xmrig | 1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123

Analysis

max time kernel
91s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 23:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
Size

1.7MB
MD5

241287779d87331adb634cead9b5f3b0
SHA1

f8e4f7f4a3951bc3ea5487552b6f22b49dd7c98c
SHA256

1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123
SHA512

c9a8d20388d7e856020e899678ea0fed5fa2674354fbd7219199787b266fe1c08d335e2cad19966e1c52cf834a0ab438b9b20ab8bebfc77d9980bbb0449c7a25
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYL+t6kw2bPUyYaKXgXScSFA9JtM:Lz071uv4BPMkibTIA5LDGTUXaDm0K

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 50 IoCs

miner

resource	yara_rule
behavioral2/memory/3640-18-0x00007FF768470000-0x00007FF768862000-memory.dmp	xmrig
behavioral2/memory/2368-573-0x00007FF6921B0000-0x00007FF6925A2000-memory.dmp	xmrig
behavioral2/memory/2248-684-0x00007FF774430000-0x00007FF774822000-memory.dmp	xmrig
behavioral2/memory/3644-687-0x00007FF614BA0000-0x00007FF614F92000-memory.dmp	xmrig
behavioral2/memory/3440-689-0x00007FF7F8D60000-0x00007FF7F9152000-memory.dmp	xmrig
behavioral2/memory/4344-688-0x00007FF6AEF50000-0x00007FF6AF342000-memory.dmp	xmrig
behavioral2/memory/864-685-0x00007FF74E4B0000-0x00007FF74E8A2000-memory.dmp	xmrig
behavioral2/memory/2064-683-0x00007FF612BE0000-0x00007FF612FD2000-memory.dmp	xmrig
behavioral2/memory/4660-681-0x00007FF628780000-0x00007FF628B72000-memory.dmp	xmrig
behavioral2/memory/4908-472-0x00007FF62AD50000-0x00007FF62B142000-memory.dmp	xmrig
behavioral2/memory/2196-467-0x00007FF7AEE60000-0x00007FF7AF252000-memory.dmp	xmrig
behavioral2/memory/3656-377-0x00007FF77B400000-0x00007FF77B7F2000-memory.dmp	xmrig
behavioral2/memory/3632-332-0x00007FF66DEC0000-0x00007FF66E2B2000-memory.dmp	xmrig
behavioral2/memory/4700-331-0x00007FF7172B0000-0x00007FF7176A2000-memory.dmp	xmrig
behavioral2/memory/608-291-0x00007FF7F53E0000-0x00007FF7F57D2000-memory.dmp	xmrig
behavioral2/memory/2664-233-0x00007FF7F18D0000-0x00007FF7F1CC2000-memory.dmp	xmrig
behavioral2/memory/2416-230-0x00007FF6DB760000-0x00007FF6DBB52000-memory.dmp	xmrig
behavioral2/memory/3212-197-0x00007FF78ABE0000-0x00007FF78AFD2000-memory.dmp	xmrig
behavioral2/memory/2712-147-0x00007FF7E03E0000-0x00007FF7E07D2000-memory.dmp	xmrig
behavioral2/memory/3164-36-0x00007FF7BA300000-0x00007FF7BA6F2000-memory.dmp	xmrig
behavioral2/memory/3164-2640-0x00007FF7BA300000-0x00007FF7BA6F2000-memory.dmp	xmrig
behavioral2/memory/4616-2641-0x00007FF6BF5F0000-0x00007FF6BF9E2000-memory.dmp	xmrig
behavioral2/memory/2296-2643-0x00007FF605A90000-0x00007FF605E82000-memory.dmp	xmrig
behavioral2/memory/3692-2642-0x00007FF76B1F0000-0x00007FF76B5E2000-memory.dmp	xmrig
behavioral2/memory/3640-2676-0x00007FF768470000-0x00007FF768862000-memory.dmp	xmrig
behavioral2/memory/3164-2681-0x00007FF7BA300000-0x00007FF7BA6F2000-memory.dmp	xmrig
behavioral2/memory/3288-2677-0x00007FF7875D0000-0x00007FF7879C2000-memory.dmp	xmrig
behavioral2/memory/3640-2679-0x00007FF768470000-0x00007FF768862000-memory.dmp	xmrig
behavioral2/memory/2712-2685-0x00007FF7E03E0000-0x00007FF7E07D2000-memory.dmp	xmrig
behavioral2/memory/4616-2694-0x00007FF6BF5F0000-0x00007FF6BF9E2000-memory.dmp	xmrig
behavioral2/memory/3644-2707-0x00007FF614BA0000-0x00007FF614F92000-memory.dmp	xmrig
behavioral2/memory/3632-2710-0x00007FF66DEC0000-0x00007FF66E2B2000-memory.dmp	xmrig
behavioral2/memory/608-2740-0x00007FF7F53E0000-0x00007FF7F57D2000-memory.dmp	xmrig
behavioral2/memory/2368-2748-0x00007FF6921B0000-0x00007FF6925A2000-memory.dmp	xmrig
behavioral2/memory/4908-2746-0x00007FF62AD50000-0x00007FF62B142000-memory.dmp	xmrig
behavioral2/memory/2196-2744-0x00007FF7AEE60000-0x00007FF7AF252000-memory.dmp	xmrig
behavioral2/memory/3656-2743-0x00007FF77B400000-0x00007FF77B7F2000-memory.dmp	xmrig
behavioral2/memory/4700-2738-0x00007FF7172B0000-0x00007FF7176A2000-memory.dmp	xmrig
behavioral2/memory/2664-2736-0x00007FF7F18D0000-0x00007FF7F1CC2000-memory.dmp	xmrig
behavioral2/memory/4344-2734-0x00007FF6AEF50000-0x00007FF6AF342000-memory.dmp	xmrig
behavioral2/memory/2416-2726-0x00007FF6DB760000-0x00007FF6DBB52000-memory.dmp	xmrig
behavioral2/memory/3212-2721-0x00007FF78ABE0000-0x00007FF78AFD2000-memory.dmp	xmrig
behavioral2/memory/3692-2718-0x00007FF76B1F0000-0x00007FF76B5E2000-memory.dmp	xmrig
behavioral2/memory/2296-2716-0x00007FF605A90000-0x00007FF605E82000-memory.dmp	xmrig
behavioral2/memory/3288-2701-0x00007FF7875D0000-0x00007FF7879C2000-memory.dmp	xmrig
behavioral2/memory/4660-2770-0x00007FF628780000-0x00007FF628B72000-memory.dmp	xmrig
behavioral2/memory/864-2780-0x00007FF74E4B0000-0x00007FF74E8A2000-memory.dmp	xmrig
behavioral2/memory/2248-2773-0x00007FF774430000-0x00007FF774822000-memory.dmp	xmrig
behavioral2/memory/3440-2772-0x00007FF7F8D60000-0x00007FF7F9152000-memory.dmp	xmrig
behavioral2/memory/2064-2771-0x00007FF612BE0000-0x00007FF612FD2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2600	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3640	rSvcCBA.exe
3164	AvXQDlq.exe
3288	ZYzvRvH.exe
4616	NmdeyyH.exe
3692	TEjyEWj.exe
2296	EaMChiH.exe
2712	KqImMap.exe
3644	ixcUJoD.exe
3212	jCnNvrm.exe
2416	gpToviq.exe
2664	pQetomC.exe
608	JuGejUs.exe
4700	WwNZCGI.exe
3632	WpNIIsF.exe
4344	hzSRzNe.exe
3656	aMMvswH.exe
2196	AqBpgFM.exe
4908	EGEPsSv.exe
2368	sWGrSpX.exe
4660	fuAwAUM.exe
3440	NDsBiph.exe
2064	HzETGSw.exe
2248	qBRSWUD.exe
864	NSUTNqc.exe
5088	PiDhLwx.exe
3836	nFMiJoh.exe
4204	XPenzce.exe
3336	asDWBDA.exe
1352	GNjwsma.exe
3848	UQGPNSX.exe
396	xhExnOP.exe
2104	SsPBYWF.exe
2000	jZFnDIC.exe
4708	KZtWPEE.exe
4284	TrYrLac.exe
4968	EJgpjUq.exe
4860	EJaYTEP.exe
1316	FbxgLfz.exe
3036	rKxtTsU.exe
3844	VEJHeSV.exe
4152	bSEOeDQ.exe
4704	jJnRwoD.exe
3648	RkQSlSf.exe
1596	PYRBqME.exe
3452	YiDIoUW.exe
2440	Qebznuj.exe
2028	EIgXfAV.exe
3292	dsPGjuM.exe
1276	LAskTKq.exe
3668	TgbAvRR.exe
4576	emrAAEU.exe
5028	CnqCnUY.exe
3696	DqAaqxN.exe
4164	VxFbiAA.exe
5072	YzzWAkr.exe
2872	RVBwTBR.exe
4804	aoFFSdd.exe
1444	GWtiGUh.exe
4064	XJjYIVP.exe
5112	WnEiwRz.exe
4956	mKuIcpU.exe
3132	QRksKtv.exe
3936	URjUVHU.exe
4528	IzwCdSl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3752-0-0x00007FF7DE4E0000-0x00007FF7DE8D2000-memory.dmp	upx
behavioral2/files/0x0007000000023412-6.dat	upx
behavioral2/files/0x000700000002327a-8.dat	upx
behavioral2/files/0x0007000000023415-32.dat	upx
behavioral2/files/0x0007000000023414-31.dat	upx
behavioral2/files/0x0007000000023418-46.dat	upx
behavioral2/files/0x0007000000023413-28.dat	upx
behavioral2/files/0x0007000000023417-39.dat	upx
behavioral2/memory/3640-18-0x00007FF768470000-0x00007FF768862000-memory.dmp	upx
behavioral2/files/0x000700000002342e-150.dat	upx
behavioral2/files/0x0007000000023437-190.dat	upx
behavioral2/memory/2368-573-0x00007FF6921B0000-0x00007FF6925A2000-memory.dmp	upx
behavioral2/memory/2248-684-0x00007FF774430000-0x00007FF774822000-memory.dmp	upx
behavioral2/memory/3644-687-0x00007FF614BA0000-0x00007FF614F92000-memory.dmp	upx
behavioral2/memory/3440-689-0x00007FF7F8D60000-0x00007FF7F9152000-memory.dmp	upx
behavioral2/memory/4344-688-0x00007FF6AEF50000-0x00007FF6AF342000-memory.dmp	upx
behavioral2/memory/864-685-0x00007FF74E4B0000-0x00007FF74E8A2000-memory.dmp	upx
behavioral2/memory/2064-683-0x00007FF612BE0000-0x00007FF612FD2000-memory.dmp	upx
behavioral2/memory/4660-681-0x00007FF628780000-0x00007FF628B72000-memory.dmp	upx
behavioral2/memory/4908-472-0x00007FF62AD50000-0x00007FF62B142000-memory.dmp	upx
behavioral2/memory/2196-467-0x00007FF7AEE60000-0x00007FF7AF252000-memory.dmp	upx
behavioral2/memory/3656-377-0x00007FF77B400000-0x00007FF77B7F2000-memory.dmp	upx
behavioral2/memory/3632-332-0x00007FF66DEC0000-0x00007FF66E2B2000-memory.dmp	upx
behavioral2/memory/4700-331-0x00007FF7172B0000-0x00007FF7176A2000-memory.dmp	upx
behavioral2/memory/608-291-0x00007FF7F53E0000-0x00007FF7F57D2000-memory.dmp	upx
behavioral2/memory/2664-233-0x00007FF7F18D0000-0x00007FF7F1CC2000-memory.dmp	upx
behavioral2/memory/2416-230-0x00007FF6DB760000-0x00007FF6DBB52000-memory.dmp	upx
behavioral2/files/0x000700000002343a-206.dat	upx
behavioral2/files/0x0007000000023439-205.dat	upx
behavioral2/files/0x0007000000023438-200.dat	upx
behavioral2/files/0x0007000000023425-193.dat	upx
behavioral2/files/0x0007000000023436-187.dat	upx
behavioral2/files/0x0007000000023435-183.dat	upx
behavioral2/files/0x0007000000023423-179.dat	upx
behavioral2/files/0x0007000000023422-176.dat	upx
behavioral2/files/0x0007000000023434-175.dat	upx
behavioral2/files/0x0007000000023421-171.dat	upx
behavioral2/files/0x0007000000023433-170.dat	upx
behavioral2/files/0x0007000000023420-161.dat	upx
behavioral2/files/0x000700000002341f-156.dat	upx
behavioral2/memory/3212-197-0x00007FF78ABE0000-0x00007FF78AFD2000-memory.dmp	upx
behavioral2/files/0x0007000000023431-153.dat	upx
behavioral2/files/0x0007000000023430-152.dat	upx
behavioral2/files/0x000700000002342f-151.dat	upx
behavioral2/files/0x000700000002342d-149.dat	upx
behavioral2/memory/2712-147-0x00007FF7E03E0000-0x00007FF7E07D2000-memory.dmp	upx
behavioral2/files/0x000700000002342c-142.dat	upx
behavioral2/files/0x000700000002342b-141.dat	upx
behavioral2/files/0x000700000002342a-140.dat	upx
behavioral2/files/0x0007000000023429-139.dat	upx
behavioral2/files/0x0007000000023428-137.dat	upx
behavioral2/files/0x0007000000023427-136.dat	upx
behavioral2/files/0x0007000000023426-133.dat	upx
behavioral2/files/0x000700000002341b-131.dat	upx
behavioral2/files/0x0007000000023432-155.dat	upx
behavioral2/files/0x000700000002341a-123.dat	upx
behavioral2/files/0x000700000002341e-119.dat	upx
behavioral2/files/0x0007000000023416-114.dat	upx
behavioral2/files/0x0007000000023419-107.dat	upx
behavioral2/memory/2296-100-0x00007FF605A90000-0x00007FF605E82000-memory.dmp	upx
behavioral2/memory/3692-93-0x00007FF76B1F0000-0x00007FF76B5E2000-memory.dmp	upx
behavioral2/files/0x0007000000023424-138.dat	upx
behavioral2/files/0x000700000002341d-85.dat	upx
behavioral2/files/0x000700000002341c-127.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DSVLpBU.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\dNDlxZA.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\xVsnfaT.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\GNjwsma.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\BDwIYar.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\KiNpHGZ.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\vJnYxGK.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\ATJcAVJ.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\BpfBTNC.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\JmzaNAB.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\uZDVkIR.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\tvejNKo.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\qbBucUp.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\oFJQIrd.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\ZdoLxhV.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\xLXwrfZ.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\ZtoROfo.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\hKRJXQI.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\CqyUQNL.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\FhsiPbg.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\EEAgaCQ.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\pRJzgCQ.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\fLWQfti.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\EXhOiyf.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\XlTXwFM.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\TQlCuHX.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\HOQQnaP.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\ZUtOgqP.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\xnslnYD.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\wpCglIB.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\rSvcCBA.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\hVQoudt.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\eGPvIjv.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\VEJHeSV.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\SOOKxNi.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\NgZAEGL.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\zjDpltL.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\WJzRlfy.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\OhoCdKN.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\poEloBa.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\BLlyYDb.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\dSscqCu.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\TeRpnBe.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\hfzeRHQ.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\EJaYTEP.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\zlvMcWq.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\fRqpMoP.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\LWtpJlU.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\aTxqrsK.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\nWtdkxd.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\kHJeRQL.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\eOIHinx.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\iHDyHzS.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\dcVMbvR.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\NwgSTyQ.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\waXdSqA.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\KsRiNNk.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\DbrRIDk.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\cXRHAjw.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\pwfyzYe.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\dNOQWeW.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\oYKmsjP.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\HhUqfdr.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
