rQbOGQV.exe
  2⤵
  PID:6608
- C:\Windows\System\OfUwDgo.exe
  C:\Windows\System\OfUwDgo.exe
  2⤵
  PID:6656
- C:\Windows\System\aCamzGx.exe
  C:\Windows\System\aCamzGx.exe
  2⤵
  PID:6696
- C:\Windows\System\iYarwRK.exe
  C:\Windows\System\iYarwRK.exe
  2⤵
  PID:6728
- C:\Windows\System\huBeHDa.exe
  C:\Windows\System\huBeHDa.exe
  2⤵
  PID:6760
- C:\Windows\System\rDytraS.exe
  C:\Windows\System\rDytraS.exe
  2⤵
  PID:6772
- C:\Windows\System\AnAzTuE.exe
  C:\Windows\System\AnAzTuE.exe
  2⤵
  PID:6820
- C:\Windows\System\gOTJauy.exe
  C:\Windows\System\gOTJauy.exe
  2⤵
  PID:4860
- C:\Windows\System\DNbyqOk.exe
  C:\Windows\System\DNbyqOk.exe
  2⤵
  PID:5960
- C:\Windows\System\itZXMgo.exe
  C:\Windows\System\itZXMgo.exe
  2⤵
  PID:7328
- C:\Windows\System\fgdbDEr.exe
  C:\Windows\System\fgdbDEr.exe
  2⤵
  PID:8696
- C:\Windows\System\fGacFqB.exe
  C:\Windows\System\fGacFqB.exe
  2⤵
  PID:8736
- C:\Windows\System\cJiTxbQ.exe
  C:\Windows\System\cJiTxbQ.exe
  2⤵
  PID:8828
- C:\Windows\System\FBoNGnM.exe
  C:\Windows\System\FBoNGnM.exe
  2⤵
  PID:8868
- C:\Windows\System\ZnWIqyc.exe
  C:\Windows\System\ZnWIqyc.exe
  2⤵
  PID:8908
- C:\Windows\System\EcJxnta.exe
  C:\Windows\System\EcJxnta.exe
  2⤵
  PID:8944
- C:\Windows\System\SwoCxRJ.exe
  C:\Windows\System\SwoCxRJ.exe
  2⤵
  PID:8992
- C:\Windows\System\VMlUMOA.exe
  C:\Windows\System\VMlUMOA.exe
  2⤵
  PID:9032
- C:\Windows\System\wZZhwuW.exe
  C:\Windows\System\wZZhwuW.exe
  2⤵
  PID:9072
- C:\Windows\System\YVpvjwj.exe
  C:\Windows\System\YVpvjwj.exe
  2⤵
  PID:3916
- C:\Windows\System\vUHrCFv.exe
  C:\Windows\System\vUHrCFv.exe
  2⤵
  PID:4064
- C:\Windows\System\McXaTFB.exe
  C:\Windows\System\McXaTFB.exe
  2⤵
  PID:7844
- C:\Windows\System\pdrQtqQ.exe
  C:\Windows\System\pdrQtqQ.exe
  2⤵
  PID:7936
- C:\Windows\System\aMiferA.exe
  C:\Windows\System\aMiferA.exe
  2⤵
  PID:9396
- C:\Windows\System\mGefuYp.exe
  C:\Windows\System\mGefuYp.exe
  2⤵
  PID:9456
- C:\Windows\System\aftAwka.exe
  C:\Windows\System\aftAwka.exe
  2⤵
  PID:9488
- C:\Windows\System\RyspMvn.exe
  C:\Windows\System\RyspMvn.exe
  2⤵
  PID:9548
- C:\Windows\System\ihIgEsK.exe
  C:\Windows\System\ihIgEsK.exe
  2⤵
  PID:10244
- C:\Windows\System\UgzfeWy.exe
  C:\Windows\System\UgzfeWy.exe
  2⤵
  PID:10268
- C:\Windows\System\jYimoZI.exe
  C:\Windows\System\jYimoZI.exe
  2⤵
  PID:10288
- C:\Windows\System\MjDrVMy.exe
  C:\Windows\System\MjDrVMy.exe
  2⤵
  PID:10312
- C:\Windows\System\uvoJULW.exe
  C:\Windows\System\uvoJULW.exe
  2⤵
  PID:10332
- C:\Windows\System\HFlLPRe.exe
  C:\Windows\System\HFlLPRe.exe
  2⤵
  PID:10348
- C:\Windows\System\UvqwXmN.exe
  C:\Windows\System\UvqwXmN.exe
  2⤵
  PID:10372
- C:\Windows\System\ztoPhcw.exe
  C:\Windows\System\ztoPhcw.exe
  2⤵
  PID:10396
- C:\Windows\System\GJjPyrY.exe
  C:\Windows\System\GJjPyrY.exe
  2⤵
  PID:10416
- C:\Windows\System\gvIpaUx.exe
  C:\Windows\System\gvIpaUx.exe
  2⤵
  PID:10436
- C:\Windows\System\SqnioUw.exe
  C:\Windows\System\SqnioUw.exe
  2⤵
  PID:10456
- C:\Windows\System\zNhfBmM.exe
  C:\Windows\System\zNhfBmM.exe
  2⤵
  PID:10476
- C:\Windows\System\bablIpr.exe
  C:\Windows\System\bablIpr.exe
  2⤵
  PID:10500
- C:\Windows\System\qRXJxmf.exe
  C:\Windows\System\qRXJxmf.exe
  2⤵
  PID:10520
- C:\Windows\System\dJBaNIg.exe
  C:\Windows\System\dJBaNIg.exe
  2⤵
  PID:10540
- C:\Windows\System\zyUZUfI.exe
  C:\Windows\System\zyUZUfI.exe
  2⤵
  PID:10560
- C:\Windows\System\oyFEWAU.exe
  C:\Windows\System\oyFEWAU.exe
  2⤵
  PID:10580
- C:\Windows\System\RsVaXsl.exe
  C:\Windows\System\RsVaXsl.exe
  2⤵
  PID:10608
- C:\Windows\System\VcBoTeq.exe
  C:\Windows\System\VcBoTeq.exe
  2⤵
  PID:10628
- C:\Windows\System\yRdAuix.exe
  C:\Windows\System\yRdAuix.exe
  2⤵
  PID:10648
- C:\Windows\System\qgSqFnC.exe
  C:\Windows\System\qgSqFnC.exe
  2⤵
  PID:10668
- C:\Windows\System\YvARFdf.exe
  C:\Windows\System\YvARFdf.exe
  2⤵
  PID:10688
- C:\Windows\System\GatgkDW.exe
  C:\Windows\System\GatgkDW.exe
  2⤵
  PID:10712
- C:\Windows\System\zYmDYEE.exe
  C:\Windows\System\zYmDYEE.exe
  2⤵
  PID:10728
- C:\Windows\System\heXfiaV.exe
  C:\Windows\System\heXfiaV.exe
  2⤵
  PID:10752
- C:\Windows\System\DWZEPDt.exe
  C:\Windows\System\DWZEPDt.exe
  2⤵
  PID:10768
- C:\Windows\System\nTQCdYa.exe
  C:\Windows\System\nTQCdYa.exe
  2⤵
  PID:10788
- C:\Windows\System\iGXMOhx.exe
  C:\Windows\System\iGXMOhx.exe
  2⤵
  PID:10804
- C:\Windows\System\wBzSAMt.exe
  C:\Windows\System\wBzSAMt.exe
  2⤵
  PID:10824
- C:\Windows\System\ZdeRrjs.exe
  C:\Windows\System\ZdeRrjs.exe
  2⤵
  PID:10844
- C:\Windows\System\vNxYcLy.exe
  C:\Windows\System\vNxYcLy.exe
  2⤵
  PID:10860
- C:\Windows\System\EhndmWU.exe
  C:\Windows\System\EhndmWU.exe
  2⤵
  PID:10876
- C:\Windows\System\Mctovqe.exe
  C:\Windows\System\Mctovqe.exe
  2⤵
  PID:10896
- C:\Windows\System\mcxUODG.exe
  C:\Windows\System\mcxUODG.exe
  2⤵
  PID:10920
- C:\Windows\System\gxsUmCC.exe
  C:\Windows\System\gxsUmCC.exe
  2⤵
  PID:10940
- C:\Windows\System\fyXonNk.exe
  C:\Windows\System\fyXonNk.exe
  2⤵
  PID:10960
- C:\Windows\System\SFZOFjZ.exe
  C:\Windows\System\SFZOFjZ.exe
  2⤵
  PID:10980
- C:\Windows\System\ROcFozQ.exe
  C:\Windows\System\ROcFozQ.exe
  2⤵
  PID:11008
- C:\Windows\System\dkMRkjV.exe
  C:\Windows\System\dkMRkjV.exe
  2⤵
  PID:11032
- C:\Windows\System\SLjmzdK.exe
  C:\Windows\System\SLjmzdK.exe
  2⤵
  PID:11048
- C:\Windows\System\aRQyhVM.exe
  C:\Windows\System\aRQyhVM.exe
  2⤵
  PID:11068
- C:\Windows\System\ZTCDmlX.exe
  C:\Windows\System\ZTCDmlX.exe
  2⤵
  PID:11084
- C:\Windows\System\miVHIMm.exe
  C:\Windows\System\miVHIMm.exe
  2⤵
  PID:11104
- C:\Windows\System\pMZxkgZ.exe
  C:\Windows\System\pMZxkgZ.exe
  2⤵
  PID:11132
- C:\Windows\System\rHnNcDL.exe
  C:\Windows\System\rHnNcDL.exe
  2⤵
  PID:11152
- C:\Windows\System\fXVGIlG.exe
  C:\Windows\System\fXVGIlG.exe
  2⤵
  PID:11168
- C:\Windows\System\VjuHSMk.exe
  C:\Windows\System\VjuHSMk.exe
  2⤵
  PID:11192
- C:\Windows\System\YTDloJU.exe
  C:\Windows\System\YTDloJU.exe
  2⤵
  PID:11208
- C:\Windows\System\KFiSHkA.exe
  C:\Windows\System\KFiSHkA.exe
  2⤵
  PID:11224
- C:\Windows\System\FRHmqDF.exe
  C:\Windows\System\FRHmqDF.exe
  2⤵
  PID:11240
- C:\Windows\System\scMpcKV.exe
  C:\Windows\System\scMpcKV.exe
