xmrig | aeae116d6cbdac403a123523fbeb0150bad748bee47172c08282168402f69fd9

Analysis

max time kernel
97s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
Size

1.7MB
MD5

256586bb042cd68e23cf6368fcdf5280
SHA1

ff77b2f4fcff724f426fa3d6c8153380f2d4c239
SHA256

aeae116d6cbdac403a123523fbeb0150bad748bee47172c08282168402f69fd9
SHA512

382ffe52088e6b64f5ba2d59a0df7870cd9b86d6ef5b46cd2a43371b66655465914ae74f69ea5e4d710d0965cf717f48c63153e41d92373c05ef6f8014b1b0ff
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkyW1HU/ek5Q1szp5OaD8VAEDzfJykmA3deeJGzd:Lz071uv4BPMkyW10/w16clf53dd4

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/1784-444-0x00007FF7674A0000-0x00007FF767892000-memory.dmp	xmrig
behavioral2/memory/4356-565-0x00007FF648190000-0x00007FF648582000-memory.dmp	xmrig
behavioral2/memory/1812-676-0x00007FF75AA80000-0x00007FF75AE72000-memory.dmp	xmrig
behavioral2/memory/700-681-0x00007FF680340000-0x00007FF680732000-memory.dmp	xmrig
behavioral2/memory/5040-686-0x00007FF638DE0000-0x00007FF6391D2000-memory.dmp	xmrig
behavioral2/memory/2356-688-0x00007FF609E60000-0x00007FF60A252000-memory.dmp	xmrig
behavioral2/memory/4412-687-0x00007FF725480000-0x00007FF725872000-memory.dmp	xmrig
behavioral2/memory/4824-685-0x00007FF70AE20000-0x00007FF70B212000-memory.dmp	xmrig
behavioral2/memory/3296-684-0x00007FF71A1E0000-0x00007FF71A5D2000-memory.dmp	xmrig
behavioral2/memory/3600-683-0x00007FF7C8BA0000-0x00007FF7C8F92000-memory.dmp	xmrig
behavioral2/memory/5024-682-0x00007FF67AD80000-0x00007FF67B172000-memory.dmp	xmrig
behavioral2/memory/2856-680-0x00007FF6F0100000-0x00007FF6F04F2000-memory.dmp	xmrig
behavioral2/memory/4800-679-0x00007FF720350000-0x00007FF720742000-memory.dmp	xmrig
behavioral2/memory/320-678-0x00007FF7BD260000-0x00007FF7BD652000-memory.dmp	xmrig
behavioral2/memory/960-677-0x00007FF6F0310000-0x00007FF6F0702000-memory.dmp	xmrig
behavioral2/memory/3336-674-0x00007FF61ADB0000-0x00007FF61B1A2000-memory.dmp	xmrig
behavioral2/memory/4908-557-0x00007FF7C2CB0000-0x00007FF7C30A2000-memory.dmp	xmrig
behavioral2/memory/4372-426-0x00007FF6A0D90000-0x00007FF6A1182000-memory.dmp	xmrig
behavioral2/memory/2232-357-0x00007FF7D30F0000-0x00007FF7D34E2000-memory.dmp	xmrig
behavioral2/memory/3404-362-0x00007FF738490000-0x00007FF738882000-memory.dmp	xmrig
behavioral2/memory/3756-273-0x00007FF7F26E0000-0x00007FF7F2AD2000-memory.dmp	xmrig
behavioral2/memory/3180-228-0x00007FF6FEDE0000-0x00007FF6FF1D2000-memory.dmp	xmrig
behavioral2/memory/3048-227-0x00007FF7D40B0000-0x00007FF7D44A2000-memory.dmp	xmrig
behavioral2/memory/2884-1938-0x00007FF6E4EA0000-0x00007FF6E5292000-memory.dmp	xmrig
behavioral2/memory/5040-1972-0x00007FF638DE0000-0x00007FF6391D2000-memory.dmp	xmrig
behavioral2/memory/3048-1975-0x00007FF7D40B0000-0x00007FF7D44A2000-memory.dmp	xmrig
behavioral2/memory/2884-1976-0x00007FF6E4EA0000-0x00007FF6E5292000-memory.dmp	xmrig
behavioral2/memory/2232-1978-0x00007FF7D30F0000-0x00007FF7D34E2000-memory.dmp	xmrig
behavioral2/memory/4412-1980-0x00007FF725480000-0x00007FF725872000-memory.dmp	xmrig
behavioral2/memory/4356-1986-0x00007FF648190000-0x00007FF648582000-memory.dmp	xmrig
behavioral2/memory/4908-1984-0x00007FF7C2CB0000-0x00007FF7C30A2000-memory.dmp	xmrig
behavioral2/memory/4800-1989-0x00007FF720350000-0x00007FF720742000-memory.dmp	xmrig
behavioral2/memory/3404-1990-0x00007FF738490000-0x00007FF738882000-memory.dmp	xmrig
behavioral2/memory/3336-1996-0x00007FF61ADB0000-0x00007FF61B1A2000-memory.dmp	xmrig
behavioral2/memory/2356-1994-0x00007FF609E60000-0x00007FF60A252000-memory.dmp	xmrig
behavioral2/memory/3180-1993-0x00007FF6FEDE0000-0x00007FF6FF1D2000-memory.dmp	xmrig
behavioral2/memory/3756-1982-0x00007FF7F26E0000-0x00007FF7F2AD2000-memory.dmp	xmrig
behavioral2/memory/700-1998-0x00007FF680340000-0x00007FF680732000-memory.dmp	xmrig
behavioral2/memory/1812-2002-0x00007FF75AA80000-0x00007FF75AE72000-memory.dmp	xmrig
behavioral2/memory/4372-2000-0x00007FF6A0D90000-0x00007FF6A1182000-memory.dmp	xmrig
behavioral2/memory/960-2008-0x00007FF6F0310000-0x00007FF6F0702000-memory.dmp	xmrig
behavioral2/memory/3600-2007-0x00007FF7C8BA0000-0x00007FF7C8F92000-memory.dmp	xmrig
behavioral2/memory/1784-2004-0x00007FF7674A0000-0x00007FF767892000-memory.dmp	xmrig
behavioral2/memory/2856-2019-0x00007FF6F0100000-0x00007FF6F04F2000-memory.dmp	xmrig
behavioral2/memory/5024-2026-0x00007FF67AD80000-0x00007FF67B172000-memory.dmp	xmrig
behavioral2/memory/3296-2024-0x00007FF71A1E0000-0x00007FF71A5D2000-memory.dmp	xmrig
behavioral2/memory/4824-2022-0x00007FF70AE20000-0x00007FF70B212000-memory.dmp	xmrig
behavioral2/memory/320-2017-0x00007FF7BD260000-0x00007FF7BD652000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3872	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2884	iWlgTRa.exe
5040	jNUvtRe.exe
3048	vkYeaQO.exe
4412	iCJFAuJ.exe
3180	Rgvnqsd.exe
3756	ynBVeBj.exe
2232	xfgNbte.exe
3404	CNIBjkB.exe
4372	DNWkDun.exe
1784	HAQgkMC.exe
4908	MVqLapD.exe
4356	RFxdDag.exe
3336	vrgSUiK.exe
1812	FrJHJdQ.exe
960	hshdpLW.exe
320	rSMNxVd.exe
4800	qELWSkK.exe
2356	TgLZRUf.exe
2856	HLZqBBF.exe
700	XPmimiV.exe
5024	hBtGTbt.exe
3600	HxXJGXE.exe
3296	njfUZXl.exe
4824	yRyOEOu.exe
5004	hTdOBjH.exe
4692	rpjXkCN.exe
724	SQZAwia.exe
940	clQRldc.exe
1576	PngyfOp.exe
1860	aOfjuja.exe
2344	iiUEBUO.exe
5048	HWXVaXZ.exe
4924	FnoJAxp.exe
1196	KFapFnM.exe
2200	FEriGNO.exe
4592	vrcxLQB.exe
3116	eCoMMor.exe
1020	HostJVE.exe
1200	hDJdgAd.exe
2056	VyECSof.exe
3284	MNPWqXC.exe
3768	ObFMjUn.exe
4072	ZtVCnEW.exe
1436	VkXSNnB.exe
2792	XjWQTPv.exe
3132	aoYtEne.exe
3304	KdTkfGp.exe
4104	qqqdQUx.exe
2896	dSofsQc.exe
2584	cAZScFs.exe
5088	ataggjJ.exe
4896	KtFpQXe.exe
756	NVvrZXM.exe
4152	OmqOowY.exe
1616	fermJVU.exe
1408	JhWocfn.exe
3964	HidJnIK.exe
2136	kywNjAi.exe
1788	VThpBNz.exe
1312	msGYCTF.exe
1220	NhTwcog.exe
4300	DRcJvGJ.exe
3228	KszdtFt.exe
4360	OnItPVI.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2976-0-0x00007FF79E460000-0x00007FF79E852000-memory.dmp	upx
behavioral2/files/0x000700000002343f-7.dat	upx
behavioral2/files/0x0007000000023441-27.dat	upx
behavioral2/files/0x000700000002344a-144.dat	upx
behavioral2/files/0x0007000000023451-202.dat	upx
behavioral2/memory/1784-444-0x00007FF7674A0000-0x00007FF767892000-memory.dmp	upx
behavioral2/memory/4356-565-0x00007FF648190000-0x00007FF648582000-memory.dmp	upx
behavioral2/memory/1812-676-0x00007FF75AA80000-0x00007FF75AE72000-memory.dmp	upx
behavioral2/memory/700-681-0x00007FF680340000-0x00007FF680732000-memory.dmp	upx
behavioral2/memory/5040-686-0x00007FF638DE0000-0x00007FF6391D2000-memory.dmp	upx
behavioral2/memory/2356-688-0x00007FF609E60000-0x00007FF60A252000-memory.dmp	upx
behavioral2/memory/4412-687-0x00007FF725480000-0x00007FF725872000-memory.dmp	upx
behavioral2/memory/4824-685-0x00007FF70AE20000-0x00007FF70B212000-memory.dmp	upx
behavioral2/memory/3296-684-0x00007FF71A1E0000-0x00007FF71A5D2000-memory.dmp	upx
behavioral2/memory/3600-683-0x00007FF7C8BA0000-0x00007FF7C8F92000-memory.dmp	upx
behavioral2/memory/5024-682-0x00007FF67AD80000-0x00007FF67B172000-memory.dmp	upx
behavioral2/memory/2856-680-0x00007FF6F0100000-0x00007FF6F04F2000-memory.dmp	upx
behavioral2/memory/4800-679-0x00007FF720350000-0x00007FF720742000-memory.dmp	upx
behavioral2/memory/320-678-0x00007FF7BD260000-0x00007FF7BD652000-memory.dmp	upx
behavioral2/memory/960-677-0x00007FF6F0310000-0x00007FF6F0702000-memory.dmp	upx
behavioral2/memory/3336-674-0x00007FF61ADB0000-0x00007FF61B1A2000-memory.dmp	upx
behavioral2/memory/4908-557-0x00007FF7C2CB0000-0x00007FF7C30A2000-memory.dmp	upx
behavioral2/memory/4372-426-0x00007FF6A0D90000-0x00007FF6A1182000-memory.dmp	upx
behavioral2/memory/2232-357-0x00007FF7D30F0000-0x00007FF7D34E2000-memory.dmp	upx
behavioral2/memory/3404-362-0x00007FF738490000-0x00007FF738882000-memory.dmp	upx
behavioral2/memory/3756-273-0x00007FF7F26E0000-0x00007FF7F2AD2000-memory.dmp	upx
behavioral2/memory/3180-228-0x00007FF6FEDE0000-0x00007FF6FF1D2000-memory.dmp	upx
behavioral2/memory/3048-227-0x00007FF7D40B0000-0x00007FF7D44A2000-memory.dmp	upx
behavioral2/files/0x0007000000023464-199.dat	upx
behavioral2/files/0x0007000000023463-193.dat	upx
behavioral2/files/0x000700000002344f-191.dat	upx
behavioral2/files/0x0007000000023462-189.dat	upx
behavioral2/files/0x0007000000023461-186.dat	upx
behavioral2/files/0x0007000000023460-185.dat	upx
behavioral2/files/0x0007000000023456-181.dat	upx
behavioral2/files/0x000700000002345e-180.dat	upx
behavioral2/files/0x0007000000023454-179.dat	upx
behavioral2/files/0x0007000000023453-168.dat	upx
behavioral2/files/0x000700000002345c-167.dat	upx
behavioral2/files/0x000700000002345b-166.dat	upx
behavioral2/files/0x000700000002344c-162.dat	upx
behavioral2/files/0x0007000000023459-159.dat	upx
behavioral2/files/0x0007000000023452-153.dat	upx
behavioral2/files/0x000700000002344b-151.dat	upx
behavioral2/files/0x0007000000023458-149.dat	upx
behavioral2/files/0x0007000000023445-140.dat	upx
behavioral2/files/0x0007000000023450-135.dat	upx
behavioral2/files/0x000700000002345d-175.dat	upx
behavioral2/files/0x000700000002345a-161.dat	upx
behavioral2/files/0x0007000000023448-100.dat	upx
behavioral2/files/0x0007000000023447-96.dat	upx
behavioral2/files/0x0007000000023457-138.dat	upx
behavioral2/files/0x0007000000023449-124.dat	upx
behavioral2/files/0x0007000000023455-120.dat	upx
behavioral2/files/0x0007000000023444-109.dat	upx
behavioral2/files/0x000700000002344d-75.dat	upx
behavioral2/files/0x0007000000023443-70.dat	upx
behavioral2/files/0x0007000000023446-92.dat	upx
behavioral2/files/0x0007000000023442-62.dat	upx
behavioral2/files/0x000700000002344e-83.dat	upx
behavioral2/files/0x0007000000023440-38.dat	upx
behavioral2/files/0x000800000002343b-14.dat	upx
behavioral2/files/0x0007000000023298-26.dat	upx
