xmrig | 06702ed14653449d17be56313561dabda211ede4a6acec3504784554aaba2c6f

Analysis

max time kernel
143s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
Size

2.1MB
MD5

88859b912e5e46f4df32c7f39edec780
SHA1

545ef609d536e3a9bb1a7e29877e90d5354d4faf
SHA256

06702ed14653449d17be56313561dabda211ede4a6acec3504784554aaba2c6f
SHA512

3b7e82ef4151d7f64618483af1d8ef6d2879497162a77e4e81d1eab8010a0b22f8cfc3d29207df339eee7760ab7fa8c344ee9fc90dd0486686c993367c325452
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYRLZcyZ204oVTUG7kieEHcYT0wm:Lz071uv4BPMkibTIA5JnJ1V8/XWoZ

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/412-306-0x00007FF7036A0000-0x00007FF703A92000-memory.dmp	xmrig
behavioral2/memory/2416-360-0x00007FF720B30000-0x00007FF720F22000-memory.dmp	xmrig
behavioral2/memory/400-412-0x00007FF785780000-0x00007FF785B72000-memory.dmp	xmrig
behavioral2/memory/4848-417-0x00007FF634920000-0x00007FF634D12000-memory.dmp	xmrig
behavioral2/memory/2760-428-0x00007FF6A7A10000-0x00007FF6A7E02000-memory.dmp	xmrig
behavioral2/memory/4804-425-0x00007FF628B90000-0x00007FF628F82000-memory.dmp	xmrig
behavioral2/memory/4880-508-0x00007FF72B0F0000-0x00007FF72B4E2000-memory.dmp	xmrig
behavioral2/memory/2324-510-0x00007FF6354F0000-0x00007FF6358E2000-memory.dmp	xmrig
behavioral2/memory/2620-509-0x00007FF7A4490000-0x00007FF7A4882000-memory.dmp	xmrig
behavioral2/memory/3124-507-0x00007FF7D60B0000-0x00007FF7D64A2000-memory.dmp	xmrig
behavioral2/memory/1800-411-0x00007FF644140000-0x00007FF644532000-memory.dmp	xmrig
behavioral2/memory/2616-329-0x00007FF7BC710000-0x00007FF7BCB02000-memory.dmp	xmrig
behavioral2/memory/440-328-0x00007FF6B7FD0000-0x00007FF6B83C2000-memory.dmp	xmrig
behavioral2/memory/560-307-0x00007FF695EC0000-0x00007FF6962B2000-memory.dmp	xmrig
behavioral2/memory/720-266-0x00007FF7EFBB0000-0x00007FF7EFFA2000-memory.dmp	xmrig
behavioral2/memory/1152-255-0x00007FF622CF0000-0x00007FF6230E2000-memory.dmp	xmrig
behavioral2/memory/1060-231-0x00007FF6890C0000-0x00007FF6894B2000-memory.dmp	xmrig
behavioral2/memory/3964-189-0x00007FF679080000-0x00007FF679472000-memory.dmp	xmrig
behavioral2/memory/4672-182-0x00007FF60A9A0000-0x00007FF60AD92000-memory.dmp	xmrig
behavioral2/memory/4064-143-0x00007FF644D60000-0x00007FF645152000-memory.dmp	xmrig
behavioral2/memory/3300-114-0x00007FF7A6820000-0x00007FF7A6C12000-memory.dmp	xmrig
behavioral2/memory/4688-94-0x00007FF7B31C0000-0x00007FF7B35B2000-memory.dmp	xmrig
behavioral2/memory/3704-91-0x00007FF68B390000-0x00007FF68B782000-memory.dmp	xmrig
behavioral2/memory/3612-14-0x00007FF7294C0000-0x00007FF7298B2000-memory.dmp	xmrig
behavioral2/memory/3612-2794-0x00007FF7294C0000-0x00007FF7298B2000-memory.dmp	xmrig
behavioral2/memory/3612-2796-0x00007FF7294C0000-0x00007FF7298B2000-memory.dmp	xmrig
behavioral2/memory/3704-2798-0x00007FF68B390000-0x00007FF68B782000-memory.dmp	xmrig
behavioral2/memory/3124-2800-0x00007FF7D60B0000-0x00007FF7D64A2000-memory.dmp	xmrig
behavioral2/memory/4064-2802-0x00007FF644D60000-0x00007FF645152000-memory.dmp	xmrig
behavioral2/memory/3300-2804-0x00007FF7A6820000-0x00007FF7A6C12000-memory.dmp	xmrig
behavioral2/memory/4688-2806-0x00007FF7B31C0000-0x00007FF7B35B2000-memory.dmp	xmrig
behavioral2/memory/412-2808-0x00007FF7036A0000-0x00007FF703A92000-memory.dmp	xmrig
behavioral2/memory/4672-2812-0x00007FF60A9A0000-0x00007FF60AD92000-memory.dmp	xmrig
behavioral2/memory/4880-2811-0x00007FF72B0F0000-0x00007FF72B4E2000-memory.dmp	xmrig
behavioral2/memory/3964-2818-0x00007FF679080000-0x00007FF679472000-memory.dmp	xmrig
behavioral2/memory/1060-2817-0x00007FF6890C0000-0x00007FF6894B2000-memory.dmp	xmrig
behavioral2/memory/560-2815-0x00007FF695EC0000-0x00007FF6962B2000-memory.dmp	xmrig
behavioral2/memory/1152-2820-0x00007FF622CF0000-0x00007FF6230E2000-memory.dmp	xmrig
behavioral2/memory/720-2823-0x00007FF7EFBB0000-0x00007FF7EFFA2000-memory.dmp	xmrig
behavioral2/memory/440-2824-0x00007FF6B7FD0000-0x00007FF6B83C2000-memory.dmp	xmrig
behavioral2/memory/2620-2826-0x00007FF7A4490000-0x00007FF7A4882000-memory.dmp	xmrig
behavioral2/memory/4804-2828-0x00007FF628B90000-0x00007FF628F82000-memory.dmp	xmrig
behavioral2/memory/2416-2830-0x00007FF720B30000-0x00007FF720F22000-memory.dmp	xmrig
behavioral2/memory/2324-2832-0x00007FF6354F0000-0x00007FF6358E2000-memory.dmp	xmrig
behavioral2/memory/4848-2834-0x00007FF634920000-0x00007FF634D12000-memory.dmp	xmrig
behavioral2/memory/400-2885-0x00007FF785780000-0x00007FF785B72000-memory.dmp	xmrig
behavioral2/memory/2616-2876-0x00007FF7BC710000-0x00007FF7BCB02000-memory.dmp	xmrig
behavioral2/memory/1800-2874-0x00007FF644140000-0x00007FF644532000-memory.dmp	xmrig
behavioral2/memory/2760-2869-0x00007FF6A7A10000-0x00007FF6A7E02000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
10	2628	powershell.exe
12	2628	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2628	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3612	JUpYGdC.exe
3124	BMZbJCh.exe
3704	MVQHzdh.exe
4688	cdYOVhA.exe
3300	CsmcwUi.exe
4064	HvNStXG.exe
4672	MXvZcTR.exe
3964	RXPPbjl.exe
1060	iExIiuY.exe
1152	GXbZzuZ.exe
720	mvmxoHk.exe
412	ShEPcbB.exe
4880	mUpPElK.exe
560	yjuPGCV.exe
440	nTVvwux.exe
2616	WQjaJuj.exe
2416	jnhNQTa.exe
1800	uSKyzCE.exe
2620	GgfgcUa.exe
400	TIYiVRc.exe
2324	adsyDSN.exe
4848	vZUlmIX.exe
4804	VwLrFkt.exe
2760	PgujECd.exe
772	oyVauty.exe
1460	GzATtMV.exe
3540	cIGqlGj.exe
4352	ZkZTKXM.exe
2412	DTJBjFj.exe
2812	dxxTuTh.exe
4272	XnNwusA.exe
1144	MapxSTe.exe
1036	xvKTpFF.exe
2120	LmHzRvF.exe
1808	vgfxurt.exe
4720	eDurdPG.exe
2304	RAhPkhr.exe
2992	SASFQeK.exe
824	WyQGfLO.exe
2752	DyFPgRp.exe
3336	SuLlmkE.exe
2108	VXvewGn.exe
3524	EIsLTBU.exe
4384	uVYRNNv.exe
3008	uOVPrYz.exe
4524	iGxOOqf.exe
4208	jrrtGFg.exe
1188	dvQAJSR.exe
3144	TtERVUz.exe
4680	qsSxeQO.exe
4788	MeWNsvw.exe
2424	MJvwbJO.exe
808	XnsWWMt.exe
220	TkgyMDx.exe
1716	HjoZrCh.exe
4936	raWpxPQ.exe
4552	zYixkiU.exe
4580	nMskZRQ.exe
4092	FHUJdpP.exe
2260	uUGJKvQ.exe
1488	paWieAm.exe
648	rpIFXkj.exe
3228	syRLqkl.exe
2336	fsKvMqU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4476-0-0x00007FF7982F0000-0x00007FF7986E2000-memory.dmp	upx
behavioral2/files/0x0008000000023403-5.dat	upx
behavioral2/files/0x0007000000023408-17.dat	upx
behavioral2/files/0x000700000002340a-23.dat	upx
behavioral2/files/0x000700000002340b-45.dat	upx
behavioral2/files/0x0007000000023412-66.dat	upx
behavioral2/files/0x0007000000023417-90.dat	upx
behavioral2/files/0x0007000000023419-111.dat	upx
behavioral2/files/0x0007000000023427-168.dat	upx
behavioral2/memory/412-306-0x00007FF7036A0000-0x00007FF703A92000-memory.dmp	upx
behavioral2/memory/2416-360-0x00007FF720B30000-0x00007FF720F22000-memory.dmp	upx
behavioral2/memory/400-412-0x00007FF785780000-0x00007FF785B72000-memory.dmp	upx
behavioral2/memory/4848-417-0x00007FF634920000-0x00007FF634D12000-memory.dmp	upx
behavioral2/memory/2760-428-0x00007FF6A7A10000-0x00007FF6A7E02000-memory.dmp	upx
behavioral2/memory/4804-425-0x00007FF628B90000-0x00007FF628F82000-memory.dmp	upx
behavioral2/memory/4880-508-0x00007FF72B0F0000-0x00007FF72B4E2000-memory.dmp	upx
behavioral2/memory/2324-510-0x00007FF6354F0000-0x00007FF6358E2000-memory.dmp	upx
behavioral2/memory/2620-509-0x00007FF7A4490000-0x00007FF7A4882000-memory.dmp	upx
behavioral2/memory/3124-507-0x00007FF7D60B0000-0x00007FF7D64A2000-memory.dmp	upx
behavioral2/memory/1800-411-0x00007FF644140000-0x00007FF644532000-memory.dmp	upx
behavioral2/memory/2616-329-0x00007FF7BC710000-0x00007FF7BCB02000-memory.dmp	upx
behavioral2/memory/440-328-0x00007FF6B7FD0000-0x00007FF6B83C2000-memory.dmp	upx
behavioral2/memory/560-307-0x00007FF695EC0000-0x00007FF6962B2000-memory.dmp	upx
behavioral2/memory/720-266-0x00007FF7EFBB0000-0x00007FF7EFFA2000-memory.dmp	upx
behavioral2/memory/1152-255-0x00007FF622CF0000-0x00007FF6230E2000-memory.dmp	upx
behavioral2/memory/1060-231-0x00007FF6890C0000-0x00007FF6894B2000-memory.dmp	upx
behavioral2/files/0x000700000002342d-217.dat	upx
behavioral2/files/0x000700000002341f-212.dat	upx
behavioral2/files/0x0007000000023422-209.dat	upx
behavioral2/files/0x000700000002341e-204.dat	upx
behavioral2/files/0x0007000000023421-201.dat	upx
behavioral2/files/0x000700000002342c-199.dat	upx
behavioral2/files/0x000700000002342b-196.dat	upx
behavioral2/files/0x000700000002341c-192.dat	upx
behavioral2/memory/3964-189-0x00007FF679080000-0x00007FF679472000-memory.dmp	upx
behavioral2/files/0x000700000002341b-186.dat	upx
behavioral2/memory/4672-182-0x00007FF60A9A0000-0x00007FF60AD92000-memory.dmp	upx
behavioral2/files/0x000700000002342a-177.dat	upx
behavioral2/files/0x0007000000023429-174.dat	upx
behavioral2/files/0x0007000000023428-171.dat	upx
behavioral2/files/0x000800000002340e-166.dat	upx
behavioral2/files/0x000700000002341d-156.dat	upx
behavioral2/files/0x0007000000023418-149.dat	upx
behavioral2/memory/4064-143-0x00007FF644D60000-0x00007FF645152000-memory.dmp	upx
behavioral2/files/0x0007000000023420-141.dat	upx
behavioral2/files/0x000700000002341a-138.dat	upx
behavioral2/files/0x0007000000023426-167.dat	upx
behavioral2/files/0x0007000000023423-162.dat	upx
behavioral2/files/0x000800000002340f-122.dat	upx
behavioral2/files/0x0007000000023416-133.dat	upx
behavioral2/files/0x0007000000023410-107.dat	upx
behavioral2/files/0x0007000000023411-104.dat	upx
behavioral2/files/0x0007000000023415-99.dat	upx
behavioral2/memory/3300-114-0x00007FF7A6820000-0x00007FF7A6C12000-memory.dmp	upx
behavioral2/memory/4688-94-0x00007FF7B31C0000-0x00007FF7B35B2000-memory.dmp	upx
behavioral2/memory/3704-91-0x00007FF68B390000-0x00007FF68B782000-memory.dmp	upx
behavioral2/files/0x000700000002340d-82.dat	upx
behavioral2/files/0x0007000000023414-78.dat	upx
behavioral2/files/0x000700000002340c-77.dat	upx
behavioral2/files/0x0007000000023413-71.dat	upx
behavioral2/files/0x0007000000023409-54.dat	upx
behavioral2/files/0x0007000000023407-26.dat	upx
behavioral2/memory/3612-14-0x00007FF7294C0000-0x00007FF7298B2000-memory.dmp	upx
behavioral2/memory/3612-2794-0x00007FF7294C0000-0x00007FF7298B2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	raw.githubusercontent.com
9	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uZsvYYY.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\lbndxJA.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\GYsfmCA.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\hQQjmdR.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\XhMjtTl.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\IHKohAv.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\HepccQJ.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\cIMADQY.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\UMRAFOe.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\mzxrNAx.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\XHWjbeg.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\NcdSkGG.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\fjphSMA.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\rBphkOB.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\VEwnSYZ.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\QAqlnMc.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\nmjGzzV.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\VCbzJKZ.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\jygIiZw.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\KZaQHbS.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\BIQZkMF.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\XuuRTGR.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\OZKiVaL.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\ffKazQO.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\PMWARwL.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\DxGpKKX.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\yXSooLk.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\sufiYLn.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\dagYjyr.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\vDAzFng.