xmrig | 0a7ae17b64a18f51fa9c5fbb90ada86caddd257f0322bfcb8ed014193e4beeec

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
Size

1.4MB
MD5

8317ce589ede313802da02f416202cc0
SHA1

bcc9f1779eaf7ebdf6d1edb9e388cb13a1fa94ba
SHA256

0a7ae17b64a18f51fa9c5fbb90ada86caddd257f0322bfcb8ed014193e4beeec
SHA512

4155b416003ddfeb064452afbfd0431aab786f1d2a61cf8d418e754450785fb5a55737c0a437481d7c1846e0bbf435f5a48bf6894dd55b77ddeb3f2e6bb51df7
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGR+ckMkkR:Lz071uv4BPMkHC0IlnASEx/Rkha

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/3636-518-0x00007FF7FC240000-0x00007FF7FC632000-memory.dmp	xmrig
behavioral2/memory/628-594-0x00007FF635FE0000-0x00007FF6363D2000-memory.dmp	xmrig
behavioral2/memory/2800-589-0x00007FF7FB8F0000-0x00007FF7FBCE2000-memory.dmp	xmrig
behavioral2/memory/4868-1132-0x00007FF65AC10000-0x00007FF65B002000-memory.dmp	xmrig
behavioral2/memory/680-1282-0x00007FF640050000-0x00007FF640442000-memory.dmp	xmrig
behavioral2/memory/2292-1336-0x00007FF61AD90000-0x00007FF61B182000-memory.dmp	xmrig
behavioral2/memory/2024-1665-0x00007FF7D8A40000-0x00007FF7D8E32000-memory.dmp	xmrig
behavioral2/memory/3436-1667-0x00007FF6EA490000-0x00007FF6EA882000-memory.dmp	xmrig
behavioral2/memory/4896-1574-0x00007FF758940000-0x00007FF758D32000-memory.dmp	xmrig
behavioral2/memory/1628-1337-0x00007FF6F1BF0000-0x00007FF6F1FE2000-memory.dmp	xmrig
behavioral2/memory/4440-1288-0x00007FF6891E0000-0x00007FF6895D2000-memory.dmp	xmrig
behavioral2/memory/1180-1281-0x00007FF7A4120000-0x00007FF7A4512000-memory.dmp	xmrig
behavioral2/memory/1680-1127-0x00007FF77A760000-0x00007FF77AB52000-memory.dmp	xmrig
behavioral2/memory/4528-987-0x00007FF7FA650000-0x00007FF7FAA42000-memory.dmp	xmrig
behavioral2/memory/2972-982-0x00007FF612B60000-0x00007FF612F52000-memory.dmp	xmrig
behavioral2/memory/448-608-0x00007FF752750000-0x00007FF752B42000-memory.dmp	xmrig
behavioral2/memory/2012-503-0x00007FF7379E0000-0x00007FF737DD2000-memory.dmp	xmrig
behavioral2/memory/4232-426-0x00007FF6A1910000-0x00007FF6A1D02000-memory.dmp	xmrig
behavioral2/memory/4040-335-0x00007FF68FC40000-0x00007FF690032000-memory.dmp	xmrig
behavioral2/memory/4572-274-0x00007FF675030000-0x00007FF675422000-memory.dmp	xmrig
behavioral2/memory/3068-256-0x00007FF7F15F0000-0x00007FF7F19E2000-memory.dmp	xmrig
behavioral2/memory/2992-2396-0x00007FF7A7790000-0x00007FF7A7B82000-memory.dmp	xmrig
behavioral2/memory/2860-2397-0x00007FF6B0340000-0x00007FF6B0732000-memory.dmp	xmrig
behavioral2/memory/2516-2398-0x00007FF7E0590000-0x00007FF7E0982000-memory.dmp	xmrig
behavioral2/memory/2860-2432-0x00007FF6B0340000-0x00007FF6B0732000-memory.dmp	xmrig
behavioral2/memory/2992-2434-0x00007FF7A7790000-0x00007FF7A7B82000-memory.dmp	xmrig
behavioral2/memory/2516-2436-0x00007FF7E0590000-0x00007FF7E0982000-memory.dmp	xmrig
behavioral2/memory/448-2439-0x00007FF752750000-0x00007FF752B42000-memory.dmp	xmrig
behavioral2/memory/2972-2440-0x00007FF612B60000-0x00007FF612F52000-memory.dmp	xmrig
behavioral2/memory/2024-2442-0x00007FF7D8A40000-0x00007FF7D8E32000-memory.dmp	xmrig
behavioral2/memory/4040-2456-0x00007FF68FC40000-0x00007FF690032000-memory.dmp	xmrig
behavioral2/memory/680-2462-0x00007FF640050000-0x00007FF640442000-memory.dmp	xmrig
behavioral2/memory/3436-2468-0x00007FF6EA490000-0x00007FF6EA882000-memory.dmp	xmrig
behavioral2/memory/1680-2472-0x00007FF77A760000-0x00007FF77AB52000-memory.dmp	xmrig
behavioral2/memory/1628-2477-0x00007FF6F1BF0000-0x00007FF6F1FE2000-memory.dmp	xmrig
behavioral2/memory/2800-2470-0x00007FF7FB8F0000-0x00007FF7FBCE2000-memory.dmp	xmrig
behavioral2/memory/3068-2466-0x00007FF7F15F0000-0x00007FF7F19E2000-memory.dmp	xmrig
behavioral2/memory/4528-2464-0x00007FF7FA650000-0x00007FF7FAA42000-memory.dmp	xmrig
behavioral2/memory/2292-2460-0x00007FF61AD90000-0x00007FF61B182000-memory.dmp	xmrig
behavioral2/memory/4232-2455-0x00007FF6A1910000-0x00007FF6A1D02000-memory.dmp	xmrig
behavioral2/memory/4572-2451-0x00007FF675030000-0x00007FF675422000-memory.dmp	xmrig
behavioral2/memory/3636-2458-0x00007FF7FC240000-0x00007FF7FC632000-memory.dmp	xmrig
behavioral2/memory/628-2446-0x00007FF635FE0000-0x00007FF6363D2000-memory.dmp	xmrig
behavioral2/memory/4440-2445-0x00007FF6891E0000-0x00007FF6895D2000-memory.dmp	xmrig
behavioral2/memory/4896-2453-0x00007FF758940000-0x00007FF758D32000-memory.dmp	xmrig
behavioral2/memory/4868-2449-0x00007FF65AC10000-0x00007FF65B002000-memory.dmp	xmrig
behavioral2/memory/1180-2501-0x00007FF7A4120000-0x00007FF7A4512000-memory.dmp	xmrig
behavioral2/memory/2012-2490-0x00007FF7379E0000-0x00007FF737DD2000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
836	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2992	rbCgtGg.exe
2860	gSRefbr.exe
2516	zqkHgqE.exe
3068	JlanPxG.exe
4896	oyfanmI.exe
4572	mtsaqKv.exe
4040	pzqcIQD.exe
4232	uVFWBBq.exe
2012	KkAoyRm.exe
3636	FGNgZNA.exe
2800	OQjDmwv.exe
628	aBTBCyn.exe
448	OlOUayD.exe
2972	AZhkFjP.exe
2024	YtCaCzy.exe
4528	dZUEhME.exe
1680	AFPsJnd.exe
4868	XcSSzUO.exe
1180	JrIZAiw.exe
680	AXogVXn.exe
4440	KNtqgYO.exe
2292	zfQcCoR.exe
1628	kLOPPNg.exe
3436	RvSjWgD.exe
1504	smLCAiW.exe
3108	dNQpEMl.exe
1760	qaQHOFp.exe
3788	vPowCia.exe
4744	vWUrTXo.exe
776	fOFYnDQ.exe
4600	LVwTeqU.exe
4864	KodUjwg.exe
2368	hofPrfD.exe
3024	SBjMrAd.exe
1744	YqEfsnx.exe
4928	kNzLJpd.exe
1384	iIajNGP.exe
1556	abWJoiC.exe
1956	PehunHP.exe
2136	sxgvmts.exe
4636	NiVMjDh.exe
1724	JJwWMzs.exe
2324	RIsFeuo.exe
548	ZBhkhuL.exe
3848	ZnWeUED.exe
4180	RkSwaWQ.exe
1244	IDteBeZ.exe
4604	DIGNmze.exe
2584	gXqbNhY.exe
2232	ZlYgvxr.exe
2528	nOVEUPB.exe
2228	oTjHlmL.exe
4028	xQxZgbR.exe
2504	YDJxFCd.exe
116	yCGtNnE.exe
4424	eItsteK.exe
4268	ZGsGyth.exe
4644	FDqdEAn.exe
3104	BrwzlJN.exe
4328	mAfRRrX.exe
1388	EDFiTIO.exe
3012	ixEYbkI.exe
2020	dBakCkX.exe
2636	FwzIGOe.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3136-0-0x00007FF7933F0000-0x00007FF7937E2000-memory.dmp	upx
behavioral2/files/0x00070000000233fe-6.dat	upx
behavioral2/memory/2992-26-0x00007FF7A7790000-0x00007FF7A7B82000-memory.dmp	upx
behavioral2/files/0x00070000000233ff-18.dat	upx
behavioral2/files/0x0007000000023411-95.dat	upx
behavioral2/files/0x0007000000023414-149.dat	upx
behavioral2/files/0x0007000000023426-188.dat	upx
behavioral2/memory/3636-518-0x00007FF7FC240000-0x00007FF7FC632000-memory.dmp	upx
behavioral2/memory/628-594-0x00007FF635FE0000-0x00007FF6363D2000-memory.dmp	upx
behavioral2/memory/2800-589-0x00007FF7FB8F0000-0x00007FF7FBCE2000-memory.dmp	upx
behavioral2/memory/4868-1132-0x00007FF65AC10000-0x00007FF65B002000-memory.dmp	upx
behavioral2/memory/680-1282-0x00007FF640050000-0x00007FF640442000-memory.dmp	upx
behavioral2/memory/2292-1336-0x00007FF61AD90000-0x00007FF61B182000-memory.dmp	upx
behavioral2/memory/2024-1665-0x00007FF7D8A40000-0x00007FF7D8E32000-memory.dmp	upx
behavioral2/memory/3436-1667-0x00007FF6EA490000-0x00007FF6EA882000-memory.dmp	upx
behavioral2/memory/4896-1574-0x00007FF758940000-0x00007FF758D32000-memory.dmp	upx
behavioral2/memory/1628-1337-0x00007FF6F1BF0000-0x00007FF6F1FE2000-memory.dmp	upx
behavioral2/memory/4440-1288-0x00007FF6891E0000-0x00007FF6895D2000-memory.dmp	upx
behavioral2/memory/1180-1281-0x00007FF7A4120000-0x00007FF7A4512000-memory.dmp	upx
behavioral2/memory/1680-1127-0x00007FF77A760000-0x00007FF77AB52000-memory.dmp	upx
behavioral2/memory/4528-987-0x00007FF7FA650000-0x00007FF7FAA42000-memory.dmp	upx
behavioral2/memory/2972-982-0x00007FF612B60000-0x00007FF612F52000-memory.dmp	upx
behavioral2/memory/448-608-0x00007FF752750000-0x00007FF752B42000-memory.dmp	upx
behavioral2/memory/2012-503-0x00007FF7379E0000-0x00007FF737DD2000-memory.dmp	upx
behavioral2/memory/4232-426-0x00007FF6A1910000-0x00007FF6A1D02000-memory.dmp	upx
behavioral2/memory/4040-335-0x00007FF68FC40000-0x00007FF690032000-memory.dmp	upx
behavioral2/memory/4572-274-0x00007FF675030000-0x00007FF675422000-memory.dmp	upx
behavioral2/memory/3068-256-0x00007FF7F15F0000-0x00007FF7F19E2000-memory.dmp	upx
behavioral2/files/0x000700000002341a-187.dat	upx
behavioral2/files/0x0007000000023410-185.dat	upx
behavioral2/files/0x0007000000023425-184.dat	upx
behavioral2/files/0x000700000002340d-179.dat	upx
behavioral2/files/0x0007000000023407-178.dat	upx
behavioral2/files/0x0007000000023406-175.dat	upx
behavioral2/files/0x0007000000023423-173.dat	upx
behavioral2/files/0x0007000000023422-172.dat	upx
behavioral2/files/0x0007000000023421-171.dat	upx
behavioral2/files/0x0007000000023404-119.dat	upx
behavioral2/files/0x0007000000023403-117.dat	upx
behavioral2/files/0x000700000002340b-162.dat	upx
behavioral2/files/0x0007000000023415-161.dat	upx
behavioral2/files/0x000700000002341d-155.dat	upx
behavioral2/files/0x0007000000023413-148.dat	upx
behavioral2/files/0x000700000002341c-144.dat	upx
behavioral2/files/0x000700000002341b-140.dat	upx
behavioral2/files/0x0007000000023419-138.dat	upx
behavioral2/files/0x0007000000023418-135.dat	upx
behavioral2/files/0x000700000002340f-182.dat	upx
behavioral2/files/0x000700000002340e-177.dat	upx
behavioral2/files/0x0007000000023417-176.dat	upx
behavioral2/files/0x0007000000023424-174.dat	upx
behavioral2/files/0x0007000000023405-129.dat	upx
behavioral2/files/0x0007000000023416-128.dat	upx
behavioral2/memory/2516-123-0x00007FF7E0590000-0x00007FF7E0982000-memory.dmp	upx
behavioral2/files/0x000700000002340c-170.dat	upx
behavioral2/files/0x0007000000023402-112.dat	upx
behavioral2/files/0x000700000002341e-169.dat	upx
behavioral2/files/0x0007000000023401-106.dat	upx
behavioral2/files/0x000700000002340a-109.dat	upx
behavioral2/files/0x0007000000023412-104.dat	upx
behavioral2/memory/2860-69-0x00007FF6B0340000-0x00007FF6B0732000-memory.dmp	upx
behavioral2/files/0x0007000000023400-102.dat	upx
behavioral2/files/0x0007000000023409-65.dat	upx
behavioral2/files/0x0007000000023408-62.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PMGeAak.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\HNObTUA.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\oMvAzlf.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\yMhjscv.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\LJptGFj.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\oULbaGG.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\WhefQzU.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\RDrXQtX.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\RiEaHUF.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\lqqaZTa.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\tmlgTpq.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\JxURvxI.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\FNJwRkm.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\sHdsVpn.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\QCFKTWJ.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\FxCsMYs.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\NaqNumI.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\hzTFNYq.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\qCeCFvn.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\fDpurLx.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\yrHhyot.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\sKBjBRk.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\btsZYpA.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\Vhksbxc.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\eKwTwZT.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\hRzKSvm.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\NZYdIIA.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\XaiiHYJ.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\tciaKpu.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\tzeMUFc.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\tkahJJt.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\kJxJiqj.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\GxRSfdC.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\HvGkxRe.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\nTuIysL.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\zQQhcis.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\hvpTICK.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\daItAOh.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\fetoCys.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\jjoFyfw.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\PMFziGc.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\ZWrFItb.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\WekLrei.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\vToVDtd.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\eAYcmqY.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\OlOUayD.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\jMnSiIN.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\bOGZQOX.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\zCXpFNN.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\tnBiDjF.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\mEGOjLG.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\CKqvHfc.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\MgbQWVz.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\njfyBYK.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\SQNfRba.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\DhlyEHH.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\BaVOdtu.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\IrJIPyJ.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\UIJWbFq.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\VPxxqSF.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\fLWtrmN.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\QnFzgsw.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\kDVNmgH.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
File created	C:\Windows\System\RvLzavC.exe	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
836	powershell.exe
836	powershell.exe
836	powershell.exe
836	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	836	powershell.exe
Token: SeLockMemoryPrivilege	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 836	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	87
PID 3136 wrote to memory of 836	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	87
PID 3136 wrote to memory of 2992	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	88
PID 3136 wrote to memory of 2992	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	88
PID 3136 wrote to memory of 2860	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	89
PID 3136 wrote to memory of 2860	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	89
PID 3136 wrote to memory of 2516	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	90
PID 3136 wrote to memory of 2516	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	90
PID 3136 wrote to memory of 3068	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	91
PID 3136 wrote to memory of 3068	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	91
PID 3136 wrote to memory of 4896	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	92
PID 3136 wrote to memory of 4896	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	92
PID 3136 wrote to memory of 4572	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	93
PID 3136 wrote to memory of 4572	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	93
PID 3136 wrote to memory of 4040	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	94
PID 3136 wrote to memory of 4040	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	94
PID 3136 wrote to memory of 4232	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	95
PID 3136 wrote to memory of 4232	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	95
PID 3136 wrote to memory of 2012	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	96
PID 3136 wrote to memory of 2012	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	96
PID 3136 wrote to memory of 3636	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	97
PID 3136 wrote to memory of 3636	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	97
PID 3136 wrote to memory of 2800	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	98
PID 3136 wrote to memory of 2800	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	98
PID 3136 wrote to memory of 628	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	99
PID 3136 wrote to memory of 628	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	99
PID 3136 wrote to memory of 448	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	100
PID 3136 wrote to memory of 448	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	100
PID 3136 wrote to memory of 2972	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	101
PID 3136 wrote to memory of 2972	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	101
PID 3136 wrote to memory of 2024	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	102
PID 3136 wrote to memory of 2024	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	102
PID 3136 wrote to memory of 4528	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	103
PID 3136 wrote to memory of 4528	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	103
PID 3136 wrote to memory of 1680	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	104
PID 3136 wrote to memory of 1680	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	104
PID 3136 wrote to memory of 4868	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	105
PID 3136 wrote to memory of 4868	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	105
PID 3136 wrote to memory of 1180	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	106
PID 3136 wrote to memory of 1180	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	106
PID 3136 wrote to memory of 680	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	107
PID 3136 wrote to memory of 680	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	107
PID 3136 wrote to memory of 4440	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	108
PID 3136 wrote to memory of 4440	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	108
PID 3136 wrote to memory of 2292	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	109
PID 3136 wrote to memory of 2292	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	109
PID 3136 wrote to memory of 1628	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	110
PID 3136 wrote to memory of 1628	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	110
PID 3136 wrote to memory of 776	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	111
PID 3136 wrote to memory of 776	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	111
PID 3136 wrote to memory of 4600	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	112
PID 3136 wrote to memory of 4600	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	112
PID 3136 wrote to memory of 2368	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	113
PID 3136 wrote to memory of 2368	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	113
PID 3136 wrote to memory of 3436	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	114
PID 3136 wrote to memory of 3436	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	114
PID 3136 wrote to memory of 1504	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	115
PID 3136 wrote to memory of 1504	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	115
PID 3136 wrote to memory of 3108	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	116
PID 3136 wrote to memory of 3108	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	116
PID 3136 wrote to memory of 1760	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	117
PID 3136 wrote to memory of 1760	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	117
PID 3136 wrote to memory of 2136	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	118
PID 3136 wrote to memory of 2136	3136	8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe	118