behavioral2/memory/2884-18-0x00007FF6E4EA0000-0x00007FF6E5292000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iONqFQj.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\OMtrQMI.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\VAyGGCW.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\blAGdXx.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\zEonlec.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\AMABsxa.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\Gncrrmr.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\PDYBaTz.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\WCiiWgT.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\DrOvwNZ.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\azWNBAi.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\iCZljBl.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\wucgkRw.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\zVxPyPX.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\xCLzSlZ.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\onSKrcc.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\GkUjpmm.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\eRQyLTQ.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\PxoOWtS.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\EmMHcrY.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\rulnzYI.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\xLoZtJW.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\ldIDKMa.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\jIfBFLQ.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\UefUNup.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\asNjIRf.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\bKGJCcI.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\vaJIObo.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\RMVXiec.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\eatjFEu.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\INifMkd.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\nmtFoEG.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\lgJFCAT.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\qepUnxi.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\KdTkfGp.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\NWvzfDf.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\SuMjuMk.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\VjmGrDd.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\PtaXdlY.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\NgvgAcu.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\xKRDYxU.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\jNUvtRe.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\ooqIQQG.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\skIkNki.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\YqJVmfK.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\EYqbBFD.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\UHhsnXU.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\rmuGowg.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\weSbcYp.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\Nbwqehg.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\dhQktnb.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\njfUZXl.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\TAeTSad.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\AiNpKDd.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\zrVoDQg.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\vIqFDin.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\gzGSkgv.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\PlGyDCW.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\VVZbKaJ.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\ZwPTDBp.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\dMuEcSo.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\MKaUfbW.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\xhgCtbe.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
File created	C:\Windows\System\EsyHoyc.exe	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3872	powershell.exe
3872	powershell.exe
3872	powershell.exe
3872	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeLockMemoryPrivilege	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3872	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	84
PID 2976 wrote to memory of 3872	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	84
PID 2976 wrote to memory of 2884	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	85
PID 2976 wrote to memory of 2884	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	85
PID 2976 wrote to memory of 5040	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	86
PID 2976 wrote to memory of 5040	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	86
PID 2976 wrote to memory of 3048	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	87
PID 2976 wrote to memory of 3048	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	87
PID 2976 wrote to memory of 4412	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	88
PID 2976 wrote to memory of 4412	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	88
PID 2976 wrote to memory of 3180	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	89
PID 2976 wrote to memory of 3180	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	89
PID 2976 wrote to memory of 3756	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	90
PID 2976 wrote to memory of 3756	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	90
PID 2976 wrote to memory of 2232	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	91
PID 2976 wrote to memory of 2232	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	91
PID 2976 wrote to memory of 3404	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	92
PID 2976 wrote to memory of 3404	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	92
PID 2976 wrote to memory of 4372	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	93
PID 2976 wrote to memory of 4372	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	93
PID 2976 wrote to memory of 1784	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	94
PID 2976 wrote to memory of 1784	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	94
PID 2976 wrote to memory of 4908	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	95
PID 2976 wrote to memory of 4908	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	95
PID 2976 wrote to memory of 4356	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	96
PID 2976 wrote to memory of 4356	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	96
PID 2976 wrote to memory of 3336	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	97
PID 2976 wrote to memory of 3336	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	97
PID 2976 wrote to memory of 1812	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	98
PID 2976 wrote to memory of 1812	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	98
PID 2976 wrote to memory of 960	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	99
PID 2976 wrote to memory of 960	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	99
PID 2976 wrote to memory of 320	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	100
PID 2976 wrote to memory of 320	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	100
PID 2976 wrote to memory of 4800	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	101
PID 2976 wrote to memory of 4800	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	101
PID 2976 wrote to memory of 2356	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	102
PID 2976 wrote to memory of 2356	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	102
PID 2976 wrote to memory of 2856	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	103
PID 2976 wrote to memory of 2856	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	103
PID 2976 wrote to memory of 700	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	104
PID 2976 wrote to memory of 700	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	104
PID 2976 wrote to memory of 5024	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	105
PID 2976 wrote to memory of 5024	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	105
PID 2976 wrote to memory of 3600	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	106
PID 2976 wrote to memory of 3600	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	106
PID 2976 wrote to memory of 3296	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	107
PID 2976 wrote to memory of 3296	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	107
PID 2976 wrote to memory of 4824	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	108
PID 2976 wrote to memory of 4824	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	108
PID 2976 wrote to memory of 5004	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	109
PID 2976 wrote to memory of 5004	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	109
PID 2976 wrote to memory of 1196	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	110
PID 2976 wrote to memory of 1196	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	110
PID 2976 wrote to memory of 4692	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	111
PID 2976 wrote to memory of 4692	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	111
PID 2976 wrote to memory of 724	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	112
PID 2976 wrote to memory of 724	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	112
PID 2976 wrote to memory of 940	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	113
PID 2976 wrote to memory of 940	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	113
PID 2976 wrote to memory of 1576	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	114
PID 2976 wrote to memory of 1576	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	114
PID 2976 wrote to memory of 1860	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	115
PID 2976 wrote to memory of 1860	2976	256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\256586bb042cd68e23cf6368fcdf5280_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\System\iWlgTRa.exe
  C:\Windows\System\iWlgTRa.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\jNUvtRe.exe
  C:\Windows\System\jNUvtRe.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\vkYeaQO.exe
  C:\Windows\System\vkYeaQO.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\iCJFAuJ.exe
  C:\Windows\System\iCJFAuJ.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\Rgvnqsd.exe
  C:\Windows\System\Rgvnqsd.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\ynBVeBj.exe
  C:\Windows\System\ynBVeBj.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\xfgNbte.exe
  C:\Windows\System\xfgNbte.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\CNIBjkB.exe
  C:\Windows\System\CNIBjkB.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\DNWkDun.exe
  C:\Windows\System\DNWkDun.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\HAQgkMC.exe
  C:\Windows\System\HAQgkMC.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\MVqLapD.exe
  C:\Windows\System\MVqLapD.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\RFxdDag.exe
  C:\Windows\System\RFxdDag.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\vrgSUiK.exe
  C:\Windows\System\vrgSUiK.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\FrJHJdQ.exe
  C:\Windows\System\FrJHJdQ.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\hshdpLW.exe
  C:\Windows\System\hshdpLW.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\rSMNxVd.exe
  C:\Windows\System\rSMNxVd.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\qELWSkK.exe
  C:\Windows\System\qELWSkK.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\TgLZRUf.exe
  C:\Windows\System\TgLZRUf.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\HLZqBBF.exe
  C:\Windows\System\HLZqBBF.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\XPmimiV.exe
  C:\Windows\System\XPmimiV.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\hBtGTbt.exe
  C:\Windows\System\hBtGTbt.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\HxXJGXE.exe
  C:\Windows\System\HxXJGXE.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\njfUZXl.exe
  C:\Windows\System\njfUZXl.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\yRyOEOu.exe
  C:\Windows\System\yRyOEOu.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\hTdOBjH.exe
  C:\Windows\System\hTdOBjH.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\KFapFnM.exe
  C:\Windows\System\KFapFnM.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\rpjXkCN.exe
