xmrig | 8b192718f72331d27c2be75880c9b94450cec1916b527ea2c6249212315aa86b

Analysis

max time kernel
121s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 19:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14e809e5a28ba863f634175f801438b0_NEIKI.exe
Size

1.6MB
MD5

14e809e5a28ba863f634175f801438b0
SHA1

0cab11764bb8a01c0cc5556567186fc655a54c44
SHA256

8b192718f72331d27c2be75880c9b94450cec1916b527ea2c6249212315aa86b
SHA512

4df39abfbe37a24b5fce85e12db75a3e146551d357753988939902c0db59f215db644c5f74233720fbfb0789ca699b08be46f007df392f64bc37ec9a77b96881
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjuJoCSxnhvuqAP9dbWmbOtK2Vk+RRVy:Lz071uv4BPMkHC0I6GCInhG1dtH08

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 44 IoCs

miner

resource	yara_rule
behavioral2/memory/4764-66-0x00007FF7A6FD0000-0x00007FF7A73C2000-memory.dmp	xmrig
behavioral2/memory/4932-72-0x00007FF62DCD0000-0x00007FF62E0C2000-memory.dmp	xmrig
behavioral2/memory/532-152-0x00007FF6C78C0000-0x00007FF6C7CB2000-memory.dmp	xmrig
behavioral2/memory/3288-163-0x00007FF7292E0000-0x00007FF7296D2000-memory.dmp	xmrig
behavioral2/memory/3280-128-0x00007FF6B4610000-0x00007FF6B4A02000-memory.dmp	xmrig
behavioral2/memory/4676-121-0x00007FF7601E0000-0x00007FF7605D2000-memory.dmp	xmrig
behavioral2/memory/3652-114-0x00007FF616C10000-0x00007FF617002000-memory.dmp	xmrig
behavioral2/memory/4644-113-0x00007FF74C160000-0x00007FF74C552000-memory.dmp	xmrig
behavioral2/memory/4124-76-0x00007FF67F930000-0x00007FF67FD22000-memory.dmp	xmrig
behavioral2/memory/1600-73-0x00007FF7C59A0000-0x00007FF7C5D92000-memory.dmp	xmrig
behavioral2/memory/3692-71-0x00007FF6A6390000-0x00007FF6A6782000-memory.dmp	xmrig
behavioral2/memory/1264-68-0x00007FF72F0D0000-0x00007FF72F4C2000-memory.dmp	xmrig
behavioral2/memory/1448-41-0x00007FF6D7E60000-0x00007FF6D8252000-memory.dmp	xmrig
behavioral2/memory/3048-19-0x00007FF6AA580000-0x00007FF6AA972000-memory.dmp	xmrig
behavioral2/memory/3496-18-0x00007FF79D2E0000-0x00007FF79D6D2000-memory.dmp	xmrig
behavioral2/memory/1580-3433-0x00007FF7B0C00000-0x00007FF7B0FF2000-memory.dmp	xmrig
behavioral2/memory/3708-3431-0x00007FF601DF0000-0x00007FF6021E2000-memory.dmp	xmrig
behavioral2/memory/912-3434-0x00007FF6F2940000-0x00007FF6F2D32000-memory.dmp	xmrig
behavioral2/memory/404-3435-0x00007FF7BF1D0000-0x00007FF7BF5C2000-memory.dmp	xmrig
behavioral2/memory/5052-3436-0x00007FF75EE10000-0x00007FF75F202000-memory.dmp	xmrig
behavioral2/memory/3048-3464-0x00007FF6AA580000-0x00007FF6AA972000-memory.dmp	xmrig
behavioral2/memory/3496-3463-0x00007FF79D2E0000-0x00007FF79D6D2000-memory.dmp	xmrig
behavioral2/memory/1448-3466-0x00007FF6D7E60000-0x00007FF6D8252000-memory.dmp	xmrig
behavioral2/memory/3652-3468-0x00007FF616C10000-0x00007FF617002000-memory.dmp	xmrig
behavioral2/memory/4764-3470-0x00007FF7A6FD0000-0x00007FF7A73C2000-memory.dmp	xmrig
behavioral2/memory/1264-3472-0x00007FF72F0D0000-0x00007FF72F4C2000-memory.dmp	xmrig
behavioral2/memory/3692-3476-0x00007FF6A6390000-0x00007FF6A6782000-memory.dmp	xmrig
behavioral2/memory/4676-3475-0x00007FF7601E0000-0x00007FF7605D2000-memory.dmp	xmrig
behavioral2/memory/1600-3482-0x00007FF7C59A0000-0x00007FF7C5D92000-memory.dmp	xmrig
behavioral2/memory/4124-3481-0x00007FF67F930000-0x00007FF67FD22000-memory.dmp	xmrig
behavioral2/memory/3280-3479-0x00007FF6B4610000-0x00007FF6B4A02000-memory.dmp	xmrig
behavioral2/memory/4932-3484-0x00007FF62DCD0000-0x00007FF62E0C2000-memory.dmp	xmrig
behavioral2/memory/1580-3488-0x00007FF7B0C00000-0x00007FF7B0FF2000-memory.dmp	xmrig
behavioral2/memory/5028-3499-0x00007FF675CD0000-0x00007FF6760C2000-memory.dmp	xmrig
behavioral2/memory/5052-3500-0x00007FF75EE10000-0x00007FF75F202000-memory.dmp	xmrig
behavioral2/memory/532-3507-0x00007FF6C78C0000-0x00007FF6C7CB2000-memory.dmp	xmrig
behavioral2/memory/3288-3509-0x00007FF7292E0000-0x00007FF7296D2000-memory.dmp	xmrig
behavioral2/memory/4100-3505-0x00007FF7757F0000-0x00007FF775BE2000-memory.dmp	xmrig
behavioral2/memory/2988-3502-0x00007FF7BB760000-0x00007FF7BBB52000-memory.dmp	xmrig
behavioral2/memory/516-3497-0x00007FF752D90000-0x00007FF753182000-memory.dmp	xmrig
behavioral2/memory/4656-3496-0x00007FF700D00000-0x00007FF7010F2000-memory.dmp	xmrig
behavioral2/memory/3708-3493-0x00007FF601DF0000-0x00007FF6021E2000-memory.dmp	xmrig
behavioral2/memory/404-3492-0x00007FF7BF1D0000-0x00007FF7BF5C2000-memory.dmp	xmrig
behavioral2/memory/912-3489-0x00007FF6F2940000-0x00007FF6F2D32000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	3356	powershell.exe
13	3356	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3356	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3496	wXhqnUd.exe
3048	EuueCZV.exe
3652	gEMFEgk.exe
1448	gBiPVpu.exe
4764	dJTsqjT.exe
1264	FvOdzEz.exe
4676	wLUIysC.exe
3280	jiPuTXN.exe
3692	uwLOvgs.exe
4932	qocKrOy.exe
4124	JDywGlN.exe
1600	uJJEXfo.exe
5028	WHEoTDh.exe
4100	gqBCvRX.exe
4656	bhtudrO.exe
516	EHfEHZO.exe
2988	UIxtnSo.exe
3708	IGtZenS.exe
1580	MZRnprq.exe
912	gLQIqHc.exe
404	MYUNIwS.exe
5052	wjagfJZ.exe
532	fbDSZwI.exe
3288	IraTToQ.exe
4596	iSmsQUq.exe
3088	uxrWeTK.exe
3876	Pnfdylh.exe
4900	mkEUGIn.exe
2168	vLQPbKj.exe
536	DkSFqsE.exe
2708	VddJkiP.exe
3948	neDzgXd.exe
2756	ubTWZtS.exe
224	UJppgNn.exe
1952	vQeXcdz.exe
800	NdIcjHL.exe
2764	PQZEKwS.exe
892	pAMMOcQ.exe
3152	CztOAwE.exe
4908	LhCmCZS.exe
4400	eNfvMqS.exe
2352	IshbctN.exe
5108	EJVtGRs.exe
928	LNYFaMC.exe
3504	TFLIFWc.exe
2784	BlRlfho.exe
3592	BgQcjAz.exe
4496	lFQTCeV.exe
5036	kqxcoEA.exe
3668	tBkbxei.exe
4472	hUJzGMW.exe
1584	rqqCkdE.exe
3648	fnEhXsm.exe
4980	lmiSEok.exe
64	fggxGYY.exe
3552	yjPAtxe.exe
1728	lRoaqRl.exe
4760	coGBodt.exe
1468	KUvErII.exe
4384	CGUYOTW.exe
4288	GPchkcz.exe
4020	UUNyZQA.exe
4164	ElLjUcG.exe
2796	GgTGyIx.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4644-0-0x00007FF74C160000-0x00007FF74C552000-memory.dmp	upx
behavioral2/files/0x000b000000023b98-12.dat	upx
behavioral2/files/0x000a000000023b9c-15.dat	upx
behavioral2/files/0x000a000000023b9e-21.dat	upx
behavioral2/files/0x000a000000023ba1-33.dat	upx
behavioral2/files/0x000a000000023ba2-40.dat	upx
behavioral2/files/0x000a000000023ba0-43.dat	upx
behavioral2/files/0x000a000000023ba3-53.dat	upx
behavioral2/files/0x000a000000023ba5-58.dat	upx
behavioral2/memory/4764-66-0x00007FF7A6FD0000-0x00007FF7A73C2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba6-69.dat	upx
behavioral2/memory/4932-72-0x00007FF62DCD0000-0x00007FF62E0C2000-memory.dmp	upx
behavioral2/files/0x000b000000023b99-90.dat	upx
behavioral2/files/0x000a000000023baa-98.dat	upx
behavioral2/files/0x000a000000023bab-104.dat	upx
behavioral2/files/0x000a000000023bad-129.dat	upx
behavioral2/memory/404-140-0x00007FF7BF1D0000-0x00007FF7BF5C2000-memory.dmp	upx
behavioral2/memory/532-152-0x00007FF6C78C0000-0x00007FF6C7CB2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb3-164.dat	upx
behavioral2/files/0x0031000000023bb7-184.dat	upx
behavioral2/files/0x000a000000023bba-191.dat	upx
behavioral2/files/0x000a000000023bb8-189.dat	upx
behavioral2/files/0x000a000000023bb9-186.dat	upx
behavioral2/files/0x0031000000023bb6-179.dat	upx
behavioral2/files/0x0031000000023bb5-174.dat	upx
behavioral2/files/0x000a000000023bb4-169.dat	upx
behavioral2/memory/3288-163-0x00007FF7292E0000-0x00007FF7296D2000-memory.dmp	upx
behavioral2/files/0x000a000000023bb2-158.dat	upx
behavioral2/files/0x000a000000023bb1-153.dat	upx
behavioral2/files/0x000a000000023bb0-147.dat	upx
behavioral2/memory/5052-146-0x00007FF75EE10000-0x00007FF75F202000-memory.dmp	upx
behavioral2/files/0x000a000000023baf-141.dat	upx
behavioral2/files/0x000a000000023bae-135.dat	upx
behavioral2/memory/912-134-0x00007FF6F2940000-0x00007FF6F2D32000-memory.dmp	upx
behavioral2/memory/3280-128-0x00007FF6B4610000-0x00007FF6B4A02000-memory.dmp	upx
behavioral2/memory/1580-127-0x00007FF7B0C00000-0x00007FF7B0FF2000-memory.dmp	upx
behavioral2/files/0x000a000000023bac-122.dat	upx
behavioral2/memory/4676-121-0x00007FF7601E0000-0x00007FF7605D2000-memory.dmp	upx
behavioral2/memory/3708-115-0x00007FF601DF0000-0x00007FF6021E2000-memory.dmp	upx
behavioral2/memory/3652-114-0x00007FF616C10000-0x00007FF617002000-memory.dmp	upx
behavioral2/memory/4644-113-0x00007FF74C160000-0x00007FF74C552000-memory.dmp	upx
behavioral2/memory/2988-107-0x00007FF7BB760000-0x00007FF7BBB52000-memory.dmp	upx
behavioral2/files/0x000a000000023ba9-102.dat	upx
behavioral2/memory/516-101-0x00007FF752D90000-0x00007FF753182000-memory.dmp	upx
behavioral2/files/0x000a000000023ba8-96.dat	upx
behavioral2/memory/4656-95-0x00007FF700D00000-0x00007FF7010F2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba7-85.dat	upx
behavioral2/memory/4100-84-0x00007FF7757F0000-0x00007FF775BE2000-memory.dmp	upx
behavioral2/memory/5028-80-0x00007FF675CD0000-0x00007FF6760C2000-memory.dmp	upx
behavioral2/memory/4124-76-0x00007FF67F930000-0x00007FF67FD22000-memory.dmp	upx
behavioral2/memory/1600-73-0x00007FF7C59A0000-0x00007FF7C5D92000-memory.dmp	upx
behavioral2/memory/3692-71-0x00007FF6A6390000-0x00007FF6A6782000-memory.dmp	upx
behavioral2/memory/1264-68-0x00007FF72F0D0000-0x00007FF72F4C2000-memory.dmp	upx
behavioral2/files/0x000a000000023ba4-62.dat	upx
behavioral2/memory/3280-49-0x00007FF6B4610000-0x00007FF6B4A02000-memory.dmp	upx
behavioral2/memory/4676-47-0x00007FF7601E0000-0x00007FF7605D2000-memory.dmp	upx
behavioral2/memory/1448-41-0x00007FF6D7E60000-0x00007FF6D8252000-memory.dmp	upx
behavioral2/files/0x000a000000023b9f-37.dat	upx
behavioral2/memory/3652-25-0x00007FF616C10000-0x00007FF617002000-memory.dmp	upx
behavioral2/memory/3048-19-0x00007FF6AA580000-0x00007FF6AA972000-memory.dmp	upx
behavioral2/memory/3496-18-0x00007FF79D2E0000-0x00007FF79D6D2000-memory.dmp	upx
behavioral2/files/0x000a000000023b9d-10.dat	upx
behavioral2/memory/1580-3433-0x00007FF7B0C00000-0x00007FF7B0FF2000-memory.dmp	upx
behavioral2/memory/3708-3431-0x00007FF601DF0000-0x00007FF6021E2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CJsPGdF.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\nxVoXOH.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\uRDEWBi.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\MqDMjdX.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\eVxqDeN.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\IgkMvPv.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\jFowuiU.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\zulFWOn.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\uFrsjJM.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\csmApxb.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\ucuJiTt.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\QCYqqCV.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\DEKfNGz.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\pNAAyBH.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\GhzcDhk.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\HbHbdwq.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\aAUVXTF.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\mzUACTL.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\tUdeprR.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\QdOmMGM.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\KMgmiuV.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\pjUvbTN.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\sDjUUrB.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\ElLjUcG.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\wgUlUKW.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\giWyNJi.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\cvpxwTu.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\pIfprzf.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\XBXmnKk.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\SrGUXIH.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\VLTXySa.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\YHDCxVk.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\XkYfhcP.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\WLlQMFj.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\lQUlCNJ.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\nGHtrFG.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\cAKtZRa.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\zksnQYn.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\dXhEcVe.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\JQodCFF.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\IdvGpzT.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\nrqHdhX.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\LWSaabU.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\PqNdxnw.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\RVokFMC.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\gvwLxMg.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\kAghSgw.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\WhdsiXQ.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\whKewLN.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\GiTuDcf.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\LvOvTeE.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\TcGSGeA.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\RWhyfkh.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\iSmsQUq.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\LRhKvZa.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\jzPkgCH.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\DHIBQWX.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\eYMaQdU.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\ZoHINLN.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\DIIPSXT.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\lunYPXJ.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\qJHYmzI.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\qQDSYvs.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe
File created	C:\Windows\System\HNlSlph.exe	14e809e5a28ba863f634175f801438b0_NEIKI.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3356	powershell.exe
3356	powershell.exe
3356	powershell.exe
3356	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe
Token: SeLockMemoryPrivilege	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe
Token: SeDebugPrivilege	3356	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 3356	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	85
PID 4644 wrote to memory of 3356	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	85
PID 4644 wrote to memory of 3048	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	86
PID 4644 wrote to memory of 3048	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	86
PID 4644 wrote to memory of 3652	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	87
PID 4644 wrote to memory of 3652	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	87
PID 4644 wrote to memory of 3496	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	88
PID 4644 wrote to memory of 3496	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	88
PID 4644 wrote to memory of 1448	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	89
PID 4644 wrote to memory of 1448	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	89
PID 4644 wrote to memory of 4764	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	90
PID 4644 wrote to memory of 4764	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	90
PID 4644 wrote to memory of 1264	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	91
PID 4644 wrote to memory of 1264	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	91
PID 4644 wrote to memory of 4676	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	92
PID 4644 wrote to memory of 4676	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	92
PID 4644 wrote to memory of 3280	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	93
PID 4644 wrote to memory of 3280	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	93
PID 4644 wrote to memory of 3692	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	94
PID 4644 wrote to memory of 3692	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	94
PID 4644 wrote to memory of 4932	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	95
PID 4644 wrote to memory of 4932	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	95
PID 4644 wrote to memory of 4124	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	96
PID 4644 wrote to memory of 4124	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	96
PID 4644 wrote to memory of 1600	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	97
PID 4644 wrote to memory of 1600	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	97
PID 4644 wrote to memory of 5028	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	98
PID 4644 wrote to memory of 5028	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	98
PID 4644 wrote to memory of 4100	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	99
PID 4644 wrote to memory of 4100	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	99
PID 4644 wrote to memory of 4656	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	100
PID 4644 wrote to memory of 4656	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	100
PID 4644 wrote to memory of 516	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	101
PID 4644 wrote to memory of 516	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	101
PID 4644 wrote to memory of 2988	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	102
PID 4644 wrote to memory of 2988	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	102
PID 4644 wrote to memory of 3708	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	103
PID 4644 wrote to memory of 3708	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	103
PID 4644 wrote to memory of 1580	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	104
PID 4644 wrote to memory of 1580	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	104
PID 4644 wrote to memory of 912	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	105
PID 4644 wrote to memory of 912	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	105
PID 4644 wrote to memory of 404	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	106
PID 4644 wrote to memory of 404	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	106
PID 4644 wrote to memory of 5052	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	107
PID 4644 wrote to memory of 5052	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	107
PID 4644 wrote to memory of 532	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	108
PID 4644 wrote to memory of 532	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	108
PID 4644 wrote to memory of 3288	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	109
PID 4644 wrote to memory of 3288	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	109
PID 4644 wrote to memory of 4596	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	110
PID 4644 wrote to memory of 4596	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	110
PID 4644 wrote to memory of 3088	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	111
PID 4644 wrote to memory of 3088	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	111
PID 4644 wrote to memory of 3876	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	112
PID 4644 wrote to memory of 3876	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	112
PID 4644 wrote to memory of 4900	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	113
PID 4644 wrote to memory of 4900	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	113
PID 4644 wrote to memory of 2168	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	114
PID 4644 wrote to memory of 2168	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	114
PID 4644 wrote to memory of 536	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	115
PID 4644 wrote to memory of 536	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	115
PID 4644 wrote to memory of 2708	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	116
PID 4644 wrote to memory of 2708	4644	14e809e5a28ba863f634175f801438b0_NEIKI.exe	116