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\QWeGcEd.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\yahMbId.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\isAxJHq.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\sJSLYRo.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\uOUBypu.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\CLZxaEI.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\WqzKPgy.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\jPwvncP.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\SFGgyqO.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\EZMeUDS.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\XuEDGub.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\vavPayM.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\mmPaSIu.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\CNhPXrb.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\sBMMDhE.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\NtuZZQa.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\ESUAHkx.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\HlYmRTY.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\lcGQNsp.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\EasmSsw.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\KStCShP.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\Sqbatzm.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\fxJGtNW.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\TLjDVZJ.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\pxqUDvt.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\bhLFdcO.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\YKptZsY.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\pETfLyq.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\hqFhzEX.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\DsfiGwW.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\FbCuBah.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\MdDYBcV.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\zksFEFu.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
File created	C:\Windows\System\lULjRqD.exe	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2628	powershell.exe
2628	powershell.exe
2628	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
Token: SeDebugPrivilege	2628	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 2628	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	86
PID 4476 wrote to memory of 2628	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	86
PID 4476 wrote to memory of 3612	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	87
PID 4476 wrote to memory of 3612	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	87
PID 4476 wrote to memory of 3704	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	88
PID 4476 wrote to memory of 3704	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	88
PID 4476 wrote to memory of 3124	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	89
PID 4476 wrote to memory of 3124	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	89
PID 4476 wrote to memory of 4688	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	90
PID 4476 wrote to memory of 4688	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	90
PID 4476 wrote to memory of 3300	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	91
PID 4476 wrote to memory of 3300	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	91
PID 4476 wrote to memory of 4064	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	92
PID 4476 wrote to memory of 4064	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	92
PID 4476 wrote to memory of 4672	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	93
PID 4476 wrote to memory of 4672	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	93
PID 4476 wrote to memory of 3964	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	94
PID 4476 wrote to memory of 3964	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	94
PID 4476 wrote to memory of 1060	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	95
PID 4476 wrote to memory of 1060	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	95
PID 4476 wrote to memory of 1152	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	96
PID 4476 wrote to memory of 1152	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	96
PID 4476 wrote to memory of 720	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	97
PID 4476 wrote to memory of 720	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	97
PID 4476 wrote to memory of 412	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	98
PID 4476 wrote to memory of 412	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	98
PID 4476 wrote to memory of 4880	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	99
PID 4476 wrote to memory of 4880	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	99
PID 4476 wrote to memory of 560	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	100
PID 4476 wrote to memory of 560	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	100
PID 4476 wrote to memory of 440	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	101
PID 4476 wrote to memory of 440	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	101
PID 4476 wrote to memory of 2616	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	102
PID 4476 wrote to memory of 2616	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	102
PID 4476 wrote to memory of 2416	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	103
PID 4476 wrote to memory of 2416	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	103
PID 4476 wrote to memory of 1800	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	104
PID 4476 wrote to memory of 1800	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	104
PID 4476 wrote to memory of 2620	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	105
PID 4476 wrote to memory of 2620	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	105
PID 4476 wrote to memory of 400	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	106
PID 4476 wrote to memory of 400	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	106
PID 4476 wrote to memory of 1460	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	107
PID 4476 wrote to memory of 1460	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	107
PID 4476 wrote to memory of 2324	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	108
PID 4476 wrote to memory of 2324	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	108
PID 4476 wrote to memory of 4848	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	109
PID 4476 wrote to memory of 4848	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	109
PID 4476 wrote to memory of 4804	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	110
PID 4476 wrote to memory of 4804	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	110
PID 4476 wrote to memory of 2760	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	111
PID 4476 wrote to memory of 2760	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	111
PID 4476 wrote to memory of 772	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	112
PID 4476 wrote to memory of 772	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	112
PID 4476 wrote to memory of 3540	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	113
PID 4476 wrote to memory of 3540	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	113
PID 4476 wrote to memory of 4352	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	114
PID 4476 wrote to memory of 4352	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	114
PID 4476 wrote to memory of 2412	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	115
PID 4476 wrote to memory of 2412	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	115
PID 4476 wrote to memory of 2812	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	116
PID 4476 wrote to memory of 2812	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	116
PID 4476 wrote to memory of 824	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	117
PID 4476 wrote to memory of 824	4476	88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\88859b912e5e46f4df32c7f39edec780_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2628
- C:\Windows\System\JUpYGdC.exe
  C:\Windows\System\JUpYGdC.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\MVQHzdh.exe
  C:\Windows\System\MVQHzdh.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\BMZbJCh.exe
  C:\Windows\System\BMZbJCh.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\cdYOVhA.exe
  C:\Windows\System\cdYOVhA.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\CsmcwUi.exe
  C:\Windows\System\CsmcwUi.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\HvNStXG.exe
  C:\Windows\System\HvNStXG.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\MXvZcTR.exe
  C:\Windows\System\MXvZcTR.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\RXPPbjl.exe
  C:\Windows\System\RXPPbjl.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\iExIiuY.exe
  C:\Windows\System\iExIiuY.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\GXbZzuZ.exe
  C:\Windows\System\GXbZzuZ.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\mvmxoHk.exe
  C:\Windows\System\mvmxoHk.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\ShEPcbB.exe
  C:\Windows\System\ShEPcbB.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\mUpPElK.exe
  C:\Windows\System\mUpPElK.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\yjuPGCV.exe
  C:\Windows\System\yjuPGCV.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\nTVvwux.exe
  C:\Windows\System\nTVvwux.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\WQjaJuj.exe
  C:\Windows\System\WQjaJuj.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\jnhNQTa.exe
  C:\Windows\System\jnhNQTa.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\uSKyzCE.exe
  C:\Windows\System\uSKyzCE.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\GgfgcUa.exe
  C:\Windows\System\GgfgcUa.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\TIYiVRc.exe
  C:\Windows\System\TIYiVRc.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\GzATtMV.exe
  C:\Windows\System\GzATtMV.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\adsyDSN.exe
  C:\Windows\System\adsyDSN.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\vZUlmIX.exe
  C:\Windows\System\vZUlmIX.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\VwLrFkt.exe
  C:\Windows\System\VwLrFkt.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\PgujECd.exe
  C:\Windows\System\PgujECd.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\oyVauty.exe
  C:\Windows\System\oyVauty.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\cIGqlGj.exe
  C:\Windows\System\cIGqlGj.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\ZkZTKXM.exe
  C:\Windows\System\ZkZTKXM.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\DTJBjFj.exe
  C:\Windows\System\DTJBjFj.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\dxxTuTh.exe
  C:\Windows\System\dxxTuTh.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\WyQGfLO.exe
  C:\Windows\System\WyQGfLO.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\DyFPgRp.exe
  C:\Windows\System\DyFPgRp.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\XnNwusA.exe
  C:\Windows\System\XnNwusA.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\MapxSTe.exe
  C:\Windows\System\MapxSTe.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\xvKTpFF.exe
  C:\Windows\System\xvKTpFF.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\LmHzRvF.exe
  C:\Windows\System\LmHzRvF.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\vgfxurt.exe
  C:\Windows\System\vgfxurt.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\eDurdPG.exe
  C:\Windows\System\eDurdPG.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\RAhPkhr.exe