  C:\Windows\System\rpjXkCN.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\SQZAwia.exe
  C:\Windows\System\SQZAwia.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\clQRldc.exe
  C:\Windows\System\clQRldc.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\PngyfOp.exe
  C:\Windows\System\PngyfOp.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\aOfjuja.exe
  C:\Windows\System\aOfjuja.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\iiUEBUO.exe
  C:\Windows\System\iiUEBUO.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\HWXVaXZ.exe
  C:\Windows\System\HWXVaXZ.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\FnoJAxp.exe
  C:\Windows\System\FnoJAxp.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\dSofsQc.exe
  C:\Windows\System\dSofsQc.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\FEriGNO.exe
  C:\Windows\System\FEriGNO.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\vrcxLQB.exe
  C:\Windows\System\vrcxLQB.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\eCoMMor.exe
  C:\Windows\System\eCoMMor.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\HostJVE.exe
  C:\Windows\System\HostJVE.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\hDJdgAd.exe
  C:\Windows\System\hDJdgAd.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\VyECSof.exe
  C:\Windows\System\VyECSof.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\MNPWqXC.exe
  C:\Windows\System\MNPWqXC.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\ObFMjUn.exe
  C:\Windows\System\ObFMjUn.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\ZtVCnEW.exe
  C:\Windows\System\ZtVCnEW.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\VkXSNnB.exe
  C:\Windows\System\VkXSNnB.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\XjWQTPv.exe
  C:\Windows\System\XjWQTPv.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\aoYtEne.exe
  C:\Windows\System\aoYtEne.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\KdTkfGp.exe
  C:\Windows\System\KdTkfGp.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\qqqdQUx.exe
  C:\Windows\System\qqqdQUx.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\cAZScFs.exe
  C:\Windows\System\cAZScFs.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\ataggjJ.exe
  C:\Windows\System\ataggjJ.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\KtFpQXe.exe
  C:\Windows\System\KtFpQXe.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\NVvrZXM.exe
  C:\Windows\System\NVvrZXM.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\OmqOowY.exe
  C:\Windows\System\OmqOowY.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\fermJVU.exe
  C:\Windows\System\fermJVU.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\JhWocfn.exe
  C:\Windows\System\JhWocfn.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\HidJnIK.exe
  C:\Windows\System\HidJnIK.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\kywNjAi.exe
  C:\Windows\System\kywNjAi.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\VThpBNz.exe
  C:\Windows\System\VThpBNz.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\NhTwcog.exe
  C:\Windows\System\NhTwcog.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\msGYCTF.exe
  C:\Windows\System\msGYCTF.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\DRcJvGJ.exe
  C:\Windows\System\DRcJvGJ.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\KszdtFt.exe
  C:\Windows\System\KszdtFt.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\OnItPVI.exe
  C:\Windows\System\OnItPVI.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\ARLuNKE.exe
  C:\Windows\System\ARLuNKE.exe
  2⤵
  PID:1192
- C:\Windows\System\byGJMss.exe
  C:\Windows\System\byGJMss.exe
  2⤵
  PID:4232
- C:\Windows\System\IVgjaKl.exe
  C:\Windows\System\IVgjaKl.exe
  2⤵
  PID:1584
- C:\Windows\System\IUTivgO.exe
  C:\Windows\System\IUTivgO.exe
  2⤵
  PID:2680
- C:\Windows\System\FWXdYpr.exe
  C:\Windows\System\FWXdYpr.exe
  2⤵
  PID:556
- C:\Windows\System\JqqYmAr.exe
  C:\Windows\System\JqqYmAr.exe
  2⤵
  PID:3676
- C:\Windows\System\vpGluMX.exe
  C:\Windows\System\vpGluMX.exe
  2⤵
  PID:4092
- C:\Windows\System\qQrwkxa.exe
  C:\Windows\System\qQrwkxa.exe
  2⤵
  PID:3692
- C:\Windows\System\ESzeROm.exe
  C:\Windows\System\ESzeROm.exe
  2⤵
  PID:1952
- C:\Windows\System\HkPvqgr.exe
  C:\Windows\System\HkPvqgr.exe
  2⤵
  PID:1536
- C:\Windows\System\KBSOYlu.exe
  C:\Windows\System\KBSOYlu.exe
  2⤵
  PID:1008
- C:\Windows\System\MOTWTtP.exe
  C:\Windows\System\MOTWTtP.exe
  2⤵
  PID:4632
- C:\Windows\System\bKGJCcI.exe
  C:\Windows\System\bKGJCcI.exe
  2⤵
  PID:1940
- C:\Windows\System\GZnNLKN.exe
  C:\Windows\System\GZnNLKN.exe
  2⤵
  PID:4328
- C:\Windows\System\ZbYjxCu.exe
  C:\Windows\System\ZbYjxCu.exe
  2⤵
  PID:4616
- C:\Windows\System\iVbelyl.exe
  C:\Windows\System\iVbelyl.exe
  2⤵
  PID:4036
- C:\Windows\System\kldBdLh.exe
  C:\Windows\System\kldBdLh.exe
  2⤵
  PID:3280
- C:\Windows\System\AKlDJWC.exe
  C:\Windows\System\AKlDJWC.exe
  2⤵
  PID:5112
- C:\Windows\System\zAQmxWm.exe
  C:\Windows\System\zAQmxWm.exe
  2⤵
  PID:5140
- C:\Windows\System\zSRKEPs.exe
  C:\Windows\System\zSRKEPs.exe
  2⤵
  PID:5164
- C:\Windows\System\GjhDBjT.exe
  C:\Windows\System\GjhDBjT.exe
  2⤵
  PID:5188
- C:\Windows\System\CDTJXnx.exe
  C:\Windows\System\CDTJXnx.exe
  2⤵
  PID:5204
- C:\Windows\System\vQuOiow.exe
  C:\Windows\System\vQuOiow.exe
  2⤵
  PID:5248
- C:\Windows\System\vaJIObo.exe
  C:\Windows\System\vaJIObo.exe
  2⤵
  PID:5264
- C:\Windows\System\TRfGxZf.exe
  C:\Windows\System\TRfGxZf.exe
  2⤵
  PID:5288
- C:\Windows\System\IfpWOUz.exe
  C:\Windows\System\IfpWOUz.exe
  2⤵
  PID:5320
- C:\Windows\System\PLbfMjS.exe
  C:\Windows\System\PLbfMjS.exe
  2⤵
  PID:5352
- C:\Windows\System\xhgCtbe.exe
  C:\Windows\System\xhgCtbe.exe
  2⤵
  PID:5368
- C:\Windows\System\mJKvJCv.exe
  C:\Windows\System\mJKvJCv.exe
  2⤵
  PID:5384
- C:\Windows\System\Fkirbxv.exe
  C:\Windows\System\Fkirbxv.exe
  2⤵
  PID:5412
- C:\Windows\System\OHdCTMe.exe
  C:\Windows\System\OHdCTMe.exe
  2⤵
  PID:5436
- C:\Windows\System\ZSrodDB.exe
  C:\Windows\System\ZSrodDB.exe
  2⤵
  PID:5452
- C:\Windows\System\kRHnpFW.exe
  C:\Windows\System\kRHnpFW.exe
  2⤵
  PID:5476
- C:\Windows\System\SFAUsZf.exe
  C:\Windows\System\SFAUsZf.exe
  2⤵
  PID:5504
- C:\Windows\System\CdgaRoV.exe
  C:\Windows\System\CdgaRoV.exe
  2⤵
  PID:5524
- C:\Windows\System\GeOPpzt.exe
  C:\Windows\System\GeOPpzt.exe
  2⤵
  PID:5572
- C:\Windows\System\iIVzJpw.exe
  C:\Windows\System\iIVzJpw.exe
  2⤵
  PID:5600
- C:\Windows\System\npOTocj.exe
  C:\Windows\System\npOTocj.exe
  2⤵
  PID:5628
- C:\Windows\System\mjlfibV.exe
  C:\Windows\System\mjlfibV.exe
  2⤵
  PID:5644
- C:\Windows\System\gkGlWjZ.exe
  C:\Windows\System\gkGlWjZ.exe
  2⤵
  PID:5664
- C:\Windows\System\nFNmpWG.exe
  C:\Windows\System\nFNmpWG.exe
  2⤵
  PID:5680
- C:\Windows\System\ewuocmd.exe
  C:\Windows\System\ewuocmd.exe
  2⤵
  PID:5704
- C:\Windows\System\JeAeIPk.exe
  C:\Windows\System\JeAeIPk.exe
  2⤵
  PID:5720
- C:\Windows\System\wozNZad.exe
  C:\Windows\System\wozNZad.exe
  2⤵
  PID:5744
- C:\Windows\System\aUUKEWS.exe
  C:\Windows\System\aUUKEWS.exe
  2⤵
  PID:5768
- C:\Windows\System\lxvwoCH.exe
  C:\Windows\System\lxvwoCH.exe
  2⤵
  PID:5788
- C:\Windows\System\EmMHcrY.exe
  C:\Windows\System\EmMHcrY.exe
  2⤵
  PID:5808
- C:\Windows\System\vzXxFyq.exe
  C:\Windows\System\vzXxFyq.exe
  2⤵
  PID:5828
- C:\Windows\System\LnVzTHd.exe
  C:\Windows\System\LnVzTHd.exe
  2⤵
  PID:5844
- C:\Windows\System\azWNBAi.exe
  C:\Windows\System\azWNBAi.exe
  2⤵
  PID:5876
- C:\Windows\System\KuMYpJN.exe
  C:\Windows\System\KuMYpJN.exe
  2⤵
  PID:5908
- C:\Windows\System\hEmlmJD.exe
  C:\Windows\System\hEmlmJD.exe
  2⤵
  PID:5932
- C:\Windows\System\jivPTiP.exe
  C:\Windows\System\jivPTiP.exe
  2⤵
  PID:5956
- C:\Windows\System\Ernutpz.exe
  C:\Windows\System\Ernutpz.exe
  2⤵
  PID:5980
- C:\Windows\System\nNkuwZD.exe
  C:\Windows\System\nNkuwZD.exe
  2⤵
  PID:5996
- C:\Windows\System\BDHHbit.exe
  C:\Windows\System\BDHHbit.exe
  2⤵
  PID:6024
- C:\Windows\System\yFWyZNe.exe
  C:\Windows\System\yFWyZNe.exe
  2⤵
  PID:6048
- C:\Windows\System\DDEobZH.exe
  C:\Windows\System\DDEobZH.exe
  2⤵
  PID:6068
- C:\Windows\System\ewaQcZN.exe
  C:\Windows\System\ewaQcZN.exe
  2⤵
  PID:6092
- C:\Windows\System\ybhJQUB.exe
  C:\Windows\System\ybhJQUB.exe
  2⤵
  PID:6112
- C:\Windows\System\HsHXber.exe
  C:\Windows\System\HsHXber.exe
  2⤵
  PID:6128
- C:\Windows\System\msGbWrr.exe
  C:\Windows\System\msGbWrr.exe
  2⤵
  PID:3548
- C:\Windows\System\hhqEanP.exe
  C:\Windows\System\hhqEanP.exe
  2⤵
  PID:3780
- C:\Windows\System\DNzdygp.exe
  C:\Windows\System\DNzdygp.exe
  2⤵
  PID:2156
- C:\Windows\System\sKQHfFz.exe
  C:\Windows\System\sKQHfFz.exe
  2⤵
  PID:2708
- C:\Windows\System\wkdphVl.exe
  C:\Windows\System\wkdphVl.exe
  2⤵
  PID:4764
- C:\Windows\System\ooqIQQG.exe
  C:\Windows\System\ooqIQQG.exe
  2⤵
  PID:4168
- C:\Windows\System\bSoLqPn.exe
  C:\Windows\System\bSoLqPn.exe
  2⤵
  PID:4708
- C:\Windows\System\OVVCQSs.exe
  C:\Windows\System\OVVCQSs.exe
  2⤵
  PID:5076
- C:\Windows\System\hFEbOAF.exe
  C:\Windows\System\hFEbOAF.exe
  2⤵
  PID:1956
- C:\Windows\System\jFucMoB.exe
  C:\Windows\System\jFucMoB.exe
  2⤵
  PID:2076
- C:\Windows\System\NpXxuqa.exe
  C:\Windows\System\NpXxuqa.exe
  2⤵
  PID:5260
- C:\Windows\System\yfuYyvu.exe
  C:\Windows\System\yfuYyvu.exe
  2⤵
  PID:1304
- C:\Windows\System\ixKZmsn.exe
  C:\Windows\System\ixKZmsn.exe
  2⤵
  PID:4320
- C:\Windows\System\rulnzYI.exe
  C:\Windows\System\rulnzYI.exe
  2⤵
  PID:3044
- C:\Windows\System\fKEXGSC.exe
  C:\Windows\System\fKEXGSC.exe
  2⤵
  PID:4408
- C:\Windows\System\oOoGGAg.exe
  C:\Windows\System\oOoGGAg.exe
  2⤵
  PID:2060
- C:\Windows\System\YtPIlzG.exe
  C:\Windows\System\YtPIlzG.exe
  2⤵
  PID:5428
- C:\Windows\System\ONcdpPX.exe
  C:\Windows\System\ONcdpPX.exe
  2⤵
  PID:816
- C:\Windows\System\oKzvWqb.exe
  C:\Windows\System\oKzvWqb.exe
  2⤵
  PID:1396
- C:\Windows\System\QemPkCr.exe
  C:\Windows\System\QemPkCr.exe
  2⤵
  PID:5312
- C:\Windows\System\NWvzfDf.exe
  C:\Windows\System\NWvzfDf.exe
  2⤵
  PID:6120
- C:\Windows\System\DjEzXJC.exe
  C:\Windows\System\DjEzXJC.exe
  2⤵
  PID:6004
- C:\Windows\System\FVECmNz.exe
  C:\Windows\System\FVECmNz.exe
  2⤵
  PID:1244
- C:\Windows\System\uXuPiuY.exe
  C:\Windows\System\uXuPiuY.exe
  2⤵
  PID:5132
- C:\Windows\System\zUhRMNH.exe
  C:\Windows\System\zUhRMNH.exe
  2⤵
  PID:5172
- C:\Windows\System\QxbAjTv.exe
  C:\Windows\System\QxbAjTv.exe
  2⤵
  PID:5220
- C:\Windows\System\fQNptAx.exe
  C:\Windows\System\fQNptAx.exe
  2⤵
  PID:5364
- C:\Windows\System\PGnisUk.exe
  C:\Windows\System\PGnisUk.exe
  2⤵
  PID:6156
- C:\Windows\System\ieGwkQl.exe
  C:\Windows\System\ieGwkQl.exe
  2⤵
  PID:6180
- C:\Windows\System\qaIAOjd.exe
  C:\Windows\System\qaIAOjd.exe
  2⤵
  PID:6200
- C:\Windows\System\vIqFDin.exe
  C:\Windows\System\vIqFDin.exe
  2⤵
  PID:6232
- C:\Windows\System\bKhoTHc.exe
  C:\Windows\System\bKhoTHc.exe
  2⤵
  PID:6248
- C:\Windows\System\ZwPTDBp.exe
  C:\Windows\System\ZwPTDBp.exe
  2⤵
  PID:6268
- C:\Windows\System\fgyFwKT.exe