C:\Users\Admin\AppData\Local\Temp\14e809e5a28ba863f634175f801438b0_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\14e809e5a28ba863f634175f801438b0_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3356
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3356" "2960" "2896" "2964" "0" "0" "2968" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:13180
- C:\Windows\System\EuueCZV.exe
  C:\Windows\System\EuueCZV.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\gEMFEgk.exe
  C:\Windows\System\gEMFEgk.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\wXhqnUd.exe
  C:\Windows\System\wXhqnUd.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\gBiPVpu.exe
  C:\Windows\System\gBiPVpu.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\dJTsqjT.exe
  C:\Windows\System\dJTsqjT.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\FvOdzEz.exe
  C:\Windows\System\FvOdzEz.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\wLUIysC.exe
  C:\Windows\System\wLUIysC.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\jiPuTXN.exe
  C:\Windows\System\jiPuTXN.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\uwLOvgs.exe
  C:\Windows\System\uwLOvgs.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\qocKrOy.exe
  C:\Windows\System\qocKrOy.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\JDywGlN.exe
  C:\Windows\System\JDywGlN.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\uJJEXfo.exe
  C:\Windows\System\uJJEXfo.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\WHEoTDh.exe
  C:\Windows\System\WHEoTDh.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\gqBCvRX.exe
  C:\Windows\System\gqBCvRX.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\bhtudrO.exe
  C:\Windows\System\bhtudrO.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\EHfEHZO.exe
  C:\Windows\System\EHfEHZO.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\UIxtnSo.exe
  C:\Windows\System\UIxtnSo.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\IGtZenS.exe
  C:\Windows\System\IGtZenS.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\MZRnprq.exe
  C:\Windows\System\MZRnprq.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\gLQIqHc.exe
  C:\Windows\System\gLQIqHc.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\MYUNIwS.exe
  C:\Windows\System\MYUNIwS.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\wjagfJZ.exe
  C:\Windows\System\wjagfJZ.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\fbDSZwI.exe
  C:\Windows\System\fbDSZwI.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\IraTToQ.exe
  C:\Windows\System\IraTToQ.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\iSmsQUq.exe
  C:\Windows\System\iSmsQUq.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\uxrWeTK.exe
  C:\Windows\System\uxrWeTK.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\Pnfdylh.exe
  C:\Windows\System\Pnfdylh.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\mkEUGIn.exe
  C:\Windows\System\mkEUGIn.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\vLQPbKj.exe
  C:\Windows\System\vLQPbKj.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\DkSFqsE.exe
  C:\Windows\System\DkSFqsE.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\VddJkiP.exe
  C:\Windows\System\VddJkiP.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\neDzgXd.exe
  C:\Windows\System\neDzgXd.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\ubTWZtS.exe
  C:\Windows\System\ubTWZtS.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\UJppgNn.exe
  C:\Windows\System\UJppgNn.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\vQeXcdz.exe
  C:\Windows\System\vQeXcdz.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\NdIcjHL.exe
  C:\Windows\System\NdIcjHL.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\PQZEKwS.exe
  C:\Windows\System\PQZEKwS.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\pAMMOcQ.exe
  C:\Windows\System\pAMMOcQ.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\CztOAwE.exe
  C:\Windows\System\CztOAwE.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\LhCmCZS.exe
  C:\Windows\System\LhCmCZS.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\eNfvMqS.exe
  C:\Windows\System\eNfvMqS.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\IshbctN.exe
  C:\Windows\System\IshbctN.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\EJVtGRs.exe
  C:\Windows\System\EJVtGRs.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\LNYFaMC.exe
  C:\Windows\System\LNYFaMC.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\TFLIFWc.exe
  C:\Windows\System\TFLIFWc.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\BlRlfho.exe
  C:\Windows\System\BlRlfho.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\BgQcjAz.exe
  C:\Windows\System\BgQcjAz.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\lFQTCeV.exe
  C:\Windows\System\lFQTCeV.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\kqxcoEA.exe
  C:\Windows\System\kqxcoEA.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\tBkbxei.exe
  C:\Windows\System\tBkbxei.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\hUJzGMW.exe
  C:\Windows\System\hUJzGMW.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\rqqCkdE.exe
  C:\Windows\System\rqqCkdE.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\fnEhXsm.exe
  C:\Windows\System\fnEhXsm.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\lmiSEok.exe
  C:\Windows\System\lmiSEok.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\fggxGYY.exe
  C:\Windows\System\fggxGYY.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\yjPAtxe.exe
  C:\Windows\System\yjPAtxe.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\lRoaqRl.exe
  C:\Windows\System\lRoaqRl.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\coGBodt.exe
  C:\Windows\System\coGBodt.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\KUvErII.exe
  C:\Windows\System\KUvErII.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\CGUYOTW.exe
  C:\Windows\System\CGUYOTW.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\GPchkcz.exe
  C:\Windows\System\GPchkcz.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\UUNyZQA.exe
  C:\Windows\System\UUNyZQA.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\ElLjUcG.exe
  C:\Windows\System\ElLjUcG.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\GgTGyIx.exe
  C:\Windows\System\GgTGyIx.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\oMLpldN.exe
  C:\Windows\System\oMLpldN.exe
  2⤵
  PID:5124
- C:\Windows\System\VkfhIbG.exe
  C:\Windows\System\VkfhIbG.exe
  2⤵
  PID:5148
- C:\Windows\System\SxpwggE.exe
  C:\Windows\System\SxpwggE.exe
  2⤵
  PID:5172
- C:\Windows\System\UmOwXCt.exe
  C:\Windows\System\UmOwXCt.exe
  2⤵
  PID:5196
- C:\Windows\System\xMcQJZL.exe
  C:\Windows\System\xMcQJZL.exe
  2⤵
  PID:5228
- C:\Windows\System\TeQHCNa.exe
  C:\Windows\System\TeQHCNa.exe
  2⤵
  PID:5256
- C:\Windows\System\yjwjmIO.exe
  C:\Windows\System\yjwjmIO.exe
  2⤵
  PID:5284
- C:\Windows\System\CywAaPk.exe
  C:\Windows\System\CywAaPk.exe
  2⤵
  PID:5312
- C:\Windows\System\pUEuzyD.exe
  C:\Windows\System\pUEuzyD.exe
  2⤵
  PID:5340
- C:\Windows\System\EqKBRDO.exe
  C:\Windows\System\EqKBRDO.exe
  2⤵
  PID:5368
- C:\Windows\System\DUsEFVm.exe
  C:\Windows\System\DUsEFVm.exe
  2⤵
  PID:5396
- C:\Windows\System\NVMoJkZ.exe
  C:\Windows\System\NVMoJkZ.exe
  2⤵
  PID:5424
- C:\Windows\System\ZsOgiDe.exe
  C:\Windows\System\ZsOgiDe.exe
  2⤵
  PID:5452
- C:\Windows\System\JxBcRjg.exe
  C:\Windows\System\JxBcRjg.exe
  2⤵
  PID:5476
- C:\Windows\System\PdHIoXn.exe
  C:\Windows\System\PdHIoXn.exe
  2⤵
  PID:5508
- C:\Windows\System\hdQcyex.exe
  C:\Windows\System\hdQcyex.exe
  2⤵
  PID:5536
- C:\Windows\System\wMSgtYv.exe
  C:\Windows\System\wMSgtYv.exe
  2⤵
  PID:5564
- C:\Windows\System\ecGWhIc.exe
  C:\Windows\System\ecGWhIc.exe
  2⤵
  PID:5592
- C:\Windows\System\BWBZEQU.exe
  C:\Windows\System\BWBZEQU.exe
  2⤵
  PID:5620
- C:\Windows\System\KruBZxT.exe
  C:\Windows\System\KruBZxT.exe
  2⤵
  PID:5648
- C:\Windows\System\lDCmvOG.exe
  C:\Windows\System\lDCmvOG.exe
  2⤵
  PID:5676
- C:\Windows\System\mcnaQNe.exe
  C:\Windows\System\mcnaQNe.exe
  2⤵
  PID:5704
- C:\Windows\System\myoqxPr.exe
  C:\Windows\System\myoqxPr.exe
  2⤵
  PID:5732
- C:\Windows\System\hJuZvnE.exe
  C:\Windows\System\hJuZvnE.exe
  2⤵
  PID:5760
- C:\Windows\System\CYAuLpo.exe
  C:\Windows\System\CYAuLpo.exe
  2⤵
  PID:5784
- C:\Windows\System\emtfNco.exe
  C:\Windows\System\emtfNco.exe
  2⤵
  PID:5816
- C:\Windows\System\wKorNkU.exe
  C:\Windows\System\wKorNkU.exe
  2⤵
  PID:5844
- C:\Windows\System\VucuQAP.exe
  C:\Windows\System\VucuQAP.exe
  2⤵
  PID:5872
- C:\Windows\System\dyElvIV.exe
  C:\Windows\System\dyElvIV.exe
  2⤵
  PID:5900
- C:\Windows\System\kXzlPxU.exe
  C:\Windows\System\kXzlPxU.exe
  2⤵
  PID:5928
- C:\Windows\System\cKPgJwO.exe
  C:\Windows\System\cKPgJwO.exe
  2⤵
  PID:5956
- C:\Windows\System\dVWAemj.exe
  C:\Windows\System\dVWAemj.exe
  2⤵
  PID:5984
- C:\Windows\System\weCELjZ.exe
  C:\Windows\System\weCELjZ.exe
  2⤵
  PID:6012
- C:\Windows\System\yLqFTLB.exe
  C:\Windows\System\yLqFTLB.exe
  2⤵
  PID:6040
- C:\Windows\System\STJivBl.exe
  C:\Windows\System\STJivBl.exe
  2⤵
  PID:6068
- C:\Windows\System\yTCMgWM.exe
  C:\Windows\System\yTCMgWM.exe
  2⤵
  PID:6096
- C:\Windows\System\TLaveGw.exe
  C:\Windows\System\TLaveGw.exe
  2⤵
  PID:6124
- C:\Windows\System\MAeFznq.exe
  C:\Windows\System\MAeFznq.exe
  2⤵
  PID:2740
- C:\Windows\System\wWReBAg.exe
  C:\Windows\System\wWReBAg.exe
  2⤵
  PID:400
- C:\Windows\System\QzyskEA.exe
  C:\Windows\System\QzyskEA.exe
  2⤵
  PID:2984
- C:\Windows\System\QUcZYYq.exe
  C:\Windows\System\QUcZYYq.exe
  2⤵
  PID:2004
- C:\Windows\System\JuQhiDL.exe
  C:\Windows\System\JuQhiDL.exe
  2⤵
  PID:1736
- C:\Windows\System\KSgqRCi.exe
  C:\Windows\System\KSgqRCi.exe
  2⤵
  PID:4460
- C:\Windows\System\NASuZQY.exe
  C:\Windows\System\NASuZQY.exe