  C:\Windows\System\RAhPkhr.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\SASFQeK.exe
  C:\Windows\System\SASFQeK.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\SuLlmkE.exe
  C:\Windows\System\SuLlmkE.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\VXvewGn.exe
  C:\Windows\System\VXvewGn.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\EIsLTBU.exe
  C:\Windows\System\EIsLTBU.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\uVYRNNv.exe
  C:\Windows\System\uVYRNNv.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\uOVPrYz.exe
  C:\Windows\System\uOVPrYz.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\iGxOOqf.exe
  C:\Windows\System\iGxOOqf.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\jrrtGFg.exe
  C:\Windows\System\jrrtGFg.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\dvQAJSR.exe
  C:\Windows\System\dvQAJSR.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\TtERVUz.exe
  C:\Windows\System\TtERVUz.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\qsSxeQO.exe
  C:\Windows\System\qsSxeQO.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\MeWNsvw.exe
  C:\Windows\System\MeWNsvw.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\MJvwbJO.exe
  C:\Windows\System\MJvwbJO.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\XnsWWMt.exe
  C:\Windows\System\XnsWWMt.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\TkgyMDx.exe
  C:\Windows\System\TkgyMDx.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\HjoZrCh.exe
  C:\Windows\System\HjoZrCh.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\raWpxPQ.exe
  C:\Windows\System\raWpxPQ.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\zYixkiU.exe
  C:\Windows\System\zYixkiU.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\nMskZRQ.exe
  C:\Windows\System\nMskZRQ.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\FHUJdpP.exe
  C:\Windows\System\FHUJdpP.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\uUGJKvQ.exe
  C:\Windows\System\uUGJKvQ.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\paWieAm.exe
  C:\Windows\System\paWieAm.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\rpIFXkj.exe
  C:\Windows\System\rpIFXkj.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\syRLqkl.exe
  C:\Windows\System\syRLqkl.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\fsKvMqU.exe
  C:\Windows\System\fsKvMqU.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\eNIxZXq.exe
  C:\Windows\System\eNIxZXq.exe
  2⤵
  PID:4164
- C:\Windows\System\Wjrseiq.exe
  C:\Windows\System\Wjrseiq.exe
  2⤵
  PID:1872
- C:\Windows\System\dXxrOUg.exe
  C:\Windows\System\dXxrOUg.exe
  2⤵
  PID:4512
- C:\Windows\System\WuBBvwO.exe
  C:\Windows\System\WuBBvwO.exe
  2⤵
  PID:4216
- C:\Windows\System\yMrSYIf.exe
  C:\Windows\System\yMrSYIf.exe
  2⤵
  PID:1568
- C:\Windows\System\GVCIzfm.exe
  C:\Windows\System\GVCIzfm.exe
  2⤵
  PID:5012
- C:\Windows\System\ezgIJWK.exe
  C:\Windows\System\ezgIJWK.exe
  2⤵
  PID:4740
- C:\Windows\System\MqcebfN.exe
  C:\Windows\System\MqcebfN.exe
  2⤵
  PID:856
- C:\Windows\System\OziYCzf.exe
  C:\Windows\System\OziYCzf.exe
  2⤵
  PID:2572
- C:\Windows\System\hHoWPoK.exe
  C:\Windows\System\hHoWPoK.exe
  2⤵
  PID:4932
- C:\Windows\System\nzrCtrT.exe
  C:\Windows\System\nzrCtrT.exe
  2⤵
  PID:5004
- C:\Windows\System\NoKLkOm.exe
  C:\Windows\System\NoKLkOm.exe
  2⤵
  PID:5132
- C:\Windows\System\FkKtrjw.exe
  C:\Windows\System\FkKtrjw.exe
  2⤵
  PID:5156
- C:\Windows\System\fhoDFEw.exe
  C:\Windows\System\fhoDFEw.exe
  2⤵
  PID:5204
- C:\Windows\System\axVBNGm.exe
  C:\Windows\System\axVBNGm.exe
  2⤵
  PID:5220
- C:\Windows\System\AnIlkDA.exe
  C:\Windows\System\AnIlkDA.exe
  2⤵
  PID:5244
- C:\Windows\System\OFczTBA.exe
  C:\Windows\System\OFczTBA.exe
  2⤵
  PID:5268
- C:\Windows\System\DsGOQox.exe
  C:\Windows\System\DsGOQox.exe
  2⤵
  PID:5284
- C:\Windows\System\jKzcAdQ.exe
  C:\Windows\System\jKzcAdQ.exe
  2⤵
  PID:5332
- C:\Windows\System\jzfghGC.exe
  C:\Windows\System\jzfghGC.exe
  2⤵
  PID:5348
- C:\Windows\System\IveiqFB.exe
  C:\Windows\System\IveiqFB.exe
  2⤵
  PID:5372
- C:\Windows\System\zQlhVeo.exe
  C:\Windows\System\zQlhVeo.exe
  2⤵
  PID:5400
- C:\Windows\System\MWRjYkG.exe
  C:\Windows\System\MWRjYkG.exe
  2⤵
  PID:5420
- C:\Windows\System\wkiAHRG.exe
  C:\Windows\System\wkiAHRG.exe
  2⤵
  PID:5444
- C:\Windows\System\VHjOWtG.exe
  C:\Windows\System\VHjOWtG.exe
  2⤵
  PID:5460
- C:\Windows\System\kUGGRxs.exe
  C:\Windows\System\kUGGRxs.exe
  2⤵
  PID:5484
- C:\Windows\System\amPXRJz.exe
  C:\Windows\System\amPXRJz.exe
  2⤵
  PID:5580
- C:\Windows\System\HobByMb.exe
  C:\Windows\System\HobByMb.exe
  2⤵
  PID:5604
- C:\Windows\System\XrZFoMa.exe
  C:\Windows\System\XrZFoMa.exe
  2⤵
  PID:5624
- C:\Windows\System\ZwTehDy.exe
  C:\Windows\System\ZwTehDy.exe
  2⤵
  PID:5644
- C:\Windows\System\WdEhIoF.exe
  C:\Windows\System\WdEhIoF.exe
  2⤵
  PID:5676
- C:\Windows\System\UITSwiy.exe
  C:\Windows\System\UITSwiy.exe
  2⤵
  PID:5696
- C:\Windows\System\RHhNTNe.exe
  C:\Windows\System\RHhNTNe.exe
  2⤵
  PID:5716
- C:\Windows\System\yTyYHlx.exe
  C:\Windows\System\yTyYHlx.exe
  2⤵
  PID:5736
- C:\Windows\System\fmgtYvH.exe
  C:\Windows\System\fmgtYvH.exe
  2⤵
  PID:5760
- C:\Windows\System\xZRPMtp.exe
  C:\Windows\System\xZRPMtp.exe
  2⤵
  PID:5780
- C:\Windows\System\eObamtn.exe
  C:\Windows\System\eObamtn.exe
  2⤵
  PID:5800
- C:\Windows\System\bbMZESw.exe
  C:\Windows\System\bbMZESw.exe
  2⤵
  PID:5884
- C:\Windows\System\uwFFAdU.exe
  C:\Windows\System\uwFFAdU.exe
  2⤵
  PID:5908
- C:\Windows\System\LfBmDSx.exe
  C:\Windows\System\LfBmDSx.exe
  2⤵
  PID:5928
- C:\Windows\System\oEPYuSn.exe
  C:\Windows\System\oEPYuSn.exe
  2⤵
  PID:5948
- C:\Windows\System\EVETcfF.exe
  C:\Windows\System\EVETcfF.exe
  2⤵
  PID:5972
- C:\Windows\System\lVKdAcA.exe
  C:\Windows\System\lVKdAcA.exe
  2⤵
  PID:5992
- C:\Windows\System\kNZYMyY.exe
  C:\Windows\System\kNZYMyY.exe
  2⤵
  PID:6016
- C:\Windows\System\HRtjUuV.exe
  C:\Windows\System\HRtjUuV.exe
  2⤵
  PID:6032
- C:\Windows\System\uEOVwZW.exe
  C:\Windows\System\uEOVwZW.exe
  2⤵
  PID:6060
- C:\Windows\System\eAQXwAb.exe
  C:\Windows\System\eAQXwAb.exe
  2⤵
  PID:6076
- C:\Windows\System\nrtrEdE.exe
  C:\Windows\System\nrtrEdE.exe
  2⤵
  PID:6104
- C:\Windows\System\KSgjNxj.exe
  C:\Windows\System\KSgjNxj.exe
  2⤵
  PID:6128
- C:\Windows\System\RaRGFWu.exe
  C:\Windows\System\RaRGFWu.exe
  2⤵
  PID:4144
- C:\Windows\System\XznGzMC.exe
  C:\Windows\System\XznGzMC.exe
  2⤵
  PID:4568
- C:\Windows\System\VWPjwui.exe
  C:\Windows\System\VWPjwui.exe
  2⤵
  PID:4304
- C:\Windows\System\NMpMPyC.exe
  C:\Windows\System\NMpMPyC.exe
  2⤵
  PID:4308
- C:\Windows\System\loSOnfm.exe
  C:\Windows\System\loSOnfm.exe
  2⤵
  PID:2240
- C:\Windows\System\OFBOtEV.exe
  C:\Windows\System\OFBOtEV.exe
  2⤵
  PID:4844
- C:\Windows\System\jKHoPgT.exe
  C:\Windows\System\jKHoPgT.exe
  2⤵
  PID:1616
- C:\Windows\System\nciKZOx.exe
  C:\Windows\System\nciKZOx.exe
  2⤵
  PID:1248
- C:\Windows\System\izgIVoL.exe
  C:\Windows\System\izgIVoL.exe
  2⤵
  PID:4184
- C:\Windows\System\btwFqis.exe
  C:\Windows\System\btwFqis.exe
  2⤵
  PID:2596
- C:\Windows\System\OcYSJmw.exe
  C:\Windows\System\OcYSJmw.exe
  2⤵
  PID:2352
- C:\Windows\System\xivXyDQ.exe
  C:\Windows\System\xivXyDQ.exe
  2⤵
  PID:5748
- C:\Windows\System\xptSeYB.exe
  C:\Windows\System\xptSeYB.exe
  2⤵
  PID:5260
- C:\Windows\System\UbaDoPK.exe
  C:\Windows\System\UbaDoPK.exe
  2⤵
  PID:5228
- C:\Windows\System\fzoiNRa.exe
  C:\Windows\System\fzoiNRa.exe
  2⤵
  PID:5292
- C:\Windows\System\FwZXvDm.exe
  C:\Windows\System\FwZXvDm.exe
  2⤵
  PID:5552
- C:\Windows\System\WHxdKvB.exe
  C:\Windows\System\WHxdKvB.exe
  2⤵
  PID:5600
- C:\Windows\System\kYEbDaa.exe
  C:\Windows\System\kYEbDaa.exe
  2⤵
  PID:5652
- C:\Windows\System\MIsaBKt.exe
  C:\Windows\System\MIsaBKt.exe
  2⤵
  PID:5708
- C:\Windows\System\oWDrIlx.exe
  C:\Windows\System\oWDrIlx.exe
  2⤵
  PID:4424
- C:\Windows\System\zQhLcFP.exe
  C:\Windows\System\zQhLcFP.exe
  2⤵
  PID:5876
- C:\Windows\System\tPXKKHy.exe
  C:\Windows\System\tPXKKHy.exe
  2⤵
  PID:5920
- C:\Windows\System\SRtJhHi.exe
  C:\Windows\System\SRtJhHi.exe
  2⤵
  PID:5988
- C:\Windows\System\raANCCF.exe
  C:\Windows\System\raANCCF.exe
  2⤵
  PID:6040
- C:\Windows\System\LXmncHM.exe
  C:\Windows\System\LXmncHM.exe
  2⤵
  PID:6084
- C:\Windows\System\oVRXHUc.exe
  C:\Windows\System\oVRXHUc.exe
  2⤵
  PID:6140
- C:\Windows\System\KwGdWpG.exe
  C:\Windows\System\KwGdWpG.exe
  2⤵
  PID:64
- C:\Windows\System\kCIKDBd.exe
  C:\Windows\System\kCIKDBd.exe
  2⤵
  PID:1720
- C:\Windows\System\qbjpOwq.exe
  C:\Windows\System\qbjpOwq.exe
  2⤵
  PID:2492
- C:\Windows\System\NFUTxso.exe
  C:\Windows\System\NFUTxso.exe
  2⤵
  PID:5212
- C:\Windows\System\yDtzkIY.exe
  C:\Windows\System\yDtzkIY.exe
  2⤵
  PID:6160
- C:\Windows\System\KTNexWS.exe
  C:\Windows\System\KTNexWS.exe
  2⤵
  PID:6188
- C:\Windows\System\vRndmDl.exe
  C:\Windows\System\vRndmDl.exe
  2⤵
  PID:6520
- C:\Windows\System\cenMCqI.exe
  C:\Windows\System\cenMCqI.exe
  2⤵
  PID:6536
- C:\Windows\System\drDMAfp.exe
  C:\Windows\System\drDMAfp.exe
  2⤵
  PID:6552
- C:\Windows\System\udTocBj.exe
  C:\Windows\System\udTocBj.exe
  2⤵
  PID:6568
- C:\Windows\System\hmQqqZX.exe
  C:\Windows\System\hmQqqZX.exe
  2⤵
  PID:6636
- C:\Windows\System\Zcdblbi.exe
  C:\Windows\System\Zcdblbi.exe
  2⤵
  PID:6652
- C:\Windows\System\ejcZrHc.exe
  C:\Windows\System\ejcZrHc.exe
  2⤵
  PID:6680
- C:\Windows\System\RErOOpA.exe
  C:\Windows\System\RErOOpA.exe
  2⤵
  PID:6696
- C:\Windows\System\ydWmdGJ.exe
  C:\Windows\System\ydWmdGJ.exe
  2⤵
  PID:6716
- C:\Windows\System\XBsqKcW.exe
  C:\Windows\System\XBsqKcW.exe
  2⤵
  PID:6744
- C:\Windows\System\GdwJpcb.exe
  C:\Windows\System\GdwJpcb.exe
  2⤵
  PID:6760
- C:\Windows\System\dGlEHkA.exe
  C:\Windows\System\dGlEHkA.exe
  2⤵
  PID:6780
- C:\Windows\System\dkcukRc.exe
  C:\Windows\System\dkcukRc.exe
  2⤵
  PID:6804
- C:\Windows\System\zUKhLbt.exe
  C:\Windows\System\zUKhLbt.exe
  2⤵
  PID:6836
- C:\Windows\System\EEZuCgt.exe
  C:\Windows\System\EEZuCgt.exe
  2⤵
  PID:6856
- C:\Windows\System\hIsATxz.exe
  C:\Windows\System\hIsATxz.exe
  2⤵
  PID:6876
- C:\Windows\System\QzifGDL.exe
  C:\Windows\System\QzifGDL.exe
  2⤵
  PID:6976
- C:\Windows\System\DvyqEmg.exe
  C:\Windows\System\DvyqEmg.exe
  2⤵
  PID:7000
- C:\Windows\System\AFdxryW.exe
  C:\Windows\System\AFdxryW.exe
  2⤵
  PID:7028
- C:\Windows\System\kSrArAu.exe
  C:\Windows\System\kSrArAu.exe
  2⤵
  PID:7044
- C:\Windows\System\wEpSLEP.exe
  C:\Windows\System\wEpSLEP.exe
  2⤵
  PID:7064
- C:\Windows\System\URrlQIB.exe
  C:\Windows\System\URrlQIB.exe
  2⤵
  PID:7088
- C:\Windows\System\HErTPLm.exe
  C:\Windows\System\HErTPLm.exe
  2⤵
  PID:7116
- C:\Windows\System\swhMaDa.exe
  C:\Windows\System\swhMaDa.exe
  2⤵
  PID:7132
- C:\Windows\System\xFiYaYg.exe
  C:\Windows\System\xFiYaYg.exe
  2⤵
  PID:7152
- C:\Windows\System\UQMJmgq.exe
  C:\Windows\System\UQMJmgq.exe
  2⤵
  PID:5688
- C:\Windows\System\HBYVWSx.exe
  C:\Windows\System\HBYVWSx.exe
  2⤵
  PID:6168
- C:\Windows\System\rbkunJp.exe
  C:\Windows\System\rbkunJp.exe
  2⤵
  PID:5480
- C:\Windows\System\vLdqhDZ.exe
  C:\Windows\System\vLdqhDZ.exe
  2⤵
  PID:1704
- C:\Windows\System\XuEDGub.exe
  C:\Windows\System\XuEDGub.exe
  2⤵
  PID:5792
- C:\Windows\System\kRatNwI.exe
  C:\Windows\System\kRatNwI.exe
  2⤵
  PID:5344
- C:\Windows\System\XyeQhRP.exe
  C:\Windows\System\XyeQhRP.exe
  2⤵
  PID:6024
- C:\Windows\System\aawvqdx.exe
  C:\Windows\System\aawvqdx.exe
  2⤵
  PID:6220
- C:\Windows\System\xjJYIGB.exe
  C:\Windows\System\xjJYIGB.exe
  2⤵
  PID:5240
- C:\Windows\System\ckwUZZb.exe
  C:\Windows\System\ckwUZZb.exe
  2⤵
  PID:5868
- C:\Windows\System\OoPSqiN.exe
  C:\Windows\System\OoPSqiN.exe
  2⤵
  PID:6120