  C:\Windows\System\fgyFwKT.exe
  2⤵
  PID:6284
- C:\Windows\System\HviTCiU.exe
  C:\Windows\System\HviTCiU.exe
  2⤵
  PID:6312
- C:\Windows\System\jWBsaVv.exe
  C:\Windows\System\jWBsaVv.exe
  2⤵
  PID:6332
- C:\Windows\System\GcNVyYv.exe
  C:\Windows\System\GcNVyYv.exe
  2⤵
  PID:6348
- C:\Windows\System\yMzXALC.exe
  C:\Windows\System\yMzXALC.exe
  2⤵
  PID:6376
- C:\Windows\System\IPMEDnU.exe
  C:\Windows\System\IPMEDnU.exe
  2⤵
  PID:6392
- C:\Windows\System\UlrDwZL.exe
  C:\Windows\System\UlrDwZL.exe
  2⤵
  PID:6416
- C:\Windows\System\XyufcBm.exe
  C:\Windows\System\XyufcBm.exe
  2⤵
  PID:6432
- C:\Windows\System\HBtFaNj.exe
  C:\Windows\System\HBtFaNj.exe
  2⤵
  PID:6452
- C:\Windows\System\AdAnVBE.exe
  C:\Windows\System\AdAnVBE.exe
  2⤵
  PID:6472
- C:\Windows\System\KcECMKa.exe
  C:\Windows\System\KcECMKa.exe
  2⤵
  PID:6492
- C:\Windows\System\APKRLRm.exe
  C:\Windows\System\APKRLRm.exe
  2⤵
  PID:6512
- C:\Windows\System\cBgSyqq.exe
  C:\Windows\System\cBgSyqq.exe
  2⤵
  PID:6540
- C:\Windows\System\pVTvDRR.exe
  C:\Windows\System\pVTvDRR.exe
  2⤵
  PID:6556
- C:\Windows\System\yQoAlBW.exe
  C:\Windows\System\yQoAlBW.exe
  2⤵
  PID:6580
- C:\Windows\System\ITzhbWB.exe
  C:\Windows\System\ITzhbWB.exe
  2⤵
  PID:6600
- C:\Windows\System\gcaNUtX.exe
  C:\Windows\System\gcaNUtX.exe
  2⤵
  PID:6616
- C:\Windows\System\TyvUFVB.exe
  C:\Windows\System\TyvUFVB.exe
  2⤵
  PID:6632
- C:\Windows\System\CgXCiYn.exe
  C:\Windows\System\CgXCiYn.exe
  2⤵
  PID:6652
- C:\Windows\System\bXWWMTT.exe
  C:\Windows\System\bXWWMTT.exe
  2⤵
  PID:6668
- C:\Windows\System\xtOzXKU.exe
  C:\Windows\System\xtOzXKU.exe
  2⤵
  PID:6700
- C:\Windows\System\qlKRMfI.exe
  C:\Windows\System\qlKRMfI.exe
  2⤵
  PID:6716
- C:\Windows\System\WQMeSlV.exe
  C:\Windows\System\WQMeSlV.exe
  2⤵
  PID:6740
- C:\Windows\System\YAziZjD.exe
  C:\Windows\System\YAziZjD.exe
  2⤵
  PID:6768
- C:\Windows\System\WDUGWyO.exe
  C:\Windows\System\WDUGWyO.exe
  2⤵
  PID:6788
- C:\Windows\System\uxdVAYp.exe
  C:\Windows\System\uxdVAYp.exe
  2⤵
  PID:6808
- C:\Windows\System\HXWUyjL.exe
  C:\Windows\System\HXWUyjL.exe
  2⤵
  PID:6828
- C:\Windows\System\PodhAsF.exe
  C:\Windows\System\PodhAsF.exe
  2⤵
  PID:6848
- C:\Windows\System\TaTYkAC.exe
  C:\Windows\System\TaTYkAC.exe
  2⤵
  PID:6868
- C:\Windows\System\UFaarOW.exe
  C:\Windows\System\UFaarOW.exe
  2⤵
  PID:6888
- C:\Windows\System\sOAZJEP.exe
  C:\Windows\System\sOAZJEP.exe
  2⤵
  PID:6904
- C:\Windows\System\etySzpa.exe
  C:\Windows\System\etySzpa.exe
  2⤵
  PID:6940
- C:\Windows\System\NxwXHhi.exe
  C:\Windows\System\NxwXHhi.exe
  2⤵
  PID:6964
- C:\Windows\System\TAeTSad.exe
  C:\Windows\System\TAeTSad.exe
  2⤵
  PID:6988
- C:\Windows\System\xLoZtJW.exe
  C:\Windows\System\xLoZtJW.exe
  2⤵
  PID:7012
- C:\Windows\System\MoMMPqR.exe
  C:\Windows\System\MoMMPqR.exe
  2⤵
  PID:7028
- C:\Windows\System\IhQeQJR.exe
  C:\Windows\System\IhQeQJR.exe
  2⤵
  PID:7048
- C:\Windows\System\AjTYVHh.exe
  C:\Windows\System\AjTYVHh.exe
  2⤵
  PID:7076
- C:\Windows\System\iBHhmeE.exe
  C:\Windows\System\iBHhmeE.exe
  2⤵
  PID:7100
- C:\Windows\System\bCaCZJL.exe
  C:\Windows\System\bCaCZJL.exe
  2⤵
  PID:7120
- C:\Windows\System\RFlNzSw.exe
  C:\Windows\System\RFlNzSw.exe
  2⤵
  PID:7136
- C:\Windows\System\AzjFmVt.exe
  C:\Windows\System\AzjFmVt.exe
  2⤵
  PID:7160
- C:\Windows\System\Gbstnpe.exe
  C:\Windows\System\Gbstnpe.exe
  2⤵
  PID:5424
- C:\Windows\System\SryBAGy.exe
  C:\Windows\System\SryBAGy.exe
  2⤵
  PID:5472
- C:\Windows\System\EsyHoyc.exe
  C:\Windows\System\EsyHoyc.exe
  2⤵
  PID:5520
- C:\Windows\System\ldIDKMa.exe
  C:\Windows\System\ldIDKMa.exe
  2⤵
  PID:5544
- C:\Windows\System\rrAFwMc.exe
  C:\Windows\System\rrAFwMc.exe
  2⤵
  PID:5696
- C:\Windows\System\kpCiveU.exe
  C:\Windows\System\kpCiveU.exe
  2⤵
  PID:5796
- C:\Windows\System\wucgkRw.exe
  C:\Windows\System\wucgkRw.exe
  2⤵
  PID:4724
- C:\Windows\System\iPjdFhw.exe
  C:\Windows\System\iPjdFhw.exe
  2⤵
  PID:6008
- C:\Windows\System\BBdOmrj.exe
  C:\Windows\System\BBdOmrj.exe
  2⤵
  PID:6060
- C:\Windows\System\CTfNnEw.exe
  C:\Windows\System\CTfNnEw.exe
  2⤵
  PID:7176
- C:\Windows\System\SuMjuMk.exe
  C:\Windows\System\SuMjuMk.exe
  2⤵
  PID:7200
- C:\Windows\System\EGpGQIj.exe
  C:\Windows\System\EGpGQIj.exe
  2⤵
  PID:7224
- C:\Windows\System\qXfEgQD.exe
  C:\Windows\System\qXfEgQD.exe
  2⤵
  PID:7248
- C:\Windows\System\qMWtZnx.exe
  C:\Windows\System\qMWtZnx.exe
  2⤵
  PID:7268
- C:\Windows\System\PlGyDCW.exe
  C:\Windows\System\PlGyDCW.exe
  2⤵
  PID:7292
- C:\Windows\System\UHhsnXU.exe
  C:\Windows\System\UHhsnXU.exe
  2⤵
  PID:7316
- C:\Windows\System\wlCOuNh.exe
  C:\Windows\System\wlCOuNh.exe
  2⤵
  PID:7332
- C:\Windows\System\DSbkQrp.exe
  C:\Windows\System\DSbkQrp.exe
  2⤵
  PID:7356
- C:\Windows\System\RfeQRmX.exe
  C:\Windows\System\RfeQRmX.exe
  2⤵
  PID:7380
- C:\Windows\System\dMuEcSo.exe
  C:\Windows\System\dMuEcSo.exe
  2⤵
  PID:7404
- C:\Windows\System\kpwCxCE.exe
  C:\Windows\System\kpwCxCE.exe
  2⤵
  PID:7420
- C:\Windows\System\ezLIWNw.exe
  C:\Windows\System\ezLIWNw.exe
  2⤵
  PID:7444
- C:\Windows\System\yUlJpZF.exe
  C:\Windows\System\yUlJpZF.exe
  2⤵
  PID:7468
- C:\Windows\System\xNlYKvk.exe
  C:\Windows\System\xNlYKvk.exe
  2⤵
  PID:7488
- C:\Windows\System\rGOeEZs.exe
  C:\Windows\System\rGOeEZs.exe
  2⤵
  PID:7504
- C:\Windows\System\OsmBxSS.exe
  C:\Windows\System\OsmBxSS.exe
  2⤵
  PID:7528
- C:\Windows\System\KtUTpuJ.exe
  C:\Windows\System\KtUTpuJ.exe
  2⤵
  PID:7556
- C:\Windows\System\sUFJWnI.exe
  C:\Windows\System\sUFJWnI.exe
  2⤵
  PID:7576
- C:\Windows\System\KYRhQAY.exe
  C:\Windows\System\KYRhQAY.exe
  2⤵
  PID:7984
- C:\Windows\System\jncGraK.exe
  C:\Windows\System\jncGraK.exe
  2⤵
  PID:8000
- C:\Windows\System\lbfDSlG.exe
  C:\Windows\System\lbfDSlG.exe
  2⤵
  PID:8016
- C:\Windows\System\bDLvOKO.exe
  C:\Windows\System\bDLvOKO.exe
  2⤵
  PID:8032
- C:\Windows\System\TyVOjGu.exe
  C:\Windows\System\TyVOjGu.exe
  2⤵
  PID:8048
- C:\Windows\System\pzCArTe.exe
  C:\Windows\System\pzCArTe.exe
  2⤵
  PID:8064
- C:\Windows\System\ziddNXI.exe
  C:\Windows\System\ziddNXI.exe
  2⤵
  PID:8080
- C:\Windows\System\LCqKAFl.exe
  C:\Windows\System\LCqKAFl.exe
  2⤵
  PID:6364
- C:\Windows\System\tiuorWp.exe
  C:\Windows\System\tiuorWp.exe
  2⤵
  PID:5152
- C:\Windows\System\RsdljPP.exe
  C:\Windows\System\RsdljPP.exe
  2⤵
  PID:6080
- C:\Windows\System\FwSMHjn.exe
  C:\Windows\System\FwSMHjn.exe
  2⤵
  PID:2952
- C:\Windows\System\GmgNvsE.exe
  C:\Windows\System\GmgNvsE.exe
  2⤵
  PID:5200
- C:\Windows\System\iTIkUFg.exe
  C:\Windows\System\iTIkUFg.exe
  2⤵
  PID:6148
- C:\Windows\System\AMABsxa.exe
  C:\Windows\System\AMABsxa.exe
  2⤵
  PID:6260
- C:\Windows\System\UVMArKC.exe
  C:\Windows\System\UVMArKC.exe
  2⤵
  PID:6360
- C:\Windows\System\kOtJlTn.exe
  C:\Windows\System\kOtJlTn.exe
  2⤵
  PID:6440
- C:\Windows\System\rzRGzPS.exe
  C:\Windows\System\rzRGzPS.exe
  2⤵
  PID:6468
- C:\Windows\System\RMVXiec.exe
  C:\Windows\System\RMVXiec.exe
  2⤵
  PID:6504
- C:\Windows\System\NZDqAoG.exe
  C:\Windows\System\NZDqAoG.exe
  2⤵
  PID:6588
- C:\Windows\System\CFctuVf.exe
  C:\Windows\System\CFctuVf.exe
  2⤵
  PID:6644
- C:\Windows\System\pNAKmSJ.exe
  C:\Windows\System\pNAKmSJ.exe
  2⤵
  PID:6784
- C:\Windows\System\yHDhjnf.exe
  C:\Windows\System\yHDhjnf.exe
  2⤵
  PID:7060
- C:\Windows\System\TVlfajV.exe
  C:\Windows\System\TVlfajV.exe
  2⤵
  PID:5688
- C:\Windows\System\jhiLKgz.exe
  C:\Windows\System\jhiLKgz.exe
  2⤵
  PID:1140
- C:\Windows\System\pJFoxND.exe
  C:\Windows\System\pJFoxND.exe
  2⤵
  PID:7184
- C:\Windows\System\hGlBhJZ.exe
  C:\Windows\System\hGlBhJZ.exe
  2⤵
  PID:7428
- C:\Windows\System\OAMWzBO.exe
  C:\Windows\System\OAMWzBO.exe
  2⤵
  PID:6660
- C:\Windows\System\CFOKQvv.exe
  C:\Windows\System\CFOKQvv.exe
  2⤵
  PID:6708
- C:\Windows\System\MjGDCVi.exe
  C:\Windows\System\MjGDCVi.exe
  2⤵
  PID:6760
- C:\Windows\System\fkvwDCv.exe
  C:\Windows\System\fkvwDCv.exe
  2⤵
  PID:6824
- C:\Windows\System\gSXCydM.exe
  C:\Windows\System\gSXCydM.exe
  2⤵
  PID:6880
- C:\Windows\System\vuxlXUb.exe
  C:\Windows\System\vuxlXUb.exe
  2⤵
  PID:6984
- C:\Windows\System\eTxGlYS.exe
  C:\Windows\System\eTxGlYS.exe
  2⤵
  PID:7068
- C:\Windows\System\bnOuJYR.exe
  C:\Windows\System\bnOuJYR.exe
  2⤵
  PID:4988
- C:\Windows\System\UEGJZoP.exe
  C:\Windows\System\UEGJZoP.exe
  2⤵
  PID:7172
- C:\Windows\System\zqwyYUO.exe
  C:\Windows\System\zqwyYUO.exe
  2⤵
  PID:7264
- C:\Windows\System\QTlbjMr.exe
  C:\Windows\System\QTlbjMr.exe
  2⤵
  PID:7372
- C:\Windows\System\QiaTELX.exe
  C:\Windows\System\QiaTELX.exe
  2⤵
  PID:7484
- C:\Windows\System\QLXoeDv.exe
  C:\Windows\System\QLXoeDv.exe
  2⤵
  PID:6896
- C:\Windows\System\goGIhzD.exe
  C:\Windows\System\goGIhzD.exe
  2⤵
  PID:7020
- C:\Windows\System\PdrKjfC.exe
  C:\Windows\System\PdrKjfC.exe
  2⤵
  PID:8264
- C:\Windows\System\aXspsBW.exe
  C:\Windows\System\aXspsBW.exe
  2⤵
  PID:8280
- C:\Windows\System\weGuUHy.exe
  C:\Windows\System\weGuUHy.exe
  2⤵
  PID:8304
- C:\Windows\System\ECohSCc.exe
  C:\Windows\System\ECohSCc.exe
  2⤵
  PID:8324
- C:\Windows\System\xQrVsKH.exe
  C:\Windows\System\xQrVsKH.exe
  2⤵
  PID:8344
- C:\Windows\System\TYCBsDC.exe
  C:\Windows\System\TYCBsDC.exe
  2⤵
  PID:8364
- C:\Windows\System\wvthTul.exe
  C:\Windows\System\wvthTul.exe
  2⤵
  PID:8384
- C:\Windows\System\hPdeZgv.exe
  C:\Windows\System\hPdeZgv.exe
  2⤵
  PID:8400
- C:\Windows\System\SZsYXaZ.exe
  C:\Windows\System\SZsYXaZ.exe
  2⤵
  PID:8456
- C:\Windows\System\CrqeIfQ.exe
  C:\Windows\System\CrqeIfQ.exe
  2⤵
  PID:8524
- C:\Windows\System\MjUEnzv.exe
  C:\Windows\System\MjUEnzv.exe
  2⤵
  PID:8564
- C:\Windows\System\rHmcuGS.exe
  C:\Windows\System\rHmcuGS.exe
  2⤵
  PID:8588
- C:\Windows\System\EkDWRSX.exe
  C:\Windows\System\EkDWRSX.exe
  2⤵
  PID:8664
- C:\Windows\System\TfYneZE.exe
  C:\Windows\System\TfYneZE.exe
  2⤵
  PID:8700
- C:\Windows\System\rYAumoD.exe
  C:\Windows\System\rYAumoD.exe
  2⤵
  PID:8716
- C:\Windows\System\eatjFEu.exe
  C:\Windows\System\eatjFEu.exe
  2⤵
  PID:8740
- C:\Windows\System\AAIvypb.exe
  C:\Windows\System\AAIvypb.exe
  2⤵
  PID:8756
- C:\Windows\System\VedFWXM.exe
  C:\Windows\System\VedFWXM.exe
  2⤵
  PID:8776
- C:\Windows\System\ynuwlhX.exe
  C:\Windows\System\ynuwlhX.exe
  2⤵
  PID:8796
- C:\Windows\System\iwFrrkg.exe
  C:\Windows\System\iwFrrkg.exe
  2⤵
  PID:8820
- C:\Windows\System\oiRUxaH.exe
  C:\Windows\System\oiRUxaH.exe
  2⤵
  PID:8840
- C:\Windows\System\NZUqCAT.exe
  C:\Windows\System\NZUqCAT.exe
  2⤵
  PID:8864
- C:\Windows\System\afxoTLW.exe
  C:\Windows\System\afxoTLW.exe
  2⤵
  PID:8884
- C:\Windows\System\RHVCENZ.exe
  C:\Windows\System\RHVCENZ.exe
  2⤵
  PID:8900
- C:\Windows\System\ggHZamD.exe
  C:\Windows\System\ggHZamD.exe
  2⤵
  PID:8924
- C:\Windows\System\yrGWGNn.exe
  C:\Windows\System\yrGWGNn.exe
  2⤵
  PID:8952
- C:\Windows\System\lvctKGB.exe
  C:\Windows\System\lvctKGB.exe
  2⤵
  PID:8972
- C:\Windows\System\mjqlYnT.exe
  C:\Windows\System\mjqlYnT.exe
  2⤵
  PID:8996
- C:\Windows\System\iONqFQj.exe
  C:\Windows\System\iONqFQj.exe
  2⤵
  PID:9020
- C:\Windows\System\ZRzlRwU.exe
