xmrig | 52d327361516de408b4e718f310cdf4c17d630ecdcc8e0a36c8c9e95225d5b97

Analysis

max time kernel
94s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
Size

3.1MB
MD5

b7540063d8263886b283dc5074d48280
SHA1

a7df70ecb99d4c098263e22be52e7d6f41afa647
SHA256

52d327361516de408b4e718f310cdf4c17d630ecdcc8e0a36c8c9e95225d5b97
SHA512

c3e93009d07bdfd1f95e348997abd66fdb51ba9c2647be8167ddb9738c05ed5d2d6b35d65ec0b124280a9ff50d9c536140bf9451a3d43ad97124c2e62a43c288
SSDEEP

98304:71ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrWU:7bBeSFkA

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/324-0-0x00007FF704860000-0x00007FF704C56000-memory.dmp	xmrig
behavioral2/files/0x0008000000023584-9.dat	xmrig
behavioral2/files/0x00060000000233cd-10.dat	xmrig
behavioral2/files/0x0007000000023585-8.dat	xmrig
behavioral2/files/0x0007000000023586-45.dat	xmrig
behavioral2/files/0x0007000000023587-44.dat	xmrig
behavioral2/files/0x0007000000023588-43.dat	xmrig
behavioral2/memory/1312-64-0x00007FF7D0CB0000-0x00007FF7D10A6000-memory.dmp	xmrig
behavioral2/files/0x000800000002358a-74.dat	xmrig
behavioral2/memory/2452-77-0x00007FF7CE170000-0x00007FF7CE566000-memory.dmp	xmrig
behavioral2/memory/3844-83-0x00007FF7FE170000-0x00007FF7FE566000-memory.dmp	xmrig
behavioral2/memory/1736-85-0x00007FF657EF0000-0x00007FF6582E6000-memory.dmp	xmrig
behavioral2/memory/3648-87-0x00007FF68AFB0000-0x00007FF68B3A6000-memory.dmp	xmrig
behavioral2/memory/376-86-0x00007FF6213F0000-0x00007FF6217E6000-memory.dmp	xmrig
behavioral2/memory/2120-84-0x00007FF757000000-0x00007FF7573F6000-memory.dmp	xmrig
behavioral2/memory/3048-82-0x00007FF6EE8E0000-0x00007FF6EECD6000-memory.dmp	xmrig
behavioral2/memory/1068-81-0x00007FF67DCA0000-0x00007FF67E096000-memory.dmp	xmrig
behavioral2/files/0x000800000002358b-76.dat	xmrig
behavioral2/memory/2172-75-0x00007FF6E26B0000-0x00007FF6E2AA6000-memory.dmp	xmrig
behavioral2/files/0x000700000002358e-70.dat	xmrig
behavioral2/files/0x0007000000023589-68.dat	xmrig
behavioral2/files/0x000700000002358d-66.dat	xmrig
behavioral2/files/0x000700000002358c-59.dat	xmrig
behavioral2/memory/4036-56-0x00007FF7A8360000-0x00007FF7A8756000-memory.dmp	xmrig
behavioral2/memory/2768-50-0x00007FF73EA10000-0x00007FF73EE06000-memory.dmp	xmrig
behavioral2/files/0x000700000002358f-90.dat	xmrig
behavioral2/files/0x0007000000023590-97.dat	xmrig
behavioral2/memory/380-108-0x00007FF7199A0000-0x00007FF719D96000-memory.dmp	xmrig
behavioral2/memory/1584-107-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023593-118.dat	xmrig
behavioral2/files/0x0007000000023595-126.dat	xmrig
behavioral2/files/0x0007000000023592-125.dat	xmrig
behavioral2/files/0x0007000000023596-137.dat	xmrig
behavioral2/memory/2756-140-0x00007FF65DA00000-0x00007FF65DDF6000-memory.dmp	xmrig
behavioral2/memory/1784-142-0x00007FF773880000-0x00007FF773C76000-memory.dmp	xmrig
behavioral2/memory/5084-145-0x00007FF787820000-0x00007FF787C16000-memory.dmp	xmrig
behavioral2/memory/3920-149-0x00007FF60BEF0000-0x00007FF60C2E6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023597-146.dat	xmrig
behavioral2/memory/4980-143-0x00007FF6B9A00000-0x00007FF6B9DF6000-memory.dmp	xmrig
behavioral2/memory/4108-134-0x00007FF7A6980000-0x00007FF7A6D76000-memory.dmp	xmrig
behavioral2/memory/536-131-0x00007FF7EE890000-0x00007FF7EEC86000-memory.dmp	xmrig
behavioral2/files/0x0007000000023594-127.dat	xmrig
behavioral2/memory/3976-122-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023591-113.dat	xmrig
behavioral2/files/0x0008000000023582-109.dat	xmrig
behavioral2/memory/3152-175-0x00007FF6009A0000-0x00007FF600D96000-memory.dmp	xmrig
behavioral2/files/0x000700000002359e-182.dat	xmrig
behavioral2/files/0x00070000000235a1-186.dat	xmrig
behavioral2/memory/1888-185-0x00007FF74EF60000-0x00007FF74F356000-memory.dmp	xmrig
behavioral2/files/0x000700000002359c-174.dat	xmrig
behavioral2/files/0x0007000000023598-166.dat	xmrig
behavioral2/files/0x00070000000235a3-254.dat	xmrig
behavioral2/files/0x00070000000235b7-264.dat	xmrig
behavioral2/files/0x00070000000235bb-275.dat	xmrig
behavioral2/files/0x00070000000235ba-279.dat	xmrig
behavioral2/files/0x00070000000235be-289.dat	xmrig
behavioral2/files/0x00070000000235bf-362.dat	xmrig
behavioral2/files/0x00070000000235d9-368.dat	xmrig
behavioral2/memory/324-1280-0x00007FF704860000-0x00007FF704C56000-memory.dmp	xmrig
behavioral2/memory/1584-1889-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp	xmrig
behavioral2/memory/3976-1892-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp	xmrig
behavioral2/memory/3844-3029-0x00007FF7FE170000-0x00007FF7FE566000-memory.dmp	xmrig
behavioral2/memory/2768-3030-0x00007FF73EA10000-0x00007FF73EE06000-memory.dmp	xmrig
behavioral2/memory/4036-3031-0x00007FF7A8360000-0x00007FF7A8756000-memory.dmp	xmrig

Blocklisted process makes network request 10 IoCs

flow	pid	Process
3	2704	powershell.exe
5	2704	powershell.exe
10	2704	powershell.exe
11	2704	powershell.exe
13	2704	powershell.exe
14	2704	powershell.exe
16	2704	powershell.exe
19	2704	powershell.exe
20	2704	powershell.exe
21	2704	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2704	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3844	YjMtENW.exe
2768	zSsHzvQ.exe
4036	PmItEyT.exe
2120	dmrdDMV.exe
1312	ErkRUbo.exe
2172	uAwmGQY.exe
1736	XbPqoiz.exe
2452	nFiXhvk.exe
1068	WEMuUez.exe
376	uiPPDnf.exe
3048	sYUwWjg.exe
3648	wKTLUim.exe
1584	yBGpwuM.exe
2756	dnukPFr.exe
380	lvLiWux.exe
3976	ARVhTPF.exe
1784	BqyHbZP.exe
536	thOgqhM.exe
4108	bmZmvMH.exe
4980	LYXhTmy.exe
5084	OUevYel.exe
3920	KQnvyaO.exe
3152	nAetehb.exe
1888	UOsCHWq.exe
64	vCKvoXl.exe
4340	HqWrntB.exe
1244	mDPDYKq.exe
4120	HypEywS.exe
4580	qdwLNrh.exe
1632	SXcmvRU.exe
416	fXujLXH.exe
1764	oAhWNLK.exe
1708	gnidRGO.exe
5104	ndOFUdW.exe
4220	BVKSTLg.exe
3944	YZYRoBL.exe
3588	HtCttwt.exe
2556	OSEKwks.exe
2812	lSbObVp.exe
1052	dSglmew.exe
2492	hYvtIvN.exe
452	yyErqMa.exe
5024	aGnCXqp.exe
4544	ZdrSJye.exe
1436	TaBuPgS.exe
4548	ISjcVHw.exe
732	OevRSWO.exe
3860	ULlKkRv.exe
3812	dhpVEyL.exe
4932	dhPunmW.exe
2880	CaTTZtx.exe
1624	MFKloet.exe
912	jokfpfE.exe
3364	ipxpQSE.exe
3008	LyxxdVj.exe
1640	FWkUbYg.exe
4408	ykSpURp.exe
4940	JnsKcqH.exe
4152	zeocmAF.exe
2168	KvilCGU.exe
2656	XSOiHZg.exe
4000	jWMDciJ.exe
3288	kIcljvT.exe
4316	PkKPUps.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/324-0-0x00007FF704860000-0x00007FF704C56000-memory.dmp	upx
behavioral2/files/0x0008000000023584-9.dat	upx
behavioral2/files/0x00060000000233cd-10.dat	upx
behavioral2/files/0x0007000000023585-8.dat	upx
behavioral2/files/0x0007000000023586-45.dat	upx
behavioral2/files/0x0007000000023587-44.dat	upx
behavioral2/files/0x0007000000023588-43.dat	upx
behavioral2/memory/1312-64-0x00007FF7D0CB0000-0x00007FF7D10A6000-memory.dmp	upx
behavioral2/files/0x000800000002358a-74.dat	upx
behavioral2/memory/2452-77-0x00007FF7CE170000-0x00007FF7CE566000-memory.dmp	upx
behavioral2/memory/3844-83-0x00007FF7FE170000-0x00007FF7FE566000-memory.dmp	upx
behavioral2/memory/1736-85-0x00007FF657EF0000-0x00007FF6582E6000-memory.dmp	upx
behavioral2/memory/3648-87-0x00007FF68AFB0000-0x00007FF68B3A6000-memory.dmp	upx
behavioral2/memory/376-86-0x00007FF6213F0000-0x00007FF6217E6000-memory.dmp	upx
behavioral2/memory/2120-84-0x00007FF757000000-0x00007FF7573F6000-memory.dmp	upx
behavioral2/memory/3048-82-0x00007FF6EE8E0000-0x00007FF6EECD6000-memory.dmp	upx
behavioral2/memory/1068-81-0x00007FF67DCA0000-0x00007FF67E096000-memory.dmp	upx
behavioral2/files/0x000800000002358b-76.dat	upx