File created	C:\Windows\System\MdGViLu.exe	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2600	powershell.exe
2600	powershell.exe
2600	powershell.exe
2600	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeLockMemoryPrivilege	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 2600	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	83
PID 3752 wrote to memory of 2600	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	83
PID 3752 wrote to memory of 3164	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	84
PID 3752 wrote to memory of 3164	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	84
PID 3752 wrote to memory of 3640	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	85
PID 3752 wrote to memory of 3640	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	85
PID 3752 wrote to memory of 3288	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	86
PID 3752 wrote to memory of 3288	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	86
PID 3752 wrote to memory of 4616	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	87
PID 3752 wrote to memory of 4616	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	87
PID 3752 wrote to memory of 3692	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	88
PID 3752 wrote to memory of 3692	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	88
PID 3752 wrote to memory of 2296	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	89
PID 3752 wrote to memory of 2296	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	89
PID 3752 wrote to memory of 2416	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	90
PID 3752 wrote to memory of 2416	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	90
PID 3752 wrote to memory of 2712	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	91
PID 3752 wrote to memory of 2712	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	91
PID 3752 wrote to memory of 3644	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	92
PID 3752 wrote to memory of 3644	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	92
PID 3752 wrote to memory of 3212	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	93
PID 3752 wrote to memory of 3212	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	93
PID 3752 wrote to memory of 2664	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	94
PID 3752 wrote to memory of 2664	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	94
PID 3752 wrote to memory of 608	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	95
PID 3752 wrote to memory of 608	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	95
PID 3752 wrote to memory of 4700	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	96
PID 3752 wrote to memory of 4700	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	96
PID 3752 wrote to memory of 3632	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	97
PID 3752 wrote to memory of 3632	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	97
PID 3752 wrote to memory of 4344	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	98
PID 3752 wrote to memory of 4344	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	98
PID 3752 wrote to memory of 3656	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	99
PID 3752 wrote to memory of 3656	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	99
PID 3752 wrote to memory of 2196	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	100
PID 3752 wrote to memory of 2196	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	100
PID 3752 wrote to memory of 4908	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	101
PID 3752 wrote to memory of 4908	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	101
PID 3752 wrote to memory of 2368	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	102
PID 3752 wrote to memory of 2368	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	102
PID 3752 wrote to memory of 4660	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	103
PID 3752 wrote to memory of 4660	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	103
PID 3752 wrote to memory of 5088	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	104
PID 3752 wrote to memory of 5088	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	104
PID 3752 wrote to memory of 3440	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	105
PID 3752 wrote to memory of 3440	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	105
PID 3752 wrote to memory of 2064	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	106
PID 3752 wrote to memory of 2064	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	106
PID 3752 wrote to memory of 2248	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	107
PID 3752 wrote to memory of 2248	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	107
PID 3752 wrote to memory of 864	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	108
PID 3752 wrote to memory of 864	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	108
PID 3752 wrote to memory of 3836	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	109
PID 3752 wrote to memory of 3836	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	109
PID 3752 wrote to memory of 4204	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	110
PID 3752 wrote to memory of 4204	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	110
PID 3752 wrote to memory of 3336	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	111
PID 3752 wrote to memory of 3336	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	111
PID 3752 wrote to memory of 1352	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	112
PID 3752 wrote to memory of 1352	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	112
PID 3752 wrote to memory of 3848	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	113
PID 3752 wrote to memory of 3848	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	113
PID 3752 wrote to memory of 396	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	114
PID 3752 wrote to memory of 396	3752	1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1aba06e0b4836f242747ed74354e0dee36aa6641da3292440d52387630f7c123_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2600 -s 1652
    3⤵
    PID:7544
- C:\Windows\System\AvXQDlq.exe
  C:\Windows\System\AvXQDlq.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\rSvcCBA.exe
  C:\Windows\System\rSvcCBA.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\ZYzvRvH.exe
  C:\Windows\System\ZYzvRvH.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\NmdeyyH.exe
  C:\Windows\System\NmdeyyH.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\TEjyEWj.exe
  C:\Windows\System\TEjyEWj.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\EaMChiH.exe
  C:\Windows\System\EaMChiH.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\gpToviq.exe
  C:\Windows\System\gpToviq.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\KqImMap.exe
  C:\Windows\System\KqImMap.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\ixcUJoD.exe
  C:\Windows\System\ixcUJoD.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\jCnNvrm.exe
  C:\Windows\System\jCnNvrm.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\pQetomC.exe
  C:\Windows\System\pQetomC.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\JuGejUs.exe
  C:\Windows\System\JuGejUs.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\WwNZCGI.exe
  C:\Windows\System\WwNZCGI.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\WpNIIsF.exe
  C:\Windows\System\WpNIIsF.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\hzSRzNe.exe
  C:\Windows\System\hzSRzNe.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\aMMvswH.exe
  C:\Windows\System\aMMvswH.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\AqBpgFM.exe
  C:\Windows\System\AqBpgFM.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\EGEPsSv.exe
  C:\Windows\System\EGEPsSv.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\sWGrSpX.exe
  C:\Windows\System\sWGrSpX.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\fuAwAUM.exe
  C:\Windows\System\fuAwAUM.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\PiDhLwx.exe
  C:\Windows\System\PiDhLwx.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\NDsBiph.exe
  C:\Windows\System\NDsBiph.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\HzETGSw.exe
  C:\Windows\System\HzETGSw.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\qBRSWUD.exe
  C:\Windows\System\qBRSWUD.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\NSUTNqc.exe
  C:\Windows\System\NSUTNqc.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\nFMiJoh.exe
  C:\Windows\System\nFMiJoh.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\XPenzce.exe
  C:\Windows\System\XPenzce.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\asDWBDA.exe
  C:\Windows\System\asDWBDA.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\GNjwsma.exe
  C:\Windows\System\GNjwsma.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\UQGPNSX.exe
  C:\Windows\System\UQGPNSX.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\xhExnOP.exe
  C:\Windows\System\xhExnOP.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\SsPBYWF.exe
  C:\Windows\System\SsPBYWF.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\jZFnDIC.exe
  C:\Windows\System\jZFnDIC.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\KZtWPEE.exe
  C:\Windows\System\KZtWPEE.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\TrYrLac.exe
  C:\Windows\System\TrYrLac.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\EJgpjUq.exe
  C:\Windows\System\EJgpjUq.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\EJaYTEP.exe
  C:\Windows\System\EJaYTEP.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\FbxgLfz.exe
  C:\Windows\System\FbxgLfz.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\rKxtTsU.exe
  C:\Windows\System\rKxtTsU.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\VEJHeSV.exe
  C:\Windows\System\VEJHeSV.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\bSEOeDQ.exe
  C:\Windows\System\bSEOeDQ.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\jJnRwoD.exe
  C:\Windows\System\jJnRwoD.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\RkQSlSf.exe
  C:\Windows\System\RkQSlSf.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\PYRBqME.exe
  C:\Windows\System\PYRBqME.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\YiDIoUW.exe
  C:\Windows\System\YiDIoUW.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\Qebznuj.exe
  C:\Windows\System\Qebznuj.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\EIgXfAV.exe
  C:\Windows\System\EIgXfAV.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\dsPGjuM.exe
  C:\Windows\System\dsPGjuM.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\LAskTKq.exe
  C:\Windows\System\LAskTKq.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\WnEiwRz.exe
  C:\Windows\System\WnEiwRz.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\TgbAvRR.exe
  C:\Windows\System\TgbAvRR.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\QRksKtv.exe
  C:\Windows\System\QRksKtv.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\emrAAEU.exe
  C:\Windows\System\emrAAEU.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\CnqCnUY.exe
  C:\Windows\System\CnqCnUY.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\DqAaqxN.exe
  C:\Windows\System\DqAaqxN.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\VxFbiAA.exe
  C:\Windows\System\VxFbiAA.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\YzzWAkr.exe
  C:\Windows\System\YzzWAkr.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\RVBwTBR.exe
  C:\Windows\System\RVBwTBR.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\aoFFSdd.exe