  C:\Windows\System\ZRzlRwU.exe
  2⤵
  PID:9036
- C:\Windows\System\lLPJGkU.exe
  C:\Windows\System\lLPJGkU.exe
  2⤵
  PID:9056
- C:\Windows\System\nSsRUDv.exe
  C:\Windows\System\nSsRUDv.exe
  2⤵
  PID:9076
- C:\Windows\System\whIKXaS.exe
  C:\Windows\System\whIKXaS.exe
  2⤵
  PID:9096
- C:\Windows\System\nFuOShq.exe
  C:\Windows\System\nFuOShq.exe
  2⤵
  PID:9112
- C:\Windows\System\wQGuCOj.exe
  C:\Windows\System\wQGuCOj.exe
  2⤵
  PID:9128
- C:\Windows\System\CoJhyNF.exe
  C:\Windows\System\CoJhyNF.exe
  2⤵
  PID:9148
- C:\Windows\System\cJLbukD.exe
  C:\Windows\System\cJLbukD.exe
  2⤵
  PID:9196
- C:\Windows\System\EXuaiCo.exe
  C:\Windows\System\EXuaiCo.exe
  2⤵
  PID:8112
- C:\Windows\System\uKvLxuq.exe
  C:\Windows\System\uKvLxuq.exe
  2⤵
  PID:6208
- C:\Windows\System\snmtiEF.exe
  C:\Windows\System\snmtiEF.exe
  2⤵
  PID:1760
- C:\Windows\System\RDLxhQx.exe
  C:\Windows\System\RDLxhQx.exe
  2⤵
  PID:5400
- C:\Windows\System\ISGnBGl.exe
  C:\Windows\System\ISGnBGl.exe
  2⤵
  PID:6164
- C:\Windows\System\zVxPyPX.exe
  C:\Windows\System\zVxPyPX.exe
  2⤵
  PID:6448
- C:\Windows\System\NmPreZI.exe
  C:\Windows\System\NmPreZI.exe
  2⤵
  PID:6844
- C:\Windows\System\JhhEmaT.exe
  C:\Windows\System\JhhEmaT.exe
  2⤵
  PID:7244
- C:\Windows\System\orUjQRj.exe
  C:\Windows\System\orUjQRj.exe
  2⤵
  PID:7520
- C:\Windows\System\sZYseQn.exe
  C:\Windows\System\sZYseQn.exe
  2⤵
  PID:7056
- C:\Windows\System\FtMkdsJ.exe
  C:\Windows\System\FtMkdsJ.exe
  2⤵
  PID:8028
- C:\Windows\System\RJsOuds.exe
  C:\Windows\System\RJsOuds.exe
  2⤵
  PID:8160
- C:\Windows\System\AWLQCph.exe
  C:\Windows\System\AWLQCph.exe
  2⤵
  PID:8696
- C:\Windows\System\eDnirdr.exe
  C:\Windows\System\eDnirdr.exe
  2⤵
  PID:8728
- C:\Windows\System\yincQTf.exe
  C:\Windows\System\yincQTf.exe
  2⤵
  PID:8780
- C:\Windows\System\UnvZTPi.exe
  C:\Windows\System\UnvZTPi.exe
  2⤵
  PID:5884
- C:\Windows\System\zmszBgY.exe
  C:\Windows\System\zmszBgY.exe
  2⤵
  PID:9224
- C:\Windows\System\UcKVhYJ.exe
  C:\Windows\System\UcKVhYJ.exe
  2⤵
  PID:9244
- C:\Windows\System\fpOuVGC.exe
  C:\Windows\System\fpOuVGC.exe
  2⤵
  PID:9264
- C:\Windows\System\hdkFuyD.exe
  C:\Windows\System\hdkFuyD.exe
  2⤵
  PID:9300
- C:\Windows\System\AGkVXDx.exe
  C:\Windows\System\AGkVXDx.exe
  2⤵
  PID:9324
- C:\Windows\System\pjPNysW.exe
  C:\Windows\System\pjPNysW.exe
  2⤵
  PID:9340
- C:\Windows\System\uqhdXeZ.exe
  C:\Windows\System\uqhdXeZ.exe
  2⤵
  PID:9368
- C:\Windows\System\AZxSzFo.exe
  C:\Windows\System\AZxSzFo.exe
  2⤵
  PID:9392
- C:\Windows\System\TWQbJID.exe
  C:\Windows\System\TWQbJID.exe
  2⤵
  PID:9412
- C:\Windows\System\YXkvyPE.exe
  C:\Windows\System\YXkvyPE.exe
  2⤵
  PID:9436
- C:\Windows\System\QJjBLfw.exe
  C:\Windows\System\QJjBLfw.exe
  2⤵
  PID:9452
- C:\Windows\System\qEgRQNa.exe
  C:\Windows\System\qEgRQNa.exe
  2⤵
  PID:9472
- C:\Windows\System\FtEQRON.exe
  C:\Windows\System\FtEQRON.exe
  2⤵
  PID:9492
- C:\Windows\System\mpCNufN.exe
  C:\Windows\System\mpCNufN.exe
  2⤵
  PID:9512
- C:\Windows\System\pCqUwQe.exe
  C:\Windows\System\pCqUwQe.exe
  2⤵
  PID:9532
- C:\Windows\System\KaIcGtc.exe
  C:\Windows\System\KaIcGtc.exe
  2⤵
  PID:9616
- C:\Windows\System\rfDLDuI.exe
  C:\Windows\System\rfDLDuI.exe
  2⤵
  PID:9644
- C:\Windows\System\jIfBFLQ.exe
  C:\Windows\System\jIfBFLQ.exe
  2⤵
  PID:9664
- C:\Windows\System\cGPaZOR.exe
  C:\Windows\System\cGPaZOR.exe
  2⤵
  PID:9684
- C:\Windows\System\FTelBWW.exe
  C:\Windows\System\FTelBWW.exe
  2⤵
  PID:9716
- C:\Windows\System\TdoXsTT.exe
  C:\Windows\System\TdoXsTT.exe
  2⤵
  PID:9736
- C:\Windows\System\ypxqGpf.exe
  C:\Windows\System\ypxqGpf.exe
  2⤵
  PID:9760
- C:\Windows\System\vFfHmne.exe
  C:\Windows\System\vFfHmne.exe
  2⤵
  PID:9780
- C:\Windows\System\kvwKnVd.exe
  C:\Windows\System\kvwKnVd.exe
  2⤵
  PID:9800
- C:\Windows\System\UefUNup.exe
  C:\Windows\System\UefUNup.exe
  2⤵
  PID:9816
- C:\Windows\System\xrHGkxa.exe
  C:\Windows\System\xrHGkxa.exe
  2⤵
  PID:9840
- C:\Windows\System\wzKiVih.exe
  C:\Windows\System\wzKiVih.exe
  2⤵
  PID:9884
- C:\Windows\System\IVFucHc.exe
  C:\Windows\System\IVFucHc.exe
  2⤵
  PID:9908
- C:\Windows\System\qzeqEzc.exe
  C:\Windows\System\qzeqEzc.exe
  2⤵
  PID:9928
- C:\Windows\System\MJHgZKa.exe
  C:\Windows\System\MJHgZKa.exe
  2⤵
  PID:6724
- C:\Windows\System\cUOwtoG.exe
  C:\Windows\System\cUOwtoG.exe
  2⤵
  PID:6732
- C:\Windows\System\vFQaFZe.exe
  C:\Windows\System\vFQaFZe.exe
  2⤵
  PID:9048
- C:\Windows\System\gzGSkgv.exe
  C:\Windows\System\gzGSkgv.exe
  2⤵
  PID:9052
- C:\Windows\System\VaqMjwH.exe
  C:\Windows\System\VaqMjwH.exe
  2⤵
  PID:9156
- C:\Windows\System\sNPbVzm.exe
  C:\Windows\System\sNPbVzm.exe
  2⤵
  PID:7936
- C:\Windows\System\RFnDyAy.exe
  C:\Windows\System\RFnDyAy.exe
  2⤵
  PID:7960
- C:\Windows\System\mjSZkJF.exe
  C:\Windows\System\mjSZkJF.exe
  2⤵
  PID:2812
- C:\Windows\System\LjbIKIi.exe
  C:\Windows\System\LjbIKIi.exe
  2⤵
  PID:6280
- C:\Windows\System\sfxGQae.exe
  C:\Windows\System\sfxGQae.exe
  2⤵
  PID:8848
- C:\Windows\System\qCUGXTF.exe
  C:\Windows\System\qCUGXTF.exe
  2⤵
  PID:6628
- C:\Windows\System\xcstVom.exe
  C:\Windows\System\xcstVom.exe
  2⤵
  PID:5840
- C:\Windows\System\XWNQlAD.exe
  C:\Windows\System\XWNQlAD.exe
  2⤵
  PID:8908
- C:\Windows\System\QdoIVOo.exe
  C:\Windows\System\QdoIVOo.exe
  2⤵
  PID:9408
- C:\Windows\System\HFDWRmW.exe
  C:\Windows\System\HFDWRmW.exe
  2⤵
  PID:8988
- C:\Windows\System\rodLFFB.exe
  C:\Windows\System\rodLFFB.exe
  2⤵
  PID:9464
- C:\Windows\System\hLkthjI.exe
  C:\Windows\System\hLkthjI.exe
  2⤵
  PID:7156
- C:\Windows\System\VOLejWQ.exe
  C:\Windows\System\VOLejWQ.exe
  2⤵
  PID:6996
- C:\Windows\System\sDhSIki.exe
  C:\Windows\System\sDhSIki.exe
  2⤵
  PID:8236
- C:\Windows\System\AiNpKDd.exe
  C:\Windows\System\AiNpKDd.exe
  2⤵
  PID:8252
- C:\Windows\System\pZnMcYR.exe
  C:\Windows\System\pZnMcYR.exe
  2⤵
  PID:8292
- C:\Windows\System\dyqhuCl.exe
  C:\Windows\System\dyqhuCl.exe
  2⤵
  PID:8332
- C:\Windows\System\CdWmyIX.exe
  C:\Windows\System\CdWmyIX.exe
  2⤵
  PID:8356
- C:\Windows\System\UIuUZDy.exe
  C:\Windows\System\UIuUZDy.exe
  2⤵
  PID:8396
- C:\Windows\System\OMtrQMI.exe
  C:\Windows\System\OMtrQMI.exe
  2⤵
  PID:8672
- C:\Windows\System\goXPnQs.exe
  C:\Windows\System\goXPnQs.exe
  2⤵
  PID:8828
- C:\Windows\System\KtkjWnK.exe
  C:\Windows\System\KtkjWnK.exe
  2⤵
  PID:8852
- C:\Windows\System\uYjWWWu.exe
  C:\Windows\System\uYjWWWu.exe
  2⤵
  PID:9280
- C:\Windows\System\vyfzvtH.exe
  C:\Windows\System\vyfzvtH.exe
  2⤵
  PID:9308
- C:\Windows\System\boJxflo.exe
  C:\Windows\System\boJxflo.exe
  2⤵
  PID:9400
- C:\Windows\System\tSTelNt.exe
  C:\Windows\System\tSTelNt.exe
  2⤵
  PID:9032
- C:\Windows\System\OdDLSXN.exe
  C:\Windows\System\OdDLSXN.exe
  2⤵
  PID:9508
- C:\Windows\System\jpFiWzY.exe
  C:\Windows\System\jpFiWzY.exe
  2⤵
  PID:9108
- C:\Windows\System\UhMsiCD.exe
  C:\Windows\System\UhMsiCD.exe
  2⤵
  PID:9188
- C:\Windows\System\yVPvYbg.exe
  C:\Windows\System\yVPvYbg.exe
  2⤵
  PID:8168
- C:\Windows\System\JtxwcSL.exe
  C:\Windows\System\JtxwcSL.exe
  2⤵
  PID:5016
- C:\Windows\System\PMmZKXc.exe
  C:\Windows\System\PMmZKXc.exe
  2⤵
  PID:6172
- C:\Windows\System\RXmgyFe.exe
  C:\Windows\System\RXmgyFe.exe
  2⤵
  PID:6800
- C:\Windows\System\oVYDlnz.exe
  C:\Windows\System\oVYDlnz.exe
  2⤵
  PID:7312
- C:\Windows\System\bBuxaEk.exe
  C:\Windows\System\bBuxaEk.exe
  2⤵
  PID:8772
- C:\Windows\System\nglxUAD.exe
  C:\Windows\System\nglxUAD.exe
  2⤵
  PID:9260
- C:\Windows\System\EvrLUXs.exe
  C:\Windows\System\EvrLUXs.exe
  2⤵
  PID:10172
- C:\Windows\System\ljXIfuu.exe
  C:\Windows\System\ljXIfuu.exe
  2⤵
  PID:9788
- C:\Windows\System\tLpNfQp.exe
  C:\Windows\System\tLpNfQp.exe
  2⤵
  PID:9468
- C:\Windows\System\wFPlMfY.exe
  C:\Windows\System\wFPlMfY.exe
  2⤵
  PID:6044
- C:\Windows\System\bKGCxMO.exe
  C:\Windows\System\bKGCxMO.exe
  2⤵
  PID:10244
- C:\Windows\System\dZBOiGR.exe
  C:\Windows\System\dZBOiGR.exe
  2⤵
  PID:10264
- C:\Windows\System\KmXjFIN.exe
  C:\Windows\System\KmXjFIN.exe
  2⤵
  PID:10288
- C:\Windows\System\xQejZYM.exe
  C:\Windows\System\xQejZYM.exe
  2⤵
  PID:10312
- C:\Windows\System\irAUEAX.exe
  C:\Windows\System\irAUEAX.exe
  2⤵
  PID:10340
- C:\Windows\System\YbfHrBh.exe
  C:\Windows\System\YbfHrBh.exe
  2⤵
  PID:10360
- C:\Windows\System\zAoXIgk.exe
  C:\Windows\System\zAoXIgk.exe
  2⤵
  PID:10376
- C:\Windows\System\ITdXVXu.exe
  C:\Windows\System\ITdXVXu.exe
  2⤵
  PID:10392
- C:\Windows\System\cVMeqcS.exe
  C:\Windows\System\cVMeqcS.exe
  2⤵
  PID:10408
- C:\Windows\System\QfZdgCh.exe
  C:\Windows\System\QfZdgCh.exe
  2⤵
  PID:10424
- C:\Windows\System\DrNHbBn.exe
  C:\Windows\System\DrNHbBn.exe
  2⤵
  PID:10440
- C:\Windows\System\mmIdGUx.exe
  C:\Windows\System\mmIdGUx.exe
  2⤵
  PID:10464
- C:\Windows\System\yHVUVgN.exe
  C:\Windows\System\yHVUVgN.exe
  2⤵
  PID:10484
- C:\Windows\System\bAyOYNZ.exe
  C:\Windows\System\bAyOYNZ.exe
  2⤵
  PID:10504
- C:\Windows\System\MlSaabJ.exe
  C:\Windows\System\MlSaabJ.exe
  2⤵
  PID:10528
- C:\Windows\System\jWKQcFI.exe
  C:\Windows\System\jWKQcFI.exe
  2⤵
  PID:10552
- C:\Windows\System\HUalBVI.exe
  C:\Windows\System\HUalBVI.exe
  2⤵
  PID:10568
- C:\Windows\System\rmuGowg.exe
  C:\Windows\System\rmuGowg.exe
  2⤵
  PID:10592
- C:\Windows\System\oIVzLrp.exe
  C:\Windows\System\oIVzLrp.exe
  2⤵
  PID:10616
- C:\Windows\System\weSbcYp.exe
  C:\Windows\System\weSbcYp.exe
  2⤵
  PID:10636
- C:\Windows\System\ECELhTe.exe
  C:\Windows\System\ECELhTe.exe
  2⤵
  PID:10656
- C:\Windows\System\YDEEyNp.exe
  C:\Windows\System\YDEEyNp.exe
  2⤵
  PID:10680
- C:\Windows\System\jnmAAcy.exe
  C:\Windows\System\jnmAAcy.exe
  2⤵
  PID:10704
- C:\Windows\System\MStJNMt.exe
  C:\Windows\System\MStJNMt.exe
  2⤵
  PID:10720
- C:\Windows\System\JvTMfLI.exe
  C:\Windows\System\JvTMfLI.exe
  2⤵
  PID:10804
- C:\Windows\System\iHHknIX.exe
  C:\Windows\System\iHHknIX.exe
  2⤵
  PID:10820
- C:\Windows\System\gRoVfGn.exe
  C:\Windows\System\gRoVfGn.exe
  2⤵
  PID:10840
- C:\Windows\System\GuRuZki.exe
  C:\Windows\System\GuRuZki.exe
  2⤵
  PID:10864
- C:\Windows\System\CBSBClP.exe
  C:\Windows\System\CBSBClP.exe
  2⤵
  PID:10888
- C:\Windows\System\YtdPATA.exe
  C:\Windows\System\YtdPATA.exe
  2⤵
  PID:10904
- C:\Windows\System\VjmGrDd.exe
  C:\Windows\System\VjmGrDd.exe
  2⤵
  PID:10932
- C:\Windows\System\Uavcifk.exe
  C:\Windows\System\Uavcifk.exe
  2⤵
  PID:10956
- C:\Windows\System\DoePthO.exe
  C:\Windows\System\DoePthO.exe
  2⤵
  PID:10984
- C:\Windows\System\yGiJEZk.exe
  C:\Windows\System\yGiJEZk.exe
  2⤵
  PID:11000
- C:\Windows\System\pKAUvNp.exe
  C:\Windows\System\pKAUvNp.exe
  2⤵
  PID:11020
- C:\Windows\System\fpEgroR.exe
  C:\Windows\System\fpEgroR.exe
  2⤵
  PID:11044
- C:\Windows\System\rOWmGJj.exe
  C:\Windows\System\rOWmGJj.exe
  2⤵
  PID:11072
- C:\Windows\System\pAuFNVi.exe
  C:\Windows\System\pAuFNVi.exe
  2⤵
  PID:11092
- C:\Windows\System\oncqnuU.exe
  C:\Windows\System\oncqnuU.exe
  2⤵
  PID:11112
- C:\Windows\System\GkUjpmm.exe
  C:\Windows\System\GkUjpmm.exe
  2⤵
  PID:11132
- C:\Windows\System\Qgkqrtp.exe
  C:\Windows\System\Qgkqrtp.exe
  2⤵