  2⤵
  PID:5184
- C:\Windows\System\ccbIrtc.exe
  C:\Windows\System\ccbIrtc.exe
  2⤵
  PID:5240
- C:\Windows\System\wDpkdvp.exe
  C:\Windows\System\wDpkdvp.exe
  2⤵
  PID:5300
- C:\Windows\System\qILptla.exe
  C:\Windows\System\qILptla.exe
  2⤵
  PID:1408
- C:\Windows\System\zvfuuxN.exe
  C:\Windows\System\zvfuuxN.exe
  2⤵
  PID:5464
- C:\Windows\System\kvzPIrR.exe
  C:\Windows\System\kvzPIrR.exe
  2⤵
  PID:5496
- C:\Windows\System\SVkkkyp.exe
  C:\Windows\System\SVkkkyp.exe
  2⤵
  PID:4968
- C:\Windows\System\BDsdMME.exe
  C:\Windows\System\BDsdMME.exe
  2⤵
  PID:5576
- C:\Windows\System\xfClFwZ.exe
  C:\Windows\System\xfClFwZ.exe
  2⤵
  PID:5636
- C:\Windows\System\cuzMbTr.exe
  C:\Windows\System\cuzMbTr.exe
  2⤵
  PID:5696
- C:\Windows\System\DYdEClc.exe
  C:\Windows\System\DYdEClc.exe
  2⤵
  PID:5772
- C:\Windows\System\pZULWDg.exe
  C:\Windows\System\pZULWDg.exe
  2⤵
  PID:5828
- C:\Windows\System\pUqXsKe.exe
  C:\Windows\System\pUqXsKe.exe
  2⤵
  PID:5864
- C:\Windows\System\RetxJFo.exe
  C:\Windows\System\RetxJFo.exe
  2⤵
  PID:552
- C:\Windows\System\dAgtAzt.exe
  C:\Windows\System\dAgtAzt.exe
  2⤵
  PID:5996
- C:\Windows\System\rHBTIwE.exe
  C:\Windows\System\rHBTIwE.exe
  2⤵
  PID:6032
- C:\Windows\System\MEPwILX.exe
  C:\Windows\System\MEPwILX.exe
  2⤵
  PID:6088
- C:\Windows\System\WjPLPJJ.exe
  C:\Windows\System\WjPLPJJ.exe
  2⤵
  PID:3104
- C:\Windows\System\lNiqiZl.exe
  C:\Windows\System\lNiqiZl.exe
  2⤵
  PID:628
- C:\Windows\System\ovGAkMn.exe
  C:\Windows\System\ovGAkMn.exe
  2⤵
  PID:5012
- C:\Windows\System\oyKJpgg.exe
  C:\Windows\System\oyKJpgg.exe
  2⤵
  PID:992
- C:\Windows\System\WZfTRFS.exe
  C:\Windows\System\WZfTRFS.exe
  2⤵
  PID:5328
- C:\Windows\System\FnbiVUs.exe
  C:\Windows\System\FnbiVUs.exe
  2⤵
  PID:2628
- C:\Windows\System\IqmjSja.exe
  C:\Windows\System\IqmjSja.exe
  2⤵
  PID:5552
- C:\Windows\System\iNBAOjh.exe
  C:\Windows\System\iNBAOjh.exe
  2⤵
  PID:5668
- C:\Windows\System\hWehaMP.exe
  C:\Windows\System\hWehaMP.exe
  2⤵
  PID:5804
- C:\Windows\System\fvsXxKC.exe
  C:\Windows\System\fvsXxKC.exe
  2⤵
  PID:5920
- C:\Windows\System\yJrcXon.exe
  C:\Windows\System\yJrcXon.exe
  2⤵
  PID:6024
- C:\Windows\System\xzzeMxy.exe
  C:\Windows\System\xzzeMxy.exe
  2⤵
  PID:1156
- C:\Windows\System\HlgJPTP.exe
  C:\Windows\System\HlgJPTP.exe
  2⤵
  PID:3996
- C:\Windows\System\pElVkdh.exe
  C:\Windows\System\pElVkdh.exe
  2⤵
  PID:5272
- C:\Windows\System\ZoHINLN.exe
  C:\Windows\System\ZoHINLN.exe
  2⤵
  PID:5528
- C:\Windows\System\KzajtlP.exe
  C:\Windows\System\KzajtlP.exe
  2⤵
  PID:2916
- C:\Windows\System\ghypUEm.exe
  C:\Windows\System\ghypUEm.exe
  2⤵
  PID:1392
- C:\Windows\System\bbgwYZV.exe
  C:\Windows\System\bbgwYZV.exe
  2⤵
  PID:6152
- C:\Windows\System\liwcQHk.exe
  C:\Windows\System\liwcQHk.exe
  2⤵
  PID:6180
- C:\Windows\System\yLjNTme.exe
  C:\Windows\System\yLjNTme.exe
  2⤵
  PID:6208
- C:\Windows\System\FRuzSKi.exe
  C:\Windows\System\FRuzSKi.exe
  2⤵
  PID:6236
- C:\Windows\System\xFdMgPy.exe
  C:\Windows\System\xFdMgPy.exe
  2⤵
  PID:6264
- C:\Windows\System\vjSvCrF.exe
  C:\Windows\System\vjSvCrF.exe
  2⤵
  PID:6292
- C:\Windows\System\dpvzsar.exe
  C:\Windows\System\dpvzsar.exe
  2⤵
  PID:6320
- C:\Windows\System\qvNnTrV.exe
  C:\Windows\System\qvNnTrV.exe
  2⤵
  PID:6348
- C:\Windows\System\Kmrjwwg.exe
  C:\Windows\System\Kmrjwwg.exe
  2⤵
  PID:6376
- C:\Windows\System\XekxpSD.exe
  C:\Windows\System\XekxpSD.exe
  2⤵
  PID:6404
- C:\Windows\System\iHLplvr.exe
  C:\Windows\System\iHLplvr.exe
  2⤵
  PID:6428
- C:\Windows\System\kQoWblY.exe
  C:\Windows\System\kQoWblY.exe
  2⤵
  PID:6456
- C:\Windows\System\DbHdKyR.exe
  C:\Windows\System\DbHdKyR.exe
  2⤵
  PID:6484
- C:\Windows\System\lunBTBx.exe
  C:\Windows\System\lunBTBx.exe
  2⤵
  PID:6512
- C:\Windows\System\DWDqCDp.exe
  C:\Windows\System\DWDqCDp.exe
  2⤵
  PID:6544
- C:\Windows\System\aQNLFAa.exe
  C:\Windows\System\aQNLFAa.exe
  2⤵
  PID:6572
- C:\Windows\System\jOGbpKm.exe
  C:\Windows\System\jOGbpKm.exe
  2⤵
  PID:6596
- C:\Windows\System\CZHZbNK.exe
  C:\Windows\System\CZHZbNK.exe
  2⤵
  PID:6624
- C:\Windows\System\jvbdXmN.exe
  C:\Windows\System\jvbdXmN.exe
  2⤵
  PID:6652
- C:\Windows\System\LDoJIEh.exe
  C:\Windows\System\LDoJIEh.exe
  2⤵
  PID:6684
- C:\Windows\System\lhFinze.exe
  C:\Windows\System\lhFinze.exe
  2⤵
  PID:6712
- C:\Windows\System\imUhFOf.exe
  C:\Windows\System\imUhFOf.exe
  2⤵
  PID:6740
- C:\Windows\System\RfWYtpD.exe
  C:\Windows\System\RfWYtpD.exe
  2⤵
  PID:6768
- C:\Windows\System\DNBnAyB.exe
  C:\Windows\System\DNBnAyB.exe
  2⤵
  PID:6796
- C:\Windows\System\FKMdUOY.exe
  C:\Windows\System\FKMdUOY.exe
  2⤵
  PID:6824
- C:\Windows\System\fjTpGsF.exe
  C:\Windows\System\fjTpGsF.exe
  2⤵
  PID:6848
- C:\Windows\System\BJfOwda.exe
  C:\Windows\System\BJfOwda.exe
  2⤵
  PID:6880
- C:\Windows\System\ZQnxINy.exe
  C:\Windows\System\ZQnxINy.exe
  2⤵
  PID:6904
- C:\Windows\System\TfkLLOw.exe
  C:\Windows\System\TfkLLOw.exe
  2⤵
  PID:6932
- C:\Windows\System\gScVvwT.exe
  C:\Windows\System\gScVvwT.exe
  2⤵
  PID:6960
- C:\Windows\System\ZFgyEdT.exe
  C:\Windows\System\ZFgyEdT.exe
  2⤵
  PID:6992
- C:\Windows\System\xadmMdo.exe
  C:\Windows\System\xadmMdo.exe
  2⤵
  PID:7020
- C:\Windows\System\esDGEpI.exe
  C:\Windows\System\esDGEpI.exe
  2⤵
  PID:7048
- C:\Windows\System\ICZpOHC.exe
  C:\Windows\System\ICZpOHC.exe
  2⤵
  PID:7076
- C:\Windows\System\YYGRIto.exe
  C:\Windows\System\YYGRIto.exe
  2⤵
  PID:7104
- C:\Windows\System\PtdwgLT.exe
  C:\Windows\System\PtdwgLT.exe
  2⤵
  PID:7132
- C:\Windows\System\HcZOhUe.exe
  C:\Windows\System\HcZOhUe.exe
  2⤵
  PID:7160
- C:\Windows\System\legDVBc.exe
  C:\Windows\System\legDVBc.exe
  2⤵
  PID:5164
- C:\Windows\System\SeIbqHU.exe
  C:\Windows\System\SeIbqHU.exe
  2⤵
  PID:5612
- C:\Windows\System\KRewMVQ.exe
  C:\Windows\System\KRewMVQ.exe
  2⤵
  PID:5916
- C:\Windows\System\YDegNuI.exe
  C:\Windows\System\YDegNuI.exe
  2⤵
  PID:6172
- C:\Windows\System\UYrHyeM.exe
  C:\Windows\System\UYrHyeM.exe
  2⤵
  PID:6220
- C:\Windows\System\ooVidZQ.exe
  C:\Windows\System\ooVidZQ.exe
  2⤵
  PID:3184
- C:\Windows\System\mJNLgRQ.exe
  C:\Windows\System\mJNLgRQ.exe
  2⤵
  PID:3500
- C:\Windows\System\NlnpHdv.exe
  C:\Windows\System\NlnpHdv.exe
  2⤵
  PID:6340
- C:\Windows\System\oCMEbtD.exe
  C:\Windows\System\oCMEbtD.exe
  2⤵
  PID:6416
- C:\Windows\System\lbONWCV.exe
  C:\Windows\System\lbONWCV.exe
  2⤵
  PID:6444
- C:\Windows\System\BvTJcTt.exe
  C:\Windows\System\BvTJcTt.exe
  2⤵
  PID:6480
- C:\Windows\System\PLJesSD.exe
  C:\Windows\System\PLJesSD.exe
  2⤵
  PID:6560
- C:\Windows\System\iTQcTLC.exe
  C:\Windows\System\iTQcTLC.exe
  2⤵
  PID:6612
- C:\Windows\System\GhzcDhk.exe
  C:\Windows\System\GhzcDhk.exe
  2⤵
  PID:6700
- C:\Windows\System\WarvhoF.exe
  C:\Windows\System\WarvhoF.exe
  2⤵
  PID:6756
- C:\Windows\System\qXMrFOg.exe
  C:\Windows\System\qXMrFOg.exe
  2⤵
  PID:6812
- C:\Windows\System\CTEDruM.exe
  C:\Windows\System\CTEDruM.exe
  2⤵
  PID:6928
- C:\Windows\System\bZHzNQS.exe
  C:\Windows\System\bZHzNQS.exe
  2⤵
  PID:6980
- C:\Windows\System\xQUPJUh.exe
  C:\Windows\System\xQUPJUh.exe
  2⤵
  PID:7032
- C:\Windows\System\dWoKYrn.exe
  C:\Windows\System\dWoKYrn.exe
  2⤵
  PID:3076
- C:\Windows\System\RwVUYsd.exe
  C:\Windows\System\RwVUYsd.exe
  2⤵
  PID:3044
- C:\Windows\System\UHuxvEf.exe
  C:\Windows\System\UHuxvEf.exe
  2⤵
  PID:6228
- C:\Windows\System\LtDmIEY.exe
  C:\Windows\System\LtDmIEY.exe
  2⤵
  PID:5116
- C:\Windows\System\OFZqymA.exe
  C:\Windows\System\OFZqymA.exe
  2⤵
  PID:2744
- C:\Windows\System\AQcxfKI.exe
  C:\Windows\System\AQcxfKI.exe
  2⤵
  PID:4744
- C:\Windows\System\aaEAowP.exe
  C:\Windows\System\aaEAowP.exe
  2⤵
  PID:3580
- C:\Windows\System\whKewLN.exe
  C:\Windows\System\whKewLN.exe
  2⤵
  PID:1352
- C:\Windows\System\AWCDOys.exe
  C:\Windows\System\AWCDOys.exe
  2⤵
  PID:6332
- C:\Windows\System\NpwrYCX.exe
  C:\Windows\System\NpwrYCX.exe
  2⤵
  PID:1068
- C:\Windows\System\govGJjH.exe
  C:\Windows\System\govGJjH.exe
  2⤵
  PID:6472
- C:\Windows\System\hwlMkjz.exe
  C:\Windows\System\hwlMkjz.exe
  2⤵
  PID:6536
- C:\Windows\System\cWUvIUM.exe
  C:\Windows\System\cWUvIUM.exe
  2⤵
  PID:4848
- C:\Windows\System\tUdeprR.exe
  C:\Windows\System\tUdeprR.exe
  2⤵
  PID:6696
- C:\Windows\System\DBTpTXd.exe
  C:\Windows\System\DBTpTXd.exe
  2⤵
  PID:6872
- C:\Windows\System\XlSReRg.exe
  C:\Windows\System\XlSReRg.exe
  2⤵
  PID:6792
- C:\Windows\System\ruCfNLc.exe
  C:\Windows\System\ruCfNLc.exe
  2⤵
  PID:7004
- C:\Windows\System\CQzKlII.exe
  C:\Windows\System\CQzKlII.exe
  2⤵
  PID:6956
- C:\Windows\System\bpNoIFx.exe
  C:\Windows\System\bpNoIFx.exe
  2⤵
  PID:2556
- C:\Windows\System\hdkRuls.exe
  C:\Windows\System\hdkRuls.exe
  2⤵
  PID:5076
- C:\Windows\System\HuTIRKZ.exe
  C:\Windows\System\HuTIRKZ.exe
  2⤵
  PID:2144
- C:\Windows\System\mNrADkK.exe
  C:\Windows\System\mNrADkK.exe
  2⤵
  PID:4132
- C:\Windows\System\HIxxAGo.exe
  C:\Windows\System\HIxxAGo.exe
  2⤵
  PID:6676
- C:\Windows\System\YKMaJqa.exe
  C:\Windows\System\YKMaJqa.exe
  2⤵
  PID:6780
- C:\Windows\System\wMtfnSA.exe
  C:\Windows\System\wMtfnSA.exe
  2⤵
  PID:3064
- C:\Windows\System\FZDIlOP.exe
  C:\Windows\System\FZDIlOP.exe
  2⤵
  PID:7092
- C:\Windows\System\WCszRVt.exe
  C:\Windows\System\WCszRVt.exe
  2⤵
  PID:6396
- C:\Windows\System\seNFWVC.exe
  C:\Windows\System\seNFWVC.exe
  2⤵
  PID:6620
- C:\Windows\System\ECNAKku.exe
  C:\Windows\System\ECNAKku.exe
  2⤵
  PID:7196
- C:\Windows\System\ugJFVEc.exe
  C:\Windows\System\ugJFVEc.exe
  2⤵
  PID:7224
- C:\Windows\System\rkSmmYr.exe
  C:\Windows\System\rkSmmYr.exe
  2⤵
  PID:7244
- C:\Windows\System\fLATtvx.exe
  C:\Windows\System\fLATtvx.exe
  2⤵
  PID:7260
- C:\Windows\System\ACZfBJg.exe
  C:\Windows\System\ACZfBJg.exe
  2⤵
  PID:7284
- C:\Windows\System\chRCbbA.exe
  C:\Windows\System\chRCbbA.exe
  2⤵
  PID:7308