behavioral2/memory/2172-75-0x00007FF6E26B0000-0x00007FF6E2AA6000-memory.dmp	upx
behavioral2/files/0x000700000002358e-70.dat	upx
behavioral2/files/0x0007000000023589-68.dat	upx
behavioral2/files/0x000700000002358d-66.dat	upx
behavioral2/files/0x000700000002358c-59.dat	upx
behavioral2/memory/4036-56-0x00007FF7A8360000-0x00007FF7A8756000-memory.dmp	upx
behavioral2/memory/2768-50-0x00007FF73EA10000-0x00007FF73EE06000-memory.dmp	upx
behavioral2/files/0x000700000002358f-90.dat	upx
behavioral2/files/0x0007000000023590-97.dat	upx
behavioral2/memory/380-108-0x00007FF7199A0000-0x00007FF719D96000-memory.dmp	upx
behavioral2/memory/1584-107-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp	upx
behavioral2/files/0x0007000000023593-118.dat	upx
behavioral2/files/0x0007000000023595-126.dat	upx
behavioral2/files/0x0007000000023592-125.dat	upx
behavioral2/files/0x0007000000023596-137.dat	upx
behavioral2/memory/2756-140-0x00007FF65DA00000-0x00007FF65DDF6000-memory.dmp	upx
behavioral2/memory/1784-142-0x00007FF773880000-0x00007FF773C76000-memory.dmp	upx
behavioral2/memory/5084-145-0x00007FF787820000-0x00007FF787C16000-memory.dmp	upx
behavioral2/memory/3920-149-0x00007FF60BEF0000-0x00007FF60C2E6000-memory.dmp	upx
behavioral2/files/0x0007000000023597-146.dat	upx
behavioral2/memory/4980-143-0x00007FF6B9A00000-0x00007FF6B9DF6000-memory.dmp	upx
behavioral2/memory/4108-134-0x00007FF7A6980000-0x00007FF7A6D76000-memory.dmp	upx
behavioral2/memory/536-131-0x00007FF7EE890000-0x00007FF7EEC86000-memory.dmp	upx
behavioral2/files/0x0007000000023594-127.dat	upx
behavioral2/memory/3976-122-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp	upx
behavioral2/files/0x0007000000023591-113.dat	upx
behavioral2/files/0x0008000000023582-109.dat	upx
behavioral2/memory/3152-175-0x00007FF6009A0000-0x00007FF600D96000-memory.dmp	upx
behavioral2/files/0x000700000002359e-182.dat	upx
behavioral2/files/0x00070000000235a1-186.dat	upx
behavioral2/memory/1888-185-0x00007FF74EF60000-0x00007FF74F356000-memory.dmp	upx
behavioral2/files/0x000700000002359c-174.dat	upx
behavioral2/files/0x0007000000023598-166.dat	upx
behavioral2/files/0x00070000000235a3-254.dat	upx
behavioral2/files/0x00070000000235b7-264.dat	upx
behavioral2/files/0x00070000000235bb-275.dat	upx
behavioral2/files/0x00070000000235ba-279.dat	upx
behavioral2/files/0x00070000000235be-289.dat	upx
behavioral2/files/0x00070000000235bf-362.dat	upx
behavioral2/files/0x00070000000235d9-368.dat	upx
behavioral2/memory/324-1280-0x00007FF704860000-0x00007FF704C56000-memory.dmp	upx
behavioral2/memory/1584-1889-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp	upx
behavioral2/memory/3976-1892-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp	upx
behavioral2/memory/3844-3029-0x00007FF7FE170000-0x00007FF7FE566000-memory.dmp	upx
behavioral2/memory/2768-3030-0x00007FF73EA10000-0x00007FF73EE06000-memory.dmp	upx
behavioral2/memory/4036-3031-0x00007FF7A8360000-0x00007FF7A8756000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uUfFxFT.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\lzHAXWN.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\UyGlWHM.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\XnKPmgX.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\dZABlKn.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\wtUxNvN.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\ZPHMkUt.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\tdXbkGf.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\uXaTXHJ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\damJlRc.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\IdzCwGM.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\mmlcaLS.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\gYapFoQ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\WICWwuK.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\PmAmQOB.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\hqysmsO.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\IeYUSHH.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\qvDAWVf.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\HsvznJx.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\HIiEMJn.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\ZJOKZli.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\CiBznBb.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\HRbxUvD.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\pJRRncb.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\toLRNgZ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\dBGKCwl.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\bfjKwWz.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\JpWhMzx.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\CiuXHGt.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\tsNqQDd.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\NqOMOFa.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\pdoifWv.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\UrcastJ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\muJrVut.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\OtvXcWP.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\aGreTSm.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\ooSFFJO.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\pdVVJMP.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\NmEcxbp.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\wbBsMUX.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\QnHttiT.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\cpgwKMc.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\dPTfwtE.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\HnZEVIm.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\HZfxGoY.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\nrzhwgC.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\EanLSQJ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\RtwseNt.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\jPWyrUJ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\HzifiNa.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\QGxKvan.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\gBIoKsn.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\aBHcpzJ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\yUGAnmp.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\FyEQLON.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\brxGgfM.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\pnpkxRu.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\vXGVmex.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\gGWZdoJ.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\qtacDKH.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\sRgrrHE.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\dfdttNY.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\NyJUYQV.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
File created	C:\Windows\System\ioozEdc.exe	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2704	powershell.exe
2704	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
Token: SeDebugPrivilege	2704	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 324 wrote to memory of 2704	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	83
PID 324 wrote to memory of 2704	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	83
PID 324 wrote to memory of 3844	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	84