  C:\Windows\System\aoFFSdd.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\GWtiGUh.exe
  C:\Windows\System\GWtiGUh.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\XJjYIVP.exe
  C:\Windows\System\XJjYIVP.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\mKuIcpU.exe
  C:\Windows\System\mKuIcpU.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\URjUVHU.exe
  C:\Windows\System\URjUVHU.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\IzwCdSl.exe
  C:\Windows\System\IzwCdSl.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\TwfbKJw.exe
  C:\Windows\System\TwfbKJw.exe
  2⤵
  PID:4520
- C:\Windows\System\UBBnjXI.exe
  C:\Windows\System\UBBnjXI.exe
  2⤵
  PID:3520
- C:\Windows\System\FCEBrTm.exe
  C:\Windows\System\FCEBrTm.exe
  2⤵
  PID:2316
- C:\Windows\System\BLlyYDb.exe
  C:\Windows\System\BLlyYDb.exe
  2⤵
  PID:4888
- C:\Windows\System\faZrwTX.exe
  C:\Windows\System\faZrwTX.exe
  2⤵
  PID:2912
- C:\Windows\System\XQqGIVh.exe
  C:\Windows\System\XQqGIVh.exe
  2⤵
  PID:544
- C:\Windows\System\CKiSptr.exe
  C:\Windows\System\CKiSptr.exe
  2⤵
  PID:1164
- C:\Windows\System\rgGEYyo.exe
  C:\Windows\System\rgGEYyo.exe
  2⤵
  PID:1968
- C:\Windows\System\iQcjwrV.exe
  C:\Windows\System\iQcjwrV.exe
  2⤵
  PID:624
- C:\Windows\System\oVeEofu.exe
  C:\Windows\System\oVeEofu.exe
  2⤵
  PID:3120
- C:\Windows\System\xTrRcaA.exe
  C:\Windows\System\xTrRcaA.exe
  2⤵
  PID:524
- C:\Windows\System\aqWQUCa.exe
  C:\Windows\System\aqWQUCa.exe
  2⤵
  PID:3240
- C:\Windows\System\ZyPqUYR.exe
  C:\Windows\System\ZyPqUYR.exe
  2⤵
  PID:4768
- C:\Windows\System\RPmDPGA.exe
  C:\Windows\System\RPmDPGA.exe
  2⤵
  PID:4872
- C:\Windows\System\SPbtAyb.exe
  C:\Windows\System\SPbtAyb.exe
  2⤵
  PID:3108
- C:\Windows\System\NJosklS.exe
  C:\Windows\System\NJosklS.exe
  2⤵
  PID:1612
- C:\Windows\System\pRJzgCQ.exe
  C:\Windows\System\pRJzgCQ.exe
  2⤵
  PID:2428
- C:\Windows\System\FLBRMad.exe
  C:\Windows\System\FLBRMad.exe
  2⤵
  PID:5000
- C:\Windows\System\jLXSplK.exe
  C:\Windows\System\jLXSplK.exe
  2⤵
  PID:1956
- C:\Windows\System\rWqNNQe.exe
  C:\Windows\System\rWqNNQe.exe
  2⤵
  PID:5128
- C:\Windows\System\SsHTYyV.exe
  C:\Windows\System\SsHTYyV.exe
  2⤵
  PID:5148
- C:\Windows\System\GyybCOO.exe
  C:\Windows\System\GyybCOO.exe
  2⤵
  PID:5168
- C:\Windows\System\hVQoudt.exe
  C:\Windows\System\hVQoudt.exe
  2⤵
  PID:5184
- C:\Windows\System\clmfASQ.exe
  C:\Windows\System\clmfASQ.exe
  2⤵
  PID:5212
- C:\Windows\System\wnZRisf.exe
  C:\Windows\System\wnZRisf.exe
  2⤵
  PID:5228
- C:\Windows\System\BCPeaHj.exe
  C:\Windows\System\BCPeaHj.exe
  2⤵
  PID:5260
- C:\Windows\System\ZATKEXy.exe
  C:\Windows\System\ZATKEXy.exe
  2⤵
  PID:5292
- C:\Windows\System\xyQAMDR.exe
  C:\Windows\System\xyQAMDR.exe
  2⤵
  PID:5320
- C:\Windows\System\xxYodzk.exe
  C:\Windows\System\xxYodzk.exe
  2⤵
  PID:5336
- C:\Windows\System\tYthtzt.exe
  C:\Windows\System\tYthtzt.exe
  2⤵
  PID:5360
- C:\Windows\System\EGxvYNP.exe
  C:\Windows\System\EGxvYNP.exe
  2⤵
  PID:5384
- C:\Windows\System\xKGwvpt.exe
  C:\Windows\System\xKGwvpt.exe
  2⤵
  PID:5404
- C:\Windows\System\VPYdWlY.exe
  C:\Windows\System\VPYdWlY.exe
  2⤵
  PID:5436
- C:\Windows\System\KOjuNsq.exe
  C:\Windows\System\KOjuNsq.exe
  2⤵
  PID:5452
- C:\Windows\System\LWtpJlU.exe
  C:\Windows\System\LWtpJlU.exe
  2⤵
  PID:5480
- C:\Windows\System\POTNMeD.exe
  C:\Windows\System\POTNMeD.exe
  2⤵
  PID:5496
- C:\Windows\System\SOOKxNi.exe
  C:\Windows\System\SOOKxNi.exe
  2⤵
  PID:5576
- C:\Windows\System\mhymWgJ.exe
  C:\Windows\System\mhymWgJ.exe
  2⤵
  PID:5596
- C:\Windows\System\tdxcPOs.exe
  C:\Windows\System\tdxcPOs.exe
  2⤵
  PID:5632
- C:\Windows\System\GDSMmRK.exe
  C:\Windows\System\GDSMmRK.exe
  2⤵
  PID:5648
- C:\Windows\System\HDkaDdF.exe
  C:\Windows\System\HDkaDdF.exe
  2⤵
  PID:5664
- C:\Windows\System\aTxqrsK.exe
  C:\Windows\System\aTxqrsK.exe
  2⤵
  PID:5684
- C:\Windows\System\TZuklCc.exe
  C:\Windows\System\TZuklCc.exe
  2⤵
  PID:5708
- C:\Windows\System\lHqkFNE.exe
  C:\Windows\System\lHqkFNE.exe
  2⤵
  PID:5728
- C:\Windows\System\eiNFGlI.exe
  C:\Windows\System\eiNFGlI.exe
  2⤵
  PID:5760
- C:\Windows\System\HyBavTL.exe
  C:\Windows\System\HyBavTL.exe
  2⤵
  PID:5788
- C:\Windows\System\QIrurrW.exe
  C:\Windows\System\QIrurrW.exe
  2⤵
  PID:5812
- C:\Windows\System\FVhxlrC.exe
  C:\Windows\System\FVhxlrC.exe
  2⤵
  PID:5828
- C:\Windows\System\LDswnFL.exe
  C:\Windows\System\LDswnFL.exe
  2⤵
  PID:5844
- C:\Windows\System\XFlwpPa.exe
  C:\Windows\System\XFlwpPa.exe
  2⤵
  PID:5868
- C:\Windows\System\VGALPkx.exe
  C:\Windows\System\VGALPkx.exe
  2⤵
  PID:5892
- C:\Windows\System\btOkOjh.exe
  C:\Windows\System\btOkOjh.exe
  2⤵
  PID:5920
- C:\Windows\System\YkNAYyn.exe
  C:\Windows\System\YkNAYyn.exe
  2⤵
  PID:5936
- C:\Windows\System\xLXwrfZ.exe
  C:\Windows\System\xLXwrfZ.exe
  2⤵
  PID:5952
- C:\Windows\System\VTVFIuB.exe
  C:\Windows\System\VTVFIuB.exe
  2⤵
  PID:5976
- C:\Windows\System\iSJYRdR.exe
  C:\Windows\System\iSJYRdR.exe
  2⤵
  PID:5992
- C:\Windows\System\cTilDdU.exe
  C:\Windows\System\cTilDdU.exe
  2⤵
  PID:6016
- C:\Windows\System\JuHRudZ.exe
  C:\Windows\System\JuHRudZ.exe
  2⤵
  PID:6032
- C:\Windows\System\JBwXaMs.exe
  C:\Windows\System\JBwXaMs.exe
  2⤵
  PID:6072
- C:\Windows\System\rKjEHgV.exe
  C:\Windows\System\rKjEHgV.exe
  2⤵
  PID:6092
- C:\Windows\System\ejEHRYa.exe
  C:\Windows\System\ejEHRYa.exe
  2⤵
  PID:6112
- C:\Windows\System\hVqLuUM.exe
  C:\Windows\System\hVqLuUM.exe
  2⤵
  PID:6136
- C:\Windows\System\qXjpWXQ.exe
  C:\Windows\System\qXjpWXQ.exe
  2⤵
  PID:1176
- C:\Windows\System\oskTGoA.exe
  C:\Windows\System\oskTGoA.exe
  2⤵
  PID:748
- C:\Windows\System\DPhwtbh.exe
  C:\Windows\System\DPhwtbh.exe
  2⤵
  PID:4532
- C:\Windows\System\oHbuNSb.exe
  C:\Windows\System\oHbuNSb.exe
  2⤵
  PID:2320
- C:\Windows\System\husSOoX.exe
  C:\Windows\System\husSOoX.exe
  2⤵
  PID:1212
- C:\Windows\System\OlkdQHo.exe
  C:\Windows\System\OlkdQHo.exe
  2⤵
  PID:3624
- C:\Windows\System\TzUfAIY.exe
  C:\Windows\System\TzUfAIY.exe
  2⤵
  PID:5376
- C:\Windows\System\HPZkvnf.exe
  C:\Windows\System\HPZkvnf.exe
  2⤵
  PID:3956
- C:\Windows\System\tvbejTx.exe
  C:\Windows\System\tvbejTx.exe
  2⤵
  PID:5504
- C:\Windows\System\rBPNwyR.exe
  C:\Windows\System\rBPNwyR.exe
  2⤵
  PID:4256
- C:\Windows\System\bUevzRk.exe
  C:\Windows\System\bUevzRk.exe
  2⤵
  PID:792
- C:\Windows\System\wmyApnb.exe
  C:\Windows\System\wmyApnb.exe
  2⤵
  PID:3572
- C:\Windows\System\gokwvav.exe
  C:\Windows\System\gokwvav.exe
  2⤵
  PID:2068
- C:\Windows\System\AbQsBXX.exe
  C:\Windows\System\AbQsBXX.exe
  2⤵
  PID:1460
- C:\Windows\System\PnJTGAT.exe
  C:\Windows\System\PnJTGAT.exe
  2⤵
  PID:5696
- C:\Windows\System\UudkMaG.exe
  C:\Windows\System\UudkMaG.exe
  2⤵
  PID:5416
- C:\Windows\System\kcGnnOU.exe
  C:\Windows\System\kcGnnOU.exe
  2⤵
  PID:4884
- C:\Windows\System\XBhpmMI.exe
  C:\Windows\System\XBhpmMI.exe
  2⤵
  PID:5836
- C:\Windows\System\MEseQiN.exe
  C:\Windows\System\MEseQiN.exe
  2⤵
  PID:6164
- C:\Windows\System\uaSfaDS.exe
  C:\Windows\System\uaSfaDS.exe
  2⤵
  PID:6180
- C:\Windows\System\BrMEayL.exe
  C:\Windows\System\BrMEayL.exe
  2⤵
  PID:6204
- C:\Windows\System\BjbHYsY.exe
  C:\Windows\System\BjbHYsY.exe
  2⤵
  PID:6228
- C:\Windows\System\pOjVDAv.exe
  C:\Windows\System\pOjVDAv.exe
  2⤵
  PID:6252
- C:\Windows\System\YRSnxWM.exe
  C:\Windows\System\YRSnxWM.exe
  2⤵
  PID:6268
- C:\Windows\System\vJjMSpb.exe
  C:\Windows\System\vJjMSpb.exe
  2⤵
  PID:6296
- C:\Windows\System\JPeHktf.exe
  C:\Windows\System\JPeHktf.exe
  2⤵
  PID:6316
- C:\Windows\System\YVNJbxa.exe
  C:\Windows\System\YVNJbxa.exe
  2⤵
  PID:6336
- C:\Windows\System\baPhkXL.exe
  C:\Windows\System\baPhkXL.exe
  2⤵
  PID:6364
- C:\Windows\System\egsCLrk.exe
  C:\Windows\System\egsCLrk.exe
  2⤵
  PID:6384
- C:\Windows\System\GAzzebb.exe
  C:\Windows\System\GAzzebb.exe
  2⤵
  PID:6416
- C:\Windows\System\QrRDaEw.exe
  C:\Windows\System\QrRDaEw.exe
  2⤵
  PID:6436
- C:\Windows\System\sJxFpmM.exe
  C:\Windows\System\sJxFpmM.exe
  2⤵
  PID:6464
- C:\Windows\System\NgZAEGL.exe
  C:\Windows\System\NgZAEGL.exe
  2⤵
  PID:6480
- C:\Windows\System\mmoiewT.exe
  C:\Windows\System\mmoiewT.exe
  2⤵
  PID:6496
- C:\Windows\System\bylkwFB.exe
  C:\Windows\System\bylkwFB.exe
  2⤵
  PID:6544
- C:\Windows\System\aRtdbhl.exe
  C:\Windows\System\aRtdbhl.exe
  2⤵
  PID:6572
- C:\Windows\System\CLJChsb.exe
  C:\Windows\System\CLJChsb.exe
  2⤵
  PID:6588
- C:\Windows\System\rMYGkPc.exe
  C:\Windows\System\rMYGkPc.exe
  2⤵
  PID:6616
- C:\Windows\System\GSewsGC.exe
  C:\Windows\System\GSewsGC.exe
  2⤵
  PID:6636
- C:\Windows\System\kIhLcHQ.exe
  C:\Windows\System\kIhLcHQ.exe
  2⤵
  PID:6660
- C:\Windows\System\FEPhuUg.exe
  C:\Windows\System\FEPhuUg.exe
  2⤵
  PID:6676
- C:\Windows\System\ulQhCUo.exe
  C:\Windows\System\ulQhCUo.exe
  2⤵
  PID:6700
- C:\Windows\System\tRvbwaW.exe
  C:\Windows\System\tRvbwaW.exe
  2⤵
  PID:6716
- C:\Windows\System\fLWQfti.exe
  C:\Windows\System\fLWQfti.exe
  2⤵
  PID:6740
- C:\Windows\System\TKOhKbW.exe
  C:\Windows\System\TKOhKbW.exe
  2⤵
  PID:6768
- C:\Windows\System\POlkfZf.exe
  C:\Windows\System\POlkfZf.exe
  2⤵
  PID:6784
- C:\Windows\System\EQPCxDb.exe
  C:\Windows\System\EQPCxDb.exe
  2⤵
  PID:6808
- C:\Windows\System\njxwqfk.exe
  C:\Windows\System\njxwqfk.exe
  2⤵
  PID:6828
- C:\Windows\System\QpZHaUz.exe
  C:\Windows\System\QpZHaUz.exe
  2⤵
  PID:6848
- C:\Windows\System\pAvblaL.exe
  C:\Windows\System\pAvblaL.exe
  2⤵
  PID:6868
- C:\Windows\System\EXhOiyf.exe
  C:\Windows\System\EXhOiyf.exe
  2⤵
  PID:6892
- C:\Windows\System\rmqifTk.exe
  C:\Windows\System\rmqifTk.exe
  2⤵
  PID:6912
- C:\Windows\System\TvJmwQr.exe
  C:\Windows\System\TvJmwQr.exe
  2⤵
  PID:6936
- C:\Windows\System\vmyWZbn.exe
  C:\Windows\System\vmyWZbn.exe
  2⤵
  PID:6968
- C:\Windows\System\cBEAawY.exe
  C:\Windows\System\cBEAawY.exe
  2⤵
  PID:6988
- C:\Windows\System\KrLDSfO.exe
  C:\Windows\System\KrLDSfO.exe
  2⤵
  PID:7008
- C:\Windows\System\UQFZwix.exe
  C:\Windows\System\UQFZwix.exe
  2⤵
  PID:7024
- C:\Windows\System\Tiafdix.exe
  C:\Windows\System\Tiafdix.exe
  2⤵
  PID:7044
- C:\Windows\System\ZDeVSlp.exe
  C:\Windows\System\ZDeVSlp.exe
  2⤵
  PID:7072
- C:\Windows\System\spkaTJo.exe
  C:\Windows\System\spkaTJo.exe
  2⤵
  PID:7092
- C:\Windows\System\ocTgjUh.exe
  C:\Windows\System\ocTgjUh.exe
  2⤵
  PID:7120
- C:\Windows\System\Ijcsybo.exe
  C:\Windows\System\Ijcsybo.exe
  2⤵
  PID:7148
- C:\Windows\System\IaNbEQU.exe
  C:\Windows\System\IaNbEQU.exe
  2⤵
  PID:704
- C:\Windows\System\kQTMLPp.exe
  C:\Windows\System\kQTMLPp.exe
  2⤵
  PID:4920
- C:\Windows\System\hdaIeuo.exe
  C:\Windows\System\hdaIeuo.exe
  2⤵
  PID:5024
- C:\Windows\System\rQdfYol.exe
  C:\Windows\System\rQdfYol.exe
  2⤵
  PID:5968
- C:\Windows\System\dRVmzgH.exe
  C:\Windows\System\dRVmzgH.exe
  2⤵
  PID:3128
- C:\Windows\System\TnZZcuQ.exe
  C:\Windows\System\TnZZcuQ.exe
  2⤵
  PID:6012
- C:\Windows\System\rFQYKSb.exe
  C:\Windows\System\rFQYKSb.exe
  2⤵
  PID:5136
- C:\Windows\System\kvwdQFl.exe
  C:\Windows\System\kvwdQFl.exe
  2⤵
  PID:5164
- C:\Windows\System\dCCSiJg.exe
  C:\Windows\System\dCCSiJg.exe
  2⤵
  PID:5200
- C:\Windows\System\HOYzZXO.exe
  C:\Windows\System\HOYzZXO.exe
  2⤵
  PID:5280
- C:\Windows\System\ZBaLHUf.exe
  C:\Windows\System\ZBaLHUf.exe
  2⤵
  PID:5312
- C:\Windows\System\SYdFdId.exe
  C:\Windows\System\SYdFdId.exe
  2⤵
  PID:1092
- C:\Windows\System\pcyWVaP.exe
  C:\Windows\System\pcyWVaP.exe
  2⤵
  PID:5464
- C:\Windows\System\zyFrIpL.exe
  C:\Windows\System\zyFrIpL.exe
  2⤵
  PID:5400
- C:\Windows\System\CclbqXV.exe
  C:\Windows\System\CclbqXV.exe
  2⤵
  PID:1480
- C:\Windows\System\yIYpAit.exe
  C:\Windows\System\yIYpAit.exe
  2⤵
  PID:6224
- C:\Windows\System\EaDryoM.exe
  C:\Windows\System\EaDryoM.exe
  2⤵
  PID:5932
- C:\Windows\System\ZSGClph.exe
  C:\Windows\System\ZSGClph.exe
  2⤵
  PID:5568
- C:\Windows\System\fdPCWYi.exe
  C:\Windows\System\fdPCWYi.exe
  2⤵
  PID:5640
- C:\Windows\System\IclhAKz.exe
  C:\Windows\System\IclhAKz.exe
  2⤵
  PID:5676
- C:\Windows\System\zsUqitG.exe
  C:\Windows\System\zsUqitG.exe
  2⤵
  PID:6692
- C:\Windows\System\SoHBQVg.exe
  C:\Windows\System\SoHBQVg.exe
  2⤵
  PID:6736
- C:\Windows\System\jieLrMq.exe
  C:\Windows\System\jieLrMq.exe
  2⤵
  PID:6800
- C:\Windows\System\sMeEPaC.exe
  C:\Windows\System\sMeEPaC.exe
  2⤵
  PID:6840
- C:\Windows\System\kiLyzTj.exe
  C:\Windows\System\kiLyzTj.exe
  2⤵
  PID:5780
- C:\Windows\System\Dadxksx.exe
  C:\Windows\System\Dadxksx.exe
  2⤵
  PID:7172
- C:\Windows\System\XlzMQZl.exe
  C:\Windows\System\XlzMQZl.exe
  2⤵
  PID:7192
- C:\Windows\System\NQPGNIo.exe
  C:\Windows\System\NQPGNIo.exe
  2⤵
  PID:7216
- C:\Windows\System\afCKTMF.exe