  2⤵
  PID:11256
- C:\Windows\System\FdZsVgm.exe
  C:\Windows\System\FdZsVgm.exe
  2⤵
  PID:9740
- C:\Windows\System\vPKjIdX.exe
  C:\Windows\System\vPKjIdX.exe
  2⤵
  PID:9888
- C:\Windows\System\FtLiwDE.exe
  C:\Windows\System\FtLiwDE.exe
  2⤵
  PID:9932
- C:\Windows\System\xPaKooI.exe
  C:\Windows\System\xPaKooI.exe
  2⤵
  PID:5928
- C:\Windows\System\pEWCDzH.exe
  C:\Windows\System\pEWCDzH.exe
  2⤵
  PID:10036
- C:\Windows\System\yXeOwxK.exe
  C:\Windows\System\yXeOwxK.exe
  2⤵
  PID:10152
- C:\Windows\System\LTkcUQO.exe
  C:\Windows\System\LTkcUQO.exe
  2⤵
  PID:6224
- C:\Windows\System\GpwRNyR.exe
  C:\Windows\System\GpwRNyR.exe
  2⤵
  PID:6876
- C:\Windows\System\aXOqeZN.exe
  C:\Windows\System\aXOqeZN.exe
  2⤵
  PID:8304
- C:\Windows\System\QZNHqNa.exe
  C:\Windows\System\QZNHqNa.exe
  2⤵
  PID:8384
- C:\Windows\System\BzLyWHa.exe
  C:\Windows\System\BzLyWHa.exe
  2⤵
  PID:8416
- C:\Windows\System\PMfHOEz.exe
  C:\Windows\System\PMfHOEz.exe
  2⤵
  PID:7604
- C:\Windows\System\NPlYgBv.exe
  C:\Windows\System\NPlYgBv.exe
  2⤵
  PID:8500
- C:\Windows\System\OsVXtXB.exe
  C:\Windows\System\OsVXtXB.exe
  2⤵
  PID:2044
- C:\Windows\System\CTxwyle.exe
  C:\Windows\System\CTxwyle.exe
  2⤵
  PID:7728
- C:\Windows\System\pGKVLMW.exe
  C:\Windows\System\pGKVLMW.exe
  2⤵
  PID:8720
- C:\Windows\System\lQLPqGD.exe
  C:\Windows\System\lQLPqGD.exe
  2⤵
  PID:11272
- C:\Windows\System\TiriVTL.exe
  C:\Windows\System\TiriVTL.exe
  2⤵
  PID:11292
- C:\Windows\System\ThVzhjV.exe
  C:\Windows\System\ThVzhjV.exe
  2⤵
  PID:11320
- C:\Windows\System\abaiveL.exe
  C:\Windows\System\abaiveL.exe
  2⤵
  PID:11344
- C:\Windows\System\vNkVpqi.exe
  C:\Windows\System\vNkVpqi.exe
  2⤵
  PID:11364
- C:\Windows\System\tLgqWlW.exe
  C:\Windows\System\tLgqWlW.exe
  2⤵
  PID:11384
- C:\Windows\System\tdygjXJ.exe
  C:\Windows\System\tdygjXJ.exe
  2⤵
  PID:11400
- C:\Windows\System\AvQdoyg.exe
  C:\Windows\System\AvQdoyg.exe
  2⤵
  PID:11420
- C:\Windows\System\sZLUsEL.exe
  C:\Windows\System\sZLUsEL.exe
  2⤵
  PID:11436
- C:\Windows\System\Jmnyfep.exe
  C:\Windows\System\Jmnyfep.exe
  2⤵
  PID:11456
- C:\Windows\System\GzNsovf.exe
  C:\Windows\System\GzNsovf.exe
  2⤵
  PID:11472
- C:\Windows\System\NHfCVOb.exe
  C:\Windows\System\NHfCVOb.exe
  2⤵
  PID:11492
- C:\Windows\System\BbbjseA.exe
  C:\Windows\System\BbbjseA.exe
  2⤵
  PID:11508
- C:\Windows\System\blVkQmg.exe
  C:\Windows\System\blVkQmg.exe
  2⤵
  PID:11524
- C:\Windows\System\JbaOIMi.exe
  C:\Windows\System\JbaOIMi.exe
  2⤵
  PID:11544
- C:\Windows\System\pHmDmqx.exe
  C:\Windows\System\pHmDmqx.exe
  2⤵
  PID:11564
- C:\Windows\System\ENrJwbv.exe
  C:\Windows\System\ENrJwbv.exe
  2⤵
  PID:11584
- C:\Windows\System\XIhsoMF.exe
  C:\Windows\System\XIhsoMF.exe
  2⤵
  PID:11604
- C:\Windows\System\iVqWPly.exe
  C:\Windows\System\iVqWPly.exe
  2⤵
  PID:11624
- C:\Windows\System\UsacIZi.exe
  C:\Windows\System\UsacIZi.exe
  2⤵
  PID:11644
- C:\Windows\System\bGDaUFh.exe
  C:\Windows\System\bGDaUFh.exe
  2⤵
  PID:11660
- C:\Windows\System\NGeyqOL.exe
  C:\Windows\System\NGeyqOL.exe
  2⤵
  PID:11680
- C:\Windows\System\sqTdzce.exe
  C:\Windows\System\sqTdzce.exe
  2⤵
  PID:11696
- C:\Windows\System\TdPCGMC.exe
  C:\Windows\System\TdPCGMC.exe
  2⤵
  PID:11720
- C:\Windows\System\DoKYohf.exe
  C:\Windows\System\DoKYohf.exe
  2⤵
  PID:11744
- C:\Windows\System\hdOLAiI.exe
  C:\Windows\System\hdOLAiI.exe
  2⤵
  PID:11760
- C:\Windows\System\QKQeMjG.exe
  C:\Windows\System\QKQeMjG.exe
  2⤵
  PID:11776
- C:\Windows\System\MqNWYdJ.exe
  C:\Windows\System\MqNWYdJ.exe
  2⤵
  PID:11796
- C:\Windows\System\hnWPnuW.exe
  C:\Windows\System\hnWPnuW.exe
  2⤵
  PID:11816
- C:\Windows\System\ZMCYZBO.exe
  C:\Windows\System\ZMCYZBO.exe
  2⤵
  PID:11836
- C:\Windows\System\zdPSWen.exe
  C:\Windows\System\zdPSWen.exe
  2⤵
  PID:11856
- C:\Windows\System\qrEFzeC.exe
  C:\Windows\System\qrEFzeC.exe
  2⤵
  PID:11880
- C:\Windows\System\BJaonTI.exe
  C:\Windows\System\BJaonTI.exe
  2⤵
  PID:11896
- C:\Windows\System\wJRKfVB.exe
  C:\Windows\System\wJRKfVB.exe
  2⤵
  PID:11920
- C:\Windows\System\esaFBQF.exe
  C:\Windows\System\esaFBQF.exe
  2⤵
  PID:11944
- C:\Windows\System\ubLAlaD.exe
  C:\Windows\System\ubLAlaD.exe
  2⤵
  PID:11960
- C:\Windows\System\NqPhbzF.exe
  C:\Windows\System\NqPhbzF.exe
  2⤵
  PID:11984
- C:\Windows\System\XtEpcFm.exe
  C:\Windows\System\XtEpcFm.exe
  2⤵
  PID:12004
- C:\Windows\System\YeRmphh.exe
  C:\Windows\System\YeRmphh.exe
  2⤵
  PID:12024
- C:\Windows\System\qJkSPlN.exe
  C:\Windows\System\qJkSPlN.exe
  2⤵
  PID:12048
- C:\Windows\System\NRosIDB.exe
  C:\Windows\System\NRosIDB.exe
  2⤵
  PID:12072
- C:\Windows\System\MWbMbbZ.exe
  C:\Windows\System\MWbMbbZ.exe
  2⤵
  PID:12088
- C:\Windows\System\EpIsVaQ.exe
  C:\Windows\System\EpIsVaQ.exe
  2⤵
  PID:12108
- C:\Windows\System\uRNXAjF.exe
  C:\Windows\System\uRNXAjF.exe
  2⤵
  PID:12132
- C:\Windows\System\rRXWixa.exe
  C:\Windows\System\rRXWixa.exe
  2⤵
  PID:12152
- C:\Windows\System\OPHMOnK.exe
  C:\Windows\System\OPHMOnK.exe
  2⤵
  PID:12188
- C:\Windows\System\sCUbnHP.exe
  C:\Windows\System\sCUbnHP.exe
  2⤵
  PID:12204
- C:\Windows\System\nIGOxkx.exe
  C:\Windows\System\nIGOxkx.exe
  2⤵
  PID:12224
- C:\Windows\System\NyhlyMb.exe
  C:\Windows\System\NyhlyMb.exe
  2⤵
  PID:12248
- C:\Windows\System\htqUtIR.exe
  C:\Windows\System\htqUtIR.exe
  2⤵
  PID:12264
- C:\Windows\System\lBXXdKr.exe
  C:\Windows\System\lBXXdKr.exe
  2⤵
  PID:8996
- C:\Windows\System\OhrsYyJ.exe
  C:\Windows\System\OhrsYyJ.exe
  2⤵
  PID:9100
- C:\Windows\System\wCbzWoR.exe
  C:\Windows\System\wCbzWoR.exe
  2⤵
  PID:9144
- C:\Windows\System\RRYCowU.exe
  C:\Windows\System\RRYCowU.exe
  2⤵
  PID:9208
- C:\Windows\System\ZLXMFba.exe
  C:\Windows\System\ZLXMFba.exe
  2⤵
  PID:5664
- C:\Windows\System\TFSNkhh.exe
  C:\Windows\System\TFSNkhh.exe
  2⤵
  PID:7696
- C:\Windows\System\UIeGlVF.exe
  C:\Windows\System\UIeGlVF.exe
  2⤵
  PID:6264
- C:\Windows\System\nMktGGG.exe
  C:\Windows\System\nMktGGG.exe
  2⤵
  PID:7856
- C:\Windows\System\AEppAfG.exe
  C:\Windows\System\AEppAfG.exe
  2⤵
  PID:2992
- C:\Windows\System\NiddAvl.exe
  C:\Windows\System\NiddAvl.exe
  2⤵
  PID:9284
- C:\Windows\System\EyaNgMP.exe