  PID:11152
- C:\Windows\System\zrVoDQg.exe
  C:\Windows\System\zrVoDQg.exe
  2⤵
  PID:11184
- C:\Windows\System\jVoZUph.exe
  C:\Windows\System\jVoZUph.exe
  2⤵
  PID:11208
- C:\Windows\System\SrnTBtq.exe
  C:\Windows\System\SrnTBtq.exe
  2⤵
  PID:11228
- C:\Windows\System\zPHVeve.exe
  C:\Windows\System\zPHVeve.exe
  2⤵
  PID:11252
- C:\Windows\System\ComRZup.exe
  C:\Windows\System\ComRZup.exe
  2⤵
  PID:9544
- C:\Windows\System\kaeoSqX.exe
  C:\Windows\System\kaeoSqX.exe
  2⤵
  PID:4476
- C:\Windows\System\HYeNihS.exe
  C:\Windows\System\HYeNihS.exe
  2⤵
  PID:9656
- C:\Windows\System\AuECNXA.exe
  C:\Windows\System\AuECNXA.exe
  2⤵
  PID:9700
- C:\Windows\System\UBSoOXY.exe
  C:\Windows\System\UBSoOXY.exe
  2⤵
  PID:9852
- C:\Windows\System\VAyGGCW.exe
  C:\Windows\System\VAyGGCW.exe
  2⤵
  PID:9920
- C:\Windows\System\ZRFpGmV.exe
  C:\Windows\System\ZRFpGmV.exe
  2⤵
  PID:9428
- C:\Windows\System\PtaXdlY.exe
  C:\Windows\System\PtaXdlY.exe
  2⤵
  PID:8376
- C:\Windows\System\mSlpgDq.exe
  C:\Windows\System\mSlpgDq.exe
  2⤵
  PID:8860
- C:\Windows\System\INifMkd.exe
  C:\Windows\System\INifMkd.exe
  2⤵
  PID:2436
- C:\Windows\System\NgvgAcu.exe
  C:\Windows\System\NgvgAcu.exe
  2⤵
  PID:7036
- C:\Windows\System\UgsRDOi.exe
  C:\Windows\System\UgsRDOi.exe
  2⤵
  PID:9728
- C:\Windows\System\blAGdXx.exe
  C:\Windows\System\blAGdXx.exe
  2⤵
  PID:10272
- C:\Windows\System\YPqpXhN.exe
  C:\Windows\System\YPqpXhN.exe
  2⤵
  PID:7972
- C:\Windows\System\DQHqpqQ.exe
  C:\Windows\System\DQHqpqQ.exe
  2⤵
  PID:10020
- C:\Windows\System\CZufejB.exe
  C:\Windows\System\CZufejB.exe
  2⤵
  PID:10044
- C:\Windows\System\TPzeapN.exe
  C:\Windows\System\TPzeapN.exe
  2⤵
  PID:10080
- C:\Windows\System\XZQaXWS.exe
  C:\Windows\System\XZQaXWS.exe
  2⤵
  PID:10120
- C:\Windows\System\zDORXxX.exe
  C:\Windows\System\zDORXxX.exe
  2⤵
  PID:7256
- C:\Windows\System\HmwcDmF.exe
  C:\Windows\System\HmwcDmF.exe
  2⤵
  PID:10220
- C:\Windows\System\PbOqmKb.exe
  C:\Windows\System\PbOqmKb.exe
  2⤵
  PID:10828
- C:\Windows\System\cikuGjF.exe
  C:\Windows\System\cikuGjF.exe
  2⤵
  PID:9004
- C:\Windows\System\eRQyLTQ.exe
  C:\Windows\System\eRQyLTQ.exe
  2⤵
  PID:7328
- C:\Windows\System\KBjnZLX.exe
  C:\Windows\System\KBjnZLX.exe
  2⤵
  PID:11280
- C:\Windows\System\AAlOQHb.exe
  C:\Windows\System\AAlOQHb.exe
  2⤵
  PID:11484
- C:\Windows\System\WVSWGtO.exe
  C:\Windows\System\WVSWGtO.exe
  2⤵
  PID:11500
- C:\Windows\System\Gncrrmr.exe
  C:\Windows\System\Gncrrmr.exe
  2⤵
  PID:11520
- C:\Windows\System\CvMXOoV.exe
  C:\Windows\System\CvMXOoV.exe
  2⤵
  PID:11540
- C:\Windows\System\asNjIRf.exe
  C:\Windows\System\asNjIRf.exe
  2⤵
  PID:11564
- C:\Windows\System\gEwIeUI.exe
  C:\Windows\System\gEwIeUI.exe
  2⤵
  PID:11580
- C:\Windows\System\LLaboAv.exe
  C:\Windows\System\LLaboAv.exe
  2⤵
  PID:11604
- C:\Windows\System\kvAcEsn.exe
  C:\Windows\System\kvAcEsn.exe
  2⤵
  PID:11628
- C:\Windows\System\zEonlec.exe
  C:\Windows\System\zEonlec.exe
  2⤵
  PID:11656
- C:\Windows\System\TCtvFuY.exe
  C:\Windows\System\TCtvFuY.exe
  2⤵
  PID:11684
- C:\Windows\System\YXXQCIZ.exe
  C:\Windows\System\YXXQCIZ.exe
  2⤵
  PID:11716
- C:\Windows\System\BTJAdCg.exe
  C:\Windows\System\BTJAdCg.exe
  2⤵
  PID:11732
- C:\Windows\System\LdoBeoC.exe
  C:\Windows\System\LdoBeoC.exe
  2⤵
  PID:11748
- C:\Windows\System\skIkNki.exe
  C:\Windows\System\skIkNki.exe
  2⤵
  PID:11764
- C:\Windows\System\aKrjrgx.exe
  C:\Windows\System\aKrjrgx.exe
  2⤵
  PID:11784
- C:\Windows\System\RIuAjNx.exe
  C:\Windows\System\RIuAjNx.exe
  2⤵
  PID:11804
- C:\Windows\System\fgcSWZF.exe
  C:\Windows\System\fgcSWZF.exe
  2⤵
  PID:11824
- C:\Windows\System\hnGoxmz.exe
  C:\Windows\System\hnGoxmz.exe
  2⤵
  PID:11848
- C:\Windows\System\aPwxcvj.exe
  C:\Windows\System\aPwxcvj.exe
  2⤵
  PID:11868
- C:\Windows\System\PYXWXUf.exe
  C:\Windows\System\PYXWXUf.exe
  2⤵
  PID:11896
- C:\Windows\System\CvUaGMa.exe
  C:\Windows\System\CvUaGMa.exe
  2⤵
  PID:11916
- C:\Windows\System\nmtFoEG.exe
  C:\Windows\System\nmtFoEG.exe
  2⤵
  PID:11940
- C:\Windows\System\LMaZvQs.exe
  C:\Windows\System\LMaZvQs.exe
  2⤵
  PID:11960
- C:\Windows\System\fkDhBLU.exe
  C:\Windows\System\fkDhBLU.exe
  2⤵
  PID:11976
- C:\Windows\System\HARfpgT.exe
  C:\Windows\System\HARfpgT.exe
  2⤵
  PID:12000
- C:\Windows\System\lwJxqKQ.exe
  C:\Windows\System\lwJxqKQ.exe
  2⤵
  PID:12028
- C:\Windows\System\FDOngVc.exe
  C:\Windows\System\FDOngVc.exe
  2⤵
  PID:12052
- C:\Windows\System\sJcfcyp.exe
  C:\Windows\System\sJcfcyp.exe
  2⤵
  PID:12076
- C:\Windows\System\AEuxxKx.exe
  C:\Windows\System\AEuxxKx.exe
  2⤵
  PID:12104
- C:\Windows\System\kAQZRTO.exe
  C:\Windows\System\kAQZRTO.exe
  2⤵
  PID:12132
- C:\Windows\System\nSDrdbk.exe
  C:\Windows\System\nSDrdbk.exe
  2⤵
  PID:12152
- C:\Windows\System\WqlHGIA.exe
  C:\Windows\System\WqlHGIA.exe
  2⤵
  PID:12172
- C:\Windows\System\IjVhyHG.exe
  C:\Windows\System\IjVhyHG.exe
  2⤵
  PID:12196
- C:\Windows\System\PxoOWtS.exe
  C:\Windows\System\PxoOWtS.exe
  2⤵
  PID:12220
- C:\Windows\System\EkxYALK.exe
  C:\Windows\System\EkxYALK.exe
  2⤵
  PID:12240
- C:\Windows\System\JmZeCle.exe
  C:\Windows\System\JmZeCle.exe
  2⤵
  PID:12264
- C:\Windows\System\DfRSvGf.exe
  C:\Windows\System\DfRSvGf.exe
  2⤵
  PID:12284
- C:\Windows\System\ySFWWtw.exe
  C:\Windows\System\ySFWWtw.exe
  2⤵
  PID:8248
- C:\Windows\System\pBZAxkA.exe
  C:\Windows\System\pBZAxkA.exe
  2⤵
  PID:10900
- C:\Windows\System\CXgtTkb.exe
  C:\Windows\System\CXgtTkb.exe
  2⤵
  PID:8360
- C:\Windows\System\LWfUQZS.exe
  C:\Windows\System\LWfUQZS.exe
  2⤵
  PID:10996
- C:\Windows\System\SJSAHhX.exe
  C:\Windows\System\SJSAHhX.exe
  2⤵
  PID:9876
- C:\Windows\System\KrfIjQQ.exe
  C:\Windows\System\KrfIjQQ.exe
  2⤵
  PID:9208
- C:\Windows\System\uviryiM.exe
  C:\Windows\System\uviryiM.exe
  2⤵
  PID:11084
- C:\Windows\System\ToKAsVW.exe
  C:\Windows\System\ToKAsVW.exe
  2⤵
  PID:9240
- C:\Windows\System\yNDpmqY.exe
  C:\Windows\System\yNDpmqY.exe
  2⤵
  PID:3912
- C:\Windows\System\VRwVgWc.exe
  C:\Windows\System\VRwVgWc.exe
  2⤵
  PID:10420
- C:\Windows\System\dyMfVLR.exe
  C:\Windows\System\dyMfVLR.exe
  2⤵
  PID:10456
- C:\Windows\System\bPGjDQQ.exe
  C:\Windows\System\bPGjDQQ.exe
  2⤵
  PID:10512
- C:\Windows\System\OqoAzAe.exe
  C:\Windows\System\OqoAzAe.exe
  2⤵
  PID:10576
- C:\Windows\System\zacVoxH.exe
  C:\Windows\System\zacVoxH.exe
  2⤵
  PID:10624
- C:\Windows\System\hpwTITH.exe
  C:\Windows\System\hpwTITH.exe
  2⤵
  PID:10672
- C:\Windows\System\lXBgbua.exe
  C:\Windows\System\lXBgbua.exe
  2⤵
  PID:7992
- C:\Windows\System\CccBJoi.exe
  C:\Windows\System\CccBJoi.exe
  2⤵
  PID:8072
- C:\Windows\System\hYvDphl.exe
  C:\Windows\System\hYvDphl.exe
  2⤵
  PID:8764
- C:\Windows\System\LJdcaXw.exe
  C:\Windows\System\LJdcaXw.exe
  2⤵
  PID:6388
- C:\Windows\System\frXJFtM.exe
  C:\Windows\System\frXJFtM.exe
  2⤵
  PID:7688
- C:\Windows\System\YNHodcG.exe
  C:\Windows\System\YNHodcG.exe
  2⤵
  PID:4732
- C:\Windows\System\ubtLELM.exe
  C:\Windows\System\ubtLELM.exe
  2⤵
  PID:10192
- C:\Windows\System\YtRVQFA.exe
  C:\Windows\System\YtRVQFA.exe
  2⤵
  PID:10876
- C:\Windows\System\pxtTAFn.exe
  C:\Windows\System\pxtTAFn.exe
  2⤵
  PID:9776
- C:\Windows\System\VVUlZHm.exe
  C:\Windows\System\VVUlZHm.exe
  2⤵
  PID:11040
- C:\Windows\System\xWIdtio.exe
  C:\Windows\System\xWIdtio.exe
  2⤵
  PID:8816
- C:\Windows\System\mJbEAxV.exe
  C:\Windows\System\mJbEAxV.exe
  2⤵
  PID:9756
- C:\Windows\System\GzhdZRm.exe
  C:\Windows\System\GzhdZRm.exe
  2⤵
  PID:7440
- C:\Windows\System\Nbwqehg.exe
  C:\Windows\System\Nbwqehg.exe
  2⤵
  PID:10348
- C:\Windows\System\zwbWKoL.exe
  C:\Windows\System\zwbWKoL.exe
  2⤵
  PID:10384
- C:\Windows\System\VEWoNpA.exe
  C:\Windows\System\VEWoNpA.exe
  2⤵
  PID:12316
- C:\Windows\System\UehveDH.exe
  C:\Windows\System\UehveDH.exe
  2⤵
  PID:12340
- C:\Windows\System\GXXxNsR.exe
  C:\Windows\System\GXXxNsR.exe
  2⤵
  PID:12356
- C:\Windows\System\iaDCnRW.exe
  C:\Windows\System\iaDCnRW.exe
  2⤵
  PID:12388
- C:\Windows\System\PDYBaTz.exe
  C:\Windows\System\PDYBaTz.exe
  2⤵
  PID:12408
- C:\Windows\System\lsYHOwt.exe
  C:\Windows\System\lsYHOwt.exe
  2⤵
  PID:12432
- C:\Windows\System\bopGdxd.exe
  C:\Windows\System\bopGdxd.exe
  2⤵
  PID:12456
- C:\Windows\System\tlDTJnU.exe
  C:\Windows\System\tlDTJnU.exe
  2⤵
  PID:12472
- C:\Windows\System\cSnDIUo.exe
  C:\Windows\System\cSnDIUo.exe
  2⤵
  PID:12500
- C:\Windows\System\tBqzZDT.exe
  C:\Windows\System\tBqzZDT.exe
  2⤵
  PID:12524
- C:\Windows\System\WPQNjTo.exe
  C:\Windows\System\WPQNjTo.exe
  2⤵
  PID:12552
- C:\Windows\System\xCLzSlZ.exe
  C:\Windows\System\xCLzSlZ.exe
  2⤵
  PID:12568
- C:\Windows\System\VAJPbaD.exe
  C:\Windows\System\VAJPbaD.exe
  2⤵
  PID:12592
- C:\Windows\System\PUiARDu.exe
  C:\Windows\System\PUiARDu.exe
  2⤵
  PID:12612
- C:\Windows\System\TJWGhgH.exe
  C:\Windows\System\TJWGhgH.exe
  2⤵
  PID:12648
- C:\Windows\System\EdjPphr.exe
  C:\Windows\System\EdjPphr.exe
  2⤵
  PID:12672
- C:\Windows\System\ngtcMGC.exe
  C:\Windows\System\ngtcMGC.exe
  2⤵
  PID:12696
- C:\Windows\System\eXVrfHw.exe
  C:\Windows\System\eXVrfHw.exe
  2⤵
  PID:12716
- C:\Windows\System\IftVGUV.exe
  C:\Windows\System\IftVGUV.exe
  2⤵
  PID:12740
- C:\Windows\System\VVZbKaJ.exe
  C:\Windows\System\VVZbKaJ.exe
  2⤵
  PID:12764
- C:\Windows\System\IocQyfr.exe
  C:\Windows\System\IocQyfr.exe
  2⤵
  PID:12788
- C:\Windows\System\wBEkmmy.exe
  C:\Windows\System\wBEkmmy.exe
  2⤵
  PID:12808
- C:\Windows\System\oqEjyDh.exe
  C:\Windows\System\oqEjyDh.exe
  2⤵
  PID:12836
- C:\Windows\System\ayiYUvz.exe
  C:\Windows\System\ayiYUvz.exe
  2⤵
  PID:12852
- C:\Windows\System\WmUSLIR.exe
  C:\Windows\System\WmUSLIR.exe
  2⤵
  PID:12872
- C:\Windows\System\anDIXHp.exe
  C:\Windows\System\anDIXHp.exe
  2⤵
  PID:12892
- C:\Windows\System\hNQGnFr.exe
  C:\Windows\System\hNQGnFr.exe
  2⤵
  PID:12912
- C:\Windows\System\YqJVmfK.exe
  C:\Windows\System\YqJVmfK.exe
  2⤵
  PID:12932
- C:\Windows\System\UolPAmz.exe
  C:\Windows\System\UolPAmz.exe
  2⤵
  PID:12960
- C:\Windows\System\NqWkyCv.exe
  C:\Windows\System\NqWkyCv.exe
  2⤵
  PID:12980
- C:\Windows\System\WAxPjab.exe
  C:\Windows\System\WAxPjab.exe
  2⤵
  PID:13000
- C:\Windows\System\VumYAft.exe
  C:\Windows\System\VumYAft.exe
  2⤵
  PID:13020
- C:\Windows\System\LiczOXn.exe
  C:\Windows\System\LiczOXn.exe
  2⤵
  PID:13040
- C:\Windows\System\DntNAop.exe
  C:\Windows\System\DntNAop.exe
  2⤵
  PID:13064
- C:\Windows\System\gppHtOb.exe
  C:\Windows\System\gppHtOb.exe
  2⤵
  PID:13088
- C:\Windows\System\hWhlpQI.exe
  C:\Windows\System\hWhlpQI.exe
  2⤵
  PID:13108
- C:\Windows\System\EYqbBFD.exe
  C:\Windows\System\EYqbBFD.exe
  2⤵
  PID:13136
- C:\Windows\System\hLemLCO.exe
  C:\Windows\System\hLemLCO.exe
  2⤵
  PID:13152
- C:\Windows\System\nmDePnq.exe
  C:\Windows\System\nmDePnq.exe
  2⤵
  PID:13176
- C:\Windows\System\IYodxGg.exe
  C:\Windows\System\IYodxGg.exe
  2⤵
  PID:13196
- C:\Windows\System\OvXxXOQ.exe
  C:\Windows\System\OvXxXOQ.exe
  2⤵
  PID:13216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dgd2liim.jmn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CNIBjkB.exe