C:\Users\Admin\AppData\Local\Temp\8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8317ce589ede313802da02f416202cc0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:836
- C:\Windows\System\rbCgtGg.exe
  C:\Windows\System\rbCgtGg.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\gSRefbr.exe
  C:\Windows\System\gSRefbr.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\zqkHgqE.exe
  C:\Windows\System\zqkHgqE.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\JlanPxG.exe
  C:\Windows\System\JlanPxG.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\oyfanmI.exe
  C:\Windows\System\oyfanmI.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\mtsaqKv.exe
  C:\Windows\System\mtsaqKv.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\pzqcIQD.exe
  C:\Windows\System\pzqcIQD.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\uVFWBBq.exe
  C:\Windows\System\uVFWBBq.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\KkAoyRm.exe
  C:\Windows\System\KkAoyRm.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\FGNgZNA.exe
  C:\Windows\System\FGNgZNA.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\OQjDmwv.exe
  C:\Windows\System\OQjDmwv.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\aBTBCyn.exe
  C:\Windows\System\aBTBCyn.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\OlOUayD.exe
  C:\Windows\System\OlOUayD.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\AZhkFjP.exe
  C:\Windows\System\AZhkFjP.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\YtCaCzy.exe
  C:\Windows\System\YtCaCzy.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\dZUEhME.exe
  C:\Windows\System\dZUEhME.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\AFPsJnd.exe
  C:\Windows\System\AFPsJnd.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\XcSSzUO.exe
  C:\Windows\System\XcSSzUO.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\JrIZAiw.exe
  C:\Windows\System\JrIZAiw.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\AXogVXn.exe
  C:\Windows\System\AXogVXn.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\KNtqgYO.exe
  C:\Windows\System\KNtqgYO.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\zfQcCoR.exe
  C:\Windows\System\zfQcCoR.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\kLOPPNg.exe
  C:\Windows\System\kLOPPNg.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\fOFYnDQ.exe
  C:\Windows\System\fOFYnDQ.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\LVwTeqU.exe
  C:\Windows\System\LVwTeqU.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\hofPrfD.exe
  C:\Windows\System\hofPrfD.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\RvSjWgD.exe
  C:\Windows\System\RvSjWgD.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\smLCAiW.exe
  C:\Windows\System\smLCAiW.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\dNQpEMl.exe
  C:\Windows\System\dNQpEMl.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\qaQHOFp.exe
  C:\Windows\System\qaQHOFp.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\sxgvmts.exe
  C:\Windows\System\sxgvmts.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\vPowCia.exe
  C:\Windows\System\vPowCia.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\vWUrTXo.exe
  C:\Windows\System\vWUrTXo.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\KodUjwg.exe
  C:\Windows\System\KodUjwg.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\SBjMrAd.exe
  C:\Windows\System\SBjMrAd.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\IDteBeZ.exe
  C:\Windows\System\IDteBeZ.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\DIGNmze.exe
  C:\Windows\System\DIGNmze.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\YqEfsnx.exe
  C:\Windows\System\YqEfsnx.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\kNzLJpd.exe
  C:\Windows\System\kNzLJpd.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\iIajNGP.exe
  C:\Windows\System\iIajNGP.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\abWJoiC.exe
  C:\Windows\System\abWJoiC.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\PehunHP.exe
  C:\Windows\System\PehunHP.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\NiVMjDh.exe
  C:\Windows\System\NiVMjDh.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\JJwWMzs.exe
  C:\Windows\System\JJwWMzs.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\gXqbNhY.exe
  C:\Windows\System\gXqbNhY.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\RIsFeuo.exe
  C:\Windows\System\RIsFeuo.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\ZBhkhuL.exe
  C:\Windows\System\ZBhkhuL.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\ZnWeUED.exe
  C:\Windows\System\ZnWeUED.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\RkSwaWQ.exe
  C:\Windows\System\RkSwaWQ.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\ZlYgvxr.exe
  C:\Windows\System\ZlYgvxr.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\AlrPnkZ.exe
  C:\Windows\System\AlrPnkZ.exe
  2⤵
  PID:1448
- C:\Windows\System\nOVEUPB.exe
  C:\Windows\System\nOVEUPB.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\oTjHlmL.exe
  C:\Windows\System\oTjHlmL.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\xQxZgbR.exe
  C:\Windows\System\xQxZgbR.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\YDJxFCd.exe
  C:\Windows\System\YDJxFCd.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\yCGtNnE.exe
  C:\Windows\System\yCGtNnE.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\eItsteK.exe
  C:\Windows\System\eItsteK.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\ZGsGyth.exe
  C:\Windows\System\ZGsGyth.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\FDqdEAn.exe
  C:\Windows\System\FDqdEAn.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\BrwzlJN.exe
  C:\Windows\System\BrwzlJN.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\mAfRRrX.exe
  C:\Windows\System\mAfRRrX.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\EDFiTIO.exe
  C:\Windows\System\EDFiTIO.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\epkKFzr.exe
  C:\Windows\System\epkKFzr.exe
  2⤵
  PID:4580
- C:\Windows\System\ixEYbkI.exe
  C:\Windows\System\ixEYbkI.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\dBakCkX.exe
  C:\Windows\System\dBakCkX.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\FwzIGOe.exe
  C:\Windows\System\FwzIGOe.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\XtQLQua.exe
  C:\Windows\System\XtQLQua.exe
  2⤵
  PID:1376
- C:\Windows\System\baLDYkN.exe
  C:\Windows\System\baLDYkN.exe
  2⤵
  PID:3876
- C:\Windows\System\FeeptXz.exe
  C:\Windows\System\FeeptXz.exe
  2⤵
  PID:2188
- C:\Windows\System\jMnSiIN.exe
  C:\Windows\System\jMnSiIN.exe
  2⤵
  PID:4064
- C:\Windows\System\cvTHyNB.exe
  C:\Windows\System\cvTHyNB.exe
  2⤵
  PID:3980
- C:\Windows\System\bNsNpNK.exe
  C:\Windows\System\bNsNpNK.exe
  2⤵
  PID:968
- C:\Windows\System\YHIAiqO.exe
  C:\Windows\System\YHIAiqO.exe
  2⤵
  PID:4224
- C:\Windows\System\iwUuQSc.exe
  C:\Windows\System\iwUuQSc.exe
  2⤵
  PID:984
- C:\Windows\System\iwcBRCL.exe
  C:\Windows\System\iwcBRCL.exe
  2⤵
  PID:3968
- C:\Windows\System\kZfGCub.exe
  C:\Windows\System\kZfGCub.exe
  2⤵
  PID:1444
- C:\Windows\System\RxJcqNz.exe
  C:\Windows\System\RxJcqNz.exe
  2⤵
  PID:5232
- C:\Windows\System\FgcbkDx.exe
  C:\Windows\System\FgcbkDx.exe
  2⤵
  PID:5256
- C:\Windows\System\acJemlw.exe
  C:\Windows\System\acJemlw.exe
  2⤵
  PID:5308
- C:\Windows\System\fQLKCxE.exe
  C:\Windows\System\fQLKCxE.exe
  2⤵
  PID:5324
- C:\Windows\System\AUDaCHH.exe
  C:\Windows\System\AUDaCHH.exe
  2⤵
  PID:5356
- C:\Windows\System\tciaKpu.exe
  C:\Windows\System\tciaKpu.exe
  2⤵
  PID:5384
- C:\Windows\System\UxiipGV.exe
  C:\Windows\System\UxiipGV.exe
  2⤵
  PID:5408
- C:\Windows\System\unrsByf.exe
  C:\Windows\System\unrsByf.exe
  2⤵
  PID:5424
- C:\Windows\System\aevnFKd.exe
  C:\Windows\System\aevnFKd.exe
  2⤵
  PID:5448
- C:\Windows\System\qrsqfER.exe
  C:\Windows\System\qrsqfER.exe
  2⤵
  PID:5468
- C:\Windows\System\jwVNvpa.exe
  C:\Windows\System\jwVNvpa.exe
  2⤵
  PID:5488
- C:\Windows\System\VPElCpZ.exe
  C:\Windows\System\VPElCpZ.exe
  2⤵
  PID:5504
- C:\Windows\System\Nuteoqc.exe
  C:\Windows\System\Nuteoqc.exe
  2⤵
  PID:5520
- C:\Windows\System\AQRtaoi.exe
  C:\Windows\System\AQRtaoi.exe
  2⤵
  PID:5544
- C:\Windows\System\GVYhtaR.exe
  C:\Windows\System\GVYhtaR.exe
  2⤵
  PID:5576
- C:\Windows\System\NkhGXtO.exe
  C:\Windows\System\NkhGXtO.exe
  2⤵
  PID:5596
- C:\Windows\System\hTScPND.exe
  C:\Windows\System\hTScPND.exe
  2⤵
  PID:5612
- C:\Windows\System\qQsRbYj.exe
  C:\Windows\System\qQsRbYj.exe
  2⤵
  PID:5636
- C:\Windows\System\JxURvxI.exe
  C:\Windows\System\JxURvxI.exe
  2⤵
  PID:5660
- C:\Windows\System\NrQsCZu.exe
  C:\Windows\System\NrQsCZu.exe
  2⤵
  PID:5680
- C:\Windows\System\MwHmjWY.exe
  C:\Windows\System\MwHmjWY.exe
  2⤵
  PID:5696
- C:\Windows\System\bUSpTBH.exe
  C:\Windows\System\bUSpTBH.exe
  2⤵
  PID:5728
- C:\Windows\System\Vhksbxc.exe
  C:\Windows\System\Vhksbxc.exe
  2⤵
  PID:5744
- C:\Windows\System\AARtCCw.exe
  C:\Windows\System\AARtCCw.exe
  2⤵
  PID:5760
- C:\Windows\System\ucgGGbU.exe
  C:\Windows\System\ucgGGbU.exe
  2⤵
  PID:5780
- C:\Windows\System\AZimcKq.exe
  C:\Windows\System\AZimcKq.exe
  2⤵
  PID:5800
- C:\Windows\System\lPWaxxC.exe
  C:\Windows\System\lPWaxxC.exe
  2⤵
  PID:5824
- C:\Windows\System\ONaKiog.exe
  C:\Windows\System\ONaKiog.exe
  2⤵
  PID:5844
- C:\Windows\System\NUuCOPl.exe
  C:\Windows\System\NUuCOPl.exe
  2⤵
  PID:5860
- C:\Windows\System\mPtlZoL.exe
  C:\Windows\System\mPtlZoL.exe
  2⤵
  PID:5896
- C:\Windows\System\iRwDcaE.exe
  C:\Windows\System\iRwDcaE.exe
  2⤵
  PID:5924
- C:\Windows\System\jDxPCaS.exe
  C:\Windows\System\jDxPCaS.exe
  2⤵
  PID:5940
- C:\Windows\System\bVabiWh.exe
  C:\Windows\System\bVabiWh.exe
  2⤵
  PID:5960
- C:\Windows\System\GSTYSOk.exe
  C:\Windows\System\GSTYSOk.exe
  2⤵
  PID:5984
- C:\Windows\System\HJDvxaB.exe
  C:\Windows\System\HJDvxaB.exe
  2⤵
  PID:6000
- C:\Windows\System\dueewFG.exe