  C:\Windows\System\EyaNgMP.exe
  2⤵
  PID:9324
- C:\Windows\System\rTXtYEf.exe
  C:\Windows\System\rTXtYEf.exe
  2⤵
  PID:8008
- C:\Windows\System\BmbSmPM.exe
  C:\Windows\System\BmbSmPM.exe
  2⤵
  PID:8072
- C:\Windows\System\TZGkZUM.exe
  C:\Windows\System\TZGkZUM.exe
  2⤵
  PID:8972
- C:\Windows\System\Biswaiz.exe
  C:\Windows\System\Biswaiz.exe
  2⤵
  PID:8120
- C:\Windows\System\qSdhlKq.exe
  C:\Windows\System\qSdhlKq.exe
  2⤵
  PID:9228
- C:\Windows\System\WZRTMnO.exe
  C:\Windows\System\WZRTMnO.exe
  2⤵
  PID:5168
- C:\Windows\System\GsEXUtq.exe
  C:\Windows\System\GsEXUtq.exe
  2⤵
  PID:9588
- C:\Windows\System\xunlBnZ.exe
  C:\Windows\System\xunlBnZ.exe
  2⤵
  PID:9408
- C:\Windows\System\nFmpkhD.exe
  C:\Windows\System\nFmpkhD.exe
  2⤵
  PID:12300
- C:\Windows\System\RUvngVy.exe
  C:\Windows\System\RUvngVy.exe
  2⤵
  PID:12324
- C:\Windows\System\JbqMyFK.exe
  C:\Windows\System\JbqMyFK.exe
  2⤵
  PID:12340
- C:\Windows\System\diOFVMI.exe
  C:\Windows\System\diOFVMI.exe
  2⤵
  PID:12356
- C:\Windows\System\FEuGqeM.exe
  C:\Windows\System\FEuGqeM.exe
  2⤵
  PID:12372
- C:\Windows\System\TlpIKkj.exe
  C:\Windows\System\TlpIKkj.exe
  2⤵
  PID:12392
- C:\Windows\System\nyMlxnj.exe
  C:\Windows\System\nyMlxnj.exe
  2⤵
  PID:12408
- C:\Windows\System\dhpDAcN.exe
  C:\Windows\System\dhpDAcN.exe
  2⤵
  PID:12424
- C:\Windows\System\bPPNByI.exe
  C:\Windows\System\bPPNByI.exe
  2⤵
  PID:12444
- C:\Windows\System\zvqkdTR.exe
  C:\Windows\System\zvqkdTR.exe
  2⤵
  PID:12460
- C:\Windows\System\AOEbnUG.exe
  C:\Windows\System\AOEbnUG.exe
  2⤵
  PID:12480
- C:\Windows\System\TcKiIuj.exe
  C:\Windows\System\TcKiIuj.exe
  2⤵
  PID:12496
- C:\Windows\System\lmTkvlp.exe
  C:\Windows\System\lmTkvlp.exe
  2⤵
  PID:12520
- C:\Windows\System\rXlHLrV.exe
  C:\Windows\System\rXlHLrV.exe
  2⤵
  PID:12540
- C:\Windows\System\lEpCjXY.exe
  C:\Windows\System\lEpCjXY.exe
  2⤵
  PID:12556
- C:\Windows\System\VyjsDyP.exe
  C:\Windows\System\VyjsDyP.exe
  2⤵
  PID:12576
- C:\Windows\System\iBXnFoh.exe
  C:\Windows\System\iBXnFoh.exe
  2⤵
  PID:12596
- C:\Windows\System\nvkEKtF.exe
  C:\Windows\System\nvkEKtF.exe
  2⤵
  PID:12616
- C:\Windows\System\HcUuQpy.exe
  C:\Windows\System\HcUuQpy.exe
  2⤵
  PID:12636
- C:\Windows\System\RVqSNmZ.exe
  C:\Windows\System\RVqSNmZ.exe
  2⤵
  PID:12656
- C:\Windows\System\nTEvcvI.exe
  C:\Windows\System\nTEvcvI.exe
  2⤵
  PID:12680
- C:\Windows\System\kWDTroI.exe
  C:\Windows\System\kWDTroI.exe
  2⤵
  PID:12696
- C:\Windows\System\INfTYWt.exe
  C:\Windows\System\INfTYWt.exe
  2⤵
  PID:12720
- C:\Windows\System\tOQgVLa.exe
  C:\Windows\System\tOQgVLa.exe
  2⤵
  PID:12744
- C:\Windows\System\qrNCdju.exe
  C:\Windows\System\qrNCdju.exe
  2⤵
  PID:12768
- C:\Windows\System\pnAaSAp.exe
  C:\Windows\System\pnAaSAp.exe
  2⤵
  PID:12792
- C:\Windows\System\FGNmKrO.exe
  C:\Windows\System\FGNmKrO.exe
  2⤵
  PID:12812
- C:\Windows\System\MVlRyOn.exe
  C:\Windows\System\MVlRyOn.exe
  2⤵
  PID:12832
- C:\Windows\System\ACRlyqe.exe
  C:\Windows\System\ACRlyqe.exe
  2⤵
  PID:12860
- C:\Windows\System\gCOdHfC.exe
  C:\Windows\System\gCOdHfC.exe
  2⤵
  PID:12884
- C:\Windows\System\ZTGjuhm.exe
  C:\Windows\System\ZTGjuhm.exe
  2⤵
  PID:12904
- C:\Windows\System\meurDcN.exe
  C:\Windows\System\meurDcN.exe
  2⤵
  PID:12932
- C:\Windows\System\vwAYtga.exe
  C:\Windows\System\vwAYtga.exe
  2⤵
  PID:12948
- C:\Windows\System\knEzgWU.exe
  C:\Windows\System\knEzgWU.exe
  2⤵
  PID:12968
- C:\Windows\System\aXhRtCP.exe
  C:\Windows\System\aXhRtCP.exe
  2⤵
  PID:12992
- C:\Windows\System\StXPqbk.exe
  C:\Windows\System\StXPqbk.exe
  2⤵
  PID:13008
- C:\Windows\System\Haddrzo.exe
  C:\Windows\System\Haddrzo.exe
  2⤵
  PID:13028
- C:\Windows\System\kPUaTxi.exe
  C:\Windows\System\kPUaTxi.exe
  2⤵
  PID:13048
- C:\Windows\System\MypVBzn.exe
  C:\Windows\System\MypVBzn.exe
  2⤵
  PID:13016
- C:\Windows\System\cfzGmnd.exe
  C:\Windows\System\cfzGmnd.exe
  2⤵
  PID:2796
- C:\Windows\System\MgdTTsg.exe
  C:\Windows\System\MgdTTsg.exe
  2⤵
  PID:8392
- C:\Windows\System\KtuuzGs.exe
  C:\Windows\System\KtuuzGs.exe
  2⤵
  PID:7196
- C:\Windows\System\UiHdtyT.exe
  C:\Windows\System\UiHdtyT.exe
  2⤵
  PID:12916
- C:\Windows\System\XnjtNCI.exe
  C:\Windows\System\XnjtNCI.exe
  2⤵
  PID:11300
- C:\Windows\System\vOXEZcn.exe
  C:\Windows\System\vOXEZcn.exe
  2⤵
  PID:11360
- C:\Windows\System\nITvtKz.exe
  C:\Windows\System\nITvtKz.exe
  2⤵
  PID:11432
- C:\Windows\System\CvppiAK.exe
  C:\Windows\System\CvppiAK.exe
  2⤵
  PID:11452
- C:\Windows\System\MvWlQMq.exe
  C:\Windows\System\MvWlQMq.exe
  2⤵
  PID:11580
- C:\Windows\System\CTRnfBt.exe
  C:\Windows\System\CTRnfBt.exe
  2⤵
  PID:11668
- C:\Windows\System\JGUuqHP.exe
  C:\Windows\System\JGUuqHP.exe
  2⤵
  PID:11792
- C:\Windows\System\FKlVAxH.exe
  C:\Windows\System\FKlVAxH.exe
  2⤵
  PID:12040
- C:\Windows\System\uAcciza.exe
  C:\Windows\System\uAcciza.exe
  2⤵
  PID:12176
- C:\Windows\System\NOPyEFc.exe
  C:\Windows\System\NOPyEFc.exe
  2⤵
  PID:12232
- C:\Windows\System\pXjkQhm.exe
  C:\Windows\System\pXjkQhm.exe
  2⤵
  PID:9096
- C:\Windows\System\dDjuIgT.exe
  C:\Windows\System\dDjuIgT.exe
  2⤵
  PID:9508
- C:\Windows\System\QspkLmi.exe
  C:\Windows\System\QspkLmi.exe
  2⤵
  PID:9620
- C:\Windows\System\gyPfDKs.exe
  C:\Windows\System\gyPfDKs.exe
  2⤵
  PID:10856
- C:\Windows\System\sWpkzuv.exe
  C:\Windows\System\sWpkzuv.exe
  2⤵
  PID:12740
- C:\Windows\System\qrzFKBE.exe
  C:\Windows\System\qrzFKBE.exe
  2⤵
  PID:4888
- C:\Windows\System\TspFoaU.exe
  C:\Windows\System\TspFoaU.exe
  2⤵
  PID:10800
- C:\Windows\System\yexfCUY.exe
  C:\Windows\System\yexfCUY.exe
  2⤵
  PID:13236
- C:\Windows\System\BWxTTih.exe
  C:\Windows\System\BWxTTih.exe
  2⤵
  PID:13208
- C:\Windows\System\QoumrSK.exe
  C:\Windows\System\QoumrSK.exe
  2⤵
  PID:13172
- C:\Windows\System\eLAyjmf.exe
  C:\Windows\System\eLAyjmf.exe
  2⤵
  PID:13108
- C:\Windows\System\lpcNVGx.exe
  C:\Windows\System\lpcNVGx.exe
  2⤵
  PID:13088
- C:\Windows\System\vfTrCrb.exe
  C:\Windows\System\vfTrCrb.exe
  2⤵
  PID:13040
- C:\Windows\System\RvoFAEg.exe
  C:\Windows\System\RvoFAEg.exe
  2⤵
  PID:12528
- C:\Windows\System\eYnjoqZ.exe
  C:\Windows\System\eYnjoqZ.exe
  2⤵
  PID:8096
- C:\Windows\System\FxjyVUn.exe
