xmrig | 6faa4907ba6b34299c8afe17b65fdfa9c34e18fa21d824d40bc3f1b9de4f346a

Analysis

max time kernel
143s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 11:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
Size

1.3MB
MD5

dd90a343f34a465cf8f2330bd8944350
SHA1

0bf3af8aeb4614c063cc1df4b5c0982f3dc356ba
SHA256

6faa4907ba6b34299c8afe17b65fdfa9c34e18fa21d824d40bc3f1b9de4f346a
SHA512

0a7661c98342b16dfa4456aa6e7dc77b5210921fb1c710629e63bd014e7e0845fd3f471b3aa03be64bcd54b40780e543379a6af4b6920f3041bd83c97ea34361
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbGRmfjK:Lz071uv4BPMkHC0IlnASEx/Rf

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/1936-63-0x00007FF7B5A10000-0x00007FF7B5E02000-memory.dmp	xmrig
behavioral2/memory/1392-69-0x00007FF76CA40000-0x00007FF76CE32000-memory.dmp	xmrig
behavioral2/memory/2008-88-0x00007FF7E1B30000-0x00007FF7E1F22000-memory.dmp	xmrig
behavioral2/memory/2320-107-0x00007FF740D50000-0x00007FF741142000-memory.dmp	xmrig
behavioral2/memory/3276-113-0x00007FF749F40000-0x00007FF74A332000-memory.dmp	xmrig
behavioral2/memory/4764-101-0x00007FF6C46A0000-0x00007FF6C4A92000-memory.dmp	xmrig
behavioral2/memory/1744-100-0x00007FF73D930000-0x00007FF73DD22000-memory.dmp	xmrig
behavioral2/memory/4108-94-0x00007FF7AA8E0000-0x00007FF7AACD2000-memory.dmp	xmrig
behavioral2/memory/3304-87-0x00007FF6DAB10000-0x00007FF6DAF02000-memory.dmp	xmrig
behavioral2/memory/2436-83-0x00007FF620780000-0x00007FF620B72000-memory.dmp	xmrig
behavioral2/memory/3568-72-0x00007FF74F1D0000-0x00007FF74F5C2000-memory.dmp	xmrig
behavioral2/memory/2100-68-0x00007FF641320000-0x00007FF641712000-memory.dmp	xmrig
behavioral2/memory/316-67-0x00007FF64DC80000-0x00007FF64E072000-memory.dmp	xmrig
behavioral2/memory/964-64-0x00007FF6572B0000-0x00007FF6576A2000-memory.dmp	xmrig
behavioral2/memory/4484-2685-0x00007FF74EAE0000-0x00007FF74EED2000-memory.dmp	xmrig
behavioral2/memory/4900-3302-0x00007FF63FB40000-0x00007FF63FF32000-memory.dmp	xmrig
behavioral2/memory/736-3303-0x00007FF6AC300000-0x00007FF6AC6F2000-memory.dmp	xmrig
behavioral2/memory/4872-3304-0x00007FF69FFD0000-0x00007FF6A03C2000-memory.dmp	xmrig
behavioral2/memory/1684-3305-0x00007FF7E3A50000-0x00007FF7E3E42000-memory.dmp	xmrig
behavioral2/memory/4448-3306-0x00007FF7DF420000-0x00007FF7DF812000-memory.dmp	xmrig
behavioral2/memory/1104-3316-0x00007FF7A8FB0000-0x00007FF7A93A2000-memory.dmp	xmrig
behavioral2/memory/2436-3320-0x00007FF620780000-0x00007FF620B72000-memory.dmp	xmrig
behavioral2/memory/1936-3321-0x00007FF7B5A10000-0x00007FF7B5E02000-memory.dmp	xmrig
behavioral2/memory/964-3323-0x00007FF6572B0000-0x00007FF6576A2000-memory.dmp	xmrig
behavioral2/memory/2100-3325-0x00007FF641320000-0x00007FF641712000-memory.dmp	xmrig
behavioral2/memory/1392-3327-0x00007FF76CA40000-0x00007FF76CE32000-memory.dmp	xmrig
behavioral2/memory/316-3331-0x00007FF64DC80000-0x00007FF64E072000-memory.dmp	xmrig
behavioral2/memory/3304-3330-0x00007FF6DAB10000-0x00007FF6DAF02000-memory.dmp	xmrig
behavioral2/memory/3568-3333-0x00007FF74F1D0000-0x00007FF74F5C2000-memory.dmp	xmrig
behavioral2/memory/1744-3344-0x00007FF73D930000-0x00007FF73DD22000-memory.dmp	xmrig
behavioral2/memory/4484-3349-0x00007FF74EAE0000-0x00007FF74EED2000-memory.dmp	xmrig
behavioral2/memory/3276-3353-0x00007FF749F40000-0x00007FF74A332000-memory.dmp	xmrig
behavioral2/memory/4448-3357-0x00007FF7DF420000-0x00007FF7DF812000-memory.dmp	xmrig
behavioral2/memory/1104-3359-0x00007FF7A8FB0000-0x00007FF7A93A2000-memory.dmp	xmrig
behavioral2/memory/1684-3355-0x00007FF7E3A50000-0x00007FF7E3E42000-memory.dmp	xmrig
behavioral2/memory/4108-3348-0x00007FF7AA8E0000-0x00007FF7AACD2000-memory.dmp	xmrig
behavioral2/memory/2008-3346-0x00007FF7E1B30000-0x00007FF7E1F22000-memory.dmp	xmrig
behavioral2/memory/4764-3342-0x00007FF6C46A0000-0x00007FF6C4A92000-memory.dmp	xmrig
behavioral2/memory/736-3338-0x00007FF6AC300000-0x00007FF6AC6F2000-memory.dmp	xmrig
behavioral2/memory/4900-3352-0x00007FF63FB40000-0x00007FF63FF32000-memory.dmp	xmrig
behavioral2/memory/4872-3336-0x00007FF69FFD0000-0x00007FF6A03C2000-memory.dmp	xmrig
behavioral2/memory/2320-3340-0x00007FF740D50000-0x00007FF741142000-memory.dmp	xmrig
behavioral2/memory/3156-3369-0x00007FF784B60000-0x00007FF784F52000-memory.dmp	xmrig
behavioral2/memory/1760-3368-0x00007FF6ED7B0000-0x00007FF6EDBA2000-memory.dmp	xmrig
behavioral2/memory/2500-3365-0x00007FF70CB80000-0x00007FF70CF72000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
9	3076	powershell.exe
11	3076	powershell.exe
15	3076	powershell.exe
16	3076	powershell.exe
19	3076	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3076	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2436	TpzqCsr.exe
1936	fejLITF.exe
964	tDQTnPf.exe
316	ZHZJBsQ.exe
2100	crELXXQ.exe
1392	mRLQQXY.exe
3304	WLvrmbj.exe
3568	TQxcDrz.exe
2008	UdXPIHI.exe
4108	ohTZVef.exe
4484	rVMoaMX.exe
1744	vMzCzFE.exe
4764	JcBWWGy.exe
2320	sZcwNZF.exe
3276	SwptUKr.exe
4900	pzTGcit.exe
736	jJVDSJZ.exe
4872	dYtNkFo.exe
1684	quMuMjp.exe
4448	EofkXrI.exe
1104	bOgBYPU.exe
3156	zdCzasl.exe
1760	SKacLTb.exe
2500	SQJedsC.exe
1800	lNmIfdF.exe
4028	Agwcjkv.exe
3120	CDRycFD.exe
3228	YBQWmYy.exe
3240	XfGDGRj.exe
3712	UlwCHYY.exe
2488	AfaDEQf.exe
4276	aGinrjT.exe
4908	olznzls.exe
1448	LYwfazX.exe
636	WvfHuLd.exe
1132	aaglgQH.exe
4356	xZqFGUg.exe
4360	fWPsTOr.exe
1288	NHIlIah.exe
2424	WLSVtcg.exe
2256	jMigOwr.exe
2084	pgDWqUU.exe
1380	yVhNGXK.exe
1996	WvfwLTP.exe
4612	btUEOSo.exe
3424	hEInbgj.exe
4600	TNnQOvN.exe
4288	OwpyMmA.exe
4756	vbXCvQd.exe
624	kfOkamM.exe
3136	LInSoJd.exe
3464	seginCM.exe
2740	FNzCToz.exe
4208	ywClhYX.exe
2908	LVusckG.exe
2652	BAyOHLl.exe
832	YdeVNuD.exe
1624	lOfcWsm.exe
2956	EUfkFiU.exe
2308	KZBsDGR.exe
3492	xWzUCfl.exe
5132	fAzHggQ.exe
5156	XDIgpHQ.exe
5184	UYgRFnJ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4476-0-0x00007FF726800000-0x00007FF726BF2000-memory.dmp	upx
behavioral2/files/0x000700000002346c-7.dat	upx
behavioral2/files/0x000700000002346b-9.dat	upx
behavioral2/files/0x0007000000023473-47.dat	upx
behavioral2/files/0x0007000000023470-46.dat	upx
behavioral2/files/0x000700000002346f-54.dat	upx
behavioral2/memory/1936-63-0x00007FF7B5A10000-0x00007FF7B5E02000-memory.dmp	upx
behavioral2/memory/1392-69-0x00007FF76CA40000-0x00007FF76CE32000-memory.dmp	upx
behavioral2/files/0x0008000000023471-75.dat	upx
behavioral2/files/0x0008000000023468-80.dat	upx
behavioral2/memory/2008-88-0x00007FF7E1B30000-0x00007FF7E1F22000-memory.dmp	upx
behavioral2/files/0x0007000000023475-95.dat	upx
behavioral2/memory/2320-107-0x00007FF740D50000-0x00007FF741142000-memory.dmp	upx
behavioral2/files/0x000700000002347a-116.dat	upx
behavioral2/memory/736-125-0x00007FF6AC300000-0x00007FF6AC6F2000-memory.dmp	upx
behavioral2/memory/1684-137-0x00007FF7E3A50000-0x00007FF7E3E42000-memory.dmp	upx
behavioral2/files/0x0007000000023484-175.dat	upx
behavioral2/files/0x0007000000023486-193.dat	upx
behavioral2/files/0x0007000000023489-200.dat	upx
behavioral2/files/0x0007000000023487-198.dat	upx
behavioral2/files/0x0007000000023488-195.dat	upx
behavioral2/files/0x0007000000023485-188.dat	upx
behavioral2/files/0x0007000000023483-178.dat	upx
behavioral2/files/0x0007000000023482-173.dat	upx
behavioral2/files/0x0007000000023481-168.dat	upx
behavioral2/files/0x0007000000023480-163.dat	upx
behavioral2/memory/2500-162-0x00007FF70CB80000-0x00007FF70CF72000-memory.dmp	upx
behavioral2/files/0x000700000002347f-157.dat	upx
behavioral2/memory/1760-156-0x00007FF6ED7B0000-0x00007FF6EDBA2000-memory.dmp	upx
behavioral2/files/0x000700000002347e-151.dat	upx
behavioral2/memory/3156-150-0x00007FF784B60000-0x00007FF784F52000-memory.dmp	upx
behavioral2/files/0x000700000002347d-145.dat	upx
behavioral2/memory/1104-144-0x00007FF7A8FB0000-0x00007FF7A93A2000-memory.dmp	upx
behavioral2/files/0x000700000002347c-139.dat	upx
behavioral2/memory/4448-138-0x00007FF7DF420000-0x00007FF7DF812000-memory.dmp	upx
behavioral2/files/0x000700000002347b-132.dat	upx
behavioral2/memory/4872-131-0x00007FF69FFD0000-0x00007FF6A03C2000-memory.dmp	upx
behavioral2/files/0x0007000000023479-120.dat	upx
behavioral2/memory/4900-119-0x00007FF63FB40000-0x00007FF63FF32000-memory.dmp	upx
behavioral2/files/0x0007000000023478-114.dat	upx
behavioral2/memory/3276-113-0x00007FF749F40000-0x00007FF74A332000-memory.dmp	upx
behavioral2/files/0x0007000000023477-108.dat	upx
behavioral2/files/0x0007000000023476-102.dat	upx
behavioral2/memory/4764-101-0x00007FF6C46A0000-0x00007FF6C4A92000-memory.dmp	upx
behavioral2/memory/1744-100-0x00007FF73D930000-0x00007FF73DD22000-memory.dmp	upx
behavioral2/memory/4108-94-0x00007FF7AA8E0000-0x00007FF7AACD2000-memory.dmp	upx
behavioral2/memory/3304-87-0x00007FF6DAB10000-0x00007FF6DAF02000-memory.dmp	upx
behavioral2/memory/2436-83-0x00007FF620780000-0x00007FF620B72000-memory.dmp	upx
behavioral2/memory/4484-78-0x00007FF74EAE0000-0x00007FF74EED2000-memory.dmp	upx
behavioral2/memory/3568-72-0x00007FF74F1D0000-0x00007FF74F5C2000-memory.dmp	upx
behavioral2/memory/2100-68-0x00007FF641320000-0x00007FF641712000-memory.dmp	upx
behavioral2/memory/316-67-0x00007FF64DC80000-0x00007FF64E072000-memory.dmp	upx
behavioral2/files/0x0008000000023472-71.dat	upx
behavioral2/files/0x0007000000023474-70.dat	upx
behavioral2/memory/964-64-0x00007FF6572B0000-0x00007FF6576A2000-memory.dmp	upx
behavioral2/files/0x000700000002346d-49.dat	upx
behavioral2/files/0x000700000002346e-25.dat	upx
behavioral2/files/0x000a000000023461-13.dat	upx
behavioral2/memory/4484-2685-0x00007FF74EAE0000-0x00007FF74EED2000-memory.dmp	upx
behavioral2/memory/4900-3302-0x00007FF63FB40000-0x00007FF63FF32000-memory.dmp	upx
behavioral2/memory/736-3303-0x00007FF6AC300000-0x00007FF6AC6F2000-memory.dmp	upx
behavioral2/memory/4872-3304-0x00007FF69FFD0000-0x00007FF6A03C2000-memory.dmp	upx
behavioral2/memory/1684-3305-0x00007FF7E3A50000-0x00007FF7E3E42000-memory.dmp	upx
behavioral2/memory/4448-3306-0x00007FF7DF420000-0x00007FF7DF812000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