- C:\Windows\System\DrplLjz.exe
  C:\Windows\System\DrplLjz.exe
  2⤵
  PID:7332
- C:\Windows\System\AWKwRyk.exe
  C:\Windows\System\AWKwRyk.exe
  2⤵
  PID:7352
- C:\Windows\System\AoBGOvM.exe
  C:\Windows\System\AoBGOvM.exe
  2⤵
  PID:7368
- C:\Windows\System\vqtIecw.exe
  C:\Windows\System\vqtIecw.exe
  2⤵
  PID:7400
- C:\Windows\System\gbBlXEP.exe
  C:\Windows\System\gbBlXEP.exe
  2⤵
  PID:7420
- C:\Windows\System\jgwznba.exe
  C:\Windows\System\jgwznba.exe
  2⤵
  PID:7436
- C:\Windows\System\KydaPmn.exe
  C:\Windows\System\KydaPmn.exe
  2⤵
  PID:7456
- C:\Windows\System\FSbnkEb.exe
  C:\Windows\System\FSbnkEb.exe
  2⤵
  PID:7476
- C:\Windows\System\plPNcrz.exe
  C:\Windows\System\plPNcrz.exe
  2⤵
  PID:7548
- C:\Windows\System\klKRvGu.exe
  C:\Windows\System\klKRvGu.exe
  2⤵
  PID:7652
- C:\Windows\System\fzvVYYv.exe
  C:\Windows\System\fzvVYYv.exe
  2⤵
  PID:7676
- C:\Windows\System\pVpvnwE.exe
  C:\Windows\System\pVpvnwE.exe
  2⤵
  PID:7736
- C:\Windows\System\dHqkfdU.exe
  C:\Windows\System\dHqkfdU.exe
  2⤵
  PID:7772
- C:\Windows\System\rEvIQsE.exe
  C:\Windows\System\rEvIQsE.exe
  2⤵
  PID:7796
- C:\Windows\System\bEfnwyi.exe
  C:\Windows\System\bEfnwyi.exe
  2⤵
  PID:7812
- C:\Windows\System\qJGOyQu.exe
  C:\Windows\System\qJGOyQu.exe
  2⤵
  PID:7828
- C:\Windows\System\EwFLQOK.exe
  C:\Windows\System\EwFLQOK.exe
  2⤵
  PID:7848
- C:\Windows\System\NllnwNN.exe
  C:\Windows\System\NllnwNN.exe
  2⤵
  PID:7868
- C:\Windows\System\asTOHqd.exe
  C:\Windows\System\asTOHqd.exe
  2⤵
  PID:7884
- C:\Windows\System\ONENYht.exe
  C:\Windows\System\ONENYht.exe
  2⤵
  PID:7952
- C:\Windows\System\MDEWYgN.exe
  C:\Windows\System\MDEWYgN.exe
  2⤵
  PID:7968
- C:\Windows\System\ZTcMYQF.exe
  C:\Windows\System\ZTcMYQF.exe
  2⤵
  PID:7988
- C:\Windows\System\joosBOR.exe
  C:\Windows\System\joosBOR.exe
  2⤵
  PID:8040
- C:\Windows\System\LgxjnyJ.exe
  C:\Windows\System\LgxjnyJ.exe
  2⤵
  PID:8064
- C:\Windows\System\detoCge.exe
  C:\Windows\System\detoCge.exe
  2⤵
  PID:8084
- C:\Windows\System\VGBKITk.exe
  C:\Windows\System\VGBKITk.exe
  2⤵
  PID:8108
- C:\Windows\System\TqjlPCf.exe
  C:\Windows\System\TqjlPCf.exe
  2⤵
  PID:8128
- C:\Windows\System\IHrwqEk.exe
  C:\Windows\System\IHrwqEk.exe
  2⤵
  PID:8148
- C:\Windows\System\hncxYwB.exe
  C:\Windows\System\hncxYwB.exe
  2⤵
  PID:6312
- C:\Windows\System\ttYpHfP.exe
  C:\Windows\System\ttYpHfP.exe
  2⤵
  PID:7180
- C:\Windows\System\OSWHLUW.exe
  C:\Windows\System\OSWHLUW.exe
  2⤵
  PID:7192
- C:\Windows\System\xJPKVjc.exe
  C:\Windows\System\xJPKVjc.exe
  2⤵
  PID:7172
- C:\Windows\System\ESDgwdw.exe
  C:\Windows\System\ESDgwdw.exe
  2⤵
  PID:7448
- C:\Windows\System\NxJSoNT.exe
  C:\Windows\System\NxJSoNT.exe
  2⤵
  PID:7256
- C:\Windows\System\AJuPqMp.exe
  C:\Windows\System\AJuPqMp.exe
  2⤵
  PID:7508
- C:\Windows\System\OXGukzi.exe
  C:\Windows\System\OXGukzi.exe
  2⤵
  PID:7616
- C:\Windows\System\HXkRXUo.exe
  C:\Windows\System\HXkRXUo.exe
  2⤵
  PID:7696
- C:\Windows\System\foPtCMn.exe
  C:\Windows\System\foPtCMn.exe
  2⤵
  PID:7748
- C:\Windows\System\ffQtRLE.exe
  C:\Windows\System\ffQtRLE.exe
  2⤵
  PID:7784
- C:\Windows\System\DOPNXlD.exe
  C:\Windows\System\DOPNXlD.exe
  2⤵
  PID:7904
- C:\Windows\System\pNAAyBH.exe
  C:\Windows\System\pNAAyBH.exe
  2⤵
  PID:7892
- C:\Windows\System\XlXPOop.exe
  C:\Windows\System\XlXPOop.exe
  2⤵
  PID:7940
- C:\Windows\System\GjVWGfk.exe
  C:\Windows\System\GjVWGfk.exe
  2⤵
  PID:8000
- C:\Windows\System\LYkmDJQ.exe
  C:\Windows\System\LYkmDJQ.exe
  2⤵
  PID:8056
- C:\Windows\System\nXWlOXH.exe
  C:\Windows\System\nXWlOXH.exe
  2⤵
  PID:8076
- C:\Windows\System\lgnAvBB.exe
  C:\Windows\System\lgnAvBB.exe
  2⤵
  PID:8136
- C:\Windows\System\rQZROZM.exe
  C:\Windows\System\rQZROZM.exe
  2⤵
  PID:6196
- C:\Windows\System\bXhaZyu.exe
  C:\Windows\System\bXhaZyu.exe
  2⤵
  PID:7344
- C:\Windows\System\NjkNaAe.exe
  C:\Windows\System\NjkNaAe.exe
  2⤵
  PID:7364
- C:\Windows\System\vZTLqli.exe
  C:\Windows\System\vZTLqli.exe
  2⤵
  PID:7468
- C:\Windows\System\sWMvfzc.exe
  C:\Windows\System\sWMvfzc.exe
  2⤵
  PID:7516
- C:\Windows\System\jHMHFgi.exe
  C:\Windows\System\jHMHFgi.exe
  2⤵
  PID:7608
- C:\Windows\System\ZQijzRE.exe
  C:\Windows\System\ZQijzRE.exe
  2⤵
  PID:8104
- C:\Windows\System\xkQZwht.exe
  C:\Windows\System\xkQZwht.exe
  2⤵
  PID:8124
- C:\Windows\System\EvgHQGn.exe
  C:\Windows\System\EvgHQGn.exe
  2⤵
  PID:7252
- C:\Windows\System\vPOqHzx.exe
  C:\Windows\System\vPOqHzx.exe
  2⤵
  PID:7500
- C:\Windows\System\EjKNmMd.exe
  C:\Windows\System\EjKNmMd.exe
  2⤵
  PID:7452
- C:\Windows\System\smdzQCE.exe
  C:\Windows\System\smdzQCE.exe
  2⤵
  PID:8220
- C:\Windows\System\HHSqDDx.exe
  C:\Windows\System\HHSqDDx.exe
  2⤵
  PID:8236
- C:\Windows\System\WfXuXYk.exe
  C:\Windows\System\WfXuXYk.exe
  2⤵
  PID:8300
- C:\Windows\System\qjhjPCU.exe
  C:\Windows\System\qjhjPCU.exe
  2⤵
  PID:8320
- C:\Windows\System\vIxDDuU.exe
  C:\Windows\System\vIxDDuU.exe
  2⤵
  PID:8364
- C:\Windows\System\ajWYqbR.exe
  C:\Windows\System\ajWYqbR.exe
  2⤵
  PID:8400
- C:\Windows\System\QdOmMGM.exe
  C:\Windows\System\QdOmMGM.exe
  2⤵
  PID:8420
- C:\Windows\System\EBoVjLL.exe
  C:\Windows\System\EBoVjLL.exe
  2⤵
  PID:8440
- C:\Windows\System\NqEpOuj.exe
  C:\Windows\System\NqEpOuj.exe
  2⤵
  PID:8464
- C:\Windows\System\uFTuvOD.exe
  C:\Windows\System\uFTuvOD.exe
  2⤵
  PID:8496
- C:\Windows\System\JlDvYqH.exe
  C:\Windows\System\JlDvYqH.exe
  2⤵
  PID:8516
- C:\Windows\System\oDRrLYo.exe
  C:\Windows\System\oDRrLYo.exe
  2⤵
  PID:8556
- C:\Windows\System\phQKwDs.exe
  C:\Windows\System\phQKwDs.exe
  2⤵
  PID:8580
- C:\Windows\System\MBWtWvY.exe
  C:\Windows\System\MBWtWvY.exe
  2⤵
  PID:8604
- C:\Windows\System\gHLkOFu.exe
  C:\Windows\System\gHLkOFu.exe
  2⤵
  PID:8620
- C:\Windows\System\HmkNumE.exe
  C:\Windows\System\HmkNumE.exe
  2⤵
  PID:8640
- C:\Windows\System\LHyHLBr.exe
  C:\Windows\System\LHyHLBr.exe
  2⤵
  PID:8660
- C:\Windows\System\omLoStH.exe
  C:\Windows\System\omLoStH.exe
  2⤵
  PID:8676
- C:\Windows\System\xDvXYJe.exe
  C:\Windows\System\xDvXYJe.exe
  2⤵
  PID:8696
- C:\Windows\System\CNKQQTq.exe
  C:\Windows\System\CNKQQTq.exe
  2⤵
  PID:8736
- C:\Windows\System\IGhNWcb.exe
  C:\Windows\System\IGhNWcb.exe
  2⤵
  PID:8756
- C:\Windows\System\kfXYHLV.exe
  C:\Windows\System\kfXYHLV.exe
  2⤵
  PID:8828
- C:\Windows\System\SLkDSON.exe
  C:\Windows\System\SLkDSON.exe
  2⤵
  PID:8872
- C:\Windows\System\HbHbdwq.exe
  C:\Windows\System\HbHbdwq.exe
  2⤵
  PID:8892
- C:\Windows\System\XvbKEAD.exe
  C:\Windows\System\XvbKEAD.exe
  2⤵
  PID:8936
- C:\Windows\System\eccERom.exe
  C:\Windows\System\eccERom.exe
  2⤵
  PID:8952
- C:\Windows\System\rjyDHWT.exe
  C:\Windows\System\rjyDHWT.exe
  2⤵
  PID:8972
- C:\Windows\System\FlchPbF.exe
  C:\Windows\System\FlchPbF.exe
  2⤵
  PID:9000
- C:\Windows\System\RPjklOn.exe
  C:\Windows\System\RPjklOn.exe
  2⤵
  PID:9020
- C:\Windows\System\WuNADSR.exe
  C:\Windows\System\WuNADSR.exe
  2⤵
  PID:9064
- C:\Windows\System\drRZzRW.exe
  C:\Windows\System\drRZzRW.exe
  2⤵
  PID:9092
- C:\Windows\System\IIwJwxj.exe
  C:\Windows\System\IIwJwxj.exe
  2⤵
  PID:9108
- C:\Windows\System\lyjHsCl.exe
  C:\Windows\System\lyjHsCl.exe
  2⤵
  PID:9136
- C:\Windows\System\oszjzYi.exe
  C:\Windows\System\oszjzYi.exe
  2⤵
  PID:9156
- C:\Windows\System\OHcpEPv.exe
  C:\Windows\System\OHcpEPv.exe
  2⤵
  PID:7328
- C:\Windows\System\GnBlHoQ.exe
  C:\Windows\System\GnBlHoQ.exe
  2⤵
  PID:8048
- C:\Windows\System\GOWEeuI.exe
  C:\Windows\System\GOWEeuI.exe
  2⤵
  PID:8336
- C:\Windows\System\kwQcewx.exe
  C:\Windows\System\kwQcewx.exe
  2⤵
  PID:8396
- C:\Windows\System\QsrXOxc.exe
  C:\Windows\System\QsrXOxc.exe
  2⤵
  PID:8432
- C:\Windows\System\jmxUkkP.exe
  C:\Windows\System\jmxUkkP.exe
  2⤵
  PID:8408
- C:\Windows\System\NsKMJte.exe
  C:\Windows\System\NsKMJte.exe
  2⤵
  PID:8476
- C:\Windows\System\uOVJAHe.exe
  C:\Windows\System\uOVJAHe.exe
  2⤵
  PID:8540
- C:\Windows\System\wXRwzRT.exe
  C:\Windows\System\wXRwzRT.exe
  2⤵
  PID:8596
- C:\Windows\System\nqIXKHa.exe
  C:\Windows\System\nqIXKHa.exe
  2⤵
  PID:8748
- C:\Windows\System\fsKTiyp.exe
  C:\Windows\System\fsKTiyp.exe
  2⤵
  PID:8780
- C:\Windows\System\EZUtsYu.exe
  C:\Windows\System\EZUtsYu.exe
  2⤵
  PID:8864
- C:\Windows\System\LohdMrg.exe
  C:\Windows\System\LohdMrg.exe
  2⤵
  PID:8960
- C:\Windows\System\vxeXdBC.exe
  C:\Windows\System\vxeXdBC.exe
  2⤵
  PID:9016
- C:\Windows\System\nLNdkkk.exe
  C:\Windows\System\nLNdkkk.exe
  2⤵
  PID:9116
- C:\Windows\System\pIfprzf.exe
  C:\Windows\System\pIfprzf.exe
  2⤵
  PID:9184
- C:\Windows\System\dwFeeYC.exe
  C:\Windows\System\dwFeeYC.exe
  2⤵
  PID:8284
- C:\Windows\System\hKgUtDf.exe
  C:\Windows\System\hKgUtDf.exe
  2⤵
  PID:8460
- C:\Windows\System\SqRjmee.exe
  C:\Windows\System\SqRjmee.exe
  2⤵
  PID:8492
- C:\Windows\System\JHSSsXm.exe
  C:\Windows\System\JHSSsXm.exe
  2⤵
  PID:8784
- C:\Windows\System\GgelekS.exe
  C:\Windows\System\GgelekS.exe
  2⤵
  PID:8652
- C:\Windows\System\GQIiPWa.exe
  C:\Windows\System\GQIiPWa.exe
  2⤵
  PID:8820
- C:\Windows\System\MhFHakd.exe
  C:\Windows\System\MhFHakd.exe
  2⤵
  PID:9100
- C:\Windows\System\xVZbimD.exe
  C:\Windows\System\xVZbimD.exe
  2⤵
  PID:8576
- C:\Windows\System\VlmICip.exe
  C:\Windows\System\VlmICip.exe
  2⤵
  PID:8488
- C:\Windows\System\VhSDJDx.exe
  C:\Windows\System\VhSDJDx.exe
  2⤵
  PID:8768
- C:\Windows\System\jhtpUKH.exe
  C:\Windows\System\jhtpUKH.exe
  2⤵
  PID:9144
- C:\Windows\System\NItsmys.exe
  C:\Windows\System\NItsmys.exe
  2⤵
  PID:9248
- C:\Windows\System\ObQjNbt.exe
  C:\Windows\System\ObQjNbt.exe
  2⤵
  PID:9268
- C:\Windows\System\rdOoYqE.exe
  C:\Windows\System\rdOoYqE.exe
  2⤵
  PID:9284
- C:\Windows\System\pwMIuuz.exe
  C:\Windows\System\pwMIuuz.exe
  2⤵
  PID:9308
- C:\Windows\System\qDYZSvz.exe
  C:\Windows\System\qDYZSvz.exe
  2⤵
  PID:9348
- C:\Windows\System\HMacXSv.exe