  C:\Windows\System\FxjyVUn.exe
  2⤵
  PID:11620
- C:\Windows\System\dXknqNj.exe
  C:\Windows\System\dXknqNj.exe
  2⤵
  PID:12872
- C:\Windows\System\XmqRdvT.exe
  C:\Windows\System\XmqRdvT.exe
  2⤵
  PID:2380
- C:\Windows\System\vTPmiLF.exe
  C:\Windows\System\vTPmiLF.exe
  2⤵
  PID:11100
- C:\Windows\System\BoPUQkm.exe
  C:\Windows\System\BoPUQkm.exe
  2⤵
  PID:4000
- C:\Windows\System\eAvVgwJ.exe
  C:\Windows\System\eAvVgwJ.exe
  2⤵
  PID:9464
- C:\Windows\System\HJUFtiE.exe
  C:\Windows\System\HJUFtiE.exe
  2⤵
  PID:10708
- C:\Windows\System\TFKJXPC.exe
  C:\Windows\System\TFKJXPC.exe
  2⤵
  PID:8220
- C:\Windows\System\QaPFicy.exe
  C:\Windows\System\QaPFicy.exe
  2⤵
  PID:10740
- C:\Windows\System\jKyyDBa.exe
  C:\Windows\System\jKyyDBa.exe
  2⤵
  PID:11024
- C:\Windows\System\CJxYSoO.exe
  C:\Windows\System\CJxYSoO.exe
  2⤵
  PID:6852
- C:\Windows\System\Xxlbsfn.exe
  C:\Windows\System\Xxlbsfn.exe
  2⤵
  PID:11480
- C:\Windows\System\eveZqNY.exe
  C:\Windows\System\eveZqNY.exe
  2⤵
  PID:9520
- C:\Windows\System\drKmtkT.exe
  C:\Windows\System\drKmtkT.exe
  2⤵
  PID:13076
- C:\Windows\System\zrRAhUH.exe
  C:\Windows\System\zrRAhUH.exe
  2⤵
  PID:13220
- C:\Windows\System\sSBLgQt.exe
  C:\Windows\System\sSBLgQt.exe
  2⤵
  PID:13140
- C:\Windows\System\NKdVvxP.exe
  C:\Windows\System\NKdVvxP.exe
  2⤵
  PID:6756
- C:\Windows\System\fRfzUas.exe
  C:\Windows\System\fRfzUas.exe
  2⤵
  PID:12476
- C:\Windows\System\kvXFVml.exe
  C:\Windows\System\kvXFVml.exe
  2⤵
  PID:9900
- C:\Windows\System\yveTpzP.exe
  C:\Windows\System\yveTpzP.exe
  2⤵
  PID:6716
- C:\Windows\System\uvthSit.exe
  C:\Windows\System\uvthSit.exe
  2⤵
  PID:7024
- C:\Windows\System\jAiaNQj.exe
  C:\Windows\System\jAiaNQj.exe
  2⤵
  PID:12756
- C:\Windows\System\tfuAdhd.exe
  C:\Windows\System\tfuAdhd.exe
  2⤵
  PID:11484
- C:\Windows\System\shXlHwW.exe
  C:\Windows\System\shXlHwW.exe
  2⤵
  PID:6712
- C:\Windows\System\onMqSdn.exe
  C:\Windows\System\onMqSdn.exe
  2⤵
  PID:9304
- C:\Windows\System\kEXodAL.exe
  C:\Windows\System\kEXodAL.exe
  2⤵
  PID:8576
- C:\Windows\System\DzoAsZd.exe
  C:\Windows\System\DzoAsZd.exe
  2⤵
  PID:9760
- C:\Windows\System\TfmOrHk.exe
  C:\Windows\System\TfmOrHk.exe
  2⤵
  PID:13056
- C:\Windows\System\oGNIpEL.exe
  C:\Windows\System\oGNIpEL.exe
  2⤵
  PID:12788
- C:\Windows\System\ZEKLzbY.exe
  C:\Windows\System\ZEKLzbY.exe
  2⤵
  PID:8684
- C:\Windows\System\QxbApYb.exe
  C:\Windows\System\QxbApYb.exe
  2⤵
  PID:9540
- C:\Windows\System\RGgCMlN.exe
  C:\Windows\System\RGgCMlN.exe
  2⤵
  PID:8248
- C:\Windows\System\SBBuIrs.exe
  C:\Windows\System\SBBuIrs.exe
  2⤵
  PID:12964
- C:\Windows\System\AdbQUSl.exe
  C:\Windows\System\AdbQUSl.exe
  2⤵
  PID:10404
- C:\Windows\System\GymlJUR.exe
  C:\Windows\System\GymlJUR.exe
  2⤵
  PID:12332
- C:\Windows\System\YXqDWTY.exe
  C:\Windows\System\YXqDWTY.exe
  2⤵
  PID:13420
- C:\Windows\System\XOngPrR.exe
  C:\Windows\System\XOngPrR.exe
  2⤵
  PID:13944
- C:\Windows\System\SQVqgcX.exe
  C:\Windows\System\SQVqgcX.exe
  2⤵
  PID:13976
- C:\Windows\System\KsWJXYq.exe
  C:\Windows\System\KsWJXYq.exe
  2⤵
  PID:14176
- C:\Windows\System\yxTVnyY.exe
  C:\Windows\System\yxTVnyY.exe
  2⤵
  PID:14316
- C:\Windows\System\xXDyIci.exe
  C:\Windows\System\xXDyIci.exe
  2⤵
  PID:12416
- C:\Windows\System\vjheSvD.exe
  C:\Windows\System\vjheSvD.exe
  2⤵
  PID:548
- C:\Windows\System\wsiyAVN.exe
  C:\Windows\System\wsiyAVN.exe
  2⤵
  PID:13536
- C:\Windows\System\OJHPySG.exe
  C:\Windows\System\OJHPySG.exe
  2⤵
  PID:13348
- C:\Windows\System\VVYKNXT.exe
  C:\Windows\System\VVYKNXT.exe
  2⤵
  PID:13380
- C:\Windows\System\diNMKzy.exe
  C:\Windows\System\diNMKzy.exe
  2⤵
  PID:6416
- C:\Windows\System\nGGIWKz.exe
  C:\Windows\System\nGGIWKz.exe
  2⤵
  PID:13144
- C:\Windows\System\zPbAIxW.exe
  C:\Windows\System\zPbAIxW.exe
  2⤵
  PID:7416
- C:\Windows\System\XZOIWXR.exe
  C:\Windows\System\XZOIWXR.exe
  2⤵
  PID:13500
- C:\Windows\System\eoRnAjf.exe
  C:\Windows\System\eoRnAjf.exe
  2⤵
  PID:13516
- C:\Windows\System\rIevWIs.exe
  C:\Windows\System\rIevWIs.exe
  2⤵
  PID:11728
- C:\Windows\System\LAQRaSV.exe
  C:\Windows\System\LAQRaSV.exe
  2⤵
  PID:13560
- C:\Windows\System\IUNewua.exe
  C:\Windows\System\IUNewua.exe
  2⤵
  PID:13676
- C:\Windows\System\WsNgubZ.exe
  C:\Windows\System\WsNgubZ.exe
  2⤵
  PID:13396
- C:\Windows\System\VIAzlFP.exe
  C:\Windows\System\VIAzlFP.exe
  2⤵
  PID:13784
- C:\Windows\System\RVRuKQG.exe
  C:\Windows\System\RVRuKQG.exe
  2⤵
  PID:13896
- C:\Windows\System\nUvtJPl.exe
  C:\Windows\System\nUvtJPl.exe
  2⤵
  PID:4904
- C:\Windows\System\oBIUTmA.exe
  C:\Windows\System\oBIUTmA.exe
  2⤵
  PID:13936
- C:\Windows\System\WpgwZwn.exe
  C:\Windows\System\WpgwZwn.exe
  2⤵
  PID:13972
- C:\Windows\System\DwAGJZg.exe
  C:\Windows\System\DwAGJZg.exe
  2⤵
  PID:14008
- C:\Windows\System\kfeadmK.exe
  C:\Windows\System\kfeadmK.exe
  2⤵
  PID:14188
- C:\Windows\System\nIFVRNi.exe
  C:\Windows\System\nIFVRNi.exe
  2⤵
  PID:14212
- C:\Windows\System\FqEunxg.exe
  C:\Windows\System\FqEunxg.exe
  2⤵
  PID:14228
- C:\Windows\System\nWSrtvA.exe
  C:\Windows\System\nWSrtvA.exe
  2⤵
  PID:14244
- C:\Windows\System\fOwhXYp.exe
  C:\Windows\System\fOwhXYp.exe
  2⤵
  PID:14296
- C:\Windows\System\NcrkaBL.exe
  C:\Windows\System\NcrkaBL.exe
  2⤵
  PID:12732
- C:\Windows\System\ALZrMYV.exe
  C:\Windows\System\ALZrMYV.exe
  2⤵
  PID:8784
- C:\Windows\System\KthGmUP.exe
  C:\Windows\System\KthGmUP.exe
  2⤵
  PID:13844
- C:\Windows\System\ERKStln.exe
  C:\Windows\System\ERKStln.exe
  2⤵
  PID:13636
- C:\Windows\System\MJvsVWt.exe
  C:\Windows\System\MJvsVWt.exe
  2⤵
  PID:13760
- C:\Windows\System\DctfpWj.exe
  C:\Windows\System\DctfpWj.exe
  2⤵
  PID:13704
- C:\Windows\System\RACxnNt.exe
  C:\Windows\System\RACxnNt.exe
  2⤵
  PID:13804
- C:\Windows\System\XxCKqhX.exe
  C:\Windows\System\XxCKqhX.exe
  2⤵
  PID:5576
- C:\Windows\System\PTrfvjh.exe
  C:\Windows\System\PTrfvjh.exe
  2⤵
  PID:2340
- C:\Windows\System\pSctEru.exe
  C:\Windows\System\pSctEru.exe
  2⤵
  PID:14184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_opwoneid.ws5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_opwoneid.ws5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