8	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\seRTcrC.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\XxwclfJ.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\GpjgqyM.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\YHKCLWz.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\wZmHKpT.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\LSGweeu.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\DITmzQb.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\kfOkamM.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\rsVjbvX.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\qDFgPsT.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\JnteiZG.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\UMklfVJ.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\tDQTnPf.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\pVhctbv.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\InsELAi.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\BAyOHLl.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\VnsnNEG.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\aWFECKe.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\hZtsalC.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\FJeIpSy.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\NNRvieo.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\vuaxBOI.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\YQRYfSe.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\xlKbzpu.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\yAzxupC.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\EFvcKBC.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\bYXALaO.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\ekjoKnr.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\eimMQiz.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\RFnhahy.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\doknUiw.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\gqBIIxo.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\zLrgDHk.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\xZqFGUg.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\uCVloiL.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\SpKQnKZ.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\FbnZuUz.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\wJYcHaO.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\xzEpLkM.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\aqHvRBu.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\qOjqxbq.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\pRXHZMc.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\sqjnLqM.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\aojCZJX.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\rYyYYrH.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\ZTFXQsp.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\zbhTkEV.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\VqHHoDM.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\HElMtRa.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\UdXPIHI.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\PuEmQML.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\RckPUGI.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\xxdJyvB.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\BxxLVpO.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\oWzukoc.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\cLMMZxU.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\ZBnrTzt.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\PpoHZax.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\jCegZQy.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\TMWOiEO.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\olznzls.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\eIsGtfB.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\KyoJenu.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
File created	C:\Windows\System\YuNfJoQ.exe	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3076	powershell.exe
3076	powershell.exe
3076	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
Token: SeDebugPrivilege	3076	powershell.exe
Token: SeLockMemoryPrivilege	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3076	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	84
PID 4476 wrote to memory of 3076	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	84
PID 4476 wrote to memory of 2436	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	85
PID 4476 wrote to memory of 2436	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	85
PID 4476 wrote to memory of 1936	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	86
PID 4476 wrote to memory of 1936	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	86
PID 4476 wrote to memory of 964	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	87
PID 4476 wrote to memory of 964	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	87
PID 4476 wrote to memory of 316	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	88
PID 4476 wrote to memory of 316	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	88
PID 4476 wrote to memory of 2100	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	89
PID 4476 wrote to memory of 2100	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	89
PID 4476 wrote to memory of 1392	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	90
PID 4476 wrote to memory of 1392	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	90
PID 4476 wrote to memory of 3304	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	91
PID 4476 wrote to memory of 3304	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	91
PID 4476 wrote to memory of 3568	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	92
PID 4476 wrote to memory of 3568	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	92
PID 4476 wrote to memory of 2008	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	93
PID 4476 wrote to memory of 2008	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	93
PID 4476 wrote to memory of 4484	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	94
PID 4476 wrote to memory of 4484	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	94
PID 4476 wrote to memory of 4108	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	95
PID 4476 wrote to memory of 4108	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	95
PID 4476 wrote to memory of 1744	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	96
PID 4476 wrote to memory of 1744	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	96
PID 4476 wrote to memory of 4764	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	97
PID 4476 wrote to memory of 4764	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	97
PID 4476 wrote to memory of 2320	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	98
PID 4476 wrote to memory of 2320	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	98
PID 4476 wrote to memory of 3276	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	99
PID 4476 wrote to memory of 3276	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	99
PID 4476 wrote to memory of 4900	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	100
PID 4476 wrote to memory of 4900	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	100
PID 4476 wrote to memory of 736	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	101
PID 4476 wrote to memory of 736	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	101
PID 4476 wrote to memory of 4872	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	102
PID 4476 wrote to memory of 4872	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	102
PID 4476 wrote to memory of 1684	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	103
PID 4476 wrote to memory of 1684	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	103
PID 4476 wrote to memory of 4448	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	104
PID 4476 wrote to memory of 4448	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	104
PID 4476 wrote to memory of 1104	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	105
PID 4476 wrote to memory of 1104	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	105
PID 4476 wrote to memory of 3156	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	106
PID 4476 wrote to memory of 3156	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	106
PID 4476 wrote to memory of 1760	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	107
PID 4476 wrote to memory of 1760	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	107
PID 4476 wrote to memory of 2500	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	108
PID 4476 wrote to memory of 2500	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	108
PID 4476 wrote to memory of 1800	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	109
PID 4476 wrote to memory of 1800	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	109
PID 4476 wrote to memory of 4028	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	110
PID 4476 wrote to memory of 4028	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	110
PID 4476 wrote to memory of 3120	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	111
PID 4476 wrote to memory of 3120	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	111
PID 4476 wrote to memory of 3228	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	112
PID 4476 wrote to memory of 3228	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	112
PID 4476 wrote to memory of 3240	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	113
PID 4476 wrote to memory of 3240	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	113
PID 4476 wrote to memory of 3712	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	114
PID 4476 wrote to memory of 3712	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	114
PID 4476 wrote to memory of 2488	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	115
PID 4476 wrote to memory of 2488	4476	dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\dd90a343f34a465cf8f2330bd8944350_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3076
- C:\Windows\System\TpzqCsr.exe
  C:\Windows\System\TpzqCsr.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\fejLITF.exe
  C:\Windows\System\fejLITF.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\tDQTnPf.exe
  C:\Windows\System\tDQTnPf.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\ZHZJBsQ.exe
  C:\Windows\System\ZHZJBsQ.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\crELXXQ.exe
  C:\Windows\System\crELXXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\mRLQQXY.exe
  C:\Windows\System\mRLQQXY.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\WLvrmbj.exe
  C:\Windows\System\WLvrmbj.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\TQxcDrz.exe
  C:\Windows\System\TQxcDrz.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\UdXPIHI.exe
  C:\Windows\System\UdXPIHI.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\rVMoaMX.exe
  C:\Windows\System\rVMoaMX.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\ohTZVef.exe
  C:\Windows\System\ohTZVef.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\vMzCzFE.exe
  C:\Windows\System\vMzCzFE.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\JcBWWGy.exe
  C:\Windows\System\JcBWWGy.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\sZcwNZF.exe
  C:\Windows\System\sZcwNZF.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\SwptUKr.exe
  C:\Windows\System\SwptUKr.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\pzTGcit.exe
  C:\Windows\System\pzTGcit.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\jJVDSJZ.exe
  C:\Windows\System\jJVDSJZ.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\dYtNkFo.exe
  C:\Windows\System\dYtNkFo.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\quMuMjp.exe
  C:\Windows\System\quMuMjp.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\EofkXrI.exe
  C:\Windows\System\EofkXrI.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\bOgBYPU.exe
  C:\Windows\System\bOgBYPU.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\zdCzasl.exe
  C:\Windows\System\zdCzasl.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\SKacLTb.exe
  C:\Windows\System\SKacLTb.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\SQJedsC.exe
  C:\Windows\System\SQJedsC.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\lNmIfdF.exe
  C:\Windows\System\lNmIfdF.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\Agwcjkv.exe
  C:\Windows\System\Agwcjkv.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\CDRycFD.exe
  C:\Windows\System\CDRycFD.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\YBQWmYy.exe