PID 324 wrote to memory of 3844	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	84
PID 324 wrote to memory of 2768	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	85
PID 324 wrote to memory of 2768	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	85
PID 324 wrote to memory of 4036	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	86
PID 324 wrote to memory of 4036	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	86
PID 324 wrote to memory of 1312	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	87
PID 324 wrote to memory of 1312	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	87
PID 324 wrote to memory of 2120	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	88
PID 324 wrote to memory of 2120	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	88
PID 324 wrote to memory of 2172	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	89
PID 324 wrote to memory of 2172	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	89
PID 324 wrote to memory of 2452	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	90
PID 324 wrote to memory of 2452	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	90
PID 324 wrote to memory of 1736	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	91
PID 324 wrote to memory of 1736	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	91
PID 324 wrote to memory of 1068	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	92
PID 324 wrote to memory of 1068	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	92
PID 324 wrote to memory of 376	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	93
PID 324 wrote to memory of 376	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	93
PID 324 wrote to memory of 3048	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	94
PID 324 wrote to memory of 3048	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	94
PID 324 wrote to memory of 3648	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	95
PID 324 wrote to memory of 3648	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	95
PID 324 wrote to memory of 1584	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	96
PID 324 wrote to memory of 1584	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	96
PID 324 wrote to memory of 2756	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	97
PID 324 wrote to memory of 2756	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	97
PID 324 wrote to memory of 380	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	98
PID 324 wrote to memory of 380	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	98
PID 324 wrote to memory of 3976	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	99
PID 324 wrote to memory of 3976	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	99
PID 324 wrote to memory of 1784	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	100
PID 324 wrote to memory of 1784	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	100
PID 324 wrote to memory of 536	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	101
PID 324 wrote to memory of 536	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	101
PID 324 wrote to memory of 4108	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	102
PID 324 wrote to memory of 4108	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	102
PID 324 wrote to memory of 4980	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	103
PID 324 wrote to memory of 4980	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	103
PID 324 wrote to memory of 5084	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	104
PID 324 wrote to memory of 5084	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	104
PID 324 wrote to memory of 3920	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	105
PID 324 wrote to memory of 3920	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	105
PID 324 wrote to memory of 3152	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	106
PID 324 wrote to memory of 3152	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	106
PID 324 wrote to memory of 1888	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	107
PID 324 wrote to memory of 1888	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	107
PID 324 wrote to memory of 64	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	108
PID 324 wrote to memory of 64	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	108
PID 324 wrote to memory of 4340	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	109
PID 324 wrote to memory of 4340	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	109
PID 324 wrote to memory of 1244	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	111
PID 324 wrote to memory of 1244	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	111
PID 324 wrote to memory of 4120	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	113
PID 324 wrote to memory of 4120	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	113
PID 324 wrote to memory of 4580	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	114
PID 324 wrote to memory of 4580	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	114
PID 324 wrote to memory of 1632	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	115
PID 324 wrote to memory of 1632	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	115
PID 324 wrote to memory of 416	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	116
PID 324 wrote to memory of 416	324	b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b7540063d8263886b283dc5074d48280_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2704
- C:\Windows\System\YjMtENW.exe
  C:\Windows\System\YjMtENW.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\zSsHzvQ.exe
  C:\Windows\System\zSsHzvQ.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\PmItEyT.exe
  C:\Windows\System\PmItEyT.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\ErkRUbo.exe
  C:\Windows\System\ErkRUbo.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\dmrdDMV.exe
  C:\Windows\System\dmrdDMV.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\uAwmGQY.exe
  C:\Windows\System\uAwmGQY.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\nFiXhvk.exe
  C:\Windows\System\nFiXhvk.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\XbPqoiz.exe
  C:\Windows\System\XbPqoiz.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\WEMuUez.exe
  C:\Windows\System\WEMuUez.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\uiPPDnf.exe
  C:\Windows\System\uiPPDnf.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\sYUwWjg.exe
  C:\Windows\System\sYUwWjg.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\wKTLUim.exe
  C:\Windows\System\wKTLUim.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\yBGpwuM.exe
  C:\Windows\System\yBGpwuM.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\dnukPFr.exe
  C:\Windows\System\dnukPFr.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\lvLiWux.exe
  C:\Windows\System\lvLiWux.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\ARVhTPF.exe
  C:\Windows\System\ARVhTPF.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\BqyHbZP.exe
  C:\Windows\System\BqyHbZP.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\thOgqhM.exe
  C:\Windows\System\thOgqhM.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\bmZmvMH.exe
  C:\Windows\System\bmZmvMH.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\LYXhTmy.exe
  C:\Windows\System\LYXhTmy.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\OUevYel.exe