CIhOjFt.exe

Path C:\Windows\System\CIhOjFt.exe
Size 1.5MB
SHA256 72568e59853bd14747993c7d398b5a294ea392c4117c36677d1d545ef44ff7d9
MD5 34a6607dd4a9a10dcf88b047436bcfd5
SHA1 8153bdea57afcda5660b7e361a17d353718f7a1b
SHA512 e73e5c3d5e1f8129043e1b11d34aa8b958d7baaee3e93f44a10859ebd6f0f7d2864a2b1fc718b27f63c94749c05e694b5d2428b1f18c53cdb169558203242f50
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRJ:Lz071uv4BPMkHC0IlnASEx/RiN9RJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

DlOfalP.exe

Path C:\Windows\System\DlOfalP.exe
Size 1.5MB
SHA256 e81ef3771afb172d8fb2097887cd0629c720458e5d9f08745370404a57dd5a9f
MD5 e8eaeba5b6f71529c1ea8dae2cbafff4
SHA1 a13b41809430edadacc241a9d09c07540ae41b7b
SHA512 4be3efb0540f3fd05a0c756bc09c595b47f8553a2408eed91d31cf6e0068351430acac3ef498fd80e38324a7a58e2f31162695e05f7a04187a78eb83f9f6bcae
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRuZ:Lz071uv4BPMkHC0IlnASEx/RiN9Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

DmCDXlU.exe

Path C:\Windows\System\DmCDXlU.exe
Size 1.5MB
SHA256 94fbb15bab197c589153b1d217d41e28f3a40ef40af041249129aad78ff0cb53
MD5 5aa72dce707826237151c62fbc293edb
SHA1 48ffb5dfa5c5fb31383a2948c82dd721f9471d83
SHA512 56117ce275d92e54cd69e39a8191b10de11b0469ea22b4f118760a84f8a4b23441e0bc074234e0cbbdf73d7bb067671db48501f1aa07e054430860429f98c176
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRf:Lz071uv4BPMkHC0IlnASEx/RiN9Rf
MD5 SHA1 SHA512 SSDEEP

Submit Download

EFamtQP.exe

Path C:\Windows\System\EFamtQP.exe
Size 1.5MB
SHA256 809bbf574cfb81935289c0d53654542d9c85f2e2540e3a6ef5cbf39212d0e95d
MD5 9ac6fb86a38b4a6908302332ffb8bbb9
SHA1 ad6da65c76554dda6b18feadf119a8c14a1eb0fe
SHA512 8064611ff026cb1129b6c0197d6b67aac069dfd87fb3d9db337a44c650383baf88e908644fca12e95ecd1c4e4d64e9acf5062f1036eb6be6184f8af1cb6d2c39
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRm:Lz071uv4BPMkHC0IlnASEx/RiN9Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fftetpb.exe

Path C:\Windows\System\Fftetpb.exe
Size 1.5MB
SHA256 5082e6143b2e1422c076aac95755cfb1c61aeb52a1150dc50de726048fae7d6c
MD5 ed519add0081bc95671da5ac7ba51dcb
SHA1 0df0f2dbc41a51b5ccb645c31b4ef1333912b38b
SHA512 f5cfa24bfd90c7fe0191e7e42ebc5625708a580826707917ba160701197a812dfaaff611847492f22f5f2b251f3039ad6abf4ab3febdbb8bd19715b7a9f9578b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRw:Lz071uv4BPMkHC0IlnASEx/RiN9Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

FlULcGY.exe

Path C:\Windows\System\FlULcGY.exe
Size 1.5MB
SHA256 afa6c731acc9fed49a48135fde8d4ac636beac71ce678d68d15a8b8eb3889da3
MD5 babeb6f44aafe44e8e481c1d5dedc0cd
SHA1 6d4a38a1e4b906c682585e1e4c89210fc9f3c79e
SHA512 fe64447c4d59eae0d72e1de33da45d16a1dd2cbbdf94a7cac3bc8fb052706287b285c2fd608b980dcde4ddbfab2f96eb0b46f4bef75e1a4256be276606f6c660
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRW:Lz071uv4BPMkHC0IlnASEx/RiN9RW
MD5 SHA1 SHA512 SSDEEP

Submit Download

GxtvbOJ.exe

Path C:\Windows\System\GxtvbOJ.exe
Size 1.5MB
SHA256 5dcf6b0eb8c4b521404de775c1f56887a5047d675afa28780c21d68bbf2a3c4b
MD5 ac8bf65062f086892d89987de7bbe010
SHA1 bb9225b167cd26536448fbfec0dfa01b04b17dd7
SHA512 0d3fe7f84932654157a61ee424c03aad0919dabd685703417f3b12ac6652d1201ee00bd6834a5b73c6943d84bf92ab0babff436ac7c2a939b18c79308cf94e30
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRg:Lz071uv4BPMkHC0IlnASEx/RiN9Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

IFzKJJd.exe

Path C:\Windows\System\IFzKJJd.exe
Size 1.5MB
SHA256 1f93628be81817c0e4a8c2bd6b87e3d69f8b31c50a4aa20120ecd1708f8698e1
MD5 9a89531cb9bb63a235eeb16d7997b77b
SHA1 cdfc2d86244d56277cd782f8e1ae2290d3771a09
SHA512 86f28e28e4cf6a6cba29233aaf9f5efd48d4ed5f72e50f81c57a09ff9dae44eed115f7455a8fc521258fcb10ce5b5701f74d4df2fe890228ab5a78e626a2aca5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRk:Lz071uv4BPMkHC0IlnASEx/RiN9Rk
MD5 SHA1 SHA512 SSDEEP

Submit Download

IjqTRmQ.exe

Path C:\Windows\System\IjqTRmQ.exe
Size 1.5MB
SHA256 5d48bb65a880ce9671d566e47934743f3285c52fd1898a5a2054290c85077def
MD5 16283c7e315467650c58da028206cc04
SHA1 2cc6164ec26b3895a28d7696c452b2b9b1e64727
SHA512 26f7c029f496f833eb93ea3b4cc4432d187db407eb2a2c9e675ccd6e6b7ddd4f1874b0ff82312d74e5f0a20d2ec35f5be3b1697d1e705dd1d2ed6ec796843c39
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxR2r:Lz071uv4BPMkHC0IlnASEx/RiN9R2r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ItorTAe.exe