  C:\Windows\System\YBQWmYy.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\XfGDGRj.exe
  C:\Windows\System\XfGDGRj.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\UlwCHYY.exe
  C:\Windows\System\UlwCHYY.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\AfaDEQf.exe
  C:\Windows\System\AfaDEQf.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\aGinrjT.exe
  C:\Windows\System\aGinrjT.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\olznzls.exe
  C:\Windows\System\olznzls.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\LYwfazX.exe
  C:\Windows\System\LYwfazX.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\WvfHuLd.exe
  C:\Windows\System\WvfHuLd.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\aaglgQH.exe
  C:\Windows\System\aaglgQH.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\xZqFGUg.exe
  C:\Windows\System\xZqFGUg.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\fWPsTOr.exe
  C:\Windows\System\fWPsTOr.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\NHIlIah.exe
  C:\Windows\System\NHIlIah.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\WLSVtcg.exe
  C:\Windows\System\WLSVtcg.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\jMigOwr.exe
  C:\Windows\System\jMigOwr.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\pgDWqUU.exe
  C:\Windows\System\pgDWqUU.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\yVhNGXK.exe
  C:\Windows\System\yVhNGXK.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\WvfwLTP.exe
  C:\Windows\System\WvfwLTP.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\btUEOSo.exe
  C:\Windows\System\btUEOSo.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\hEInbgj.exe
  C:\Windows\System\hEInbgj.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\TNnQOvN.exe
  C:\Windows\System\TNnQOvN.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\OwpyMmA.exe
  C:\Windows\System\OwpyMmA.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\vbXCvQd.exe
  C:\Windows\System\vbXCvQd.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\kfOkamM.exe
  C:\Windows\System\kfOkamM.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\LInSoJd.exe
  C:\Windows\System\LInSoJd.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\seginCM.exe
  C:\Windows\System\seginCM.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\FNzCToz.exe
  C:\Windows\System\FNzCToz.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\ywClhYX.exe
  C:\Windows\System\ywClhYX.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\LVusckG.exe
  C:\Windows\System\LVusckG.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\BAyOHLl.exe
  C:\Windows\System\BAyOHLl.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\YdeVNuD.exe
  C:\Windows\System\YdeVNuD.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\lOfcWsm.exe
  C:\Windows\System\lOfcWsm.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\EUfkFiU.exe
  C:\Windows\System\EUfkFiU.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\KZBsDGR.exe
  C:\Windows\System\KZBsDGR.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\xWzUCfl.exe
  C:\Windows\System\xWzUCfl.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\fAzHggQ.exe
  C:\Windows\System\fAzHggQ.exe
  2⤵
  - Executes dropped EXE
  PID:5132
- C:\Windows\System\XDIgpHQ.exe
  C:\Windows\System\XDIgpHQ.exe
  2⤵
  - Executes dropped EXE
  PID:5156
- C:\Windows\System\UYgRFnJ.exe
  C:\Windows\System\UYgRFnJ.exe
  2⤵
  - Executes dropped EXE
  PID:5184
- C:\Windows\System\nmOtMmo.exe
  C:\Windows\System\nmOtMmo.exe
  2⤵
  PID:5216
- C:\Windows\System\zGxxECZ.exe
  C:\Windows\System\zGxxECZ.exe
  2⤵
  PID:5248
- C:\Windows\System\DiNeKZT.exe
  C:\Windows\System\DiNeKZT.exe
  2⤵
  PID:5272
- C:\Windows\System\tbGwQhO.exe
  C:\Windows\System\tbGwQhO.exe
  2⤵
  PID:5304
- C:\Windows\System\hiHpUub.exe
  C:\Windows\System\hiHpUub.exe
  2⤵
  PID:5332
- C:\Windows\System\uJtFXNd.exe
  C:\Windows\System\uJtFXNd.exe
  2⤵
  PID:5356
- C:\Windows\System\DMTKuXs.exe
  C:\Windows\System\DMTKuXs.exe
  2⤵
  PID:5392
- C:\Windows\System\TwlHOqb.exe
  C:\Windows\System\TwlHOqb.exe
  2⤵
  PID:5416
- C:\Windows\System\iZNfqzu.exe
  C:\Windows\System\iZNfqzu.exe
  2⤵
  PID:5444
- C:\Windows\System\LkbDiky.exe
  C:\Windows\System\LkbDiky.exe
  2⤵
  PID:5476
- C:\Windows\System\XCWsKRL.exe
  C:\Windows\System\XCWsKRL.exe
  2⤵
  PID:5504
- C:\Windows\System\HHAWPsg.exe
  C:\Windows\System\HHAWPsg.exe
  2⤵
  PID:5532
- C:\Windows\System\NfKIWtp.exe
  C:\Windows\System\NfKIWtp.exe
  2⤵
  PID:5560
- C:\Windows\System\aWQQiEl.exe
  C:\Windows\System\aWQQiEl.exe
  2⤵
  PID:5588
- C:\Windows\System\xuFJOXH.exe
  C:\Windows\System\xuFJOXH.exe
  2⤵
  PID:5616
- C:\Windows\System\wiLNBRA.exe
  C:\Windows\System\wiLNBRA.exe
  2⤵
  PID:5644
- C:\Windows\System\spEPxMy.exe
  C:\Windows\System\spEPxMy.exe
  2⤵
  PID:5676
- C:\Windows\System\ypvvOfZ.exe
  C:\Windows\System\ypvvOfZ.exe
  2⤵
  PID:5704
- C:\Windows\System\rxHyzLM.exe
  C:\Windows\System\rxHyzLM.exe
  2⤵
  PID:5732
- C:\Windows\System\OgSGtYc.exe
  C:\Windows\System\OgSGtYc.exe
  2⤵
  PID:5756
- C:\Windows\System\XNfOEJX.exe
  C:\Windows\System\XNfOEJX.exe
  2⤵
  PID:5784
- C:\Windows\System\vXzlWua.exe
  C:\Windows\System\vXzlWua.exe
  2⤵
  PID:5812
- C:\Windows\System\lXmMRCK.exe
  C:\Windows\System\lXmMRCK.exe
  2⤵
  PID:5844
- C:\Windows\System\bwiJpvL.exe
  C:\Windows\System\bwiJpvL.exe
  2⤵
  PID:5872
- C:\Windows\System\JBENyrc.exe
  C:\Windows\System\JBENyrc.exe
  2⤵
  PID:5900
- C:\Windows\System\pEQYVGg.exe
  C:\Windows\System\pEQYVGg.exe
  2⤵
  PID:5928
- C:\Windows\System\TyxpLxV.exe
  C:\Windows\System\TyxpLxV.exe
  2⤵
  PID:5956
- C:\Windows\System\xYKzYBX.exe
  C:\Windows\System\xYKzYBX.exe
  2⤵
  PID:5984
- C:\Windows\System\xbLNkle.exe
  C:\Windows\System\xbLNkle.exe
  2⤵
  PID:6012
- C:\Windows\System\kLMYTFu.exe
  C:\Windows\System\kLMYTFu.exe
  2⤵
  PID:6040
- C:\Windows\System\yYxRSKD.exe
  C:\Windows\System\yYxRSKD.exe
  2⤵
  PID:6068
- C:\Windows\System\RxRgVIp.exe
  C:\Windows\System\RxRgVIp.exe
  2⤵
  PID:6096
- C:\Windows\System\iZkiBDP.exe
  C:\Windows\System\iZkiBDP.exe
  2⤵
  PID:6124
- C:\Windows\System\zsMVLrr.exe
  C:\Windows\System\zsMVLrr.exe
  2⤵
  PID:264
- C:\Windows\System\UWKXjKJ.exe
  C:\Windows\System\UWKXjKJ.exe
  2⤵
  PID:544
- C:\Windows\System\cqjYkuT.exe
  C:\Windows\System\cqjYkuT.exe
  2⤵
  PID:4424
- C:\Windows\System\UuunVnZ.exe
  C:\Windows\System\UuunVnZ.exe
  2⤵
  PID:2472
- C:\Windows\System\daKdnUC.exe
  C:\Windows\System\daKdnUC.exe
  2⤵
  PID:780
- C:\Windows\System\HKjZuty.exe
  C:\Windows\System\HKjZuty.exe
  2⤵
  PID:2020
- C:\Windows\System\ercKBVg.exe
  C:\Windows\System\ercKBVg.exe
  2⤵
  PID:5140
- C:\Windows\System\CCXGqbd.exe
  C:\Windows\System\CCXGqbd.exe
  2⤵
  PID:5176
- C:\Windows\System\NFaMEUd.exe
  C:\Windows\System\NFaMEUd.exe
  2⤵
  PID:388
- C:\Windows\System\elxMVOo.exe
  C:\Windows\System\elxMVOo.exe
  2⤵
  PID:5296
- C:\Windows\System\nrMaBdv.exe
  C:\Windows\System\nrMaBdv.exe
  2⤵
  PID:5372
- C:\Windows\System\MBfnnYi.exe
  C:\Windows\System\MBfnnYi.exe
  2⤵
  PID:5432
- C:\Windows\System\kgAZuVA.exe
  C:\Windows\System\kgAZuVA.exe
  2⤵
  PID:5492
- C:\Windows\System\kXYAbpP.exe
  C:\Windows\System\kXYAbpP.exe
  2⤵
  PID:5552
- C:\Windows\System\rOubwTs.exe
  C:\Windows\System\rOubwTs.exe
  2⤵
  PID:5608
- C:\Windows\System\SnriKbM.exe
  C:\Windows\System\SnriKbM.exe
  2⤵
  PID:5664
- C:\Windows\System\FpOqQOs.exe
  C:\Windows\System\FpOqQOs.exe
  2⤵
  PID:5728
- C:\Windows\System\sXonEyk.exe
  C:\Windows\System\sXonEyk.exe
  2⤵
  PID:5796
- C:\Windows\System\NOVlxLS.exe
  C:\Windows\System\NOVlxLS.exe
  2⤵
  PID:5860
- C:\Windows\System\zOOpPuD.exe
  C:\Windows\System\zOOpPuD.exe
  2⤵
  PID:5920
- C:\Windows\System\FKFvBvz.exe
  C:\Windows\System\FKFvBvz.exe
  2⤵
  PID:5996
- C:\Windows\System\OHdaDlJ.exe
  C:\Windows\System\OHdaDlJ.exe
  2⤵
  PID:6052
- C:\Windows\System\iJErAPJ.exe
  C:\Windows\System\iJErAPJ.exe
  2⤵
  PID:6088
- C:\Windows\System\RXkEGPS.exe
  C:\Windows\System\RXkEGPS.exe
  2⤵
  PID:1880
- C:\Windows\System\jNzOPhY.exe
  C:\Windows\System\jNzOPhY.exe
  2⤵
  PID:5168
- C:\Windows\System\GKzvidc.exe
  C:\Windows\System\GKzvidc.exe
  2⤵
  PID:5240
- C:\Windows\System\NtzEjGy.exe
  C:\Windows\System\NtzEjGy.exe
  2⤵
  PID:5408
- C:\Windows\System\CzjaMoY.exe
  C:\Windows\System\CzjaMoY.exe
  2⤵
  PID:5544
- C:\Windows\System\zrHjRYe.exe
  C:\Windows\System\zrHjRYe.exe
  2⤵
  PID:5660
- C:\Windows\System\JvtWfJq.exe
  C:\Windows\System\JvtWfJq.exe
  2⤵
  PID:5752
- C:\Windows\System\pmodWzR.exe
  C:\Windows\System\pmodWzR.exe
  2⤵
  PID:5832
- C:\Windows\System\NuAEyVV.exe
  C:\Windows\System\NuAEyVV.exe
  2⤵
  PID:5948
- C:\Windows\System\KjTFqog.exe
  C:\Windows\System\KjTFqog.exe
  2⤵
  PID:3620
- C:\Windows\System\lzOGzqi.exe
  C:\Windows\System\lzOGzqi.exe
  2⤵
  PID:752
- C:\Windows\System\XiuMfLo.exe
  C:\Windows\System\XiuMfLo.exe
  2⤵
  PID:3176
- C:\Windows\System\RxjpOJJ.exe
  C:\Windows\System\RxjpOJJ.exe
  2⤵
  PID:4608
- C:\Windows\System\ooGZOHC.exe
  C:\Windows\System\ooGZOHC.exe
  2⤵
  PID:4640
- C:\Windows\System\KEtUVti.exe
  C:\Windows\System\KEtUVti.exe
  2⤵
  PID:4204
- C:\Windows\System\LgpVWEq.exe
  C:\Windows\System\LgpVWEq.exe
  2⤵
  PID:3892
- C:\Windows\System\nBJuXJt.exe
  C:\Windows\System\nBJuXJt.exe
  2⤵
  PID:5428
- C:\Windows\System\dfyMfsg.exe
  C:\Windows\System\dfyMfsg.exe
  2⤵
  PID:5824
- C:\Windows\System\tAeVYYz.exe
  C:\Windows\System\tAeVYYz.exe
  2⤵
  PID:5636
- C:\Windows\System\tgwFPBJ.exe
  C:\Windows\System\tgwFPBJ.exe
  2⤵
  PID:5016
- C:\Windows\System\pzTdAkG.exe
  C:\Windows\System\pzTdAkG.exe
  2⤵
  PID:4936
- C:\Windows\System\KDHYXUr.exe
  C:\Windows\System\KDHYXUr.exe
  2⤵
  PID:2204
- C:\Windows\System\AfwiaJg.exe
  C:\Windows\System\AfwiaJg.exe
  2⤵
  PID:4272
- C:\Windows\System\GKgRhiG.exe
  C:\Windows\System\GKgRhiG.exe
  2⤵
  PID:4284
- C:\Windows\System\VgeLQJo.exe
  C:\Windows\System\VgeLQJo.exe
  2⤵
  PID:3584
- C:\Windows\System\STGqFBZ.exe
  C:\Windows\System\STGqFBZ.exe
  2⤵
  PID:396
- C:\Windows\System\vICcfmV.exe
  C:\Windows\System\vICcfmV.exe
  2⤵
  PID:3504
- C:\Windows\System\iYAdrpw.exe
  C:\Windows\System\iYAdrpw.exe
  2⤵
  PID:3188
- C:\Windows\System\YlmtOXc.exe
  C:\Windows\System\YlmtOXc.exe
  2⤵
  PID:2580
- C:\Windows\System\dRATiGA.exe
  C:\Windows\System\dRATiGA.exe
  2⤵
  PID:4672
- C:\Windows\System\BTNtvGB.exe
  C:\Windows\System\BTNtvGB.exe
  2⤵
  PID:6152
- C:\Windows\System\AmqPflT.exe
  C:\Windows\System\AmqPflT.exe
  2⤵
  PID:6180
- C:\Windows\System\TZFapbn.exe
  C:\Windows\System\TZFapbn.exe
  2⤵
  PID:6216
- C:\Windows\System\liBacaT.exe
  C:\Windows\System\liBacaT.exe
  2⤵
  PID:6232
- C:\Windows\System\jjKLHBj.exe
  C:\Windows\System\jjKLHBj.exe
  2⤵
  PID:6256
- C:\Windows\System\xVjFaYt.exe
  C:\Windows\System\xVjFaYt.exe
  2⤵
  PID:6292
- C:\Windows\System\aFcovgY.exe
  C:\Windows\System\aFcovgY.exe
  2⤵
  PID:6324
- C:\Windows\System\twLGmjR.exe
  C:\Windows\System\twLGmjR.exe
  2⤵
  PID:6364
- C:\Windows\System\KEwishU.exe
  C:\Windows\System\KEwishU.exe
  2⤵
  PID:6400
- C:\Windows\System\vtBDdkb.exe
  C:\Windows\System\vtBDdkb.exe
  2⤵
  PID:6424
- C:\Windows\System\DFvJnDr.exe
  C:\Windows\System\DFvJnDr.exe
  2⤵
  PID:6468
- C:\Windows\System\eWRaGTJ.exe
  C:\Windows\System\eWRaGTJ.exe
  2⤵
  PID:6484