- C:\Windows\System\zaykipf.exe
  C:\Windows\System\zaykipf.exe
  2⤵
  PID:6376
- C:\Windows\System\WnkVFct.exe
  C:\Windows\System\WnkVFct.exe
  2⤵
  PID:6412
- C:\Windows\System\nMLjRaN.exe
  C:\Windows\System\nMLjRaN.exe
  2⤵
  PID:6452
- C:\Windows\System\VlBdFQb.exe
  C:\Windows\System\VlBdFQb.exe
  2⤵
  PID:6484
- C:\Windows\System\FGNkmXh.exe
  C:\Windows\System\FGNkmXh.exe
  2⤵
  PID:6564
- C:\Windows\System\jGVpEYg.exe
  C:\Windows\System\jGVpEYg.exe
  2⤵
  PID:6660
- C:\Windows\System\PCPdAbo.exe
  C:\Windows\System\PCPdAbo.exe
  2⤵
  PID:6704
- C:\Windows\System\KwRsXHF.exe
  C:\Windows\System\KwRsXHF.exe
  2⤵
  PID:6736
- C:\Windows\System\tZURUfP.exe
  C:\Windows\System\tZURUfP.exe
  2⤵
  PID:6788
- C:\Windows\System\ulZYdGw.exe
  C:\Windows\System\ulZYdGw.exe
  2⤵
  PID:6844
- C:\Windows\System\rdiFXpy.exe
  C:\Windows\System\rdiFXpy.exe
  2⤵
  PID:6920
- C:\Windows\System\dPVChea.exe
  C:\Windows\System\dPVChea.exe
  2⤵
  PID:7180
- C:\Windows\System\yKkOjmx.exe
  C:\Windows\System\yKkOjmx.exe
  2⤵
  PID:7308
- C:\Windows\System\eJsSWlq.exe
  C:\Windows\System\eJsSWlq.exe
  2⤵
  PID:7332
- C:\Windows\System\syFgJSA.exe
  C:\Windows\System\syFgJSA.exe
  2⤵
  PID:7348
- C:\Windows\System\qYYAOGS.exe
  C:\Windows\System\qYYAOGS.exe
  2⤵
  PID:7372
- C:\Windows\System\Vvzsoel.exe
  C:\Windows\System\Vvzsoel.exe
  2⤵
  PID:7396
- C:\Windows\System\mpEJZTD.exe
  C:\Windows\System\mpEJZTD.exe
  2⤵
  PID:7420
- C:\Windows\System\suVYQsq.exe
  C:\Windows\System\suVYQsq.exe
  2⤵
  PID:7452
- C:\Windows\System\KmWJhMw.exe
  C:\Windows\System\KmWJhMw.exe
  2⤵
  PID:7472
- C:\Windows\System\YlQLaGF.exe
  C:\Windows\System\YlQLaGF.exe
  2⤵
  PID:7492
- C:\Windows\System\XirrSmP.exe
  C:\Windows\System\XirrSmP.exe
  2⤵
  PID:7516
- C:\Windows\System\DgsUnND.exe
  C:\Windows\System\DgsUnND.exe
  2⤵
  PID:7544
- C:\Windows\System\aLeTscB.exe
  C:\Windows\System\aLeTscB.exe
  2⤵
  PID:7620
- C:\Windows\System\lShJnTx.exe
  C:\Windows\System\lShJnTx.exe
  2⤵
  PID:7640
- C:\Windows\System\CxcMAxR.exe
  C:\Windows\System\CxcMAxR.exe
  2⤵
  PID:7660
- C:\Windows\System\PrixVSZ.exe
  C:\Windows\System\PrixVSZ.exe
  2⤵
  PID:7684
- C:\Windows\System\fjkLWmw.exe
  C:\Windows\System\fjkLWmw.exe
  2⤵
  PID:7708
- C:\Windows\System\SxgYdmS.exe
  C:\Windows\System\SxgYdmS.exe
  2⤵
  PID:7724
- C:\Windows\System\oFqHlsr.exe
  C:\Windows\System\oFqHlsr.exe
  2⤵
  PID:7748
- C:\Windows\System\MrWCvCg.exe
  C:\Windows\System\MrWCvCg.exe
  2⤵
  PID:7768
- C:\Windows\System\GyROvzn.exe
  C:\Windows\System\GyROvzn.exe
  2⤵
  PID:7792
- C:\Windows\System\IOlUOHe.exe
  C:\Windows\System\IOlUOHe.exe
  2⤵
  PID:7816
- C:\Windows\System\smqEhlu.exe
  C:\Windows\System\smqEhlu.exe
  2⤵
  PID:7840
- C:\Windows\System\fZbuEBl.exe
  C:\Windows\System\fZbuEBl.exe
  2⤵
  PID:7868
- C:\Windows\System\dJMDSla.exe
  C:\Windows\System\dJMDSla.exe
  2⤵
  PID:7884
- C:\Windows\System\YdrZKEf.exe
  C:\Windows\System\YdrZKEf.exe
  2⤵
  PID:7908
- C:\Windows\System\TMFmsUP.exe
  C:\Windows\System\TMFmsUP.exe
  2⤵
  PID:7932
- C:\Windows\System\aXqPTPP.exe
  C:\Windows\System\aXqPTPP.exe
  2⤵
  PID:7972
- C:\Windows\System\LctjGon.exe
  C:\Windows\System\LctjGon.exe
  2⤵
  PID:7992
- C:\Windows\System\rwSUqli.exe
  C:\Windows\System\rwSUqli.exe
  2⤵
  PID:8024
- C:\Windows\System\ZAfXCEc.exe
  C:\Windows\System\ZAfXCEc.exe
  2⤵
  PID:8040
- C:\Windows\System\kvnlEmy.exe
  C:\Windows\System\kvnlEmy.exe
  2⤵
  PID:8056
- C:\Windows\System\JdkFBfW.exe
  C:\Windows\System\JdkFBfW.exe
  2⤵
  PID:8080
- C:\Windows\System\WZzGShL.exe
  C:\Windows\System\WZzGShL.exe
  2⤵
  PID:8104
- C:\Windows\System\vyTXFtL.exe
  C:\Windows\System\vyTXFtL.exe
  2⤵
  PID:8128
- C:\Windows\System\UBbkRSK.exe
  C:\Windows\System\UBbkRSK.exe
  2⤵
  PID:8152
- C:\Windows\System\FUYElEM.exe
  C:\Windows\System\FUYElEM.exe
  2⤵
  PID:8168
- C:\Windows\System\buzglMv.exe
  C:\Windows\System\buzglMv.exe
  2⤵
  PID:6984
- C:\Windows\System\TeXPENy.exe
  C:\Windows\System\TeXPENy.exe
  2⤵
  PID:7024
- C:\Windows\System\SlykIMR.exe
  C:\Windows\System\SlykIMR.exe
  2⤵
  PID:7080
- C:\Windows\System\JspmcOh.exe
  C:\Windows\System\JspmcOh.exe
  2⤵
  PID:7108
- C:\Windows\System\eNAgwGK.exe
  C:\Windows\System\eNAgwGK.exe
  2⤵
  PID:7160
- C:\Windows\System\HKuKSMz.exe
  C:\Windows\System\HKuKSMz.exe
  2⤵
  PID:5296
- C:\Windows\System\TKZPjMC.exe
  C:\Windows\System\TKZPjMC.exe
  2⤵
  PID:5684
- C:\Windows\System\XDABDwH.exe
  C:\Windows\System\XDABDwH.exe
  2⤵
  PID:2116
- C:\Windows\System\xyWIFjo.exe
  C:\Windows\System\xyWIFjo.exe
  2⤵
  PID:6196
- C:\Windows\System\UQWILuj.exe
  C:\Windows\System\UQWILuj.exe
  2⤵
  PID:448
- C:\Windows\System\VicHDVn.exe
  C:\Windows\System\VicHDVn.exe
  2⤵
  PID:6404
- C:\Windows\System\VQyajMb.exe
  C:\Windows\System\VQyajMb.exe
  2⤵
  PID:3556
- C:\Windows\System\jFXbQdt.exe
  C:\Windows\System\jFXbQdt.exe
  2⤵
  PID:6644
- C:\Windows\System\jtHBdFy.exe
  C:\Windows\System\jtHBdFy.exe
  2⤵
  PID:6800
- C:\Windows\System\HPwHRjH.exe
  C:\Windows\System\HPwHRjH.exe
  2⤵
  PID:7172
- C:\Windows\System\mCIUppW.exe
  C:\Windows\System\mCIUppW.exe
  2⤵
  PID:7484
- C:\Windows\System\vvwbPKw.exe
  C:\Windows\System\vvwbPKw.exe
  2⤵
  PID:7268
- C:\Windows\System\XtQllTt.exe
  C:\Windows\System\XtQllTt.exe
  2⤵
  PID:7672
- C:\Windows\System\mtAOdVc.exe
  C:\Windows\System\mtAOdVc.exe
  2⤵
  PID:7276
- C:\Windows\System\UyhtExx.exe
  C:\Windows\System\UyhtExx.exe
  2⤵
  PID:7316
- C:\Windows\System\ibSHTjI.exe
  C:\Windows\System\ibSHTjI.exe
  2⤵
  PID:7364
- C:\Windows\System\TWXkWWS.exe
  C:\Windows\System\TWXkWWS.exe
  2⤵
  PID:7408
- C:\Windows\System\qIheSLY.exe
  C:\Windows\System\qIheSLY.exe
  2⤵
  PID:7440
- C:\Windows\System\VVDlhMv.exe
  C:\Windows\System\VVDlhMv.exe
  2⤵
  PID:7576
- C:\Windows\System\xmGyhpZ.exe
  C:\Windows\System\xmGyhpZ.exe
  2⤵
  PID:7824
- C:\Windows\System\tnTiabi.exe
  C:\Windows\System\tnTiabi.exe
  2⤵
  PID:7928
- C:\Windows\System\CFUIWyc.exe
  C:\Windows\System\CFUIWyc.exe
  2⤵
  PID:7628
- C:\Windows\System\SyrwBgW.exe
  C:\Windows\System\SyrwBgW.exe
  2⤵
  PID:7716
- C:\Windows\System\Awjftho.exe
  C:\Windows\System\Awjftho.exe
  2⤵
  PID:7892
- C:\Windows\System\XzoldRE.exe
  C:\Windows\System\XzoldRE.exe
  2⤵
  PID:7040
- C:\Windows\System\xEAQUpa.exe
  C:\Windows\System\xEAQUpa.exe
  2⤵
  PID:7788
- C:\Windows\System\DksxhsB.exe
  C:\Windows\System\DksxhsB.exe
  2⤵
  PID:5596
- C:\Windows\System\BfmLMFq.exe
  C:\Windows\System\BfmLMFq.exe
  2⤵
  PID:6468
- C:\Windows\System\fewFsaU.exe
  C:\Windows\System\fewFsaU.exe
  2⤵
  PID:7968
- C:\Windows\System\NJSvUaF.exe
  C:\Windows\System\NJSvUaF.exe
  2⤵
  PID:8032
- C:\Windows\System\tmtaTYD.exe
  C:\Windows\System\tmtaTYD.exe
  2⤵
  PID:8064
- C:\Windows\System\sxdIlbk.exe
  C:\Windows\System\sxdIlbk.exe
  2⤵
  PID:8116
- C:\Windows\System\xBlkypd.exe
  C:\Windows\System\xBlkypd.exe
  2⤵
  PID:8196
- C:\Windows\System\iOohslA.exe
  C:\Windows\System\iOohslA.exe
  2⤵
  PID:8224
- C:\Windows\System\zeMgusu.exe
  C:\Windows\System\zeMgusu.exe
  2⤵
  PID:8256
- C:\Windows\System\amSeDEk.exe
  C:\Windows\System\amSeDEk.exe
  2⤵
  PID:8276
- C:\Windows\System\stDqeRH.exe
  C:\Windows\System\stDqeRH.exe
  2⤵
  PID:8300
- C:\Windows\System\KhDPPsh.exe
  C:\Windows\System\KhDPPsh.exe
  2⤵
  PID:8324
- C:\Windows\System\pSxWuUm.exe
  C:\Windows\System\pSxWuUm.exe
  2⤵
  PID:8340
- C:\Windows\System\xHpaKiy.exe
  C:\Windows\System\xHpaKiy.exe
  2⤵
  PID:8356
- C:\Windows\System\zDuaBLj.exe
  C:\Windows\System\zDuaBLj.exe
  2⤵
  PID:8372
- C:\Windows\System\pgHpcvy.exe
  C:\Windows\System\pgHpcvy.exe
  2⤵
  PID:8396
- C:\Windows\System\qOKrTNi.exe
  C:\Windows\System\qOKrTNi.exe
  2⤵
  PID:8416
- C:\Windows\System\NiEglbR.exe
  C:\Windows\System\NiEglbR.exe
  2⤵
  PID:8472
- C:\Windows\System\MJOLtlu.exe
  C:\Windows\System\MJOLtlu.exe
  2⤵
  PID:8496
- C:\Windows\System\IpKbvsX.exe
  C:\Windows\System\IpKbvsX.exe
  2⤵
  PID:8520
- C:\Windows\System\jGYmcDk.exe
  C:\Windows\System\jGYmcDk.exe
  2⤵
  PID:8556
- C:\Windows\System\FXEgVCk.exe
  C:\Windows\System\FXEgVCk.exe
  2⤵
  PID:8584
- C:\Windows\System\atyBvde.exe
  C:\Windows\System\atyBvde.exe
  2⤵
  PID:8604
- C:\Windows\System\fFzeNkb.exe
  C:\Windows\System\fFzeNkb.exe
  2⤵
  PID:8632
- C:\Windows\System\oYsmmBl.exe
  C:\Windows\System\oYsmmBl.exe
  2⤵
  PID:8656
- C:\Windows\System\CFXImQA.exe
  C:\Windows\System\CFXImQA.exe
  2⤵
  PID:8680
- C:\Windows\System\wBJaItc.exe
  C:\Windows\System\wBJaItc.exe
  2⤵
  PID:8700
- C:\Windows\System\TdyQINt.exe
  C:\Windows\System\TdyQINt.exe
  2⤵
  PID:8728
- C:\Windows\System\bfzTboY.exe
  C:\Windows\System\bfzTboY.exe
  2⤵
  PID:8748
- C:\Windows\System\augEykN.exe
  C:\Windows\System\augEykN.exe
  2⤵
  PID:8764
- C:\Windows\System\KsZwjBE.exe
  C:\Windows\System\KsZwjBE.exe
  2⤵
  PID:8792
- C:\Windows\System\abbtqgn.exe
  C:\Windows\System\abbtqgn.exe
  2⤵
  PID:8816
- C:\Windows\System\miJRdAc.exe
  C:\Windows\System\miJRdAc.exe
  2⤵
  PID:8844
- C:\Windows\System\vcULCjK.exe
  C:\Windows\System\vcULCjK.exe
  2⤵
  PID:8860
- C:\Windows\System\bwqHaJz.exe
  C:\Windows\System\bwqHaJz.exe
  2⤵
  PID:8876
- C:\Windows\System\MLFRvuC.exe
  C:\Windows\System\MLFRvuC.exe
  2⤵
  PID:8896
- C:\Windows\System\LRMWmok.exe
  C:\Windows\System\LRMWmok.exe
  2⤵
  PID:8940
- C:\Windows\System\mSZMcEr.exe
  C:\Windows\System\mSZMcEr.exe
  2⤵
  PID:8956
- C:\Windows\System\RTkeiUZ.exe
  C:\Windows\System\RTkeiUZ.exe
  2⤵
  PID:8988
- C:\Windows\System\obwDPRf.exe
  C:\Windows\System\obwDPRf.exe
  2⤵
  PID:9008
- C:\Windows\System\BWcgrYs.exe
  C:\Windows\System\BWcgrYs.exe
  2⤵
  PID:9032
- C:\Windows\System\kmJsdGv.exe
  C:\Windows\System\kmJsdGv.exe
  2⤵
  PID:9052
- C:\Windows\System\fDhnWNW.exe
  C:\Windows\System\fDhnWNW.exe
  2⤵
  PID:9072
- C:\Windows\System\INlFWxb.exe
  C:\Windows\System\INlFWxb.exe
  2⤵
  PID:9096
- C:\Windows\System\DClRVRA.exe
  C:\Windows\System\DClRVRA.exe
  2⤵
  PID:9120
- C:\Windows\System\Tbizvpg.exe
  C:\Windows\System\Tbizvpg.exe
  2⤵
  PID:9144
- C:\Windows\System\LaNiQcV.exe
  C:\Windows\System\LaNiQcV.exe
  2⤵
  PID:9164
- C:\Windows\System\QOqrokY.exe
  C:\Windows\System\QOqrokY.exe
  2⤵
  PID:9184
- C:\Windows\System\FnyNiKF.exe
  C:\Windows\System\FnyNiKF.exe
  2⤵
  PID:9208
- C:\Windows\System\QCUocFC.exe
  C:\Windows\System\QCUocFC.exe
  2⤵
  PID:7344
- C:\Windows\System\CFjvgwB.exe
  C:\Windows\System\CFjvgwB.exe
  2⤵
  PID:7380
- C:\Windows\System\oUFIaQm.exe
  C:\Windows\System\oUFIaQm.exe
  2⤵
  PID:2308
- C:\Windows\System\JMszLgj.exe
  C:\Windows\System\JMszLgj.exe
  2⤵
  PID:7876
- C:\Windows\System\nOyOCom.exe
  C:\Windows\System\nOyOCom.exe
  2⤵
  PID:6756
- C:\Windows\System\dhEvaZe.exe
  C:\Windows\System\dhEvaZe.exe
  2⤵
  PID:7656
- C:\Windows\System\JqIknpM.exe
  C:\Windows\System\JqIknpM.exe
  2⤵
  PID:8112
- C:\Windows\System\fUZSEtI.exe
  C:\Windows\System\fUZSEtI.exe
  2⤵
  PID:7696
- C:\Windows\System\ufGQWCz.exe
  C:\Windows\System\ufGQWCz.exe
  2⤵
  PID:8364
- C:\Windows\System\ISOnSKb.exe
  C:\Windows\System\ISOnSKb.exe
  2⤵
  PID:8408
- C:\Windows\System\FMbjejd.exe
  C:\Windows\System\FMbjejd.exe
  2⤵
  PID:8176
- C:\Windows\System\QSufsgu.exe
  C:\Windows\System\QSufsgu.exe
  2⤵
  PID:4120
- C:\Windows\System\aUjTdcy.exe
  C:\Windows\System\aUjTdcy.exe
  2⤵
  PID:8088
- C:\Windows\System\nxkMOtg.exe
  C:\Windows\System\nxkMOtg.exe
  2⤵
  PID:6972
- C:\Windows\System\LwVOzSB.exe
  C:\Windows\System\LwVOzSB.exe
  2⤵
  PID:8692
- C:\Windows\System\bupVJfV.exe
  C:\Windows\System\bupVJfV.exe
  2⤵
  PID:8332
- C:\Windows\System\FsQHuzH.exe
  C:\Windows\System\FsQHuzH.exe
  2⤵
  PID:8368
- C:\Windows\System\OxVfiTN.exe
  C:\Windows\System\OxVfiTN.exe
  2⤵
  PID:8744
- C:\Windows\System\cnMhZUJ.exe
  C:\Windows\System\cnMhZUJ.exe
  2⤵
  PID:8852
- C:\Windows\System\NTqgEcO.exe
  C:\Windows\System\NTqgEcO.exe