  C:\Windows\System\dueewFG.exe
  2⤵
  PID:6016
- C:\Windows\System\rTpBrfW.exe
  C:\Windows\System\rTpBrfW.exe
  2⤵
  PID:6040
- C:\Windows\System\fWIUaQP.exe
  C:\Windows\System\fWIUaQP.exe
  2⤵
  PID:6072
- C:\Windows\System\ORpIsSY.exe
  C:\Windows\System\ORpIsSY.exe
  2⤵
  PID:6100
- C:\Windows\System\UmrjTzF.exe
  C:\Windows\System\UmrjTzF.exe
  2⤵
  PID:6120
- C:\Windows\System\irOukAe.exe
  C:\Windows\System\irOukAe.exe
  2⤵
  PID:6140
- C:\Windows\System\HMwCokC.exe
  C:\Windows\System\HMwCokC.exe
  2⤵
  PID:2600
- C:\Windows\System\kblXmVa.exe
  C:\Windows\System\kblXmVa.exe
  2⤵
  PID:3888
- C:\Windows\System\bBkaSTj.exe
  C:\Windows\System\bBkaSTj.exe
  2⤵
  PID:4152
- C:\Windows\System\gkLwhJo.exe
  C:\Windows\System\gkLwhJo.exe
  2⤵
  PID:4820
- C:\Windows\System\FugdoGn.exe
  C:\Windows\System\FugdoGn.exe
  2⤵
  PID:2196
- C:\Windows\System\AZJFBTp.exe
  C:\Windows\System\AZJFBTp.exe
  2⤵
  PID:4996
- C:\Windows\System\PzvMhfi.exe
  C:\Windows\System\PzvMhfi.exe
  2⤵
  PID:1360
- C:\Windows\System\OcGclOZ.exe
  C:\Windows\System\OcGclOZ.exe
  2⤵
  PID:2880
- C:\Windows\System\pnRlxDK.exe
  C:\Windows\System\pnRlxDK.exe
  2⤵
  PID:1564
- C:\Windows\System\xmPfBoU.exe
  C:\Windows\System\xmPfBoU.exe
  2⤵
  PID:4296
- C:\Windows\System\GkuyqSw.exe
  C:\Windows\System\GkuyqSw.exe
  2⤵
  PID:4712
- C:\Windows\System\oXXaxoO.exe
  C:\Windows\System\oXXaxoO.exe
  2⤵
  PID:4288
- C:\Windows\System\NoEhTKW.exe
  C:\Windows\System\NoEhTKW.exe
  2⤵
  PID:2852
- C:\Windows\System\LORHhSL.exe
  C:\Windows\System\LORHhSL.exe
  2⤵
  PID:3428
- C:\Windows\System\ObWIIxs.exe
  C:\Windows\System\ObWIIxs.exe
  2⤵
  PID:2304
- C:\Windows\System\FxCsMYs.exe
  C:\Windows\System\FxCsMYs.exe
  2⤵
  PID:5376
- C:\Windows\System\RzNPpFW.exe
  C:\Windows\System\RzNPpFW.exe
  2⤵
  PID:4976
- C:\Windows\System\VzvCnAf.exe
  C:\Windows\System\VzvCnAf.exe
  2⤵
  PID:3680
- C:\Windows\System\KUELjms.exe
  C:\Windows\System\KUELjms.exe
  2⤵
  PID:4088
- C:\Windows\System\obFuOCb.exe
  C:\Windows\System\obFuOCb.exe
  2⤵
  PID:2164
- C:\Windows\System\uQiDYwn.exe
  C:\Windows\System\uQiDYwn.exe
  2⤵
  PID:4404
- C:\Windows\System\lWOPIeN.exe
  C:\Windows\System\lWOPIeN.exe
  2⤵
  PID:5836
- C:\Windows\System\LJptGFj.exe
  C:\Windows\System\LJptGFj.exe
  2⤵
  PID:5272
- C:\Windows\System\UoFobdN.exe
  C:\Windows\System\UoFobdN.exe
  2⤵
  PID:5976
- C:\Windows\System\vYwQyfH.exe
  C:\Windows\System\vYwQyfH.exe
  2⤵
  PID:6156
- C:\Windows\System\GsTAJKa.exe
  C:\Windows\System\GsTAJKa.exe
  2⤵
  PID:6176
- C:\Windows\System\YJdAlfl.exe
  C:\Windows\System\YJdAlfl.exe
  2⤵
  PID:6192
- C:\Windows\System\pYRzOlZ.exe
  C:\Windows\System\pYRzOlZ.exe
  2⤵
  PID:6256
- C:\Windows\System\aSSmanD.exe
  C:\Windows\System\aSSmanD.exe
  2⤵
  PID:6272
- C:\Windows\System\emwrTWF.exe
  C:\Windows\System\emwrTWF.exe
  2⤵
  PID:6288
- C:\Windows\System\BUMVHrb.exe
  C:\Windows\System\BUMVHrb.exe
  2⤵
  PID:6308
- C:\Windows\System\KylUmkv.exe
  C:\Windows\System\KylUmkv.exe
  2⤵
  PID:6324
- C:\Windows\System\iLKiHuG.exe
  C:\Windows\System\iLKiHuG.exe
  2⤵
  PID:6348
- C:\Windows\System\LvSgebg.exe
  C:\Windows\System\LvSgebg.exe
  2⤵
  PID:6364
- C:\Windows\System\lcfezbd.exe
  C:\Windows\System\lcfezbd.exe
  2⤵
  PID:6404
- C:\Windows\System\AccXdIh.exe
  C:\Windows\System\AccXdIh.exe
  2⤵
  PID:6428
- C:\Windows\System\WjEauwU.exe
  C:\Windows\System\WjEauwU.exe
  2⤵
  PID:6448
- C:\Windows\System\fiSLxRO.exe
  C:\Windows\System\fiSLxRO.exe
  2⤵
  PID:6468
- C:\Windows\System\HDVcoCm.exe
  C:\Windows\System\HDVcoCm.exe
  2⤵
  PID:6488
- C:\Windows\System\cLhLzje.exe
  C:\Windows\System\cLhLzje.exe
  2⤵
  PID:6512
- C:\Windows\System\vhmZzSh.exe
  C:\Windows\System\vhmZzSh.exe
  2⤵
  PID:6532
- C:\Windows\System\XaiiHYJ.exe
  C:\Windows\System\XaiiHYJ.exe
  2⤵
  PID:6552
- C:\Windows\System\KVJwbct.exe
  C:\Windows\System\KVJwbct.exe
  2⤵
  PID:6584
- C:\Windows\System\tfPTyrn.exe
  C:\Windows\System\tfPTyrn.exe
  2⤵
  PID:6604
- C:\Windows\System\nqwigTt.exe
  C:\Windows\System\nqwigTt.exe
  2⤵
  PID:6624
- C:\Windows\System\gTdsooJ.exe
  C:\Windows\System\gTdsooJ.exe
  2⤵
  PID:6648
- C:\Windows\System\RaCJRJf.exe
  C:\Windows\System\RaCJRJf.exe
  2⤵
  PID:6668
- C:\Windows\System\TKtvcBA.exe
  C:\Windows\System\TKtvcBA.exe
  2⤵
  PID:6684
- C:\Windows\System\wVTWmIk.exe
  C:\Windows\System\wVTWmIk.exe
  2⤵
  PID:6700
- C:\Windows\System\KumXska.exe
  C:\Windows\System\KumXska.exe
  2⤵
  PID:6720
- C:\Windows\System\RpajkXn.exe
  C:\Windows\System\RpajkXn.exe
  2⤵
  PID:6740
- C:\Windows\System\JmRcLiP.exe
  C:\Windows\System\JmRcLiP.exe
  2⤵
  PID:6756
- C:\Windows\System\siiUHGl.exe
  C:\Windows\System\siiUHGl.exe
  2⤵
  PID:6780
- C:\Windows\System\enkzGia.exe
  C:\Windows\System\enkzGia.exe
  2⤵
  PID:6796
- C:\Windows\System\fukjYEA.exe
  C:\Windows\System\fukjYEA.exe
  2⤵
  PID:6816
- C:\Windows\System\lplPLAp.exe
  C:\Windows\System\lplPLAp.exe
  2⤵
  PID:6836
- C:\Windows\System\FEBuOJc.exe
  C:\Windows\System\FEBuOJc.exe
  2⤵
  PID:6868
- C:\Windows\System\JlAIrEL.exe
  C:\Windows\System\JlAIrEL.exe
  2⤵
  PID:6896
- C:\Windows\System\QXTNpXf.exe
  C:\Windows\System\QXTNpXf.exe
  2⤵
  PID:6924
- C:\Windows\System\XXyQrqc.exe
  C:\Windows\System\XXyQrqc.exe
  2⤵
  PID:6948
- C:\Windows\System\zlNQuxq.exe
  C:\Windows\System\zlNQuxq.exe
  2⤵
  PID:6972
- C:\Windows\System\gTzNzFk.exe
  C:\Windows\System\gTzNzFk.exe
  2⤵
  PID:6988
- C:\Windows\System\tYnLFqJ.exe
  C:\Windows\System\tYnLFqJ.exe
  2⤵
  PID:7020
- C:\Windows\System\PGOxwva.exe
  C:\Windows\System\PGOxwva.exe
  2⤵
  PID:7036
- C:\Windows\System\tpFJjXj.exe
  C:\Windows\System\tpFJjXj.exe
  2⤵
  PID:7052
- C:\Windows\System\oULbaGG.exe
  C:\Windows\System\oULbaGG.exe
  2⤵
  PID:7068
- C:\Windows\System\XfvvjET.exe
  C:\Windows\System\XfvvjET.exe
  2⤵
  PID:7092
- C:\Windows\System\IQkmMvD.exe
  C:\Windows\System\IQkmMvD.exe
  2⤵
  PID:7108
- C:\Windows\System\RUdcqjk.exe
  C:\Windows\System\RUdcqjk.exe
  2⤵
  PID:7124
- C:\Windows\System\qBRksyA.exe
  C:\Windows\System\qBRksyA.exe
  2⤵
  PID:7144
- C:\Windows\System\CYTLUrs.exe
  C:\Windows\System\CYTLUrs.exe
  2⤵
  PID:7160
- C:\Windows\System\degaOSK.exe
  C:\Windows\System\degaOSK.exe
  2⤵
  PID:1352
- C:\Windows\System\GnMSzEi.exe
  C:\Windows\System\GnMSzEi.exe
  2⤵
  PID:1852
- C:\Windows\System\GfAqUwc.exe
  C:\Windows\System\GfAqUwc.exe
  2⤵
  PID:5240
- C:\Windows\System\syVDFeV.exe
  C:\Windows\System\syVDFeV.exe
  2⤵
  PID:4760
- C:\Windows\System\zOfpnvO.exe
  C:\Windows\System\zOfpnvO.exe
  2⤵
  PID:5284
- C:\Windows\System\YUqhgqo.exe
  C:\Windows\System\YUqhgqo.exe
  2⤵
  PID:5316
- C:\Windows\System\tySDmLB.exe
  C:\Windows\System\tySDmLB.exe
  2⤵
  PID:5420
- C:\Windows\System\VNTvXWc.exe
  C:\Windows\System\VNTvXWc.exe
  2⤵
  PID:5460
- C:\Windows\System\EqufVeA.exe
  C:\Windows\System\EqufVeA.exe
  2⤵
  PID:5500
- C:\Windows\System\UbQrvgU.exe
  C:\Windows\System\UbQrvgU.exe
  2⤵
  PID:1848
- C:\Windows\System\bcdIvWO.exe
  C:\Windows\System\bcdIvWO.exe
  2⤵
  PID:6268
- C:\Windows\System\FdwMaLI.exe
  C:\Windows\System\FdwMaLI.exe
  2⤵
  PID:708
- C:\Windows\System\YXdNFxT.exe
  C:\Windows\System\YXdNFxT.exe
  2⤵
  PID:1632
- C:\Windows\System\CfBchOs.exe
  C:\Windows\System\CfBchOs.exe
  2⤵
  PID:5776
- C:\Windows\System\OXrAJOO.exe
  C:\Windows\System\OXrAJOO.exe
  2⤵
  PID:5740
- C:\Windows\System\bOGZQOX.exe
  C:\Windows\System\bOGZQOX.exe
  2⤵
  PID:5704
- C:\Windows\System\aOcXtRR.exe
  C:\Windows\System\aOcXtRR.exe
  2⤵
  PID:5652
- C:\Windows\System\yQemPUN.exe
  C:\Windows\System\yQemPUN.exe
  2⤵
  PID:5620
- C:\Windows\System\bUTXrJg.exe
  C:\Windows\System\bUTXrJg.exe
  2⤵
  PID:5892
- C:\Windows\System\daItAOh.exe
  C:\Windows\System\daItAOh.exe
  2⤵
  PID:5912
- C:\Windows\System\nIJIpqU.exe
  C:\Windows\System\nIJIpqU.exe
  2⤵
  PID:5952
- C:\Windows\System\qPDRrin.exe
  C:\Windows\System\qPDRrin.exe
  2⤵
  PID:6008
- C:\Windows\System\XKivXDW.exe
  C:\Windows\System\XKivXDW.exe
  2⤵
  PID:2868
- C:\Windows\System\tFENBDr.exe
  C:\Windows\System\tFENBDr.exe
  2⤵
  PID:6080
- C:\Windows\System\BkLhprX.exe
  C:\Windows\System\BkLhprX.exe
  2⤵
  PID:6116
- C:\Windows\System\kZOjxbb.exe
  C:\Windows\System\kZOjxbb.exe
  2⤵
  PID:1664
- C:\Windows\System\suxlQXz.exe
  C:\Windows\System\suxlQXz.exe
  2⤵
  PID:4812
- C:\Windows\System\lqqaZTa.exe
  C:\Windows\System\lqqaZTa.exe
  2⤵
  PID:4300
- C:\Windows\System\ITuiddC.exe
  C:\Windows\System\ITuiddC.exe
  2⤵
  PID:3448
- C:\Windows\System\rpTnEef.exe
  C:\Windows\System\rpTnEef.exe
  2⤵
  PID:4860
- C:\Windows\System\mmPISUh.exe
  C:\Windows\System\mmPISUh.exe
  2⤵
  PID:6340
- C:\Windows\System\vKfMFaK.exe
  C:\Windows\System\vKfMFaK.exe
  2⤵
  PID:6680
- C:\Windows\System\DbEWJxA.exe
  C:\Windows\System\DbEWJxA.exe
  2⤵
  PID:6484
- C:\Windows\System\egevaun.exe
  C:\Windows\System\egevaun.exe
  2⤵
  PID:3664
- C:\Windows\System\KEOTuJu.exe
  C:\Windows\System\KEOTuJu.exe
  2⤵
  PID:6224
- C:\Windows\System\eqmjtsl.exe
  C:\Windows\System\eqmjtsl.exe
  2⤵
  PID:6168
- C:\Windows\System\TKOBYQH.exe
  C:\Windows\System\TKOBYQH.exe
  2⤵
  PID:5856
- C:\Windows\System\qOySbqQ.exe
  C:\Windows\System\qOySbqQ.exe
  2⤵
  PID:5560
- C:\Windows\System\mFGcLXZ.exe
  C:\Windows\System\mFGcLXZ.exe
  2⤵
  PID:6528
- C:\Windows\System\zBKCMve.exe
  C:\Windows\System\zBKCMve.exe
  2⤵
  PID:6632
- C:\Windows\System\EfvgrzT.exe
  C:\Windows\System\EfvgrzT.exe
  2⤵
  PID:6736
- C:\Windows\System\ORdMMlW.exe
  C:\Windows\System\ORdMMlW.exe
  2⤵
  PID:6812
- C:\Windows\System\UhlddpX.exe
  C:\Windows\System\UhlddpX.exe
  2⤵
  PID:6876
- C:\Windows\System\ffGNoPb.exe
  C:\Windows\System\ffGNoPb.exe
  2⤵
  PID:6936
- C:\Windows\System\GVasLsO.exe
  C:\Windows\System\GVasLsO.exe
  2⤵
  PID:6960
- C:\Windows\System\RJLjHkF.exe
  C:\Windows\System\RJLjHkF.exe
  2⤵
  PID:7000
- C:\Windows\System\KLsqdWJ.exe
  C:\Windows\System\KLsqdWJ.exe
  2⤵
  PID:7048
- C:\Windows\System\QZGUMky.exe
  C:\Windows\System\QZGUMky.exe
  2⤵
  PID:7100
- C:\Windows\System\uARuerO.exe