- C:\Windows\System\lzdUBtX.exe
  C:\Windows\System\lzdUBtX.exe
  2⤵
  PID:6500
- C:\Windows\System\JkskKxU.exe
  C:\Windows\System\JkskKxU.exe
  2⤵
  PID:6536
- C:\Windows\System\OIjqiBE.exe
  C:\Windows\System\OIjqiBE.exe
  2⤵
  PID:6556
- C:\Windows\System\eIsGtfB.exe
  C:\Windows\System\eIsGtfB.exe
  2⤵
  PID:6592
- C:\Windows\System\nUsKHBw.exe
  C:\Windows\System\nUsKHBw.exe
  2⤵
  PID:6624
- C:\Windows\System\tvjFuIO.exe
  C:\Windows\System\tvjFuIO.exe
  2⤵
  PID:6664
- C:\Windows\System\MzrzxLU.exe
  C:\Windows\System\MzrzxLU.exe
  2⤵
  PID:6684
- C:\Windows\System\OXCMYEc.exe
  C:\Windows\System\OXCMYEc.exe
  2⤵
  PID:6716
- C:\Windows\System\maVYizV.exe
  C:\Windows\System\maVYizV.exe
  2⤵
  PID:6736
- C:\Windows\System\RzrfnUw.exe
  C:\Windows\System\RzrfnUw.exe
  2⤵
  PID:6752
- C:\Windows\System\TSaNecb.exe
  C:\Windows\System\TSaNecb.exe
  2⤵
  PID:6780
- C:\Windows\System\kaBEhkt.exe
  C:\Windows\System\kaBEhkt.exe
  2⤵
  PID:6852
- C:\Windows\System\Okspgjy.exe
  C:\Windows\System\Okspgjy.exe
  2⤵
  PID:6868
- C:\Windows\System\jsbzKsz.exe
  C:\Windows\System\jsbzKsz.exe
  2⤵
  PID:6892
- C:\Windows\System\apqGQEZ.exe
  C:\Windows\System\apqGQEZ.exe
  2⤵
  PID:6916
- C:\Windows\System\xQzSIOr.exe
  C:\Windows\System\xQzSIOr.exe
  2⤵
  PID:6936
- C:\Windows\System\UoCCRTY.exe
  C:\Windows\System\UoCCRTY.exe
  2⤵
  PID:6952
- C:\Windows\System\AKYnjOE.exe
  C:\Windows\System\AKYnjOE.exe
  2⤵
  PID:6980
- C:\Windows\System\ZlavAPu.exe
  C:\Windows\System\ZlavAPu.exe
  2⤵
  PID:7020
- C:\Windows\System\ufbBBAT.exe
  C:\Windows\System\ufbBBAT.exe
  2⤵
  PID:7040
- C:\Windows\System\zVfIvIE.exe
  C:\Windows\System\zVfIvIE.exe
  2⤵
  PID:7060
- C:\Windows\System\evbdPaE.exe
  C:\Windows\System\evbdPaE.exe
  2⤵
  PID:7084
- C:\Windows\System\DXovTui.exe
  C:\Windows\System\DXovTui.exe
  2⤵
  PID:7100
- C:\Windows\System\OmIrFFV.exe
  C:\Windows\System\OmIrFFV.exe
  2⤵
  PID:7124
- C:\Windows\System\kdEsawS.exe
  C:\Windows\System\kdEsawS.exe
  2⤵
  PID:4520
- C:\Windows\System\tAfrynY.exe
  C:\Windows\System\tAfrynY.exe
  2⤵
  PID:6148
- C:\Windows\System\HlzvoIC.exe
  C:\Windows\System\HlzvoIC.exe
  2⤵
  PID:6204
- C:\Windows\System\NddkuVJ.exe
  C:\Windows\System\NddkuVJ.exe
  2⤵
  PID:6352
- C:\Windows\System\kXVzRJR.exe
  C:\Windows\System\kXVzRJR.exe
  2⤵
  PID:6396
- C:\Windows\System\lBNfsff.exe
  C:\Windows\System\lBNfsff.exe
  2⤵
  PID:6432
- C:\Windows\System\kCdXzhP.exe
  C:\Windows\System\kCdXzhP.exe
  2⤵
  PID:6480
- C:\Windows\System\qBafmhF.exe
  C:\Windows\System\qBafmhF.exe
  2⤵
  PID:6496
- C:\Windows\System\uMcJKLT.exe
  C:\Windows\System\uMcJKLT.exe
  2⤵
  PID:6552
- C:\Windows\System\KQRzGTb.exe
  C:\Windows\System\KQRzGTb.exe
  2⤵
  PID:6588
- C:\Windows\System\xiUgNzi.exe
  C:\Windows\System\xiUgNzi.exe
  2⤵
  PID:6760
- C:\Windows\System\bKJWkDg.exe
  C:\Windows\System\bKJWkDg.exe
  2⤵
  PID:6864
- C:\Windows\System\CANGEIU.exe
  C:\Windows\System\CANGEIU.exe
  2⤵
  PID:6912
- C:\Windows\System\CFeJcBM.exe
  C:\Windows\System\CFeJcBM.exe
  2⤵
  PID:6996
- C:\Windows\System\pHUtzHE.exe
  C:\Windows\System\pHUtzHE.exe
  2⤵
  PID:7164
- C:\Windows\System\AkygKrJ.exe
  C:\Windows\System\AkygKrJ.exe
  2⤵
  PID:6444
- C:\Windows\System\SnmpQxV.exe
  C:\Windows\System\SnmpQxV.exe
  2⤵
  PID:6692
- C:\Windows\System\spLUKWC.exe
  C:\Windows\System\spLUKWC.exe
  2⤵
  PID:6768
- C:\Windows\System\ZxtfUbT.exe
  C:\Windows\System\ZxtfUbT.exe
  2⤵
  PID:6848
- C:\Windows\System\vosYQRZ.exe
  C:\Windows\System\vosYQRZ.exe
  2⤵
  PID:7052
- C:\Windows\System\uItSvQJ.exe
  C:\Windows\System\uItSvQJ.exe
  2⤵
  PID:1664
- C:\Windows\System\wwCACei.exe
  C:\Windows\System\wwCACei.exe
  2⤵
  PID:400
- C:\Windows\System\taSHiCC.exe
  C:\Windows\System\taSHiCC.exe
  2⤵
  PID:6884
- C:\Windows\System\qfVQGCP.exe
  C:\Windows\System\qfVQGCP.exe
  2⤵
  PID:6960
- C:\Windows\System\fxWkhMd.exe
  C:\Windows\System\fxWkhMd.exe
  2⤵
  PID:6456
- C:\Windows\System\LvEYskW.exe
  C:\Windows\System\LvEYskW.exe
  2⤵
  PID:908
- C:\Windows\System\rWKlmAM.exe
  C:\Windows\System\rWKlmAM.exe
  2⤵
  PID:6840
- C:\Windows\System\NGrZxQq.exe
  C:\Windows\System\NGrZxQq.exe
  2⤵
  PID:7136
- C:\Windows\System\jqKZkHQ.exe
  C:\Windows\System\jqKZkHQ.exe
  2⤵
  PID:7196
- C:\Windows\System\YIcqLOB.exe
  C:\Windows\System\YIcqLOB.exe
  2⤵
  PID:7216
- C:\Windows\System\GTlMkcf.exe
  C:\Windows\System\GTlMkcf.exe
  2⤵
  PID:7292
- C:\Windows\System\RxeiZiK.exe
  C:\Windows\System\RxeiZiK.exe
  2⤵
  PID:7312
- C:\Windows\System\eJXUVTm.exe
  C:\Windows\System\eJXUVTm.exe
  2⤵
  PID:7372
- C:\Windows\System\uOyKXob.exe
  C:\Windows\System\uOyKXob.exe
  2⤵
  PID:7388
- C:\Windows\System\KPmOweN.exe
  C:\Windows\System\KPmOweN.exe
  2⤵
  PID:7432
- C:\Windows\System\bslAoXk.exe
  C:\Windows\System\bslAoXk.exe
  2⤵
  PID:7448
- C:\Windows\System\ssdoJpR.exe
  C:\Windows\System\ssdoJpR.exe
  2⤵
  PID:7468
- C:\Windows\System\FDOcTgO.exe
  C:\Windows\System\FDOcTgO.exe
  2⤵
  PID:7504
- C:\Windows\System\QUFIIYz.exe
  C:\Windows\System\QUFIIYz.exe
  2⤵
  PID:7524
- C:\Windows\System\ZdXpGae.exe
  C:\Windows\System\ZdXpGae.exe
  2⤵
  PID:7540
- C:\Windows\System\ilWwMrk.exe
  C:\Windows\System\ilWwMrk.exe
  2⤵
  PID:7576
- C:\Windows\System\qewfBdJ.exe
  C:\Windows\System\qewfBdJ.exe
  2⤵
  PID:7592
- C:\Windows\System\IbQDIHC.exe
  C:\Windows\System\IbQDIHC.exe
  2⤵
  PID:7656
- C:\Windows\System\seRTcrC.exe
  C:\Windows\System\seRTcrC.exe
  2⤵
  PID:7724
- C:\Windows\System\soMugWf.exe
  C:\Windows\System\soMugWf.exe
  2⤵
  PID:7744
- C:\Windows\System\EVzSljD.exe
  C:\Windows\System\EVzSljD.exe
  2⤵
  PID:7816
- C:\Windows\System\qDFgPsT.exe
  C:\Windows\System\qDFgPsT.exe
  2⤵
  PID:7836
- C:\Windows\System\CCGjWmO.exe
  C:\Windows\System\CCGjWmO.exe
  2⤵
  PID:7852
- C:\Windows\System\OEZLcFI.exe
  C:\Windows\System\OEZLcFI.exe
  2⤵
  PID:7900
- C:\Windows\System\mFJwQom.exe
  C:\Windows\System\mFJwQom.exe
  2⤵
  PID:7940
- C:\Windows\System\TQzQKAS.exe
  C:\Windows\System\TQzQKAS.exe
  2⤵
  PID:7956
- C:\Windows\System\yISGcgc.exe
  C:\Windows\System\yISGcgc.exe
  2⤵
  PID:7976
- C:\Windows\System\aQrKYjR.exe
  C:\Windows\System\aQrKYjR.exe
  2⤵
  PID:8000
- C:\Windows\System\fopxegd.exe
  C:\Windows\System\fopxegd.exe
  2⤵
  PID:8052
- C:\Windows\System\FfTCiSN.exe
  C:\Windows\System\FfTCiSN.exe
  2⤵
  PID:8096
- C:\Windows\System\FQhhuoZ.exe
  C:\Windows\System\FQhhuoZ.exe
  2⤵
  PID:8144
- C:\Windows\System\sNcXsTE.exe
  C:\Windows\System\sNcXsTE.exe
  2⤵
  PID:6408
- C:\Windows\System\YttCkBk.exe
  C:\Windows\System\YttCkBk.exe
  2⤵
  PID:7244
- C:\Windows\System\zICzSos.exe
  C:\Windows\System\zICzSos.exe
  2⤵
  PID:7208
- C:\Windows\System\lQUrMJD.exe
  C:\Windows\System\lQUrMJD.exe
  2⤵
  PID:7352
- C:\Windows\System\eJsXePI.exe
  C:\Windows\System\eJsXePI.exe
  2⤵
  PID:7420
- C:\Windows\System\SSbZXRm.exe
  C:\Windows\System\SSbZXRm.exe
  2⤵
  PID:7384
- C:\Windows\System\QvvfHBD.exe
  C:\Windows\System\QvvfHBD.exe
  2⤵
  PID:7464
- C:\Windows\System\cPWXJhd.exe
  C:\Windows\System\cPWXJhd.exe
  2⤵
  PID:7516
- C:\Windows\System\hBCTyeD.exe
  C:\Windows\System\hBCTyeD.exe
  2⤵
  PID:7476
- C:\Windows\System\XOFyNxL.exe
  C:\Windows\System\XOFyNxL.exe
  2⤵
  PID:7560
- C:\Windows\System\fgLOSoG.exe
  C:\Windows\System\fgLOSoG.exe
  2⤵
  PID:7752
- C:\Windows\System\kLakWDR.exe
  C:\Windows\System\kLakWDR.exe
  2⤵
  PID:7708
- C:\Windows\System\oObpWCt.exe
  C:\Windows\System\oObpWCt.exe
  2⤵
  PID:7828
- C:\Windows\System\FFmnoOg.exe
  C:\Windows\System\FFmnoOg.exe
  2⤵
  PID:7876
- C:\Windows\System\AEoOEKW.exe
  C:\Windows\System\AEoOEKW.exe
  2⤵
  PID:8032
- C:\Windows\System\UASbnWy.exe
  C:\Windows\System\UASbnWy.exe
  2⤵
  PID:8140
- C:\Windows\System\yLnaqGo.exe
  C:\Windows\System\yLnaqGo.exe
  2⤵
  PID:8180
- C:\Windows\System\OyevIsb.exe
  C:\Windows\System\OyevIsb.exe
  2⤵
  PID:7256
- C:\Windows\System\VXJYioF.exe
  C:\Windows\System\VXJYioF.exe
  2⤵
  PID:7176
- C:\Windows\System\YrgTjMn.exe
  C:\Windows\System\YrgTjMn.exe
  2⤵
  PID:7344
- C:\Windows\System\MqxJjkX.exe
  C:\Windows\System\MqxJjkX.exe
  2⤵
  PID:7276
- C:\Windows\System\RckPUGI.exe
  C:\Windows\System\RckPUGI.exe
  2⤵
  PID:7532
- C:\Windows\System\JlKIwbr.exe
  C:\Windows\System\JlKIwbr.exe
  2⤵
  PID:7500
- C:\Windows\System\ydnarVw.exe
  C:\Windows\System\ydnarVw.exe
  2⤵
  PID:7860
- C:\Windows\System\QgXHJim.exe
  C:\Windows\System\QgXHJim.exe
  2⤵
  PID:7884
- C:\Windows\System\mdoMpFs.exe
  C:\Windows\System\mdoMpFs.exe
  2⤵
  PID:7920
- C:\Windows\System\InobFIx.exe
  C:\Windows\System\InobFIx.exe
  2⤵
  PID:8048
- C:\Windows\System\yDDJYgT.exe
  C:\Windows\System\yDDJYgT.exe
  2⤵
  PID:6704
- C:\Windows\System\dLBXrEX.exe
  C:\Windows\System\dLBXrEX.exe
  2⤵
  PID:7440
- C:\Windows\System\ySIRMWR.exe
  C:\Windows\System\ySIRMWR.exe
  2⤵
  PID:7460
- C:\Windows\System\OHRPAFV.exe
  C:\Windows\System\OHRPAFV.exe
  2⤵
  PID:7684
- C:\Windows\System\ybJzsfA.exe
  C:\Windows\System\ybJzsfA.exe
  2⤵
  PID:7760
- C:\Windows\System\afHbxeE.exe
  C:\Windows\System\afHbxeE.exe
  2⤵
  PID:7916
- C:\Windows\System\LunSSgr.exe
  C:\Windows\System\LunSSgr.exe
  2⤵
  PID:7996
- C:\Windows\System\rYyYYrH.exe
  C:\Windows\System\rYyYYrH.exe
  2⤵
  PID:8160
- C:\Windows\System\GKBfQCR.exe
  C:\Windows\System\GKBfQCR.exe
  2⤵
  PID:8012
- C:\Windows\System\uwiWZZs.exe
  C:\Windows\System\uwiWZZs.exe
  2⤵
  PID:8240
- C:\Windows\System\EMmjQjq.exe
  C:\Windows\System\EMmjQjq.exe
  2⤵
  PID:8280
- C:\Windows\System\jszlaKc.exe
  C:\Windows\System\jszlaKc.exe
  2⤵
  PID:8296
- C:\Windows\System\VVwUIVT.exe
  C:\Windows\System\VVwUIVT.exe
  2⤵
  PID:8312
- C:\Windows\System\iPhStQV.exe
  C:\Windows\System\iPhStQV.exe
  2⤵
  PID:8364
- C:\Windows\System\EmYkQpK.exe
  C:\Windows\System\EmYkQpK.exe
  2⤵
  PID:8380
- C:\Windows\System\mzZKbLl.exe
  C:\Windows\System\mzZKbLl.exe
  2⤵
  PID:8404
- C:\Windows\System\PfZjvvU.exe
  C:\Windows\System\PfZjvvU.exe
  2⤵
  PID:8424
- C:\Windows\System\EegCafP.exe
  C:\Windows\System\EegCafP.exe
  2⤵
  PID:8488
- C:\Windows\System\LebwayN.exe
  C:\Windows\System\LebwayN.exe
  2⤵
  PID:8508
- C:\Windows\System\cCRjJBx.exe
  C:\Windows\System\cCRjJBx.exe
  2⤵
  PID:8540
- C:\Windows\System\YQVzUcF.exe
  C:\Windows\System\YQVzUcF.exe
  2⤵
  PID:8560
- C:\Windows\System\SJXiBMD.exe
  C:\Windows\System\SJXiBMD.exe
  2⤵
  PID:8576
- C:\Windows\System\mzGbDKn.exe
  C:\Windows\System\mzGbDKn.exe
  2⤵
  PID:8596
- C:\Windows\System\BzZvcMj.exe
  C:\Windows\System\BzZvcMj.exe
  2⤵
  PID:8616
- C:\Windows\System\fKNEqZf.exe
  C:\Windows\System\fKNEqZf.exe
  2⤵
  PID:8684
- C:\Windows\System\DcPTJsS.exe
  C:\Windows\System\DcPTJsS.exe
  2⤵
  PID:8708
- C:\Windows\System\bRfdalj.exe
  C:\Windows\System\bRfdalj.exe
  2⤵
  PID:8732
- C:\Windows\System\rqCmBqn.exe
  C:\Windows\System\rqCmBqn.exe
  2⤵
  PID:8820
- C:\Windows\System\yKfMhMD.exe
  C:\Windows\System\yKfMhMD.exe
  2⤵
  PID:8844
- C:\Windows\System\xfDQlRe.exe
  C:\Windows\System\xfDQlRe.exe
  2⤵
  PID:8864
- C:\Windows\System\AXiGRRA.exe
  C:\Windows\System\AXiGRRA.exe
  2⤵
  PID:8892
- C:\Windows\System\ivENErk.exe
  C:\Windows\System\ivENErk.exe
  2⤵
  PID:8912
- C:\Windows\System\SdxQupH.exe
  C:\Windows\System\SdxQupH.exe
  2⤵
  PID:8972
- C:\Windows\System\QDoPIAx.exe
  C:\Windows\System\QDoPIAx.exe
  2⤵
  PID:9028
- C:\Windows\System\ytPJUTF.exe