  C:\Windows\System\OUevYel.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\KQnvyaO.exe
  C:\Windows\System\KQnvyaO.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\nAetehb.exe
  C:\Windows\System\nAetehb.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\UOsCHWq.exe
  C:\Windows\System\UOsCHWq.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\vCKvoXl.exe
  C:\Windows\System\vCKvoXl.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\HqWrntB.exe
  C:\Windows\System\HqWrntB.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\mDPDYKq.exe
  C:\Windows\System\mDPDYKq.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\HypEywS.exe
  C:\Windows\System\HypEywS.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\qdwLNrh.exe
  C:\Windows\System\qdwLNrh.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\SXcmvRU.exe
  C:\Windows\System\SXcmvRU.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\fXujLXH.exe
  C:\Windows\System\fXujLXH.exe
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Windows\System\oAhWNLK.exe
  C:\Windows\System\oAhWNLK.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\gnidRGO.exe
  C:\Windows\System\gnidRGO.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\ndOFUdW.exe
  C:\Windows\System\ndOFUdW.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\BVKSTLg.exe
  C:\Windows\System\BVKSTLg.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\YZYRoBL.exe
  C:\Windows\System\YZYRoBL.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\HtCttwt.exe
  C:\Windows\System\HtCttwt.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\OSEKwks.exe
  C:\Windows\System\OSEKwks.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\lSbObVp.exe
  C:\Windows\System\lSbObVp.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\dSglmew.exe
  C:\Windows\System\dSglmew.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\hYvtIvN.exe
  C:\Windows\System\hYvtIvN.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\yyErqMa.exe
  C:\Windows\System\yyErqMa.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\aGnCXqp.exe
  C:\Windows\System\aGnCXqp.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\ZdrSJye.exe
  C:\Windows\System\ZdrSJye.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\TaBuPgS.exe
  C:\Windows\System\TaBuPgS.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\ISjcVHw.exe
  C:\Windows\System\ISjcVHw.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\OevRSWO.exe
  C:\Windows\System\OevRSWO.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\ULlKkRv.exe
  C:\Windows\System\ULlKkRv.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\dhpVEyL.exe
  C:\Windows\System\dhpVEyL.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\dhPunmW.exe
  C:\Windows\System\dhPunmW.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\CaTTZtx.exe
  C:\Windows\System\CaTTZtx.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\MFKloet.exe
  C:\Windows\System\MFKloet.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\jokfpfE.exe
  C:\Windows\System\jokfpfE.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\ipxpQSE.exe
  C:\Windows\System\ipxpQSE.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\LyxxdVj.exe
  C:\Windows\System\LyxxdVj.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\FWkUbYg.exe
  C:\Windows\System\FWkUbYg.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\ykSpURp.exe
  C:\Windows\System\ykSpURp.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\JnsKcqH.exe
  C:\Windows\System\JnsKcqH.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\zeocmAF.exe
  C:\Windows\System\zeocmAF.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\KvilCGU.exe
  C:\Windows\System\KvilCGU.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\XSOiHZg.exe
  C:\Windows\System\XSOiHZg.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\jWMDciJ.exe
  C:\Windows\System\jWMDciJ.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\kIcljvT.exe
  C:\Windows\System\kIcljvT.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\PkKPUps.exe
  C:\Windows\System\PkKPUps.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\GpIHnQa.exe
  C:\Windows\System\GpIHnQa.exe
  2⤵
  PID:3412
- C:\Windows\System\vaPPhNi.exe
  C:\Windows\System\vaPPhNi.exe
  2⤵
  PID:3560
- C:\Windows\System\wOnyBDS.exe
  C:\Windows\System\wOnyBDS.exe
  2⤵
  PID:2420
- C:\Windows\System\NQcLeFG.exe
  C:\Windows\System\NQcLeFG.exe
  2⤵
  PID:672
- C:\Windows\System\UIbiOKh.exe
  C:\Windows\System\UIbiOKh.exe
  2⤵
  PID:4060
- C:\Windows\System\tuhInWe.exe
  C:\Windows\System\tuhInWe.exe
  2⤵
  PID:1720
- C:\Windows\System\BnieeaY.exe
  C:\Windows\System\BnieeaY.exe
  2⤵
  PID:3996
- C:\Windows\System\GJWtNLh.exe
  C:\Windows\System\GJWtNLh.exe
  2⤵
  PID:4876
- C:\Windows\System\pyFXfHc.exe
  C:\Windows\System\pyFXfHc.exe
  2⤵
  PID:4576
- C:\Windows\System\TkMatBY.exe
  C:\Windows\System\TkMatBY.exe
  2⤵
  PID:5116
- C:\Windows\System\ZAMKaKy.exe
  C:\Windows\System\ZAMKaKy.exe
  2⤵
  PID:4492
- C:\Windows\System\TVXJKvx.exe
  C:\Windows\System\TVXJKvx.exe
  2⤵
  PID:4468
- C:\Windows\System\xJbRVxm.exe
  C:\Windows\System\xJbRVxm.exe
  2⤵
  PID:4716
- C:\Windows\System\voSoocN.exe
  C:\Windows\System\voSoocN.exe
  2⤵
  PID:2036
- C:\Windows\System\LEVVKto.exe
  C:\Windows\System\LEVVKto.exe
  2⤵
  PID:4012
- C:\Windows\System\BsMnFfQ.exe
  C:\Windows\System\BsMnFfQ.exe
  2⤵
  PID:1492
- C:\Windows\System\GmTUHfT.exe
  C:\Windows\System\GmTUHfT.exe
  2⤵
  PID:832
- C:\Windows\System\XYNgNuA.exe
  C:\Windows\System\XYNgNuA.exe
  2⤵
  PID:3040
- C:\Windows\System\LDKJtWS.exe
  C:\Windows\System\LDKJtWS.exe
  2⤵
  PID:992
- C:\Windows\System\WJvENZS.exe
  C:\Windows\System\WJvENZS.exe
  2⤵
  PID:2000
- C:\Windows\System\aLeTOTH.exe
  C:\Windows\System\aLeTOTH.exe
  2⤵
  PID:2700
- C:\Windows\System\zhKQFnb.exe
  C:\Windows\System\zhKQFnb.exe
  2⤵
  PID:5016
- C:\Windows\System\SeNgKID.exe
  C:\Windows\System\SeNgKID.exe
  2⤵
  PID:5132
- C:\Windows\System\cvbljFv.exe
  C:\Windows\System\cvbljFv.exe
  2⤵
  PID:5168
- C:\Windows\System\CCRwysg.exe
  C:\Windows\System\CCRwysg.exe
  2⤵
  PID:5200
- C:\Windows\System\fcsvfkN.exe
  C:\Windows\System\fcsvfkN.exe
  2⤵
  PID:5228
- C:\Windows\System\WvsRVVq.exe
  C:\Windows\System\WvsRVVq.exe
  2⤵
  PID:5260
- C:\Windows\System\FboaTlu.exe
  C:\Windows\System\FboaTlu.exe
  2⤵
  PID:5296
- C:\Windows\System\yjtHOKO.exe
  C:\Windows\System\yjtHOKO.exe
  2⤵
  PID:5324
- C:\Windows\System\JfAyOMf.exe
  C:\Windows\System\JfAyOMf.exe
  2⤵
  PID:5360
- C:\Windows\System\saWZglK.exe
  C:\Windows\System\saWZglK.exe
  2⤵
  PID:5392
- C:\Windows\System\pAyXGRj.exe
  C:\Windows\System\pAyXGRj.exe
  2⤵
  PID:5424
- C:\Windows\System\yDPsxEU.exe
  C:\Windows\System\yDPsxEU.exe
  2⤵
  PID:5456
- C:\Windows\System\RtTEVvH.exe
  C:\Windows\System\RtTEVvH.exe
  2⤵
  PID:5476
- C:\Windows\System\vZTVOkR.exe
  C:\Windows\System\vZTVOkR.exe
  2⤵
  PID:5520
- C:\Windows\System\ONJPNeb.exe
  C:\Windows\System\ONJPNeb.exe
  2⤵
  PID:5588
- C:\Windows\System\pznBgtG.exe
  C:\Windows\System\pznBgtG.exe
  2⤵
  PID:5604
- C:\Windows\System\dmmVLFf.exe
  C:\Windows\System\dmmVLFf.exe
  2⤵
  PID:5624
- C:\Windows\System\rxSbUBo.exe
  C:\Windows\System\rxSbUBo.exe
  2⤵
  PID:5644
- C:\Windows\System\RbVjlXS.exe
  C:\Windows\System\RbVjlXS.exe
  2⤵
  PID:5672
- C:\Windows\System\bxbkvhz.exe
  C:\Windows\System\bxbkvhz.exe