  C:\Windows\System\afCKTMF.exe
  2⤵
  PID:7240
- C:\Windows\System\olKIfXV.exe
  C:\Windows\System\olKIfXV.exe
  2⤵
  PID:7264
- C:\Windows\System\yCBdmTw.exe
  C:\Windows\System\yCBdmTw.exe
  2⤵
  PID:7280
- C:\Windows\System\EUlcbNB.exe
  C:\Windows\System\EUlcbNB.exe
  2⤵
  PID:7304
- C:\Windows\System\WUOChXC.exe
  C:\Windows\System\WUOChXC.exe
  2⤵
  PID:7320
- C:\Windows\System\MHQfQTL.exe
  C:\Windows\System\MHQfQTL.exe
  2⤵
  PID:7344
- C:\Windows\System\iGSdomY.exe
  C:\Windows\System\iGSdomY.exe
  2⤵
  PID:7364
- C:\Windows\System\zpCRfEH.exe
  C:\Windows\System\zpCRfEH.exe
  2⤵
  PID:7384
- C:\Windows\System\jBcpNbj.exe
  C:\Windows\System\jBcpNbj.exe
  2⤵
  PID:7408
- C:\Windows\System\AaYjDfs.exe
  C:\Windows\System\AaYjDfs.exe
  2⤵
  PID:7424
- C:\Windows\System\kXhnugY.exe
  C:\Windows\System\kXhnugY.exe
  2⤵
  PID:7448
- C:\Windows\System\EDYBMPk.exe
  C:\Windows\System\EDYBMPk.exe
  2⤵
  PID:7472
- C:\Windows\System\uZDVkIR.exe
  C:\Windows\System\uZDVkIR.exe
  2⤵
  PID:7488
- C:\Windows\System\sHOZxMS.exe
  C:\Windows\System\sHOZxMS.exe
  2⤵
  PID:7512
- C:\Windows\System\OoHTcok.exe
  C:\Windows\System\OoHTcok.exe
  2⤵
  PID:7528
- C:\Windows\System\dOmiQbl.exe
  C:\Windows\System\dOmiQbl.exe
  2⤵
  PID:7552
- C:\Windows\System\AYpenev.exe
  C:\Windows\System\AYpenev.exe
  2⤵
  PID:7568
- C:\Windows\System\YbYYMTt.exe
  C:\Windows\System\YbYYMTt.exe
  2⤵
  PID:7592
- C:\Windows\System\LpxuHkz.exe
  C:\Windows\System\LpxuHkz.exe
  2⤵
  PID:7612
- C:\Windows\System\qNCOYYb.exe
  C:\Windows\System\qNCOYYb.exe
  2⤵
  PID:7764
- C:\Windows\System\whRiRZd.exe
  C:\Windows\System\whRiRZd.exe
  2⤵
  PID:7780
- C:\Windows\System\xNzDJdp.exe
  C:\Windows\System\xNzDJdp.exe
  2⤵
  PID:7796
- C:\Windows\System\mPmRsYQ.exe
  C:\Windows\System\mPmRsYQ.exe
  2⤵
  PID:7812
- C:\Windows\System\LFGuaVJ.exe
  C:\Windows\System\LFGuaVJ.exe
  2⤵
  PID:7828
- C:\Windows\System\qnJycaI.exe
  C:\Windows\System\qnJycaI.exe
  2⤵
  PID:7844
- C:\Windows\System\KpkbiDD.exe
  C:\Windows\System\KpkbiDD.exe
  2⤵
  PID:7860
- C:\Windows\System\sXbIyIP.exe
  C:\Windows\System\sXbIyIP.exe
  2⤵
  PID:7876
- C:\Windows\System\QsQJbCd.exe
  C:\Windows\System\QsQJbCd.exe
  2⤵
  PID:7896
- C:\Windows\System\IkCwsvQ.exe
  C:\Windows\System\IkCwsvQ.exe
  2⤵
  PID:8136
- C:\Windows\System\cXRHAjw.exe
  C:\Windows\System\cXRHAjw.exe
  2⤵
  PID:8152
- C:\Windows\System\APSCAJN.exe
  C:\Windows\System\APSCAJN.exe
  2⤵
  PID:8172
- C:\Windows\System\bQGzSMQ.exe
  C:\Windows\System\bQGzSMQ.exe
  2⤵
  PID:8188
- C:\Windows\System\rXZYLHW.exe
  C:\Windows\System\rXZYLHW.exe
  2⤵
  PID:5796
- C:\Windows\System\brmPIWe.exe
  C:\Windows\System\brmPIWe.exe
  2⤵
  PID:5040
- C:\Windows\System\NOWBVwo.exe
  C:\Windows\System\NOWBVwo.exe
  2⤵
  PID:5876
- C:\Windows\System\rRjudEw.exe
  C:\Windows\System\rRjudEw.exe
  2⤵
  PID:6148
- C:\Windows\System\JZeiTsz.exe
  C:\Windows\System\JZeiTsz.exe
  2⤵
  PID:6172
- C:\Windows\System\pwfyzYe.exe
  C:\Windows\System\pwfyzYe.exe
  2⤵
  PID:6104
- C:\Windows\System\djiwxMh.exe
  C:\Windows\System\djiwxMh.exe
  2⤵
  PID:3024
- C:\Windows\System\GKRDjgk.exe
  C:\Windows\System\GKRDjgk.exe
  2⤵
  PID:4004
- C:\Windows\System\zhHGsXx.exe
  C:\Windows\System\zhHGsXx.exe
  2⤵
  PID:2240
- C:\Windows\System\VqYTdCz.exe
  C:\Windows\System\VqYTdCz.exe
  2⤵
  PID:2056
- C:\Windows\System\VixZMox.exe
  C:\Windows\System\VixZMox.exe
  2⤵
  PID:7160
- C:\Windows\System\MOjOLqm.exe
  C:\Windows\System\MOjOLqm.exe
  2⤵
  PID:6356
- C:\Windows\System\vgkxoEO.exe
  C:\Windows\System\vgkxoEO.exe
  2⤵
  PID:6472
- C:\Windows\System\hJcUZSM.exe
  C:\Windows\System\hJcUZSM.exe
  2⤵
  PID:6532
- C:\Windows\System\uHrSvMZ.exe
  C:\Windows\System\uHrSvMZ.exe
  2⤵
  PID:6568
- C:\Windows\System\lGmmcSX.exe
  C:\Windows\System\lGmmcSX.exe
  2⤵
  PID:6608
- C:\Windows\System\IJUtiRz.exe
  C:\Windows\System\IJUtiRz.exe
  2⤵
  PID:6644
- C:\Windows\System\lBtRkPM.exe
  C:\Windows\System\lBtRkPM.exe
  2⤵
  PID:6824
- C:\Windows\System\zyOCiRM.exe
  C:\Windows\System\zyOCiRM.exe
  2⤵
  PID:6924
- C:\Windows\System\GBaAbUG.exe
  C:\Windows\System\GBaAbUG.exe
  2⤵
  PID:7016
- C:\Windows\System\oAFnaEy.exe
  C:\Windows\System\oAFnaEy.exe
  2⤵
  PID:7080
- C:\Windows\System\PiBOlTw.exe
  C:\Windows\System\PiBOlTw.exe
  2⤵
  PID:3524
- C:\Windows\System\IPeXsOX.exe
  C:\Windows\System\IPeXsOX.exe
  2⤵
  PID:5356
- C:\Windows\System\MZpxjZJ.exe
  C:\Windows\System\MZpxjZJ.exe
  2⤵
  PID:6856
- C:\Windows\System\oAHYMmD.exe
  C:\Windows\System\oAHYMmD.exe
  2⤵
  PID:7288
- C:\Windows\System\xFgeIDp.exe
  C:\Windows\System\xFgeIDp.exe
  2⤵
  PID:7432
- C:\Windows\System\nTPxeiz.exe
  C:\Windows\System\nTPxeiz.exe
  2⤵
  PID:7672
- C:\Windows\System\zmkegyo.exe
  C:\Windows\System\zmkegyo.exe
  2⤵
  PID:4744
- C:\Windows\System\BJIEAei.exe
  C:\Windows\System\BJIEAei.exe
  2⤵
  PID:4400
- C:\Windows\System\rbiAREr.exe
  C:\Windows\System\rbiAREr.exe
  2⤵
  PID:2836
- C:\Windows\System\PhmDRDL.exe
  C:\Windows\System\PhmDRDL.exe
  2⤵
  PID:5156
- C:\Windows\System\EcEdeEv.exe
  C:\Windows\System\EcEdeEv.exe
  2⤵
  PID:5236
- C:\Windows\System\QOCyOSs.exe
  C:\Windows\System\QOCyOSs.exe
  2⤵
  PID:5444
- C:\Windows\System\cuSCPoV.exe
  C:\Windows\System\cuSCPoV.exe
  2⤵
  PID:5468
- C:\Windows\System\FnLsPne.exe
  C:\Windows\System\FnLsPne.exe
  2⤵
  PID:5908
- C:\Windows\System\oQtasFS.exe
  C:\Windows\System\oQtasFS.exe
  2⤵
  PID:5660
- C:\Windows\System\nAbxpxC.exe
  C:\Windows\System\nAbxpxC.exe
  2⤵
  PID:6712
- C:\Windows\System\xhlWJgW.exe
  C:\Windows\System\xhlWJgW.exe
  2⤵
  PID:6820
- C:\Windows\System\tBKlaRo.exe
  C:\Windows\System\tBKlaRo.exe
  2⤵
  PID:7184
- C:\Windows\System\rDBHYIB.exe
  C:\Windows\System\rDBHYIB.exe
  2⤵
  PID:7224
- C:\Windows\System\cJmIGUF.exe
  C:\Windows\System\cJmIGUF.exe
  2⤵
  PID:7276
- C:\Windows\System\yruBweI.exe
  C:\Windows\System\yruBweI.exe
  2⤵
  PID:7352
- C:\Windows\System\CqyUQNL.exe
  C:\Windows\System\CqyUQNL.exe
  2⤵
  PID:7380
- C:\Windows\System\ySyNKBx.exe
  C:\Windows\System\ySyNKBx.exe
  2⤵
  PID:7456
- C:\Windows\System\lHHOCXu.exe
  C:\Windows\System\lHHOCXu.exe
  2⤵
  PID:7484
- C:\Windows\System\EExNiVl.exe
  C:\Windows\System\EExNiVl.exe
  2⤵
  PID:7560
- C:\Windows\System\gNRSRzo.exe
  C:\Windows\System\gNRSRzo.exe
  2⤵
  PID:7584
- C:\Windows\System\LhXKDPT.exe
  C:\Windows\System\LhXKDPT.exe
  2⤵
  PID:8204
- C:\Windows\System\HTArSxd.exe
  C:\Windows\System\HTArSxd.exe
  2⤵
  PID:8224
- C:\Windows\System\olRBXtt.exe
  C:\Windows\System\olRBXtt.exe
  2⤵
  PID:8240
- C:\Windows\System\WfoXSSC.exe
  C:\Windows\System\WfoXSSC.exe
  2⤵
  PID:8260
- C:\Windows\System\ThBKslX.exe
  C:\Windows\System\ThBKslX.exe
  2⤵
  PID:8280
- C:\Windows\System\oAbqGsx.exe
  C:\Windows\System\oAbqGsx.exe
  2⤵
  PID:8296
- C:\Windows\System\vbsvWKm.exe
  C:\Windows\System\vbsvWKm.exe
  2⤵
  PID:8316
- C:\Windows\System\pxgoxCC.exe
  C:\Windows\System\pxgoxCC.exe
  2⤵
  PID:8336
- C:\Windows\System\ZuMfcIy.exe
  C:\Windows\System\ZuMfcIy.exe
  2⤵
  PID:8352
- C:\Windows\System\pkPHKYB.exe
  C:\Windows\System\pkPHKYB.exe
  2⤵
  PID:8372
- C:\Windows\System\ljFUKnR.exe
  C:\Windows\System\ljFUKnR.exe
  2⤵
  PID:8392
- C:\Windows\System\kJotioq.exe
  C:\Windows\System\kJotioq.exe
  2⤵
  PID:8412
- C:\Windows\System\WyVKEIP.exe
  C:\Windows\System\WyVKEIP.exe
  2⤵
  PID:8428
- C:\Windows\System\jCJTQDZ.exe
  C:\Windows\System\jCJTQDZ.exe
  2⤵
  PID:8448
- C:\Windows\System\KcchhYd.exe
  C:\Windows\System\KcchhYd.exe
  2⤵
  PID:8468
- C:\Windows\System\NheJTPl.exe
  C:\Windows\System\NheJTPl.exe
  2⤵
  PID:8488
- C:\Windows\System\CdfSJqc.exe
  C:\Windows\System\CdfSJqc.exe
  2⤵
  PID:8504
- C:\Windows\System\GMyAfgI.exe
  C:\Windows\System\GMyAfgI.exe
  2⤵
  PID:8524
- C:\Windows\System\sozrLHN.exe
  C:\Windows\System\sozrLHN.exe
  2⤵
  PID:8544
- C:\Windows\System\mSuNkRG.exe
  C:\Windows\System\mSuNkRG.exe
  2⤵
  PID:8564
- C:\Windows\System\rvfxDoo.exe
  C:\Windows\System\rvfxDoo.exe
  2⤵
  PID:8580
- C:\Windows\System\OeYFndE.exe
  C:\Windows\System\OeYFndE.exe
  2⤵
  PID:8600
- C:\Windows\System\SZVmGHm.exe
  C:\Windows\System\SZVmGHm.exe
  2⤵
  PID:8620
- C:\Windows\System\WyhyDsl.exe
  C:\Windows\System\WyhyDsl.exe
  2⤵
  PID:8636
- C:\Windows\System\zvmbLdp.exe
  C:\Windows\System\zvmbLdp.exe
  2⤵
  PID:8656
- C:\Windows\System\LBHDMxT.exe
  C:\Windows\System\LBHDMxT.exe
  2⤵
  PID:8676
- C:\Windows\System\SwyRabl.exe
  C:\Windows\System\SwyRabl.exe
  2⤵
  PID:8696
- C:\Windows\System\WSpyqHt.exe
  C:\Windows\System\WSpyqHt.exe
  2⤵
  PID:8712
- C:\Windows\System\FOoVpNL.exe
  C:\Windows\System\FOoVpNL.exe
  2⤵
  PID:8732
- C:\Windows\System\zlvMcWq.exe
  C:\Windows\System\zlvMcWq.exe
  2⤵
  PID:8752
- C:\Windows\System\cmqTBMr.exe
  C:\Windows\System\cmqTBMr.exe
  2⤵
  PID:8768
- C:\Windows\System\FKynKib.exe
  C:\Windows\System\FKynKib.exe
  2⤵
  PID:8788
- C:\Windows\System\fTcunwW.exe
  C:\Windows\System\fTcunwW.exe
  2⤵
  PID:8808
- C:\Windows\System\tOATTya.exe
  C:\Windows\System\tOATTya.exe
  2⤵
  PID:8824
- C:\Windows\System\DSVLpBU.exe
  C:\Windows\System\DSVLpBU.exe
  2⤵
  PID:8844
- C:\Windows\System\YnjQTba.exe
  C:\Windows\System\YnjQTba.exe
  2⤵
  PID:8860
- C:\Windows\System\PMHtchM.exe
  C:\Windows\System\PMHtchM.exe
  2⤵
  PID:8876
- C:\Windows\System\PFHeIhT.exe
  C:\Windows\System\PFHeIhT.exe
  2⤵
  PID:8892
- C:\Windows\System\eGPvIjv.exe
  C:\Windows\System\eGPvIjv.exe
  2⤵
  PID:8908
- C:\Windows\System\dNDlxZA.exe
  C:\Windows\System\dNDlxZA.exe
  2⤵
  PID:8928
- C:\Windows\System\XUqFcRB.exe
  C:\Windows\System\XUqFcRB.exe
  2⤵
  PID:8948
- C:\Windows\System\xygANOA.exe
  C:\Windows\System\xygANOA.exe
  2⤵
  PID:8964
- C:\Windows\System\LwiXZOz.exe
  C:\Windows\System\LwiXZOz.exe
  2⤵
  PID:8984
- C:\Windows\System\rCNOmpz.exe
  C:\Windows\System\rCNOmpz.exe
  2⤵
  PID:9004
- C:\Windows\System\IlzBFNS.exe
  C:\Windows\System\IlzBFNS.exe
  2⤵
  PID:9024
- C:\Windows\System\dSscqCu.exe
  C:\Windows\System\dSscqCu.exe
  2⤵
  PID:9040
- C:\Windows\System\BExtyXo.exe
  C:\Windows\System\BExtyXo.exe
  2⤵
  PID:9060
- C:\Windows\System\tHTDugZ.exe
  C:\Windows\System\tHTDugZ.exe
  2⤵
  PID:9076
- C:\Windows\System\vWIEBZd.exe
  C:\Windows\System\vWIEBZd.exe
  2⤵
  PID:9096
- C:\Windows\System\cCIaQuY.exe
  C:\Windows\System\cCIaQuY.exe
  2⤵
  PID:9116
- C:\Windows\System\PGaAMuA.exe
  C:\Windows\System\PGaAMuA.exe
  2⤵
  PID:9136
- C:\Windows\System\jLsmIlv.exe
  C:\Windows\System\jLsmIlv.exe
  2⤵
  PID:9156
- C:\Windows\System\gwfOzBs.exe
  C:\Windows\System\gwfOzBs.exe
  2⤵
  PID:9172
- C:\Windows\System\DWogehh.exe
  C:\Windows\System\DWogehh.exe
  2⤵
  PID:9192
- C:\Windows\System\kMzvqCY.exe
  C:\Windows\System\kMzvqCY.exe
  2⤵
  PID:9212
- C:\Windows\System\ssYZMnY.exe
  C:\Windows\System\ssYZMnY.exe
  2⤵
  PID:9236
- C:\Windows\System\KfPEzJl.exe
  C:\Windows\System\KfPEzJl.exe
  2⤵
  PID:9256
- C:\Windows\System\OlZQuTD.exe
  C:\Windows\System\OlZQuTD.exe
  2⤵
  PID:9272
- C:\Windows\System\DqNryVe.exe
  C:\Windows\System\DqNryVe.exe
  2⤵
  PID:9292
- C:\Windows\System\qbXprqD.exe
  C:\Windows\System\qbXprqD.exe
  2⤵
  PID:9312
- C:\Windows\System\tmivQCn.exe
  C:\Windows\System\tmivQCn.exe
  2⤵
  PID:9332
- C:\Windows\System\oPsnIKF.exe
  C:\Windows\System\oPsnIKF.exe
  2⤵
  PID:9352
- C:\Windows\System\SAXipUQ.exe
  C:\Windows\System\SAXipUQ.exe
  2⤵
  PID:9368
- C:\Windows\System\TSyUVYY.exe
  C:\Windows\System\TSyUVYY.exe
  2⤵
  PID:9388
- C:\Windows\System\IrtZYwA.exe
  C:\Windows\System\IrtZYwA.exe
  2⤵
  PID:9408
- C:\Windows\System\YyZdICy.exe
  C:\Windows\System\YyZdICy.exe
  2⤵
  PID:9428
- C:\Windows\System\fdDRiwk.exe
  C:\Windows\System\fdDRiwk.exe
  2⤵
  PID:9444
- C:\Windows\System\gHMjmoD.exe
  C:\Windows\System\gHMjmoD.exe
  2⤵
  PID:9464
- C:\Windows\System\MWjXfln.exe
  C:\Windows\System\MWjXfln.exe
  2⤵
  PID:9484
- C:\Windows\System\nCdFUkj.exe
  C:\Windows\System\nCdFUkj.exe
  2⤵
  PID:9504
- C:\Windows\System\buGCLKP.exe
  C:\Windows\System\buGCLKP.exe
  2⤵
  PID:9524
- C:\Windows\System\RsEaqXP.exe
  C:\Windows\System\RsEaqXP.exe
  2⤵
  PID:9540
- C:\Windows\System\mljhDZB.exe
  C:\Windows\System\mljhDZB.exe
  2⤵
  PID:9560
- C:\Windows\System\Vxnpmpm.exe
  C:\Windows\System\Vxnpmpm.exe
  2⤵
  PID:9580
- C:\Windows\System\eUrZYkp.exe
  C:\Windows\System\eUrZYkp.exe
  2⤵
  PID:9596
- C:\Windows\System\HWKjmKe.exe
  C:\Windows\System\HWKjmKe.exe
  2⤵
  PID:9616
- C:\Windows\System\qqvUkFF.exe
  C:\Windows\System\qqvUkFF.exe
  2⤵
  PID:9636
- C:\Windows\System\VHntQTo.exe
  C:\Windows\System\VHntQTo.exe
  2⤵
  PID:9656
- C:\Windows\System\mKCxtxv.exe
  C:\Windows\System\mKCxtxv.exe
  2⤵
  PID:9672
- C:\Windows\System\nlsGaXZ.exe
  C:\Windows\System\nlsGaXZ.exe
  2⤵
  PID:9692
- C:\Windows\System\gokJkxy.exe
  C:\Windows\System\gokJkxy.exe
  2⤵