Filesize
1.7MB

MD5
8e8767590545a8a448e5d445a82d89f1

SHA1
422a7fd3fc89054d6f2a623438a40d6f1d0dd4e9

SHA256
ff8e5a2bca95613efd90ed609bba514237fbd37866e6161f21f3706179908e12

SHA512
5b8089e58242ee4ccc899179f805ac46b93db5b0b1a0ab9bae6caf0a0c7a302d6a4c8ad6abcc0fc4f47ec3585734e10abc9565fce8586f4f779f39d15a61fda9

Download Submit
C:\Windows\System\DNWkDun.exe

Filesize
1.7MB

MD5
6d181c83bdaae523b057dcaaadf4925b

SHA1
c45018d8cf9368cb37836e7985ec9b922e418f44

SHA256
b6d3d99903e7626a669a86174691d5c96c6eadfc0c06d5e41d0e8fe02807f8e6

SHA512
9b1c3a746091527ee19a61c1d8a308949d6ae9861b4325d29ba468ae2832d72a489ec20e2f8d444671c793991bc8416d25b6456d5110c37bb63b0238f6c2638e

Download Submit
C:\Windows\System\FEriGNO.exe

Filesize
1.7MB

MD5
c476debd8698662c8ca58e749dcc2157

SHA1
a6f8ceff25258d3957ff6efd32625ccb11cc02b8

SHA256
ffb30d03e4156bcd74e046e1f4e90ab8389a3e0df6a35a196843f50b54debf29

SHA512
8ae150718f265f1686fd58236c371b5aa03e38b3e4cbd1296de4d8035950f9b759f77023164bde4c6bc8067121cb19ba73cbec028c3e36f900da7a404cc68435

Download Submit
C:\Windows\System\FnoJAxp.exe

Filesize
1.7MB

MD5
bcf147f9376df250868253a756b78908

SHA1
3f23e9fafdf2cc351c98ec0f2683beb55bcf1434

SHA256
1d7edd5dd554d18d1a92d39bc043b383e7f66096549588856f585ee34da9bc46

SHA512
deecd3e83ba92379f0faad0e8b146de30ac2eeeee5d0b0545dc73aa3a87d70505e85e3efc078f9c0693e14d6be2a7ec18365c71151b810cc17a20c537b2a1d35

Download Submit
C:\Windows\System\FrJHJdQ.exe

Filesize
1.7MB

MD5
b259474ebdb84bcd0cc81011d31e4e55

SHA1
22be6523ce4939a8e350e8b4c1d5f57364655e56

SHA256
d5fb863c01b4925ebc74cc3753e88966b28eaf88ab869ae608f87e4379c26e1e

SHA512
68a8abf7605df531ebb9b7766d8f882a2065c7a1dd02b7e047246783abc38800fa6a72dd9777e0cf5ee1178c759caebd2eed284b8cc21eda19822b600f192121

Download Submit
C:\Windows\System\HAQgkMC.exe

Filesize
1.7MB

MD5
49cca4915821b62d8cf12769faad7736

SHA1
1a55ae592cb16d81d8e3ed1e4f0c8a2b90dd6bf3

SHA256
444512da4221e19b51e9cbaa17ccb8f9f0f906c92a2c18592a4baf2d13a3eb8b

SHA512
748248e0ec2556b180e7bfb82d02be43f5403920442b9fdf0a17ca2cf1979a60705b4f96a2235860d3531a256f8d43335eaf5d8c66ea89cf207175919ee1a1f4

Download Submit
C:\Windows\System\HLZqBBF.exe

Filesize
1.7MB

MD5
4cd9f21593ba7a929144392d927896b3

SHA1
f8e6e3548a8587c3faaa709e84d4f18effdf6245

SHA256
1bf70280b8a693e14f73ebcc536154b38f67d55a2ada55cb052b2923a988883c

SHA512
777857e66f99d5bbff0fde2a9b3b93452f92115dfb4d2283877fc4430b0a9e2b345ae95b346e01760008e55bdca6b134181f3632136d4721672953fe20d9e7b8

Download Submit
C:\Windows\System\HWXVaXZ.exe

Filesize
1.7MB

MD5
fb66035abb312cde7c99c2cda5158621

SHA1
2c2d18ff1cda82fc6fcc8ed15873d76e514c9a33

SHA256
ae15af943cfa9e4f8ad068a27f1e1500273a7f1c0163ef50c19b46eb493799c8

SHA512
be6fee95e7c34842acfa516f798e0d193df45cec672f1bf622293ecac39d27ad4327f47c9cc4eda98e49526086d65b50ef0a5739698bd97f28818789ac08999d

Download Submit
C:\Windows\System\HostJVE.exe

Filesize
1.7MB

MD5
bf5f46dbe6d0e1aca1e3c49df1d6dbed

SHA1
43ff6c454c578a552b6b3b8e5375e3697ad7bb46

SHA256
ce669d13fe841d9cf48146165d966ea2991427c2ba54dfe79e7113c6c9e4f4fd

SHA512
b4d2f593026deaef29a9b4d523841de6c3275d1333fa95f24b70195d7b68424d7dfccc1f9e763eb27964fb8ad14e66ea0d9a83ef4e90ee991dc088fee9cf222a

Download Submit
C:\Windows\System\HxXJGXE.exe

Filesize
1.7MB

MD5
69bb7e7b1f64a966bf33c3134cd9102b

SHA1
b3e326ec3271b7e4cf5e58bcca12dd4175d7fb6e

SHA256
9f46d1dff2666bc67aceea770f10d62e0808ba1c94c25dc8c2e9dc6f3f4fa532

SHA512
56df5d6a81d0d0fdbae2eaf15ce019e5c5e0821a881f319212e4afff4ec8019fd2b348f3bdf7963b15fdd99ea9ca126a1e121328cc573268f49d5bfd23abc66e

Download Submit
C:\Windows\System\KFapFnM.exe

Filesize
1.7MB

MD5
40324bc9ec638d6c3475b05893870fe3

SHA1
24c308181e5fdb7d263f6994e870ed35e9be4c86

SHA256
60329dbda7bb336a9b0d97110799b3a2d986bdbaa9586d3f3abd413a4b287a15

SHA512
6b4e995effc878802937c5a150c4c04e0acfe9e1168b3c62129e1c985d0ffc467dfddce368aa609135ca5c4ac92eb32597fe84ce10faf2f9359fb8a3a0eb7522

Download Submit
C:\Windows\System\MVqLapD.exe

Filesize
1.7MB

MD5
62bb6a808b490e2328994c21dcda62f6

SHA1
35b0a0bf7bff38420f638fb4d6fe069fd112cd3c

SHA256
a8f0c498f39761c0dafdb8e997fcedace644f8645c2b87cbbac08828f6cdd0f1

SHA512
adf29a481dfcc538e677cc33fdbd86d6fe7cf55acee9b99f91bfc33950f93ca7bf98e53d2d0b0297892fc73de71393c6982e1aba60506572792ff6d7159494e4

Download Submit
C:\Windows\System\PngyfOp.exe

Filesize
1.7MB

MD5
ca12024d3f556ee18b8afb895a8e6209

SHA1
bed34e5f41426ce4168721400443481f76405707

SHA256
0466cedbef21c05557fc6abefea6b0093f3de65dda6201039308538990f48a2b

SHA512
369518753c5e9349242f2c47d982d86f6aac151601f6231cc39ec2ac1d06a5e01e2dd5f0412c147c535248d0b10d62e7e60b001c69f92d674504e96dbbfc2c32

Download Submit
C:\Windows\System\RFxdDag.exe

Filesize
1.7MB

MD5
d9c619c2f20db6e9ea1edce3b5503517

SHA1
8bdd72e78f8d5f50767e029536d68fbd7e5916c8

SHA256
5166bf4ebe64e29c282f535412c1d207842377d080478df7487adb154d3bebf6

SHA512
ee5f1cbaf818f6c2e0ee91f1897346f65e5af9ee17a8355166f6163a676caad02b0650ca9c3ef51a1fa2f1ee2bb4551968784a3a07612666520b3a1b846cebd0

Download Submit
C:\Windows\System\Rgvnqsd.exe

Filesize
1.7MB

MD5
fb0cea32519bd66b0706d85e8c0efca5

SHA1
a471be7253b5f57bd9999b3ee14bac0dbb1ad90e

SHA256
418114cfd595ff33ac2f7d7927641edbb18be1387e4983f9182508ea20745a08

SHA512
f4dc2a2a48a49333bbf96d5a2b8e2c4dfdb0fa90af5ff75cf2e0271028a53d215b6065d9ec46e11f2105b3bc4c00f6c3c3cb8a9f7587026f3cb564034b978cb9

Download Submit
C:\Windows\System\SQZAwia.exe

Filesize
1.7MB

MD5
7130ac61fe3965a5296bd471f8fae0f0

SHA1
508de10061838c00828659d854035d6086f684d5

SHA256
f668497e5bcc867f72d0c6e5a552cbbb64b87ce0f981d7a049447cb7295a2a5a

SHA512
3b4a03bc18bdcb30821c845a4e5c9258b50a784327004e8d71917418adf8d73a27a4807769a635b2a813a7f015edcead22d645bb13a53f544b2f42e0b1c5b86d

Download Submit
C:\Windows\System\TgLZRUf.exe

Filesize
1.7MB

MD5
0f9d605abd589ae4186d9612090bdd2c

SHA1
c45dd5f5241b0f409c4f047b381ca84f6a80855c

SHA256
8dd9b8f408dfc6836d1fd3bfeaebccb65dcb61562cd831ad190fe96a80afd701

SHA512
4b2f7b5886f654c808bbbff841b7263e76a46e1a69bdc425b5070d1506b8b9693328dd54ecdae33f49ab13e3e6e65c00da091291d4b61223b3e0c1605d603edc

Download Submit
C:\Windows\System\XPmimiV.exe

Filesize
1.7MB

MD5
3a55a78cbec2fec80fc921431d486f6e

SHA1
44156ee9437eb6415f13ae7bde5d8592616a675d

SHA256
e04f277c09480b54a4c7537afc5c1b0427a2bda5a5ef8e74bd55a2a21727ae57

SHA512
1e137d9080a9b824fe39d61bab4981f8b2c1ffa9569d2e8670f067c90c1fb0df0f3911a1e21fa412b419a3bc3f10f3a8257270e18b1fa53c33516db5fd2ca62f

Download Submit
C:\Windows\System\aOfjuja.exe

Filesize
1.7MB

MD5
53c802c17f5413b83fbf585abf8afc04

SHA1
1d5b07cf86f5fd9e34f3379bfb7fab09df522eed

SHA256
9f076f191ef0a6d6f2e48902953ba6bd81fdf66fcd27f4b37550f59796a6e149

SHA512
aff120ffa2bcde1682f5563301be8861f69a2b0ecd10cf4f674c6b433c679abf53beb100ed5bc43293e30cb17a88b2246ae64359f3f58df32e79970b3e6f1aad

Download Submit
C:\Windows\System\clQRldc.exe

Filesize
1.7MB

MD5
49285a8c1b009fa5c708e9c2e8f9c379

SHA1
ee3885003e7987a6683adb9f2247c07529e26c10

SHA256
f2dbf3f6e8bfbbb073e303e3eac9f463eb1c714b43190feb5b33da4e36bb54a2

SHA512
89db0ccc28343eac70d05e156f4bb5bcb2457bb4200d1ccc1a1900bb2c792d32c1aaa09f8aa5daacde28b57abb5ed24243be12fe63b857092a0d61d57b5e05cc

Download Submit
C:\Windows\System\eCoMMor.exe

Filesize
1.7MB

MD5
31555e78210bb714763cb831b30ad9a9

SHA1
2417f34af940a9e0b6d801d2454d4ada7b126439

SHA256
3e038ec33c240ef7f6c955f9f5eb614583fee0c00e94cba129dae2cd26639b1c

SHA512
522f0f02cdca9df7689ec8afb7042519a2a16b32059d6bc41dea98b7fb201ad91dc701bfe2ffbcb8498e378c4c7f1c0452827a4401c853ca72482830cda7a16a

Download Submit
C:\Windows\System\hBtGTbt.exe

Filesize
1.7MB

MD5
13c5037476f7051704d91093651feead

SHA1
47eacfd207601c2737c668bbdf7066b14f878bd9

SHA256
d6bf7ddef8b47bbb0d690857d9ecc60c864a856bd14a895a747771cb5b1d994d

SHA512
90e66562676efb69d839bf1d2d8e8db4e3456f9c02fb393178ca970c03b7a25e233c4e9abf83f92ba818c340d06b2830569f444f2bf3d5eb1aa85d0e1944a8e4

Download Submit
C:\Windows\System\hDJdgAd.exe

Filesize
1.7MB

MD5
aec0064aff7c72082b39d22b59dfc987

SHA1
9f4205feef9a5762e32cfc86be328bd2568de61c

SHA256
adfdbf431bf3a45f1fccc508f7a8f2761bfbacf38cd7254e87c30e5a3148fc4a

SHA512
b6a724ec9c61d24ec57c0329b9cf6fadad03ddbee4b0a64a0016288f9b94bb45f0d83829f4cd976b92b60c700c1626b5a334ec4a9e1433bc98a85836ef1d1a7a

Download Submit
C:\Windows\System\hTdOBjH.exe

Filesize
1.7MB

MD5
d7bb891fd01044512f3764f571a42ece

SHA1
222020a9ca84f78a20889c5279706bb3ba173e56

SHA256
29a34d8bda1852b653c282b60ccf2cf1dbcb8dd38359ff24a87b51b9047c80af

SHA512
35407033dfbb3272a1d12c9452ba211c16a0a58d81a6d4e0df403fd942c68c1ec370c83df962fb7052801e202c3e90be5dff306da422969daedb1cb4f5cc2d08

Download Submit
C:\Windows\System\hshdpLW.exe

Filesize
1.7MB

MD5
b9fb383895ce4b78b8f5b8d9706932b1

SHA1
1a24797c71e853a10b308635aac0cb1d520da165

SHA256
47237b4e8d3cbbd1340e3fb49e7910f9f5228d3cfbbd6b420466fdbefbeee93d

SHA512
cd541dec9a261dde1ed3062a3c4dc27008057b3680165d290a1262ae34021115ed5698fb92e1818fae2dc0992e194e17100aaf92ffae983be52c98bd15b1a098