  2⤵
  PID:1392
- C:\Windows\System\gMTPdXx.exe
  C:\Windows\System\gMTPdXx.exe
  2⤵
  PID:8252
- C:\Windows\System\XbUbjgs.exe
  C:\Windows\System\XbUbjgs.exe
  2⤵
  PID:5080
- C:\Windows\System\mzeAkzZ.exe
  C:\Windows\System\mzeAkzZ.exe
  2⤵
  PID:8668
- C:\Windows\System\zVCgyop.exe
  C:\Windows\System\zVCgyop.exe
  2⤵
  PID:8760
- C:\Windows\System\LbUUKMr.exe
  C:\Windows\System\LbUUKMr.exe
  2⤵
  PID:9112
- C:\Windows\System\XCgCvbF.exe
  C:\Windows\System\XCgCvbF.exe
  2⤵
  PID:9152
- C:\Windows\System\VyRVXYL.exe
  C:\Windows\System\VyRVXYL.exe
  2⤵
  PID:8872
- C:\Windows\System\gPpPNhA.exe
  C:\Windows\System\gPpPNhA.exe
  2⤵
  PID:8488
- C:\Windows\System\KoOQMLX.exe
  C:\Windows\System\KoOQMLX.exe
  2⤵
  PID:8516
- C:\Windows\System\RHygaWW.exe
  C:\Windows\System\RHygaWW.exe
  2⤵
  PID:8576
- C:\Windows\System\WFFzsHd.exe
  C:\Windows\System\WFFzsHd.exe
  2⤵
  PID:8972
- C:\Windows\System\RUYoQMe.exe
  C:\Windows\System\RUYoQMe.exe
  2⤵
  PID:9244
- C:\Windows\System\CPNeDdp.exe
  C:\Windows\System\CPNeDdp.exe
  2⤵
  PID:9260
- C:\Windows\System\VoQoXYW.exe
  C:\Windows\System\VoQoXYW.exe
  2⤵
  PID:9284
- C:\Windows\System\zsdnKQI.exe
  C:\Windows\System\zsdnKQI.exe
  2⤵
  PID:9308
- C:\Windows\System\CgGXOIe.exe
  C:\Windows\System\CgGXOIe.exe
  2⤵
  PID:9332
- C:\Windows\System\KAlPANu.exe
  C:\Windows\System\KAlPANu.exe
  2⤵
  PID:9580
- C:\Windows\System\wpTQcmD.exe
  C:\Windows\System\wpTQcmD.exe
  2⤵
  PID:9604
- C:\Windows\System\ZsyHhwH.exe
  C:\Windows\System\ZsyHhwH.exe
  2⤵
  PID:9624
- C:\Windows\System\jzNkwzJ.exe
  C:\Windows\System\jzNkwzJ.exe
  2⤵
  PID:9648
- C:\Windows\System\ivKxKii.exe
  C:\Windows\System\ivKxKii.exe
  2⤵
  PID:9672
- C:\Windows\System\hjibOYw.exe
  C:\Windows\System\hjibOYw.exe
  2⤵
  PID:9688
- C:\Windows\System\IhcOpgn.exe
  C:\Windows\System\IhcOpgn.exe
  2⤵
  PID:9716
- C:\Windows\System\JhELkXO.exe
  C:\Windows\System\JhELkXO.exe
  2⤵
  PID:9748
- C:\Windows\System\JZWacYx.exe
  C:\Windows\System\JZWacYx.exe
  2⤵
  PID:9772
- C:\Windows\System\EZbAKRL.exe
  C:\Windows\System\EZbAKRL.exe
  2⤵
  PID:9792
- C:\Windows\System\AEWHLlI.exe
  C:\Windows\System\AEWHLlI.exe
  2⤵
  PID:9812
- C:\Windows\System\llWJlde.exe
  C:\Windows\System\llWJlde.exe
  2⤵
  PID:9836
- C:\Windows\System\jnDUOkR.exe
  C:\Windows\System\jnDUOkR.exe
  2⤵
  PID:9872
- C:\Windows\System\AXGUXPo.exe
  C:\Windows\System\AXGUXPo.exe
  2⤵
  PID:9892
- C:\Windows\System\mpVlaJh.exe
  C:\Windows\System\mpVlaJh.exe
  2⤵
  PID:9920
- C:\Windows\System\WyInWEr.exe
  C:\Windows\System\WyInWEr.exe
  2⤵
  PID:9960
- C:\Windows\System\dzrgNPh.exe
  C:\Windows\System\dzrgNPh.exe
  2⤵
  PID:9976
- C:\Windows\System\OqDNUiW.exe
  C:\Windows\System\OqDNUiW.exe
  2⤵
  PID:9996
- C:\Windows\System\LVOoGMc.exe
  C:\Windows\System\LVOoGMc.exe
  2⤵
  PID:10024
- C:\Windows\System\vHwaxRm.exe
  C:\Windows\System\vHwaxRm.exe
  2⤵
  PID:10056
- C:\Windows\System\sbayYji.exe
  C:\Windows\System\sbayYji.exe
  2⤵
  PID:10084
- C:\Windows\System\GbrrFHa.exe
  C:\Windows\System\GbrrFHa.exe
  2⤵
  PID:9340
- C:\Windows\System\THSauzS.exe
  C:\Windows\System\THSauzS.exe
  2⤵
  PID:8740
- C:\Windows\System\PJZeqqM.exe
  C:\Windows\System\PJZeqqM.exe
  2⤵
  PID:9140
- C:\Windows\System\ijRDrOU.exe
  C:\Windows\System\ijRDrOU.exe
  2⤵
  PID:6580
- C:\Windows\System\zpfqTrT.exe
  C:\Windows\System\zpfqTrT.exe
  2⤵
  PID:8512
- C:\Windows\System\qOKJaAZ.exe
  C:\Windows\System\qOKJaAZ.exe
  2⤵
  PID:4592
- C:\Windows\System\QiMaEHT.exe
  C:\Windows\System\QiMaEHT.exe
  2⤵
  PID:4940
- C:\Windows\System\rZfOcDD.exe
  C:\Windows\System\rZfOcDD.exe
  2⤵
  PID:3580
- C:\Windows\System\ZgoquIh.exe
  C:\Windows\System\ZgoquIh.exe
  2⤵
  PID:1240
- C:\Windows\System\dyreHQW.exe
  C:\Windows\System\dyreHQW.exe
  2⤵
  PID:4500
- C:\Windows\System\CPlrsON.exe
  C:\Windows\System\CPlrsON.exe
  2⤵
  PID:8648
- C:\Windows\System\WIjYzJB.exe
  C:\Windows\System\WIjYzJB.exe
  2⤵
  PID:9128
- C:\Windows\System\zOVWjEI.exe
  C:\Windows\System\zOVWjEI.exe
  2⤵
  PID:4652
- C:\Windows\System\ONmYXqU.exe
  C:\Windows\System\ONmYXqU.exe
  2⤵
  PID:10092
- C:\Windows\System\lPjKEzj.exe
  C:\Windows\System\lPjKEzj.exe
  2⤵
  PID:9324
- C:\Windows\System\txjIlVd.exe
  C:\Windows\System\txjIlVd.exe
  2⤵
  PID:9588
- C:\Windows\System\VOEZAEN.exe
  C:\Windows\System\VOEZAEN.exe
  2⤵
  PID:9388
- C:\Windows\System\eWNJDIH.exe
  C:\Windows\System\eWNJDIH.exe
  2⤵
  PID:9416
- C:\Windows\System\rHsXLOL.exe
  C:\Windows\System\rHsXLOL.exe
  2⤵
  PID:9788
- C:\Windows\System\fieCJkN.exe
  C:\Windows\System\fieCJkN.exe
  2⤵
  PID:9932
- C:\Windows\System\rtwGcau.exe
  C:\Windows\System\rtwGcau.exe
  2⤵
  PID:1708
- C:\Windows\System\CYVtpDc.exe
  C:\Windows\System\CYVtpDc.exe
  2⤵
  PID:9620
- C:\Windows\System\mTiFGWQ.exe
  C:\Windows\System\mTiFGWQ.exe
  2⤵
  PID:9684
- C:\Windows\System\mVYxwYR.exe
  C:\Windows\System\mVYxwYR.exe
  2⤵
  PID:9712
- C:\Windows\System\OkdbmeK.exe
  C:\Windows\System\OkdbmeK.exe
  2⤵
  PID:10216
- C:\Windows\System\HMtfHvX.exe
  C:\Windows\System\HMtfHvX.exe
  2⤵
  PID:9852
- C:\Windows\System\fxOIIFN.exe
  C:\Windows\System\fxOIIFN.exe
  2⤵
  PID:2852
- C:\Windows\System\qylbqFl.exe
  C:\Windows\System\qylbqFl.exe
  2⤵
  PID:1484
- C:\Windows\System\PYqjlbS.exe
  C:\Windows\System\PYqjlbS.exe
  2⤵
  PID:8640
- C:\Windows\System\fGTIzsH.exe
  C:\Windows\System\fGTIzsH.exe
  2⤵
  PID:10196
- C:\Windows\System\yFYsmVL.exe
  C:\Windows\System\yFYsmVL.exe
  2⤵
  PID:9048
- C:\Windows\System\qYMBJTK.exe
  C:\Windows\System\qYMBJTK.exe
  2⤵
  PID:7744
- C:\Windows\System\wMzHoIj.exe
  C:\Windows\System\wMzHoIj.exe
  2⤵
  PID:10052
- C:\Windows\System\zByFbQf.exe
  C:\Windows\System\zByFbQf.exe
  2⤵
  PID:1356
- C:\Windows\System\FwyNYkf.exe
  C:\Windows\System\FwyNYkf.exe
  2⤵
  PID:9136
- C:\Windows\System\nrcqywT.exe
  C:\Windows\System\nrcqywT.exe
  2⤵
  PID:7328
- C:\Windows\System\CSSeEeS.exe
  C:\Windows\System\CSSeEeS.exe
  2⤵
  PID:8352
- C:\Windows\System\ociNoic.exe
  C:\Windows\System\ociNoic.exe
  2⤵
  PID:9656
- C:\Windows\System\PpudKzg.exe
  C:\Windows\System\PpudKzg.exe
  2⤵
  PID:8888
- C:\Windows\System\JgBBlHc.exe
  C:\Windows\System\JgBBlHc.exe
  2⤵
  PID:8784
- C:\Windows\System\vwkGhFS.exe
  C:\Windows\System\vwkGhFS.exe
  2⤵
  PID:8564
- C:\Windows\System\GVFiaID.exe
  C:\Windows\System\GVFiaID.exe
  2⤵
  PID:1168
- C:\Windows\System\lzumPLM.exe
  C:\Windows\System\lzumPLM.exe
  2⤵
  PID:10260
- C:\Windows\System\VHGdhpr.exe
  C:\Windows\System\VHGdhpr.exe
  2⤵
  PID:10284
- C:\Windows\System\iLtGxoi.exe
  C:\Windows\System\iLtGxoi.exe
  2⤵
  PID:10304
- C:\Windows\System\ZrbyNij.exe
  C:\Windows\System\ZrbyNij.exe
  2⤵
  PID:10328
- C:\Windows\System\CMpSTxf.exe
  C:\Windows\System\CMpSTxf.exe
  2⤵
  PID:10352
- C:\Windows\System\LRrctSE.exe
  C:\Windows\System\LRrctSE.exe
  2⤵
  PID:10372
- C:\Windows\System\uFkaipA.exe
  C:\Windows\System\uFkaipA.exe
  2⤵
  PID:10392
- C:\Windows\System\VAjsmAu.exe
  C:\Windows\System\VAjsmAu.exe
  2⤵
  PID:10412
- C:\Windows\System\lcfMcNB.exe
  C:\Windows\System\lcfMcNB.exe
  2⤵
  PID:10440
- C:\Windows\System\YzbfPsc.exe
  C:\Windows\System\YzbfPsc.exe
  2⤵
  PID:10464
- C:\Windows\System\NxmUXac.exe
  C:\Windows\System\NxmUXac.exe
  2⤵
  PID:10488
- C:\Windows\System\IfKfesd.exe
  C:\Windows\System\IfKfesd.exe
  2⤵
  PID:10508
- C:\Windows\System\UIrMDOq.exe
  C:\Windows\System\UIrMDOq.exe
  2⤵
  PID:10524
- C:\Windows\System\FyYvFIB.exe
  C:\Windows\System\FyYvFIB.exe
  2⤵
  PID:10544
- C:\Windows\System\HuJCYot.exe
  C:\Windows\System\HuJCYot.exe
  2⤵
  PID:10576
- C:\Windows\System\ChEoDAH.exe
  C:\Windows\System\ChEoDAH.exe
  2⤵
  PID:10600
- C:\Windows\System\yYfySfG.exe
  C:\Windows\System\yYfySfG.exe
  2⤵
  PID:10620
- C:\Windows\System\vCizLzV.exe
  C:\Windows\System\vCizLzV.exe
  2⤵
  PID:10640
- C:\Windows\System\WUNwHks.exe
  C:\Windows\System\WUNwHks.exe
  2⤵
  PID:10668
- C:\Windows\System\KMlPlWl.exe
  C:\Windows\System\KMlPlWl.exe
  2⤵
  PID:10692
- C:\Windows\System\kXoQoGD.exe
  C:\Windows\System\kXoQoGD.exe
  2⤵
  PID:10712
- C:\Windows\System\CcKByjd.exe
  C:\Windows\System\CcKByjd.exe
  2⤵
  PID:10736
- C:\Windows\System\DPwNTfq.exe
  C:\Windows\System\DPwNTfq.exe
  2⤵
  PID:10760
- C:\Windows\System\QcgfnFD.exe
  C:\Windows\System\QcgfnFD.exe
  2⤵
  PID:10788
- C:\Windows\System\EQENuEl.exe
  C:\Windows\System\EQENuEl.exe
  2⤵
  PID:10804
- C:\Windows\System\tRRPBEv.exe
  C:\Windows\System\tRRPBEv.exe
  2⤵
  PID:10832
- C:\Windows\System\CMtCgUz.exe
  C:\Windows\System\CMtCgUz.exe
  2⤵
  PID:10856
- C:\Windows\System\dGwsbeG.exe
  C:\Windows\System\dGwsbeG.exe
  2⤵
  PID:10880
- C:\Windows\System\JxaqzYG.exe
  C:\Windows\System\JxaqzYG.exe
  2⤵
  PID:10900
- C:\Windows\System\CVPDDEV.exe
  C:\Windows\System\CVPDDEV.exe
  2⤵
  PID:10920
- C:\Windows\System\OZHjEPd.exe
  C:\Windows\System\OZHjEPd.exe
  2⤵
  PID:10944
- C:\Windows\System\NjAUCAg.exe
  C:\Windows\System\NjAUCAg.exe
  2⤵
  PID:10968
- C:\Windows\System\QiwsxzH.exe
  C:\Windows\System\QiwsxzH.exe
  2⤵
  PID:10988
- C:\Windows\System\JxJaofn.exe
  C:\Windows\System\JxJaofn.exe
  2⤵
  PID:11012
- C:\Windows\System\MlPQRAU.exe
  C:\Windows\System\MlPQRAU.exe
  2⤵
  PID:11032
- C:\Windows\System\YJWhqmk.exe
  C:\Windows\System\YJWhqmk.exe
  2⤵
  PID:11056
- C:\Windows\System\FHdCJdc.exe
  C:\Windows\System\FHdCJdc.exe
  2⤵
  PID:11080
- C:\Windows\System\JbryMvT.exe
  C:\Windows\System\JbryMvT.exe
  2⤵
  PID:11104
- C:\Windows\System\TKbECln.exe
  C:\Windows\System\TKbECln.exe
  2⤵
  PID:11124
- C:\Windows\System\uKAOODg.exe
  C:\Windows\System\uKAOODg.exe
  2⤵
  PID:11144
- C:\Windows\System\PRUalIP.exe
  C:\Windows\System\PRUalIP.exe
  2⤵
  PID:11160
- C:\Windows\System\HcxKPtK.exe
  C:\Windows\System\HcxKPtK.exe
  2⤵
  PID:11176
- C:\Windows\System\tgwcvvq.exe
  C:\Windows\System\tgwcvvq.exe
  2⤵
  PID:11192
- C:\Windows\System\iViCqRT.exe
  C:\Windows\System\iViCqRT.exe
  2⤵
  PID:11212
- C:\Windows\System\kTHkMyJ.exe
  C:\Windows\System\kTHkMyJ.exe
  2⤵
  PID:11228
- C:\Windows\System\JfKBNLi.exe
  C:\Windows\System\JfKBNLi.exe
  2⤵
  PID:11244
- C:\Windows\System\HvelGBQ.exe
  C:\Windows\System\HvelGBQ.exe
  2⤵
  PID:11260
- C:\Windows\System\tvqsqzI.exe
  C:\Windows\System\tvqsqzI.exe
  2⤵
  PID:9304
- C:\Windows\System\GfreAuh.exe
  C:\Windows\System\GfreAuh.exe
  2⤵
  PID:3528
- C:\Windows\System\gbEWRXa.exe
  C:\Windows\System\gbEWRXa.exe
  2⤵
  PID:3960
- C:\Windows\System\HbIKVXJ.exe
  C:\Windows\System\HbIKVXJ.exe
  2⤵
  PID:4540
- C:\Windows\System\BVxulDA.exe
  C:\Windows\System\BVxulDA.exe
  2⤵
  PID:9316
- C:\Windows\System\ZdGYsTW.exe
  C:\Windows\System\ZdGYsTW.exe
  2⤵
  PID:10292
- C:\Windows\System\yhfbeYi.exe
  C:\Windows\System\yhfbeYi.exe
  2⤵
  PID:10324
- C:\Windows\System\ZXomsgl.exe
  C:\Windows\System\ZXomsgl.exe
  2⤵
  PID:10364
- C:\Windows\System\RvMKhgh.exe
  C:\Windows\System\RvMKhgh.exe
  2⤵
  PID:9760
- C:\Windows\System\utysNOV.exe
  C:\Windows\System\utysNOV.exe
  2⤵
  PID:10408
- C:\Windows\System\nBlPqaV.exe
  C:\Windows\System\nBlPqaV.exe
  2⤵
  PID:10500
- C:\Windows\System\ubjEvDh.exe
  C:\Windows\System\ubjEvDh.exe
  2⤵
  PID:10016
- C:\Windows\System\oetdKIP.exe
  C:\Windows\System\oetdKIP.exe
  2⤵
  PID:9832
- C:\Windows\System\EhgFGrl.exe
  C:\Windows\System\EhgFGrl.exe
  2⤵
  PID:7612
- C:\Windows\System\deymRrg.exe
  C:\Windows\System\deymRrg.exe
  2⤵
  PID:10616
- C:\Windows\System\edeqGdK.exe
  C:\Windows\System\edeqGdK.exe
  2⤵
  PID:10656
- C:\Windows\System\ARoWgtU.exe
  C:\Windows\System\ARoWgtU.exe
  2⤵
  PID:10796
- C:\Windows\System\PbgykiS.exe
  C:\Windows\System\PbgykiS.exe
  2⤵
  PID:10436
- C:\Windows\System\zZfXvte.exe
  C:\Windows\System\zZfXvte.exe
  2⤵
  PID:8100
- C:\Windows\System\SsWwMCn.exe
  C:\Windows\System\SsWwMCn.exe
  2⤵
  PID:11052
- C:\Windows\System\BzCusjg.exe
  C:\Windows\System\BzCusjg.exe