  C:\Windows\System\uARuerO.exe
  2⤵
  PID:7132
- C:\Windows\System\tWgUJyU.exe
  C:\Windows\System\tWgUJyU.exe
  2⤵
  PID:1020
- C:\Windows\System\QhnKJRZ.exe
  C:\Windows\System\QhnKJRZ.exe
  2⤵
  PID:5568
- C:\Windows\System\iiUMzie.exe
  C:\Windows\System\iiUMzie.exe
  2⤵
  PID:6032
- C:\Windows\System\TvKchwv.exe
  C:\Windows\System\TvKchwv.exe
  2⤵
  PID:6252
- C:\Windows\System\PHezECP.exe
  C:\Windows\System\PHezECP.exe
  2⤵
  PID:6388
- C:\Windows\System\owhpXcH.exe
  C:\Windows\System\owhpXcH.exe
  2⤵
  PID:5624
- C:\Windows\System\sZqJTzJ.exe
  C:\Windows\System\sZqJTzJ.exe
  2⤵
  PID:2092
- C:\Windows\System\jDiQNmh.exe
  C:\Windows\System\jDiQNmh.exe
  2⤵
  PID:7196
- C:\Windows\System\ZCUVmOk.exe
  C:\Windows\System\ZCUVmOk.exe
  2⤵
  PID:7216
- C:\Windows\System\StXJemP.exe
  C:\Windows\System\StXJemP.exe
  2⤵
  PID:7240
- C:\Windows\System\KTmjWyO.exe
  C:\Windows\System\KTmjWyO.exe
  2⤵
  PID:7260
- C:\Windows\System\whaueoq.exe
  C:\Windows\System\whaueoq.exe
  2⤵
  PID:7284
- C:\Windows\System\cNSyuJe.exe
  C:\Windows\System\cNSyuJe.exe
  2⤵
  PID:7300
- C:\Windows\System\HEBbTJm.exe
  C:\Windows\System\HEBbTJm.exe
  2⤵
  PID:7324
- C:\Windows\System\WJmXKCe.exe
  C:\Windows\System\WJmXKCe.exe
  2⤵
  PID:7340
- C:\Windows\System\bGjtkjR.exe
  C:\Windows\System\bGjtkjR.exe
  2⤵
  PID:7364
- C:\Windows\System\ZotcnEe.exe
  C:\Windows\System\ZotcnEe.exe
  2⤵
  PID:7380
- C:\Windows\System\nVTmvSh.exe
  C:\Windows\System\nVTmvSh.exe
  2⤵
  PID:7404
- C:\Windows\System\qKMcFGw.exe
  C:\Windows\System\qKMcFGw.exe
  2⤵
  PID:7432
- C:\Windows\System\wmdWhhZ.exe
  C:\Windows\System\wmdWhhZ.exe
  2⤵
  PID:7448
- C:\Windows\System\DBLdXbt.exe
  C:\Windows\System\DBLdXbt.exe
  2⤵
  PID:7472
- C:\Windows\System\CIPmtYV.exe
  C:\Windows\System\CIPmtYV.exe
  2⤵
  PID:7488
- C:\Windows\System\iYOvtUz.exe
  C:\Windows\System\iYOvtUz.exe
  2⤵
  PID:7516
- C:\Windows\System\eiKFyEh.exe
  C:\Windows\System\eiKFyEh.exe
  2⤵
  PID:7532
- C:\Windows\System\dIujRqO.exe
  C:\Windows\System\dIujRqO.exe
  2⤵
  PID:7552
- C:\Windows\System\SKkbOHh.exe
  C:\Windows\System\SKkbOHh.exe
  2⤵
  PID:7576
- C:\Windows\System\XlsVuRm.exe
  C:\Windows\System\XlsVuRm.exe
  2⤵
  PID:7592
- C:\Windows\System\SIvaWCk.exe
  C:\Windows\System\SIvaWCk.exe
  2⤵
  PID:7616
- C:\Windows\System\VEkoTdb.exe
  C:\Windows\System\VEkoTdb.exe
  2⤵
  PID:7636
- C:\Windows\System\PfVlvzY.exe
  C:\Windows\System\PfVlvzY.exe
  2⤵
  PID:7656
- C:\Windows\System\wIoXGeL.exe
  C:\Windows\System\wIoXGeL.exe
  2⤵
  PID:7680
- C:\Windows\System\aWwiBej.exe
  C:\Windows\System\aWwiBej.exe
  2⤵
  PID:7696
- C:\Windows\System\qVzJUVT.exe
  C:\Windows\System\qVzJUVT.exe
  2⤵
  PID:7720
- C:\Windows\System\FNJwRkm.exe
  C:\Windows\System\FNJwRkm.exe
  2⤵
  PID:7736
- C:\Windows\System\QQTqlFD.exe
  C:\Windows\System\QQTqlFD.exe
  2⤵
  PID:7760
- C:\Windows\System\zdYMzZa.exe
  C:\Windows\System\zdYMzZa.exe
  2⤵
  PID:7776
- C:\Windows\System\arkUhNJ.exe
  C:\Windows\System\arkUhNJ.exe
  2⤵
  PID:7800
- C:\Windows\System\PIAPLYa.exe
  C:\Windows\System\PIAPLYa.exe
  2⤵
  PID:7820
- C:\Windows\System\mfRZKxn.exe
  C:\Windows\System\mfRZKxn.exe
  2⤵
  PID:7840
- C:\Windows\System\LhRdsjF.exe
  C:\Windows\System\LhRdsjF.exe
  2⤵
  PID:7864
- C:\Windows\System\SucbLfY.exe
  C:\Windows\System\SucbLfY.exe
  2⤵
  PID:7880
- C:\Windows\System\iGmLVTO.exe
  C:\Windows\System\iGmLVTO.exe
  2⤵
  PID:7908
- C:\Windows\System\rkNGFDK.exe
  C:\Windows\System\rkNGFDK.exe
  2⤵
  PID:7924
- C:\Windows\System\BaVOdtu.exe
  C:\Windows\System\BaVOdtu.exe
  2⤵
  PID:7944
- C:\Windows\System\sFCLikR.exe
  C:\Windows\System\sFCLikR.exe
  2⤵
  PID:7964
- C:\Windows\System\RsFtQsx.exe
  C:\Windows\System\RsFtQsx.exe
  2⤵
  PID:7980
- C:\Windows\System\vWLZYAK.exe
  C:\Windows\System\vWLZYAK.exe
  2⤵
  PID:8004
- C:\Windows\System\sJDwTcc.exe
  C:\Windows\System\sJDwTcc.exe
  2⤵
  PID:8020
- C:\Windows\System\VLcGURK.exe
  C:\Windows\System\VLcGURK.exe
  2⤵
  PID:8044
- C:\Windows\System\eKwTwZT.exe
  C:\Windows\System\eKwTwZT.exe
  2⤵
  PID:8064
- C:\Windows\System\tJjqMgo.exe
  C:\Windows\System\tJjqMgo.exe
  2⤵
  PID:8084
- C:\Windows\System\XGvMNfi.exe
  C:\Windows\System\XGvMNfi.exe
  2⤵
  PID:8108
- C:\Windows\System\sZPeKVC.exe
  C:\Windows\System\sZPeKVC.exe
  2⤵
  PID:8124
- C:\Windows\System\mwjWyrK.exe
  C:\Windows\System\mwjWyrK.exe
  2⤵
  PID:8148
- C:\Windows\System\bgBFKfm.exe
  C:\Windows\System\bgBFKfm.exe
  2⤵
  PID:8164
- C:\Windows\System\vCecTqb.exe
  C:\Windows\System\vCecTqb.exe
  2⤵
  PID:8188
- C:\Windows\System\tGSAdMg.exe
  C:\Windows\System\tGSAdMg.exe
  2⤵
  PID:8216
- C:\Windows\System\kpiNylr.exe
  C:\Windows\System\kpiNylr.exe
  2⤵
  PID:8236
- C:\Windows\System\pESOknz.exe
  C:\Windows\System\pESOknz.exe
  2⤵
  PID:8260
- C:\Windows\System\FcZOyVd.exe
  C:\Windows\System\FcZOyVd.exe
  2⤵
  PID:8276
- C:\Windows\System\dxoNUPP.exe
  C:\Windows\System\dxoNUPP.exe
  2⤵
  PID:8300
- C:\Windows\System\gisQmTO.exe
  C:\Windows\System\gisQmTO.exe
  2⤵
  PID:8316
- C:\Windows\System\utljrbY.exe
  C:\Windows\System\utljrbY.exe
  2⤵
  PID:8340
- C:\Windows\System\SFttWyR.exe
  C:\Windows\System\SFttWyR.exe
  2⤵
  PID:8368
- C:\Windows\System\BGqtfxJ.exe
  C:\Windows\System\BGqtfxJ.exe
  2⤵
  PID:8384
- C:\Windows\System\EvQiaFL.exe
  C:\Windows\System\EvQiaFL.exe
  2⤵
  PID:8404
- C:\Windows\System\XshXmqj.exe
  C:\Windows\System\XshXmqj.exe
  2⤵
  PID:8420
- C:\Windows\System\VIHvPhi.exe
  C:\Windows\System\VIHvPhi.exe
  2⤵
  PID:8444
- C:\Windows\System\mEGOjLG.exe
  C:\Windows\System\mEGOjLG.exe
  2⤵
  PID:8464
- C:\Windows\System\MnjxTss.exe
  C:\Windows\System\MnjxTss.exe
  2⤵
  PID:8484
- C:\Windows\System\ITLdAeq.exe
  C:\Windows\System\ITLdAeq.exe
  2⤵
  PID:8508
- C:\Windows\System\vLWeXae.exe
  C:\Windows\System\vLWeXae.exe
  2⤵
  PID:8524
- C:\Windows\System\fsxXHax.exe
  C:\Windows\System\fsxXHax.exe
  2⤵
  PID:8548
- C:\Windows\System\tzeMUFc.exe
  C:\Windows\System\tzeMUFc.exe
  2⤵
  PID:8572
- C:\Windows\System\ISenqQG.exe
  C:\Windows\System\ISenqQG.exe
  2⤵
  PID:8596
- C:\Windows\System\CKqvHfc.exe
  C:\Windows\System\CKqvHfc.exe
  2⤵
  PID:8616
- C:\Windows\System\GUzsozr.exe
  C:\Windows\System\GUzsozr.exe
  2⤵
  PID:8644
- C:\Windows\System\UmBZMFW.exe
  C:\Windows\System\UmBZMFW.exe
  2⤵
  PID:8660
- C:\Windows\System\vUIBHQx.exe
  C:\Windows\System\vUIBHQx.exe
  2⤵
  PID:8680
- C:\Windows\System\YRuavMu.exe
  C:\Windows\System\YRuavMu.exe
  2⤵
  PID:8696
- C:\Windows\System\lNRIfqy.exe
  C:\Windows\System\lNRIfqy.exe
  2⤵
  PID:8720
- C:\Windows\System\aLhtdDy.exe
  C:\Windows\System\aLhtdDy.exe
  2⤵
  PID:8748
- C:\Windows\System\zVjRviq.exe
  C:\Windows\System\zVjRviq.exe
  2⤵
  PID:8764
- C:\Windows\System\GStoWFZ.exe
  C:\Windows\System\GStoWFZ.exe
  2⤵
  PID:8784
- C:\Windows\System\JKVtXtz.exe
  C:\Windows\System\JKVtXtz.exe
  2⤵
  PID:8808
- C:\Windows\System\XRlBqqs.exe
  C:\Windows\System\XRlBqqs.exe
  2⤵
  PID:8824
- C:\Windows\System\cUDhbaS.exe
  C:\Windows\System\cUDhbaS.exe
  2⤵
  PID:8840
- C:\Windows\System\PJuvYrU.exe
  C:\Windows\System\PJuvYrU.exe
  2⤵
  PID:8856
- C:\Windows\System\WpdKhrg.exe
  C:\Windows\System\WpdKhrg.exe
  2⤵
  PID:8876
- C:\Windows\System\aYWcBiD.exe
  C:\Windows\System\aYWcBiD.exe
  2⤵
  PID:8896
- C:\Windows\System\UbAWLfa.exe
  C:\Windows\System\UbAWLfa.exe
  2⤵
  PID:8920
- C:\Windows\System\ZlbEHuV.exe
  C:\Windows\System\ZlbEHuV.exe
  2⤵
  PID:8940
- C:\Windows\System\OwTkHgw.exe
  C:\Windows\System\OwTkHgw.exe
  2⤵
  PID:8964
- C:\Windows\System\cJnluIE.exe
  C:\Windows\System\cJnluIE.exe
  2⤵
  PID:8984
- C:\Windows\System\vmpXzQn.exe
  C:\Windows\System\vmpXzQn.exe
  2⤵
  PID:9004
- C:\Windows\System\ahwNlTo.exe
  C:\Windows\System\ahwNlTo.exe
  2⤵
  PID:9028
- C:\Windows\System\PvSvLgx.exe
  C:\Windows\System\PvSvLgx.exe
  2⤵
  PID:9048
- C:\Windows\System\suQrtYs.exe
  C:\Windows\System\suQrtYs.exe
  2⤵
  PID:9068
- C:\Windows\System\zqOzDFQ.exe
  C:\Windows\System\zqOzDFQ.exe
  2⤵
  PID:9092
- C:\Windows\System\TeEJprR.exe
  C:\Windows\System\TeEJprR.exe
  2⤵
  PID:9108
- C:\Windows\System\EFhDgYm.exe
  C:\Windows\System\EFhDgYm.exe
  2⤵
  PID:9132
- C:\Windows\System\WhefQzU.exe
  C:\Windows\System\WhefQzU.exe
  2⤵
  PID:9156
- C:\Windows\System\YWhAnOQ.exe
  C:\Windows\System\YWhAnOQ.exe
  2⤵
  PID:9172
- C:\Windows\System\EcrBtrB.exe
  C:\Windows\System\EcrBtrB.exe
  2⤵
  PID:9196
- C:\Windows\System\WBAPtVd.exe
  C:\Windows\System\WBAPtVd.exe
  2⤵
  PID:5736
- C:\Windows\System\qSKzxwN.exe
  C:\Windows\System\qSKzxwN.exe
  2⤵
  PID:9232
- C:\Windows\System\Nwoidnf.exe
  C:\Windows\System\Nwoidnf.exe
  2⤵
  PID:9252
- C:\Windows\System\PNnwIkr.exe
  C:\Windows\System\PNnwIkr.exe
  2⤵
  PID:9268
- C:\Windows\System\PMFziGc.exe
  C:\Windows\System\PMFziGc.exe
  2⤵
  PID:9296
- C:\Windows\System\jpzxXlw.exe
  C:\Windows\System\jpzxXlw.exe
  2⤵
  PID:9316
- C:\Windows\System\FKBIzhq.exe
  C:\Windows\System\FKBIzhq.exe
  2⤵
  PID:9336
- C:\Windows\System\VhBxfzW.exe
  C:\Windows\System\VhBxfzW.exe
  2⤵
  PID:9356
- C:\Windows\System\SLAOFrw.exe
  C:\Windows\System\SLAOFrw.exe
  2⤵
  PID:9380
- C:\Windows\System\TQNIRzc.exe
  C:\Windows\System\TQNIRzc.exe
  2⤵
  PID:9400
- C:\Windows\System\gMwwshI.exe
  C:\Windows\System\gMwwshI.exe
  2⤵
  PID:9424
- C:\Windows\System\PCOGOEy.exe
  C:\Windows\System\PCOGOEy.exe
  2⤵
  PID:9440
- C:\Windows\System\dTVGDtJ.exe
  C:\Windows\System\dTVGDtJ.exe
  2⤵
  PID:9464
- C:\Windows\System\uncVXfG.exe
  C:\Windows\System\uncVXfG.exe
  2⤵
  PID:9480
- C:\Windows\System\XURCDxp.exe
  C:\Windows\System\XURCDxp.exe
  2⤵
  PID:9504
- C:\Windows\System\OocYkZV.exe
  C:\Windows\System\OocYkZV.exe
  2⤵
  PID:9524
- C:\Windows\System\JMcpVim.exe
  C:\Windows\System\JMcpVim.exe
  2⤵
  PID:9772
- C:\Windows\System\NSxnaDo.exe
  C:\Windows\System\NSxnaDo.exe
  2⤵
  PID:9796
- C:\Windows\System\RALOOvg.exe
  C:\Windows\System\RALOOvg.exe
  2⤵
  PID:9812
- C:\Windows\System\woetxQo.exe
  C:\Windows\System\woetxQo.exe
  2⤵
  PID:9828
- C:\Windows\System\BBKfZzj.exe