Download Submit
C:\Windows\System\iCJFAuJ.exe

Filesize
1.7MB

MD5
e93ce075e4198fb0f25d5535d5886354

SHA1
89e56b183319318e53495bcecc00edb5113ce5b2

SHA256
316e979076cc6d2c857b257b000467788beedad0b31cd96ad72401f02fabd504

SHA512
a3c933c305c556668a864b396e47d1db50b070cc8266c8f2f262a6a9a2a0ac904f790b63a0576fbc5bce9faf733d9216fd32f9102bef868f6cff24aeb4babbe0

Download Submit
C:\Windows\System\iWlgTRa.exe

Filesize
1.7MB

MD5
78d3d75567e9387a533b2eb5c5e37fdb

SHA1
93c98a58651340ae0da82b861e49f9fb890ccb18

SHA256
368b5f0349ccf3f074675f58cf630eb23a1320850331db8029548cef7756de07

SHA512
bbfa3c3c567761e1c84c3d088c2057e464368992f80b01534a21b96f0522f7959eb0cfba02b3bfb0abeaf0abfd62c25b80be2592de32316d88959a6adf8500f8

Download Submit
C:\Windows\System\iiUEBUO.exe

Filesize
1.7MB

MD5
6b8bceda6df622048d3fe7c8c3e409db

SHA1
f47481a1f3a1adbfbf3884274b14d5ee4af97a7d

SHA256
87becdd47b2677463c37801375219e2fe75eaae75f7884b49e7c469ae8dfd0dc

SHA512
7e4a8663358bb321614fc2e719d385f8b23484b57f09e2a49eece4c63dd426b7ecf6f279aa4aa6e953f74c3bb0efb27a0c045d2908c088968c3703566b6e881f

Download Submit
C:\Windows\System\jNUvtRe.exe

Filesize
1.7MB

MD5
05af5e587d3c78dcc67e24531c70b163

SHA1
70d6b40aee0157607c35f086683c1e961749d33a

SHA256
3acb3c99ebab38a71103f1f3852c59209927bf6f3ce3904e675cc8bff5492ea0

SHA512
f85543d14fdf7eb707c20eec8e982a43715d2568fb71489fdf83e62c7ba8c8cf79895ef7d0394c1e077f7b1a2cf00874f3dd61d1fe95c60c7ec704f0e9a1d3ad

Download Submit
C:\Windows\System\njfUZXl.exe

Filesize
1.7MB

MD5
06f884e0430bb7cb15072eb27d66f8be

SHA1
011805d6416804d4d8d37dd1688f0358dad369d5

SHA256
671c006906475a541391b28404938a209aeab5538ef86142284c7e2e10ebf672

SHA512
314c3965caa0ae165147d69eb02fca745abc872baa01ba2ace20375eb15f7eea8a6cd9fc324e69583210de382c257f0448f950660eeb14884915f3f82f2b6d21

Download Submit
C:\Windows\System\qELWSkK.exe

Filesize
1.7MB

MD5
7402d37921b514b7f814b0c03053ce52

SHA1
ae4b128757f9e22cff0b9364408bc6be744d642e

SHA256
2144e196263da0488cced330d73fbe0ce380f827a62816366ba6dd5660d1e846

SHA512
6d4c48d4d2836dcc3d468db0f14d48f659d1e3444bd5e45448d7ce1a82b881b4a2d271667ee1c3eee4523689156d59adbab7d08045f71060339921d200a9a472

Download Submit
C:\Windows\System\rSMNxVd.exe

Filesize
1.7MB

MD5
eefaa12324b9e6b7cf6989e12a74c019

SHA1
e8c0e9007141da1401762bc2713fe64bf53f3d94

SHA256
0feb98586b9431cc0138dc6948c1b041faf5a9cf68a871bd57127cadabcb5a02

SHA512
050c6aed3dee78aedd521030fdcbfe7d89d0ea60456cbb2db04a17ae29e751f103e571e94e8352b0c5cc9aae06b9157cf735355a0b629be4814ad73f5ccd1ff4

Download Submit
C:\Windows\System\rpjXkCN.exe

Filesize
1.7MB

MD5
ca568314c630b3ba6df0f939ab1933c0

SHA1
fb83f28118199a914efe5c6a2068e115347e1d3b

SHA256
64d78f252ccd909264ff0c769949dfcfd44820d017bdfd5a8fa2e5d2878ce8d8

SHA512
7f91fb0441a2b500f9c8aa3a4f9ed547ed686a2e05cc7c3be948e9b3e5877e8271b91b3af7f2bb7427bbde3e6c10100e2ae2d4b683b9d23dab295deaeaebb780

Download Submit
C:\Windows\System\vkYeaQO.exe

Filesize
1.7MB

MD5
7949911032e023b22a40badb56d6d536

SHA1
64244354961098fa087aea4234245cf9d155ad00

SHA256
f3a0ae6ad276a0e8307fe29f1887a1b507a9caf16a62a9d99a9affc417313f98

SHA512
569ccf236105576aa3d55fa6bfaae7f7b77d7b9c6d07e7cd771821feb9c9145a7301a2f320a9ef45e74ea558374e50c2c65a8d562c7052401e333e5f539d9ec2

Download Submit
C:\Windows\System\vrcxLQB.exe

Filesize
1.7MB

MD5
647a75ccf7a9e53508c813a2311a825c

SHA1
d63403b29bf30264adc8d41cbe5dcfc3381749cd

SHA256
08f0ca6465f22b531974d394e93cc1d1a92b3b550ee74b4928b95e54fcd9bf5b

SHA512
b5f758faa196b1b1cdce1a39b1ef7eaec93151d7ab70637240a46e4c37c6189b7c1bfa9d30192d8240d934c9956fe9a656c6b38bdd0311a40451d5531c4ebbbd

Download Submit
C:\Windows\System\vrgSUiK.exe

Filesize
1.7MB

MD5
97cacca647f8b2f9e80de9d7e1f60f3f

SHA1
42910f9cf45650133cc1ccbc9a5b5e23c33156cb

SHA256
0babe7fc86929e9f4cd71faf3440fecb6a89650fb125fa101867cc2c20555859

SHA512
30b7e8053b4ef367c7c4ceb5e96dbe8609bb54ada73b8cf34bc0983e3d921fc54596785cdecb089af98ae3715cc75472c40a99cdf764c691b62b816298240ef4

Download Submit
C:\Windows\System\xfgNbte.exe

Filesize
1.7MB

MD5
d2b0ebc404debdad1120f532fda5063c

SHA1
192d0b21843dc7e43b1a941185e00a2e212069c7

SHA256
9ed3022d47676588b8a9e8c9a6d6b74be5b80eb364934b51c68ec58c61433d14

SHA512
d89840fabf50dca42b683bbd5c5928f89abe969bd49a2d74d28b63eef53e27cf940277c053633175e2ef30d14009ad092079b0f9584b93e1af6b075ce66c095a

Download Submit
C:\Windows\System\yRyOEOu.exe

Filesize
1.7MB

MD5
f223c0cea76c598b6679b22a2c59202f

SHA1
8fe8ecf86eacdcf713ed172d68d2f2c1d0d4e997

SHA256
2af4dd7295dfe30730f67c9a36c91c91352233a466757acef1a1eb98ddadc698

SHA512
f41cb8671844e42fb579b8f723014531bbce0ffda023adbe475734dd6cb499524043ad0e954670db0e8358c576705772976e4f9f60759e99cb371686331dfc23

Download Submit
C:\Windows\System\ynBVeBj.exe

Filesize
1.7MB

MD5
53a3a9d9082fd2aa52c1e40b53bed15d

SHA1
bef362e08f85c73b732e82864adcb1dc2674e83e

SHA256
31d2997f2e46229736e4d7e29cf3f889e3408f7c0d2ef8df67da4d1ea7755c10

SHA512
3b59d86409036a92a848a5aa13fbf5b2ed64144933da1d250f24901e0545acf610d8180658187907e6fc0bb537669525e9f8411aa2389574afe30b1bb792c2d0

Download Submit
memory/320-2017-0x00007FF7BD260000-0x00007FF7BD652000-memory.dmp

Filesize
3.9MB

Download
memory/320-678-0x00007FF7BD260000-0x00007FF7BD652000-memory.dmp

Filesize
3.9MB

Download
memory/700-1998-0x00007FF680340000-0x00007FF680732000-memory.dmp

Filesize
3.9MB

Download
memory/700-681-0x00007FF680340000-0x00007FF680732000-memory.dmp

Filesize
3.9MB

Download
memory/960-677-0x00007FF6F0310000-0x00007FF6F0702000-memory.dmp

Filesize
3.9MB

Download
memory/960-2008-0x00007FF6F0310000-0x00007FF6F0702000-memory.dmp

Filesize
3.9MB

Download
memory/1784-444-0x00007FF7674A0000-0x00007FF767892000-memory.dmp

Filesize
3.9MB

Download
memory/1784-2004-0x00007FF7674A0000-0x00007FF767892000-memory.dmp

Filesize
3.9MB

Download
memory/1812-676-0x00007FF75AA80000-0x00007FF75AE72000-memory.dmp

Filesize
3.9MB

Download
memory/1812-2002-0x00007FF75AA80000-0x00007FF75AE72000-memory.dmp

Filesize
3.9MB

Download
memory/2232-1978-0x00007FF7D30F0000-0x00007FF7D34E2000-memory.dmp

Filesize
3.9MB

Download
memory/2232-357-0x00007FF7D30F0000-0x00007FF7D34E2000-memory.dmp

Filesize
3.9MB

Download
memory/2356-688-0x00007FF609E60000-0x00007FF60A252000-memory.dmp

Filesize
3.9MB

Download
memory/2356-1994-0x00007FF609E60000-0x00007FF60A252000-memory.dmp

Filesize
3.9MB

Download
memory/2856-2019-0x00007FF6F0100000-0x00007FF6F04F2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-680-0x00007FF6F0100000-0x00007FF6F04F2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-1976-0x00007FF6E4EA0000-0x00007FF6E5292000-memory.dmp

Filesize
3.9MB

Download
memory/2884-1938-0x00007FF6E4EA0000-0x00007FF6E5292000-memory.dmp

Filesize
3.9MB

Download
memory/2884-18-0x00007FF6E4EA0000-0x00007FF6E5292000-memory.dmp

Filesize
3.9MB

Download
memory/2976-0-0x00007FF79E460000-0x00007FF79E852000-memory.dmp

Filesize
3.9MB

Download
memory/2976-1-0x0000022B47740000-0x0000022B47750000-memory.dmp

Filesize
64KB

Download
memory/3048-1975-0x00007FF7D40B0000-0x00007FF7D44A2000-memory.dmp

Filesize
3.9MB

Download
memory/3048-227-0x00007FF7D40B0000-0x00007FF7D44A2000-memory.dmp

Filesize
3.9MB

Download
memory/3180-1993-0x00007FF6FEDE0000-0x00007FF6FF1D2000-memory.dmp

Filesize
3.9MB

Download
memory/3180-228-0x00007FF6FEDE0000-0x00007FF6FF1D2000-memory.dmp

Filesize
3.9MB

Download
memory/3296-684-0x00007FF71A1E0000-0x00007FF71A5D2000-memory.dmp

Filesize
3.9MB

Download
memory/3296-2024-0x00007FF71A1E0000-0x00007FF71A5D2000-memory.dmp

Filesize
3.9MB

Download
memory/3336-1996-0x00007FF61ADB0000-0x00007FF61B1A2000-memory.dmp

Filesize
3.9MB

Download
memory/3336-674-0x00007FF61ADB0000-0x00007FF61B1A2000-memory.dmp

Filesize
3.9MB

Download
memory/3404-362-0x00007FF738490000-0x00007FF738882000-memory.dmp

Filesize
3.9MB

Download
memory/3404-1990-0x00007FF738490000-0x00007FF738882000-memory.dmp

Filesize
3.9MB

Download
memory/3600-683-0x00007FF7C8BA0000-0x00007FF7C8F92000-memory.dmp

Filesize
3.9MB

Download
memory/3600-2007-0x00007FF7C8BA0000-0x00007FF7C8F92000-memory.dmp

Filesize
3.9MB

Download
memory/3756-1982-0x00007FF7F26E0000-0x00007FF7F2AD2000-memory.dmp

Filesize
3.9MB

Download
memory/3756-273-0x00007FF7F26E0000-0x00007FF7F2AD2000-memory.dmp

Filesize
3.9MB

Download
memory/3872-336-0x0000026A2CC10000-0x0000026A2CC32000-memory.dmp

Filesize
136KB

Download
memory/3872-1841-0x00007FF8FFF40000-0x00007FF900A01000-memory.dmp

Filesize
10.8MB

Download
memory/3872-8-0x00007FF8FFF43000-0x00007FF8FFF45000-memory.dmp

Filesize
8KB

Download
memory/3872-132-0x00007FF8FFF40000-0x00007FF900A01000-memory.dmp

Filesize
10.8MB

Download
memory/3872-76-0x00007FF8FFF40000-0x00007FF900A01000-memory.dmp

Filesize
10.8MB

Download
memory/4356-1986-0x00007FF648190000-0x00007FF648582000-memory.dmp

Filesize
3.9MB

Download
memory/4356-565-0x00007FF648190000-0x00007FF648582000-memory.dmp

Filesize
3.9MB

Download
memory/4372-426-0x00007FF6A0D90000-0x00007FF6A1182000-memory.dmp

Filesize
3.9MB

Download
memory/4372-2000-0x00007FF6A0D90000-0x00007FF6A1182000-memory.dmp

Filesize
3.9MB

Download
memory/4412-1980-0x00007FF725480000-0x00007FF725872000-memory.dmp

Filesize
3.9MB

Download
memory/4412-687-0x00007FF725480000-0x00007FF725872000-memory.dmp

Filesize
3.9MB

Download
memory/4800-1989-0x00007FF720350000-0x00007FF720742000-memory.dmp

Filesize
3.9MB

Download
memory/4800-679-0x00007FF720350000-0x00007FF720742000-memory.dmp

Filesize
3.9MB

Download
memory/4824-685-0x00007FF70AE20000-0x00007FF70B212000-memory.dmp

Filesize
3.9MB

Download
memory/4824-2022-0x00007FF70AE20000-0x00007FF70B212000-memory.dmp

Filesize
3.9MB

Download
memory/4908-1984-0x00007FF7C2CB0000-0x00007FF7C30A2000-memory.dmp

Filesize
3.9MB

Download
memory/4908-557-0x00007FF7C2CB0000-0x00007FF7C30A2000-memory.dmp

Filesize
3.9MB

Download
memory/5024-682-0x00007FF67AD80000-0x00007FF67B172000-memory.dmp

Filesize
3.9MB

Download
memory/5024-2026-0x00007FF67AD80000-0x00007FF67B172000-memory.dmp

Filesize
3.9MB

Download
memory/5040-686-0x00007FF638DE0000-0x00007FF6391D2000-memory.dmp

Filesize
3.9MB

Download
memory/5040-1972-0x00007FF638DE0000-0x00007FF6391D2000-memory.dmp

Filesize
3.9MB

Download