  C:\Windows\System\HMacXSv.exe
  2⤵
  PID:9396
- C:\Windows\System\QLPmckm.exe
  C:\Windows\System\QLPmckm.exe
  2⤵
  PID:9444
- C:\Windows\System\whTlkzS.exe
  C:\Windows\System\whTlkzS.exe
  2⤵
  PID:9464
- C:\Windows\System\FOdrLFT.exe
  C:\Windows\System\FOdrLFT.exe
  2⤵
  PID:9528
- C:\Windows\System\yLWsNds.exe
  C:\Windows\System\yLWsNds.exe
  2⤵
  PID:9548
- C:\Windows\System\hGNFiAu.exe
  C:\Windows\System\hGNFiAu.exe
  2⤵
  PID:9576
- C:\Windows\System\IvIhaOX.exe
  C:\Windows\System\IvIhaOX.exe
  2⤵
  PID:9604
- C:\Windows\System\ERmKqnu.exe
  C:\Windows\System\ERmKqnu.exe
  2⤵
  PID:9632
- C:\Windows\System\wceEEFm.exe
  C:\Windows\System\wceEEFm.exe
  2⤵
  PID:9652
- C:\Windows\System\DIIPSXT.exe
  C:\Windows\System\DIIPSXT.exe
  2⤵
  PID:9676
- C:\Windows\System\KzBFngx.exe
  C:\Windows\System\KzBFngx.exe
  2⤵
  PID:9700
- C:\Windows\System\MiiOxPy.exe
  C:\Windows\System\MiiOxPy.exe
  2⤵
  PID:9724
- C:\Windows\System\iuXLUtJ.exe
  C:\Windows\System\iuXLUtJ.exe
  2⤵
  PID:9744
- C:\Windows\System\hKPimzx.exe
  C:\Windows\System\hKPimzx.exe
  2⤵
  PID:9760
- C:\Windows\System\wCFJHfo.exe
  C:\Windows\System\wCFJHfo.exe
  2⤵
  PID:9776
- C:\Windows\System\xJPMtou.exe
  C:\Windows\System\xJPMtou.exe
  2⤵
  PID:9820
- C:\Windows\System\ltmfOno.exe
  C:\Windows\System\ltmfOno.exe
  2⤵
  PID:9872
- C:\Windows\System\JxyStto.exe
  C:\Windows\System\JxyStto.exe
  2⤵
  PID:9888
- C:\Windows\System\KMgmiuV.exe
  C:\Windows\System\KMgmiuV.exe
  2⤵
  PID:9928
- C:\Windows\System\TzuNvOO.exe
  C:\Windows\System\TzuNvOO.exe
  2⤵
  PID:9948
- C:\Windows\System\JvgfzQp.exe
  C:\Windows\System\JvgfzQp.exe
  2⤵
  PID:9988
- C:\Windows\System\aeahIku.exe
  C:\Windows\System\aeahIku.exe
  2⤵
  PID:10004
- C:\Windows\System\OHBfknb.exe
  C:\Windows\System\OHBfknb.exe
  2⤵
  PID:10032
- C:\Windows\System\XfnaaIe.exe
  C:\Windows\System\XfnaaIe.exe
  2⤵
  PID:10056
- C:\Windows\System\oBJVYdn.exe
  C:\Windows\System\oBJVYdn.exe
  2⤵
  PID:10076
- C:\Windows\System\MlAexFX.exe
  C:\Windows\System\MlAexFX.exe
  2⤵
  PID:10108
- C:\Windows\System\wSSAJBd.exe
  C:\Windows\System\wSSAJBd.exe
  2⤵
  PID:10124
- C:\Windows\System\GdKblhq.exe
  C:\Windows\System\GdKblhq.exe
  2⤵
  PID:10148
- C:\Windows\System\GbVRPnM.exe
  C:\Windows\System\GbVRPnM.exe
  2⤵
  PID:10176
- C:\Windows\System\GFQCrns.exe
  C:\Windows\System\GFQCrns.exe
  2⤵
  PID:10216
- C:\Windows\System\cZoQwYD.exe
  C:\Windows\System\cZoQwYD.exe
  2⤵
  PID:8928
- C:\Windows\System\ZLrzRTs.exe
  C:\Windows\System\ZLrzRTs.exe
  2⤵
  PID:8212
- C:\Windows\System\QfxTrrG.exe
  C:\Windows\System\QfxTrrG.exe
  2⤵
  PID:9260
- C:\Windows\System\JcQkuoF.exe
  C:\Windows\System\JcQkuoF.exe
  2⤵
  PID:9292
- C:\Windows\System\iXUgQcw.exe
  C:\Windows\System\iXUgQcw.exe
  2⤵
  PID:9392
- C:\Windows\System\RctyhTt.exe
  C:\Windows\System\RctyhTt.exe
  2⤵
  PID:9372
- C:\Windows\System\FcXrYsB.exe
  C:\Windows\System\FcXrYsB.exe
  2⤵
  PID:9484
- C:\Windows\System\XoocGom.exe
  C:\Windows\System\XoocGom.exe
  2⤵
  PID:9520
- C:\Windows\System\PofWOJf.exe
  C:\Windows\System\PofWOJf.exe
  2⤵
  PID:9596
- C:\Windows\System\YilwAsW.exe
  C:\Windows\System\YilwAsW.exe
  2⤵
  PID:9740
- C:\Windows\System\PFJKDOg.exe
  C:\Windows\System\PFJKDOg.exe
  2⤵
  PID:9716
- C:\Windows\System\JiulyqZ.exe
  C:\Windows\System\JiulyqZ.exe
  2⤵
  PID:9968
- C:\Windows\System\rTuvUyp.exe
  C:\Windows\System\rTuvUyp.exe
  2⤵
  PID:9996
- C:\Windows\System\LlocrhQ.exe
  C:\Windows\System\LlocrhQ.exe
  2⤵
  PID:10068
- C:\Windows\System\xsekwpi.exe
  C:\Windows\System\xsekwpi.exe
  2⤵
  PID:10156
- C:\Windows\System\BpiTLLV.exe
  C:\Windows\System\BpiTLLV.exe
  2⤵
  PID:10188
- C:\Windows\System\RvVOmgY.exe
  C:\Windows\System\RvVOmgY.exe
  2⤵
  PID:9236
- C:\Windows\System\FcKmJMG.exe
  C:\Windows\System\FcKmJMG.exe
  2⤵
  PID:9500
- C:\Windows\System\IcPDIFU.exe
  C:\Windows\System\IcPDIFU.exe
  2⤵
  PID:8256
- C:\Windows\System\abhdUWc.exe
  C:\Windows\System\abhdUWc.exe
  2⤵
  PID:9408
- C:\Windows\System\QPtbfJF.exe
  C:\Windows\System\QPtbfJF.exe
  2⤵
  PID:9732
- C:\Windows\System\OcLddJl.exe
  C:\Windows\System\OcLddJl.exe
  2⤵
  PID:9752
- C:\Windows\System\HHumiNu.exe
  C:\Windows\System\HHumiNu.exe
  2⤵
  PID:9880
- C:\Windows\System\AJBUNgm.exe
  C:\Windows\System\AJBUNgm.exe
  2⤵
  PID:10040
- C:\Windows\System\SoKKGDp.exe
  C:\Windows\System\SoKKGDp.exe
  2⤵
  PID:10120
- C:\Windows\System\KMYMUnF.exe
  C:\Windows\System\KMYMUnF.exe
  2⤵
  PID:9044
- C:\Windows\System\CTqUcWX.exe
  C:\Windows\System\CTqUcWX.exe
  2⤵
  PID:9556
- C:\Windows\System\XrCOMVn.exe
  C:\Windows\System\XrCOMVn.exe
  2⤵
  PID:9864
- C:\Windows\System\tmnGLQB.exe
  C:\Windows\System\tmnGLQB.exe
  2⤵
  PID:10132
- C:\Windows\System\lGxhgdN.exe
  C:\Windows\System\lGxhgdN.exe
  2⤵
  PID:10260
- C:\Windows\System\YwRvDnJ.exe
  C:\Windows\System\YwRvDnJ.exe
  2⤵
  PID:10296
- C:\Windows\System\aSKzldy.exe
  C:\Windows\System\aSKzldy.exe
  2⤵
  PID:10320
- C:\Windows\System\VDKLsXs.exe
  C:\Windows\System\VDKLsXs.exe
  2⤵
  PID:10480
- C:\Windows\System\pDwEThw.exe
  C:\Windows\System\pDwEThw.exe
  2⤵
  PID:10500
- C:\Windows\System\HGWmiGF.exe
  C:\Windows\System\HGWmiGF.exe
  2⤵
  PID:10516
- C:\Windows\System\UpkAOxN.exe
  C:\Windows\System\UpkAOxN.exe
  2⤵
  PID:10532
- C:\Windows\System\NZOSTBE.exe
  C:\Windows\System\NZOSTBE.exe
  2⤵
  PID:10548
- C:\Windows\System\PGghwGm.exe
  C:\Windows\System\PGghwGm.exe
  2⤵
  PID:10564
- C:\Windows\System\xahZbfm.exe
  C:\Windows\System\xahZbfm.exe
  2⤵
  PID:10580
- C:\Windows\System\HyiiHgg.exe
  C:\Windows\System\HyiiHgg.exe
  2⤵
  PID:10596
- C:\Windows\System\hOwfrKd.exe
  C:\Windows\System\hOwfrKd.exe
  2⤵
  PID:10616
- C:\Windows\System\ytaGzRL.exe
  C:\Windows\System\ytaGzRL.exe
  2⤵
  PID:10632
- C:\Windows\System\CjrsOmY.exe
  C:\Windows\System\CjrsOmY.exe
  2⤵
  PID:10648
- C:\Windows\System\wrGlKZG.exe
  C:\Windows\System\wrGlKZG.exe
  2⤵
  PID:10664
- C:\Windows\System\srPlwPV.exe
  C:\Windows\System\srPlwPV.exe
  2⤵
  PID:10680
- C:\Windows\System\eRBCIod.exe
  C:\Windows\System\eRBCIod.exe
  2⤵
  PID:10696
- C:\Windows\System\hbSRGpe.exe
  C:\Windows\System\hbSRGpe.exe
  2⤵
  PID:10712
- C:\Windows\System\PqjsYNZ.exe
  C:\Windows\System\PqjsYNZ.exe
  2⤵
  PID:10728
- C:\Windows\System\bfzBTFL.exe
  C:\Windows\System\bfzBTFL.exe
  2⤵
  PID:10744
- C:\Windows\System\vyJpzsQ.exe
  C:\Windows\System\vyJpzsQ.exe
  2⤵
  PID:10760
- C:\Windows\System\lunYPXJ.exe
  C:\Windows\System\lunYPXJ.exe
  2⤵
  PID:10776
- C:\Windows\System\XOdziGn.exe
  C:\Windows\System\XOdziGn.exe
  2⤵
  PID:10792
- C:\Windows\System\YREUdSq.exe
  C:\Windows\System\YREUdSq.exe
  2⤵
  PID:10808
- C:\Windows\System\oIdfuOT.exe
  C:\Windows\System\oIdfuOT.exe
  2⤵
  PID:10824
- C:\Windows\System\RUAaLNO.exe
  C:\Windows\System\RUAaLNO.exe
  2⤵
  PID:10868
- C:\Windows\System\acNfduV.exe
  C:\Windows\System\acNfduV.exe
  2⤵
  PID:10924
- C:\Windows\System\QsacQWn.exe
  C:\Windows\System\QsacQWn.exe
  2⤵
  PID:10944
- C:\Windows\System\IZytdtq.exe
  C:\Windows\System\IZytdtq.exe
  2⤵
  PID:11048
- C:\Windows\System\WLlQMFj.exe
  C:\Windows\System\WLlQMFj.exe
  2⤵
  PID:11064
- C:\Windows\System\SzXXAym.exe
  C:\Windows\System\SzXXAym.exe
  2⤵
  PID:11088
- C:\Windows\System\ksGNjqO.exe
  C:\Windows\System\ksGNjqO.exe
  2⤵
  PID:11112
- C:\Windows\System\hrKZXxB.exe
  C:\Windows\System\hrKZXxB.exe
  2⤵
  PID:11132
- C:\Windows\System\hVDkPhf.exe
  C:\Windows\System\hVDkPhf.exe
  2⤵
  PID:11156
- C:\Windows\System\dKhYhLP.exe
  C:\Windows\System\dKhYhLP.exe
  2⤵
  PID:11180
- C:\Windows\System\wFgqlmq.exe
  C:\Windows\System\wFgqlmq.exe
  2⤵
  PID:11204
- C:\Windows\System\GtBqhER.exe
  C:\Windows\System\GtBqhER.exe
  2⤵
  PID:11220
- C:\Windows\System\jKEJgpE.exe
  C:\Windows\System\jKEJgpE.exe
  2⤵
  PID:11244
- C:\Windows\System\mnDZyDu.exe
  C:\Windows\System\mnDZyDu.exe
  2⤵
  PID:10244
- C:\Windows\System\DXzEwjD.exe
  C:\Windows\System\DXzEwjD.exe
  2⤵
  PID:10356
- C:\Windows\System\wxBMtLv.exe
  C:\Windows\System\wxBMtLv.exe
  2⤵
  PID:10392
- C:\Windows\System\cSppdCo.exe
  C:\Windows\System\cSppdCo.exe
  2⤵
  PID:10420
- C:\Windows\System\mjkyWCQ.exe
  C:\Windows\System\mjkyWCQ.exe
  2⤵
  PID:10508
- C:\Windows\System\TtOmDZt.exe
  C:\Windows\System\TtOmDZt.exe
  2⤵
  PID:10572
- C:\Windows\System\OFKjCzx.exe
  C:\Windows\System\OFKjCzx.exe
  2⤵
  PID:10608
- C:\Windows\System\ekuKCjv.exe
  C:\Windows\System\ekuKCjv.exe
  2⤵
  PID:10768
- C:\Windows\System\lQUlCNJ.exe
  C:\Windows\System\lQUlCNJ.exe
  2⤵
  PID:11028
- C:\Windows\System\DtqrAcB.exe
  C:\Windows\System\DtqrAcB.exe
  2⤵
  PID:10048
- C:\Windows\System\tfKlOhw.exe
  C:\Windows\System\tfKlOhw.exe
  2⤵
  PID:10960
- C:\Windows\System\xJqxwHB.exe
  C:\Windows\System\xJqxwHB.exe
  2⤵
  PID:11108
- C:\Windows\System\DlineWS.exe
  C:\Windows\System\DlineWS.exe
  2⤵
  PID:11144
- C:\Windows\System\VhpmscV.exe
  C:\Windows\System\VhpmscV.exe
  2⤵
  PID:11188
- C:\Windows\System\kQOvyQD.exe
  C:\Windows\System\kQOvyQD.exe
  2⤵
  PID:10360
- C:\Windows\System\SzSMAcM.exe
  C:\Windows\System\SzSMAcM.exe
  2⤵
  PID:10404
- C:\Windows\System\IJKpktq.exe
  C:\Windows\System\IJKpktq.exe
  2⤵
  PID:10708
- C:\Windows\System\BNeDXxk.exe
  C:\Windows\System\BNeDXxk.exe
  2⤵
  PID:10740
- C:\Windows\System\sbLrmCo.exe
  C:\Windows\System\sbLrmCo.exe
  2⤵
  PID:11056
- C:\Windows\System\mzGqyOk.exe
  C:\Windows\System\mzGqyOk.exe
  2⤵
  PID:11084
- C:\Windows\System\ednihlI.exe
  C:\Windows\System\ednihlI.exe
  2⤵
  PID:10644
- C:\Windows\System\jUrMmBu.exe
  C:\Windows\System\jUrMmBu.exe
  2⤵
  PID:11016
- C:\Windows\System\rDkNwVh.exe
  C:\Windows\System\rDkNwVh.exe
  2⤵
  PID:11060
- C:\Windows\System\EEyOwXA.exe
  C:\Windows\System\EEyOwXA.exe
  2⤵
  PID:10540
- C:\Windows\System\YgdgSaf.exe
  C:\Windows\System\YgdgSaf.exe
  2⤵
  PID:10936
- C:\Windows\System\fWCTkQt.exe
  C:\Windows\System\fWCTkQt.exe