  C:\Windows\System\BBKfZzj.exe
  2⤵
  PID:9848
- C:\Windows\System\yTYLUVu.exe
  C:\Windows\System\yTYLUVu.exe
  2⤵
  PID:9864
- C:\Windows\System\sqHruJa.exe
  C:\Windows\System\sqHruJa.exe
  2⤵
  PID:9880
- C:\Windows\System\aGVLnpb.exe
  C:\Windows\System\aGVLnpb.exe
  2⤵
  PID:9900
- C:\Windows\System\jduDIkt.exe
  C:\Windows\System\jduDIkt.exe
  2⤵
  PID:9920
- C:\Windows\System\isfPOvl.exe
  C:\Windows\System\isfPOvl.exe
  2⤵
  PID:9948
- C:\Windows\System\PJmNfaa.exe
  C:\Windows\System\PJmNfaa.exe
  2⤵
  PID:9968
- C:\Windows\System\gGjOgcc.exe
  C:\Windows\System\gGjOgcc.exe
  2⤵
  PID:9992
- C:\Windows\System\MgbQWVz.exe
  C:\Windows\System\MgbQWVz.exe
  2⤵
  PID:10016
- C:\Windows\System\jhGZCIT.exe
  C:\Windows\System\jhGZCIT.exe
  2⤵
  PID:10036
- C:\Windows\System\EOFePpa.exe
  C:\Windows\System\EOFePpa.exe
  2⤵
  PID:10060
- C:\Windows\System\hSzbCOR.exe
  C:\Windows\System\hSzbCOR.exe
  2⤵
  PID:10080
- C:\Windows\System\VHRTMia.exe
  C:\Windows\System\VHRTMia.exe
  2⤵
  PID:10104
- C:\Windows\System\NaqNumI.exe
  C:\Windows\System\NaqNumI.exe
  2⤵
  PID:10120
- C:\Windows\System\SLVTyrl.exe
  C:\Windows\System\SLVTyrl.exe
  2⤵
  PID:10148
- C:\Windows\System\FkVSTJf.exe
  C:\Windows\System\FkVSTJf.exe
  2⤵
  PID:10168
- C:\Windows\System\TGFqimZ.exe
  C:\Windows\System\TGFqimZ.exe
  2⤵
  PID:10192
- C:\Windows\System\fetoCys.exe
  C:\Windows\System\fetoCys.exe
  2⤵
  PID:10208
- C:\Windows\System\ZWrFItb.exe
  C:\Windows\System\ZWrFItb.exe
  2⤵
  PID:10232
- C:\Windows\System\IrJIPyJ.exe
  C:\Windows\System\IrJIPyJ.exe
  2⤵
  PID:8104
- C:\Windows\System\GfOtObD.exe
  C:\Windows\System\GfOtObD.exe
  2⤵
  PID:8156
- C:\Windows\System\qmMFizo.exe
  C:\Windows\System\qmMFizo.exe
  2⤵
  PID:8292
- C:\Windows\System\fqmFmgC.exe
  C:\Windows\System\fqmFmgC.exe
  2⤵
  PID:8400
- C:\Windows\System\yrHhyot.exe
  C:\Windows\System\yrHhyot.exe
  2⤵
  PID:8564
- C:\Windows\System\BtDxEvI.exe
  C:\Windows\System\BtDxEvI.exe
  2⤵
  PID:8624
- C:\Windows\System\ydOTjpk.exe
  C:\Windows\System\ydOTjpk.exe
  2⤵
  PID:10268
- C:\Windows\System\nUGZPam.exe
  C:\Windows\System\nUGZPam.exe
  2⤵
  PID:10288
- C:\Windows\System\YXWtMnK.exe
  C:\Windows\System\YXWtMnK.exe
  2⤵
  PID:10312
- C:\Windows\System\RvDyEea.exe
  C:\Windows\System\RvDyEea.exe
  2⤵
  PID:10332
- C:\Windows\System\LPuWmIa.exe
  C:\Windows\System\LPuWmIa.exe
  2⤵
  PID:10348
- C:\Windows\System\ccdrpPU.exe
  C:\Windows\System\ccdrpPU.exe
  2⤵
  PID:10364
- C:\Windows\System\hAJIToC.exe
  C:\Windows\System\hAJIToC.exe
  2⤵
  PID:10380
- C:\Windows\System\vrDILQU.exe
  C:\Windows\System\vrDILQU.exe
  2⤵
  PID:10400
- C:\Windows\System\rphxeaf.exe
  C:\Windows\System\rphxeaf.exe
  2⤵
  PID:10420
- C:\Windows\System\OtEcUVX.exe
  C:\Windows\System\OtEcUVX.exe
  2⤵
  PID:10440
- C:\Windows\System\tHoDrRX.exe
  C:\Windows\System\tHoDrRX.exe
  2⤵
  PID:10468
- C:\Windows\System\utvWGis.exe
  C:\Windows\System\utvWGis.exe
  2⤵
  PID:10484
- C:\Windows\System\MFfrtwC.exe
  C:\Windows\System\MFfrtwC.exe
  2⤵
  PID:10508
- C:\Windows\System\laFjaJG.exe
  C:\Windows\System\laFjaJG.exe
  2⤵
  PID:10532
- C:\Windows\System\tofnqLM.exe
  C:\Windows\System\tofnqLM.exe
  2⤵
  PID:10556
- C:\Windows\System\COWOtxM.exe
  C:\Windows\System\COWOtxM.exe
  2⤵
  PID:10576
- C:\Windows\System\NYJKnVF.exe
  C:\Windows\System\NYJKnVF.exe
  2⤵
  PID:10616
- C:\Windows\System\EdrUWqc.exe
  C:\Windows\System\EdrUWqc.exe
  2⤵
  PID:10632
- C:\Windows\System\AKRtrAb.exe
  C:\Windows\System\AKRtrAb.exe
  2⤵
  PID:10652
- C:\Windows\System\XInihOS.exe
  C:\Windows\System\XInihOS.exe
  2⤵
  PID:10676
- C:\Windows\System\OrfVkhL.exe
  C:\Windows\System\OrfVkhL.exe
  2⤵
  PID:10696
- C:\Windows\System\OroZWlP.exe
  C:\Windows\System\OroZWlP.exe
  2⤵
  PID:10716
- C:\Windows\System\jeOQZZB.exe
  C:\Windows\System\jeOQZZB.exe
  2⤵
  PID:10744
- C:\Windows\System\GxRSfdC.exe
  C:\Windows\System\GxRSfdC.exe
  2⤵
  PID:10764
- C:\Windows\System\gYhhwOW.exe
  C:\Windows\System\gYhhwOW.exe
  2⤵
  PID:10788
- C:\Windows\System\sHdsVpn.exe
  C:\Windows\System\sHdsVpn.exe
  2⤵
  PID:10804
- C:\Windows\System\FoNSwDu.exe
  C:\Windows\System\FoNSwDu.exe
  2⤵
  PID:10824
- C:\Windows\System\vXmxtPC.exe
  C:\Windows\System\vXmxtPC.exe
  2⤵
  PID:10844
- C:\Windows\System\SkTXyEV.exe
  C:\Windows\System\SkTXyEV.exe
  2⤵
  PID:10864
- C:\Windows\System\FslaleD.exe
  C:\Windows\System\FslaleD.exe
  2⤵
  PID:10888
- C:\Windows\System\hzTFNYq.exe
  C:\Windows\System\hzTFNYq.exe
  2⤵
  PID:10912
- C:\Windows\System\uALpIGL.exe
  C:\Windows\System\uALpIGL.exe
  2⤵
  PID:10944
- C:\Windows\System\OwGrVYf.exe
  C:\Windows\System\OwGrVYf.exe
  2⤵
  PID:10960
- C:\Windows\System\RQTdrHZ.exe
  C:\Windows\System\RQTdrHZ.exe
  2⤵
  PID:10976
- C:\Windows\System\YdiPmti.exe
  C:\Windows\System\YdiPmti.exe
  2⤵
  PID:10992
- C:\Windows\System\OCBAMKQ.exe
  C:\Windows\System\OCBAMKQ.exe
  2⤵
  PID:11040
- C:\Windows\System\SbqyxsB.exe
  C:\Windows\System\SbqyxsB.exe
  2⤵
  PID:11060
- C:\Windows\System\RDrXQtX.exe
  C:\Windows\System\RDrXQtX.exe
  2⤵
  PID:11080
- C:\Windows\System\JABeqCj.exe
  C:\Windows\System\JABeqCj.exe
  2⤵
  PID:11100
- C:\Windows\System\zLvMIcp.exe
  C:\Windows\System\zLvMIcp.exe
  2⤵
  PID:11120
- C:\Windows\System\jjoFyfw.exe
  C:\Windows\System\jjoFyfw.exe
  2⤵
  PID:11140
- C:\Windows\System\tvfBctJ.exe
  C:\Windows\System\tvfBctJ.exe
  2⤵
  PID:11156
- C:\Windows\System\IkZxFSX.exe
  C:\Windows\System\IkZxFSX.exe
  2⤵
  PID:11180
- C:\Windows\System\aScbAJt.exe
  C:\Windows\System\aScbAJt.exe
  2⤵
  PID:11196
- C:\Windows\System\hHEOGgH.exe
  C:\Windows\System\hHEOGgH.exe
  2⤵
  PID:11220
- C:\Windows\System\vtTbgfb.exe
  C:\Windows\System\vtTbgfb.exe
  2⤵
  PID:11236
- C:\Windows\System\ogAwROf.exe
  C:\Windows\System\ogAwROf.exe
  2⤵
  PID:11256
- C:\Windows\System\ViczvEv.exe
  C:\Windows\System\ViczvEv.exe
  2⤵
  PID:8688
- C:\Windows\System\RSwUtiM.exe
  C:\Windows\System\RSwUtiM.exe
  2⤵
  PID:8716
- C:\Windows\System\KSmtymb.exe
  C:\Windows\System\KSmtymb.exe
  2⤵
  PID:8776
- C:\Windows\System\bgPFTjS.exe
  C:\Windows\System\bgPFTjS.exe
  2⤵
  PID:8892
- C:\Windows\System\InWkAYr.exe
  C:\Windows\System\InWkAYr.exe
  2⤵
  PID:8936
- C:\Windows\System\SxFvfSS.exe
  C:\Windows\System\SxFvfSS.exe
  2⤵
  PID:9000
- C:\Windows\System\qfQKsni.exe
  C:\Windows\System\qfQKsni.exe
  2⤵
  PID:9104
- C:\Windows\System\BzGSuFT.exe
  C:\Windows\System\BzGSuFT.exe
  2⤵
  PID:9164
- C:\Windows\System\HvGkxRe.exe
  C:\Windows\System\HvGkxRe.exe
  2⤵
  PID:6336
- C:\Windows\System\OcVpRTV.exe
  C:\Windows\System\OcVpRTV.exe
  2⤵
  PID:9276
- C:\Windows\System\RiEaHUF.exe
  C:\Windows\System\RiEaHUF.exe
  2⤵
  PID:9284
- C:\Windows\System\nUYhJwS.exe
  C:\Windows\System\nUYhJwS.exe
  2⤵
  PID:9448
- C:\Windows\System\BqVVIzv.exe
  C:\Windows\System\BqVVIzv.exe
  2⤵
  PID:6656
- C:\Windows\System\nuKWyqp.exe
  C:\Windows\System\nuKWyqp.exe
  2⤵
  PID:9824
- C:\Windows\System\CCldClo.exe
  C:\Windows\System\CCldClo.exe
  2⤵
  PID:9912
- C:\Windows\System\iYXqFWR.exe
  C:\Windows\System\iYXqFWR.exe
  2⤵
  PID:8080
- C:\Windows\System\FDCgCmH.exe
  C:\Windows\System\FDCgCmH.exe
  2⤵
  PID:8172
- C:\Windows\System\NXPZBwL.exe
  C:\Windows\System\NXPZBwL.exe
  2⤵
  PID:8204
- C:\Windows\System\UYoqPoe.exe
  C:\Windows\System\UYoqPoe.exe
  2⤵
  PID:8244
- C:\Windows\System\vDfOJPq.exe
  C:\Windows\System\vDfOJPq.exe
  2⤵
  PID:10116
- C:\Windows\System\gxvrfLV.exe
  C:\Windows\System\gxvrfLV.exe
  2⤵
  PID:8352
- C:\Windows\System\CuxGTAV.exe
  C:\Windows\System\CuxGTAV.exe
  2⤵
  PID:8392
- C:\Windows\System\oUBLkqd.exe
  C:\Windows\System\oUBLkqd.exe
  2⤵
  PID:8440
- C:\Windows\System\POVGyBD.exe
  C:\Windows\System\POVGyBD.exe
  2⤵
  PID:10224
- C:\Windows\System\nECLtZx.exe
  C:\Windows\System\nECLtZx.exe
  2⤵
  PID:8544
- C:\Windows\System\NZYdIIA.exe
  C:\Windows\System\NZYdIIA.exe
  2⤵
  PID:8348
- C:\Windows\System\DdhiXNg.exe
  C:\Windows\System\DdhiXNg.exe
  2⤵
  PID:8520
- C:\Windows\System\TnclFfr.exe
  C:\Windows\System\TnclFfr.exe
  2⤵
  PID:8628
- C:\Windows\System\JQiSHKy.exe
  C:\Windows\System\JQiSHKy.exe
  2⤵
  PID:10276
- C:\Windows\System\lzHRIiE.exe
  C:\Windows\System\lzHRIiE.exe
  2⤵
  PID:10304
- C:\Windows\System\ehwPGGq.exe
  C:\Windows\System\ehwPGGq.exe
  2⤵
  PID:8832
- C:\Windows\System\DiYgxrL.exe
  C:\Windows\System\DiYgxrL.exe
  2⤵
  PID:10388
- C:\Windows\System\aRLAiWA.exe
  C:\Windows\System\aRLAiWA.exe
  2⤵
  PID:10432
- C:\Windows\System\iuHFnFP.exe
  C:\Windows\System\iuHFnFP.exe
  2⤵
  PID:10452
- C:\Windows\System\cpLWQwR.exe
  C:\Windows\System\cpLWQwR.exe
  2⤵
  PID:9020
- C:\Windows\System\zHYUqtn.exe
  C:\Windows\System\zHYUqtn.exe
  2⤵
  PID:9100
- C:\Windows\System\pTbWMBU.exe
  C:\Windows\System\pTbWMBU.exe
  2⤵
  PID:9212
- C:\Windows\System\AVjQTID.exe
  C:\Windows\System\AVjQTID.exe
  2⤵
  PID:9224
- C:\Windows\System\egngByh.exe
  C:\Windows\System\egngByh.exe
  2⤵
  PID:9304
- C:\Windows\System\rrIpKRK.exe
  C:\Windows\System\rrIpKRK.exe
  2⤵
  PID:10688
- C:\Windows\System\ENoWNBe.exe
  C:\Windows\System\ENoWNBe.exe
  2⤵
  PID:10712
- C:\Windows\System\MaoNGDB.exe
  C:\Windows\System\MaoNGDB.exe
  2⤵
  PID:9436
- C:\Windows\System\ERYbiQP.exe
  C:\Windows\System\ERYbiQP.exe
  2⤵
  PID:9496
- C:\Windows\System\USAHKUB.exe
  C:\Windows\System\USAHKUB.exe
  2⤵
  PID:11268
- C:\Windows\System\qcnZFeB.exe
  C:\Windows\System\qcnZFeB.exe
  2⤵
  PID:11296
- C:\Windows\System\lYAPigT.exe
  C:\Windows\System\lYAPigT.exe
  2⤵
  PID:11316
- C:\Windows\System\eUyggBA.exe
  C:\Windows\System\eUyggBA.exe
  2⤵
  PID:11340
- C:\Windows\System\MNrukfK.exe
  C:\Windows\System\MNrukfK.exe
  2⤵
  PID:11356
- C:\Windows\System\FfiEjLL.exe
  C:\Windows\System\FfiEjLL.exe
  2⤵
  PID:11376
- C:\Windows\System\kHXdAhv.exe
  C:\Windows\System\kHXdAhv.exe
  2⤵
  PID:11408
- C:\Windows\System\cVcFSeV.exe
  C:\Windows\System\cVcFSeV.exe
  2⤵
  PID:11424
- C:\Windows\System\tcJmBRt.exe
  C:\Windows\System\tcJmBRt.exe
  2⤵
  PID:11444
- C:\Windows\System\MJksSJf.exe