  2⤵
  PID:11120
- C:\Windows\System\JElgHwX.exe
  C:\Windows\System\JElgHwX.exe
  2⤵
  PID:11268
- C:\Windows\System\FoycMhz.exe
  C:\Windows\System\FoycMhz.exe
  2⤵
  PID:11292
- C:\Windows\System\xbpWxJI.exe
  C:\Windows\System\xbpWxJI.exe
  2⤵
  PID:11312
- C:\Windows\System\lChNlhQ.exe
  C:\Windows\System\lChNlhQ.exe
  2⤵
  PID:11332
- C:\Windows\System\CYgnoqj.exe
  C:\Windows\System\CYgnoqj.exe
  2⤵
  PID:11352
- C:\Windows\System\lEAFTpM.exe
  C:\Windows\System\lEAFTpM.exe
  2⤵
  PID:11376
- C:\Windows\System\FjEsUEz.exe
  C:\Windows\System\FjEsUEz.exe
  2⤵
  PID:11400
- C:\Windows\System\RSVlkmu.exe
  C:\Windows\System\RSVlkmu.exe
  2⤵
  PID:11420
- C:\Windows\System\mRUoaUc.exe
  C:\Windows\System\mRUoaUc.exe
  2⤵
  PID:11444
- C:\Windows\System\lnPLTKk.exe
  C:\Windows\System\lnPLTKk.exe
  2⤵
  PID:11464
- C:\Windows\System\GapHHAu.exe
  C:\Windows\System\GapHHAu.exe
  2⤵
  PID:11484
- C:\Windows\System\yszDNIq.exe
  C:\Windows\System\yszDNIq.exe
  2⤵
  PID:11512
- C:\Windows\System\zTvHtZl.exe
  C:\Windows\System\zTvHtZl.exe
  2⤵
  PID:11536
- C:\Windows\System\UwMiOMM.exe
  C:\Windows\System\UwMiOMM.exe
  2⤵
  PID:11560
- C:\Windows\System\lFgDDKJ.exe
  C:\Windows\System\lFgDDKJ.exe
  2⤵
  PID:11576
- C:\Windows\System\rHfQDPD.exe
  C:\Windows\System\rHfQDPD.exe
  2⤵
  PID:11596
- C:\Windows\System\cydRBQB.exe
  C:\Windows\System\cydRBQB.exe
  2⤵
  PID:11616
- C:\Windows\System\kSbyyys.exe
  C:\Windows\System\kSbyyys.exe
  2⤵
  PID:11640
- C:\Windows\System\xXmBBKG.exe
  C:\Windows\System\xXmBBKG.exe
  2⤵
  PID:11664
- C:\Windows\System\NvqvVoC.exe
  C:\Windows\System\NvqvVoC.exe
  2⤵
  PID:11680
- C:\Windows\System\PEsuBNR.exe
  C:\Windows\System\PEsuBNR.exe
  2⤵
  PID:11704
- C:\Windows\System\qPAefmQ.exe
  C:\Windows\System\qPAefmQ.exe
  2⤵
  PID:11728
- C:\Windows\System\ssnpqMt.exe
  C:\Windows\System\ssnpqMt.exe
  2⤵
  PID:11756
- C:\Windows\System\JkIRrTn.exe
  C:\Windows\System\JkIRrTn.exe
  2⤵
  PID:11780
- C:\Windows\System\iFALvHY.exe
  C:\Windows\System\iFALvHY.exe
  2⤵
  PID:11804
- C:\Windows\System\KNiglba.exe
  C:\Windows\System\KNiglba.exe
  2⤵
  PID:11832
- C:\Windows\System\gCtCAgd.exe
  C:\Windows\System\gCtCAgd.exe
  2⤵
  PID:11852
- C:\Windows\System\FWpVvNo.exe
  C:\Windows\System\FWpVvNo.exe
  2⤵
  PID:11868
- C:\Windows\System\ACVfEPW.exe
  C:\Windows\System\ACVfEPW.exe
  2⤵
  PID:11884
- C:\Windows\System\zMugeKv.exe
  C:\Windows\System\zMugeKv.exe
  2⤵
  PID:11900
- C:\Windows\System\oUkWxln.exe
  C:\Windows\System\oUkWxln.exe
  2⤵
  PID:11916
- C:\Windows\System\HmFkpQR.exe
  C:\Windows\System\HmFkpQR.exe
  2⤵
  PID:11932
- C:\Windows\System\lXUVMQH.exe
  C:\Windows\System\lXUVMQH.exe
  2⤵
  PID:11948
- C:\Windows\System\dCaRdPq.exe
  C:\Windows\System\dCaRdPq.exe
  2⤵
  PID:11968
- C:\Windows\System\HnVBPtK.exe
  C:\Windows\System\HnVBPtK.exe
  2⤵
  PID:11992
- C:\Windows\System\aRrYtKq.exe
  C:\Windows\System\aRrYtKq.exe
  2⤵
  PID:12016
- C:\Windows\System\hbPuOEI.exe
  C:\Windows\System\hbPuOEI.exe
  2⤵
  PID:12036
- C:\Windows\System\SgxwFyC.exe
  C:\Windows\System\SgxwFyC.exe
  2⤵
  PID:12056
- C:\Windows\System\rtodzZY.exe
  C:\Windows\System\rtodzZY.exe
  2⤵
  PID:12076
- C:\Windows\System\QSqgWPu.exe
  C:\Windows\System\QSqgWPu.exe
  2⤵
  PID:12096
- C:\Windows\System\ZGQbwCR.exe
  C:\Windows\System\ZGQbwCR.exe
  2⤵
  PID:12116
- C:\Windows\System\MtCKoJk.exe
  C:\Windows\System\MtCKoJk.exe
  2⤵
  PID:12136
- C:\Windows\System\JPWQWGt.exe
  C:\Windows\System\JPWQWGt.exe
  2⤵
  PID:12160
- C:\Windows\System\TRoVXDL.exe
  C:\Windows\System\TRoVXDL.exe
  2⤵
  PID:12180
- C:\Windows\System\CODNyJw.exe
  C:\Windows\System\CODNyJw.exe
  2⤵
  PID:12200
- C:\Windows\System\liSkZZy.exe
  C:\Windows\System\liSkZZy.exe
  2⤵
  PID:12220
- C:\Windows\System\ydDMtcH.exe
  C:\Windows\System\ydDMtcH.exe
  2⤵
  PID:12240
- C:\Windows\System\AEiBGBO.exe
  C:\Windows\System\AEiBGBO.exe
  2⤵
  PID:12256
- C:\Windows\System\arQbTZo.exe
  C:\Windows\System\arQbTZo.exe
  2⤵
  PID:12284
- C:\Windows\System\TkLrjop.exe
  C:\Windows\System\TkLrjop.exe
  2⤵
  PID:11220
- C:\Windows\System\zWsnzCP.exe
  C:\Windows\System\zWsnzCP.exe
  2⤵
  PID:10164
- C:\Windows\System\REKGYZl.exe
  C:\Windows\System\REKGYZl.exe
  2⤵
  PID:10360
- C:\Windows\System\tEcSWbs.exe
  C:\Windows\System\tEcSWbs.exe
  2⤵
  PID:9356
- C:\Windows\System\eKTsrst.exe
  C:\Windows\System\eKTsrst.exe
  2⤵
  PID:10004
- C:\Windows\System\CLHtsgS.exe
  C:\Windows\System\CLHtsgS.exe
  2⤵
  PID:10520
- C:\Windows\System\BOPbooz.exe
  C:\Windows\System\BOPbooz.exe
  2⤵
  PID:2280
- C:\Windows\System\AjyhSgg.exe
  C:\Windows\System\AjyhSgg.exe
  2⤵
  PID:10964
- C:\Windows\System\WRqRVJk.exe
  C:\Windows\System\WRqRVJk.exe
  2⤵
  PID:11208
- C:\Windows\System\fDjwucX.exe
  C:\Windows\System\fDjwucX.exe
  2⤵
  PID:11348
- C:\Windows\System\JAgBnqb.exe
  C:\Windows\System\JAgBnqb.exe
  2⤵
  PID:11460
- C:\Windows\System\RPAYDOd.exe
  C:\Windows\System\RPAYDOd.exe
  2⤵
  PID:11480
- C:\Windows\System\ViYVaGT.exe
  C:\Windows\System\ViYVaGT.exe
  2⤵
  PID:12296
- C:\Windows\System\qgEpUxT.exe
  C:\Windows\System\qgEpUxT.exe
  2⤵
  PID:12312
- C:\Windows\System\PkzkivY.exe
  C:\Windows\System\PkzkivY.exe
  2⤵
  PID:12336
- C:\Windows\System\qXpJYzt.exe
  C:\Windows\System\qXpJYzt.exe
  2⤵
  PID:12352
- C:\Windows\System\ZLHWVrd.exe
  C:\Windows\System\ZLHWVrd.exe
  2⤵
  PID:12380
- C:\Windows\System\BiEsUkg.exe
  C:\Windows\System\BiEsUkg.exe
  2⤵
  PID:12396
- C:\Windows\System\EKQiByz.exe
  C:\Windows\System\EKQiByz.exe
  2⤵
  PID:12412
- C:\Windows\System\cJYsuZO.exe
  C:\Windows\System\cJYsuZO.exe
  2⤵
  PID:12432
- C:\Windows\System\CfqlhvD.exe
  C:\Windows\System\CfqlhvD.exe
  2⤵
  PID:12452
- C:\Windows\System\ofWnfnF.exe
  C:\Windows\System\ofWnfnF.exe
  2⤵
  PID:12472
- C:\Windows\System\XFlAKbA.exe
  C:\Windows\System\XFlAKbA.exe
  2⤵
  PID:12500
- C:\Windows\System\vtdiCbU.exe
  C:\Windows\System\vtdiCbU.exe
  2⤵
  PID:12516
- C:\Windows\System\ZTYNNUA.exe
  C:\Windows\System\ZTYNNUA.exe
  2⤵
  PID:12540
- C:\Windows\System\DfkRyis.exe
  C:\Windows\System\DfkRyis.exe
  2⤵
  PID:12560
- C:\Windows\System\UVbWkhs.exe
  C:\Windows\System\UVbWkhs.exe
  2⤵
  PID:12584
- C:\Windows\System\ZaiVvBV.exe
  C:\Windows\System\ZaiVvBV.exe
  2⤵
  PID:12600
- C:\Windows\System\hUiUSgg.exe
  C:\Windows\System\hUiUSgg.exe
  2⤵
  PID:12620
- C:\Windows\System\MgKSsVM.exe
  C:\Windows\System\MgKSsVM.exe
  2⤵
  PID:12640
- C:\Windows\System\ZHzWLCw.exe
  C:\Windows\System\ZHzWLCw.exe
  2⤵
  PID:12676
- C:\Windows\System\vbdyeXu.exe
  C:\Windows\System\vbdyeXu.exe
  2⤵
  PID:12700
- C:\Windows\System\EBLlfrI.exe
  C:\Windows\System\EBLlfrI.exe
  2⤵
  PID:12724
- C:\Windows\System\wRyaFzH.exe
  C:\Windows\System\wRyaFzH.exe
  2⤵
  PID:12744
- C:\Windows\System\tNvXsLs.exe
  C:\Windows\System\tNvXsLs.exe
  2⤵
  PID:12764
- C:\Windows\System\OkXEvde.exe
  C:\Windows\System\OkXEvde.exe
  2⤵
  PID:12788
- C:\Windows\System\XHsIXZn.exe
  C:\Windows\System\XHsIXZn.exe
  2⤵
  PID:12804
- C:\Windows\System\VAmBVKV.exe
  C:\Windows\System\VAmBVKV.exe
  2⤵
  PID:12820
- C:\Windows\System\WxOwiWZ.exe
  C:\Windows\System\WxOwiWZ.exe
  2⤵
  PID:12836
- C:\Windows\System\dubJNuj.exe
  C:\Windows\System\dubJNuj.exe
  2⤵
  PID:13000
- C:\Windows\System\wjAXgcw.exe
  C:\Windows\System\wjAXgcw.exe
  2⤵
  PID:12216
- C:\Windows\System\hZDuGbD.exe
  C:\Windows\System\hZDuGbD.exe
  2⤵
  PID:13200
- C:\Windows\System\ABvZfIi.exe
  C:\Windows\System\ABvZfIi.exe
  2⤵
  PID:13132
- C:\Windows\System\DvvsZKh.exe
  C:\Windows\System\DvvsZKh.exe
  2⤵
  PID:13068
- C:\Windows\System\dKoEzrt.exe
  C:\Windows\System\dKoEzrt.exe
  2⤵
  PID:13012
- C:\Windows\System\DgGoIKB.exe
  C:\Windows\System\DgGoIKB.exe
  2⤵
  PID:12960
- C:\Windows\System\VnKrgLK.exe
  C:\Windows\System\VnKrgLK.exe
  2⤵
  PID:12760
- C:\Windows\System\lmYOGMA.exe
  C:\Windows\System\lmYOGMA.exe
  2⤵
  PID:12308
- C:\Windows\System\HPkndJx.exe
  C:\Windows\System\HPkndJx.exe
  2⤵
  PID:11396
- C:\Windows\System\clXkSVu.exe
  C:\Windows\System\clXkSVu.exe
  2⤵
  PID:11204
- C:\Windows\System\PlBqNGS.exe
  C:\Windows\System\PlBqNGS.exe
  2⤵
  PID:12048
- C:\Windows\System\sHSwrTs.exe
  C:\Windows\System\sHSwrTs.exe
  2⤵
  PID:11864
- C:\Windows\System\cIaQwNQ.exe
  C:\Windows\System\cIaQwNQ.exe
  2⤵
  PID:11672
- C:\Windows\System\YCBRnsv.exe
  C:\Windows\System\YCBRnsv.exe
  2⤵
  PID:13036
- C:\Windows\System\zePqkWn.exe
  C:\Windows\System\zePqkWn.exe
  2⤵
  PID:13020
- C:\Windows\System\xJgQgzJ.exe
  C:\Windows\System\xJgQgzJ.exe
  2⤵
  PID:13072
- C:\Windows\System\KRbHXSl.exe
  C:\Windows\System\KRbHXSl.exe
  2⤵
  PID:12720
- C:\Windows\System\LCbXuou.exe
  C:\Windows\System\LCbXuou.exe
  2⤵
  PID:12796
- C:\Windows\System\VtaCBYo.exe
  C:\Windows\System\VtaCBYo.exe
  2⤵
  PID:12484
- C:\Windows\System\aJwnsey.exe
  C:\Windows\System\aJwnsey.exe
  2⤵
  PID:12568
- C:\Windows\System\jsHeQnT.exe
  C:\Windows\System\jsHeQnT.exe
  2⤵
  PID:12592
- C:\Windows\System\EEiTAHW.exe
  C:\Windows\System\EEiTAHW.exe
  2⤵
  PID:1820
- C:\Windows\System\wuUrRuY.exe
  C:\Windows\System\wuUrRuY.exe
  2⤵
  PID:13076
- C:\Windows\System\AOikWFk.exe
  C:\Windows\System\AOikWFk.exe
  2⤵
  PID:11172
- C:\Windows\System\cVPTHlt.exe
  C:\Windows\System\cVPTHlt.exe
  2⤵
  PID:13168
- C:\Windows\System\BXoaNHq.exe
  C:\Windows\System\BXoaNHq.exe
  2⤵
  PID:13252
- C:\Windows\System\UIYqgqb.exe
  C:\Windows\System\UIYqgqb.exe
  2⤵
  PID:13296
- C:\Windows\System\AHNcluu.exe
  C:\Windows\System\AHNcluu.exe
  2⤵
  PID:12408
- C:\Windows\System\fclSGtj.exe
  C:\Windows\System\fclSGtj.exe
  2⤵
  PID:11548
- C:\Windows\System\mYZomrx.exe
  C:\Windows\System\mYZomrx.exe
  2⤵
  PID:10404
- C:\Windows\System\ghwWNdo.exe
  C:\Windows\System\ghwWNdo.exe
  2⤵
  PID:5308
- C:\Windows\System\BkrtewE.exe
  C:\Windows\System\BkrtewE.exe
  2⤵
  PID:1244
- C:\Windows\System\bZNGRld.exe
  C:\Windows\System\bZNGRld.exe
  2⤵
  PID:1612
- C:\Windows\System\VuVvrga.exe
  C:\Windows\System\VuVvrga.exe
  2⤵
  PID:10728
- C:\Windows\System\kmYKJzg.exe
  C:\Windows\System\kmYKJzg.exe
  2⤵
  PID:13272
- C:\Windows\System\wDYcmVe.exe
  C:\Windows\System\wDYcmVe.exe
  2⤵
  PID:12072
- C:\Windows\System\fZyqVuN.exe
  C:\Windows\System\fZyqVuN.exe
  2⤵
  PID:10888
- C:\Windows\System\uXEOSQn.exe
  C:\Windows\System\uXEOSQn.exe
  2⤵
  PID:12440
- C:\Windows\System\GBmhYod.exe
  C:\Windows\System\GBmhYod.exe
  2⤵
  PID:12372
- C:\Windows\System\NZGEMeZ.exe
  C:\Windows\System\NZGEMeZ.exe
  2⤵
  PID:12464
- C:\Windows\System\HXLwfMX.exe
  C:\Windows\System\HXLwfMX.exe
  2⤵
  PID:1072
- C:\Windows\System\SyBlpeH.exe
  C:\Windows\System\SyBlpeH.exe
  2⤵
  PID:10612
- C:\Windows\System\TOCgXbI.exe
  C:\Windows\System\TOCgXbI.exe
  2⤵
  PID:10768
- C:\Windows\System\DwDfBVl.exe
  C:\Windows\System\DwDfBVl.exe
  2⤵
  PID:8320
- C:\Windows\System\fOetGnX.exe
  C:\Windows\System\fOetGnX.exe
  2⤵
  PID:11624
- C:\Windows\System\HzliBGp.exe
  C:\Windows\System\HzliBGp.exe
  2⤵
  PID:13228
- C:\Windows\System\ySMhjNW.exe
  C:\Windows\System\ySMhjNW.exe
  2⤵
  PID:12268
- C:\Windows\System\JQhOXaB.exe
  C:\Windows\System\JQhOXaB.exe
  2⤵
  PID:12420
- C:\Windows\System\HaZtvDo.exe
  C:\Windows\System\HaZtvDo.exe
  2⤵
  PID:13124
- C:\Windows\System\FvCJBQc.exe
  C:\Windows\System\FvCJBQc.exe
  2⤵
  PID:10852
- C:\Windows\System\hAoUjSa.exe
  C:\Windows\System\hAoUjSa.exe
  2⤵
  PID:4888
- C:\Windows\System\pMovAsl.exe
  C:\Windows\System\pMovAsl.exe
  2⤵
  PID:396
- C:\Windows\System\DTfsWlX.exe
  C:\Windows\System\DTfsWlX.exe
  2⤵
  PID:3488
- C:\Windows\System\fdHvkOY.exe
  C:\Windows\System\fdHvkOY.exe
  2⤵
  PID:6352
- C:\Windows\System\cXvxRnR.exe
  C:\Windows\System\cXvxRnR.exe
  2⤵
  PID:6348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_khw5ys2h.k0p.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BMZbJCh.exe