  2⤵
  PID:5720
- C:\Windows\System\TREaFtQ.exe
  C:\Windows\System\TREaFtQ.exe
  2⤵
  PID:5748
- C:\Windows\System\TDoHjrX.exe
  C:\Windows\System\TDoHjrX.exe
  2⤵
  PID:5788
- C:\Windows\System\mouaPtG.exe
  C:\Windows\System\mouaPtG.exe
  2⤵
  PID:5824
- C:\Windows\System\TSQvWgX.exe
  C:\Windows\System\TSQvWgX.exe
  2⤵
  PID:5864
- C:\Windows\System\ynzDhEO.exe
  C:\Windows\System\ynzDhEO.exe
  2⤵
  PID:5888
- C:\Windows\System\EpSxAcH.exe
  C:\Windows\System\EpSxAcH.exe
  2⤵
  PID:5916
- C:\Windows\System\sgHzSXM.exe
  C:\Windows\System\sgHzSXM.exe
  2⤵
  PID:5944
- C:\Windows\System\rTIniLZ.exe
  C:\Windows\System\rTIniLZ.exe
  2⤵
  PID:5972
- C:\Windows\System\lrwoADB.exe
  C:\Windows\System\lrwoADB.exe
  2⤵
  PID:6008
- C:\Windows\System\IvykHvz.exe
  C:\Windows\System\IvykHvz.exe
  2⤵
  PID:6040
- C:\Windows\System\gFaZMnf.exe
  C:\Windows\System\gFaZMnf.exe
  2⤵
  PID:6068
- C:\Windows\System\ehwKzin.exe
  C:\Windows\System\ehwKzin.exe
  2⤵
  PID:6096
- C:\Windows\System\lklwUGj.exe
  C:\Windows\System\lklwUGj.exe
  2⤵
  PID:6124
- C:\Windows\System\QIKrVds.exe
  C:\Windows\System\QIKrVds.exe
  2⤵
  PID:2936
- C:\Windows\System\oJVxnYM.exe
  C:\Windows\System\oJVxnYM.exe
  2⤵
  PID:5188
- C:\Windows\System\UhkZJXo.exe
  C:\Windows\System\UhkZJXo.exe
  2⤵
  PID:5244
- C:\Windows\System\wyuesvU.exe
  C:\Windows\System\wyuesvU.exe
  2⤵
  PID:5308
- C:\Windows\System\CDNmwVC.exe
  C:\Windows\System\CDNmwVC.exe
  2⤵
  PID:5348
- C:\Windows\System\wxbSvQw.exe
  C:\Windows\System\wxbSvQw.exe
  2⤵
  PID:5412
- C:\Windows\System\tItgjgf.exe
  C:\Windows\System\tItgjgf.exe
  2⤵
  PID:5472
- C:\Windows\System\QzeqcSA.exe
  C:\Windows\System\QzeqcSA.exe
  2⤵
  PID:5516
- C:\Windows\System\iFdcikk.exe
  C:\Windows\System\iFdcikk.exe
  2⤵
  PID:5612
- C:\Windows\System\cqsoyuS.exe
  C:\Windows\System\cqsoyuS.exe
  2⤵
  PID:5660
- C:\Windows\System\ILrTgyC.exe
  C:\Windows\System\ILrTgyC.exe
  2⤵
  PID:5736
- C:\Windows\System\ThifZYd.exe
  C:\Windows\System\ThifZYd.exe
  2⤵
  PID:5772
- C:\Windows\System\wprPfYi.exe
  C:\Windows\System\wprPfYi.exe
  2⤵
  PID:5808
- C:\Windows\System\oquGQZA.exe
  C:\Windows\System\oquGQZA.exe
  2⤵
  PID:5852
- C:\Windows\System\WwwmJWs.exe
  C:\Windows\System\WwwmJWs.exe
  2⤵
  PID:5928
- C:\Windows\System\kgwgXSH.exe
  C:\Windows\System\kgwgXSH.exe
  2⤵
  PID:5996
- C:\Windows\System\JTZOWUP.exe
  C:\Windows\System\JTZOWUP.exe
  2⤵
  PID:6092
- C:\Windows\System\IZhBmfL.exe
  C:\Windows\System\IZhBmfL.exe
  2⤵
  PID:5164
- C:\Windows\System\pvfBlvO.exe
  C:\Windows\System\pvfBlvO.exe
  2⤵
  PID:5352
- C:\Windows\System\wxBhRgm.exe
  C:\Windows\System\wxBhRgm.exe
  2⤵
  PID:5148
- C:\Windows\System\YjxzLpd.exe
  C:\Windows\System\YjxzLpd.exe
  2⤵
  PID:5556
- C:\Windows\System\yYdAMDl.exe
  C:\Windows\System\yYdAMDl.exe
  2⤵
  PID:5688
- C:\Windows\System\KwEhrZZ.exe
  C:\Windows\System\KwEhrZZ.exe
  2⤵
  PID:5816
- C:\Windows\System\XZdlIir.exe
  C:\Windows\System\XZdlIir.exe
  2⤵
  PID:5964
- C:\Windows\System\GxmRtnr.exe
  C:\Windows\System\GxmRtnr.exe
  2⤵
  PID:5240
- C:\Windows\System\FaukgLG.exe
  C:\Windows\System\FaukgLG.exe
  2⤵
  PID:5496
- C:\Windows\System\sKnzTPY.exe
  C:\Windows\System\sKnzTPY.exe
  2⤵
  PID:5884
- C:\Windows\System\RuMwQka.exe
  C:\Windows\System\RuMwQka.exe
  2⤵
  PID:5404
- C:\Windows\System\jPjcBMv.exe
  C:\Windows\System\jPjcBMv.exe
  2⤵
  PID:5760
- C:\Windows\System\mvIVKaq.exe
  C:\Windows\System\mvIVKaq.exe
  2⤵
  PID:6180
- C:\Windows\System\ZJOKZli.exe
  C:\Windows\System\ZJOKZli.exe
  2⤵
  PID:6204
- C:\Windows\System\CiuXHGt.exe
  C:\Windows\System\CiuXHGt.exe
  2⤵
  PID:6224
- C:\Windows\System\mdiJBJM.exe
  C:\Windows\System\mdiJBJM.exe
  2⤵
  PID:6252
- C:\Windows\System\IVDsZVH.exe
  C:\Windows\System\IVDsZVH.exe
  2⤵
  PID:6280
- C:\Windows\System\rLSbMzn.exe
  C:\Windows\System\rLSbMzn.exe
  2⤵
  PID:6308
- C:\Windows\System\WxWyETj.exe
  C:\Windows\System\WxWyETj.exe
  2⤵
  PID:6340
- C:\Windows\System\VBGLrgx.exe
  C:\Windows\System\VBGLrgx.exe
  2⤵
  PID:6364
- C:\Windows\System\JqtCotu.exe
  C:\Windows\System\JqtCotu.exe
  2⤵
  PID:6396
- C:\Windows\System\KxCOdCg.exe
  C:\Windows\System\KxCOdCg.exe
  2⤵
  PID:6428
- C:\Windows\System\hPZYxle.exe
  C:\Windows\System\hPZYxle.exe
  2⤵
  PID:6464
- C:\Windows\System\SRsBFZt.exe
  C:\Windows\System\SRsBFZt.exe
  2⤵
  PID:6484
- C:\Windows\System\CcYjwEm.exe
  C:\Windows\System\CcYjwEm.exe
  2⤵
  PID:6512
- C:\Windows\System\povYEFP.exe
  C:\Windows\System\povYEFP.exe
  2⤵
  PID:6540
- C:\Windows\System\KPQtsSh.exe
  C:\Windows\System\KPQtsSh.exe
  2⤵
  PID:6568
- C:\Windows\System\VMFsWul.exe
  C:\Windows\System\VMFsWul.exe
  2⤵
  PID:6600
- C:\Windows\System\lFwvQaU.exe
  C:\Windows\System\lFwvQaU.exe
  2⤵
  PID:6624
- C:\Windows\System\DFHtNHu.exe
  C:\Windows\System\DFHtNHu.exe
  2⤵
  PID:6652
- C:\Windows\System\JkyuFNG.exe
  C:\Windows\System\JkyuFNG.exe
  2⤵
  PID:6684
- C:\Windows\System\FxXikoM.exe
  C:\Windows\System\FxXikoM.exe
  2⤵
  PID:6708
- C:\Windows\System\NuLspIW.exe
  C:\Windows\System\NuLspIW.exe
  2⤵
  PID:6736
- C:\Windows\System\icpdtmJ.exe
  C:\Windows\System\icpdtmJ.exe
  2⤵
  PID:6764
- C:\Windows\System\GfdspmU.exe
  C:\Windows\System\GfdspmU.exe
  2⤵
  PID:6800
- C:\Windows\System\ePwIBcz.exe
  C:\Windows\System\ePwIBcz.exe
  2⤵
  PID:6828
- C:\Windows\System\gkbUBmt.exe
  C:\Windows\System\gkbUBmt.exe
  2⤵
  PID:6860
- C:\Windows\System\SrrVDhm.exe
  C:\Windows\System\SrrVDhm.exe
  2⤵
  PID:6884
- C:\Windows\System\olBjRHo.exe
  C:\Windows\System\olBjRHo.exe
  2⤵
  PID:6912
- C:\Windows\System\QMMWsCg.exe
  C:\Windows\System\QMMWsCg.exe
  2⤵
  PID:6944
- C:\Windows\System\sLWVOeX.exe
  C:\Windows\System\sLWVOeX.exe
  2⤵
  PID:6968
- C:\Windows\System\ppNLXyT.exe
  C:\Windows\System\ppNLXyT.exe
  2⤵
  PID:7004
- C:\Windows\System\EkVdiBb.exe
  C:\Windows\System\EkVdiBb.exe
  2⤵
  PID:7028
- C:\Windows\System\NyiRNOv.exe
  C:\Windows\System\NyiRNOv.exe
  2⤵
  PID:7056
- C:\Windows\System\whFSjgF.exe
  C:\Windows\System\whFSjgF.exe
  2⤵
  PID:7088
- C:\Windows\System\tUUlXyA.exe
  C:\Windows\System\tUUlXyA.exe
  2⤵
  PID:7112
- C:\Windows\System\kHmwkdv.exe
  C:\Windows\System\kHmwkdv.exe
  2⤵
  PID:7144
- C:\Windows\System\rLWSfIY.exe
  C:\Windows\System\rLWSfIY.exe
  2⤵
  PID:6148
- C:\Windows\System\RjravUn.exe
  C:\Windows\System\RjravUn.exe
  2⤵
  PID:6216
- C:\Windows\System\jiMGenb.exe
  C:\Windows\System\jiMGenb.exe
  2⤵
  PID:6276
- C:\Windows\System\fgAxCob.exe
  C:\Windows\System\fgAxCob.exe
  2⤵
  PID:6348
- C:\Windows\System\tDDAzWK.exe
  C:\Windows\System\tDDAzWK.exe
  2⤵
  PID:6420
- C:\Windows\System\iAjtLNt.exe
  C:\Windows\System\iAjtLNt.exe
  2⤵
  PID:6508
- C:\Windows\System\BhURoTp.exe
  C:\Windows\System\BhURoTp.exe
  2⤵
  PID:6564
- C:\Windows\System\vMfHiJb.exe
  C:\Windows\System\vMfHiJb.exe
  2⤵
  PID:6648
- C:\Windows\System\FboVwMF.exe
  C:\Windows\System\FboVwMF.exe
  2⤵
  PID:6704
- C:\Windows\System\AGqUhna.exe
  C:\Windows\System\AGqUhna.exe
  2⤵
  PID:6780
- C:\Windows\System\AhzYhmS.exe
  C:\Windows\System\AhzYhmS.exe
  2⤵
  PID:6840
- C:\Windows\System\CKVvKzb.exe
  C:\Windows\System\CKVvKzb.exe
  2⤵
  PID:6924
- C:\Windows\System\mrqYGGx.exe
  C:\Windows\System\mrqYGGx.exe
  2⤵
  PID:6960
- C:\Windows\System\glWPRdu.exe
  C:\Windows\System\glWPRdu.exe
  2⤵
  PID:7044
- C:\Windows\System\QupeCSs.exe
  C:\Windows\System\QupeCSs.exe
  2⤵
  PID:7108
- C:\Windows\System\NcZmnGt.exe