  C:\Windows\System\MJksSJf.exe
  2⤵
  PID:11732
- C:\Windows\System\hsVGMcf.exe
  C:\Windows\System\hsVGMcf.exe
  2⤵
  PID:11756
- C:\Windows\System\UoETQfd.exe
  C:\Windows\System\UoETQfd.exe
  2⤵
  PID:11776
- C:\Windows\System\bpiNPuW.exe
  C:\Windows\System\bpiNPuW.exe
  2⤵
  PID:11800
- C:\Windows\System\lcEZRVq.exe
  C:\Windows\System\lcEZRVq.exe
  2⤵
  PID:11816
- C:\Windows\System\meIKKWL.exe
  C:\Windows\System\meIKKWL.exe
  2⤵
  PID:11836
- C:\Windows\System\OdVQxsz.exe
  C:\Windows\System\OdVQxsz.exe
  2⤵
  PID:11856
- C:\Windows\System\eiJzYWY.exe
  C:\Windows\System\eiJzYWY.exe
  2⤵
  PID:11876
- C:\Windows\System\SnsIbYO.exe
  C:\Windows\System\SnsIbYO.exe
  2⤵
  PID:11900
- C:\Windows\System\pyvLEzl.exe
  C:\Windows\System\pyvLEzl.exe
  2⤵
  PID:11924
- C:\Windows\System\djsVDAL.exe
  C:\Windows\System\djsVDAL.exe
  2⤵
  PID:11940
- C:\Windows\System\ZbAjECO.exe
  C:\Windows\System\ZbAjECO.exe
  2⤵
  PID:11956
- C:\Windows\System\pPWMZzY.exe
  C:\Windows\System\pPWMZzY.exe
  2⤵
  PID:11976
- C:\Windows\System\iJfHBHE.exe
  C:\Windows\System\iJfHBHE.exe
  2⤵
  PID:11996
- C:\Windows\System\hKFmABI.exe
  C:\Windows\System\hKFmABI.exe
  2⤵
  PID:12016
- C:\Windows\System\wUgGEli.exe
  C:\Windows\System\wUgGEli.exe
  2⤵
  PID:12040
- C:\Windows\System\trebDVo.exe
  C:\Windows\System\trebDVo.exe
  2⤵
  PID:12056
- C:\Windows\System\cVegDAH.exe
  C:\Windows\System\cVegDAH.exe
  2⤵
  PID:12076
- C:\Windows\System\mqkVQjN.exe
  C:\Windows\System\mqkVQjN.exe
  2⤵
  PID:12100
- C:\Windows\System\yqdElEy.exe
  C:\Windows\System\yqdElEy.exe
  2⤵
  PID:12120
- C:\Windows\System\zCXpFNN.exe
  C:\Windows\System\zCXpFNN.exe
  2⤵
  PID:12144
- C:\Windows\System\DGZXJOf.exe
  C:\Windows\System\DGZXJOf.exe
  2⤵
  PID:12164
- C:\Windows\System\NKsZWls.exe
  C:\Windows\System\NKsZWls.exe
  2⤵
  PID:12208
- C:\Windows\System\mbDGLrO.exe
  C:\Windows\System\mbDGLrO.exe
  2⤵
  PID:12224
- C:\Windows\System\oxbNpFk.exe
  C:\Windows\System\oxbNpFk.exe
  2⤵
  PID:12244
- C:\Windows\System\JuWZlPK.exe
  C:\Windows\System\JuWZlPK.exe
  2⤵
  PID:7412
- C:\Windows\System\VFQsLIU.exe
  C:\Windows\System\VFQsLIU.exe
  2⤵
  PID:7524
- C:\Windows\System\QCFKTWJ.exe
  C:\Windows\System\QCFKTWJ.exe
  2⤵
  PID:7560
- C:\Windows\System\kngHGdA.exe
  C:\Windows\System\kngHGdA.exe
  2⤵
  PID:7588
- C:\Windows\System\HQNjhoU.exe
  C:\Windows\System\HQNjhoU.exe
  2⤵
  PID:7628
- C:\Windows\System\xqDpFti.exe
  C:\Windows\System\xqDpFti.exe
  2⤵
  PID:7668
- C:\Windows\System\OljvnQc.exe
  C:\Windows\System\OljvnQc.exe
  2⤵
  PID:7712
- C:\Windows\System\VFdzRMr.exe
  C:\Windows\System\VFdzRMr.exe
  2⤵
  PID:7752
- C:\Windows\System\peRbHUJ.exe
  C:\Windows\System\peRbHUJ.exe
  2⤵
  PID:7784
- C:\Windows\System\qCeCFvn.exe
  C:\Windows\System\qCeCFvn.exe
  2⤵
  PID:7816
- C:\Windows\System\tCsmhdt.exe
  C:\Windows\System\tCsmhdt.exe
  2⤵
  PID:7872
- C:\Windows\System\PMGeAak.exe
  C:\Windows\System\PMGeAak.exe
  2⤵
  PID:7920
- C:\Windows\System\nTuIysL.exe
  C:\Windows\System\nTuIysL.exe
  2⤵
  PID:7956
- C:\Windows\System\NVojZLY.exe
  C:\Windows\System\NVojZLY.exe
  2⤵
  PID:8012
- C:\Windows\System\dZZzFfq.exe
  C:\Windows\System\dZZzFfq.exe
  2⤵
  PID:8040
- C:\Windows\System\OjfxMdN.exe
  C:\Windows\System\OjfxMdN.exe
  2⤵
  PID:8380
- C:\Windows\System\bLhdCDz.exe
  C:\Windows\System\bLhdCDz.exe
  2⤵
  PID:10500
- C:\Windows\System\OSjmvgl.exe
  C:\Windows\System\OSjmvgl.exe
  2⤵
  PID:9208
- C:\Windows\System\nuKVcoq.exe
  C:\Windows\System\nuKVcoq.exe
  2⤵
  PID:8652
- C:\Windows\System\mHQtJEj.exe
  C:\Windows\System\mHQtJEj.exe
  2⤵
  PID:8820
- C:\Windows\System\bfukLlf.exe
  C:\Windows\System\bfukLlf.exe
  2⤵
  PID:10732
- C:\Windows\System\WtRpKhG.exe
  C:\Windows\System\WtRpKhG.exe
  2⤵
  PID:9248
- C:\Windows\System\pmibSnu.exe
  C:\Windows\System\pmibSnu.exe
  2⤵
  PID:10776
- C:\Windows\System\gkKETHx.exe
  C:\Windows\System\gkKETHx.exe
  2⤵
  PID:9488
- C:\Windows\System\eftxwqa.exe
  C:\Windows\System\eftxwqa.exe
  2⤵
  PID:10856
- C:\Windows\System\RUjLldR.exe
  C:\Windows\System\RUjLldR.exe
  2⤵
  PID:11392
- C:\Windows\System\JcYsWvn.exe
  C:\Windows\System\JcYsWvn.exe
  2⤵
  PID:9744
- C:\Windows\System\BYkQguc.exe
  C:\Windows\System\BYkQguc.exe
  2⤵
  PID:9856
- C:\Windows\System\zjisgyi.exe
  C:\Windows\System\zjisgyi.exe
  2⤵
  PID:9928
- C:\Windows\System\VXEiCII.exe
  C:\Windows\System\VXEiCII.exe
  2⤵
  PID:10028
- C:\Windows\System\SGvoJhV.exe
  C:\Windows\System\SGvoJhV.exe
  2⤵
  PID:10180
- C:\Windows\System\SCleQYc.exe
  C:\Windows\System\SCleQYc.exe
  2⤵
  PID:8132
- C:\Windows\System\CkvFcyQ.exe
  C:\Windows\System\CkvFcyQ.exe
  2⤵
  PID:10356
- C:\Windows\System\KifhTrH.exe
  C:\Windows\System\KifhTrH.exe
  2⤵
  PID:10520
- C:\Windows\System\YwQkZxC.exe
  C:\Windows\System\YwQkZxC.exe
  2⤵
  PID:4608
- C:\Windows\System\EhUbfFF.exe
  C:\Windows\System\EhUbfFF.exe
  2⤵
  PID:8972
- C:\Windows\System\tyVTwkZ.exe
  C:\Windows\System\tyVTwkZ.exe
  2⤵
  PID:11512
- C:\Windows\System\AzmjZNp.exe
  C:\Windows\System\AzmjZNp.exe
  2⤵
  PID:11532
- C:\Windows\System\pWfRKDi.exe
  C:\Windows\System\pWfRKDi.exe
  2⤵
  PID:9240
- C:\Windows\System\fkmOrzt.exe
  C:\Windows\System\fkmOrzt.exe
  2⤵
  PID:11728
- C:\Windows\System\JXftBzk.exe
  C:\Windows\System\JXftBzk.exe
  2⤵
  PID:9064
- C:\Windows\System\apgtsGD.exe
  C:\Windows\System\apgtsGD.exe
  2⤵
  PID:10132
- C:\Windows\System\MHrqJxe.exe
  C:\Windows\System\MHrqJxe.exe
  2⤵
  PID:4596
- C:\Windows\System\nUCZSKf.exe
  C:\Windows\System\nUCZSKf.exe
  2⤵
  PID:7900
- C:\Windows\System\UePwxZl.exe
  C:\Windows\System\UePwxZl.exe
  2⤵
  PID:3540
- C:\Windows\System\BXRvdww.exe
  C:\Windows\System\BXRvdww.exe
  2⤵
  PID:11248
- C:\Windows\System\HbYsvPC.exe
  C:\Windows\System\HbYsvPC.exe
  2⤵
  PID:7268
- C:\Windows\System\hRzKSvm.exe
  C:\Windows\System\hRzKSvm.exe
  2⤵
  PID:10528
- C:\Windows\System\QfWNogG.exe
  C:\Windows\System\QfWNogG.exe
  2⤵
  PID:12952
- C:\Windows\System\bZBDiNg.exe
  C:\Windows\System\bZBDiNg.exe
  2⤵
  PID:11544
- C:\Windows\System\kqfqTox.exe
  C:\Windows\System\kqfqTox.exe
  2⤵
  PID:10772
- C:\Windows\System\jFbczeL.exe
  C:\Windows\System\jFbczeL.exe
  2⤵
  PID:5604
- C:\Windows\System\JjgfjWa.exe
  C:\Windows\System\JjgfjWa.exe
  2⤵
  PID:13260
- C:\Windows\System\zRoDSvG.exe
  C:\Windows\System\zRoDSvG.exe
  2⤵
  PID:12912
- C:\Windows\System\hNkQTbG.exe
  C:\Windows\System\hNkQTbG.exe
  2⤵
  PID:12932
- C:\Windows\System\eZamuoB.exe
  C:\Windows\System\eZamuoB.exe
  2⤵
  PID:13152
- C:\Windows\System\SIffXxn.exe
  C:\Windows\System\SIffXxn.exe
  2⤵
  PID:2840
- C:\Windows\System\yHFiIAk.exe
  C:\Windows\System\yHFiIAk.exe
  2⤵
  PID:11784
- C:\Windows\System\JSLFJOh.exe
  C:\Windows\System\JSLFJOh.exe
  2⤵
  PID:12960
- C:\Windows\System\TksarjR.exe
  C:\Windows\System\TksarjR.exe
  2⤵
  PID:4912
- C:\Windows\System\eOIUNUg.exe
  C:\Windows\System\eOIUNUg.exe
  2⤵
  PID:13276
- C:\Windows\System\brpEmwp.exe
  C:\Windows\System\brpEmwp.exe
  2⤵
  PID:11000
- C:\Windows\System\cykQkZc.exe
  C:\Windows\System\cykQkZc.exe
  2⤵
  PID:9124
- C:\Windows\System\FesAcNM.exe
  C:\Windows\System\FesAcNM.exe
  2⤵
  PID:4000
- C:\Windows\System\GRJcwFn.exe
  C:\Windows\System\GRJcwFn.exe
  2⤵
  PID:5152
- C:\Windows\System\mJmFJgy.exe
  C:\Windows\System\mJmFJgy.exe
  2⤵
  PID:13168
- C:\Windows\System\PdpdvvR.exe
  C:\Windows\System\PdpdvvR.exe
  2⤵
  PID:9896
- C:\Windows\System\yBfiWuJ.exe
  C:\Windows\System\yBfiWuJ.exe
  2⤵
  PID:11640
- C:\Windows\System\FjQkADZ.exe
  C:\Windows\System\FjQkADZ.exe
  2⤵
  PID:11812
- C:\Windows\System\yqVZiwb.exe
  C:\Windows\System\yqVZiwb.exe
  2⤵
  PID:11724
- C:\Windows\System\ihNWafq.exe
  C:\Windows\System\ihNWafq.exe
  2⤵
  PID:7692
- C:\Windows\System\mIbqUWR.exe
  C:\Windows\System\mIbqUWR.exe
  2⤵
  PID:2660
- C:\Windows\System\UmNlXfc.exe
  C:\Windows\System\UmNlXfc.exe
  2⤵
  PID:10904
- C:\Windows\System\ekubViA.exe
  C:\Windows\System\ekubViA.exe
  2⤵
  PID:12052
- C:\Windows\System\ReCPzGO.exe
  C:\Windows\System\ReCPzGO.exe
  2⤵
  PID:11624
- C:\Windows\System\aVACYJL.exe
  C:\Windows\System\aVACYJL.exe
  2⤵
  PID:11600
- C:\Windows\System\cjNVvVy.exe
  C:\Windows\System\cjNVvVy.exe
  2⤵
  PID:11572
- C:\Windows\System\clQjfmV.exe
  C:\Windows\System\clQjfmV.exe
  2⤵
  PID:11524
- C:\Windows\System\xcEtwha.exe
  C:\Windows\System\xcEtwha.exe
  2⤵
  PID:4256
- C:\Windows\System\xpVlluA.exe
  C:\Windows\System\xpVlluA.exe
  2⤵
  PID:3096
- C:\Windows\System\XlzLIOo.exe
  C:\Windows\System\XlzLIOo.exe
  2⤵
  PID:6264
- C:\Windows\System\QssFZAP.exe
  C:\Windows\System\QssFZAP.exe
  2⤵
  PID:4392
- C:\Windows\System\gTiFlPi.exe
  C:\Windows\System\gTiFlPi.exe
  2⤵
  PID:3792
- C:\Windows\System\hOtJTdK.exe
  C:\Windows\System\hOtJTdK.exe
  2⤵
  PID:5064
- C:\Windows\System\rLYshMM.exe
  C:\Windows\System\rLYshMM.exe
  2⤵
  PID:5248
- C:\Windows\System\tnBiDjF.exe
  C:\Windows\System\tnBiDjF.exe
  2⤵
  PID:12700
- C:\Windows\System\LqPBzES.exe
  C:\Windows\System\LqPBzES.exe
  2⤵
  PID:13088
- C:\Windows\System\cgkezQA.exe
  C:\Windows\System\cgkezQA.exe
  2⤵
  PID:12920
- C:\Windows\System\IhArMOu.exe
  C:\Windows\System\IhArMOu.exe
  2⤵
  PID:13124
- C:\Windows\System\mXocEOj.exe
  C:\Windows\System\mXocEOj.exe
  2⤵
  PID:5788
- C:\Windows\System\fuSskZO.exe
  C:\Windows\System\fuSskZO.exe
  2⤵
  PID:7348
- C:\Windows\System\WrZXBmO.exe
  C:\Windows\System\WrZXBmO.exe
  2⤵
  PID:10920
- C:\Windows\System\KvdWccc.exe
  C:\Windows\System\KvdWccc.exe
  2⤵
  PID:13224
- C:\Windows\System\agKJGmQ.exe
  C:\Windows\System\agKJGmQ.exe
  2⤵
  PID:10984
- C:\Windows\System\hPLchYa.exe
  C:\Windows\System\hPLchYa.exe
  2⤵
  PID:4576
- C:\Windows\System\pYhLVOc.exe
  C:\Windows\System\pYhLVOc.exe
  2⤵
  PID:11992
- C:\Windows\System\eoECeWB.exe
  C:\Windows\System\eoECeWB.exe
  2⤵
  PID:12032
- C:\Windows\System\ZBcKqyh.exe
  C:\Windows\System\ZBcKqyh.exe
  2⤵
  PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nm1v3f1m.jmq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AFPsJnd.exe