  PID:9712
- C:\Windows\System\WedtnUB.exe
  C:\Windows\System\WedtnUB.exe
  2⤵
  PID:9728
- C:\Windows\System\prFjbVq.exe
  C:\Windows\System\prFjbVq.exe
  2⤵
  PID:9748
- C:\Windows\System\iVZlkTF.exe
  C:\Windows\System\iVZlkTF.exe
  2⤵
  PID:9768
- C:\Windows\System\cKOuMLs.exe
  C:\Windows\System\cKOuMLs.exe
  2⤵
  PID:9788
- C:\Windows\System\hidrNHQ.exe
  C:\Windows\System\hidrNHQ.exe
  2⤵
  PID:9804
- C:\Windows\System\BalcJZg.exe
  C:\Windows\System\BalcJZg.exe
  2⤵
  PID:9824
- C:\Windows\System\MyWeoKq.exe
  C:\Windows\System\MyWeoKq.exe
  2⤵
  PID:9844
- C:\Windows\System\ELmetiV.exe
  C:\Windows\System\ELmetiV.exe
  2⤵
  PID:9860
- C:\Windows\System\LxKqPmZ.exe
  C:\Windows\System\LxKqPmZ.exe
  2⤵
  PID:9880
- C:\Windows\System\vABLJIM.exe
  C:\Windows\System\vABLJIM.exe
  2⤵
  PID:9900
- C:\Windows\System\iJGuiin.exe
  C:\Windows\System\iJGuiin.exe
  2⤵
  PID:9920
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 9920 -s 188
    3⤵
    PID:9800
- C:\Windows\System\SGPKaDM.exe
  C:\Windows\System\SGPKaDM.exe
  2⤵
  PID:9936
- C:\Windows\System\TAlbdSg.exe
  C:\Windows\System\TAlbdSg.exe
  2⤵
  PID:9956
- C:\Windows\System\wLPHpQe.exe
  C:\Windows\System\wLPHpQe.exe
  2⤵
  PID:9976
- C:\Windows\System\BaQtQjS.exe
  C:\Windows\System\BaQtQjS.exe
  2⤵
  PID:10000
- C:\Windows\System\XOaxEMs.exe
  C:\Windows\System\XOaxEMs.exe
  2⤵
  PID:10024
- C:\Windows\System\OAvaGLZ.exe
  C:\Windows\System\OAvaGLZ.exe
  2⤵
  PID:10040
- C:\Windows\System\TeRpnBe.exe
  C:\Windows\System\TeRpnBe.exe
  2⤵
  PID:10068
- C:\Windows\System\jvdqyme.exe
  C:\Windows\System\jvdqyme.exe
  2⤵
  PID:10088
- C:\Windows\System\BbpHpkG.exe
  C:\Windows\System\BbpHpkG.exe
  2⤵
  PID:10116
- C:\Windows\System\GQuqLju.exe
  C:\Windows\System\GQuqLju.exe
  2⤵
  PID:10132
- C:\Windows\System\GgOqiqC.exe
  C:\Windows\System\GgOqiqC.exe
  2⤵
  PID:10148
- C:\Windows\System\kMDGZUG.exe
  C:\Windows\System\kMDGZUG.exe
  2⤵
  PID:10164
- C:\Windows\System\SKTUVST.exe
  C:\Windows\System\SKTUVST.exe
  2⤵
  PID:10180
- C:\Windows\System\EjjiFQp.exe
  C:\Windows\System\EjjiFQp.exe
  2⤵
  PID:10196
- C:\Windows\System\cKcPzWk.exe
  C:\Windows\System\cKcPzWk.exe
  2⤵
  PID:10212
- C:\Windows\System\qEnrjZc.exe
  C:\Windows\System\qEnrjZc.exe
  2⤵
  PID:10228
- C:\Windows\System\uckuBzE.exe
  C:\Windows\System\uckuBzE.exe
  2⤵
  PID:10248
- C:\Windows\System\BGVBCnA.exe
  C:\Windows\System\BGVBCnA.exe
  2⤵
  PID:10264
- C:\Windows\System\fGGYGJW.exe
  C:\Windows\System\fGGYGJW.exe
  2⤵
  PID:10280
- C:\Windows\System\sEeQWHU.exe
  C:\Windows\System\sEeQWHU.exe
  2⤵
  PID:10296
- C:\Windows\System\sjRvZHg.exe
  C:\Windows\System\sjRvZHg.exe
  2⤵
  PID:10312
- C:\Windows\System\JWMJNFL.exe
  C:\Windows\System\JWMJNFL.exe
  2⤵
  PID:10328
- C:\Windows\System\mgmqfwM.exe
  C:\Windows\System\mgmqfwM.exe
  2⤵
  PID:10356
- C:\Windows\System\NlSInfd.exe
  C:\Windows\System\NlSInfd.exe
  2⤵
  PID:10396
- C:\Windows\System\dNOQWeW.exe
  C:\Windows\System\dNOQWeW.exe
  2⤵
  PID:10436
- C:\Windows\System\SHGSclR.exe
  C:\Windows\System\SHGSclR.exe
  2⤵
  PID:10628
- C:\Windows\System\PDcCWMg.exe
  C:\Windows\System\PDcCWMg.exe
  2⤵
  PID:10644
- C:\Windows\System\VksIBCF.exe
  C:\Windows\System\VksIBCF.exe
  2⤵
  PID:10664
- C:\Windows\System\wCaJjbw.exe
  C:\Windows\System\wCaJjbw.exe
  2⤵
  PID:10680
- C:\Windows\System\lyWKgiG.exe
  C:\Windows\System\lyWKgiG.exe
  2⤵
  PID:10696
- C:\Windows\System\zHXNegC.exe
  C:\Windows\System\zHXNegC.exe
  2⤵
  PID:10780
- C:\Windows\System\KrTlnkz.exe
  C:\Windows\System\KrTlnkz.exe
  2⤵
  PID:10868
- C:\Windows\System\VerLwBI.exe
  C:\Windows\System\VerLwBI.exe
  2⤵
  PID:10948
- C:\Windows\System\pRobQeK.exe
  C:\Windows\System\pRobQeK.exe
  2⤵
  PID:10964
- C:\Windows\System\kqmNQZy.exe
  C:\Windows\System\kqmNQZy.exe
  2⤵
  PID:10984
- C:\Windows\System\TUQDxYg.exe
  C:\Windows\System\TUQDxYg.exe
  2⤵
  PID:11004
- C:\Windows\System\AbrFBWr.exe
  C:\Windows\System\AbrFBWr.exe
  2⤵
  PID:11024
- C:\Windows\System\OrhdhZs.exe
  C:\Windows\System\OrhdhZs.exe
  2⤵
  PID:11044
- C:\Windows\System\dcVMbvR.exe
  C:\Windows\System\dcVMbvR.exe
  2⤵
  PID:11060
- C:\Windows\System\xenfrna.exe
  C:\Windows\System\xenfrna.exe
  2⤵
  PID:11076
- C:\Windows\System\TDmPenD.exe
  C:\Windows\System\TDmPenD.exe
  2⤵
  PID:11092
- C:\Windows\System\RnQQkoz.exe
  C:\Windows\System\RnQQkoz.exe
  2⤵
  PID:11108
- C:\Windows\System\XSzWvQI.exe
  C:\Windows\System\XSzWvQI.exe
  2⤵
  PID:11128
- C:\Windows\System\CzrZebZ.exe
  C:\Windows\System\CzrZebZ.exe
  2⤵
  PID:11144
- C:\Windows\System\KiGCLtC.exe
  C:\Windows\System\KiGCLtC.exe
  2⤵
  PID:11160
- C:\Windows\System\DkFaadg.exe
  C:\Windows\System\DkFaadg.exe
  2⤵
  PID:11180
- C:\Windows\System\nXNheyD.exe
  C:\Windows\System\nXNheyD.exe
  2⤵
  PID:11196
- C:\Windows\System\iSQYcgl.exe
  C:\Windows\System\iSQYcgl.exe
  2⤵
  PID:11212
- C:\Windows\System\qtfwocX.exe
  C:\Windows\System\qtfwocX.exe
  2⤵
  PID:11228
- C:\Windows\System\eeGrioi.exe
  C:\Windows\System\eeGrioi.exe
  2⤵
  PID:11244
- C:\Windows\System\zlCKRgt.exe
  C:\Windows\System\zlCKRgt.exe
  2⤵
  PID:11260
- C:\Windows\System\XBQpHZF.exe
  C:\Windows\System\XBQpHZF.exe
  2⤵
  PID:5840
- C:\Windows\System\dyhrVxn.exe
  C:\Windows\System\dyhrVxn.exe
  2⤵
  PID:7128
- C:\Windows\System\INOtOSf.exe
  C:\Windows\System\INOtOSf.exe
  2⤵
  PID:4916
- C:\Windows\System\hFXiwYO.exe
  C:\Windows\System\hFXiwYO.exe
  2⤵
  PID:6652
- C:\Windows\System\BfZlaRj.exe
  C:\Windows\System\BfZlaRj.exe
  2⤵
  PID:6864
- C:\Windows\System\qCLgEow.exe
  C:\Windows\System\qCLgEow.exe
  2⤵
  PID:5344
- C:\Windows\System\oYjRgpN.exe
  C:\Windows\System\oYjRgpN.exe
  2⤵
  PID:7248
- C:\Windows\System\BgLriWN.exe
  C:\Windows\System\BgLriWN.exe
  2⤵
  PID:2840
- C:\Windows\System\fjVfdTC.exe
  C:\Windows\System\fjVfdTC.exe
  2⤵
  PID:6780
- C:\Windows\System\YVfFvwC.exe
  C:\Windows\System\YVfFvwC.exe
  2⤵
  PID:5804
- C:\Windows\System\lLHzSaY.exe
  C:\Windows\System\lLHzSaY.exe
  2⤵
  PID:8976
- C:\Windows\System\GTMgtix.exe
  C:\Windows\System\GTMgtix.exe
  2⤵
  PID:9500
- C:\Windows\System\xOfKbOj.exe
  C:\Windows\System\xOfKbOj.exe
  2⤵
  PID:9556
- C:\Windows\System\pDENqkS.exe
  C:\Windows\System\pDENqkS.exe
  2⤵
  PID:9604
- C:\Windows\System\SeMtbKw.exe
  C:\Windows\System\SeMtbKw.exe
  2⤵
  PID:9652
- C:\Windows\System\iQFQXDF.exe
  C:\Windows\System\iQFQXDF.exe
  2⤵
  PID:9724
- C:\Windows\System\lybZluo.exe
  C:\Windows\System\lybZluo.exe
  2⤵
  PID:6160
- C:\Windows\System\TkAoGbc.exe
  C:\Windows\System\TkAoGbc.exe
  2⤵
  PID:7052
- C:\Windows\System\RHMPMyd.exe
  C:\Windows\System\RHMPMyd.exe
  2⤵
  PID:3300
- C:\Windows\System\LBVWekK.exe
  C:\Windows\System\LBVWekK.exe
  2⤵
  PID:11208
- C:\Windows\System\eFSwGJQ.exe
  C:\Windows\System\eFSwGJQ.exe
  2⤵
  PID:8344
- C:\Windows\System\tvejNKo.exe
  C:\Windows\System\tvejNKo.exe
  2⤵
  PID:8308
- C:\Windows\System\HOQQnaP.exe
  C:\Windows\System\HOQQnaP.exe
  2⤵
  PID:11224
- C:\Windows\System\HOEbgDt.exe
  C:\Windows\System\HOEbgDt.exe
  2⤵
  PID:8444
- C:\Windows\System\zgEbswo.exe
  C:\Windows\System\zgEbswo.exe
  2⤵
  PID:8540
- C:\Windows\System\brwPEbL.exe
  C:\Windows\System\brwPEbL.exe
  2⤵
  PID:8560
- C:\Windows\System\MicZARS.exe
  C:\Windows\System\MicZARS.exe
  2⤵
  PID:8588
- C:\Windows\System\UDtfWWb.exe
  C:\Windows\System\UDtfWWb.exe
  2⤵
  PID:8664
- C:\Windows\System\HdlgRpc.exe
  C:\Windows\System\HdlgRpc.exe
  2⤵
  PID:8684
- C:\Windows\System\OMstADa.exe
  C:\Windows\System\OMstADa.exe
  2⤵
  PID:8628
- C:\Windows\System\zwmVmkp.exe
  C:\Windows\System\zwmVmkp.exe
  2⤵
  PID:8740
- C:\Windows\System\fJNUxOI.exe
  C:\Windows\System\fJNUxOI.exe
  2⤵
  PID:8780
- C:\Windows\System\MvHnJty.exe
  C:\Windows\System\MvHnJty.exe
  2⤵
  PID:5700
- C:\Windows\System\tDrFzZS.exe
  C:\Windows\System\tDrFzZS.exe
  2⤵
  PID:8840
- C:\Windows\System\TPKhJjL.exe
  C:\Windows\System\TPKhJjL.exe
  2⤵
  PID:5604
- C:\Windows\System\ntWzWLT.exe
  C:\Windows\System\ntWzWLT.exe
  2⤵
  PID:8924
- C:\Windows\System\xWvhzpW.exe
  C:\Windows\System\xWvhzpW.exe
  2⤵
  PID:8940
- C:\Windows\System\gLhXHbc.exe
  C:\Windows\System\gLhXHbc.exe
  2⤵
  PID:7392
- C:\Windows\System\cbfYIVs.exe
  C:\Windows\System\cbfYIVs.exe
  2⤵
  PID:4172
- C:\Windows\System\LMkGtYL.exe
  C:\Windows\System\LMkGtYL.exe
  2⤵
  PID:11236
- C:\Windows\System\rxOQFhm.exe
  C:\Windows\System\rxOQFhm.exe
  2⤵
  PID:11152
- C:\Windows\System\qEFCkVk.exe
  C:\Windows\System\qEFCkVk.exe
  2⤵
  PID:11052
- C:\Windows\System\WIqyeqs.exe
  C:\Windows\System\WIqyeqs.exe
  2⤵
  PID:10688
- C:\Windows\System\aUaSqxh.exe
  C:\Windows\System\aUaSqxh.exe
  2⤵
  PID:10548
- C:\Windows\System\AhcNxiA.exe
  C:\Windows\System\AhcNxiA.exe
  2⤵
  PID:10288
- C:\Windows\System\jPoQgjJ.exe
  C:\Windows\System\jPoQgjJ.exe
  2⤵
  PID:10220
- C:\Windows\System\heZXgGF.exe
  C:\Windows\System\heZXgGF.exe
  2⤵
  PID:10124
- C:\Windows\System\IUUtGJd.exe
  C:\Windows\System\IUUtGJd.exe
  2⤵
  PID:9760
- C:\Windows\System\EvVrkHN.exe
  C:\Windows\System\EvVrkHN.exe
  2⤵
  PID:9572
- C:\Windows\System\YbVAnYo.exe
  C:\Windows\System\YbVAnYo.exe
  2⤵
  PID:9476
- C:\Windows\System\egDWxkZ.exe
  C:\Windows\System\egDWxkZ.exe
  2⤵
  PID:9380
- C:\Windows\System\iqfcdgU.exe
  C:\Windows\System\iqfcdgU.exe
  2⤵
  PID:9264
- C:\Windows\System\qQXytXX.exe
  C:\Windows\System\qQXytXX.exe
  2⤵
  PID:9184
- C:\Windows\System\vREnfwX.exe
  C:\Windows\System\vREnfwX.exe
  2⤵
  PID:9068
- C:\Windows\System\CyWLoFl.exe
  C:\Windows\System\CyWLoFl.exe
  2⤵
  PID:9052
- C:\Windows\System\ZSpHuEt.exe
  C:\Windows\System\ZSpHuEt.exe
  2⤵
  PID:9084
- C:\Windows\System\cPLdkdb.exe
  C:\Windows\System\cPLdkdb.exe
  2⤵
  PID:9124
- C:\Windows\System\texjVzt.exe
  C:\Windows\System\texjVzt.exe
  2⤵
  PID:9168
- C:\Windows\System\hKpUhQt.exe
  C:\Windows\System\hKpUhQt.exe
  2⤵
  PID:8480
- C:\Windows\System\TxKZOpD.exe
  C:\Windows\System\TxKZOpD.exe
  2⤵
  PID:8512
- C:\Windows\System\ToGUWeK.exe
  C:\Windows\System\ToGUWeK.exe
  2⤵
  PID:9944
- C:\Windows\System\kheaqpa.exe
  C:\Windows\System\kheaqpa.exe
  2⤵
  PID:10036
- C:\Windows\System\CUFdJmC.exe
  C:\Windows\System\CUFdJmC.exe
  2⤵
  PID:7772
- C:\Windows\System\VQRpLOv.exe
  C:\Windows\System\VQRpLOv.exe
  2⤵
  PID:7792
- C:\Windows\System\bOyFjXK.exe
  C:\Windows\System\bOyFjXK.exe
  2⤵
  PID:7852
- C:\Windows\System\VHutbFt.exe
  C:\Windows\System\VHutbFt.exe
  2⤵
  PID:7868
- C:\Windows\System\CAZmEro.exe
  C:\Windows\System\CAZmEro.exe
  2⤵
  PID:7964
- C:\Windows\System\EtttCjT.exe
  C:\Windows\System\EtttCjT.exe
  2⤵
  PID:7112
- C:\Windows\System\DDVQcUf.exe
  C:\Windows\System\DDVQcUf.exe
  2⤵
  PID:6904
- C:\Windows\System\lGmEDkU.exe
  C:\Windows\System\lGmEDkU.exe
  2⤵
  PID:6984
- C:\Windows\System\CZIKkIN.exe
  C:\Windows\System\CZIKkIN.exe
  2⤵
  PID:5160
- C:\Windows\System\maXQfZe.exe
  C:\Windows\System\maXQfZe.exe
  2⤵
  PID:6684
- C:\Windows\System\oYKmsjP.exe
  C:\Windows\System\oYKmsjP.exe
  2⤵
  PID:7420
- C:\Windows\System\PusQjDG.exe
  C:\Windows\System\PusQjDG.exe
  2⤵
  PID:8196
- C:\Windows\System\MlddTgC.exe
  C:\Windows\System\MlddTgC.exe
  2⤵
  PID:8272
- C:\Windows\System\pRbxqVV.exe
  C:\Windows\System\pRbxqVV.exe
  2⤵
  PID:5776
- C:\Windows\System\jqMttvB.exe
  C:\Windows\System\jqMttvB.exe
  2⤵
  PID:11272
- C:\Windows\System\JwvVCjr.exe
  C:\Windows\System\JwvVCjr.exe
  2⤵
  PID:11292
- C:\Windows\System\AebLLHi.exe
  C:\Windows\System\AebLLHi.exe
  2⤵
  PID:11312
- C:\Windows\System\MDKcYsk.exe
  C:\Windows\System\MDKcYsk.exe
  2⤵
  PID:11328
- C:\Windows\System\PPhmJAv.exe
  C:\Windows\System\PPhmJAv.exe
  2⤵
  PID:11348
- C:\Windows\System\iYPbdwj.exe
  C:\Windows\System\iYPbdwj.exe
  2⤵
  PID:11368
- C:\Windows\System\Feupmns.exe
  C:\Windows\System\Feupmns.exe
  2⤵
  PID:11388
- C:\Windows\System\CylYiFo.exe
  C:\Windows\System\CylYiFo.exe
  2⤵
  PID:11408
- C:\Windows\System\ICYNfNJ.exe
  C:\Windows\System\ICYNfNJ.exe
  2⤵
  PID:11424
- C:\Windows\System\BDwIYar.exe
  C:\Windows\System\BDwIYar.exe
  2⤵
  PID:11444
- C:\Windows\System\UXjbwFn.exe
  C:\Windows\System\UXjbwFn.exe
  2⤵
  PID:11464
- C:\Windows\System\BYbWkTY.exe
  C:\Windows\System\BYbWkTY.exe
  2⤵
  PID:11480
- C:\Windows\System\occfmwp.exe
  C:\Windows\System\occfmwp.exe
  2⤵
  PID:11500
- C:\Windows\System\crpVwNV.exe
  C:\Windows\System\crpVwNV.exe
  2⤵
  PID:11520
- C:\Windows\System\aZLqDFE.exe
  C:\Windows\System\aZLqDFE.exe
  2⤵
  PID:11536
- C:\Windows\System\gyPPOLl.exe
  C:\Windows\System\gyPPOLl.exe
  2⤵
  PID:11560
- C:\Windows\System\UNLxsei.exe
  C:\Windows\System\UNLxsei.exe
  2⤵
  PID:11576
- C:\Windows\System\iNKSCmh.exe
  C:\Windows\System\iNKSCmh.exe
  2⤵
  PID:11596
- C:\Windows\System\taDocyc.exe
  C:\Windows\System\taDocyc.exe
  2⤵
  PID:11616
- C:\Windows\System\XtGOfxC.exe