  C:\Windows\System\NcZmnGt.exe
  2⤵
  PID:7132
- C:\Windows\System\ObxQVFu.exe
  C:\Windows\System\ObxQVFu.exe
  2⤵
  PID:6296
- C:\Windows\System\pnpkxRu.exe
  C:\Windows\System\pnpkxRu.exe
  2⤵
  PID:6496
- C:\Windows\System\WeMIbJp.exe
  C:\Windows\System\WeMIbJp.exe
  2⤵
  PID:6636
- C:\Windows\System\nEOraAP.exe
  C:\Windows\System\nEOraAP.exe
  2⤵
  PID:6816
- C:\Windows\System\ggNElUa.exe
  C:\Windows\System\ggNElUa.exe
  2⤵
  PID:6964
- C:\Windows\System\LgRBJSI.exe
  C:\Windows\System\LgRBJSI.exe
  2⤵
  PID:7096
- C:\Windows\System\iBJQauP.exe
  C:\Windows\System\iBJQauP.exe
  2⤵
  PID:6448
- C:\Windows\System\MkqwXzd.exe
  C:\Windows\System\MkqwXzd.exe
  2⤵
  PID:6896
- C:\Windows\System\OHtEPsi.exe
  C:\Windows\System\OHtEPsi.exe
  2⤵
  PID:6408
- C:\Windows\System\MGBhIpW.exe
  C:\Windows\System\MGBhIpW.exe
  2⤵
  PID:6760
- C:\Windows\System\TbZEpFk.exe
  C:\Windows\System\TbZEpFk.exe
  2⤵
  PID:7188
- C:\Windows\System\hewYuOr.exe
  C:\Windows\System\hewYuOr.exe
  2⤵
  PID:7220
- C:\Windows\System\VhVyPAH.exe
  C:\Windows\System\VhVyPAH.exe
  2⤵
  PID:7248
- C:\Windows\System\bmArfeO.exe
  C:\Windows\System\bmArfeO.exe
  2⤵
  PID:7280
- C:\Windows\System\LFiFxDw.exe
  C:\Windows\System\LFiFxDw.exe
  2⤵
  PID:7308
- C:\Windows\System\evRQUUy.exe
  C:\Windows\System\evRQUUy.exe
  2⤵
  PID:7340
- C:\Windows\System\rUkrHJU.exe
  C:\Windows\System\rUkrHJU.exe
  2⤵
  PID:7364
- C:\Windows\System\SjSDchJ.exe
  C:\Windows\System\SjSDchJ.exe
  2⤵
  PID:7392
- C:\Windows\System\MxefUdq.exe
  C:\Windows\System\MxefUdq.exe
  2⤵
  PID:7420
- C:\Windows\System\wUAeeXM.exe
  C:\Windows\System\wUAeeXM.exe
  2⤵
  PID:7448
- C:\Windows\System\uOcNTca.exe
  C:\Windows\System\uOcNTca.exe
  2⤵
  PID:7476
- C:\Windows\System\isTnMHf.exe
  C:\Windows\System\isTnMHf.exe
  2⤵
  PID:7504
- C:\Windows\System\AwPlkmZ.exe
  C:\Windows\System\AwPlkmZ.exe
  2⤵
  PID:7536
- C:\Windows\System\Htozndy.exe
  C:\Windows\System\Htozndy.exe
  2⤵
  PID:7560
- C:\Windows\System\SxYrVcw.exe
  C:\Windows\System\SxYrVcw.exe
  2⤵
  PID:7596
- C:\Windows\System\CliTcnf.exe
  C:\Windows\System\CliTcnf.exe
  2⤵
  PID:7628
- C:\Windows\System\qBYKXgN.exe
  C:\Windows\System\qBYKXgN.exe
  2⤵
  PID:7652
- C:\Windows\System\KwFHzaW.exe
  C:\Windows\System\KwFHzaW.exe
  2⤵
  PID:7672
- C:\Windows\System\hZmmgIb.exe
  C:\Windows\System\hZmmgIb.exe
  2⤵
  PID:7704
- C:\Windows\System\Nmhxits.exe
  C:\Windows\System\Nmhxits.exe
  2⤵
  PID:7740
- C:\Windows\System\EUoVyGH.exe
  C:\Windows\System\EUoVyGH.exe
  2⤵
  PID:7768
- C:\Windows\System\HtBICgu.exe
  C:\Windows\System\HtBICgu.exe
  2⤵
  PID:7796
- C:\Windows\System\sNqPHmT.exe
  C:\Windows\System\sNqPHmT.exe
  2⤵
  PID:7824
- C:\Windows\System\jEskKux.exe
  C:\Windows\System\jEskKux.exe
  2⤵
  PID:7852
- C:\Windows\System\eiFDiiA.exe
  C:\Windows\System\eiFDiiA.exe
  2⤵
  PID:7888
- C:\Windows\System\dIXWSch.exe
  C:\Windows\System\dIXWSch.exe
  2⤵
  PID:7908
- C:\Windows\System\xypVoyC.exe
  C:\Windows\System\xypVoyC.exe
  2⤵
  PID:7940
- C:\Windows\System\bgyElyd.exe
  C:\Windows\System\bgyElyd.exe
  2⤵
  PID:7972
- C:\Windows\System\IAqOBSb.exe
  C:\Windows\System\IAqOBSb.exe
  2⤵
  PID:7992
- C:\Windows\System\oIlgnxe.exe
  C:\Windows\System\oIlgnxe.exe
  2⤵
  PID:8024
- C:\Windows\System\ppERApt.exe
  C:\Windows\System\ppERApt.exe
  2⤵
  PID:8048
- C:\Windows\System\ucNiOin.exe
  C:\Windows\System\ucNiOin.exe
  2⤵
  PID:8080
- C:\Windows\System\ZccxzAC.exe
  C:\Windows\System\ZccxzAC.exe
  2⤵
  PID:8104
- C:\Windows\System\SrzrKci.exe
  C:\Windows\System\SrzrKci.exe
  2⤵
  PID:8132
- C:\Windows\System\dAVJlNS.exe
  C:\Windows\System\dAVJlNS.exe
  2⤵
  PID:8160
- C:\Windows\System\eqWduXM.exe
  C:\Windows\System\eqWduXM.exe
  2⤵
  PID:7176
- C:\Windows\System\utYUYnH.exe
  C:\Windows\System\utYUYnH.exe
  2⤵
  PID:7232
- C:\Windows\System\JvetDKK.exe
  C:\Windows\System\JvetDKK.exe
  2⤵
  PID:7296
- C:\Windows\System\DTsTVZo.exe
  C:\Windows\System\DTsTVZo.exe
  2⤵
  PID:7352
- C:\Windows\System\FUdPFxQ.exe
  C:\Windows\System\FUdPFxQ.exe
  2⤵
  PID:7436
- C:\Windows\System\DEDxOOe.exe
  C:\Windows\System\DEDxOOe.exe
  2⤵
  PID:7472
- C:\Windows\System\woaEICl.exe
  C:\Windows\System\woaEICl.exe
  2⤵
  PID:7528
- C:\Windows\System\edMVLAo.exe
  C:\Windows\System\edMVLAo.exe
  2⤵
  PID:7604
- C:\Windows\System\pbdNCBx.exe
  C:\Windows\System\pbdNCBx.exe
  2⤵
  PID:7680
- C:\Windows\System\xYjCOkQ.exe
  C:\Windows\System\xYjCOkQ.exe
  2⤵
  PID:7736
- C:\Windows\System\viNpvGu.exe
  C:\Windows\System\viNpvGu.exe
  2⤵
  PID:7808
- C:\Windows\System\dptLaKe.exe
  C:\Windows\System\dptLaKe.exe
  2⤵
  PID:7872
- C:\Windows\System\XZcYJtk.exe
  C:\Windows\System\XZcYJtk.exe
  2⤵
  PID:7932
- C:\Windows\System\BxindIj.exe
  C:\Windows\System\BxindIj.exe
  2⤵
  PID:8004
- C:\Windows\System\QipOHXH.exe
  C:\Windows\System\QipOHXH.exe
  2⤵
  PID:8072
- C:\Windows\System\pAZsOMW.exe
  C:\Windows\System\pAZsOMW.exe
  2⤵
  PID:8144
- C:\Windows\System\wshKNWB.exe
  C:\Windows\System\wshKNWB.exe
  2⤵
  PID:7212
- C:\Windows\System\czSmkOz.exe
  C:\Windows\System\czSmkOz.exe
  2⤵
  PID:7348
- C:\Windows\System\HMdUJgG.exe
  C:\Windows\System\HMdUJgG.exe
  2⤵
  PID:7496
- C:\Windows\System\AMzHkwu.exe
  C:\Windows\System\AMzHkwu.exe
  2⤵
  PID:7644
- C:\Windows\System\ZFduhrL.exe
  C:\Windows\System\ZFduhrL.exe
  2⤵
  PID:7792
- C:\Windows\System\BxrOHtf.exe
  C:\Windows\System\BxrOHtf.exe
  2⤵
  PID:7960
- C:\Windows\System\pHnRrou.exe
  C:\Windows\System\pHnRrou.exe
  2⤵
  PID:8016
- C:\Windows\System\uQKslxS.exe
  C:\Windows\System\uQKslxS.exe
  2⤵
  PID:7316
- C:\Windows\System\MMPoVPU.exe
  C:\Windows\System\MMPoVPU.exe
  2⤵
  PID:7588
- C:\Windows\System\aweWCUL.exe
  C:\Windows\System\aweWCUL.exe
  2⤵
  PID:7928
- C:\Windows\System\rexYdaQ.exe
  C:\Windows\System\rexYdaQ.exe
  2⤵
  PID:7468
- C:\Windows\System\sKuDETV.exe
  C:\Windows\System\sKuDETV.exe
  2⤵
  PID:7184
- C:\Windows\System\SFEKtqI.exe
  C:\Windows\System\SFEKtqI.exe
  2⤵
  PID:8200
- C:\Windows\System\ThNqLnt.exe
  C:\Windows\System\ThNqLnt.exe
  2⤵
  PID:8228
- C:\Windows\System\NoPfsWJ.exe
  C:\Windows\System\NoPfsWJ.exe
  2⤵
  PID:8256
- C:\Windows\System\buWsVHo.exe
  C:\Windows\System\buWsVHo.exe
  2⤵
  PID:8296
- C:\Windows\System\hBOXPEm.exe
  C:\Windows\System\hBOXPEm.exe
  2⤵
  PID:8328
- C:\Windows\System\YMebeWU.exe
  C:\Windows\System\YMebeWU.exe
  2⤵
  PID:8356
- C:\Windows\System\ndeewFg.exe
  C:\Windows\System\ndeewFg.exe
  2⤵
  PID:8384
- C:\Windows\System\JYxfFAp.exe
  C:\Windows\System\JYxfFAp.exe
  2⤵
  PID:8412
- C:\Windows\System\ECOOQLM.exe
  C:\Windows\System\ECOOQLM.exe
  2⤵
  PID:8440
- C:\Windows\System\ffLIXRB.exe
  C:\Windows\System\ffLIXRB.exe
  2⤵
  PID:8468
- C:\Windows\System\ZyKABXe.exe
  C:\Windows\System\ZyKABXe.exe
  2⤵
  PID:8496
- C:\Windows\System\zKZSAAV.exe
  C:\Windows\System\zKZSAAV.exe
  2⤵
  PID:8524
- C:\Windows\System\sccGawY.exe
  C:\Windows\System\sccGawY.exe
  2⤵
  PID:8552
- C:\Windows\System\JzlAhWn.exe
  C:\Windows\System\JzlAhWn.exe
  2⤵
  PID:8580
- C:\Windows\System\JbiIAAV.exe
  C:\Windows\System\JbiIAAV.exe
  2⤵
  PID:8608
- C:\Windows\System\iOjWDCk.exe
  C:\Windows\System\iOjWDCk.exe
  2⤵
  PID:8636
- C:\Windows\System\xWETsnq.exe
  C:\Windows\System\xWETsnq.exe
  2⤵
  PID:8664
- C:\Windows\System\DqcSseA.exe
  C:\Windows\System\DqcSseA.exe
  2⤵
  PID:8692
- C:\Windows\System\GPfMzaV.exe
  C:\Windows\System\GPfMzaV.exe
  2⤵
  PID:8720
- C:\Windows\System\lMgwOHP.exe