Filesize
2.1MB

MD5
329258de8cc59004c1ea5db22db31de3

SHA1
bc8403f704540d8cb07377bf63f69c42b387974f

SHA256
d66054dbe1e2ee2cfc3a67998c0e7c9237d034574e2efa739a0b6f1d2138816b

SHA512
b7356f4cbf22c8ebdc9f42d48b8b04291488020e39b1615a54a085b0d7d17f68f197cffb90c9188e91aefeb0be4a33a5e9a377da23b433d1a172607e97beca29

Download Submit
C:\Windows\System\CsmcwUi.exe

Filesize
2.1MB

MD5
43d840d63507b9e4b6ab255bb581ec81

SHA1
133408c1ab7f91707e10e1c36d0ade22a3795a8f

SHA256
17be7932f9427efa61e80af3f833ab5018f5530bb5ebf0be73dbef9f91d8bf88

SHA512
a741ea03cc94019ca02abc39b9ae399feef93bf03240aed5fb039e32e1891b6601c9c50121956e638026a8565c89e9bcb695fbc8c6f7355249f521f48fef0768

Download Submit
C:\Windows\System\DTJBjFj.exe

Filesize
2.1MB

MD5
ee6cbe819e242b86b94d458e8ec71348

SHA1
1db0dc5a62ba80ef4c0867ea216c550cf5b65bee

SHA256
c54f45f092d42dc54ecfa11adabca463b1db6294f4bee228ea9ad2a2e9a3ca0f

SHA512
7a8cd5a6a57ee6d2a6f30130257d3a66f8fa1ca47df2b21f72c7c95c35110df58bb4b03f54d052b2666a71b7f1f458ff4bac68aac3b2f655b7a3e6c255b42600

Download Submit
C:\Windows\System\GXbZzuZ.exe

Filesize
2.1MB

MD5
59fe20c7dcef52366c43866707a262b1

SHA1
484bd9c728e34af86d8d77f50cbfcff4e3a9feff

SHA256
8b647f713e21d3e3bd232564b8b8c70f5a261eb3f12d6aa7bb137a8f3a4ec139

SHA512
13ee333d3d63afbf3f9f2df6e5ab9ae1a48bfe7108d0755d191de1788f5a6428c0e9c4321297ca56cca2e423fcd5be8006cc715e3731cca15131e83327d3e3e3

Download Submit
C:\Windows\System\GgfgcUa.exe

Filesize
2.1MB

MD5
4cb54352caf183ff8ed65d7c89ab0301

SHA1
0f286380823f6b44fa98d2a24a3cf285e1d8fd81

SHA256
9c24d4991f1033c8352d83cf5228c64e6958032466e86998c980732c076ca5a5

SHA512
0a716155ddbd216f5fa5f088094cf267b52e7396d32a158b194bd3ab9b53e75cf3c2ed55b79b2b35558fc40858fd0fadfcf9702e16bb1ffed3776a369e6e5bd0

Download Submit
C:\Windows\System\GzATtMV.exe

Filesize
2.1MB

MD5
35e81fbf0aaa3145149b3ed396422093

SHA1
acf28587febcfa4bbe6f372eeb456280b11eb7e9

SHA256
e778d2ed6b777e78fe424a3add69e518c7ea740a5c198b1e57e363658e742bab

SHA512
34526a9ffb2e8578a9e0bd38aea98965ccd53d2675d7fea2b4d56c1bab1d6ad3cb04569b8e5fdc9ea5942e76890786a967ace47ebcc1129e7636261d3b03573e

Download Submit
C:\Windows\System\HvNStXG.exe

Filesize
2.1MB

MD5
9ddfe2587de07d749596f78a62a20f46

SHA1
8c03aecb71761914cf77ec2beaef8bb83eead3ae

SHA256
5f0942c073966c49be8f6db31ce50e0150fdb9a3b6829e092685f168b7ad0dcd

SHA512
057ca9841368a11c091145d0802e4af06fbd2b8ad84b4cad72d36b3e74f865a9bc22482e7f5e929b1c6b3fd52f90148319b0f7d54f7d2d9f19a87e9f2be020aa

Download Submit
C:\Windows\System\JUpYGdC.exe

Filesize
2.1MB

MD5
319c3aab65d14095d48ae0b0fd8670ac

SHA1
456317293f5c2ee6d88bce05206c737693524210

SHA256
a224eebe4b702301c246874ed575247ea80b7272a69bf43285eb109ebf32e636

SHA512
458a9150f68c8a360d1a839e1edb1a8d2aaec1258df8c6490ab41a83ea197b7247bca8958e955051358fad57b85f14453965e0091175fbea4522b28a23c76898

Download Submit
C:\Windows\System\LmHzRvF.exe

Filesize
2.1MB

MD5
eb7abc1977e4a8a51d10ad49613e0113

SHA1
e49409607057b49b1a0c229c939a6e2467b243d6

SHA256
86db4c51c880a82770b31c142a3d3e155043d4fd84caa2e3e7bbdd8522c9b54b

SHA512
afd9bccb8a3579af324ca5f1322295a96a4d41225683b4d4afa86f6d016171699e56285428218b58046f46e8285ce80b0af20bbdd83f06ed8b465dd6506050e6

Download Submit
C:\Windows\System\MVQHzdh.exe

Filesize
2.1MB

MD5
3d030f1e0ede688afe45b78a6503d5ee

SHA1
f5e22c1d59e94358a9e32ca300a309464f4c89a5

SHA256
feb97a6415eaadfb6a1ed7bca83eacf42469503ad80facc623937a5658356245

SHA512
bb82049130547de4107483d3dc57606b3ae70883ea53eb59d353d9baf6011786b158a91040153428af2dd2123e8f77205ed599491fb181bb114dda6985257478

Download Submit
C:\Windows\System\MXvZcTR.exe

Filesize
2.1MB

MD5
c0b89811895ecfbf6835a50f3fb222ce

SHA1
d339e439c758bf3bd594ffa6988c3eb88743bcfa

SHA256
5238edaa9f64f6d99826a2131fcc33cfa793b060521ff58670593e6642fff3f6

SHA512
96f5ae511f9c2375f99aba269dc9cf26ddc99a7a2aa446bcaf1a1f05faca1f761c2156030021e3110bc666d75849cb399581f50247bde5234b6428f70ec088f4

Download Submit
C:\Windows\System\MapxSTe.exe

Filesize
2.1MB

MD5
28fd26571815fe8f8e130610cacf33ca

SHA1
7e13917d76e5c84db2cd879ec2ec61018643bf83

SHA256
cd55a003040631da32669d5507e4f27d65f8dddb76f8e28f356c2bc78dd3a005

SHA512
a4285831121a55a63288338867a23f04e5d88cd14f1b1db9a4c229e6e69af478c23e40b8a718e2e798d6b39004ef8cd71ad6a4adeec6d500570e2c790fe3ab77

Download Submit
C:\Windows\System\PgujECd.exe

Filesize
2.1MB

MD5
c4f7695d1eed776d05595bed6167d38c

SHA1
f67c3496c5b769feb18f694431ea3c35c15044f0

SHA256
f51ee34965129e253b52394201bdde794527f25733db3222c72e1040c19fac80

SHA512
b04760e85a9c8951b4e2ffca28330c7e570e83d7290bf320ce62d5c5a67922d68fd09f39f8381f4055485fe6fc27eef7d7c40568e2453009c5bc558a4302d6cf

Download Submit
C:\Windows\System\RAhPkhr.exe

Filesize
2.1MB

MD5
9998f0e28c07afd2abb4a243547bfdef

SHA1
5291f5500083c0bf0d92f6dd27a1ac7266c1ef8c

SHA256
19dc83e291ffdffe7c993d2b2a2124cfddab59153f4d2901d56a623bc14eb736

SHA512
9ac79183550ad073a947f68acf5642e6b5fed9a912628fc58a894db2818e84cb0930e446b7fdaf7296ac403caa6f8d82ee0d61d49bfa7fbdda5dca9d1d0e43fb

Download Submit
C:\Windows\System\RXPPbjl.exe

Filesize
2.1MB

MD5
e3e075c53c76f8c8ea8b0a2a9eeb79d9

SHA1
e0f50aaae37ed67577258e00ce04d52af8ed4030

SHA256
12dab4492a7cfbece475b90f08f1cbf06435cc55fabe4ee809eb891e672caf04

SHA512
8245ab3b57371dd3ad00e1354d82fac49db0c393b6977379d4544ed166949ff4e6ebfb736a8194930e92ff691d6bfe3998d8b4b25cfacc3a9ee00750aebc4925

Download Submit
C:\Windows\System\SASFQeK.exe

Filesize
2.1MB

MD5
bd203637a26dac7490feb2588fba1292

SHA1
b507f2c52533c0a3fd061a75c125cae7d27a29b9

SHA256
10db48ed98ba5a766877830187ba9d9e3033883e0c35b96fd070f54461e4d1d8

SHA512
699ab73b6ee82ec52c6c10ef749a2278653024fc87bf34776e4c65e7d9f068c8a971a166f5a012550ce0462eed58ede2417cbc4f15629fdecf0490ab6f32d3c6

Download Submit
C:\Windows\System\ShEPcbB.exe

Filesize
2.1MB

MD5
f262420b6a770f7a2ed6514d523c652c

SHA1
29517518d3fd4132fca6f82fe757223e504ef45a

SHA256
199085f9080b457f8e255a09b04e1a37cd5c19c512496d172f8b99f9ecd541e9

SHA512
99f5c099e2bbed428eeef0385cf1d961d61a2f482beee4363215a2ea1bf89b1798374285ce0a848b0cd4b3baa3d1a53df0d26b9a51e363b16409ec0071c6d8ea

Download Submit
C:\Windows\System\TIYiVRc.exe

Filesize
2.1MB

MD5
97e261c93cc60550bdd07c3df4e5abd8

SHA1
24980022ecd0d700ea47f02c6f5cb5650a74ae70

SHA256
1be6009d6a7a878d38aed46910bc9b8d9badc30aec9948ccd75a83f9aa1be2a1

SHA512
f83e3b02d97378b1f05fbef940a8cecb5c7767bd4980dbbe4a971e58a584231c82a0631a9c8685fa3c53e5712f99fc3292acfae7aa9faf23e7ff30209abf59bc

Download Submit
C:\Windows\System\TxPTwjI.exe

Filesize
8B

MD5
97ae678ab7a260144a6894d393aafc50

SHA1
bc2c100088193fd6d6519af2aead383990fb72cf

SHA256
157f7cbc92b928f4bda1044305768cc6fc9c7f0e0535195612cf8b17779de690

SHA512
92b787fc4e284e25abaf0cb6a78f97b8bd4233f4ca8f28338ffb1616a783b28fce1a37cc2e57f0392b8d6c48c846b2d035be7faeaac1f98ff8804a60b6f14b4b

Download Submit
C:\Windows\System\VwLrFkt.exe

Filesize
2.1MB

MD5
23e889f25f590194a6b4c1775b1d67eb

SHA1
9287e276f8a3e21d0c2f73984c3a5e6e85c0f90f

SHA256
1f09cd4d8526eee2e49d078e70f5bc28d70647c3b5d9cab4a4927288d48c4554

SHA512
ba5576bcf0608bd1b4354de5f9fcd7b4bb837a7f83ef303e64f671373c1c4b6fa9c984e37ac0233d71cac2989163c36d987a38efe5449a5951457102813288fe

Download Submit
C:\Windows\System\WQjaJuj.exe

Filesize
2.1MB

MD5
b30a87b4110caa5a45158188249037a2

SHA1
583ac3f46144d98facc711720d6ccf1e97c6bc8d

SHA256
473d3049eb77b58e8fcfb95041fcafe0ca613e833e9c13dcbaad43b476dcd7a4

SHA512
fdda5984439bb40a1864cf7813e28985d07c3250507ebefc62cfa33aba657c42ec5a105594a085a955757d989fe9fe47f12c459d23a7b6ec6feff95e90e39184

Download Submit
C:\Windows\System\XnNwusA.exe

Filesize
2.1MB

MD5
bd71268275e4b1443f0020b5fdc20d5b

SHA1
0b47d927be8bc5ef019585e4f87b195978c6f050

SHA256
eefca824ef5bf3e6720b8c3e7dfc19e95e70c16f507e34c62e67c2e59ac12e2c

SHA512
2915c7bda484cc2d05143c531ecff30256e79a0e3558c471afb30265a03e8ed38e4bd5e1f4004fb793612a7cebfa1e3868347a972fb4a3d22c9a818bff018f25

Download Submit
C:\Windows\System\ZkZTKXM.exe

Filesize
2.1MB

MD5
248d85116ada00924487a99dc9ee5df5

SHA1
c9d3dcb6c08d0f5147fed0af87b8dbb9968f6c4c

SHA256
d6edbe8ddf04444c88006eace65f240710b9309bab85ce49954ee7022b07fbe5

SHA512
9515572ec49cec706eccf43a0cc17eba4f4ddf454527298913af766fa8f04d68c11006549190d63d95e8a9c54233bd140e8476364d7a8a4ebeb4ac0dd1a4939c