  C:\Windows\System\XtGOfxC.exe
  2⤵
  PID:11632
- C:\Windows\System\hKiQbSB.exe
  C:\Windows\System\hKiQbSB.exe
  2⤵
  PID:11652
- C:\Windows\System\xREbFDh.exe
  C:\Windows\System\xREbFDh.exe
  2⤵
  PID:11672
- C:\Windows\System\ygfzlff.exe
  C:\Windows\System\ygfzlff.exe
  2⤵
  PID:11876
- C:\Windows\System\spmAbnb.exe
  C:\Windows\System\spmAbnb.exe
  2⤵
  PID:11900
- C:\Windows\System\NSVyQdp.exe
  C:\Windows\System\NSVyQdp.exe
  2⤵
  PID:11928
- C:\Windows\System\cmtwYKr.exe
  C:\Windows\System\cmtwYKr.exe
  2⤵
  PID:11960
- C:\Windows\System\ChhBQfN.exe
  C:\Windows\System\ChhBQfN.exe
  2⤵
  PID:11980
- C:\Windows\System\xsljozO.exe
  C:\Windows\System\xsljozO.exe
  2⤵
  PID:12000
- C:\Windows\System\aTSmYGb.exe
  C:\Windows\System\aTSmYGb.exe
  2⤵
  PID:12028
- C:\Windows\System\SwcfekX.exe
  C:\Windows\System\SwcfekX.exe
  2⤵
  PID:12048
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12048 -s 28
    3⤵
    PID:11548
- C:\Windows\System\DSYPzia.exe
  C:\Windows\System\DSYPzia.exe
  2⤵
  PID:12072
- C:\Windows\System\weVykea.exe
  C:\Windows\System\weVykea.exe
  2⤵
  PID:12092
- C:\Windows\System\KvRAHZj.exe
  C:\Windows\System\KvRAHZj.exe
  2⤵
  PID:12116
- C:\Windows\System\FBWfXYv.exe
  C:\Windows\System\FBWfXYv.exe
  2⤵
  PID:12132
- C:\Windows\System\xaGrCvC.exe
  C:\Windows\System\xaGrCvC.exe
  2⤵
  PID:12148
- C:\Windows\System\lWPweQB.exe
  C:\Windows\System\lWPweQB.exe
  2⤵
  PID:12164
- C:\Windows\System\qCYKNcq.exe
  C:\Windows\System\qCYKNcq.exe
  2⤵
  PID:12180
- C:\Windows\System\ywAafHn.exe
  C:\Windows\System\ywAafHn.exe
  2⤵
  PID:12196
- C:\Windows\System\SpGaUBP.exe
  C:\Windows\System\SpGaUBP.exe
  2⤵
  PID:12212
- C:\Windows\System\qbBucUp.exe
  C:\Windows\System\qbBucUp.exe
  2⤵
  PID:12228
- C:\Windows\System\pAjphsW.exe
  C:\Windows\System\pAjphsW.exe
  2⤵
  PID:12244
- C:\Windows\System\QIXmEQL.exe
  C:\Windows\System\QIXmEQL.exe
  2⤵
  PID:12260
- C:\Windows\System\SAJpCap.exe
  C:\Windows\System\SAJpCap.exe
  2⤵
  PID:12276
- C:\Windows\System\EDiusAC.exe
  C:\Windows\System\EDiusAC.exe
  2⤵
  PID:9664
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 9664 -s 28
    3⤵
    PID:13048
- C:\Windows\System\XXSYGqM.exe
  C:\Windows\System\XXSYGqM.exe
  2⤵
  PID:9200
- C:\Windows\System\TJsbPxa.exe
  C:\Windows\System\TJsbPxa.exe
  2⤵
  PID:9280
- C:\Windows\System\dmLnyBa.exe
  C:\Windows\System\dmLnyBa.exe
  2⤵
  PID:9328
- C:\Windows\System\GdstfoJ.exe
  C:\Windows\System\GdstfoJ.exe
  2⤵
  PID:9396
- C:\Windows\System\kkEtSas.exe
  C:\Windows\System\kkEtSas.exe
  2⤵
  PID:9876
- C:\Windows\System\jWftoCs.exe
  C:\Windows\System\jWftoCs.exe
  2⤵
  PID:8380
- C:\Windows\System\dxkTpMM.exe
  C:\Windows\System\dxkTpMM.exe
  2⤵
  PID:12296
- C:\Windows\System\hkJOFzl.exe
  C:\Windows\System\hkJOFzl.exe
  2⤵
  PID:12324
- C:\Windows\System\trfqTrL.exe
  C:\Windows\System\trfqTrL.exe
  2⤵
  PID:12340
- C:\Windows\System\gDcGZiC.exe
  C:\Windows\System\gDcGZiC.exe
  2⤵
  PID:12364
- C:\Windows\System\KUSIhby.exe
  C:\Windows\System\KUSIhby.exe
  2⤵
  PID:12384
- C:\Windows\System\aNMQhrL.exe
  C:\Windows\System\aNMQhrL.exe
  2⤵
  PID:12408
- C:\Windows\System\cqMbAss.exe
  C:\Windows\System\cqMbAss.exe
  2⤵
  PID:12428
- C:\Windows\System\hnMOCqk.exe
  C:\Windows\System\hnMOCqk.exe
  2⤵
  PID:12444
- C:\Windows\System\XEyUVwn.exe
  C:\Windows\System\XEyUVwn.exe
  2⤵
  PID:12468
- C:\Windows\System\AptrfXP.exe
  C:\Windows\System\AptrfXP.exe
  2⤵
  PID:12488
- C:\Windows\System\pCGrfCY.exe
  C:\Windows\System\pCGrfCY.exe
  2⤵
  PID:12520
- C:\Windows\System\pWtiPqk.exe
  C:\Windows\System\pWtiPqk.exe
  2⤵
  PID:12544
- C:\Windows\System\YHKpcMx.exe
  C:\Windows\System\YHKpcMx.exe
  2⤵
  PID:12572
- C:\Windows\System\fRqpMoP.exe
  C:\Windows\System\fRqpMoP.exe
  2⤵
  PID:12592
- C:\Windows\System\hQRkcRR.exe
  C:\Windows\System\hQRkcRR.exe
  2⤵
  PID:12624
- C:\Windows\System\GmIuANN.exe
  C:\Windows\System\GmIuANN.exe
  2⤵
  PID:12648
- C:\Windows\System\huKMrkm.exe
  C:\Windows\System\huKMrkm.exe
  2⤵
  PID:12664
- C:\Windows\System\AqJFJtD.exe
  C:\Windows\System\AqJFJtD.exe
  2⤵
  PID:12696
- C:\Windows\System\eNxNgYJ.exe
  C:\Windows\System\eNxNgYJ.exe
  2⤵
  PID:12716
- C:\Windows\System\MTdqdRv.exe
  C:\Windows\System\MTdqdRv.exe
  2⤵
  PID:12744
- C:\Windows\System\SufpnAA.exe
  C:\Windows\System\SufpnAA.exe
  2⤵
  PID:12772
- C:\Windows\System\kVNwgKY.exe
  C:\Windows\System\kVNwgKY.exe
  2⤵
  PID:12792
- C:\Windows\System\FFeCsCf.exe
  C:\Windows\System\FFeCsCf.exe
  2⤵
  PID:12812
- C:\Windows\System\nQhTqlx.exe
  C:\Windows\System\nQhTqlx.exe
  2⤵
  PID:12832
- C:\Windows\System\guixakk.exe
  C:\Windows\System\guixakk.exe
  2⤵
  PID:12852
- C:\Windows\System\xTZCwWI.exe
  C:\Windows\System\xTZCwWI.exe
  2⤵
  PID:12876
- C:\Windows\System\yNewQCj.exe
  C:\Windows\System\yNewQCj.exe
  2⤵
  PID:12904
- C:\Windows\System\MdWINfh.exe
  C:\Windows\System\MdWINfh.exe
  2⤵
  PID:12932
- C:\Windows\System\oFJQIrd.exe
  C:\Windows\System\oFJQIrd.exe
  2⤵
  PID:12956
- C:\Windows\System\BGPQgki.exe
  C:\Windows\System\BGPQgki.exe
  2⤵
  PID:10236
- C:\Windows\System\iHvuhws.exe
  C:\Windows\System\iHvuhws.exe
  2⤵
  PID:1804
- C:\Windows\System\TTLghra.exe
  C:\Windows\System\TTLghra.exe
  2⤵
  PID:8256
- C:\Windows\System\UekLmgt.exe
  C:\Windows\System\UekLmgt.exe
  2⤵
  PID:6600
- C:\Windows\System\eTybmfa.exe
  C:\Windows\System\eTybmfa.exe
  2⤵
  PID:11384
- C:\Windows\System\euhiiOh.exe
  C:\Windows\System\euhiiOh.exe
  2⤵
  PID:11440
- C:\Windows\System\jgfmCiW.exe
  C:\Windows\System\jgfmCiW.exe
  2⤵
  PID:11496
- C:\Windows\System\NwgSTyQ.exe
  C:\Windows\System\NwgSTyQ.exe
  2⤵
  PID:11556
- C:\Windows\System\UEAQNvE.exe
  C:\Windows\System\UEAQNvE.exe
  2⤵
  PID:11628
- C:\Windows\System\SMMpDQW.exe
  C:\Windows\System\SMMpDQW.exe
  2⤵
  PID:11688
- C:\Windows\System\IMLeHoj.exe
  C:\Windows\System\IMLeHoj.exe
  2⤵
  PID:11720
- C:\Windows\System\RkLoFlI.exe
  C:\Windows\System\RkLoFlI.exe
  2⤵
  PID:12160
- C:\Windows\System\YMdXGJe.exe
  C:\Windows\System\YMdXGJe.exe
  2⤵
  PID:11992
- C:\Windows\System\vwRZaAS.exe
  C:\Windows\System\vwRZaAS.exe
  2⤵
  PID:11336
- C:\Windows\System\kapwvqE.exe
  C:\Windows\System\kapwvqE.exe
  2⤵
  PID:11476
- C:\Windows\System\CBmJplj.exe
  C:\Windows\System\CBmJplj.exe
  2⤵
  PID:11380
- C:\Windows\System\YsmKygK.exe
  C:\Windows\System\YsmKygK.exe
  2⤵
  PID:5196
- C:\Windows\System\WKmAuNF.exe
  C:\Windows\System\WKmAuNF.exe
  2⤵
  PID:10636
- C:\Windows\System\weLYaqR.exe
  C:\Windows\System\weLYaqR.exe
  2⤵
  PID:11172
- C:\Windows\System\lQHaDTG.exe
  C:\Windows\System\lQHaDTG.exe
  2⤵
  PID:8644
- C:\Windows\System\zsWHOtG.exe
  C:\Windows\System\zsWHOtG.exe
  2⤵
  PID:5756
- C:\Windows\System\ZUtOgqP.exe
  C:\Windows\System\ZUtOgqP.exe
  2⤵
  PID:11356
- C:\Windows\System\hUWBIuZ.exe
  C:\Windows\System\hUWBIuZ.exe
  2⤵
  PID:1168
- C:\Windows\System\xnslnYD.exe
  C:\Windows\System\xnslnYD.exe
  2⤵
  PID:11612
- C:\Windows\System\GkBBZsk.exe
  C:\Windows\System\GkBBZsk.exe
  2⤵
  PID:11860
- C:\Windows\System\fxyJUqX.exe
  C:\Windows\System\fxyJUqX.exe
  2⤵
  PID:11956
- C:\Windows\System\lwqHIkB.exe
  C:\Windows\System\lwqHIkB.exe
  2⤵
  PID:12056
- C:\Windows\System\Hjupqnl.exe
  C:\Windows\System\Hjupqnl.exe
  2⤵
  PID:13220
- C:\Windows\System\QLyOaeS.exe
  C:\Windows\System\QLyOaeS.exe
  2⤵
  PID:9308
- C:\Windows\System\gRSqnOY.exe
  C:\Windows\System\gRSqnOY.exe
  2⤵
  PID:2916
- C:\Windows\System\fwZTjpV.exe
  C:\Windows\System\fwZTjpV.exe
  2⤵
  PID:6352
- C:\Windows\System\MKIKRBE.exe
  C:\Windows\System\MKIKRBE.exe
  2⤵
  PID:7544
- C:\Windows\System\AmhHAfy.exe
  C:\Windows\System\AmhHAfy.exe
  2⤵
  PID:11752
- C:\Windows\System\nghWLPH.exe
  C:\Windows\System\nghWLPH.exe
  2⤵
  PID:10224
- C:\Windows\System\GYoLqlB.exe
  C:\Windows\System\GYoLqlB.exe
  2⤵
  PID:4544
- C:\Windows\System\ZVYNiJx.exe
  C:\Windows\System\ZVYNiJx.exe
  2⤵
  PID:12452
- C:\Windows\System\UeLbrAf.exe
  C:\Windows\System\UeLbrAf.exe
  2⤵
  PID:4588
- C:\Windows\System\IGpgUTb.exe
  C:\Windows\System\IGpgUTb.exe
  2⤵
  PID:11760
- C:\Windows\System\uubSDyN.exe
  C:\Windows\System\uubSDyN.exe
  2⤵
  PID:4464
- C:\Windows\System\mzLQCbp.exe
  C:\Windows\System\mzLQCbp.exe
  2⤵
  PID:2420
- C:\Windows\System\iHDyHzS.exe
  C:\Windows\System\iHDyHzS.exe
  2⤵
  PID:9152
- C:\Windows\System\vTZUGdi.exe
  C:\Windows\System\vTZUGdi.exe
  2⤵
  PID:11548
- C:\Windows\System\kwXdLlx.exe
  C:\Windows\System\kwXdLlx.exe
  2⤵
  PID:2884
- C:\Windows\System\FmqOiro.exe
  C:\Windows\System\FmqOiro.exe
  2⤵
  PID:9800
- C:\Windows\System\ZpNtIBg.exe
  C:\Windows\System\ZpNtIBg.exe
  2⤵
  PID:12356
- C:\Windows\System\MTDoCXP.exe
  C:\Windows\System\MTDoCXP.exe
  2⤵
  PID:1056
- C:\Windows\System\dckOQOZ.exe
  C:\Windows\System\dckOQOZ.exe
  2⤵
  PID:11488
- C:\Windows\System\rehLPtt.exe
  C:\Windows\System\rehLPtt.exe
  2⤵
  PID:11240
- C:\Windows\System\oEAbjOK.exe
  C:\Windows\System\oEAbjOK.exe
  2⤵
  PID:6528
- C:\Windows\System\phVaREK.exe
  C:\Windows\System\phVaREK.exe
  2⤵
  PID:11284
- C:\Windows\System\ALVHrbY.exe
  C:\Windows\System\ALVHrbY.exe
  2⤵
  PID:10080
- C:\Windows\System\vPtUgLF.exe
  C:\Windows\System\vPtUgLF.exe
  2⤵
  PID:12764
- C:\Windows\System\DJBJSJT.exe
  C:\Windows\System\DJBJSJT.exe
  2⤵
  PID:4756
- C:\Windows\System\GFGryDd.exe
  C:\Windows\System\GFGryDd.exe
  2⤵
  PID:12064
- C:\Windows\System\hRmFMkc.exe
  C:\Windows\System\hRmFMkc.exe
  2⤵
  PID:12484
- C:\Windows\System\AUbjBtS.exe
  C:\Windows\System\AUbjBtS.exe
  2⤵
  PID:7336
- C:\Windows\System\YxAtwEf.exe
  C:\Windows\System\YxAtwEf.exe
  2⤵
  PID:10676
- C:\Windows\System\zEVujgw.exe
  C:\Windows\System\zEVujgw.exe
  2⤵
  PID:3792
- C:\Windows\System\MDIdaDR.exe
  C:\Windows\System\MDIdaDR.exe
  2⤵
  PID:9036
- C:\Windows\System\ATBdYNf.exe
  C:\Windows\System\ATBdYNf.exe
  2⤵
  PID:13388
- C:\Windows\System\eewVItR.exe
  C:\Windows\System\eewVItR.exe
  2⤵
  PID:13468
- C:\Windows\System\iinGZrq.exe
  C:\Windows\System\iinGZrq.exe
  2⤵
  PID:13500
- C:\Windows\System\LXTrlYJ.exe
  C:\Windows\System\LXTrlYJ.exe
  2⤵
  PID:13540
- C:\Windows\System\fBkdRJg.exe
  C:\Windows\System\fBkdRJg.exe
  2⤵
  PID:13632
- C:\Windows\System\zBwlgYU.exe
  C:\Windows\System\zBwlgYU.exe
  2⤵
  PID:13784
- C:\Windows\System\UMTUYzC.exe
  C:\Windows\System\UMTUYzC.exe
  2⤵
  PID:13816
- C:\Windows\System\NpXeWyn.exe
  C:\Windows\System\NpXeWyn.exe
  2⤵
  PID:13836
- C:\Windows\System\ZKLmDCu.exe
  C:\Windows\System\ZKLmDCu.exe
  2⤵
  PID:13860
- C:\Windows\System\EosOQZM.exe
  C:\Windows\System\EosOQZM.exe
  2⤵
  PID:13896
- C:\Windows\System\bBCNdHW.exe
  C:\Windows\System\bBCNdHW.exe
  2⤵
  PID:13920
- C:\Windows\System\wPXxgde.exe
  C:\Windows\System\wPXxgde.exe
  2⤵
  PID:13940
- C:\Windows\System\hGtfpfN.exe
  C:\Windows\System\hGtfpfN.exe
  2⤵
  PID:13960
- C:\Windows\System\rLTAKKb.exe
  C:\Windows\System\rLTAKKb.exe
  2⤵
  PID:13988
- C:\Windows\System\ZJrJhkG.exe
  C:\Windows\System\ZJrJhkG.exe
  2⤵
  PID:14016
- C:\Windows\System\zKlAwPv.exe
  C:\Windows\System\zKlAwPv.exe
  2⤵
  PID:14036
- C:\Windows\System\iEBaZYI.exe
  C:\Windows\System\iEBaZYI.exe
  2⤵
  PID:14060
- C:\Windows\System\lPBdCRw.exe
  C:\Windows\System\lPBdCRw.exe
  2⤵
  PID:14256
- C:\Windows\System\tuvpVyL.exe
  C:\Windows\System\tuvpVyL.exe
  2⤵
  PID:7460
- C:\Windows\System\lfNpWKm.exe
  C:\Windows\System\lfNpWKm.exe
  2⤵
  PID:10320
- C:\Windows\System\YfbBkuv.exe
  C:\Windows\System\YfbBkuv.exe
  2⤵
  PID:4912
- C:\Windows\System\WLQFNZR.exe
  C:\Windows\System\WLQFNZR.exe
  2⤵
  PID:13352
- C:\Windows\System\HPHFaBR.exe
  C:\Windows\System\HPHFaBR.exe
  2⤵
  PID:3852
- C:\Windows\System\CLhaTFk.exe
  C:\Windows\System\CLhaTFk.exe
  2⤵
  PID:13332
- C:\Windows\System\KwPygHE.exe
  C:\Windows\System\KwPygHE.exe
  2⤵
  PID:9228
- C:\Windows\System\ZURHGfs.exe
  C:\Windows\System\ZURHGfs.exe
  2⤵
  PID:13372
- C:\Windows\System\xDNZJui.exe
  C:\Windows\System\xDNZJui.exe
  2⤵
  PID:13512
- C:\Windows\System\hfzeRHQ.exe
  C:\Windows\System\hfzeRHQ.exe
  2⤵
  PID:13348
- C:\Windows\System\BxyQzZt.exe
  C:\Windows\System\BxyQzZt.exe
  2⤵
  PID:13048
- C:\Windows\System\OjGNcjM.exe
  C:\Windows\System\OjGNcjM.exe
  2⤵
  PID:13528
- C:\Windows\System\kNaqFqj.exe
  C:\Windows\System\kNaqFqj.exe
  2⤵
  PID:13588
- C:\Windows\System\HlieoxN.exe
  C:\Windows\System\HlieoxN.exe
  2⤵
  PID:13708
- C:\Windows\System\tTIbhNt.exe
  C:\Windows\System\tTIbhNt.exe
  2⤵
  PID:13884
- C:\Windows\System\vxyageE.exe
  C:\Windows\System\vxyageE.exe
  2⤵
  PID:14120
- C:\Windows\System\eWGcRcp.exe
  C:\Windows\System\eWGcRcp.exe
  2⤵
  PID:14284
- C:\Windows\System\OpuTNyh.exe
  C:\Windows\System\OpuTNyh.exe
  2⤵
  PID:9324
- C:\Windows\System\kwmmCIT.exe
  C:\Windows\System\kwmmCIT.exe
  2⤵
  PID:13556