  C:\Windows\System\lMgwOHP.exe
  2⤵
  PID:8748
- C:\Windows\System\eHRksCY.exe
  C:\Windows\System\eHRksCY.exe
  2⤵
  PID:8776
- C:\Windows\System\wjZMdUn.exe
  C:\Windows\System\wjZMdUn.exe
  2⤵
  PID:8804
- C:\Windows\System\JgpEqde.exe
  C:\Windows\System\JgpEqde.exe
  2⤵
  PID:8832
- C:\Windows\System\lCQRteb.exe
  C:\Windows\System\lCQRteb.exe
  2⤵
  PID:8860
- C:\Windows\System\dFCdhgB.exe
  C:\Windows\System\dFCdhgB.exe
  2⤵
  PID:8888
- C:\Windows\System\LqPDegi.exe
  C:\Windows\System\LqPDegi.exe
  2⤵
  PID:8916
- C:\Windows\System\DkosNbx.exe
  C:\Windows\System\DkosNbx.exe
  2⤵
  PID:8944
- C:\Windows\System\aLuZIpu.exe
  C:\Windows\System\aLuZIpu.exe
  2⤵
  PID:8972
- C:\Windows\System\TJElxdZ.exe
  C:\Windows\System\TJElxdZ.exe
  2⤵
  PID:9000
- C:\Windows\System\xXBefcS.exe
  C:\Windows\System\xXBefcS.exe
  2⤵
  PID:9028
- C:\Windows\System\lvbstJZ.exe
  C:\Windows\System\lvbstJZ.exe
  2⤵
  PID:9056
- C:\Windows\System\jyiCiUz.exe
  C:\Windows\System\jyiCiUz.exe
  2⤵
  PID:9084
- C:\Windows\System\gUsusGq.exe
  C:\Windows\System\gUsusGq.exe
  2⤵
  PID:9120
- C:\Windows\System\WMtIGFs.exe
  C:\Windows\System\WMtIGFs.exe
  2⤵
  PID:9140
- C:\Windows\System\nNcUzbQ.exe
  C:\Windows\System\nNcUzbQ.exe
  2⤵
  PID:9172
- C:\Windows\System\IcNpmRK.exe
  C:\Windows\System\IcNpmRK.exe
  2⤵
  PID:9200
- C:\Windows\System\EXlWHlO.exe
  C:\Windows\System\EXlWHlO.exe
  2⤵
  PID:8220
- C:\Windows\System\HJguNIg.exe
  C:\Windows\System\HJguNIg.exe
  2⤵
  PID:3372
- C:\Windows\System\OrJEICO.exe
  C:\Windows\System\OrJEICO.exe
  2⤵
  PID:8348
- C:\Windows\System\vPESSRd.exe
  C:\Windows\System\vPESSRd.exe
  2⤵
  PID:8408
- C:\Windows\System\oPeLvbb.exe
  C:\Windows\System\oPeLvbb.exe
  2⤵
  PID:8480
- C:\Windows\System\grzdUgy.exe
  C:\Windows\System\grzdUgy.exe
  2⤵
  PID:8544
- C:\Windows\System\VjArARs.exe
  C:\Windows\System\VjArARs.exe
  2⤵
  PID:8592
- C:\Windows\System\nGKOYfo.exe
  C:\Windows\System\nGKOYfo.exe
  2⤵
  PID:8628
- C:\Windows\System\OHJOIHe.exe
  C:\Windows\System\OHJOIHe.exe
  2⤵
  PID:8676
- C:\Windows\System\ANzmxlm.exe
  C:\Windows\System\ANzmxlm.exe
  2⤵
  PID:8736
- C:\Windows\System\MMaMwyi.exe
  C:\Windows\System\MMaMwyi.exe
  2⤵
  PID:8796
- C:\Windows\System\eMFPyfw.exe
  C:\Windows\System\eMFPyfw.exe
  2⤵
  PID:8880
- C:\Windows\System\GPKEarR.exe
  C:\Windows\System\GPKEarR.exe
  2⤵
  PID:9012
- C:\Windows\System\gleLIGj.exe
  C:\Windows\System\gleLIGj.exe
  2⤵
  PID:9052
- C:\Windows\System\htAVizZ.exe
  C:\Windows\System\htAVizZ.exe
  2⤵
  PID:9108
- C:\Windows\System\OjNgHgZ.exe
  C:\Windows\System\OjNgHgZ.exe
  2⤵
  PID:3192
- C:\Windows\System\ebtaUnb.exe
  C:\Windows\System\ebtaUnb.exe
  2⤵
  PID:4812
- C:\Windows\System\wjDlLQn.exe
  C:\Windows\System\wjDlLQn.exe
  2⤵
  PID:4496
- C:\Windows\System\qAWNvkU.exe
  C:\Windows\System\qAWNvkU.exe
  2⤵
  PID:9164
- C:\Windows\System\vhMkOVV.exe
  C:\Windows\System\vhMkOVV.exe
  2⤵
  PID:9196
- C:\Windows\System\IVwsCRv.exe
  C:\Windows\System\IVwsCRv.exe
  2⤵
  PID:4384
- C:\Windows\System\kVlpDNB.exe
  C:\Windows\System\kVlpDNB.exe
  2⤵
  PID:8452
- C:\Windows\System\LXAzKNH.exe
  C:\Windows\System\LXAzKNH.exe
  2⤵
  PID:8576
- C:\Windows\System\TXPYVuD.exe
  C:\Windows\System\TXPYVuD.exe
  2⤵
  PID:8604
- C:\Windows\System\DJgsILD.exe
  C:\Windows\System\DJgsILD.exe
  2⤵
  PID:8768
- C:\Windows\System\JTLNgOm.exe
  C:\Windows\System\JTLNgOm.exe
  2⤵
  PID:9076
- C:\Windows\System\KieWGXa.exe
  C:\Windows\System\KieWGXa.exe
  2⤵
  PID:1864
- C:\Windows\System\OtVFcQN.exe
  C:\Windows\System\OtVFcQN.exe
  2⤵
  PID:5956
- C:\Windows\System\ImTOrVE.exe
  C:\Windows\System\ImTOrVE.exe
  2⤵
  PID:8648
- C:\Windows\System\VHQGULh.exe
  C:\Windows\System\VHQGULh.exe
  2⤵
  PID:8400
- C:\Windows\System\vmzFblO.exe
  C:\Windows\System\vmzFblO.exe
  2⤵
  PID:8620
- C:\Windows\System\QGAuMAw.exe
  C:\Windows\System\QGAuMAw.exe
  2⤵
  PID:9104
- C:\Windows\System\IheNadP.exe
  C:\Windows\System\IheNadP.exe
  2⤵
  PID:1372
- C:\Windows\System\MZudptL.exe
  C:\Windows\System\MZudptL.exe
  2⤵
  PID:8656
- C:\Windows\System\ucdzjAe.exe
  C:\Windows\System\ucdzjAe.exe
  2⤵
  PID:8272
- C:\Windows\System\xwEwlNt.exe
  C:\Windows\System\xwEwlNt.exe
  2⤵
  PID:5564
- C:\Windows\System\BtOAyBu.exe
  C:\Windows\System\BtOAyBu.exe
  2⤵
  PID:9244
- C:\Windows\System\vafYGwh.exe
  C:\Windows\System\vafYGwh.exe
  2⤵
  PID:9272
- C:\Windows\System\JeFbVgX.exe
  C:\Windows\System\JeFbVgX.exe
  2⤵
  PID:9300
- C:\Windows\System\jQbvNlW.exe
  C:\Windows\System\jQbvNlW.exe
  2⤵
  PID:9328
- C:\Windows\System\fsTqUwU.exe
  C:\Windows\System\fsTqUwU.exe
  2⤵
  PID:9356
- C:\Windows\System\GYyObHE.exe
  C:\Windows\System\GYyObHE.exe
  2⤵
  PID:9384
- C:\Windows\System\pNqOARQ.exe
  C:\Windows\System\pNqOARQ.exe
  2⤵
  PID:9412
- C:\Windows\System\YjTTyeH.exe
  C:\Windows\System\YjTTyeH.exe
  2⤵
  PID:9440
- C:\Windows\System\bFyqeIQ.exe
  C:\Windows\System\bFyqeIQ.exe
  2⤵
  PID:9468
- C:\Windows\System\iwVHtDq.exe
  C:\Windows\System\iwVHtDq.exe
  2⤵
  PID:9496
- C:\Windows\System\MRkYxrq.exe
  C:\Windows\System\MRkYxrq.exe
  2⤵
  PID:9524
- C:\Windows\System\TaBCOed.exe
  C:\Windows\System\TaBCOed.exe
  2⤵
  PID:9552
- C:\Windows\System\lpClUBt.exe
  C:\Windows\System\lpClUBt.exe
  2⤵
  PID:9584
- C:\Windows\System\nEPHMIV.exe
  C:\Windows\System\nEPHMIV.exe
  2⤵
  PID:9612
- C:\Windows\System\FGYJpNd.exe
  C:\Windows\System\FGYJpNd.exe
  2⤵
  PID:9640
- C:\Windows\System\eMPNKNa.exe
  C:\Windows\System\eMPNKNa.exe
  2⤵
  PID:9668
- C:\Windows\System\OYghYfI.exe
  C:\Windows\System\OYghYfI.exe
  2⤵
  PID:9696
- C:\Windows\System\ZCXxhAk.exe
  C:\Windows\System\ZCXxhAk.exe
  2⤵
  PID:9724
- C:\Windows\System\UmFpsSI.exe
  C:\Windows\System\UmFpsSI.exe
  2⤵
  PID:9752
- C:\Windows\System\zDSNFsF.exe
  C:\Windows\System\zDSNFsF.exe
  2⤵
  PID:9780
- C:\Windows\System\NWnkwiA.exe
  C:\Windows\System\NWnkwiA.exe
  2⤵
  PID:9808
- C:\Windows\System\pxdCECv.exe
  C:\Windows\System\pxdCECv.exe
  2⤵
  PID:9836
- C:\Windows\System\jvHNeQT.exe
  C:\Windows\System\jvHNeQT.exe
  2⤵
  PID:9864
- C:\Windows\System\uPOwAFk.exe
  C:\Windows\System\uPOwAFk.exe
  2⤵
  PID:9892
- C:\Windows\System\FLfHLjT.exe
  C:\Windows\System\FLfHLjT.exe
  2⤵
  PID:9920
- C:\Windows\System\QMcpcYr.exe
  C:\Windows\System\QMcpcYr.exe
  2⤵
  PID:9948
- C:\Windows\System\vGOYVnP.exe
  C:\Windows\System\vGOYVnP.exe
  2⤵
  PID:9976
- C:\Windows\System\nnoYwql.exe
  C:\Windows\System\nnoYwql.exe
  2⤵
  PID:10004
- C:\Windows\System\kWiwvRZ.exe
  C:\Windows\System\kWiwvRZ.exe
  2⤵
  PID:10032
- C:\Windows\System\jogEkZo.exe
  C:\Windows\System\jogEkZo.exe
  2⤵
  PID:10060
- C:\Windows\System\hMNhhtK.exe
  C:\Windows\System\hMNhhtK.exe
  2⤵
  PID:10088
- C:\Windows\System\RgWGWsG.exe
  C:\Windows\System\RgWGWsG.exe
  2⤵
  PID:10116
- C:\Windows\System\bZMzPNc.exe
  C:\Windows\System\bZMzPNc.exe
  2⤵
  PID:10144
- C:\Windows\System\PySYTtt.exe
  C:\Windows\System\PySYTtt.exe
  2⤵
  PID:10172
- C:\Windows\System\VNfxMgu.exe
  C:\Windows\System\VNfxMgu.exe
  2⤵
  PID:10200
- C:\Windows\System\GxQTjHS.exe
  C:\Windows\System\GxQTjHS.exe
  2⤵
  PID:10228
- C:\Windows\System\zEreSQj.exe
  C:\Windows\System\zEreSQj.exe
  2⤵
  PID:9284
- C:\Windows\System\mSiWJam.exe
  C:\Windows\System\mSiWJam.exe
  2⤵
  PID:9320
- C:\Windows\System\yPFqHVd.exe
  C:\Windows\System\yPFqHVd.exe
  2⤵
  PID:2532
- C:\Windows\System\woCFWrt.exe
  C:\Windows\System\woCFWrt.exe
  2⤵