Filesize
1.4MB

MD5
f652f5cb13acd2da8f40cad3ff8509d1

SHA1
79ca37a30ce7325d7051954b3deabef75bd5a803

SHA256
a370def4c922b82a3db5ded5a9e91ba7b904b7b119387093faa991f11bbeb061

SHA512
3fd8a7b7048159244e054e76da99e869ec10cdb9407f9cf87894c5f9dc8b510cbb4c2ffe36178dac876070c046ba27e5d407304bed4cc7d977056498d27ed182

Download Submit
C:\Windows\System\AXogVXn.exe

Filesize
1.4MB

MD5
a1b81614e93d7049ad7668132657f928

SHA1
87e2299347b33b7e0afec0ae105b84c0ad70a4d4

SHA256
b39f2231f1368667e0cd72770b65a2b953abdcdd19b7d99aa9d615ee503087d2

SHA512
61eba8b89ab63a0a00dc2bd46a6006457dad5498b8fb6508fa03ffe26f4fcb8eb3d04efe8ca7fedfdb843c66d6563e08196cf7ef90b7aed6487f29541b75da74

Download Submit
C:\Windows\System\AZhkFjP.exe

Filesize
1.4MB

MD5
40f656e2686b8a83be9e2e9b3e295a0b

SHA1
aee90485e9229fc4a1a5a2efb557b4f335b88ab4

SHA256
efbd38a93ee6cab7b2e3197dcbd910df16221f3d1d152172e9b31f941d927d70

SHA512
2704de17b533492074f9e1543e8c07fdb05b1a8240652c107827fd0f061c1e943ff34a16dfdc11663d961556ac8102c4d093933c2be0d7c306deaaa3bb90ca41

Download Submit
C:\Windows\System\FGNgZNA.exe

Filesize
1.4MB

MD5
a5ff456ebd72aeb87d7f831607ed44fa

SHA1
4ef12bdc03b4ff80b572d844354a7ee7d76383a1

SHA256
e586b030850737887d6a751c137b1c6cfbc038363979162ac053fd428337b3cc

SHA512
63aa4eb823340650260d03b76ec503dda3bf5145c713bda357fd186fe87778cc5e46f4b4ea9c5c78ad721483e1d66969b14aaca5be2cdf96f73defdb2507485b

Download Submit
C:\Windows\System\JlanPxG.exe

Filesize
1.4MB

MD5
9a0f730859f1a5f7b5a37e5ee1b2a1a1

SHA1
6df4971c94142c3bb964aa5087b3175cb867e01f

SHA256
563925facfce2408edaf38e60f5000ab07fb12f5c266b7754b007eb34ecb5341

SHA512
43a555f782e3a67cd6f339cd507fac58353492596bf9180ed1ef1e5354d199430c341120295a10c3f8fa399c59461987158e3db59d09b1c030d72404e5656680

Download Submit
C:\Windows\System\JrIZAiw.exe

Filesize
1.4MB

MD5
1bfe895960678030dc921445c1eb2a5b

SHA1
9fa81c87adb04a3b1f7d0cfb1b8848a9865d5c7b

SHA256
678b5baaddf3ee8d6ed6eee08aede65529a92dc3ec31d26d0ebe58029aaf690e

SHA512
75f321a757e826996105f137a6eb83c84746cbc2acb9fe8c75b031ddb002d09b1483bc38c73cc5a4e94f36b5b56250f874d4fd09f7ff5118a7727461c6a03f1c

Download Submit
C:\Windows\System\KNtqgYO.exe

Filesize
1.4MB

MD5
913349966d501d688a685d747d4d20d9

SHA1
2d09cac2bd5db9c34ab5503d26333bee94292601

SHA256
70d57edaab2fa561c987478da87fdcd889082b363840ad6a42fee6df414a68fb

SHA512
2cfd8476a60c64063076385f07eb75a6fe47e4c79b9362d2e706a70d00d538cf1336dda254b5481ea18c68e5791c71a29e6c04c15fd54ce6e4c1852317446143

Download Submit
C:\Windows\System\KkAoyRm.exe

Filesize
1.4MB

MD5
8dd922a1fb08924e01ff58b1480c67cf

SHA1
7b60fd23152c6ccf1c3557a25d9213e57e288714

SHA256
eb3e66db57dff094f1c10a498ec831ad752a5cdffcd9b7823549c4b5c47b12b0

SHA512
1c1bd4fa0da8a408d3afdf97aa9b922e25ddff4563fa3cba3e59ff73ea608ed4992d95c0621975d4921392572d8ad2bd2335207a23ced59c814b7faa60e050b1

Download Submit
C:\Windows\System\KodUjwg.exe

Filesize
1.4MB

MD5
7af23ac126fdeb9e71ce05e66edbc7e5

SHA1
1785f644a4411160d87dc73752f8d54ec881c24a

SHA256
b1d96258eb610d7b9b5ecaa634b17246503d815e9e9329230fa0b832b15d3663

SHA512
8058c9505736d8d51af33015e595bd3d4bdbe6625d47662be773e359797c1f620731d8b95c5b7d1e5250eb2311595e003e654e56e118ac3495d30db53e9e70dd

Download Submit
C:\Windows\System\LVwTeqU.exe

Filesize
1.4MB

MD5
5bd458921b8bd80ffcef4f7d021e20c0

SHA1
0892e58c860d8a069669919383ca4d9cbbfe7fa5

SHA256
a4b2578f1ce586eef2d66bdacc219d6f243ee2f9e6e4230bec8cb93435deb717

SHA512
f0405dca3ccb6890a5c816f992b13e28f9a06aa68ef0a0e0b93f8723f7961b36e9d253367a4fc80f5ff6c52172afb2b7071086f704a21a8566d95c0bf7d2907c

Download Submit
C:\Windows\System\NiVMjDh.exe

Filesize
1.4MB

MD5
06db7159de2f2c3882c6ed5cbf0b083c

SHA1
a3615409bbffbbe6fa61292241295b906b4e18e3

SHA256
996bda72c263075d7f4c8fc036b1d194f547d35d7a30f0ecf66519ff73ebd9a2

SHA512
d936aaa839f642558b6f0c9de2bb7f4bfe6769e7f33406c481d6c8c8ba698db01dd5d89fb7fb52dd52628de9903969c3167e79ae848543f78390c70ebed955be

Download Submit
C:\Windows\System\OQjDmwv.exe

Filesize
1.4MB

MD5
217eee6113bccad11c652ba98b0e8a15

SHA1
5b1ada786719f35182ebc3a451de5128a9cc65e7

SHA256
49c2d999e4676b2dc29dbbe1446fc2b5272a863bf32b9a3c7fad537fe5db4e10

SHA512
0372aa529c60cd5f08031d73cb58f52d750ccb22f0a524afa0f86b6d03103410ba9d3fcf5ef26e9e90b9a2f71091a9e1f988570243cafc82743107efb17d9857

Download Submit
C:\Windows\System\OhQRXME.exe

Filesize
8B

MD5
dbf4b2bc48179622c6577370619233f8

SHA1
9f7e18ffe46e0a1e380d04af3bbfc6f315ce80a1

SHA256
1fbf1f9f7f7842891151713f30b367cffec488ea36dc866c7fa8cf719141342a

SHA512
15b91ffe21366637f32ece688a7f3e263afa8104af4020271de5ae532ecbc3198516e7a018548a1dd8ee525394a80425bf8c6bace328002d82a85c06b94f8920

Download Submit
C:\Windows\System\OlOUayD.exe

Filesize
1.4MB

MD5
9f635de128fcc6381dbcb51fe117d30a

SHA1
2e45ad02deaae8ff1f76e7d378f4c43675965a40

SHA256
d370c9df86c5ff218ae0f46e4d1a98fe5be22e3f44e842bb27c27b21ebb9030a

SHA512
06c2ab1830c2e33dd67dfb80f0df97236aaa742757df269e4bede5f2caa60a1ab911d94a529c905948c498b6a56d746a434f7206b89dd0637b6be454ade2f763

Download Submit
C:\Windows\System\PehunHP.exe

Filesize
1.4MB

MD5
f77560a65df42f1955c216fbad29c45d

SHA1
58783a9d918f712cf1b1410d39c4fcdfb1bffafc

SHA256
5e9547214ada4d541d22824eb892c7133d21c0103a48d50c984948732b9a355d

SHA512
4a47d338a0e987f7ce8a13e3bfc8ace2425dc158330eb042b0a2fa6fc34b2e2e4e08a4ae61d9dd2517c8e6b1de3878a9f06277c62c4d3b9629df694790cf4a52

Download Submit
C:\Windows\System\RvSjWgD.exe

Filesize
1.4MB

MD5
c56dc3ddf2140af651b1f4a9270c1626

SHA1
63e899682b254d49d4755335645ba1c225ecfb29

SHA256
298e7a40fd973b30342b0ebfe35b0830af0a742946383130d854ecc86ed3741c

SHA512
864b0a178c9f44db2def1337e1abd535db181875d7842cd78f114a345eb42f31fb1a6c0686a70a4c648bc24dba20e0708a563f4ab86f43ec4960c2f26e1057d3

Download Submit
C:\Windows\System\SBjMrAd.exe

Filesize
1.4MB

MD5
9ab58508dae20415899b9de114da147d

SHA1
9da8844e33b75e0c7032b7391f964b547f05bebd

SHA256
ed5697eb32e3eeedfabb3790a3f53c86b49ceaa6bbbf9cb05aa87c37491c3b7c

SHA512
f5e3449a1709d43ee9533f56d722ffa3f0599ab9692b2137e72d5de1170ef82d9acb3fc4874cb83d43d68a11e281dc08d3945e3c31df88eceadfada74aee1b9f

Download Submit
C:\Windows\System\XcSSzUO.exe

Filesize
1.4MB

MD5
00e2080e19718560f57772bb83cdfecf

SHA1
e6ee874bbf0c89ffc4936caaa13bd547f3ef2abf

SHA256
0908a22a61697f1231d16da519af824c26665e62f2fe4bcabc9ae9306c228f7b

SHA512
fe1d8e607384341ef68483443e4674f5c621f0c24096e6778354069a0e7a9e7ae83c3fb152acfef38a23e37767155c7960fe2b7cef5b139810d941ba3b849e3d

Download Submit
C:\Windows\System\YqEfsnx.exe

Filesize
1.4MB

MD5
a6f44e1579096ce27a5c30bab60a2660

SHA1
2624ab0ecc0d269507d0c5e0bebb05a87f0aba44

SHA256
92439faef2d2a1185429c50a225a01e07adcba810cc8b70fe6068a3b2203a88b

SHA512
3e51a6254727d4308a85ae88941685a4a6bb31c812888c55f89f065f68b1d5d7eef0add680f3e1f63ca8bcce207404f736ce70d37a2be1e423308a3d6a7305aa

Download Submit
C:\Windows\System\YtCaCzy.exe

Filesize
1.4MB

MD5
7be790d91e482930b0bda4eed595bfc2

SHA1
93b85502ec133a87d273840941eb86a1e2336ea2

SHA256
affad0166eb1d0d36158ffa218b07aa92a8053601f1fde083f7c25d0a97e6403

SHA512
5a90812d9d93d3d72fcd9974b915cc85005af90e051590208fa0bdeea250fadff9213a89b786b24f16a6ee0152f4a5317cffffa0b8e1618d7b9a6b83d9260b91

Download Submit
C:\Windows\System\aBTBCyn.exe

Filesize
1.4MB

MD5
fbc95439888ce8c2e641b420ad5f525c

SHA1
faa6c7003595162a04bec67e59e6e1ca0de7da41

SHA256
c22e9f250337d7946e050eac7e392bd7bda5634728118b95581d0313cd6aaa76

SHA512
bbd8728862a705ee850c5a5cce800775f05f0bf95b19c4193f5586f7efcb10a0c5b947dc7c286b5173499ed6e5097a84802f4061e8fae2ed3c3607dffb812d71

Download Submit
C:\Windows\System\abWJoiC.exe

Filesize
1.4MB

MD5
d878ba76d6d37862a98ea5b11eb1415d

SHA1
a2b344aa4b52aaa86ecd0745d425c630da12b53d

SHA256
7770e0a2b04a2ad439558b84ee42843d63f42f366010c6a024b270b6380c4a11

SHA512
14df7e7e49f3e919f71be0b79f73b09aec63ff625f75e4801a9e713d1ca6a08a09ee6001d87582ef5e91cb9a7168c9ac2d430608d191e3e76dded7f0c869a730

Download Submit
C:\Windows\System\dNQpEMl.exe

Filesize
1.4MB

MD5
964201c6f12ff027a032dae00c37774c

SHA1
5c7ff7002d0e9726d564fa54c1e1417f703786c8

SHA256
d566dd86d6008ce172de0c230eb588e83cb1f11ab1c3f52d0ad4a11a19264660

SHA512
7612164b190ed8cfd721c6a745523bd9282a20748408b994030d0fd6bd2d5a03bd26440066398e5be6867703d5623bae1e875961f646bc29a9288859d4177d1b

Download Submit
C:\Windows\System\dZUEhME.exe

Filesize
1.4MB

MD5
be25ab045bb45890f830c56ac27ac9eb

SHA1
c325d1f9b2d63c3c5b6dc10adeab51804a22b131

SHA256
24f983b919ecc61345d61c48db859bfa8404cb0d23713da0097a8b635eba4c31

SHA512
f6a6ffb1c6611734bbc6b5e9ad8968c7f96bd88b930cad063447b5dc8835e64489db208745352e19e0394d42182018285a474fea7dbd8b52946962d64ad85808

Download Submit
C:\Windows\System\fOFYnDQ.exe

Filesize
1.4MB

MD5
c6e75df68ab7b93001eceb8acb25026d

SHA1
0a37f5e57df5ca6931aba31607c9721e91fa1579

SHA256
f05f0d0a8348e18fcf0e9a851aa7b6c0ad817a6d1e5f947a3070acecb10326ec

SHA512
a22d9dd26ef6c28a4f99354c20d6a60415c9d61dd6b60f338ccf9591b1082fababa800423c9facdaae5e142651bdada492d7404ecf04af06677a7bada29489f9

Download Submit
C:\Windows\System\gSRefbr.exe

Filesize
1.4MB

MD5
e1fc3e2a1fe11b37098343bf2d78df83

SHA1
9f41f1ecde1f7d1382cfd988f22513b865fb5b3f

SHA256
88530fc4d16ad2b51340592debb60aa3135577166f87310cec9ce68d668cc58f

SHA512
ba34a9b49431db94520811c348f398775ce34ec6641c7d25d6fbc086d8b51cff01a1957b7a640c0cd87fd2bb561822349b8bb29a03ec487e23f89fa7fef4a6b6

Download Submit
C:\Windows\System\hofPrfD.exe

Filesize
1.4MB

MD5
e3ac986faa3dbaf519f9e9128856fe2f

SHA1
957880b60dfb641eafcb5f21e62cefedd7245fe0

SHA256
d4efee5fa8574b579fcb3cca9b91d8ea9b7e8187db47575b633d19ddf7521a39

SHA512
ae9be06ef102b40d38d5c33e4fb7aadcafeede14349850c8e3d68c202d84b50d4ceea6a803bc2e1fcefb2bd5ca6965b0b0b67f889646e80f4699a49edaa2b91a