  C:\Windows\System\ytPJUTF.exe
  2⤵
  PID:9064
- C:\Windows\System\RwbOINb.exe
  C:\Windows\System\RwbOINb.exe
  2⤵
  PID:9092
- C:\Windows\System\QhHutep.exe
  C:\Windows\System\QhHutep.exe
  2⤵
  PID:9108
- C:\Windows\System\rrvbZBq.exe
  C:\Windows\System\rrvbZBq.exe
  2⤵
  PID:9148
- C:\Windows\System\eqmdlqA.exe
  C:\Windows\System\eqmdlqA.exe
  2⤵
  PID:9168
- C:\Windows\System\whDprTM.exe
  C:\Windows\System\whDprTM.exe
  2⤵
  PID:9184
- C:\Windows\System\ZDrBrUs.exe
  C:\Windows\System\ZDrBrUs.exe
  2⤵
  PID:7616
- C:\Windows\System\OxDhEMx.exe
  C:\Windows\System\OxDhEMx.exe
  2⤵
  PID:8308
- C:\Windows\System\mnrINfi.exe
  C:\Windows\System\mnrINfi.exe
  2⤵
  PID:8228
- C:\Windows\System\CGRGzdE.exe
  C:\Windows\System\CGRGzdE.exe
  2⤵
  PID:8344
- C:\Windows\System\axwwXjv.exe
  C:\Windows\System\axwwXjv.exe
  2⤵
  PID:8260
- C:\Windows\System\DPcINfH.exe
  C:\Windows\System\DPcINfH.exe
  2⤵
  PID:8292
- C:\Windows\System\CcTGcRK.exe
  C:\Windows\System\CcTGcRK.exe
  2⤵
  PID:8456
- C:\Windows\System\PpoHZax.exe
  C:\Windows\System\PpoHZax.exe
  2⤵
  PID:8472
- C:\Windows\System\xTWEuuB.exe
  C:\Windows\System\xTWEuuB.exe
  2⤵
  PID:8552
- C:\Windows\System\qQQrTUR.exe
  C:\Windows\System\qQQrTUR.exe
  2⤵
  PID:8668
- C:\Windows\System\QaXuCwM.exe
  C:\Windows\System\QaXuCwM.exe
  2⤵
  PID:8676
- C:\Windows\System\jixpxdG.exe
  C:\Windows\System\jixpxdG.exe
  2⤵
  PID:8716
- C:\Windows\System\bZzdpxR.exe
  C:\Windows\System\bZzdpxR.exe
  2⤵
  PID:8836
- C:\Windows\System\mDOQYFK.exe
  C:\Windows\System\mDOQYFK.exe
  2⤵
  PID:8856
- C:\Windows\System\ZSyvmFD.exe
  C:\Windows\System\ZSyvmFD.exe
  2⤵
  PID:8888
- C:\Windows\System\gqTXdxL.exe
  C:\Windows\System\gqTXdxL.exe
  2⤵
  PID:8932
- C:\Windows\System\WbYtECS.exe
  C:\Windows\System\WbYtECS.exe
  2⤵
  PID:9052
- C:\Windows\System\cMfYyhr.exe
  C:\Windows\System\cMfYyhr.exe
  2⤵
  PID:9140
- C:\Windows\System\zQPXdNf.exe
  C:\Windows\System\zQPXdNf.exe
  2⤵
  PID:9192
- C:\Windows\System\iOaIMno.exe
  C:\Windows\System\iOaIMno.exe
  2⤵
  PID:8212
- C:\Windows\System\rsURtSS.exe
  C:\Windows\System\rsURtSS.exe
  2⤵
  PID:8272
- C:\Windows\System\tyQrsRJ.exe
  C:\Windows\System\tyQrsRJ.exe
  2⤵
  PID:8444
- C:\Windows\System\stInLUi.exe
  C:\Windows\System\stInLUi.exe
  2⤵
  PID:8448
- C:\Windows\System\XbPujUT.exe
  C:\Windows\System\XbPujUT.exe
  2⤵
  PID:8624
- C:\Windows\System\CdKVonO.exe
  C:\Windows\System\CdKVonO.exe
  2⤵
  PID:8700
- C:\Windows\System\BqMofCR.exe
  C:\Windows\System\BqMofCR.exe
  2⤵
  PID:8748
- C:\Windows\System\biDQlFa.exe
  C:\Windows\System\biDQlFa.exe
  2⤵
  PID:8880
- C:\Windows\System\dMCsCMZ.exe
  C:\Windows\System\dMCsCMZ.exe
  2⤵
  PID:8928
- C:\Windows\System\thSNwyj.exe
  C:\Windows\System\thSNwyj.exe
  2⤵
  PID:9076
- C:\Windows\System\COgrmim.exe
  C:\Windows\System\COgrmim.exe
  2⤵
  PID:8256
- C:\Windows\System\nbhtKdl.exe
  C:\Windows\System\nbhtKdl.exe
  2⤵
  PID:8572
- C:\Windows\System\aPPmDOd.exe
  C:\Windows\System\aPPmDOd.exe
  2⤵
  PID:8504
- C:\Windows\System\RlJBTVB.exe
  C:\Windows\System\RlJBTVB.exe
  2⤵
  PID:9072
- C:\Windows\System\fRwaJYZ.exe
  C:\Windows\System\fRwaJYZ.exe
  2⤵
  PID:8248
- C:\Windows\System\QNAbDCK.exe
  C:\Windows\System\QNAbDCK.exe
  2⤵
  PID:9224
- C:\Windows\System\aFQjQxa.exe
  C:\Windows\System\aFQjQxa.exe
  2⤵
  PID:9244
- C:\Windows\System\RmGhxHe.exe
  C:\Windows\System\RmGhxHe.exe
  2⤵
  PID:9344
- C:\Windows\System\AHsuGtO.exe
  C:\Windows\System\AHsuGtO.exe
  2⤵
  PID:9420
- C:\Windows\System\MJRlpCy.exe
  C:\Windows\System\MJRlpCy.exe
  2⤵
  PID:9448
- C:\Windows\System\qIJBXvb.exe
  C:\Windows\System\qIJBXvb.exe
  2⤵
  PID:9472
- C:\Windows\System\RpMBhpA.exe
  C:\Windows\System\RpMBhpA.exe
  2⤵
  PID:9496
- C:\Windows\System\tPywPOm.exe
  C:\Windows\System\tPywPOm.exe
  2⤵
  PID:9544
- C:\Windows\System\AexayTy.exe
  C:\Windows\System\AexayTy.exe
  2⤵
  PID:9580
- C:\Windows\System\VnsnNEG.exe
  C:\Windows\System\VnsnNEG.exe
  2⤵
  PID:9604
- C:\Windows\System\iVYWjJA.exe
  C:\Windows\System\iVYWjJA.exe
  2⤵
  PID:9620
- C:\Windows\System\CxQyMIN.exe
  C:\Windows\System\CxQyMIN.exe
  2⤵
  PID:9640
- C:\Windows\System\rfQjxZm.exe
  C:\Windows\System\rfQjxZm.exe
  2⤵
  PID:9692
- C:\Windows\System\SxQUCvC.exe
  C:\Windows\System\SxQUCvC.exe
  2⤵
  PID:9708
- C:\Windows\System\pyjtXUh.exe
  C:\Windows\System\pyjtXUh.exe
  2⤵
  PID:9732
- C:\Windows\System\HjMvZcq.exe
  C:\Windows\System\HjMvZcq.exe
  2⤵
  PID:9784
- C:\Windows\System\WNkSwqR.exe
  C:\Windows\System\WNkSwqR.exe
  2⤵
  PID:9824
- C:\Windows\System\xwWLris.exe
  C:\Windows\System\xwWLris.exe
  2⤵
  PID:9876
- C:\Windows\System\xLpXGpK.exe
  C:\Windows\System\xLpXGpK.exe
  2⤵
  PID:9896
- C:\Windows\System\PXMDiwf.exe
  C:\Windows\System\PXMDiwf.exe
  2⤵
  PID:9916
- C:\Windows\System\nnpURjL.exe
  C:\Windows\System\nnpURjL.exe
  2⤵
  PID:9940
- C:\Windows\System\dXNdHNJ.exe
  C:\Windows\System\dXNdHNJ.exe
  2⤵
  PID:9956
- C:\Windows\System\rRuvIHC.exe
  C:\Windows\System\rRuvIHC.exe
  2⤵
  PID:10012
- C:\Windows\System\wJYcHaO.exe
  C:\Windows\System\wJYcHaO.exe
  2⤵
  PID:10036
- C:\Windows\System\hDmHLWU.exe
  C:\Windows\System\hDmHLWU.exe
  2⤵
  PID:10056
- C:\Windows\System\iwuHOtI.exe
  C:\Windows\System\iwuHOtI.exe
  2⤵
  PID:10100
- C:\Windows\System\PDOJGjo.exe
  C:\Windows\System\PDOJGjo.exe
  2⤵
  PID:10132
- C:\Windows\System\aXrwjPb.exe
  C:\Windows\System\aXrwjPb.exe
  2⤵
  PID:10188
- C:\Windows\System\SXAMWfA.exe
  C:\Windows\System\SXAMWfA.exe
  2⤵
  PID:10216
- C:\Windows\System\Rushtyn.exe
  C:\Windows\System\Rushtyn.exe
  2⤵
  PID:10236
- C:\Windows\System\WyhzFIe.exe
  C:\Windows\System\WyhzFIe.exe
  2⤵
  PID:8720
- C:\Windows\System\IgZIrKe.exe
  C:\Windows\System\IgZIrKe.exe
  2⤵
  PID:9060
- C:\Windows\System\BwgVEQh.exe
  C:\Windows\System\BwgVEQh.exe
  2⤵
  PID:9308
- C:\Windows\System\REtejXC.exe
  C:\Windows\System\REtejXC.exe
  2⤵
  PID:9220
- C:\Windows\System\DxSzKdI.exe
  C:\Windows\System\DxSzKdI.exe
  2⤵
  PID:9360
- C:\Windows\System\XxwclfJ.exe
  C:\Windows\System\XxwclfJ.exe
  2⤵
  PID:9232
- C:\Windows\System\jcaGmZm.exe
  C:\Windows\System\jcaGmZm.exe
  2⤵
  PID:9416
- C:\Windows\System\LeeeCMO.exe
  C:\Windows\System\LeeeCMO.exe
  2⤵
  PID:344
- C:\Windows\System\YHEJGHJ.exe
  C:\Windows\System\YHEJGHJ.exe
  2⤵
  PID:9508
- C:\Windows\System\eZDRHDO.exe
  C:\Windows\System\eZDRHDO.exe
  2⤵
  PID:9832
- C:\Windows\System\bcSzixb.exe
  C:\Windows\System\bcSzixb.exe
  2⤵
  PID:9932
- C:\Windows\System\jCegZQy.exe
  C:\Windows\System\jCegZQy.exe
  2⤵
  PID:9980
- C:\Windows\System\hKEWSgK.exe
  C:\Windows\System\hKEWSgK.exe
  2⤵
  PID:10032
- C:\Windows\System\uIytsvI.exe
  C:\Windows\System\uIytsvI.exe
  2⤵
  PID:10052
- C:\Windows\System\lqUTngw.exe
  C:\Windows\System\lqUTngw.exe
  2⤵
  PID:10140
- C:\Windows\System\POiPBwb.exe
  C:\Windows\System\POiPBwb.exe
  2⤵
  PID:10168
- C:\Windows\System\mHIGepm.exe
  C:\Windows\System\mHIGepm.exe
  2⤵
  PID:10224
- C:\Windows\System\NAjScHf.exe
  C:\Windows\System\NAjScHf.exe
  2⤵
  PID:1596
- C:\Windows\System\OcmRood.exe
  C:\Windows\System\OcmRood.exe
  2⤵
  PID:9256
- C:\Windows\System\NhlszJN.exe
  C:\Windows\System\NhlszJN.exe
  2⤵
  PID:9276
- C:\Windows\System\gEyTUbD.exe
  C:\Windows\System\gEyTUbD.exe
  2⤵
  PID:9296
- C:\Windows\System\xAXFIYr.exe
  C:\Windows\System\xAXFIYr.exe
  2⤵
  PID:9588
- C:\Windows\System\hfDfCJl.exe
  C:\Windows\System\hfDfCJl.exe
  2⤵
  PID:9700
- C:\Windows\System\iwfDYQj.exe
  C:\Windows\System\iwfDYQj.exe
  2⤵
  PID:9776
- C:\Windows\System\AXjqQwu.exe
  C:\Windows\System\AXjqQwu.exe
  2⤵
  PID:9432
- C:\Windows\System\YEtdOYk.exe
  C:\Windows\System\YEtdOYk.exe
  2⤵
  PID:9724
- C:\Windows\System\cKiuvGi.exe
  C:\Windows\System\cKiuvGi.exe
  2⤵
  PID:3952
- C:\Windows\System\BHukzlp.exe
  C:\Windows\System\BHukzlp.exe
  2⤵
  PID:10096
- C:\Windows\System\kYbRmsG.exe
  C:\Windows\System\kYbRmsG.exe
  2⤵
  PID:9904
- C:\Windows\System\ICmhlpW.exe
  C:\Windows\System\ICmhlpW.exe
  2⤵
  PID:8420
- C:\Windows\System\CXZUHLk.exe
  C:\Windows\System\CXZUHLk.exe
  2⤵
  PID:10072
- C:\Windows\System\NHZhIBt.exe
  C:\Windows\System\NHZhIBt.exe
  2⤵
  PID:9284
- C:\Windows\System\lbUwNGV.exe
  C:\Windows\System\lbUwNGV.exe
  2⤵
  PID:10184
- C:\Windows\System\COyrxVG.exe
  C:\Windows\System\COyrxVG.exe
  2⤵
  PID:9324
- C:\Windows\System\LnEhfsc.exe
  C:\Windows\System\LnEhfsc.exe
  2⤵
  PID:9400
- C:\Windows\System\mEkklFk.exe
  C:\Windows\System\mEkklFk.exe
  2⤵
  PID:10248
- C:\Windows\System\UsNXXod.exe
  C:\Windows\System\UsNXXod.exe
  2⤵
  PID:10264
- C:\Windows\System\vszdBwx.exe
  C:\Windows\System\vszdBwx.exe
  2⤵
  PID:10280
- C:\Windows\System\ybkThyC.exe
  C:\Windows\System\ybkThyC.exe
  2⤵
  PID:10296
- C:\Windows\System\uCVloiL.exe
  C:\Windows\System\uCVloiL.exe
  2⤵
  PID:10316
- C:\Windows\System\UamUSMp.exe
  C:\Windows\System\UamUSMp.exe
  2⤵
  PID:10340
- C:\Windows\System\DQTObZt.exe
  C:\Windows\System\DQTObZt.exe
  2⤵
  PID:10360
- C:\Windows\System\VzgxFYS.exe
  C:\Windows\System\VzgxFYS.exe
  2⤵
  PID:10424
- C:\Windows\System\wfaqVMZ.exe
  C:\Windows\System\wfaqVMZ.exe
  2⤵
  PID:10484
- C:\Windows\System\kzzgURA.exe
  C:\Windows\System\kzzgURA.exe
  2⤵
  PID:10512
- C:\Windows\System\WSWcMcW.exe
  C:\Windows\System\WSWcMcW.exe
  2⤵
  PID:10536
- C:\Windows\System\WjHvact.exe
  C:\Windows\System\WjHvact.exe
  2⤵
  PID:10556
- C:\Windows\System\fnCAlKU.exe
  C:\Windows\System\fnCAlKU.exe
  2⤵
  PID:10788
- C:\Windows\System\PVfXpjT.exe
  C:\Windows\System\PVfXpjT.exe
  2⤵
  PID:10808
- C:\Windows\System\VyUoFtj.exe
  C:\Windows\System\VyUoFtj.exe
  2⤵
  PID:10836
- C:\Windows\System\QuJRvmK.exe
  C:\Windows\System\QuJRvmK.exe
  2⤵
  PID:10856
- C:\Windows\System\xFEhgWp.exe
  C:\Windows\System\xFEhgWp.exe
  2⤵
  PID:10892
- C:\Windows\System\cSbwMJA.exe
  C:\Windows\System\cSbwMJA.exe
  2⤵
  PID:10916
- C:\Windows\System\qFnwWGG.exe
  C:\Windows\System\qFnwWGG.exe
  2⤵
  PID:10940
- C:\Windows\System\VjPCtOq.exe
  C:\Windows\System\VjPCtOq.exe
  2⤵
  PID:10968
- C:\Windows\System\HJkbxOw.exe
  C:\Windows\System\HJkbxOw.exe
  2⤵
  PID:10996
- C:\Windows\System\GwDaRCO.exe
  C:\Windows\System\GwDaRCO.exe
  2⤵
  PID:11040
- C:\Windows\System\pKGhLZs.exe
  C:\Windows\System\pKGhLZs.exe
  2⤵
  PID:11064
- C:\Windows\System\ofSzsHd.exe
  C:\Windows\System\ofSzsHd.exe
  2⤵
  PID:11088
- C:\Windows\System\xLDPrzn.exe
  C:\Windows\System\xLDPrzn.exe
  2⤵
  PID:11116
- C:\Windows\System\aSxScPN.exe
  C:\Windows\System\aSxScPN.exe
  2⤵
  PID:11136
- C:\Windows\System\JEPAbAu.exe
  C:\Windows\System\JEPAbAu.exe
  2⤵
  PID:11156
- C:\Windows\System\fPmnOyS.exe
  C:\Windows\System\fPmnOyS.exe
  2⤵
  PID:11172
- C:\Windows\System\OZKAkfo.exe
  C:\Windows\System\OZKAkfo.exe
  2⤵
  PID:11196
- C:\Windows\System\BMpSMBR.exe
  C:\Windows\System\BMpSMBR.exe
  2⤵
  PID:11248
- C:\Windows\System\IWenIdP.exe
  C:\Windows\System\IWenIdP.exe
  2⤵
  PID:9540
- C:\Windows\System\YzeXSAy.exe
  C:\Windows\System\YzeXSAy.exe
  2⤵
  PID:9652
- C:\Windows\System\yxMqaKw.exe
  C:\Windows\System\yxMqaKw.exe
  2⤵
  PID:9688
- C:\Windows\System\ECCFDZI.exe
  C:\Windows\System\ECCFDZI.exe
  2⤵
  PID:9236
- C:\Windows\System\nBjNLOq.exe
  C:\Windows\System\nBjNLOq.exe
  2⤵
  PID:9976
- C:\Windows\System\CsBGYvP.exe
  C:\Windows\System\CsBGYvP.exe
  2⤵
  PID:10024