  2⤵
  PID:11284
- C:\Windows\System\DaJEzwg.exe
  C:\Windows\System\DaJEzwg.exe
  2⤵
  PID:11304
- C:\Windows\System\oyZxFjb.exe
  C:\Windows\System\oyZxFjb.exe
  2⤵
  PID:11324
- C:\Windows\System\VSkEIij.exe
  C:\Windows\System\VSkEIij.exe
  2⤵
  PID:11372
- C:\Windows\System\XgUVGKV.exe
  C:\Windows\System\XgUVGKV.exe
  2⤵
  PID:11400
- C:\Windows\System\EXMkuFp.exe
  C:\Windows\System\EXMkuFp.exe
  2⤵
  PID:11420
- C:\Windows\System\vbXsCjm.exe
  C:\Windows\System\vbXsCjm.exe
  2⤵
  PID:11460
- C:\Windows\System\KldBPOh.exe
  C:\Windows\System\KldBPOh.exe
  2⤵
  PID:11480
- C:\Windows\System\RJKRrtl.exe
  C:\Windows\System\RJKRrtl.exe
  2⤵
  PID:11536
- C:\Windows\System\LMVOCwO.exe
  C:\Windows\System\LMVOCwO.exe
  2⤵
  PID:11564
- C:\Windows\System\zCfRQtd.exe
  C:\Windows\System\zCfRQtd.exe
  2⤵
  PID:11580
- C:\Windows\System\xetYGQp.exe
  C:\Windows\System\xetYGQp.exe
  2⤵
  PID:11600
- C:\Windows\System\ZWQAAiD.exe
  C:\Windows\System\ZWQAAiD.exe
  2⤵
  PID:11640
- C:\Windows\System\sADEmof.exe
  C:\Windows\System\sADEmof.exe
  2⤵
  PID:11660
- C:\Windows\System\hllqKFR.exe
  C:\Windows\System\hllqKFR.exe
  2⤵
  PID:11684
- C:\Windows\System\rQcuOsf.exe
  C:\Windows\System\rQcuOsf.exe
  2⤵
  PID:11704
- C:\Windows\System\KUflsnN.exe
  C:\Windows\System\KUflsnN.exe
  2⤵
  PID:11764
- C:\Windows\System\uKfpPHt.exe
  C:\Windows\System\uKfpPHt.exe
  2⤵
  PID:11792
- C:\Windows\System\eRUShEE.exe
  C:\Windows\System\eRUShEE.exe
  2⤵
  PID:11824
- C:\Windows\System\xJYmRmM.exe
  C:\Windows\System\xJYmRmM.exe
  2⤵
  PID:11848
- C:\Windows\System\opEwEyf.exe
  C:\Windows\System\opEwEyf.exe
  2⤵
  PID:11868
- C:\Windows\System\cELinyx.exe
  C:\Windows\System\cELinyx.exe
  2⤵
  PID:11884
- C:\Windows\System\OXoqewd.exe
  C:\Windows\System\OXoqewd.exe
  2⤵
  PID:11908
- C:\Windows\System\uunaInY.exe
  C:\Windows\System\uunaInY.exe
  2⤵
  PID:11960
- C:\Windows\System\ZytrJbL.exe
  C:\Windows\System\ZytrJbL.exe
  2⤵
  PID:11980
- C:\Windows\System\MMitCVR.exe
  C:\Windows\System\MMitCVR.exe
  2⤵
  PID:12024
- C:\Windows\System\XrbTshg.exe
  C:\Windows\System\XrbTshg.exe
  2⤵
  PID:12040
- C:\Windows\System\avqaRRf.exe
  C:\Windows\System\avqaRRf.exe
  2⤵
  PID:12056
- C:\Windows\System\ELpicoN.exe
  C:\Windows\System\ELpicoN.exe
  2⤵
  PID:12072
- C:\Windows\System\FEfZBgY.exe
  C:\Windows\System\FEfZBgY.exe
  2⤵
  PID:12116
- C:\Windows\System\cgqEhDW.exe
  C:\Windows\System\cgqEhDW.exe
  2⤵
  PID:12140
- C:\Windows\System\BKmaTry.exe
  C:\Windows\System\BKmaTry.exe
  2⤵
  PID:12164
- C:\Windows\System\cPIbOtG.exe
  C:\Windows\System\cPIbOtG.exe
  2⤵
  PID:12196
- C:\Windows\System\ihdCGzE.exe
  C:\Windows\System\ihdCGzE.exe
  2⤵
  PID:12228
- C:\Windows\System\WARpQGX.exe
  C:\Windows\System\WARpQGX.exe
  2⤵
  PID:12264
- C:\Windows\System\Eyvbtxu.exe
  C:\Windows\System\Eyvbtxu.exe
  2⤵
  PID:11168
- C:\Windows\System\DHnkdHu.exe
  C:\Windows\System\DHnkdHu.exe
  2⤵
  PID:11320
- C:\Windows\System\vyAPjHE.exe
  C:\Windows\System\vyAPjHE.exe
  2⤵
  PID:11296
- C:\Windows\System\BBoYoRF.exe
  C:\Windows\System\BBoYoRF.exe
  2⤵
  PID:11364
- C:\Windows\System\sElVRud.exe
  C:\Windows\System\sElVRud.exe
  2⤵
  PID:11472
- C:\Windows\System\kjwlKIF.exe
  C:\Windows\System\kjwlKIF.exe
  2⤵
  PID:11524
- C:\Windows\System\tLIgMKK.exe
  C:\Windows\System\tLIgMKK.exe
  2⤵
  PID:11572
- C:\Windows\System\peLevwz.exe
  C:\Windows\System\peLevwz.exe
  2⤵
  PID:11656
- C:\Windows\System\ydhcMCs.exe
  C:\Windows\System\ydhcMCs.exe
  2⤵
  PID:11752
- C:\Windows\System\yJdYIoU.exe
  C:\Windows\System\yJdYIoU.exe
  2⤵
  PID:11812
- C:\Windows\System\QYXmqEr.exe
  C:\Windows\System\QYXmqEr.exe
  2⤵
  PID:11856
- C:\Windows\System\ImoJXPC.exe
  C:\Windows\System\ImoJXPC.exe
  2⤵
  PID:11896
- C:\Windows\System\vvFbJjm.exe
  C:\Windows\System\vvFbJjm.exe
  2⤵
  PID:11932
- C:\Windows\System\DjksrXw.exe
  C:\Windows\System\DjksrXw.exe
  2⤵
  PID:12032
- C:\Windows\System\EOEOGMU.exe
  C:\Windows\System\EOEOGMU.exe
  2⤵
  PID:12092
- C:\Windows\System\EQmVYwS.exe
  C:\Windows\System\EQmVYwS.exe
  2⤵
  PID:12132
- C:\Windows\System\hUIfgHq.exe
  C:\Windows\System\hUIfgHq.exe
  2⤵
  PID:12156
- C:\Windows\System\QEMMakH.exe
  C:\Windows\System\QEMMakH.exe
  2⤵
  PID:11280
- C:\Windows\System\vbsktlk.exe
  C:\Windows\System\vbsktlk.exe
  2⤵
  PID:11476
- C:\Windows\System\BemuqkM.exe
  C:\Windows\System\BemuqkM.exe
  2⤵
  PID:11504
- C:\Windows\System\FhpozgN.exe
  C:\Windows\System\FhpozgN.exe
  2⤵
  PID:11592
- C:\Windows\System\HGnMgAu.exe
  C:\Windows\System\HGnMgAu.exe
  2⤵
  PID:11876
- C:\Windows\System\gDiwEzd.exe
  C:\Windows\System\gDiwEzd.exe
  2⤵
  PID:12048
- C:\Windows\System\IRptrTn.exe
  C:\Windows\System\IRptrTn.exe
  2⤵
  PID:12208
- C:\Windows\System\rdPhEbC.exe
  C:\Windows\System\rdPhEbC.exe
  2⤵
  PID:3408
- C:\Windows\System\yyiESXE.exe
  C:\Windows\System\yyiESXE.exe
  2⤵
  PID:11368
- C:\Windows\System\kpGjCld.exe
  C:\Windows\System\kpGjCld.exe
  2⤵
  PID:11492
- C:\Windows\System\uFrsjJM.exe
  C:\Windows\System\uFrsjJM.exe
  2⤵
  PID:11724
- C:\Windows\System\qVeUdvr.exe
  C:\Windows\System\qVeUdvr.exe
  2⤵
  PID:4380
- C:\Windows\System\FaeRfyl.exe
  C:\Windows\System\FaeRfyl.exe
  2⤵
  PID:12276
- C:\Windows\System\fIPmRfA.exe
  C:\Windows\System\fIPmRfA.exe
  2⤵
  PID:12304
- C:\Windows\System\CPsxIqp.exe
  C:\Windows\System\CPsxIqp.exe
  2⤵
  PID:12328
- C:\Windows\System\EKnkhIf.exe
  C:\Windows\System\EKnkhIf.exe
  2⤵
  PID:12384
- C:\Windows\System\HPsyNVo.exe
  C:\Windows\System\HPsyNVo.exe
  2⤵
  PID:12436
- C:\Windows\System\AGaVsCE.exe
  C:\Windows\System\AGaVsCE.exe
  2⤵
  PID:12456
- C:\Windows\System\csmApxb.exe
  C:\Windows\System\csmApxb.exe
  2⤵
  PID:12488
- C:\Windows\System\abMgNHP.exe
  C:\Windows\System\abMgNHP.exe
  2⤵
  PID:12508
- C:\Windows\System\qJHYmzI.exe
  C:\Windows\System\qJHYmzI.exe
  2⤵
  PID:12540
- C:\Windows\System\NHuZzEP.exe
  C:\Windows\System\NHuZzEP.exe
  2⤵
  PID:12568
- C:\Windows\System\PRxHqGh.exe
  C:\Windows\System\PRxHqGh.exe
  2⤵
  PID:12592
- C:\Windows\System\HeJGXfl.exe
  C:\Windows\System\HeJGXfl.exe
  2⤵
  PID:12608
- C:\Windows\System\eUWQZZb.exe
  C:\Windows\System\eUWQZZb.exe
  2⤵
  PID:12636
- C:\Windows\System\WzOGjGL.exe
  C:\Windows\System\WzOGjGL.exe
  2⤵
  PID:12672
- C:\Windows\System\MfbsoRB.exe
  C:\Windows\System\MfbsoRB.exe
  2⤵
  PID:12688
- C:\Windows\System\oCkCBmV.exe
  C:\Windows\System\oCkCBmV.exe
  2⤵
  PID:12708
- C:\Windows\System\tobutdD.exe
  C:\Windows\System\tobutdD.exe
  2⤵
  PID:12728
- C:\Windows\System\BcpLGHq.exe
  C:\Windows\System\BcpLGHq.exe
  2⤵
  PID:12780
- C:\Windows\System\WpZqXsz.exe
  C:\Windows\System\WpZqXsz.exe
  2⤵
  PID:12796
- C:\Windows\System\fpqpbzy.exe
  C:\Windows\System\fpqpbzy.exe
  2⤵
  PID:12864
- C:\Windows\System\cVgVEUT.exe
  C:\Windows\System\cVgVEUT.exe
  2⤵
  PID:12884
- C:\Windows\System\VRbctSN.exe
  C:\Windows\System\VRbctSN.exe
  2⤵
  PID:12904
- C:\Windows\System\fYndYzx.exe
  C:\Windows\System\fYndYzx.exe
  2⤵
  PID:12920
- C:\Windows\System\cOcAeEB.exe
  C:\Windows\System\cOcAeEB.exe
  2⤵
  PID:12948
- C:\Windows\System\rjoWPSi.exe
  C:\Windows\System\rjoWPSi.exe
  2⤵
  PID:12976
- C:\Windows\System\NxvFhnF.exe
  C:\Windows\System\NxvFhnF.exe
  2⤵
  PID:13036
- C:\Windows\System\cUKbBKM.exe
  C:\Windows\System\cUKbBKM.exe
  2⤵
  PID:13052
- C:\Windows\System\aIMBWyg.exe
  C:\Windows\System\aIMBWyg.exe
  2⤵
  PID:13072
- C:\Windows\System\qYFYoiA.exe
  C:\Windows\System\qYFYoiA.exe
  2⤵
  PID:13100
- C:\Windows\System\GiFRoBl.exe
  C:\Windows\System\GiFRoBl.exe
  2⤵
  PID:13124
- C:\Windows\System\atwsdKE.exe
  C:\Windows\System\atwsdKE.exe
  2⤵
  PID:13168
- C:\Windows\System\rvbjeUH.exe
  C:\Windows\System\rvbjeUH.exe
  2⤵
  PID:13192
- C:\Windows\System\ldzxkad.exe
  C:\Windows\System\ldzxkad.exe
  2⤵
  PID:13208
- C:\Windows\System\pObFoWk.exe
  C:\Windows\System\pObFoWk.exe
  2⤵
  PID:13228
- C:\Windows\System\tmmxcfl.exe
  C:\Windows\System\tmmxcfl.exe
  2⤵
  PID:13248
- C:\Windows\System\fOnCbQc.exe
  C:\Windows\System\fOnCbQc.exe
  2⤵
  PID:13284
- C:\Windows\System\krRcZVv.exe
  C:\Windows\System\krRcZVv.exe
  2⤵
  PID:11552
- C:\Windows\System\NTRQArM.exe
  C:\Windows\System\NTRQArM.exe
  2⤵
  PID:11864
- C:\Windows\System\UfpfWvN.exe
  C:\Windows\System\UfpfWvN.exe
  2⤵
  PID:12348
- C:\Windows\System\uuekVZB.exe
  C:\Windows\System\uuekVZB.exe
  2⤵
  PID:12380
- C:\Windows\System\NrizWma.exe
  C:\Windows\System\NrizWma.exe
  2⤵
  PID:12452
- C:\Windows\System\UAqKkwK.exe
  C:\Windows\System\UAqKkwK.exe
  2⤵
  PID:12528
- C:\Windows\System\sjYKtRE.exe
  C:\Windows\System\sjYKtRE.exe
  2⤵
  PID:12600
- C:\Windows\System\KLXmgHI.exe
  C:\Windows\System\KLXmgHI.exe
  2⤵
  PID:12664
- C:\Windows\System\muvlxXY.exe
  C:\Windows\System\muvlxXY.exe
  2⤵
  PID:12716
- C:\Windows\System\CbSHBGY.exe
  C:\Windows\System\CbSHBGY.exe
  2⤵
  PID:12824
- C:\Windows\System\nsHuHjX.exe
  C:\Windows\System\nsHuHjX.exe
  2⤵
  PID:12872
- C:\Windows\System\ncBkFsA.exe
  C:\Windows\System\ncBkFsA.exe
  2⤵
  PID:12928
- C:\Windows\System\zNHxPYO.exe
  C:\Windows\System\zNHxPYO.exe
  2⤵
  PID:12972
- C:\Windows\System\iDpcpnC.exe
  C:\Windows\System\iDpcpnC.exe
  2⤵
  PID:13068
- C:\Windows\System\EZQwdND.exe
  C:\Windows\System\EZQwdND.exe
  2⤵
  PID:13120
- C:\Windows\System\rbXVbqO.exe
  C:\Windows\System\rbXVbqO.exe
  2⤵
  PID:13220
- C:\Windows\System\oteUBjb.exe
  C:\Windows\System\oteUBjb.exe
  2⤵
  PID:13280
- C:\Windows\System\baeievQ.exe
  C:\Windows\System\baeievQ.exe
  2⤵
  PID:12376
- C:\Windows\System\PAHhOuD.exe
  C:\Windows\System\PAHhOuD.exe
  2⤵
  PID:4936
- C:\Windows\System\zOUZbXB.exe
  C:\Windows\System\zOUZbXB.exe
  2⤵
  PID:12588
- C:\Windows\System\DqOyNfW.exe
  C:\Windows\System\DqOyNfW.exe
  2⤵
  PID:12760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_onjotct0.c45.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\DkSFqsE.exe