Path C:\Windows\System\ItorTAe.exe
Size 1.5MB
SHA256 bb6d417ed34f5ddd7ff3ecc53031a3a450738bdd158243799278fccb0feec44d
MD5 fe1a610b0881e2c6199f889c06cfcdf4
SHA1 27d79309fb4b8747e060d13d38d74523481e10b3
SHA512 799be2ca94929e490c8bac939e7d548c6cd67aae451d7bd8ace52777b31afb351f09aedc789eff85fbea1c5730d44cd86bcc89bc8937649f53d09ae2baf82762
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRm:Lz071uv4BPMkHC0IlnASEx/RiN9Rm
MD5 SHA1 SHA512 SSDEEP

Submit Download

KoZzWGC.exe

Path C:\Windows\System\KoZzWGC.exe
Size 1.5MB
SHA256 4747e89add4fafae86b7f164556cc87dc7b9c983065b579137bbe3762df5bf66
MD5 fad00ecaa180161aa52a82d17ded54a0
SHA1 19c68cf74eee1abcfba6ae50331cee4dec050450
SHA512 211a8ddb88a59d006af5d8a58580866441772cb0ce33ff958a521bf73acf15c47059fc3fc8d51afa99d5dbd4d7455d46e04c71987ad74fe91b8789d91c679aef
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRA:Lz071uv4BPMkHC0IlnASEx/RiN9RA
MD5 SHA1 SHA512 SSDEEP

Submit Download

MAmsUAg.exe

Path C:\Windows\System\MAmsUAg.exe
Size 1.5MB
SHA256 416920f4b98369f69566e995f8315ec37d3fedb7c9c839694b8dbdb8f3fc6878
MD5 5b5271bf1dbc383dcfaae684fe1d9a75
SHA1 385886581f7cf8f25273f2971870d0d2afba2cbc
SHA512 d15dba66ef98dcd876f384c8af8d64c0483abe4ed5590e2e35ec8c31fac288752b846b00730e733cba3450b7a8ed822f48a23f424789a8c147ec094414741083
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRG:Lz071uv4BPMkHC0IlnASEx/RiN9RG
MD5 SHA1 SHA512 SSDEEP

Submit Download

NpDXEmh.exe

Path C:\Windows\System\NpDXEmh.exe
Size 1.5MB
SHA256 33867b617963e3ec54e966ce5ea819f0893beb23f6d30a3b1bd9a6f7fb0a75ac
MD5 70e8273b05aa5cfbc3b6a868268db199
SHA1 6de35dae20e51ab77ae629825f613ac133d94ef2
SHA512 7cdea7fa3b9be309b1e9cec9326c8513c2b95ee375ca653e14847f8f3259ab1f226010624fa5acb7eb9c6c211acf23aa7b61886632b1abded74c9a3786d85b52
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRn:Lz071uv4BPMkHC0IlnASEx/RiN9Rn
MD5 SHA1 SHA512 SSDEEP

Submit Download

NsyFkcj.exe

Path C:\Windows\System\NsyFkcj.exe
Size 1.5MB
SHA256 769b45cd166d93222357509d066018691e18f5e4302363e640d5fdfa2e81e700
MD5 a0caf1426ecd193db9bc8a5ce3cc84ca
SHA1 da8e5d8ec35b7fcf3f213f78d923076bf2b377a5
SHA512 ef2f50ad1730005a5090aac0cbc75547a6ae90e2769323ff327d05ff731ee83a9d2a90e7cb6ea7ad0695670acb1bdd812bffccf15f13c35d9c95722b49ee99d3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRD:Lz071uv4BPMkHC0IlnASEx/RiN9RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

OkaWlpc.exe

Path C:\Windows\System\OkaWlpc.exe
Size 1.5MB
SHA256 963329123a879938966f7f14c0b9b5435b49670c20c0a2ee57c99988322abb08
MD5 71cac8fc185c48e6cc05135eafc84471
SHA1 7797f53f748d67c6f221cf05f7570ad39efcf5d9
SHA512 00a9e5afd56a873eb8c678f7080169454dd0cb6db986c4ed8d77ff11a9a61b8ae15875a36a02925f73ae5d1599f7c536762d1bf0129ee75e2f161e98fe9e9532
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRo:Lz071uv4BPMkHC0IlnASEx/RiN9Ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

SAuoOlu.exe

Path C:\Windows\System\SAuoOlu.exe
Size 1.5MB
SHA256 bf917aa275214dde51b4a621db4eb6e3edc2b07f9e3d4389c645e41ed96e190d
MD5 21041688dcc8add10b26470727fbea99
SHA1 02251c26aac55c5b52b6a4dd98a9c9c0583daf09
SHA512 560d5fef13a56fbfb474cb19e6d81aec41e6c624f2e2f7c2a199178e66cb97dfb35ac2e50106e51e1ccee46b6d4a294cbdbff12b8e87db2e652bf6280caec4de
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRR:Lz071uv4BPMkHC0IlnASEx/RiN9RR
MD5 SHA1 SHA512 SSDEEP

Submit Download

SJtKEWf.exe

Path C:\Windows\System\SJtKEWf.exe
Size 1.5MB
SHA256 38618db13d417e01c63d40f6c509329f0a767352ff06d12f475ef38c4cef0e42
MD5 c7df30e9aeb7481f23088b3017d4c79c
SHA1 3a283b087b202affb3a01d6d7283b02828ce8f13
SHA512 7bec7a4c3b55e26cc82fd9891153a06c6740c3366183545da9410037e6b6150cd929a3273bc130a232db7243ac2c4183d56455fabb9adfc1d9255325571b20e5
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRV:Lz071uv4BPMkHC0IlnASEx/RiN9RV
MD5 SHA1 SHA512 SSDEEP

Submit Download

UnnwKDB.exe

Path C:\Windows\System\UnnwKDB.exe
Size 1.5MB
SHA256 8942751a05399b430cd39d2d625cb98ae8fc53c4f832c8ac3c934ff4566b9f38
MD5 e87d76e00ab2342fc012a245bc93079c
SHA1 6b2cf853a6a4314c5f3a4fb139f267f64487141d
SHA512 54ea8150dfad340f5563bc0fe72f371ed7145f65a01bc451e63d8d3da1d2834ecdfe6c36fa097de965e8e76c2967e70d32c5a94fb7bc01a526759871ad58756f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRg:Lz071uv4BPMkHC0IlnASEx/RiN9Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

WDciFlE.exe

Path C:\Windows\System\WDciFlE.exe
Size 1.5MB
SHA256 908db065f5ffa4e184a7f76fe43b1649ba1bed8da74d9b26c166c0ccb7b9ca2c
MD5 8db6fb26bce96e9bc7c06c654bd03624
SHA1 4df6639743934df5d729e34ac9520841e389b361
SHA512 37f073f8db7fbc2c7818c0b3f23bc2e1843f48e0f7720737851e30d9468d252dfb497d9283b071c0615a310636ec2c06d73270fafaf233a1c40bd1c55731a3db
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxR3:Lz071uv4BPMkHC0IlnASEx/RiN9R3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WTnYtqK.exe

Path C:\Windows\System\WTnYtqK.exe
Size 1.5MB
SHA256 cd0f4d53c54a86905d097567be9749b36e80d6cfb06cc75ba42fa0b5efed14cc
MD5 8677996fa12047bf59384e369ec03747
SHA1 4a1d94d47304c4f1f38e4b9408d853947ff63d06
SHA512 c5a5622e28362370b285102d03ff3fc510e414be8f869e93ea14a29059c439e7921c382e2aa2b78b681094e92aa0fbe97b5dd49006bec4a6e2b8224dc29aad70
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRD:Lz071uv4BPMkHC0IlnASEx/RiN9RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

WeQBOrC.exe

Path C:\Windows\System\WeQBOrC.exe
Size 1.5MB
SHA256 30ac408667082b3e95b85e82df2bf8af020bc7ea16ffaa9272ac62d3ff53c00f
MD5 b2ff7f1156036265efeba2d6ebdd0a20
SHA1 229387e08435263baed7564f4e6f49dc0c4e0923
SHA512 b4d52e4729d433028fab0eb2021ddb5152cf96cca71abdef2af16b293d6a601bd30c45701227fe8fc776877e77e2aa9925186a7df4fc921499bbd3670d08abae
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxR2:Lz071uv4BPMkHC0IlnASEx/RiN9R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

WhekzrO.exe

Path C:\Windows\System\WhekzrO.exe
Size 1.5MB
SHA256 af07464c2fd22e082468cfbc42c4a906c23dad1d129c1fcb9532c26db4d5c323
MD5 e236dcd37792803862fc00fa8cc4c755
SHA1 c78b9e78a79a5fbb01e3beb414c05c328346519a
SHA512 207073bd57a565d08d6b2d96e9fc51512fd6a973a5700e0a5397b5c7550ca9eae098dd6ecd05b602b1722829aaa2db46d45400d68e24db31030e1595b78c6ba8
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRY:Lz071uv4BPMkHC0IlnASEx/RiN9RY
MD5 SHA1 SHA512 SSDEEP