- C:\Windows\System\qhosxlG.exe
  C:\Windows\System\qhosxlG.exe
  2⤵
  PID:2352
- C:\Windows\System\MexOdAT.exe
  C:\Windows\System\MexOdAT.exe
  2⤵
  PID:10260
- C:\Windows\System\ApJvDYf.exe
  C:\Windows\System\ApJvDYf.exe
  2⤵
  PID:4008
- C:\Windows\System\moUBDpM.exe
  C:\Windows\System\moUBDpM.exe
  2⤵
  PID:9756
- C:\Windows\System\welkhZv.exe
  C:\Windows\System\welkhZv.exe
  2⤵
  PID:10396
- C:\Windows\System\qRlcQKO.exe
  C:\Windows\System\qRlcQKO.exe
  2⤵
  PID:10420
- C:\Windows\System\eWCAdXk.exe
  C:\Windows\System\eWCAdXk.exe
  2⤵
  PID:10476
- C:\Windows\System\ihFvskB.exe
  C:\Windows\System\ihFvskB.exe
  2⤵
  PID:10496
- C:\Windows\System\OHxqnqK.exe
  C:\Windows\System\OHxqnqK.exe
  2⤵
  PID:10548
- C:\Windows\System\EVOgnar.exe
  C:\Windows\System\EVOgnar.exe
  2⤵
  PID:10636
- C:\Windows\System\AoKNeyg.exe
  C:\Windows\System\AoKNeyg.exe
  2⤵
  PID:10740
- C:\Windows\System\AayJdeF.exe
  C:\Windows\System\AayJdeF.exe
  2⤵
  PID:10780
- C:\Windows\System\pETXyoa.exe
  C:\Windows\System\pETXyoa.exe
  2⤵
  PID:10820
- C:\Windows\System\NZEHiGu.exe
  C:\Windows\System\NZEHiGu.exe
  2⤵
  PID:10880
- C:\Windows\System\VMdZKeP.exe
  C:\Windows\System\VMdZKeP.exe
  2⤵
  PID:10904
- C:\Windows\System\TMYfAbt.exe
  C:\Windows\System\TMYfAbt.exe
  2⤵
  PID:10976
- C:\Windows\System\AuMyuix.exe
  C:\Windows\System\AuMyuix.exe
  2⤵
  PID:11060
- C:\Windows\System\knmqHdi.exe
  C:\Windows\System\knmqHdi.exe
  2⤵
  PID:11240
- C:\Windows\System\LxYOJco.exe
  C:\Windows\System\LxYOJco.exe
  2⤵
  PID:2596
- C:\Windows\System\dkSBCXp.exe
  C:\Windows\System\dkSBCXp.exe
  2⤵
  PID:3732
- C:\Windows\System\LGBsAzu.exe
  C:\Windows\System\LGBsAzu.exe
  2⤵
  PID:10244
- C:\Windows\System\aLhTlKK.exe
  C:\Windows\System\aLhTlKK.exe
  2⤵
  PID:9512
- C:\Windows\System\HzRWqkE.exe
  C:\Windows\System\HzRWqkE.exe
  2⤵
  PID:10576
- C:\Windows\System\GjsnrfU.exe
  C:\Windows\System\GjsnrfU.exe
  2⤵
  PID:10504
- C:\Windows\System\TsciGSI.exe
  C:\Windows\System\TsciGSI.exe
  2⤵
  PID:10776
- C:\Windows\System\HcGSrHi.exe
  C:\Windows\System\HcGSrHi.exe
  2⤵
  PID:10908
- C:\Windows\System\GxWsdKQ.exe
  C:\Windows\System\GxWsdKQ.exe
  2⤵
  PID:10932
- C:\Windows\System\lmIgtyE.exe
  C:\Windows\System\lmIgtyE.exe
  2⤵
  PID:11032
- C:\Windows\System\grGCeqS.exe
  C:\Windows\System\grGCeqS.exe
  2⤵
  PID:10004
- C:\Windows\System\jLxUnIF.exe
  C:\Windows\System\jLxUnIF.exe
  2⤵
  PID:10324
- C:\Windows\System\hPjRmPg.exe
  C:\Windows\System\hPjRmPg.exe
  2⤵
  PID:10412
- C:\Windows\System\uQSZBCf.exe
  C:\Windows\System\uQSZBCf.exe
  2⤵
  PID:11124
- C:\Windows\System\daBnUsP.exe
  C:\Windows\System\daBnUsP.exe
  2⤵
  PID:10616
- C:\Windows\System\KPSPzIu.exe
  C:\Windows\System\KPSPzIu.exe
  2⤵
  PID:10524
- C:\Windows\System\UkLoLyd.exe
  C:\Windows\System\UkLoLyd.exe
  2⤵
  PID:11272
- C:\Windows\System\pRXHZMc.exe
  C:\Windows\System\pRXHZMc.exe
  2⤵
  PID:11300
- C:\Windows\System\kPeelZE.exe
  C:\Windows\System\kPeelZE.exe
  2⤵
  PID:11320
- C:\Windows\System\VbLjXhw.exe
  C:\Windows\System\VbLjXhw.exe
  2⤵
  PID:11336
- C:\Windows\System\VxJMuKN.exe
  C:\Windows\System\VxJMuKN.exe
  2⤵
  PID:11420
- C:\Windows\System\uVGPztU.exe
  C:\Windows\System\uVGPztU.exe
  2⤵
  PID:11444
- C:\Windows\System\zjWqmUs.exe
  C:\Windows\System\zjWqmUs.exe
  2⤵
  PID:11472
- C:\Windows\System\EDHAdsW.exe
  C:\Windows\System\EDHAdsW.exe
  2⤵
  PID:11492
- C:\Windows\System\RPjJFiw.exe
  C:\Windows\System\RPjJFiw.exe
  2⤵
  PID:11508
- C:\Windows\System\tlbiFeN.exe
  C:\Windows\System\tlbiFeN.exe
  2⤵
  PID:11564
- C:\Windows\System\qWdndMD.exe
  C:\Windows\System\qWdndMD.exe
  2⤵
  PID:11600
- C:\Windows\System\vJaPlEg.exe
  C:\Windows\System\vJaPlEg.exe
  2⤵
  PID:11636
- C:\Windows\System\kzOrjEE.exe
  C:\Windows\System\kzOrjEE.exe
  2⤵
  PID:11660
- C:\Windows\System\XqXPFfm.exe
  C:\Windows\System\XqXPFfm.exe
  2⤵
  PID:11696
- C:\Windows\System\Zbfzzaa.exe
  C:\Windows\System\Zbfzzaa.exe
  2⤵
  PID:11728
- C:\Windows\System\ueuEuKX.exe
  C:\Windows\System\ueuEuKX.exe
  2⤵
  PID:11748
- C:\Windows\System\jzDypdG.exe
  C:\Windows\System\jzDypdG.exe
  2⤵
  PID:11764
- C:\Windows\System\jLuKiTZ.exe
  C:\Windows\System\jLuKiTZ.exe
  2⤵
  PID:11784
- C:\Windows\System\WxXonZy.exe
  C:\Windows\System\WxXonZy.exe
  2⤵
  PID:11816
- C:\Windows\System\RvydkSx.exe
  C:\Windows\System\RvydkSx.exe
  2⤵
  PID:11840
- C:\Windows\System\jGIJQlo.exe
  C:\Windows\System\jGIJQlo.exe
  2⤵
  PID:11860
- C:\Windows\System\GWKmeuo.exe
  C:\Windows\System\GWKmeuo.exe
  2⤵
  PID:11884
- C:\Windows\System\yBBseIw.exe
  C:\Windows\System\yBBseIw.exe
  2⤵
  PID:11900
- C:\Windows\System\SsowtXY.exe
  C:\Windows\System\SsowtXY.exe
  2⤵
  PID:11944
- C:\Windows\System\JnteiZG.exe
  C:\Windows\System\JnteiZG.exe
  2⤵
  PID:11964
- C:\Windows\System\XOQkIba.exe
  C:\Windows\System\XOQkIba.exe
  2⤵
  PID:12000
- C:\Windows\System\FWKeJer.exe
  C:\Windows\System\FWKeJer.exe
  2⤵
  PID:12020
- C:\Windows\System\IMSImVW.exe
  C:\Windows\System\IMSImVW.exe
  2⤵
  PID:12040
- C:\Windows\System\LubNqsC.exe
  C:\Windows\System\LubNqsC.exe
  2⤵
  PID:12092
- C:\Windows\System\CTqqemM.exe
  C:\Windows\System\CTqqemM.exe
  2⤵
  PID:12108
- C:\Windows\System\BhUHZRl.exe
  C:\Windows\System\BhUHZRl.exe
  2⤵
  PID:12136
- C:\Windows\System\WchXUTQ.exe
  C:\Windows\System\WchXUTQ.exe
  2⤵
  PID:12172
- C:\Windows\System\bESdrBm.exe
  C:\Windows\System\bESdrBm.exe
  2⤵
  PID:12188
- C:\Windows\System\kJAeSAL.exe
  C:\Windows\System\kJAeSAL.exe
  2⤵
  PID:12212
- C:\Windows\System\TlWzNiY.exe
  C:\Windows\System\TlWzNiY.exe
  2⤵
  PID:12228
- C:\Windows\System\UlAdjiV.exe
  C:\Windows\System\UlAdjiV.exe
  2⤵
  PID:12244
- C:\Windows\System\BJvCAzW.exe
  C:\Windows\System\BJvCAzW.exe
  2⤵
  PID:10720
- C:\Windows\System\lrRvJZn.exe
  C:\Windows\System\lrRvJZn.exe
  2⤵
  PID:11268
- C:\Windows\System\kaBnnYU.exe
  C:\Windows\System\kaBnnYU.exe
  2⤵
  PID:11328
- C:\Windows\System\HHSJwDY.exe
  C:\Windows\System\HHSJwDY.exe
  2⤵
  PID:11416
- C:\Windows\System\xvYojKi.exe
  C:\Windows\System\xvYojKi.exe
  2⤵
  PID:11480
- C:\Windows\System\ttOUnbr.exe
  C:\Windows\System\ttOUnbr.exe
  2⤵
  PID:11484
- C:\Windows\System\nGXHBsU.exe
  C:\Windows\System\nGXHBsU.exe
  2⤵
  PID:11596
- C:\Windows\System\mLbaNxA.exe
  C:\Windows\System\mLbaNxA.exe
  2⤵
  PID:11668
- C:\Windows\System\tRJXSnj.exe
  C:\Windows\System\tRJXSnj.exe
  2⤵
  PID:11876
- C:\Windows\System\uNATNyF.exe
  C:\Windows\System\uNATNyF.exe
  2⤵
  PID:11892
- C:\Windows\System\uFNjtkT.exe
  C:\Windows\System\uFNjtkT.exe
  2⤵
  PID:11952
- C:\Windows\System\hvdzSoj.exe
  C:\Windows\System\hvdzSoj.exe
  2⤵
  PID:11996
- C:\Windows\System\RZrgosE.exe
  C:\Windows\System\RZrgosE.exe
  2⤵
  PID:12144
- C:\Windows\System\FTrCbny.exe
  C:\Windows\System\FTrCbny.exe
  2⤵
  PID:12104
- C:\Windows\System\vUuxFyo.exe
  C:\Windows\System\vUuxFyo.exe
  2⤵
  PID:12184
- C:\Windows\System\tMPbynm.exe
  C:\Windows\System\tMPbynm.exe
  2⤵
  PID:12260
- C:\Windows\System\xGMpUeS.exe
  C:\Windows\System\xGMpUeS.exe
  2⤵
  PID:10824
- C:\Windows\System\viFbnLk.exe
  C:\Windows\System\viFbnLk.exe
  2⤵
  PID:2268
- C:\Windows\System\JbrqiiN.exe
  C:\Windows\System\JbrqiiN.exe
  2⤵
  PID:2452
- C:\Windows\System\PceVxib.exe
  C:\Windows\System\PceVxib.exe
  2⤵
  PID:4064
- C:\Windows\System\QMElApT.exe
  C:\Windows\System\QMElApT.exe
  2⤵
  PID:11812
- C:\Windows\System\sfAqwrI.exe
  C:\Windows\System\sfAqwrI.exe
  2⤵
  PID:11928
- C:\Windows\System\EJTAfEy.exe
  C:\Windows\System\EJTAfEy.exe
  2⤵
  PID:12016
- C:\Windows\System\ZTFXQsp.exe
  C:\Windows\System\ZTFXQsp.exe
  2⤵
  PID:12272
- C:\Windows\System\riUMwhk.exe
  C:\Windows\System\riUMwhk.exe
  2⤵
  PID:11364
- C:\Windows\System\bIKzYbp.exe
  C:\Windows\System\bIKzYbp.exe
  2⤵
  PID:11580
- C:\Windows\System\wmPsNSt.exe
  C:\Windows\System\wmPsNSt.exe
  2⤵
  PID:11296
- C:\Windows\System\AGNhYRV.exe
  C:\Windows\System\AGNhYRV.exe
  2⤵
  PID:12292
- C:\Windows\System\ZSFvTYt.exe
  C:\Windows\System\ZSFvTYt.exe
  2⤵
  PID:12308
- C:\Windows\System\JMfnKnV.exe
  C:\Windows\System\JMfnKnV.exe
  2⤵
  PID:12328
- C:\Windows\System\CdVhxIn.exe
  C:\Windows\System\CdVhxIn.exe
  2⤵
  PID:12344
- C:\Windows\System\OXDdvfS.exe
  C:\Windows\System\OXDdvfS.exe
  2⤵
  PID:12368
- C:\Windows\System\khgayrP.exe
  C:\Windows\System\khgayrP.exe
  2⤵
  PID:12404
- C:\Windows\System\IuzkIeJ.exe
  C:\Windows\System\IuzkIeJ.exe
  2⤵
  PID:12452
- C:\Windows\System\vwiWwBr.exe
  C:\Windows\System\vwiWwBr.exe
  2⤵
  PID:12484
- C:\Windows\System\eoxKyqJ.exe
  C:\Windows\System\eoxKyqJ.exe
  2⤵
  PID:12500
- C:\Windows\System\DDEyAVy.exe
  C:\Windows\System\DDEyAVy.exe
  2⤵
  PID:12516
- C:\Windows\System\XMuqswn.exe
  C:\Windows\System\XMuqswn.exe
  2⤵
  PID:12540
- C:\Windows\System\NeJxSGu.exe
  C:\Windows\System\NeJxSGu.exe
  2⤵
  PID:12556
- C:\Windows\System\lCVYeuw.exe
  C:\Windows\System\lCVYeuw.exe
  2⤵
  PID:12576
- C:\Windows\System\xTaIFpM.exe
  C:\Windows\System\xTaIFpM.exe
  2⤵
  PID:12612
- C:\Windows\System\EgCKIoT.exe
  C:\Windows\System\EgCKIoT.exe
  2⤵
  PID:12632
- C:\Windows\System\PXeFYxr.exe
  C:\Windows\System\PXeFYxr.exe
  2⤵
  PID:12648
- C:\Windows\System\EUMVzij.exe
  C:\Windows\System\EUMVzij.exe
  2⤵
  PID:12812
- C:\Windows\System\sBxUuFF.exe
  C:\Windows\System\sBxUuFF.exe
  2⤵
  PID:12852
- C:\Windows\System\SLZXqVl.exe
  C:\Windows\System\SLZXqVl.exe
  2⤵
  PID:12152
- C:\Windows\System\NvoQdUH.exe
  C:\Windows\System\NvoQdUH.exe
  2⤵
  PID:12916
- C:\Windows\System\utHEUua.exe
  C:\Windows\System\utHEUua.exe
  2⤵
  PID:12920
- C:\Windows\System\SWVSMZH.exe
  C:\Windows\System\SWVSMZH.exe
  2⤵
  PID:12940
- C:\Windows\System\JRcUytb.exe
  C:\Windows\System\JRcUytb.exe
  2⤵
  PID:12972
- C:\Windows\System\qMmjMoG.exe
  C:\Windows\System\qMmjMoG.exe
  2⤵
  PID:12996
- C:\Windows\System\ZOUftfn.exe
  C:\Windows\System\ZOUftfn.exe
  2⤵
  PID:13012
- C:\Windows\System\BzLdJrv.exe
  C:\Windows\System\BzLdJrv.exe
  2⤵
  PID:13040
- C:\Windows\System\FrxFsCA.exe
  C:\Windows\System\FrxFsCA.exe
  2⤵
  PID:13088
- C:\Windows\System\YhpAXDF.exe
  C:\Windows\System\YhpAXDF.exe
  2⤵
  PID:13156
- C:\Windows\System\UcsLgsL.exe
  C:\Windows\System\UcsLgsL.exe
  2⤵
  PID:13020
- C:\Windows\System\Nvyyfgy.exe
  C:\Windows\System\Nvyyfgy.exe
  2⤵
  PID:13176
- C:\Windows\System\xsSsUzl.exe
  C:\Windows\System\xsSsUzl.exe
  2⤵
  PID:13216
- C:\Windows\System\wgsAAyD.exe
  C:\Windows\System\wgsAAyD.exe
  2⤵
  PID:12708
- C:\Windows\System\GUeWZoU.exe
  C:\Windows\System\GUeWZoU.exe
  2⤵
  PID:12380
- C:\Windows\System\gxEAJsS.exe
  C:\Windows\System\gxEAJsS.exe
  2⤵
  PID:12548
- C:\Windows\System\FPsczok.exe
  C:\Windows\System\FPsczok.exe
  2⤵
  PID:12512
- C:\Windows\System\lFtsNbm.exe
  C:\Windows\System\lFtsNbm.exe
  2⤵
  PID:12588
- C:\Windows\System\aojCZJX.exe
  C:\Windows\System\aojCZJX.exe
  2⤵
  PID:12680
- C:\Windows\System\HmRBZip.exe
  C:\Windows\System\HmRBZip.exe
  2⤵
  PID:12764
- C:\Windows\System\tBSWEAT.exe
  C:\Windows\System\tBSWEAT.exe
  2⤵
  PID:1340
- C:\Windows\System\WgJeMlX.exe
  C:\Windows\System\WgJeMlX.exe
  2⤵
  PID:12620
- C:\Windows\System\HRHUaGN.exe
  C:\Windows\System\HRHUaGN.exe
  2⤵
  PID:13308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a3xdd5i5.ccf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AfaDEQf.exe