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 11520 -ip 11520
1⤵
PID:11760

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 688 -p 9396 -ip 9396
1⤵
PID:10320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0f3cvhjk.juf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AqBpgFM.exe

Filesize
1.7MB

MD5
c294f630867c46c12403f8e615745005

SHA1
2fbec06c1240577e9a0fefe49e87e6821cf368cd

SHA256
61509e735b3855ab8729cde20ca40227fe192c8f05471e4687e7ea5a82ac5593

SHA512
ec4cf833ec6f18bf24aaef08cf7af8cc0f60e1e43aba1c51eb752ce5861781678edf4eb52febb5dc96aacb9ac54902322a9745535e89077781025d31b319b58a

Download Submit
C:\Windows\System\AvXQDlq.exe

Filesize
1.7MB

MD5
4bf3a51a834a12b75d82b07ccadd32d0

SHA1
40718bf593d609f0d30feec9a0f6bc1c371db148

SHA256
e4ebd11741f7b8150c578ec0bf283a2c2ad54e5854d77dfdd86b4cdb3835ec19

SHA512
a23dd99925f6d60c2c38c52b2a3d98052f69814c96f75cb65bf3f99fed957f5ec3aaefa98f8e266f0a5b8ea6f816f40bade91856920d148605bed7ce246ce0d6

Download Submit
C:\Windows\System\EGEPsSv.exe

Filesize
1.7MB

MD5
fe588f5ffb5737d47d20fb2b8518f46e

SHA1
0cfb780740008e333d6a50974ba7db4633972e9f

SHA256
7bdb97eccf2df7b643eb3f6aaa9e1f9d593db520b893fd4ce3e097edcf33c409

SHA512
3a405ef5a39e0dd66b696b4f8bca426cc9bc632cb353857d2cb77eeb7aa5a4141b957571ac598b37fdde385c1f33753e04ae9184234942d5f2d140326c0afd03

Download Submit
C:\Windows\System\EJaYTEP.exe

Filesize
1.7MB

MD5
c37ab0aa46f3588c3d9e9a55afa85f30

SHA1
f1a5a07b36a99e9ff678957104eb00061bbc7bd6

SHA256
ea499acbfb095deeb6adc4db62b52548ee3d3443e8511a5f77e2636b48adaf84

SHA512
627d2bb90fea669336e8a336ed01bdf96a8a932ecece8ede3a51affa1976669289789810d9a5d6a244cd82a0e10e53a608a17b9b933212d5a170b081ff12d14a

Download Submit
C:\Windows\System\EJgpjUq.exe

Filesize
1.7MB

MD5
01ca350660d695cfe1516875b958c7af

SHA1
0d125d07558568e8fc19c625de8457417e1df0c8

SHA256
b4560af0a88ea9802802ff870cde7444aaff77fa053a063d6efc94778db46a48

SHA512
092d1725af169dd483f5853430726ee5de2e58e96c5a9e6927617ac0f6addf65a6be21d3fb266e89714f731d12e8afd06db9f6d6df1fa132ba19b2cd8ab9aaa4

Download Submit
C:\Windows\System\EaMChiH.exe

Filesize
1.7MB

MD5
1af89205c976a899e523aa485fce67aa

SHA1
f4974bf22af75291657e9e1e2c6a12a9a69d33ca

SHA256
8edad80225ef8a2fb0d08d19783f7eb86099333cc79f5e2e119f0c92681b6a57

SHA512
57fa8ac9ddafdd6d059cd6416abb6121a8058bd56d38b6ff09dacee9b3423597e6cd31a8c500d3612c5a2b56ac97b5e78ad6b62a8b6352a2b765c8c025d665ad

Download Submit
C:\Windows\System\FbxgLfz.exe

Filesize
1.7MB

MD5
4d39649e4b53d6b0ac28f79ff204bf77

SHA1
83f5f4d6ac661da2cf74dff6f882fc0ac441eef7

SHA256
454b1549897c5d718425a6dc24e0092ff5888ec8ace6d0bf44cb605a6ec2e1a5

SHA512
c6718714c084263dd875e9f3279fa4f19e0f39c36890d05a99e5254aaa186fcbfef7bbdc3846edfd1fa4ed2687c09d43d633b4578c6d9d69bf4068e122d81b4d

Download Submit
C:\Windows\System\GNjwsma.exe

Filesize
1.7MB

MD5
d828b5d09afa198c5b3d2727e6b0ebf5

SHA1
b2df01057be694438e546037fa3256eaf25a697e

SHA256
d8fddf7a5a76d5a144a860f7af7a22f05f93da8634a35b8e8aec0e668c428a44

SHA512
5893ca55a1ca21024202ceff9466baf23f9e321041c7351876861005377004b4f7bc5e31e7b3af52e454c2e8e5f631b65f80b825ef2790ed5b1fc3b715f928b1

Download Submit
C:\Windows\System\HzETGSw.exe

Filesize
1.7MB

MD5
43d60c32d7abe24b9aaa8f122af11dc8

SHA1
ae16c453b3ef01d53e57ba2c5008cf9d72d82d1d

SHA256
c9c6995bec938ad02d3ccda37a3e39d9609f9920b00f490870dc9152c9909644

SHA512
6dfbf271fcfd789a2158f17d527ba839a7b7fc7becdb0686a29f5ebcb3dcb0fd369f640646cfde3413cf7e09255cd9af788a71c0888de32f0ba50f086371c932

Download Submit
C:\Windows\System\JuGejUs.exe

Filesize
1.7MB

MD5
359fcc66ab86a25bdc8430af0aeaa55b

SHA1
5fde2224aa33cfc96bab11c1bcd796a6dca02b71

SHA256
851ee09a06add54dc59e131c1c3ac5eb56b523a9a8ba1e368088b243fca4cd5e

SHA512
4a4d20bc4d716a4222202546ab2023e24157bd3680305765308a4ed8cdf01c44a7b5565943539c92bb0b4f3de15660b784759987184b1d684ff5818ba1e6d6f4

Download Submit
C:\Windows\System\KZtWPEE.exe

Filesize
1.7MB

MD5
0ce153efcd3b4c5c83858ca1b9411d1e

SHA1
826bb960e7f384a5f81672b5230eecbb1170d0ee

SHA256
d173b97c9a3a905b5d3de9f9a9ffbc32a83bcf76c914e91fbb83016ca60006b5

SHA512
af515c21cdd71ba554e4f6137db650978deff2422bbeb2651a0b1c6e7073549bb54b1acccad72440d0dc70f3b508c6d020cfcfdfb40662b0a1b0ac73aea4a07e

Download Submit
C:\Windows\System\KqImMap.exe

Filesize
1.7MB

MD5
0e4e8423eacfd473225dc5f12cd71df2

SHA1
ea85438bfb15ec6e920945416b4b3b4220e82d7a

SHA256
493727c87b48f77df8e40f229d29bca419cb576d2309bf73e8e606b5c9f3259a

SHA512
9b1633382c8fe705c1de9b96de0604ff1bdd3b60f8b6901e9ba0db38d4da57ce550f1b006eef147965d6c305fc802a2f5661356268ebbcbe6e3482096bb962a1

Download Submit
C:\Windows\System\NDsBiph.exe

Filesize
1.7MB

MD5
16a8f43c2ded44d7dbda7d2b6351619d

SHA1
42a032dd456f55cf5d0d3d601f17ba266554ed3a

SHA256
f5431aba90ae373027d56b7df7f8049281c4ec0eded18af7876d5644d971467a

SHA512
7597661de9d36bef49c0ff51dc37cbd2743d4eb7c68f744ed8db5115a6a18d572d00d09661aaf9078425da714be7cf85980fa9938f655e3e0f11ba62189f462c

Download Submit
C:\Windows\System\NSUTNqc.exe

Filesize
1.7MB

MD5
70bd66d8e58a692d24f9246e9c706d4d

SHA1
89d4bdf825787ef18d714c66788ed8fc8eb6a8ae

SHA256
504e72b4f17eb443f52c80346a6d0eea88fda72d101d0f45ffed84d97f5c3930

SHA512
e3bafbf6602893dea933a4633e4e4448d60d2cea86532a6cdffff2ba21949f37512a82a39934b489dae6d3bae48a2cf9708ebadbf435e33f96154f94a090fe1e

Download Submit
C:\Windows\System\NmdeyyH.exe

Filesize
1.7MB

MD5
3957fc01a8e5e47a8fccc21d784c544a

SHA1
da8bd2f80a008fad4077ac90f1bb9fee5c6351a3

SHA256
777c8a2ec52c288190d08ef0a6b17b5c7b8862f518664dd923f3c108864badb9

SHA512
fb7124ca52f1315968ca5bb19ae5c9a3e6d9272b76c8c3545c9fcac399e5cd0aaabb983c55fd2e7d95394c37f301b9ee1bb107bbf3621065fea90b0b288cf302

Download Submit
C:\Windows\System\PiDhLwx.exe

Filesize
1.7MB

MD5
c17d0bf98ace5768d141d6218a921c78

SHA1
a064194fd01e094c7a77ae8c033abbbcdcd86619

SHA256
ee47ce098d71373be2d7d58e852565dc45860ffb60e7f58fb8199595b5b4909d

SHA512
df662aead8ed38d0c8f3a6ac956f19eee88aba7d5836960233560c09b2fb585d866fc2abadd98d525f5b2b99a7417ae97363824303b1914a22be0643cf25f81c

Download Submit
C:\Windows\System\RkQSlSf.exe

Filesize
1.7MB

MD5
3853fbab5dde36648ef26299c318f3ea

SHA1
8cf7901f00c7611dc9f6d65f88ff37df281241bb

SHA256
9191ffa30d40b51d132624d5d386353714a4a4edc6bfe51bdeb701ba45cea0d6

SHA512
f177300af7e28fab44c435cf154b669feb56b89e4bd6a1eb78c9fba8536ccf2cfa396db7744f000340ad4e41362b2915d9d6bddea61fa878140cb1c6679233c5

Download Submit
C:\Windows\System\SsPBYWF.exe

Filesize
1.7MB

MD5
01ede099193003ffcc9a501fc7cff1c7

SHA1
098b5945f072a2c2564972d61c307a7159585323

SHA256
4ff6cc6364c596bf51e343990d30b8fa54a256dba3a22819e9b37b442587a27a

SHA512
833d4de71425b66f884d308656d730aab2df6d1ae89f00a2345769b9225d4f572ea598115cb59f342dd9ac1d9e69ace5f0638e204027785db21a44aec8dd4f9e

Download Submit
C:\Windows\System\TEjyEWj.exe

Filesize
1.7MB

MD5
3f7a2d41edcc100da654da54275a4b5c

SHA1
5f875bbca4c81dca5af90d2b033ca01b14c5b1bb

SHA256
257f9f1854a610f6164517b9e7abcd324ad0b14d0b1b0ea99ac206108e45b5ce

SHA512
44cc24cac733d327d7f388aa81e3376804e2d3f92746f51b6d6c51e20e8d00def327b1be77e0f04a5c14bcdf9e93ab431d7eea2cb44058f7ced0f347e1c6fbf6

Download Submit
C:\Windows\System\TrYrLac.exe

Filesize
1.7MB

MD5
78946afebbea32fee6d18123ba3597a7

SHA1
b92884a21e4429eb061feff2f346c5fd7c4fa77b

SHA256
26ffaf96457af6a74ad23b5cd170f1a4cd61d51e4f4a3b2b32d4dd3c561f30b5

SHA512
46e0cc33b25c5d5344b9e11ab85a175bf09cca35244d10f49a43f75238289bedd19857ec66e3dd46158c9b17123302c737282f5d5236e8533d233c5cfc66040f

Download Submit
C:\Windows\System\UQGPNSX.exe

Filesize
1.7MB

MD5
32c90afed1d323c210ec9dae2e518c67

SHA1
87c9fea570e162bbaf74ab6de11e04b7ac7a3ebf

SHA256
965b6c01940b197f7ff35a6021b1762f5438a42a6b5312faaa4f35426b12181c

SHA512
eeed5d7a995c6e3682bddf460c86410a943d110e26644d2ad171d36c371350a22babca4fa7e2293f13c76dbdaddedf1f51089497e37249d55ab270a2eca15813

Download Submit
C:\Windows\System\VEJHeSV.exe

Filesize
1.7MB

MD5
e517839cbf43996f2e0ccf5e4d7df4e3

SHA1
f69f84be0de934a20a2acf8c0f25d8d0b636660e

SHA256
06768e425c866793aee22b597d6a3711eb4c45d0639cc617faf106c1cea4b58a

SHA512
61de9256901771fbeb13ca9aab10ee2a18485a3a3786b7646339362b6c388a1b821b94bbcf2cce7538d69caf7c8aef476ab45cdd13327251a28d528aa9e32f30

Download Submit
C:\Windows\System\WpNIIsF.exe

Filesize
1.7MB

MD5
09142ca3703d304234b334d977d47b19

SHA1
87dd5f430764ea4293e5cf14e214f2a37c804b8e

SHA256
d2ef894182826aa5d91ae77657d3943ffa6230c3535f10bae829b3c61b2bf42c

SHA512
01c599ac5adc06aa446f975b0b78bc5e78b7b8dbb0120945baa6dee818efa6f794b97e57c72f8c7f14482a57019173cb5009952e4247d63205d829f78c290b93

Download Submit
C:\Windows\System\WwNZCGI.exe

Filesize
1.7MB

MD5
e5a9aef65eec21e573d8ffa4c2e889ac

SHA1
c9c9b2cef1322592016daf473aed540758a2cb0a

SHA256
9689d6253c7659fd9b4ca030a2c6bc336f17bb601e775d473685f206aab85675

SHA512
b119bdf5d32c8a19b923cfb8b910720cca07a794fc9022daacd8316072b2fe5cc1caa81186d8b34305c9c22cb5c62e261abc70ba8331e135abc5dde012f359d7

Download Submit
C:\Windows\System\XPenzce.exe

Filesize
1.7MB

MD5
7402e0407b825cb33261ef877ae88efe

SHA1
913a459087d17b13964bbef793b7883cd5b96cbd

SHA256
b90efae66a332dbf9379008e49b340cd4a57dfe96eeadded1ad8981b1ba80e2e

SHA512
0f271f2c44505cce2fe380588a8fc4dedb17aa7309779259d024e43cae74b97f5a3ab2acc9dfdad071863e51361d516ad6c27e7cac071b7059b77811e84e317d

Download Submit
C:\Windows\System\ZYzvRvH.exe

Filesize
1.7MB

MD5
eaf5684c271c493ef7e9bf96ef398325

SHA1
6ebb1f9325fe03892a8c96e02f105f5c5700fa36

SHA256
eabfd41f1d7b239433ae5ba7f75b138f9c4b83de659f6999a83b8c88a6db0fd9

SHA512
ae8b1839fc8526d38d9971ff09a7d61a405ab4155d35eef0029d441dca764d49b9ca410ce1b86043c376360546151f5643913cf579c035d45cd033d5f6834909