Filesize
1.6MB

MD5
3572d29fa9ddd0e07b35dafb609bf637

SHA1
95567e40a24a62829549f84d8f39622a00f2c830

SHA256
95142de793d87ee88baf9b7794db7a601bc36b68fffbfc14f9bfafce686b5e10

SHA512
2382a68da5773bac3cd5fe1ec887050c0507fe7cfb56609ada0c5635067e742feb4093cf971bc8e7a420b39e7c2d6c95a258ce9fce499ac20a4212f3a314cf31

Download Submit
C:\Windows\System\EHfEHZO.exe

Filesize
1.6MB

MD5
764dc88058c21477453c41767e5f829e

SHA1
9f5d5b599b40b5129ce2565a71728477f3bb6bb6

SHA256
29a07f4d2ff61d53ed4a21955ee81a709011a6439cde26dae3c5a623dffa41dc

SHA512
96696653d9b93656eb86f9e009ccb757a2c715200132b779c068fcc77e19d20b83bd3ff4ecd7b6c41fdb371ba6bd58287675ce21f95021bcaf1429468cf74543

Download Submit
C:\Windows\System\EuueCZV.exe

Filesize
1.6MB

MD5
58a6b06298721d75c42464e338eef3f4

SHA1
4a6befc1d1b14f670352582aa971617ed1d57086

SHA256
781b8bbf48a7e6afbee9599573fcdb8b2bc28699623b8e274dfc9b58b2bdcbe6

SHA512
3e9c98f06c7c58b6e8f8ca2e037ac5b07926dbffdfcd3fe40f6b4b397596fbc34193abf3d7c6699531f471a5b74059e6c529647b7f219529e0389a0ffda99a57

Download Submit
C:\Windows\System\FvOdzEz.exe

Filesize
1.6MB

MD5
1570ec7e445e59ba75bb8d5bdb01c63e

SHA1
e77127427a2501bc974b19cc9fffb5b99863937d

SHA256
80253519d12b079a29d4591f880fe3ca736349896d2c563db78b0063b32d93e4

SHA512
88713c53ca31b9d8f4e6935fd72a6b2c27b36ad292a21103788d5b2a5fef1d649468bfe1531202d1d1f385a6584df4336777f017b8b21dbbf21a64c5ef0a8595

Download Submit
C:\Windows\System\IGtZenS.exe

Filesize
1.6MB

MD5
163e1ac0777953107cac066ebe2d260d

SHA1
e4051b10bc71320f2c33e66a444134f96037342c

SHA256
074e5cd53b4fa103b4f6ed91047093efcca4f2ed79ad9a2efce0ef5c533debe7

SHA512
01e86206d6239133c543f5706c794a0771ede9bca8da1ebc3548cfc555402d0ba462a00ffa6df20837008005019b7ffce4039c6f8b0592faa5d469d4f5feb2b1

Download Submit
C:\Windows\System\IraTToQ.exe

Filesize
1.6MB

MD5
ab114619577caae112b41e8d48e9c579

SHA1
dc757576af01d4ad9efe18e341107796bff3cf16

SHA256
181a280f88994b5aa792fca0b067afa7856aafcb6d0167aea8ac5a7259187cce

SHA512
e7de5d68ee3db8e13fa9d6c27f92943a666f86e8636ea898046995ed03eb574924391c1cd5aecefe5655f4c5113b49c045931cdbe4125ec7f8c3013a077f2340

Download Submit
C:\Windows\System\JDywGlN.exe

Filesize
1.6MB

MD5
083068b65f267717119d8c1e7a898367

SHA1
3da1df8ed09aa070df5c136fad09058d5a75b843

SHA256
4e5918a64d8913b22f6e61193f8f0c83b70367571189bb16e0fa6d61c98685a3

SHA512
588ac3494d2dda3a6a809a3bf3ff145f6254d49db1cff068f35309b208d45b1adbbf29264afa07ef6ad64630deb7fbaa0009111136fe95dea40cb6045893c12d

Download Submit
C:\Windows\System\MYUNIwS.exe

Filesize
1.6MB

MD5
8a04a6d67edd1c7da5ae868ebdbf2ad7

SHA1
2daa08d68c539c3129ba5b77b17dfd67cca2d500

SHA256
221811b14c81c4801e42ffb5ce2a01366d3a797054877bc54a7fd71d17de0362

SHA512
cabd9a991a7bbc9c8b711a0a15660ee4364a6e94cd2681710a3975ac0aca71db39cc914556eb7efb6ebda160a97b1b19c0109274db95e72ecff9c40b1e457e2b

Download Submit
C:\Windows\System\MZRnprq.exe

Filesize
1.6MB

MD5
fd049c0526ef3150580810468855a311

SHA1
37c52f396ac3a4b315e7e38df84984caee7a3182

SHA256
9ef9bdcb323e022a0a66b11ed048eadc3c828a88300fac37fef949e3e7d14993

SHA512
63fd440a7e68e6a85b9206b71e5ea2cc997c6b4df0650b0029d3f521f3bd390e2b9402430467ce1a956bf1aa3095ce6061e44cd202158db45f3039169bb2f5aa

Download Submit
C:\Windows\System\Pnfdylh.exe

Filesize
1.6MB

MD5
2f64964ef6d543238d61d394d1f193f8

SHA1
969bb85199b0e1d60fb992097086155c2b9823c7

SHA256
041b0a07f77eaabd558991d0e3378422ec49489f37dc83c70878a2a5ff889d60

SHA512
ec6d42f6e05426b791a9d7da2bd301fa60b131baa5139d7b8c9d8eacac274bd69266ccccbd8e2ac8219a0c7377edcc6d3ec38561a15c8e243e574dd5ef2edda4

Download Submit
C:\Windows\System\UIxtnSo.exe

Filesize
1.6MB

MD5
57884ec2507474487aa7d32cca7491da

SHA1
3a36df48ea4d33a507f4f2e46b6556b6fb62f359

SHA256
261ba8570e5eeff32fe748912b6c3a4806ff407b5264575a6ae6879fedf65e69

SHA512
21fbadd9c776605bdb45bc500e9ff22e4149808d74e1aaa5b06c777bcd58fb58e5aac0c8fbdd6ac90767b9cff12592a8445580b1aea683816f1586f58bfcd92e

Download Submit
C:\Windows\System\VddJkiP.exe

Filesize
1.6MB

MD5
a3b15467f316ae4cca0f65801b17f6c8

SHA1
3d4d58a430083d06fe28923e3f09c4317ab7fb61

SHA256
71690910dbfb80e7bf23ba9e48ae6fc1f97ebd93ef6c4290e0dca670ace67ab5

SHA512
77eaa2a3639c5bc24a872de78c03681a72107d11142106f46c963f84dbee07874d598d09176ca0ad7735499daa54e56e61b7cbd57cb1151ee4443bd81bb871e4

Download Submit
C:\Windows\System\WHEoTDh.exe

Filesize
1.6MB

MD5
4758eadcf238bbc455d7c171e4d699eb

SHA1
0b37ae9b945e7b0ca7147e5215c7e6ad24e486c9

SHA256
efcbad35548d7b1e1a574a207e461018a9a343de4afb887f8f1473e9c5bb84ac

SHA512
e72970e68aec35bee0fa0ccbad85a8f7f735ea383d5f6f7715db62b74ac23a59c392a47c473cd268a3c355e6080b119b102015a6f5e009aff0f27b1ba9d75d41

Download Submit
C:\Windows\System\bhtudrO.exe

Filesize
1.6MB

MD5
d6b544b3250234d81b3633492c11aba6

SHA1
d8be88dd2fffec48c5d1cfaec2b4522a30acdbb6

SHA256
8535625db632aaa174120e8e930b3deab9e4f85cc8d464ecfc01e03eab1a187e

SHA512
a8d224a0b9001e2d436bbfb30ba097892b49f92560998b9056a6e8179c449a88c8b6e079cac9324c7ea107cbcc66ba6f797eedff064a3b22ad78daa78277ba1c

Download Submit
C:\Windows\System\dJTsqjT.exe

Filesize
1.6MB

MD5
ba96df530543b4f2379b797387edaf70

SHA1
f77881d234bb86e423fc9303ce0ff56d6977e3c7

SHA256
b1644b6498555cf4f893a24e0e8a83549b68a2898f8a9116173f27b0e14b19b6

SHA512
4636d73f48e7d1fb0280025bf659af54e9eb2833a77bf2610b8150fe49dcfa7bbf591eae888a6afd55c2eeaae76e280c4201048dca262d2966a862d3bb5ef26f

Download Submit
C:\Windows\System\fbDSZwI.exe

Filesize
1.6MB

MD5
e38dcb135b827abfb7c5065975d69e4f

SHA1
ab0bfad8469512acc59f63a69fa8f4788df9db81

SHA256
cf25d853fe96feefdf9b8fa74baa6f031351534e4315f33e475ea0481e5e6ff3

SHA512
664e650ca67593a3afef65e7faaf36f282f4a29482969dec678298c21ddaeaa2a67a4e391c4f37620fca5ad3a363041e8ca7ea3d94953b1e0092f627f77e37ee

Download Submit
C:\Windows\System\gBiPVpu.exe

Filesize
1.6MB

MD5
f65a7dd3a80e2cbabfb9c586fa8823b1

SHA1
c6de3a6eac9351487d48ba689a3a6b3467a0e01a

SHA256
06285c3a1c9eef3519e784386702a56df9bc94875d57cf9d9d54f07bf260e4db

SHA512
8ec3d9471c97f092373762ade3278af6100dee44824a8282c174b6ebf18dd22bf73dc47be49ed4929ba704dd95a132519297f1fe93761c69b996dff8fa68831c

Download Submit
C:\Windows\System\gEMFEgk.exe

Filesize
1.6MB

MD5
2ad11b72d4cfc4001f7e8c74058e3cd9

SHA1
c1d5db401c3de9666aec073551c5651a82b95d4a

SHA256
ac18f5fda7919e08289ef3e282eb211b54b2cada98c90289bd1cecb81f8b56b2

SHA512
ff97b658bccf31f8b96bbd4d03e98fcd67aedc3eb43f5e5c68437c1a12c1610e336cc5049d76703f2d4cafce538fbf65a2c6e403a4c84b7b60b3e4869b768409

Download Submit
C:\Windows\System\gLQIqHc.exe

Filesize
1.6MB

MD5
5882827dbd49dcf5e6d776436832ee26

SHA1
8a1aba33f4b951cafe140194a8c57cf5f11d5715

SHA256
e9c3535d16e93883b9bc3841445647c35a749f35970cf2a9c2361a3b8b3f4204

SHA512
69a964b8e31f01b6bcff33cdbb325ce7e6ebfc8ae86a5f3b66d1008fe528cb2ad187153ebaba963039df196cdd3bda5920556ebc6d5d50ba3141937497252c31

Download Submit
C:\Windows\System\gqBCvRX.exe

Filesize
1.6MB

MD5
54ed1d7297124ba5b21e2cb0d56bd483

SHA1
50b49c920d3ef5907d7bea914fd627ad97bad7d9

SHA256
ad5401ab214c83c277cd35257663e7d4375363676f97d64c290d4478e776846f

SHA512
b4f9833eb07f6774c9c28a0b9a23295bb8ab3d7efdcd30d596e3b73bb7bc18069a21b4bf704a50c01f4eb5d7edf35a8fcdcd1b934f4f633353d58f3ff44ad157

Download Submit
C:\Windows\System\iSmsQUq.exe

Filesize
1.6MB

MD5
f00d6d9865f596590a9bd5be0908b1d4

SHA1
3b290d1832d69632a8d3911f9ba2e54daffb0c6d

SHA256
acf6a9d2de8e9a9bb86fd5152961965990daae0478d3c21e174bab382de3de6c

SHA512
9d65c7cef707ec64229d993227830bcd14ed591043a20f305d12c15c06037c732f46bf84064b6fa7f64e157316b66e4829fad3d1c0b05c06d4f4cc744f209e51