Filesize
1.3MB

MD5
348d45e69d5152ad1c8a4b242091bddb

SHA1
8cf60b4164515e0552b741340589ac71852c5411

SHA256
a08bfad2faada427f8592aaf66e2c9d2e2e8200127179785da81713363de219d

SHA512
67a9020628074e5f1f78fe020fe7abeb1584e2b0d01707fefad7656ad4a41406768f4e9fdde9015af29f05bd68b0ef2afc3066ac59302827fd85914ff1cd5ecd

Download Submit
C:\Windows\System\Agwcjkv.exe

Filesize
1.3MB

MD5
dd35a2b14ddfc4b532a195085c9f2ab9

SHA1
b2d0f1ac3e555e13e85ff19674ed26c7e0f3d1ea

SHA256
b76c850e30d5af31f24edf1feaace8d52ee4bd36671046ecbbf03fbe51a395e0

SHA512
e22985c11effc2101687a7b5fc517b38b32fa25dcaf642b324c1090bf5101b48e3e3cfb79e37245745408eeba84b427c953a434c19a09958233a66c3597b1887

Download Submit
C:\Windows\System\CDRycFD.exe

Filesize
1.3MB

MD5
3102d463cb136fef53b4fe6da1883be6

SHA1
e18b51e19a4a71b3186a4bb329f28cc349162c50

SHA256
d8c0da44b43de3890ad19b8db758f242c503a61e7df58b754059d19014268dbf

SHA512
24b1904ed60c8f476e8d07e6066e5762230d584cb5c1c9e95bd18f69357d01f7588dbbbfd46a4bee3ce7e35ba3f302e0ba891bd6308e7e9db7e0ea489dc4d524

Download Submit
C:\Windows\System\DhwFyUc.exe

Filesize
8B

MD5
b4264996759d988d82730e6958cf8074

SHA1
7bbc1f74a3ce00994d790da4622d87f15f45b523

SHA256
8ec7039187958fcd27e56e585c4d65242972777fffc8821de830bc1ff1727bca

SHA512
90e2f3e49d27ab4d11cbf031af514cf6fc3a8851362bc0086d9e25b2d97c3341159ec901fb19a665474ceb995371e4f69eda62c3d14f844ace445c61339d139c

Download Submit
C:\Windows\System\EofkXrI.exe

Filesize
1.3MB

MD5
0b34a482c6d21ff0e5aaec498f26f7d2

SHA1
a0490f7325db753e1d3b076e0e19a0aeb9e5e6fb

SHA256
bf7c439a2cd27d51eb218c709d282db2541bbcb2adbbadb81088f1abe71dd7e8

SHA512
a35a211e2a8d0b243ac1fe0843ef0778f91ef4517b50777c921e27c5602fe47dcaa7a708294a3c3e9ae56f6414a560ed92e50298a667c0bc1207a1794fcdf22b

Download Submit
C:\Windows\System\JcBWWGy.exe

Filesize
1.3MB

MD5
00949a8a03631dcde3d498d838a49ce3

SHA1
fec1746268dcadd344983e507128da32e897f420

SHA256
281bd861d7190e943c1be73fdf20f3e0250f80e2ab351796f23fc0ce255a821e

SHA512
b94a88c5b12c9565ed6cb38f20e93d7b30ac55480f9c03c4885a05063d243c1ed268fa676146af922566060e2a84ec696525135bdd728b81316efad5bbb79ad3

Download Submit
C:\Windows\System\SKacLTb.exe

Filesize
1.3MB

MD5
915c7de48a801757c39186b4e2e8c005

SHA1
d72139e3972c6af413b0f85c51234e96f5a11a45

SHA256
a4e6023a13001e77c6361db4c050fbc18f17f1908e9f3df75d175d70528ea38f

SHA512
2cb0dbd42ac01a374fbc64fea25c4bb5a90b04f4e78355e31cd4081ea951b91e250494a72cf91a96144c1e673777496bbc28b967d4d6160ef2001e5ad23c715d

Download Submit
C:\Windows\System\SQJedsC.exe

Filesize
1.3MB

MD5
34d5f765651a193de3afbc51f8f44101

SHA1
6af5145609da1488e531cfd9c53fd038c2a30ad1

SHA256
764e1341aed41df11605d3481d2e421ce367d57d2b641f1fe294bee0ff61a052

SHA512
dce56d8c3f52d9630ec1ab22f45a6fde2f89827357ae3671bf4b2e8679ff070eb57dc8adfa61e71fea00bde9c38589d9bf136bcb308b5b78fc4b0258ebe5bee3

Download Submit
C:\Windows\System\SwptUKr.exe

Filesize
1.3MB

MD5
f055ef806fdff0b58553a9f4f2eb9907

SHA1
ac20d15408b2f4fa6db7ffb6b6e7bdaa086c82b9

SHA256
a73c9d14be725b567619692c0058e94a6f4eeb172d2ce151eac07c397685075c

SHA512
e79c5e9c4c3b551cece849a4c792cd9245ece4a62b10d6b2cdcbbb9f826cad9c0804a7c0abcc29ef79e8a5714b793702c7fe5ad82241e6e8db4bd7de52ae76b4

Download Submit
C:\Windows\System\TQxcDrz.exe

Filesize
1.3MB

MD5
e40fd4eae27632f999d9a6a5a83893c5

SHA1
c96784e2f4d2082a0fde1123acf1187c657aa06e

SHA256
585ebe9a8e5ae3f4e26bc016c4a7fc04c801d579a3513bd72adb436ffc282d48

SHA512
a795efd34d04c94e207eabc9076dd86fffd3b013686a387ddf636803f096bc8d8fd806bef5cfa5020e8789b6faec4d1cdafd3315bd7726bca74f453dee1950c3

Download Submit
C:\Windows\System\TpzqCsr.exe

Filesize
1.3MB

MD5
fe336a3fb74bf64dacce5d0450068b03

SHA1
a6fe293c838c072750f4537fc4b42aaa9a74e599

SHA256
1c0d78a4804a30392d8f51fc3d96b4b4841fd88427264c9cd4bff11b637609cf

SHA512
f104d5d80e8bd67f20efa5a1acbf0e9204fa64e045785f438aca751395a4f1bb8247bac1ae1ca26af2f7e56d3e514a652ee8c2ddef9b7eaba5cb88776e9f1dfa

Download Submit
C:\Windows\System\UdXPIHI.exe

Filesize
1.3MB

MD5
06230f2daa5b0fb84c94fe1a4d8e3e5f

SHA1
3660a255ecfcdcf30e2b19d33a05dfb2ba0a6197

SHA256
8d6a345890e7cc21f8f759fd1d4c93a18c8d4a5fc7822ac0f321710556da9cc5

SHA512
8382201a226af5694541ddfdabf1c2c9fb904b99787d4f51b5ad77be844cb97f53ba07f8aa7b74cc67251769d0be0aee54d1860420314717b7b43b89c5f54edf

Download Submit
C:\Windows\System\UlwCHYY.exe

Filesize
1.3MB

MD5
79e9ad35f8b8cf7b5d1761311e9675ed

SHA1
7b89826a94e318c63131f1da29e4d8a6e96840ca

SHA256
e4e31f44cf4e84b9918746969b3e2cf2eda99945ea09933ad565de07c7214fc1

SHA512
f0df0b95b2ccc58241e523c699977fb571897266dd777bab92b2dd421803f82b43c784000e817998a5b0a98fa141fda496813edcdfb16cfc4663540cbdd2c4cc

Download Submit
C:\Windows\System\WLvrmbj.exe

Filesize
1.3MB

MD5
20251e73d49a28fbdbd58cc61367be76

SHA1
3c37846b33fb83b6cee7897695a9605c56491c12

SHA256
1bdaedca819f971a81a8ec0f078f85f8806ea1748d4c58f349e953e1659cf108

SHA512
754b471a7800a746576396154608cb91a1a5b4926cd3afbe8e353b7f4bdd0ecffa13576fec914adf33941a7fabafa7495f54e3dbab1af77ad4b82afc19e20f88

Download Submit
C:\Windows\System\XfGDGRj.exe

Filesize
1.3MB

MD5
b63bc553ef200ccc8a1f50006b6cccb4

SHA1
ae7c8838a07d4566de2fae98abb20891f8b0520b

SHA256
e74520d8be5665c4374b4d0ddf2382e5785740a78348c23f6187c8073e2d4ca8

SHA512
c65ad40f4f8e7a8466cf031f41d0946ba9c0ff5e412fe3d13f0e6d73e67df91105e7dd24c6773a8c98c8d184ad918b95e8a9725a4f4bdcb5c279f1ed90f15e53

Download Submit
C:\Windows\System\YBQWmYy.exe

Filesize
1.3MB

MD5
4979adea397686dbbd8e9ce35866da18

SHA1
5782cc6284ee9ae4f9536393ad6dcb38fc84f137

SHA256
8eab52c80a654975078c2f71a26fcda3eb340cb2c294fe8edf6fb63b8fdddce9

SHA512
eeed73548e65199901e7fdfe85e310e8ea99b207763d0ed9eeb8b2f69acde10108ed22796fd0c22e2b71c1e2bf05a1bc313a16c6a23beb46075ea4bc5f954bf6

Download Submit
C:\Windows\System\ZHZJBsQ.exe

Filesize
1.3MB

MD5
d3779ae00b0d0588ada2f06fed1c000b

SHA1
c514aefa1340873b436f53f617e141d02237f3d6

SHA256
e95044ed55662ad14f05e9293d4b4ae82f2538e04d0234ffe255dc35c5ebcabe

SHA512
7b3449068191e4767c08bb575c09932f8c6daf6fb3b880639ec6fea8000aefa7a94a3e7c54ed76f2d380b45bd72e7b753da5767a8727880eead5001089b034f3

Download Submit
C:\Windows\System\aGinrjT.exe

Filesize
1.3MB

MD5
456e6a28e6a16065f4704af619cb4fbb

SHA1
17afe89ae40cbcf8e4b6298c19f15bd34a1c51cc

SHA256
e702d1e5c797a39b738b73f53585adf29dfd76035312e3260dfc34dc8b53f8de

SHA512
863b34fe7596fd4bd63cc2bdc5ce5eca3fa3908ffd42777e4a8cea8128b97dd0bddb40899f596559f98cf7b591c4c8101902e3920e764af46c572f5e546a61a6

Download Submit
C:\Windows\System\bOgBYPU.exe

Filesize
1.3MB

MD5
56a625fc24c3d5b9e6557a34752bfe4e

SHA1
25c2757002b386a89c267549073e2919ccbf4efb

SHA256
a095a047e68770d90a4ff5eba53a2f57b2a6bd00dbbc07999ef444cef4b0aabe

SHA512
763dae9a9fe229a7bfb4ab2b16f991f678602e8b0a86ee5f8609cc350765bef48557a6a9569212a1d7ffa30a9c6cd880d82b05ce8ede462f3440bf7d51acff90

Download Submit
C:\Windows\System\crELXXQ.exe

Filesize
1.3MB

MD5
118b87cc5a528392d32ab8e2f69bf5fa

SHA1
a3dca6ca1d018c17f9ab643fb703d0e25cb871fc

SHA256
810846946f872cd9a851d53939580a2a8e632dc12bfe52d01f101990c650ef4f

SHA512
0f888093e5ff398d1b6e767233ae5e91bc3db14872fed508ec7a8a07387fb0897eed03e5698cb8d20bf11cfe01fea67a7ca010c12213bf9d0e3154853eeaa5ab

Download Submit
C:\Windows\System\dYtNkFo.exe

Filesize
1.3MB

MD5
204be2b5b915a0a9e66cf0484cc37b1c

SHA1
908364d5c59535e6427462418270f516ad615c37

SHA256
a420968c0303cc1faa29266a6fbb91a978a48628cb2d53b8dbf0065f0bba09e8

SHA512
fe20d5da0776366aff7a7dad2e12ae4ea5771d436793c39722cbb2b39240db6432c19fae4d5436afa9ac3afad63b8c2f31b05ed289ec0b38643432966aff2055

Download Submit
C:\Windows\System\fejLITF.exe

Filesize
1.3MB

MD5
50751dfd0dbfb79d40933482a62ea82e

SHA1
e7f3e117b5a096498c68376a0b75b07bf3b1b42d

SHA256
acf14054f747290dab07498e77e4dfb693d0ed165b1fff0553e1661e36e0aa7a

SHA512
193ae43cf86aa63df2dbc449fc0e22659b9a42e11ce0a1ef3fd93c2bd414745615dee7a10b215c4fdb773ea241d328237a180350d737f20e5c079fcecfba45be