Submit Download

XvbZyOF.exe

Path C:\Windows\System\XvbZyOF.exe
Size 1.5MB
SHA256 d71eeee4d438ea4d04d3e10062ed27cfd66a765d52a7c45b3bc50788266d88ec
MD5 dcc32c84f1ece35910fd8f8e2ef8ed21
SHA1 e40a024c45ddae537714ceaa51abe1353b3b29ac
SHA512 d7266aeb3ceecc7b32db91ced639c421ef3e1f0ef3916a0753b14d3abaebd8dbb7e12d2a0cc50c98545eade3a8fea2da6a8ae9be432469f979a17ee9435cf3be
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRh:Lz071uv4BPMkHC0IlnASEx/RiN9Rh
MD5 SHA1 SHA512 SSDEEP

Submit Download

YNPVpkA.exe

Path C:\Windows\System\YNPVpkA.exe
Size 1.5MB
SHA256 ea2f1f7dae8ec631ec0dc5e7d8a33dd834e76e91db7b0bec96f273c6786cc74c
MD5 aa1a4273f1c61ab27d19fe7d9a6d619f
SHA1 2826b5300335c4fb40589b96b0527dd5d4352041
SHA512 0697507d95ab15469ced474623c3fd41dc57d7f8b899703d4fcd1a1c2b3c9112501c56a064116db56e8e162709684efb61902239235393269ef316bb4d120246
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRE:Lz071uv4BPMkHC0IlnASEx/RiN9RE
MD5 SHA1 SHA512 SSDEEP

Submit Download

YqfoEGV.exe

Path C:\Windows\System\YqfoEGV.exe
Size 1.5MB
SHA256 ab5318957fa230d9fec8d1e57cd8f4df66105ef2ded37ffde3ea9b68ef9fdbd8
MD5 68913d707ed80f1512d5cd7d9a73fa61
SHA1 2dc74bc933029a805af8a70bb13af91df4ddc7fb
SHA512 fde8ff18ac8e9a96b22318cdde847042e930cbca87d189d5743ba8a8d487872f5d922cefc74cc1b5859281fcc059150f6a7b893fc50771f4004373fbfc597885
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRD:Lz071uv4BPMkHC0IlnASEx/RiN9RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZWvAUTj.exe

Path C:\Windows\System\ZWvAUTj.exe
Size 1.5MB
SHA256 b203dfbc5f6a146d35837ba62b18a3675132c9839d5f63887067e3cca5d80662
MD5 9ce94afe44121d37a527b9b866db1d50
SHA1 b7e86dedef9bb678a5d07903460031d9fab1477e
SHA512 ad1e8d70b7515b34526ad5511eecd10b731bc111759d88211a8fca84ffb052e2e86c36a8daf696e3daf5e7f7579ea36ebaad0a2f19ca63267f67f92704a98ba3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRw:Lz071uv4BPMkHC0IlnASEx/RiN9Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZkHnApY.exe

Path C:\Windows\System\ZkHnApY.exe
Size 1.5MB
SHA256 5f9d0aa3c6539072564023d94997fc6bf911657d997ed651fb0a28c516c72104
MD5 679037538483c90d959eda7186b15895
SHA1 c382bce8f7bf8b5997cfe5f1ed3a81299554d72e
SHA512 d576a1bca42435a973f56939d608dcda16472e93e6a54e0bbc051d3e821e487c36a53801158fef947f24f4b608ef97ead4c8f291583196b616c6166c89538d4b
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRNE:Lz071uv4BPMkHC0IlnASEx/RiN9Ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

derLtZX.exe

Path C:\Windows\System\derLtZX.exe
Size 1.5MB
SHA256 aeda38a48b4b78342069a056fb74885b6a968fbc7e96b1c9b842f637054d930c
MD5 0da7e3b0de8919557df3b93f4edc57ca
SHA1 47b525b944a9d5df96874c3ea188aeee1faeecf5
SHA512 0a14c58acf3e9ed1d4990bc9bd8ad7ae2dd7ff35769dcd3466b36704b01a4fab2372d85ddf022c5ab3d19ab33daa278a0f9703f0c02784ac17940514872deccf
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRw:Lz071uv4BPMkHC0IlnASEx/RiN9Rw
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpWqvMQ.exe

Path C:\Windows\System\jpWqvMQ.exe
Size 1.5MB
SHA256 ff5b07932bd57d14802cd146c4751e627b63c0fff0f997da490357e2192f318f
MD5 a1fa2bcb6116a5f47b6add699e6e86e6
SHA1 b187fda3d835e06a272b6ad01ea32fef466bdacf
SHA512 770641539266fb2606f89179abffb0d959a0ffd919f44220f1c1d95588d35380a81b08daa00f233aacb31e3d4ca55be89f5d187f1b58da2160b192ef1a69fce7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRTo:Lz071uv4BPMkHC0IlnASEx/RiN9Rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

kyyXTUM.exe

Path C:\Windows\System\kyyXTUM.exe
Size 1.5MB
SHA256 913392933f128a7e5a7219743d073a0040e5f0d1af933e4eaa00c34dd5b1579b
MD5 e6eb8dd9d3b0a9286cddf7e69b4a5d3a
SHA1 d4a389fe27c5f8a0bc12aa19ed0e4f714ee1a8b6
SHA512 3f7f04d30af17e436946710d17f81f66bae0886fbad1879831dde2b55937ae4d56d8e8d4f6ac80ac42ffbe29b66af60c3d4a3cccdbd508f7eb00d4ef2d94581c
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRN:Lz071uv4BPMkHC0IlnASEx/RiN9RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

maPHctu.exe

Path C:\Windows\System\maPHctu.exe
Size 1.5MB
SHA256 dbd9c4daa5125ae377a24a1359dcb552a07d99bc3ed5bb3281af999fdcf6ff2c
MD5 7dcde38fc33245f517763fc35412d900
SHA1 c606aa39b8fb24cb0167e2dd4686d05e5f8b6c7c
SHA512 18d82a909b6034720c0a978ea412d486cd054c15de2bba5c40e8c07057699add7c802c6c33e9989949bacd3f6f163a785dca59218a5c6aaec5cafbd2ae1810d9
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRJF:Lz071uv4BPMkHC0IlnASEx/RiN9R/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdpiEjs.exe

Path C:\Windows\System\mdpiEjs.exe
Size 1.5MB
SHA256 f65db7ac6d23d536f362c3c54ce837271c2ec9eb2848fdfcee2e1a7ade28c20e
MD5 cbb21f1327535690dcb6ff7b7588cf78
SHA1 8fe550cb9fdbd81e71457d0f4fa832b1858fa0d1
SHA512 46611c8f50ef61bbdf685710d1e5494c1841c22a5e4b82f92c81c3d7b6de08bdd7e9219283118e39f148161310649b0205e651563ff16c1a2957f031a0c404ca
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRa:Lz071uv4BPMkHC0IlnASEx/RiN9Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

oNwryAJ.exe

Path C:\Windows\System\oNwryAJ.exe
Size 1.5MB
SHA256 1942fab40a92cae6d07d342739bce4093fce1a37edf4bef7d37dd3aead7ad401
MD5 28a118e475a4ab7e7be9f67beffec115
SHA1 a316a61b30176e054f229d529b4122c78b33d81b
SHA512 0f1985fad48a418c177a2b34d5782e245f2670bfbe6d082d89fe59a37b277a096c3ad2d4fe57492fcce88e1ec5af6ce0f242d1a791fad69603583ed61cd70f53
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRUi:Lz071uv4BPMkHC0IlnASEx/RiN9RUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

qhWNqnv.exe

Path C:\Windows\System\qhWNqnv.exe
Size 1.5MB
SHA256 562761fe81e7da21348dca23ba64f8247c6c91a9fd9502bcc1d998581aeeebe2
MD5 3906fa600c354f85d007b900c762a573
SHA1 2cb447b28f11e2ef0659c846e286df8f88062ad0
SHA512 a0fd106d85cda66e4ea8d7b37be24bf438728ed2602495c8d64ac502cb5df4ec9f801f87892848fb7efd1457e471839361fa29923d55bb0e88df18bdb64b4b05
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRp:Lz071uv4BPMkHC0IlnASEx/RiN9Rp
MD5 SHA1 SHA512 SSDEEP

Submit Download

qjBvCfR.exe

Path C:\Windows\System\qjBvCfR.exe
Size 1.5MB
SHA256 a5a2cbf965c79ae5f5cafc0cb276b434995d235b0157d15d9a46779d655f7c58
MD5 daaada0bd1c57d752bad73e0f181b5f3
SHA1 222ac5109babbc3d4b52714d88f3ee2a625a6c3d
SHA512 603994b8d6722c15e8257587d6c517106248c16c973cde86abfaa76f7589daa34dd545ebd9234f45a80c29f9b2e80dd699f05367d1e39489b6baea96a76fd394
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRa:Lz071uv4BPMkHC0IlnASEx/RiN9Ra
MD5 SHA1 SHA512 SSDEEP

Submit Download

tBXJqFI.exe

Path C:\Windows\System\tBXJqFI.exe
Size 1.5MB
SHA256 df47be379113971bb2bc522cf73f0bc63ea858535f5f4245eb5f217498a8fcb5
MD5 2b6ca88c6c80ab0c84861749955fde62
SHA1 b68f1cb00359b1945da593b860498e224d40ec4c
SHA512 d7be0ba441253fa254f6ba5c22eb9af66bc4b658b269330e95d76a3db83ca4a2376c63156fa011fd0ff43a8707e0443258942ca8b9bbadab4050536f22420427
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxR44:Lz071uv4BPMkHC0IlnASEx/RiN9RN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tBtakAs.exe