Download Submit
C:\Windows\System\iIajNGP.exe

Filesize
1.4MB

MD5
07b00a180936c130b55c98075b5fdbfd

SHA1
c5602a1fd27046bf0733bb8a77b2eaa50a5eac2b

SHA256
2b75f76255d1dcaff53aa763ac7d792dc4795acf37ba78f5c953f65d57d7f545

SHA512
8e45eb7a5dbb25d70e0def9ab80aeac07b11618357c912028d7acc946c25cc1eb3f29d920e63af4b34b4bb00f8caf8bbb6aecc1fee17162d809b77e9eab27133

Download Submit
C:\Windows\System\kLOPPNg.exe

Filesize
1.4MB

MD5
c557f53c10b37eb9439bfed08ae8a6ba

SHA1
46089d2c7be216a93e0ad941be002357e6c79519

SHA256
539b133b45b88e5cee8684a162af4899a4267071ccb01b472096e3deff935706

SHA512
f196a9e5b802c3e253b478c9255a1f1a035f64a4242839bad427ef0c19e4ce3f9e4e8389d0040af5055d6fe239ffbfcbba2fb842389fa90e4538abee9fbc0325

Download Submit
C:\Windows\System\kNzLJpd.exe

Filesize
1.4MB

MD5
a861e00e563169e2fc5066341dab5fde

SHA1
a5ba4444b785cb31b661cbea4dbca57fb7657e81

SHA256
afd3420366d994520274a91c807a45618a953fb0022957b2fd4c1468ce2755b6

SHA512
def9fcc899b262e28f8934286245546952fdda90a449a22289173e0ee887cb7eba0d762d1da04f7773b9c6000435ed8c73d3fb4bcf69e5d4295d9b7b02487e8d

Download Submit
C:\Windows\System\mtsaqKv.exe

Filesize
1.4MB

MD5
92ad2a522ddb63e735d8a0e347e03d45

SHA1
a5ec4ae1c2fe0c1e8270cac60801b0c1a298e4e7

SHA256
c2a64eac81b330624d1196636558ca8c529451a531c3d12c35b36f9343b211e8

SHA512
58345bfb173e0b1d135a4ab567a4f3f3b74fe33a3cb49fd2891b2aa7861b174c985be159687d16e0128074ff5368bdd91bea6534214267a6891608bcf899dac3

Download Submit
C:\Windows\System\oyfanmI.exe

Filesize
1.4MB

MD5
404a43738f1f6bbd9e9e99cf483d9cb7

SHA1
968d8cba5ab1d117b9c3f3483114db530562601f

SHA256
0aa37fa875ab2a521d3bddf4567624a02cc306fe5f580a619f71347b29c9e5cf

SHA512
a1b2b6d77d47ee7bd3492c71f440898b5569a1fee6a347d59db90f264ec9d9721f581349e4fa62c0b10d70d68615ae035a6aec7dd4ce38fba311b48511ccba4d

Download Submit
C:\Windows\System\pzqcIQD.exe

Filesize
1.4MB

MD5
25ae87812c9401838f8d90effcb793fc

SHA1
36a11df09ab1660de5276382358122e4a1e24673

SHA256
be69f5559ace3c13320c7e8bca2bdd88f443703fd4c20b4ff2319eb4b3728fd1

SHA512
3b2e4aea28a23512b2944408c6822e64d0ebb49a2ea3ab3793e712a53d4ac7ae9ef73ab30b2cca8ee72b491852ad9858fde31f3c219fed8a2136bc678d445ed4

Download Submit
C:\Windows\System\qaQHOFp.exe

Filesize
1.4MB

MD5
5914c7f676ed2b4427a1cd1486517ffa

SHA1
fb256d5ac7ac0f5d9650ed9a7216a8adc2a22f97

SHA256
2470f63fc17bb2974c3d00a87a14d455d5756e243b44c5d15d078204d2f44514

SHA512
c1af480ec63dff279c3619e3919612fe2ad0aeaf5cdc9f8a62cb4f7694efe0fcad6fc75e7e0cf9c7d252331d27c2b46647dd200662e47f874329b85d3530119e

Download Submit
C:\Windows\System\rbCgtGg.exe

Filesize
1.4MB

MD5
53810ce0503ac2612c13f2ce3734322b

SHA1
12796d65b54134995704ed8b847aa56eb952a3a4

SHA256
33accafb940f7249b71a8afc6f99ebcd38ca245e184f8b9544c32bde0109fc79

SHA512
d34a8e74345d9b90e31def98057090997ecf45ed7c5713a12904c957921a6f5b990d206385a7884d46966524c149c6767fdb82bf8d31decd57dd4f605034fbc1

Download Submit
C:\Windows\System\smLCAiW.exe

Filesize
1.4MB

MD5
512884e8ff6b2737ad73a7b352bc8b54

SHA1
0db38311899610f202825425090e344445a95036

SHA256
2fa4e7c2fc4b57a2090769ae10e91b61ded6998e247e7510126d24fafabcee55

SHA512
5570789cc7b452a7c45f4ae95c2ce4ad44d24158aaa0e17d12eccadf04d529fc6d9146bd99f99f14012066881b19722841b3bc14a500fab2c5c287828051fadb

Download Submit
C:\Windows\System\sxgvmts.exe

Filesize
1.4MB

MD5
38626dd55aacb075b7f95621023700c4

SHA1
3844eb6eef21ba2f87be907bdbf5a2510df0c225

SHA256
d04fc7638b8b8fb2de9daf551c80b34ed50952eea1ac27f9e16fb8869407f97b

SHA512
768e990da4ccc153fdb4e0048e82a5ec4dcacac4bae31d32f000a19a51e5fd213daa762b6bc7e731ae76783ec1578a2999402616221d20035a47448b28b263e0

Download Submit
C:\Windows\System\uVFWBBq.exe

Filesize
1.4MB

MD5
0353752d28811b2acb1ac2e31a2677e0

SHA1
9a8e95129e8e5857dd7f5195931f32934f58e688

SHA256
44ee5416f250f0e466cba3fa096bfe293d1f5bfd275f72a32b339fccc201f125

SHA512
9c7978b3c73bdf9698904f9d6142e20f012bcd57e92d2dd28094553822bb44d054bd6066a8b5eb31ae23c983b2677a5cc033c5bae9cb3e1e772d26bbb71c70d3

Download Submit
C:\Windows\System\vPowCia.exe

Filesize
1.4MB

MD5
5576a3a6daf26e524035c0a7f747dc2b

SHA1
07dabcb4a8682e9f4a5bf00e116d396f16d41fe2

SHA256
430a7c7ae9b7307451aa06f850af2121638076d8e12625b9b859eecfb1252637

SHA512
44b2d9330e9296beb1fb8e835bbc94d6da81f5f7ecac372de9041adc8df46e11e46ce3fe6c11244d4c56f83710347d03a0ca89870b9efd27b1bcdb2bf7a7b239

Download Submit
C:\Windows\System\vWUrTXo.exe

Filesize
1.4MB

MD5
1748aa7b3180610e1710943a3be84a9b

SHA1
ad697979ffeb977e0c1c7c3875e24250cfd41fc9

SHA256
20fab585aca42739feefd51fd7d881b5222a83fd5b5bfc9165d48fee5d796e74

SHA512
23440388113030393ed60d5268f3928088fbfe0d083b650c67ab48cda3d2a882b15c163c14d409739438d0c23ae10da9db3a2010583d9344cee426e4aa6067c4

Download Submit
C:\Windows\System\zfQcCoR.exe

Filesize
1.4MB

MD5
4e06dd2a355f9f427860cc96f464cc12

SHA1
57289305586cb5f59b1f8ddc2556c40cbc61673a

SHA256
81506561a68d7e72d047504dc8ce373c8449d8e8d76fb129984f1d751b24a2f6

SHA512
bf794a90dadb35cc037115ab290026407f1b0f90b4949c68ed997aa15c8cfe5a44b363109f3059175cdc135ec268f8272251ba875d334cfdf778ca2e39f9b074

Download Submit
C:\Windows\System\zqkHgqE.exe

Filesize
1.4MB

MD5
e6822c34ee3888c2eafa66f9d40acc98

SHA1
8d7206a0d1e2c6107589ab0eb3b10c78b99ea547

SHA256
fb60f9b48d328cb45c09af1024b0207561d5cb624088415bd112240b71e5a8ba

SHA512
ca8d5d1d3151e59ca4070cde4148a736804d7505e4027b8eacaf25dc37168fa63b62c113c772143181f626c1eb902242843bc9214e9ca96bebbe1b6b41fd8399

Download Submit
memory/448-2439-0x00007FF752750000-0x00007FF752B42000-memory.dmp

Filesize
3.9MB

Download
memory/448-608-0x00007FF752750000-0x00007FF752B42000-memory.dmp

Filesize
3.9MB

Download
memory/628-594-0x00007FF635FE0000-0x00007FF6363D2000-memory.dmp

Filesize
3.9MB

Download
memory/628-2446-0x00007FF635FE0000-0x00007FF6363D2000-memory.dmp

Filesize
3.9MB

Download
memory/680-1282-0x00007FF640050000-0x00007FF640442000-memory.dmp

Filesize
3.9MB

Download
memory/680-2462-0x00007FF640050000-0x00007FF640442000-memory.dmp

Filesize
3.9MB

Download
memory/836-1455-0x00007FFFEC4F0000-0x00007FFFECFB1000-memory.dmp

Filesize
10.8MB

Download
memory/836-126-0x00007FFFEC4F3000-0x00007FFFEC4F5000-memory.dmp

Filesize
8KB

Download
memory/836-308-0x000001F0ADD30000-0x000001F0ADD52000-memory.dmp

Filesize
136KB

Download
memory/836-253-0x00007FFFEC4F0000-0x00007FFFECFB1000-memory.dmp

Filesize
10.8MB

Download
memory/1180-1281-0x00007FF7A4120000-0x00007FF7A4512000-memory.dmp

Filesize
3.9MB

Download
memory/1180-2501-0x00007FF7A4120000-0x00007FF7A4512000-memory.dmp

Filesize
3.9MB

Download
memory/1628-2477-0x00007FF6F1BF0000-0x00007FF6F1FE2000-memory.dmp

Filesize
3.9MB

Download
memory/1628-1337-0x00007FF6F1BF0000-0x00007FF6F1FE2000-memory.dmp

Filesize
3.9MB

Download
memory/1680-2472-0x00007FF77A760000-0x00007FF77AB52000-memory.dmp

Filesize
3.9MB

Download
memory/1680-1127-0x00007FF77A760000-0x00007FF77AB52000-memory.dmp

Filesize
3.9MB

Download
memory/2012-503-0x00007FF7379E0000-0x00007FF737DD2000-memory.dmp

Filesize
3.9MB

Download
memory/2012-2490-0x00007FF7379E0000-0x00007FF737DD2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-1665-0x00007FF7D8A40000-0x00007FF7D8E32000-memory.dmp

Filesize
3.9MB

Download
memory/2024-2442-0x00007FF7D8A40000-0x00007FF7D8E32000-memory.dmp

Filesize
3.9MB

Download
memory/2292-1336-0x00007FF61AD90000-0x00007FF61B182000-memory.dmp

Filesize
3.9MB

Download
memory/2292-2460-0x00007FF61AD90000-0x00007FF61B182000-memory.dmp

Filesize
3.9MB

Download
memory/2516-2398-0x00007FF7E0590000-0x00007FF7E0982000-memory.dmp

Filesize
3.9MB

Download
memory/2516-2436-0x00007FF7E0590000-0x00007FF7E0982000-memory.dmp

Filesize
3.9MB

Download
memory/2516-123-0x00007FF7E0590000-0x00007FF7E0982000-memory.dmp

Filesize
3.9MB

Download
memory/2800-2470-0x00007FF7FB8F0000-0x00007FF7FBCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-589-0x00007FF7FB8F0000-0x00007FF7FBCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-69-0x00007FF6B0340000-0x00007FF6B0732000-memory.dmp

Filesize
3.9MB

Download
memory/2860-2432-0x00007FF6B0340000-0x00007FF6B0732000-memory.dmp

Filesize
3.9MB

Download
memory/2860-2397-0x00007FF6B0340000-0x00007FF6B0732000-memory.dmp

Filesize
3.9MB

Download
memory/2972-2440-0x00007FF612B60000-0x00007FF612F52000-memory.dmp

Filesize
3.9MB

Download
memory/2972-982-0x00007FF612B60000-0x00007FF612F52000-memory.dmp

Filesize
3.9MB

Download
memory/2992-2434-0x00007FF7A7790000-0x00007FF7A7B82000-memory.dmp

Filesize
3.9MB

Download
memory/2992-26-0x00007FF7A7790000-0x00007FF7A7B82000-memory.dmp

Filesize
3.9MB

Download
memory/2992-2396-0x00007FF7A7790000-0x00007FF7A7B82000-memory.dmp

Filesize
3.9MB

Download
memory/3068-256-0x00007FF7F15F0000-0x00007FF7F19E2000-memory.dmp

Filesize
3.9MB

Download
memory/3068-2466-0x00007FF7F15F0000-0x00007FF7F19E2000-memory.dmp

Filesize
3.9MB

Download
memory/3136-1-0x000002DCF4390000-0x000002DCF43A0000-memory.dmp

Filesize
64KB

Download
memory/3136-0-0x00007FF7933F0000-0x00007FF7937E2000-memory.dmp

Filesize
3.9MB

Download
memory/3436-2468-0x00007FF6EA490000-0x00007FF6EA882000-memory.dmp

Filesize
3.9MB

Download
memory/3436-1667-0x00007FF6EA490000-0x00007FF6EA882000-memory.dmp

Filesize
3.9MB

Download
memory/3636-518-0x00007FF7FC240000-0x00007FF7FC632000-memory.dmp

Filesize
3.9MB

Download
memory/3636-2458-0x00007FF7FC240000-0x00007FF7FC632000-memory.dmp

Filesize
3.9MB

Download
memory/4040-2456-0x00007FF68FC40000-0x00007FF690032000-memory.dmp

Filesize
3.9MB

Download
memory/4040-335-0x00007FF68FC40000-0x00007FF690032000-memory.dmp

Filesize
3.9MB

Download
memory/4232-2455-0x00007FF6A1910000-0x00007FF6A1D02000-memory.dmp

Filesize
3.9MB

Download
memory/4232-426-0x00007FF6A1910000-0x00007FF6A1D02000-memory.dmp

Filesize
3.9MB

Download
memory/4440-2445-0x00007FF6891E0000-0x00007FF6895D2000-memory.dmp

Filesize
3.9MB

Download
memory/4440-1288-0x00007FF6891E0000-0x00007FF6895D2000-memory.dmp

Filesize
3.9MB

Download
memory/4528-2464-0x00007FF7FA650000-0x00007FF7FAA42000-memory.dmp

Filesize
3.9MB

Download
memory/4528-987-0x00007FF7FA650000-0x00007FF7FAA42000-memory.dmp

Filesize
3.9MB

Download
memory/4572-274-0x00007FF675030000-0x00007FF675422000-memory.dmp

Filesize
3.9MB

Download
memory/4572-2451-0x00007FF675030000-0x00007FF675422000-memory.dmp

Filesize
3.9MB

Download
memory/4868-1132-0x00007FF65AC10000-0x00007FF65B002000-memory.dmp

Filesize
3.9MB

Download
memory/4868-2449-0x00007FF65AC10000-0x00007FF65B002000-memory.dmp

Filesize
3.9MB

Download
memory/4896-2453-0x00007FF758940000-0x00007FF758D32000-memory.dmp

Filesize
3.9MB

Download
memory/4896-1574-0x00007FF758940000-0x00007FF758D32000-memory.dmp

Filesize
3.9MB

Download