Download Submit
C:\Windows\System\jJVDSJZ.exe

Filesize
1.3MB

MD5
24590c3a529e9f2a55ab145ed8fc6fe3

SHA1
87e903039c4c572c5220071f43cbb0aa026868b0

SHA256
24d642db1460e7e6215d79e4bb3f930aba1b6a9b58c05a3df7737678c385e026

SHA512
b242eadc37223b867a38d727e6e2bac1f4c1982b3ecc4a49e200a84a5c048fbe91c2c81e9ad05fd914831e55d2edd4c947a045ff8f64046e8f72a96362f09f31

Download Submit
C:\Windows\System\lNmIfdF.exe

Filesize
1.3MB

MD5
3eedd12f7236d89acb6c4f262e6bb13d

SHA1
f518129accd4af40dfb5f0142781b59a43b46546

SHA256
b98142626d636376c36a806041f4ebbd1c488cb347c739e750b5712de55a600c

SHA512
3c23c23244839d63307ad6b080ab1ecc41985402622ff68e994d37e41196727e8edcd1173fcebdf62cfaad28702481e586ab5e83f40aed8dc6712b15bd0c01c7

Download Submit
C:\Windows\System\mRLQQXY.exe

Filesize
1.3MB

MD5
f7c1df4a4541b1da11abe581e2f95a68

SHA1
da2ce1759e6c834b9fa0f84f4b6412a5dc1cd38e

SHA256
184bfa2d32980b933c17d8c8f90ed47613cc2feb995e20c02ff3edf57a3fe743

SHA512
6ccb1828a04ea5a98d4f2df72b0fb8b8608df17b6f632016455efd7ce7d42b3a9a14eed1bbbd237b1cac343280e092bc1f4b58b5d994b562f22c140355ee9105

Download Submit
C:\Windows\System\ohTZVef.exe

Filesize
1.3MB

MD5
449fcab400e1663b711bcbdf355551ac

SHA1
9a0d8fb5d8860689b422b1be6695e87698d33f70

SHA256
2e4056116b2d6e3f9fd563e1d1a7f30ea603f9d4e5396482acfc61717f65c4d3

SHA512
6d776ce0a0d7765ddb7f5bc1a26a03bfd2b49c5483f93fe84c6bc1ff4f4cd9b849d79e2c5127618473dce2e3d4d483a52b8c36471331edc09fe5132f49c3a8d7

Download Submit
C:\Windows\System\olznzls.exe

Filesize
1.3MB

MD5
a08437bf28b01b0637def611861678a4

SHA1
3096100e7ad8243a49f451a3b854d5f016401e38

SHA256
b76beb2c59b7c8455a18e4ec6c595014dde18844fcb81db645bd79afa5289391

SHA512
a82c4cf1b4e4450155d17e6a894782bfa73f1182937cfefaf69cb4eae9e43136ffe47bd519630b9bfb06c879204e2902fd5663644a4692fec0450a4526f4aec2

Download Submit
C:\Windows\System\pzTGcit.exe

Filesize
1.3MB

MD5
3236aad2373ee007554e829771e9209a

SHA1
fbe15634865d5db2cead7f4c8e210a87f43daae0

SHA256
ab783d8bbd7d35fcf56dd583cbd4e7d0aaca15d695f4951caa4a6718e1cdedd3

SHA512
2d19bdab5e7a3608e4e5a52708762f8db6d11f082ed715a863fef3f444d4e363cc6bb33dc9199f966f43d9b787af61b34675ef0db76071a291ec3def74c98b1e

Download Submit
C:\Windows\System\quMuMjp.exe

Filesize
1.3MB

MD5
6753883c2ca5b9c0b2b9556ef78c560c

SHA1
6571e2a7797d38c548a47a6a0e654c80e8caf62c

SHA256
35a947a4c0d5aea0a86e549a26d4ac0f522057d7381f7dfee45708d8152f5d24

SHA512
9d6fa9536779df53c2bde8ebd8d7b8613a8a55c81df9c74feec4518da52c85ecb6ceab835bf39b644efc082c4547ebd29086872316b4de5dbbef04fffe15a160

Download Submit
C:\Windows\System\rVMoaMX.exe

Filesize
1.3MB

MD5
cd05ce0423586d82945aa3025152e768

SHA1
7e59748e4d15338bf9bb917acd1c65cf9f8c336b

SHA256
10d963550232ed1f0a6c8d98ceb31e514aa14c0f67d1510110f9baa8470ea538

SHA512
d3428ea68a535fc1641ef5776a2ab4a41781fdaa45f04a402378ed7919e3b77b9eb1623878b1050d330973859043342a9036f6aa6e48fb8150debe65aa037236

Download Submit
C:\Windows\System\sZcwNZF.exe

Filesize
1.3MB

MD5
139de626122fab0c3a7888b1242006a3

SHA1
210ebf627f9fbd01df2eca5f37b6672af9653d44

SHA256
4af2d1e2c1cb93ad1089a11f3b8b0361b9d48f64752dd338dbfe9728f3d2a671

SHA512
406359877d0e2a7c0bf7cef12506dedf0c849d8eeb7fdbdcff8df409d792d40a5b84445ba646864290a4858cb5760b43909ac73fc602069ebd43e3d2028664b2

Download Submit
C:\Windows\System\tDQTnPf.exe

Filesize
1.3MB

MD5
7d13f293e2e811412134ad19b0789225

SHA1
552590354562519ae59d26ad814ec9444c5cb8a9

SHA256
2da771bf2be6ecd801cf956762f0b94f40ae651c2358d4f340db14d6653d9f53

SHA512
5ef4faf3eee3248b6028ccb609ca7e1faf798b8d21150ae21b4541d0d6dce164d1944feff103d6cf6a9bae4352f3332c1d3b43e7152d091272b9d94ae8466671

Download Submit
C:\Windows\System\vMzCzFE.exe

Filesize
1.3MB

MD5
1353242d58cc271d68fba588a2242859

SHA1
97066146780d50776d926831aa1adb5fff59c298

SHA256
5df96cca23c7e45d431f49e03e553e5c3ef3bfd28a22af585f080b76cb8900b8

SHA512
a66024844462f8654b4126f327e14fa8e8f551b5f28d2f0e344a4338404f87eee7cab068a9bf9bbcfe784fe6cb3d096f8017fc6b61101a3ff70d52bfc1814e7a

Download Submit
C:\Windows\System\zdCzasl.exe

Filesize
1.3MB

MD5
8a8f38d9c1264dab98f1075f72759572

SHA1
72049a35b65e52ce6ec8f9e895bbb500517da810

SHA256
2cb85dddeefd74cfbcf2958663866d640eda2fa2792a728cd936e452388d416c

SHA512
d9d384d9a19a786927b4786c967979a21c31eabd5269a4046f45595232989e40f9804650723a3b8399c25b5e897e0395cf7808790123b882ec1e349fb5c88b1f

Download Submit
memory/316-3331-0x00007FF64DC80000-0x00007FF64E072000-memory.dmp

Filesize
3.9MB

Download
memory/316-67-0x00007FF64DC80000-0x00007FF64E072000-memory.dmp

Filesize
3.9MB

Download
memory/736-3338-0x00007FF6AC300000-0x00007FF6AC6F2000-memory.dmp

Filesize
3.9MB

Download
memory/736-125-0x00007FF6AC300000-0x00007FF6AC6F2000-memory.dmp

Filesize
3.9MB

Download
memory/736-3303-0x00007FF6AC300000-0x00007FF6AC6F2000-memory.dmp

Filesize
3.9MB

Download
memory/964-3323-0x00007FF6572B0000-0x00007FF6576A2000-memory.dmp

Filesize
3.9MB

Download
memory/964-64-0x00007FF6572B0000-0x00007FF6576A2000-memory.dmp

Filesize
3.9MB

Download
memory/1104-3316-0x00007FF7A8FB0000-0x00007FF7A93A2000-memory.dmp

Filesize
3.9MB

Download
memory/1104-3359-0x00007FF7A8FB0000-0x00007FF7A93A2000-memory.dmp

Filesize
3.9MB

Download
memory/1104-144-0x00007FF7A8FB0000-0x00007FF7A93A2000-memory.dmp

Filesize
3.9MB

Download
memory/1392-69-0x00007FF76CA40000-0x00007FF76CE32000-memory.dmp

Filesize
3.9MB

Download
memory/1392-3327-0x00007FF76CA40000-0x00007FF76CE32000-memory.dmp

Filesize
3.9MB

Download
memory/1684-3305-0x00007FF7E3A50000-0x00007FF7E3E42000-memory.dmp

Filesize
3.9MB

Download
memory/1684-3355-0x00007FF7E3A50000-0x00007FF7E3E42000-memory.dmp

Filesize
3.9MB

Download
memory/1684-137-0x00007FF7E3A50000-0x00007FF7E3E42000-memory.dmp

Filesize
3.9MB

Download
memory/1744-3344-0x00007FF73D930000-0x00007FF73DD22000-memory.dmp

Filesize
3.9MB

Download
memory/1744-100-0x00007FF73D930000-0x00007FF73DD22000-memory.dmp

Filesize
3.9MB

Download
memory/1760-156-0x00007FF6ED7B0000-0x00007FF6EDBA2000-memory.dmp

Filesize
3.9MB

Download
memory/1760-3368-0x00007FF6ED7B0000-0x00007FF6EDBA2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-63-0x00007FF7B5A10000-0x00007FF7B5E02000-memory.dmp

Filesize
3.9MB

Download
memory/1936-3321-0x00007FF7B5A10000-0x00007FF7B5E02000-memory.dmp

Filesize
3.9MB

Download
memory/2008-88-0x00007FF7E1B30000-0x00007FF7E1F22000-memory.dmp

Filesize
3.9MB

Download
memory/2008-3346-0x00007FF7E1B30000-0x00007FF7E1F22000-memory.dmp

Filesize
3.9MB

Download
memory/2100-68-0x00007FF641320000-0x00007FF641712000-memory.dmp

Filesize
3.9MB

Download
memory/2100-3325-0x00007FF641320000-0x00007FF641712000-memory.dmp

Filesize
3.9MB

Download
memory/2320-3340-0x00007FF740D50000-0x00007FF741142000-memory.dmp

Filesize
3.9MB

Download
memory/2320-107-0x00007FF740D50000-0x00007FF741142000-memory.dmp

Filesize
3.9MB

Download
memory/2436-83-0x00007FF620780000-0x00007FF620B72000-memory.dmp

Filesize
3.9MB

Download
memory/2436-3320-0x00007FF620780000-0x00007FF620B72000-memory.dmp

Filesize
3.9MB

Download
memory/2500-162-0x00007FF70CB80000-0x00007FF70CF72000-memory.dmp

Filesize
3.9MB

Download
memory/2500-3365-0x00007FF70CB80000-0x00007FF70CF72000-memory.dmp

Filesize
3.9MB

Download
memory/3076-52-0x00007FF8E8B00000-0x00007FF8E95C1000-memory.dmp

Filesize
10.8MB

Download
memory/3076-2679-0x00007FF8E8B03000-0x00007FF8E8B05000-memory.dmp

Filesize
8KB

Download
memory/3076-458-0x00000157C9DB0000-0x00000157CA556000-memory.dmp

Filesize
7.6MB

Download
memory/3076-42-0x00000157C9200000-0x00000157C9222000-memory.dmp

Filesize
136KB

Download
memory/3076-3-0x00007FF8E8B03000-0x00007FF8E8B05000-memory.dmp

Filesize
8KB

Download
memory/3076-41-0x00007FF8E8B00000-0x00007FF8E95C1000-memory.dmp

Filesize
10.8MB

Download
memory/3156-150-0x00007FF784B60000-0x00007FF784F52000-memory.dmp

Filesize
3.9MB

Download
memory/3156-3369-0x00007FF784B60000-0x00007FF784F52000-memory.dmp

Filesize
3.9MB

Download
memory/3276-113-0x00007FF749F40000-0x00007FF74A332000-memory.dmp

Filesize
3.9MB

Download
memory/3276-3353-0x00007FF749F40000-0x00007FF74A332000-memory.dmp

Filesize
3.9MB

Download
memory/3304-87-0x00007FF6DAB10000-0x00007FF6DAF02000-memory.dmp

Filesize
3.9MB

Download
memory/3304-3330-0x00007FF6DAB10000-0x00007FF6DAF02000-memory.dmp

Filesize
3.9MB

Download
memory/3568-72-0x00007FF74F1D0000-0x00007FF74F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/3568-3333-0x00007FF74F1D0000-0x00007FF74F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/4108-3348-0x00007FF7AA8E0000-0x00007FF7AACD2000-memory.dmp

Filesize
3.9MB

Download
memory/4108-94-0x00007FF7AA8E0000-0x00007FF7AACD2000-memory.dmp

Filesize
3.9MB

Download
memory/4448-3306-0x00007FF7DF420000-0x00007FF7DF812000-memory.dmp

Filesize
3.9MB

Download
memory/4448-138-0x00007FF7DF420000-0x00007FF7DF812000-memory.dmp

Filesize
3.9MB

Download
memory/4448-3357-0x00007FF7DF420000-0x00007FF7DF812000-memory.dmp

Filesize
3.9MB

Download
memory/4476-1-0x0000017513C30000-0x0000017513C40000-memory.dmp

Filesize
64KB

Download
memory/4476-0-0x00007FF726800000-0x00007FF726BF2000-memory.dmp

Filesize
3.9MB

Download
memory/4484-2685-0x00007FF74EAE0000-0x00007FF74EED2000-memory.dmp

Filesize
3.9MB

Download
memory/4484-3349-0x00007FF74EAE0000-0x00007FF74EED2000-memory.dmp

Filesize
3.9MB

Download
memory/4484-78-0x00007FF74EAE0000-0x00007FF74EED2000-memory.dmp

Filesize
3.9MB

Download
memory/4764-3342-0x00007FF6C46A0000-0x00007FF6C4A92000-memory.dmp

Filesize
3.9MB

Download
memory/4764-101-0x00007FF6C46A0000-0x00007FF6C4A92000-memory.dmp

Filesize
3.9MB

Download
memory/4872-3304-0x00007FF69FFD0000-0x00007FF6A03C2000-memory.dmp

Filesize
3.9MB

Download
memory/4872-3336-0x00007FF69FFD0000-0x00007FF6A03C2000-memory.dmp

Filesize
3.9MB

Download
memory/4872-131-0x00007FF69FFD0000-0x00007FF6A03C2000-memory.dmp

Filesize
3.9MB

Download
memory/4900-3302-0x00007FF63FB40000-0x00007FF63FF32000-memory.dmp

Filesize
3.9MB

Download
memory/4900-3352-0x00007FF63FB40000-0x00007FF63FF32000-memory.dmp

Filesize
3.9MB

Download
memory/4900-119-0x00007FF63FB40000-0x00007FF63FF32000-memory.dmp

Filesize
3.9MB

Download