Path C:\Windows\System\tBtakAs.exe
Size 1.5MB
SHA256 f36e402d413779cb64a2270149c1e0c3dab64ab490689a6e004aa5c71a554490
MD5 862350f0248e428a882a117677c96728
SHA1 b5cde0d92ecd5dfd60a7ddc3ba660675ba0a4f4d
SHA512 97a4887f49fe42f04b61fe6a85a5eb55471394bbc9a2fbef0e813357278a5b17535b9b5f2aa478fe01e27554299ddc21622e1cc99725d250127e45496f1fc9f7
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRY:Lz071uv4BPMkHC0IlnASEx/RiN9RY
MD5 SHA1 SHA512 SSDEEP

Submit Download

unEVwZu.exe

Path C:\Windows\System\unEVwZu.exe
Size 1.5MB
SHA256 efc8c9b0e278e1918a011a38cf0fe899066106859fb53ea22004197c46b9399d
MD5 d74f356032190ede410edbb1fe9d4593
SHA1 a55ad38a7aa65c6aa40c7a11a3bc90bc76e0588b
SHA512 85053329b77d70682c928febbf6ce2d612eb37ddcb7e751fbd48102d4a103960a861a8838a7d398d493ce1f54ba3b45b9a6772ad77a4c6a6efffbcfb5153d6dd
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRB:Lz071uv4BPMkHC0IlnASEx/RiN9RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

xNvxBnr.exe

Path C:\Windows\System\xNvxBnr.exe
Size 1.5MB
SHA256 a2212ad57808592ad386b8629240f3ccd4d85d972acd3b6c5324e2794299a921
MD5 2d774d8b9d037a8c8435f4215aaafb60
SHA1 94b3f2b2f4e09c7a0d1afa8a091ace1f3d9d89fb
SHA512 ddc6976d8553f670c1ce2d3916d440edb588e9f797bc11d146b772cc32b761baa0d2b36ce1315749504826ba50d743d50f74246e48194dc08cb0c4de0678ec0d
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRM:Lz071uv4BPMkHC0IlnASEx/RiN9RM
MD5 SHA1 SHA512 SSDEEP

Submit Download

xPajFNc.exe

Path C:\Windows\System\xPajFNc.exe
Size 1.5MB
SHA256 494f8f7dba39501e23657c3c03aea1555fde3a4283ab9375238217a8ce56ee0f
MD5 bc7e074c3990886eb9fcc779af3be8ea
SHA1 0d9775695b33846347e8fe523450aff7520f8ec8
SHA512 5269911ca8c660d06e280e20673c8c4c1de65a62b087423bb7454dde1e77b472d8ab07dcc9f0a293d335dde03af42878ec8b8f66568717bd2fcecbe8e7859fb3
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxR2:Lz071uv4BPMkHC0IlnASEx/RiN9R2
MD5 SHA1 SHA512 SSDEEP

Submit Download

xbkyuVm.exe

Path C:\Windows\System\xbkyuVm.exe
Size 1.5MB
SHA256 99902943dc84a9e43bed0b7d18477f273d97f7f12d2399fb749d98375c6c13e2
MD5 9672846431378ec7d697ba3d37e938f6
SHA1 dec2b66ddab8e7a2511b5a92357c6bb589fa70b7
SHA512 16fd6e940dba6918c0630fea552a694849800019812ae055757a012f9db4ae9a2b9883a7376ce9a6ccb3776997a786010165a5bae19076376ffc96fc69ff4b6f
SSDEEP 24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRQNqadxRg:Lz071uv4BPMkHC0IlnASEx/RiN9Rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/380-1-0x00000212842D0000-0x00000212842E0000-memory.dmp

Download

memory/380-0-0x00007FF6ECC80000-0x00007FF6ED072000-memory.dmp

Download

memory/708-302-0x00007FF71F7D0000-0x00007FF71FBC2000-memory.dmp

Download

memory/708-3051-0x00007FF71F7D0000-0x00007FF71FBC2000-memory.dmp

Download

memory/864-303-0x00007FF7F7A10000-0x00007FF7F7E02000-memory.dmp

Download

memory/864-3079-0x00007FF7F7A10000-0x00007FF7F7E02000-memory.dmp

Download

memory/916-311-0x00007FF7990D0000-0x00007FF7994C2000-memory.dmp

Download

memory/916-3081-0x00007FF7990D0000-0x00007FF7994C2000-memory.dmp

Download

memory/1312-3038-0x00007FF6588A0000-0x00007FF658C92000-memory.dmp

Download

memory/1312-297-0x00007FF6588A0000-0x00007FF658C92000-memory.dmp

Download

memory/1644-304-0x00007FF7D6F50000-0x00007FF7D7342000-memory.dmp

Download

memory/1644-3064-0x00007FF7D6F50000-0x00007FF7D7342000-memory.dmp

Download

memory/1748-308-0x00007FF7D1930000-0x00007FF7D1D22000-memory.dmp

Download

memory/1748-3087-0x00007FF7D1930000-0x00007FF7D1D22000-memory.dmp

Download

memory/2160-301-0x00007FF7A6D60000-0x00007FF7A7152000-memory.dmp

Download

memory/2160-3040-0x00007FF7A6D60000-0x00007FF7A7152000-memory.dmp

Download

memory/2336-127-0x00007FF731200000-0x00007FF7315F2000-memory.dmp

Download

memory/2336-3030-0x00007FF731200000-0x00007FF7315F2000-memory.dmp

Download

memory/2600-307-0x00007FF63E880000-0x00007FF63EC72000-memory.dmp

Download

memory/2600-3068-0x00007FF63E880000-0x00007FF63EC72000-memory.dmp

Download

memory/2928-312-0x00007FF6CD2C0000-0x00007FF6CD6B2000-memory.dmp

Download

memory/2928-3062-0x00007FF6CD2C0000-0x00007FF6CD6B2000-memory.dmp

Download

memory/3140-3083-0x00007FF6F3A00000-0x00007FF6F3DF2000-memory.dmp

Download

memory/3140-310-0x00007FF6F3A00000-0x00007FF6F3DF2000-memory.dmp

Download

memory/3152-306-0x00007FF61D200000-0x00007FF61D5F2000-memory.dmp

Download

memory/3152-3069-0x00007FF61D200000-0x00007FF61D5F2000-memory.dmp

Download

memory/3156-3033-0x00007FF6FCE20000-0x00007FF6FD212000-memory.dmp

Download

memory/3156-150-0x00007FF6FCE20000-0x00007FF6FD212000-memory.dmp

Download

memory/3412-3063-0x00007FF7ECE90000-0x00007FF7ED282000-memory.dmp

Download

memory/3412-305-0x00007FF7ECE90000-0x00007FF7ED282000-memory.dmp

Download

memory/3416-3034-0x00007FF70CDF0000-0x00007FF70D1E2000-memory.dmp

Download

memory/3416-269-0x00007FF70CDF0000-0x00007FF70D1E2000-memory.dmp

Download

memory/3948-3020-0x00007FF6A6E20000-0x00007FF6A7212000-memory.dmp

Download

memory/3948-314-0x00007FF6A6E20000-0x00007FF6A7212000-memory.dmp

Download

memory/4072-3052-0x00007FF6FF760000-0x00007FF6FFB52000-memory.dmp

Download

memory/4072-313-0x00007FF6FF760000-0x00007FF6FFB52000-memory.dmp

Download

memory/4376-299-0x00007FF6FC950000-0x00007FF6FCD42000-memory.dmp

Download

memory/4376-3050-0x00007FF6FC950000-0x00007FF6FCD42000-memory.dmp

Download

memory/4532-315-0x00007FF7A7E00000-0x00007FF7A81F2000-memory.dmp

Download

memory/4532-3042-0x00007FF7A7E00000-0x00007FF7A81F2000-memory.dmp

Download

memory/4620-309-0x00007FF7BF3B0000-0x00007FF7BF7A2000-memory.dmp

Download

memory/4620-3085-0x00007FF7BF3B0000-0x00007FF7BF7A2000-memory.dmp

Download

memory/4756-300-0x00007FF77C230000-0x00007FF77C622000-memory.dmp

Download

memory/4756-3044-0x00007FF77C230000-0x00007FF77C622000-memory.dmp

Download

memory/4812-2987-0x00007FF6AC340000-0x00007FF6AC732000-memory.dmp

Download

memory/4812-19-0x00007FF6AC340000-0x00007FF6AC732000-memory.dmp

Download

memory/4940-20-0x00007FF942E73000-0x00007FF942E75000-memory.dmp

Download

memory/4940-208-0x00007FF942E70000-0x00007FF943931000-memory.dmp

Download

memory/4940-167-0x0000024F7AC50000-0x0000024F7AC72000-memory.dmp

Download

memory/4940-89-0x00007FF942E70000-0x00007FF943931000-memory.dmp

Download

memory/5044-298-0x00007FF738570000-0x00007FF738962000-memory.dmp

Download

memory/5044-3049-0x00007FF738570000-0x00007FF738962000-memory.dmp

Download

memory/5088-296-0x00007FF63ED80000-0x00007FF63F172000-memory.dmp

Download

memory/5088-3036-0x00007FF63ED80000-0x00007FF63F172000-memory.dmp

Download