Download Submit
C:\Windows\System\aMMvswH.exe

Filesize
1.7MB

MD5
c016acb8a55742fa9ed3b706b590e3cd

SHA1
3f63e2e90edb3ae01f66ec57d724b1eccdcbb26f

SHA256
1fa465ec02d1b157281a63170ec165d73df2c567e4806133ee8cb8614744ed41

SHA512
d8f2f4c0fc7184e5fbe8e64ac3c8847c47e034c33ad4a47836409639ad6b914c399238cacae1e148711842470c1986ed6260c687f8238d9e443c2858a2d1a7fe

Download Submit
C:\Windows\System\asDWBDA.exe

Filesize
1.7MB

MD5
301d99f272567fcf87bdce0ce2a4c971

SHA1
202dedee9cd32d0d2d37912bf9324f8115a4886a

SHA256
9feb909a4c45c9457fca219036033db68dea1e28029886c93848ff0c4d25cc9b

SHA512
8267b20dd8fbc704b10a44bd984f1d1aba7a69cae252f069cc30e2e4a691d8a3b79f90092f9933f502698160126c9ba499e448e4c3fb5a2567cf00f5560e1b9a

Download Submit
C:\Windows\System\bSEOeDQ.exe

Filesize
1.7MB

MD5
ab44e57e677155c8af21ec82c499b9ff

SHA1
f91b9ff9b1d98e785fb52270623c788e11cbc978

SHA256
cc0f2e3fa5b0dee7ca4c0a1a15707cc7e108a10cdc52db72a2bc3205d63a610e

SHA512
2110a1d6b03f9242ca39fe6271579768cad051ae7a4aff30e88d767375c559e3597e31612693b6981f101ec2d0ac2619a260589b2e36f74482fbc0e73b3cd32e

Download Submit
C:\Windows\System\fuAwAUM.exe

Filesize
1.7MB

MD5
3b6297040e001b8427c5ad74f729bdbd

SHA1
af405b55290bf4b41ac3e21800157a2334cf5c20

SHA256
517e293cfccd625e9a30fdb0f8a1d7a7a71a51533aad64bb6e5486a40c24071c

SHA512
6da73f533e3745a76215e02b8b0086f94f325cf009aa829910c16d6e9eae386f4cfd374f7667e31a9cd534bc8da075db511d5b6eadbc786fbe3e1c97601b2873

Download Submit
C:\Windows\System\gpToviq.exe

Filesize
1.7MB

MD5
7b856678d220363bcc7ba284cfcdb2ee

SHA1
cbdaa58331003e7250c4281ba55b2a4cea9ffc4b

SHA256
a60f3bec22ca01043546befeabf9dc8b70228fd40da1bdb4206f2dc674be9782

SHA512
1089b2479d1f0573cb3cce703a9dee5ce3bc70aa5d69b17a70f53e2266b57386b01de01c1c44694f2801d3eaf0974326ff021c26f94ba5fe2090eca88fb09b63

Download Submit
C:\Windows\System\hzSRzNe.exe

Filesize
1.7MB

MD5
eabd3321c5e76c720adb42c47415d039

SHA1
48d94e0d16b5a517d4a4f4e449bbda43a50895d2

SHA256
7950e4b5c12b8c6b9385c829b2c9510f41f9a2e1b9976363e1542d9f3b63706c

SHA512
bcd71494ff90dd5da5cd7153c8ed06eabf786a85fac81ddbae883c0ae57090522de4faea7374511b716e5a9f93e34f0b861bf8611cad054b0c14a11c2014fd7e

Download Submit
C:\Windows\System\ixcUJoD.exe

Filesize
1.7MB

MD5
f43d25d37fb364b452b63bd9cb872c23

SHA1
799720541ee2fe1149b3132efa513e0d13012d2e

SHA256
ac5085493867029e1f59cf261e35fd7e81a62253d92369a449f122b7db574160

SHA512
64e9f150e3d96f67518f9e9bfa3c30dd5a3048d27366215eae7fd3fd489e6f46b45a600e6cede7fed7c0cad9d3064997e0fe62a22a2b86d8239ac413045d4da5

Download Submit
C:\Windows\System\jCnNvrm.exe

Filesize
1.7MB

MD5
a008affc62df54a8cf4d7592ec2ccba9

SHA1
02509664a37637749075badddbff66eb8e546d56

SHA256
160e6e05322770d37a19f4af7568de2f83ddc9526bfb284850ac529f0895b79e

SHA512
4600a70fb3fc1f108bd75c55f823c80c0fc49f686133d429e5437d71f64f491a6cfa0d4791970b1b6677e732a83573782e4a5d20a07a9129c00ed754cb0f6109

Download Submit
C:\Windows\System\jJnRwoD.exe

Filesize
1.7MB

MD5
ea45620940b6364ad4038c701e4b0165

SHA1
6e52a2b8faa5790c82d65dd9fd413bcb3434135b

SHA256
1d752bb38d1de66cfb3c5b6a7dad460637e53682669ca0cc7002d5dd0c0967e6

SHA512
58b5621941953e618aa45206819a4368e21971aa8a2a0434e97b8aeae97c9319551eceeb2049dcefad23bcf9108ccf17dc324966648a54d812838d2bb85839ec

Download Submit
C:\Windows\System\jZFnDIC.exe

Filesize
1.7MB

MD5
ac03535e092335d1dda210734c41499e

SHA1
ab81c2f3a237ea797614c6ccb101339d04e22bca

SHA256
973683a4bb109820e053a7aa78f958f613ad3ba5f47d7ca17eee75984f3360be

SHA512
d78de1c1f290e988d5bfdef77ddda1667695a52683f9124ff0e9c6170cfb03cd2e18bf5543fad21d99da230bbb819f93478386b7a0c0e2ee9d6b8aba461fd32d

Download Submit
C:\Windows\System\nFMiJoh.exe

Filesize
1.7MB

MD5
3ab9a089bfe254de3c73201f6e5a4739

SHA1
eda834995a1e2fd6ca226e349bb254fb8f61266c

SHA256
2a999c9ecd1badcd0700e93cb4b62d798dcfd672ea8a6230c493e6c4bf39b6b0

SHA512
f7e2be5dd6e8114861278481b9eba0225c7e90eacc8ce7f55f908f4a5b88a9babc23bad22d3216d78a83ceb987797b9d55cafd8b7278df8523558cd72acb0a98

Download Submit
C:\Windows\System\pQetomC.exe

Filesize
1.7MB

MD5
2ef17432200f735982ff2545266e2093

SHA1
df069b1b9084d6483c15e8e5f7b30e24c87976a6

SHA256
a989e247a4fe81384192ef291021a8d9b875ea53960dcc7e2f617916c5a0ce7d

SHA512
98201f80aac4b0436893776a8cce02bb928df50bfd3eefdf329886ec959e0f83b767394aad8b0b6df8db9366581b64c8eff503d8398b8ce6e9af4aeca8590b15

Download Submit
C:\Windows\System\qBRSWUD.exe

Filesize
1.7MB

MD5
cfe207f75a1ab1a6ba1753933e12ccd0

SHA1
51a5a4ca33f6b87ae4edad2534aeb5049634bf33

SHA256
69e90d6df87efd62e39082bd9da736cb8511df9776fd386517ea3a1180da2019

SHA512
9c7136c5b6b3d496e7cf6299974a7a05d9b9b989ffefb56dc2e6c8ae4253c40c1aca7494daee863db205acd800c5488baa727c71f0a0da7982f1953c86f6dc8b

Download Submit
C:\Windows\System\rKxtTsU.exe

Filesize
1.7MB

MD5
d5ef0960afba7bbbb551bc40fdb326f6

SHA1
7f0cb804b1a22ac85f1e6abadd2e39505607ed1e

SHA256
c279db546770700e145c5bee3f6ad3a8fa0cd4e49d80a32b5eab9bcbaca57fab

SHA512
1f3d389431363c05da08bfcc47c8ac7d29ccccf452107cd46ec97d9d803498e765224a715f9cb5db13d84866c8c179807be8566b9c8e14b74cfe3516e1dd6a50

Download Submit
C:\Windows\System\rSvcCBA.exe

Filesize
1.7MB

MD5
3b779ae10fac90827488961817beb13c

SHA1
f5405c77e3c7a65d2bb27645c77f3954a051da50

SHA256
bb029b13307a499c3b6f3f38b28dc2cf16c81a971b7c4784d45a591ab02533f1

SHA512
7d88a95b51c68112fa0d7693ba784d609b82a6b1b2dc28d882476a80962caa33c2722874120e8357b6c39ef23df09ace2c2d599b780c5b0aa77561673cddf284

Download Submit
C:\Windows\System\sWGrSpX.exe

Filesize
1.7MB

MD5
9c30e4c4117ce9fb68cd3cb5bec943de

SHA1
202e5a1cc66d19af8657d4455434f2d1cfc4a868

SHA256
cf99e521d6c02f3bf9b4f2e825fe699af683d3d58d97865fda390b10412a24fe

SHA512
0661ea57c4ba34f9dd3d06936edf5200194892278ea47ee59bb0bf9d21568cf160d82ca79b443a1e3c06024115c9c8272e37c7c6d2370a654bf7f7a53a8321cb

Download Submit
C:\Windows\System\uArQxhr.exe

Filesize
8B

MD5
3989110bf28e1752d8354fc44aee0a5a

SHA1
2d341ede84fcdf1393cbc1c69b98173c16076de5

SHA256
ebec1be56406b8ccda98c6ae40713b17ab0e77787c03fa110b421dcd4ed20236

SHA512
05d90fae41717bc7686b0f44550f09d1b8636af054b5f3ca56692a92791caee36e681dc16ad6673b593b02851b240971a152f999e8c1a1c5d0d92fad9fcf82a2

Download Submit
C:\Windows\System\xhExnOP.exe

Filesize
1.7MB

MD5
813e97f8922af283826e74b0615d84fc

SHA1
9f24eec13aa7572caa2cc77016249fd8c3ba2f83

SHA256
71aace79219fa89859495a5fb3a048e78a5d3b9093331f31761e8c00c5b82763

SHA512
ddffb4420b2473116da9bf256a6b576ea421263d236995b8527c3c0562506a0d13fa55dda1acf131f09a332727dbf4d95a2f99df6a2c983c088b19e59cb8dc7b

Download Submit
memory/608-291-0x00007FF7F53E0000-0x00007FF7F57D2000-memory.dmp

Filesize
3.9MB

Download
memory/608-2740-0x00007FF7F53E0000-0x00007FF7F57D2000-memory.dmp

Filesize
3.9MB

Download
memory/864-685-0x00007FF74E4B0000-0x00007FF74E8A2000-memory.dmp

Filesize
3.9MB

Download
memory/864-2780-0x00007FF74E4B0000-0x00007FF74E8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-683-0x00007FF612BE0000-0x00007FF612FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2064-2771-0x00007FF612BE0000-0x00007FF612FD2000-memory.dmp

Filesize
3.9MB

Download
memory/2196-2744-0x00007FF7AEE60000-0x00007FF7AF252000-memory.dmp

Filesize
3.9MB

Download
memory/2196-467-0x00007FF7AEE60000-0x00007FF7AF252000-memory.dmp

Filesize
3.9MB

Download
memory/2248-684-0x00007FF774430000-0x00007FF774822000-memory.dmp

Filesize
3.9MB

Download
memory/2248-2773-0x00007FF774430000-0x00007FF774822000-memory.dmp

Filesize
3.9MB

Download
memory/2296-100-0x00007FF605A90000-0x00007FF605E82000-memory.dmp

Filesize
3.9MB

Download
memory/2296-2716-0x00007FF605A90000-0x00007FF605E82000-memory.dmp

Filesize
3.9MB

Download
memory/2296-2643-0x00007FF605A90000-0x00007FF605E82000-memory.dmp

Filesize
3.9MB

Download
memory/2368-573-0x00007FF6921B0000-0x00007FF6925A2000-memory.dmp

Filesize
3.9MB

Download
memory/2368-2748-0x00007FF6921B0000-0x00007FF6925A2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-2726-0x00007FF6DB760000-0x00007FF6DBB52000-memory.dmp

Filesize
3.9MB

Download
memory/2416-230-0x00007FF6DB760000-0x00007FF6DBB52000-memory.dmp

Filesize
3.9MB

Download
memory/2600-686-0x00007FFD569E3000-0x00007FFD569E5000-memory.dmp

Filesize
8KB

Download
memory/2600-43-0x00000148F4FF0000-0x00000148F5000000-memory.dmp

Filesize
64KB

Download
memory/2600-501-0x00000148F4D90000-0x00000148F4DB2000-memory.dmp

Filesize
136KB

Download
memory/2664-233-0x00007FF7F18D0000-0x00007FF7F1CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-2736-0x00007FF7F18D0000-0x00007FF7F1CC2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-147-0x00007FF7E03E0000-0x00007FF7E07D2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-2685-0x00007FF7E03E0000-0x00007FF7E07D2000-memory.dmp

Filesize
3.9MB

Download
memory/3164-36-0x00007FF7BA300000-0x00007FF7BA6F2000-memory.dmp

Filesize
3.9MB

Download
memory/3164-2681-0x00007FF7BA300000-0x00007FF7BA6F2000-memory.dmp

Filesize
3.9MB

Download
memory/3164-2640-0x00007FF7BA300000-0x00007FF7BA6F2000-memory.dmp

Filesize
3.9MB

Download
memory/3212-2721-0x00007FF78ABE0000-0x00007FF78AFD2000-memory.dmp

Filesize
3.9MB

Download
memory/3212-197-0x00007FF78ABE0000-0x00007FF78AFD2000-memory.dmp

Filesize
3.9MB

Download
memory/3288-41-0x00007FF7875D0000-0x00007FF7879C2000-memory.dmp

Filesize
3.9MB

Download
memory/3288-2701-0x00007FF7875D0000-0x00007FF7879C2000-memory.dmp

Filesize
3.9MB

Download
memory/3288-2677-0x00007FF7875D0000-0x00007FF7879C2000-memory.dmp

Filesize
3.9MB

Download
memory/3440-689-0x00007FF7F8D60000-0x00007FF7F9152000-memory.dmp

Filesize
3.9MB

Download
memory/3440-2772-0x00007FF7F8D60000-0x00007FF7F9152000-memory.dmp

Filesize
3.9MB

Download
memory/3632-332-0x00007FF66DEC0000-0x00007FF66E2B2000-memory.dmp

Filesize
3.9MB

Download
memory/3632-2710-0x00007FF66DEC0000-0x00007FF66E2B2000-memory.dmp

Filesize
3.9MB

Download
memory/3640-2679-0x00007FF768470000-0x00007FF768862000-memory.dmp

Filesize
3.9MB

Download
memory/3640-2676-0x00007FF768470000-0x00007FF768862000-memory.dmp

Filesize
3.9MB

Download
memory/3640-18-0x00007FF768470000-0x00007FF768862000-memory.dmp

Filesize
3.9MB

Download
memory/3644-687-0x00007FF614BA0000-0x00007FF614F92000-memory.dmp

Filesize
3.9MB

Download
memory/3644-2707-0x00007FF614BA0000-0x00007FF614F92000-memory.dmp

Filesize
3.9MB

Download
memory/3656-377-0x00007FF77B400000-0x00007FF77B7F2000-memory.dmp

Filesize
3.9MB

Download
memory/3656-2743-0x00007FF77B400000-0x00007FF77B7F2000-memory.dmp

Filesize
3.9MB

Download
memory/3692-2642-0x00007FF76B1F0000-0x00007FF76B5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3692-2718-0x00007FF76B1F0000-0x00007FF76B5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3692-93-0x00007FF76B1F0000-0x00007FF76B5E2000-memory.dmp

Filesize
3.9MB

Download
memory/3752-0-0x00007FF7DE4E0000-0x00007FF7DE8D2000-memory.dmp

Filesize
3.9MB

Download
memory/3752-1-0x000001EC4F580000-0x000001EC4F590000-memory.dmp

Filesize
64KB

Download
memory/4344-2734-0x00007FF6AEF50000-0x00007FF6AF342000-memory.dmp

Filesize
3.9MB

Download
memory/4344-688-0x00007FF6AEF50000-0x00007FF6AF342000-memory.dmp

Filesize
3.9MB

Download
memory/4616-2694-0x00007FF6BF5F0000-0x00007FF6BF9E2000-memory.dmp

Filesize
3.9MB

Download
memory/4616-68-0x00007FF6BF5F0000-0x00007FF6BF9E2000-memory.dmp

Filesize
3.9MB

Download
memory/4616-2641-0x00007FF6BF5F0000-0x00007FF6BF9E2000-memory.dmp

Filesize
3.9MB

Download
memory/4660-681-0x00007FF628780000-0x00007FF628B72000-memory.dmp

Filesize
3.9MB

Download
memory/4660-2770-0x00007FF628780000-0x00007FF628B72000-memory.dmp

Filesize
3.9MB

Download
memory/4700-331-0x00007FF7172B0000-0x00007FF7176A2000-memory.dmp

Filesize
3.9MB

Download
memory/4700-2738-0x00007FF7172B0000-0x00007FF7176A2000-memory.dmp

Filesize
3.9MB

Download
memory/4908-472-0x00007FF62AD50000-0x00007FF62B142000-memory.dmp

Filesize
3.9MB

Download
memory/4908-2746-0x00007FF62AD50000-0x00007FF62B142000-memory.dmp

Filesize
3.9MB

Download