Download Submit
C:\Windows\System\jiPuTXN.exe

Filesize
1.6MB

MD5
2f3ab5db149be64e1e346ef4261c2b42

SHA1
0511dcf14928b8a1a095fe0c36c31e2d06173ca1

SHA256
7a693c5fb151ed2951de0e9620e44a5e512c3cb02770a30781d8c8b02687a71b

SHA512
aa253335ed994b8c53f5d7934d038e604ec03997b70143159be5e85136e0aec85f997644a7783b74797c8e29519967efc0eec0b90f4a5e8694eb8f75861ec9a7

Download Submit
C:\Windows\System\mkEUGIn.exe

Filesize
1.6MB

MD5
a3cd80b7201eabe46d8a1459a2d82f01

SHA1
d3a2e2c27ff30e1523853800aa187def8cd2b240

SHA256
6f75b16bfb4e0a7453d2adfa51223ad3e3ea2a56b596439cd5b24e6194f6a7a4

SHA512
d96b4b26f49ecda6734dee31b74f935b934c24592ce428758d58dab1538471bc52ab5eca65cb8d6aa01ecb9f3fe57f994f8b5d0040797c9d41844bb2c2efee6e

Download Submit
C:\Windows\System\neDzgXd.exe

Filesize
1.6MB

MD5
4ddbd0ec9daca6274be6d021f3d5a02e

SHA1
9baade5e4ce03daf8adc002c36c9692cfe6e2c0d

SHA256
646ae45dc55d44a124780f70e92cc3e72aca1ffd36ece9499a5e8338990a24d4

SHA512
77789f3aa0ebfdf2686e0d88cc33c8367c1a07951994a47fb1fd2da6dec77731462c1b69acbda3a021109ab364433b21e967fbe82534ebfaa86d9c709db45e1a

Download Submit
C:\Windows\System\qocKrOy.exe

Filesize
1.6MB

MD5
97d57bad08cfbb1575c0d4182c02938b

SHA1
acb19a3e4b3ce776198e63fb9de3f2e08baff3a3

SHA256
ab7960d7fc0309d5eef51698a842cfd371a1ce81de331db5346d5342e2a19f2b

SHA512
d3f59ca0bacb1f56edb13ad41ad12222dd84c26ec826b078c47aa577008f54d0be46d6f8c48f10c1122bb3bc5d550e84bfa8ba723b18b5f99eb1f99ca02ae060

Download Submit
C:\Windows\System\uJJEXfo.exe

Filesize
1.6MB

MD5
949d10acf660d5d9328b2bac59e4831b

SHA1
93ff8b9939c8fdb56128ac3d1a8d81c5b1599df2

SHA256
5230da73b63b370abd2722b63194e3f3dd665cc5099f61982e83e5e7a902381f

SHA512
5d7851e2fd27f65166d074fb109c32748ec498cc55e555f55a708c3545a6de4fb736f9db4947bb66d314684943da6bd8ef9c57929b6b5f721508bda9cc25cc53

Download Submit
C:\Windows\System\ubTWZtS.exe

Filesize
1.6MB

MD5
e0f7e54533c76265ac66b0cc243f3f1d

SHA1
42d25eed3ea7f0a62e5137b92ecd9b04dd7a2e36

SHA256
5c9f2893a219a8821530ba27fcceb407e8a2c3a25720c797f30244109ff24b45

SHA512
f33cea530fd026676234bb0aec5df27d2d5fb2b1e3634aad722edcd8ae3bde7528d811b606fee020effde8d9d4d245b4a7d11959c6f14dd7eb0555fca9e17233

Download Submit
C:\Windows\System\uwLOvgs.exe

Filesize
1.6MB

MD5
8f12404efd16f218df975645fdd3485f

SHA1
3c628076b22fa749eb8c8907c3a7cae0767524dc

SHA256
26d984d4af7c84366b61045956d56f25a49ed499113f6ad578688c933f8bc8fe

SHA512
b814e18c30e50e540e9561c0d97288180d9b3955035306c909bd4c97032dd3b030209eb005739aacffaa8fcd474288d573b5714a2fe0e03704b0c74da267d37d

Download Submit
C:\Windows\System\uxrWeTK.exe

Filesize
1.6MB

MD5
52416183030d85ff2705daafd4e005d2

SHA1
cdbb2f6a1092fb9e64195077cc3ea1ba1f8fafa5

SHA256
dd2cc6ffba9b70043ae562f344e537afba56706ddfccca70395ff85041ffbc1b

SHA512
fb7821849d4c1607afd137e5e6da7edade7ed9c131adea5718f55dc9868f402171c46e7bf6f20e8f6053f2587470edd4f36f3f2e136d1e22eb56006e252b72b2

Download Submit
C:\Windows\System\vLQPbKj.exe

Filesize
1.6MB

MD5
3e8775798869e66acc0e3329ba54eed8

SHA1
d5c7844feb52da834d92b3b979a0a3f17adc931f

SHA256
fb8f8eb193d796f788c016419f01f4861dcfdc4e9945e51a1768cc11d74a7b82

SHA512
32d3f9af51787e7dde5d9585ed56c851431df2aa44341a0f3a612bc98f035378efd6beb48e9b1539278768ed0d891f10a7b4fd2279713d5fe3d63f21ebdca560

Download Submit
C:\Windows\System\wLUIysC.exe

Filesize
1.6MB

MD5
b2756f3c9c502f4835474f8d12c06ba5

SHA1
11808a9114054fde08681e83fd78de9327cda55e

SHA256
320b9b48df460bc17cf447b88cd5a7d8d6f1b73fb100ca6f330ea9a40f14cd9c

SHA512
13ef09e976c1cdae5b93085274b0898ef6c3690e3ef057ef0519bdbc6902c73aa1cb73f49e0c71c1fedb334094f3412c3530093d45bc8880b28e28a929112605

Download Submit
C:\Windows\System\wXhqnUd.exe

Filesize
1.6MB

MD5
7e03c6bcb178cbca2347652d8025713a

SHA1
7f816038712a1c7dd4eafc5377e32ea8d99bb89b

SHA256
657b76ca280e3e51049e3fbfee0479b3f7bbcf200b80000f8b62c04ada26d81e

SHA512
5242b866476695bbdcda64c3a06b07ef76f7c80944d5a467716ab20300ea9110db4a8cbed8038a7fe80a66f4ff1937e4fa6e1198e187b84365602f026bc1c3f4

Download Submit
C:\Windows\System\wjagfJZ.exe

Filesize
1.6MB

MD5
d7971fbdf147bf3acf3ffb7dab96e323

SHA1
a07cb70126931e8fbf157943ff73ee2320bedaa6

SHA256
c72b99d05b381746128756fad1717c74b08e8aae9b45d1996115877e36f65909

SHA512
7bad2bbeeab386e83dfda5b8b3e53abfbf225cdcbeadc96038f85d8afd0355bcbe0694e5404b53936d718dd19ef0c92bdf41d66d6923cdf281f4f8c36d607440

Download Submit
C:\Windows\System\yXpmbcg.exe

Filesize
8B

MD5
cf50e241303d497858ee01855fb582c8

SHA1
071c6ca1d65e04749f98c6a703cbc804ec84ade3

SHA256
501a1602089109b7d1620eb45678928ef48594bd3e9d379e4d9cd5c0f3bdf610

SHA512
9acf492462174dc95aadbf576467af6a3992f55fe198a880427aa6ca9bf21c04fc7a421b1986a9d47e9b0a48e3c4b3d86850c8700c25e99a738c34f1ba7766bb

Download Submit
memory/404-140-0x00007FF7BF1D0000-0x00007FF7BF5C2000-memory.dmp

Filesize
3.9MB

Download
memory/404-3492-0x00007FF7BF1D0000-0x00007FF7BF5C2000-memory.dmp

Filesize
3.9MB

Download
memory/404-3435-0x00007FF7BF1D0000-0x00007FF7BF5C2000-memory.dmp

Filesize
3.9MB

Download
memory/516-101-0x00007FF752D90000-0x00007FF753182000-memory.dmp

Filesize
3.9MB

Download
memory/516-3497-0x00007FF752D90000-0x00007FF753182000-memory.dmp

Filesize
3.9MB

Download
memory/532-152-0x00007FF6C78C0000-0x00007FF6C7CB2000-memory.dmp

Filesize
3.9MB

Download
memory/532-3507-0x00007FF6C78C0000-0x00007FF6C7CB2000-memory.dmp

Filesize
3.9MB

Download
memory/912-3434-0x00007FF6F2940000-0x00007FF6F2D32000-memory.dmp

Filesize
3.9MB

Download
memory/912-134-0x00007FF6F2940000-0x00007FF6F2D32000-memory.dmp

Filesize
3.9MB

Download
memory/912-3489-0x00007FF6F2940000-0x00007FF6F2D32000-memory.dmp

Filesize
3.9MB

Download
memory/1264-68-0x00007FF72F0D0000-0x00007FF72F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1264-3472-0x00007FF72F0D0000-0x00007FF72F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/1448-3466-0x00007FF6D7E60000-0x00007FF6D8252000-memory.dmp

Filesize
3.9MB

Download
memory/1448-41-0x00007FF6D7E60000-0x00007FF6D8252000-memory.dmp

Filesize
3.9MB

Download
memory/1580-3488-0x00007FF7B0C00000-0x00007FF7B0FF2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-3433-0x00007FF7B0C00000-0x00007FF7B0FF2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-127-0x00007FF7B0C00000-0x00007FF7B0FF2000-memory.dmp

Filesize
3.9MB

Download
memory/1600-73-0x00007FF7C59A0000-0x00007FF7C5D92000-memory.dmp

Filesize
3.9MB

Download
memory/1600-3482-0x00007FF7C59A0000-0x00007FF7C5D92000-memory.dmp

Filesize
3.9MB

Download
memory/2988-3502-0x00007FF7BB760000-0x00007FF7BBB52000-memory.dmp

Filesize
3.9MB

Download
memory/2988-107-0x00007FF7BB760000-0x00007FF7BBB52000-memory.dmp

Filesize
3.9MB

Download
memory/3048-3464-0x00007FF6AA580000-0x00007FF6AA972000-memory.dmp

Filesize
3.9MB

Download
memory/3048-19-0x00007FF6AA580000-0x00007FF6AA972000-memory.dmp

Filesize
3.9MB

Download
memory/3280-3479-0x00007FF6B4610000-0x00007FF6B4A02000-memory.dmp

Filesize
3.9MB

Download
memory/3280-49-0x00007FF6B4610000-0x00007FF6B4A02000-memory.dmp

Filesize
3.9MB

Download
memory/3280-128-0x00007FF6B4610000-0x00007FF6B4A02000-memory.dmp

Filesize
3.9MB

Download
memory/3288-163-0x00007FF7292E0000-0x00007FF7296D2000-memory.dmp

Filesize
3.9MB

Download
memory/3288-3509-0x00007FF7292E0000-0x00007FF7296D2000-memory.dmp

Filesize
3.9MB

Download
memory/3356-1017-0x00000264DBE80000-0x00000264DC626000-memory.dmp

Filesize
7.6MB

Download
memory/3356-692-0x00000264C23B0000-0x00000264C23D2000-memory.dmp

Filesize
136KB

Download
memory/3496-3463-0x00007FF79D2E0000-0x00007FF79D6D2000-memory.dmp

Filesize
3.9MB

Download
memory/3496-18-0x00007FF79D2E0000-0x00007FF79D6D2000-memory.dmp

Filesize
3.9MB

Download
memory/3652-25-0x00007FF616C10000-0x00007FF617002000-memory.dmp

Filesize
3.9MB

Download
memory/3652-114-0x00007FF616C10000-0x00007FF617002000-memory.dmp

Filesize
3.9MB

Download
memory/3652-3468-0x00007FF616C10000-0x00007FF617002000-memory.dmp

Filesize
3.9MB

Download
memory/3692-3476-0x00007FF6A6390000-0x00007FF6A6782000-memory.dmp

Filesize
3.9MB

Download
memory/3692-71-0x00007FF6A6390000-0x00007FF6A6782000-memory.dmp

Filesize
3.9MB

Download
memory/3708-3493-0x00007FF601DF0000-0x00007FF6021E2000-memory.dmp

Filesize
3.9MB

Download
memory/3708-115-0x00007FF601DF0000-0x00007FF6021E2000-memory.dmp

Filesize
3.9MB

Download
memory/3708-3431-0x00007FF601DF0000-0x00007FF6021E2000-memory.dmp

Filesize
3.9MB

Download
memory/4100-3505-0x00007FF7757F0000-0x00007FF775BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4100-84-0x00007FF7757F0000-0x00007FF775BE2000-memory.dmp

Filesize
3.9MB

Download
memory/4124-76-0x00007FF67F930000-0x00007FF67FD22000-memory.dmp

Filesize
3.9MB

Download
memory/4124-3481-0x00007FF67F930000-0x00007FF67FD22000-memory.dmp

Filesize
3.9MB

Download
memory/4644-0-0x00007FF74C160000-0x00007FF74C552000-memory.dmp

Filesize
3.9MB

Download
memory/4644-1-0x000001CD67790000-0x000001CD677A0000-memory.dmp

Filesize
64KB

Download
memory/4644-113-0x00007FF74C160000-0x00007FF74C552000-memory.dmp

Filesize
3.9MB

Download
memory/4656-95-0x00007FF700D00000-0x00007FF7010F2000-memory.dmp

Filesize
3.9MB

Download
memory/4656-3496-0x00007FF700D00000-0x00007FF7010F2000-memory.dmp

Filesize
3.9MB

Download
memory/4676-121-0x00007FF7601E0000-0x00007FF7605D2000-memory.dmp

Filesize
3.9MB

Download
memory/4676-47-0x00007FF7601E0000-0x00007FF7605D2000-memory.dmp

Filesize
3.9MB

Download
memory/4676-3475-0x00007FF7601E0000-0x00007FF7605D2000-memory.dmp

Filesize
3.9MB

Download
memory/4764-3470-0x00007FF7A6FD0000-0x00007FF7A73C2000-memory.dmp

Filesize
3.9MB

Download
memory/4764-66-0x00007FF7A6FD0000-0x00007FF7A73C2000-memory.dmp

Filesize
3.9MB

Download
memory/4932-72-0x00007FF62DCD0000-0x00007FF62E0C2000-memory.dmp

Filesize
3.9MB

Download
memory/4932-3484-0x00007FF62DCD0000-0x00007FF62E0C2000-memory.dmp

Filesize
3.9MB

Download
memory/5028-3499-0x00007FF675CD0000-0x00007FF6760C2000-memory.dmp

Filesize
3.9MB

Download
memory/5028-80-0x00007FF675CD0000-0x00007FF6760C2000-memory.dmp

Filesize
3.9MB

Download
memory/5052-3500-0x00007FF75EE10000-0x00007FF75F202000-memory.dmp

Filesize
3.9MB

Download
memory/5052-3436-0x00007FF75EE10000-0x00007FF75F202000-memory.dmp

Filesize
3.9MB

Download
memory/5052-146-0x00007FF75EE10000-0x00007FF75F202000-memory.dmp

Filesize
3.9MB

Download