Download Submit
C:\Windows\System\adsyDSN.exe

Filesize
2.1MB

MD5
575abbbd2de3a40a43c511f9eff6fea1

SHA1
4515d0f896ef18e07de9c4b4ed2f9cf8a00c9227

SHA256
981d5af6f4e0457e4506f5cc9173ae2939b4277eba0b999736ee69658e6306bd

SHA512
3c85aeb58e65a7e78515ea35960968108b2cf895e51ba9eef3ef743040a598c0f5b08eee693830d7d84397435cd9a8a01bed2edc91810d2b7fb8a5cc7fc6a18d

Download Submit
C:\Windows\System\cIGqlGj.exe

Filesize
2.1MB

MD5
f5988c73cefd97347c00c208d275401f

SHA1
a5807f73845fdbf9a0a9ee49f41b792e141da205

SHA256
dc10d36751c41ba2959b77deddcbabaf095bac9d8a54ae5042277078be7435d3

SHA512
0b3ea8cb9d94ebea170a14ce841081633d997fc1e2f961e8f3b1b4fc33599db22e44e2267ee0c052eb2c35dc5895c3a0fcee4b27659c56bfb77963d2c096f1f9

Download Submit
C:\Windows\System\cdYOVhA.exe

Filesize
2.1MB

MD5
74b46690452593467e8770e75ecb30dd

SHA1
de3bd6d58c3c3c85a4635310d732a64313532d4b

SHA256
c68bce5289704d0213b4377cee52339eab9489e2c78593630ed0f74fb88c1c3c

SHA512
843b13bc345abeed2980d46a23d6d1bad50beb1026b069c5fbeb3e205e6bd58260eb0f81725dc7a3aea8ad17f4851eeb614f16526c502e6ad0b3ade02d3ddba0

Download Submit
C:\Windows\System\dxxTuTh.exe

Filesize
2.1MB

MD5
8d654172b487dd5ec217fa096ca77185

SHA1
38034289d561bb4d7ef08c084b77ed09d20eaeb3

SHA256
90c40984c04433b44017486f72c29b710c08db5572498d1349152c6b8a9f1250

SHA512
a475c86488d7186022afb3eda5b4dc40b18c56c73542ebeda05ac59d3dfbfe866211f437a414aca07ef0c93e6cb389f8fa9bd2937605c62a9140033da3d4750e

Download Submit
C:\Windows\System\eDurdPG.exe

Filesize
2.1MB

MD5
e13c0049ed1a4fa7b500f4ced81e9e0d

SHA1
ebfe3a67f648c2ad58c3f5823add6f4ca894a098

SHA256
aa8c0a0b24a6399b20a920d401f7293a77303311ebf8aa15067cca573c70d466

SHA512
4a358548b9c9d4db2121fcbd700bf732bd9dab37aadbf2ae70dd78c23e90451e8ca1b1315eda8ceb2171acfb55b16ebc460362d9d3fd698a6965ca4a43c6ccd3

Download Submit
C:\Windows\System\iExIiuY.exe

Filesize
2.1MB

MD5
8f0db23b8e11b169818b1955ff1ecc2a

SHA1
ed19dafeea74a9e104421678033685a3b80b4d28

SHA256
06f7e187d64b26f7bf258f4848569eacf5e497ef5a07879eadd74c242a629060

SHA512
565055654866f657bcecc758f135df57a6e2520ca6281f0658d067b4ceba556819eb4a6417a8f427488a38520ce3490fb4757a0a901595671846eec2313c4fb8

Download Submit
C:\Windows\System\jnhNQTa.exe

Filesize
2.1MB

MD5
1378d5f00402be8cb30a84a92c7e7933

SHA1
241e8ec11914862f5c1b4815a9b7c9d265000917

SHA256
b27141571ca81d5cb88cc0207aa787ad01127cdaa9a9d115d0a02cf713f743b0

SHA512
54586444ce88c91c689ee7ec56458df4e8d8ad94f371b0112034860528d3f14674cffa46c383860bb82d7e8bb04a814ecaba6cf88d013ba02bc6ffb00e0692b3

Download Submit
C:\Windows\System\mUpPElK.exe

Filesize
2.1MB

MD5
f2f3ac8960a3b03ac1092d7627018f21

SHA1
c45d92936582ac3de076119a29895ba14c4d4d44

SHA256
0d4727e73513e2206c3b5c9d884afd93d85c66e67aff9f217e6a8bc9c8f667f3

SHA512
74f3702b5625c52bb353c520c6c09d8341f6913780c3b65e6666358196bc4b9b66bc9c03c419c0f5f25ec2d7716d875783fb3a3ffbe54a1c40f09a4fc5a0662c

Download Submit
C:\Windows\System\mvmxoHk.exe

Filesize
2.1MB

MD5
43bc5274bfd2b5c97f1e70e055960470

SHA1
d1867b480010a8c033d437d46b7d24db27de52a1

SHA256
3522d4e0bccada7c07501eebe7a74b31770776765f577a28841cf6f9d73b1631

SHA512
45928fef99ffa75621cc001b13595d6aeb8bd8a7c1b0b1c9e947da61272bb6cbab9f3d9a55b89dd225d9483b83c7a41a2ac5a7ebcc1a4f721e61b516f1449102

Download Submit
C:\Windows\System\nTVvwux.exe

Filesize
2.1MB

MD5
9e0059e8172a4dcc99d0ce31c0a4aa64

SHA1
9b4d97ab4ae8c06f320904177959a8f67f2272e8

SHA256
2c5549a9557c5f5f1713c1ba8f48c9ccefd19f243f934d562a8a9e0e1321ec51

SHA512
161468a5e9b097890cbdfcefee35a2029cf48b2de467ff667ba1d5386af39993cb03124f7bf839781cfe042759e4ac423b6c52d9f0c243cc4e178689bb755e8c

Download Submit
C:\Windows\System\oyVauty.exe

Filesize
2.1MB

MD5
da725afcf7844f29153ef7d232f6bb32

SHA1
b923705f94f37ff20329c500034dbdaa095dc1d2

SHA256
511b18b55161b61dbfcb9c9813784d2b11f685d54306252816695c9d70fd2377

SHA512
0164848504d829f9dcd1b03550b207e0112d93587f2c107e7cd90aacb3e4a0e4e4d79a7680ced775999839e7283a35267654240f41487d761fe9f65c7d9f878b

Download Submit
C:\Windows\System\uSKyzCE.exe

Filesize
2.1MB

MD5
5cb5d61c8526d6fbfc9314b632ac18d4

SHA1
7f3034c08d8b83f1d94d998cd6721c9f9fff7c7c

SHA256
caeec45b64cda813b65b0d565c8096285914ccaf4d0056759655b7c156da822f

SHA512
aff7cbeb7f307ea10fbf113114c39d6506bf0599254decf5c84282fb6fda5ee105a0b1306e6767371bd5de21ecc1a04e659636390086dd72c941ca2ebffbc0c5

Download Submit
C:\Windows\System\vZUlmIX.exe

Filesize
2.1MB

MD5
96ae2478bf7cf896c7c7129827682f3a

SHA1
ed4973050d1388ebf8d1876db832b14cc054de27

SHA256
f48c3c4529b4298fca44a68bb88efb331ee0867f248aba836ec83815d7de8bfb

SHA512
4138b98e5149281bfc83077c0b619dd2b9916a0c3bfd373bf48320ad71a87b3cfdefccbd0aa6d8f6bbeb2cd5a03511cd1852a9578c5fd90f279350f9a9cba543

Download Submit
C:\Windows\System\vgfxurt.exe

Filesize
2.1MB

MD5
904c61f882e8a2f34c9802f15ec076fb

SHA1
f456649028d577d8637c3651db265460edcf717a

SHA256
564c796480c2e46a1161f6b9620082447e2c35fa3b975a41d231f9b61049e3c6

SHA512
9d08edc54722a0d62ccb3110bccfb121ff241ad8689156dd350a05ee8c0db68597733291b3e7b0b937433fb871a89312598dd162d8e3e638abcc85500386998d

Download Submit
C:\Windows\System\xvKTpFF.exe

Filesize
2.1MB

MD5
9a510a904b8f74aae33c32b47e412810

SHA1
821f12a9d91acce85c65b8c370c12d1cfaa985c2

SHA256
f89980e5a2c5dfec8a526a3968b055d3e9cf2f3662a3df758f14781f6f484f21

SHA512
d979888b61e621dbdcb622bab33171072176f08474cde6671aac5d7e4a93d329a251f658098dca8b8e740925c4f10586271a877149b7fdbe9a3c0b57004c6203

Download Submit
C:\Windows\System\yjuPGCV.exe

Filesize
2.1MB

MD5
ac624d3315c55d832598e362b8ad7610

SHA1
1f062fbd43d7eaffbc15b53c5625eeedbcb026f6

SHA256
f1ae474da552d9b49867209ee4b5f42e94d95c3cadba5a601188cab4ec0a7def

SHA512
a46d20e0e8758f0ca9121d3626be14121cf38fd591dbd74eac6f77bf99cd975ddce01c8b8f305ce240e926d7dcfc84aeaaef49660b14bfed516f32c40957b7de

Download Submit
memory/400-412-0x00007FF785780000-0x00007FF785B72000-memory.dmp

Filesize
3.9MB

Download
memory/400-2885-0x00007FF785780000-0x00007FF785B72000-memory.dmp

Filesize
3.9MB

Download
memory/412-2808-0x00007FF7036A0000-0x00007FF703A92000-memory.dmp

Filesize
3.9MB

Download
memory/412-306-0x00007FF7036A0000-0x00007FF703A92000-memory.dmp

Filesize
3.9MB

Download
memory/440-328-0x00007FF6B7FD0000-0x00007FF6B83C2000-memory.dmp

Filesize
3.9MB

Download
memory/440-2824-0x00007FF6B7FD0000-0x00007FF6B83C2000-memory.dmp

Filesize
3.9MB

Download
memory/560-307-0x00007FF695EC0000-0x00007FF6962B2000-memory.dmp

Filesize
3.9MB

Download
memory/560-2815-0x00007FF695EC0000-0x00007FF6962B2000-memory.dmp

Filesize
3.9MB

Download
memory/720-2823-0x00007FF7EFBB0000-0x00007FF7EFFA2000-memory.dmp

Filesize
3.9MB

Download
memory/720-266-0x00007FF7EFBB0000-0x00007FF7EFFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1060-2817-0x00007FF6890C0000-0x00007FF6894B2000-memory.dmp

Filesize
3.9MB

Download
memory/1060-231-0x00007FF6890C0000-0x00007FF6894B2000-memory.dmp

Filesize
3.9MB

Download
memory/1152-2820-0x00007FF622CF0000-0x00007FF6230E2000-memory.dmp

Filesize
3.9MB

Download
memory/1152-255-0x00007FF622CF0000-0x00007FF6230E2000-memory.dmp

Filesize
3.9MB

Download
memory/1800-411-0x00007FF644140000-0x00007FF644532000-memory.dmp

Filesize
3.9MB

Download
memory/1800-2874-0x00007FF644140000-0x00007FF644532000-memory.dmp

Filesize
3.9MB

Download
memory/2324-2832-0x00007FF6354F0000-0x00007FF6358E2000-memory.dmp

Filesize
3.9MB

Download
memory/2324-510-0x00007FF6354F0000-0x00007FF6358E2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-2830-0x00007FF720B30000-0x00007FF720F22000-memory.dmp

Filesize
3.9MB

Download
memory/2416-360-0x00007FF720B30000-0x00007FF720F22000-memory.dmp

Filesize
3.9MB

Download
memory/2616-329-0x00007FF7BC710000-0x00007FF7BCB02000-memory.dmp

Filesize
3.9MB

Download
memory/2616-2876-0x00007FF7BC710000-0x00007FF7BCB02000-memory.dmp

Filesize
3.9MB

Download
memory/2620-2826-0x00007FF7A4490000-0x00007FF7A4882000-memory.dmp

Filesize
3.9MB

Download
memory/2620-509-0x00007FF7A4490000-0x00007FF7A4882000-memory.dmp

Filesize
3.9MB

Download
memory/2628-501-0x00007FFF0B580000-0x00007FFF0C041000-memory.dmp

Filesize
10.8MB

Download
memory/2628-155-0x000002A2BF930000-0x000002A2BF952000-memory.dmp

Filesize
136KB

Download
memory/2628-15-0x00007FFF0B583000-0x00007FFF0B585000-memory.dmp

Filesize
8KB

Download
memory/2628-69-0x00007FFF0B580000-0x00007FFF0C041000-memory.dmp

Filesize
10.8MB

Download
memory/2760-2869-0x00007FF6A7A10000-0x00007FF6A7E02000-memory.dmp

Filesize
3.9MB

Download
memory/2760-428-0x00007FF6A7A10000-0x00007FF6A7E02000-memory.dmp

Filesize
3.9MB

Download
memory/3124-2800-0x00007FF7D60B0000-0x00007FF7D64A2000-memory.dmp

Filesize
3.9MB

Download
memory/3124-507-0x00007FF7D60B0000-0x00007FF7D64A2000-memory.dmp

Filesize
3.9MB

Download
memory/3300-114-0x00007FF7A6820000-0x00007FF7A6C12000-memory.dmp

Filesize
3.9MB

Download
memory/3300-2804-0x00007FF7A6820000-0x00007FF7A6C12000-memory.dmp

Filesize
3.9MB

Download
memory/3612-14-0x00007FF7294C0000-0x00007FF7298B2000-memory.dmp

Filesize
3.9MB

Download
memory/3612-2794-0x00007FF7294C0000-0x00007FF7298B2000-memory.dmp

Filesize
3.9MB

Download
memory/3612-2796-0x00007FF7294C0000-0x00007FF7298B2000-memory.dmp

Filesize
3.9MB

Download
memory/3704-2798-0x00007FF68B390000-0x00007FF68B782000-memory.dmp

Filesize
3.9MB

Download
memory/3704-91-0x00007FF68B390000-0x00007FF68B782000-memory.dmp

Filesize
3.9MB

Download
memory/3964-189-0x00007FF679080000-0x00007FF679472000-memory.dmp

Filesize
3.9MB

Download
memory/3964-2818-0x00007FF679080000-0x00007FF679472000-memory.dmp

Filesize
3.9MB

Download
memory/4064-2802-0x00007FF644D60000-0x00007FF645152000-memory.dmp

Filesize
3.9MB

Download
memory/4064-143-0x00007FF644D60000-0x00007FF645152000-memory.dmp

Filesize
3.9MB

Download
memory/4476-1-0x000001231F2D0000-0x000001231F2E0000-memory.dmp

Filesize
64KB

Download
memory/4476-0-0x00007FF7982F0000-0x00007FF7986E2000-memory.dmp

Filesize
3.9MB

Download
memory/4672-2812-0x00007FF60A9A0000-0x00007FF60AD92000-memory.dmp

Filesize
3.9MB

Download
memory/4672-182-0x00007FF60A9A0000-0x00007FF60AD92000-memory.dmp

Filesize
3.9MB

Download
memory/4688-2806-0x00007FF7B31C0000-0x00007FF7B35B2000-memory.dmp

Filesize
3.9MB

Download
memory/4688-94-0x00007FF7B31C0000-0x00007FF7B35B2000-memory.dmp

Filesize
3.9MB

Download
memory/4804-2828-0x00007FF628B90000-0x00007FF628F82000-memory.dmp

Filesize
3.9MB

Download
memory/4804-425-0x00007FF628B90000-0x00007FF628F82000-memory.dmp

Filesize
3.9MB

Download
memory/4848-417-0x00007FF634920000-0x00007FF634D12000-memory.dmp

Filesize
3.9MB

Download
memory/4848-2834-0x00007FF634920000-0x00007FF634D12000-memory.dmp

Filesize
3.9MB

Download
memory/4880-2811-0x00007FF72B0F0000-0x00007FF72B4E2000-memory.dmp

Filesize
3.9MB

Download
memory/4880-508-0x00007FF72B0F0000-0x00007FF72B4E2000-memory.dmp

Filesize
3.9MB

Download