  PID:9376
- C:\Windows\System\osUfECP.exe
  C:\Windows\System\osUfECP.exe
  2⤵
  PID:9452
- C:\Windows\System\TlRxmJQ.exe
  C:\Windows\System\TlRxmJQ.exe
  2⤵
  PID:9508
- C:\Windows\System\JOEDDpN.exe
  C:\Windows\System\JOEDDpN.exe
  2⤵
  PID:9576
- C:\Windows\System\aIpHJjP.exe
  C:\Windows\System\aIpHJjP.exe
  2⤵
  PID:9632
- C:\Windows\System\VEYfSWa.exe
  C:\Windows\System\VEYfSWa.exe
  2⤵
  PID:9708
- C:\Windows\System\iiskHSC.exe
  C:\Windows\System\iiskHSC.exe
  2⤵
  PID:9772
- C:\Windows\System\aSynUIi.exe
  C:\Windows\System\aSynUIi.exe
  2⤵
  PID:9832
- C:\Windows\System\XPSPmVt.exe
  C:\Windows\System\XPSPmVt.exe
  2⤵
  PID:9904
- C:\Windows\System\irQioFs.exe
  C:\Windows\System\irQioFs.exe
  2⤵
  PID:9968
- C:\Windows\System\JVUlGjo.exe
  C:\Windows\System\JVUlGjo.exe
  2⤵
  PID:10028
- C:\Windows\System\MXmAGmG.exe
  C:\Windows\System\MXmAGmG.exe
  2⤵
  PID:10100
- C:\Windows\System\zIAQHrr.exe
  C:\Windows\System\zIAQHrr.exe
  2⤵
  PID:10164
- C:\Windows\System\bvilrOP.exe
  C:\Windows\System\bvilrOP.exe
  2⤵
  PID:10224
- C:\Windows\System\bcBfqdW.exe
  C:\Windows\System\bcBfqdW.exe
  2⤵
  PID:9348
- C:\Windows\System\aGZejch.exe
  C:\Windows\System\aGZejch.exe
  2⤵
  PID:9432
- C:\Windows\System\SUGIvhU.exe
  C:\Windows\System\SUGIvhU.exe
  2⤵
  PID:9568
- C:\Windows\System\cCCWnAi.exe
  C:\Windows\System\cCCWnAi.exe
  2⤵
  PID:9736
- C:\Windows\System\PdYPgFa.exe
  C:\Windows\System\PdYPgFa.exe
  2⤵
  PID:9876
- C:\Windows\System\xRmUvFM.exe
  C:\Windows\System\xRmUvFM.exe
  2⤵
  PID:10000
- C:\Windows\System\QwyPBsy.exe
  C:\Windows\System\QwyPBsy.exe
  2⤵
  PID:10128
- C:\Windows\System\gtQwoRg.exe
  C:\Windows\System\gtQwoRg.exe
  2⤵
  PID:9316
- C:\Windows\System\sBGPABr.exe
  C:\Windows\System\sBGPABr.exe
  2⤵
  PID:9636
- C:\Windows\System\VrXsSKL.exe
  C:\Windows\System\VrXsSKL.exe
  2⤵
  PID:9944
- C:\Windows\System\FJdTJBa.exe
  C:\Windows\System\FJdTJBa.exe
  2⤵
  PID:9296
- C:\Windows\System\xWSFwLK.exe
  C:\Windows\System\xWSFwLK.exe
  2⤵
  PID:10080
- C:\Windows\System\AapVvWU.exe
  C:\Windows\System\AapVvWU.exe
  2⤵
  PID:9828
- C:\Windows\System\ZRfVWSO.exe
  C:\Windows\System\ZRfVWSO.exe
  2⤵
  PID:10268
- C:\Windows\System\jBRLwTx.exe
  C:\Windows\System\jBRLwTx.exe
  2⤵
  PID:10296
- C:\Windows\System\npwwhyd.exe
  C:\Windows\System\npwwhyd.exe
  2⤵
  PID:10324
- C:\Windows\System\NPHsVpv.exe
  C:\Windows\System\NPHsVpv.exe
  2⤵
  PID:10352
- C:\Windows\System\NJfqzpI.exe
  C:\Windows\System\NJfqzpI.exe
  2⤵
  PID:10384
- C:\Windows\System\DNmlDtT.exe
  C:\Windows\System\DNmlDtT.exe
  2⤵
  PID:10400
- C:\Windows\System\oTcBRNQ.exe
  C:\Windows\System\oTcBRNQ.exe
  2⤵
  PID:10416
- C:\Windows\System\qPtiBmx.exe
  C:\Windows\System\qPtiBmx.exe
  2⤵
  PID:10432
- C:\Windows\System\ONSpgYa.exe
  C:\Windows\System\ONSpgYa.exe
  2⤵
  PID:10496
- C:\Windows\System\prnnbPZ.exe
  C:\Windows\System\prnnbPZ.exe
  2⤵
  PID:10524
- C:\Windows\System\QYCoUkm.exe
  C:\Windows\System\QYCoUkm.exe
  2⤵
  PID:10552
- C:\Windows\System\RsUaBoE.exe
  C:\Windows\System\RsUaBoE.exe
  2⤵
  PID:10580
- C:\Windows\System\NmVIjEZ.exe
  C:\Windows\System\NmVIjEZ.exe
  2⤵
  PID:10608
- C:\Windows\System\BiNSCPW.exe
  C:\Windows\System\BiNSCPW.exe
  2⤵
  PID:10636
- C:\Windows\System\GGyQFPY.exe
  C:\Windows\System\GGyQFPY.exe
  2⤵
  PID:10664
- C:\Windows\System\YnOJIUL.exe
  C:\Windows\System\YnOJIUL.exe
  2⤵
  PID:10692
- C:\Windows\System\lqPeFyc.exe
  C:\Windows\System\lqPeFyc.exe
  2⤵
  PID:10720
- C:\Windows\System\vSjQfUC.exe
  C:\Windows\System\vSjQfUC.exe
  2⤵
  PID:10748
- C:\Windows\System\DwdEmmY.exe
  C:\Windows\System\DwdEmmY.exe
  2⤵
  PID:10776
- C:\Windows\System\tBsildm.exe
  C:\Windows\System\tBsildm.exe
  2⤵
  PID:10804
- C:\Windows\System\KbRveuq.exe
  C:\Windows\System\KbRveuq.exe
  2⤵
  PID:10832
- C:\Windows\System\atQcBgm.exe
  C:\Windows\System\atQcBgm.exe
  2⤵
  PID:10860
- C:\Windows\System\ZNeqzkC.exe
  C:\Windows\System\ZNeqzkC.exe
  2⤵
  PID:10888
- C:\Windows\System\jyiziqC.exe
  C:\Windows\System\jyiziqC.exe
  2⤵
  PID:10916
- C:\Windows\System\yVkooch.exe
  C:\Windows\System\yVkooch.exe
  2⤵
  PID:10944
- C:\Windows\System\tIonHre.exe
  C:\Windows\System\tIonHre.exe
  2⤵
  PID:10972
- C:\Windows\System\xIZITcI.exe
  C:\Windows\System\xIZITcI.exe
  2⤵
  PID:11000
- C:\Windows\System\aRwNssd.exe
  C:\Windows\System\aRwNssd.exe
  2⤵
  PID:11028
- C:\Windows\System\BabUFyO.exe
  C:\Windows\System\BabUFyO.exe
  2⤵
  PID:11056
- C:\Windows\System\stqbxpz.exe
  C:\Windows\System\stqbxpz.exe
  2⤵
  PID:11084
- C:\Windows\System\NlafMfj.exe
  C:\Windows\System\NlafMfj.exe
  2⤵
  PID:11112
- C:\Windows\System\yuzrkMJ.exe
  C:\Windows\System\yuzrkMJ.exe
  2⤵
  PID:11140
- C:\Windows\System\IFxzOUK.exe
  C:\Windows\System\IFxzOUK.exe
  2⤵
  PID:11168
- C:\Windows\System\BfCbenH.exe
  C:\Windows\System\BfCbenH.exe
  2⤵
  PID:11196
- C:\Windows\System\uBvzDjQ.exe
  C:\Windows\System\uBvzDjQ.exe
  2⤵
  PID:11224
- C:\Windows\System\LVquPRj.exe
  C:\Windows\System\LVquPRj.exe
  2⤵
  PID:11252
- C:\Windows\System\iCmFqCx.exe
  C:\Windows\System\iCmFqCx.exe
  2⤵
  PID:10288
- C:\Windows\System\wkeoEBP.exe
  C:\Windows\System\wkeoEBP.exe
  2⤵
  PID:10344
- C:\Windows\System\oXyebds.exe
  C:\Windows\System\oXyebds.exe
  2⤵
  PID:10368
- C:\Windows\System\jCSVwIV.exe
  C:\Windows\System\jCSVwIV.exe
  2⤵
  PID:10464
- C:\Windows\System\IesxMyH.exe
  C:\Windows\System\IesxMyH.exe
  2⤵
  PID:10516
- C:\Windows\System\RcoWMMq.exe
  C:\Windows\System\RcoWMMq.exe
  2⤵
  PID:10576
- C:\Windows\System\ylYzzzx.exe
  C:\Windows\System\ylYzzzx.exe
  2⤵
  PID:10656
- C:\Windows\System\EPCGNUb.exe
  C:\Windows\System\EPCGNUb.exe
  2⤵
  PID:10716
- C:\Windows\System\foMbTZA.exe
  C:\Windows\System\foMbTZA.exe
  2⤵
  PID:10788
- C:\Windows\System\EanLSQJ.exe
  C:\Windows\System\EanLSQJ.exe
  2⤵
  PID:10852
- C:\Windows\System\EoMAvNQ.exe
  C:\Windows\System\EoMAvNQ.exe
  2⤵
  PID:10912
- C:\Windows\System\XetfgPi.exe
  C:\Windows\System\XetfgPi.exe
  2⤵
  PID:10984
- C:\Windows\System\EZnxncc.exe
  C:\Windows\System\EZnxncc.exe
  2⤵
  PID:11048
- C:\Windows\System\nIxLBed.exe
  C:\Windows\System\nIxLBed.exe
  2⤵
  PID:11108
- C:\Windows\System\YtnxQTX.exe
  C:\Windows\System\YtnxQTX.exe
  2⤵
  PID:11180
- C:\Windows\System\AfPgSQw.exe
  C:\Windows\System\AfPgSQw.exe
  2⤵
  PID:11240
- C:\Windows\System\UHDbuiD.exe
  C:\Windows\System\UHDbuiD.exe
  2⤵
  PID:10320
- C:\Windows\System\OFdkeAg.exe
  C:\Windows\System\OFdkeAg.exe
  2⤵
  PID:10460
- C:\Windows\System\wVOSLga.exe
  C:\Windows\System\wVOSLga.exe
  2⤵
  PID:10624
- C:\Windows\System\HpSbbSz.exe
  C:\Windows\System\HpSbbSz.exe
  2⤵
  PID:10768
- C:\Windows\System\CkymFud.exe
  C:\Windows\System\CkymFud.exe
  2⤵
  PID:10908
- C:\Windows\System\EFHoSet.exe
  C:\Windows\System\EFHoSet.exe
  2⤵
  PID:11080
- C:\Windows\System\yCwVtjQ.exe
  C:\Windows\System\yCwVtjQ.exe
  2⤵
  PID:11220
- C:\Windows\System\yMiEpuG.exe
  C:\Windows\System\yMiEpuG.exe
  2⤵
  PID:10444
- C:\Windows\System\dTmfgOx.exe
  C:\Windows\System\dTmfgOx.exe
  2⤵
  PID:10744
- C:\Windows\System\fvVwvov.exe
  C:\Windows\System\fvVwvov.exe
  2⤵
  PID:11164
- C:\Windows\System\VqafXaV.exe
  C:\Windows\System\VqafXaV.exe
  2⤵
  PID:10828
- C:\Windows\System\eapHcas.exe
  C:\Windows\System\eapHcas.exe
  2⤵
  PID:10396
- C:\Windows\System\DzuXJsa.exe
  C:\Windows\System\DzuXJsa.exe
  2⤵
  PID:11284
- C:\Windows\System\lcDsICz.exe
  C:\Windows\System\lcDsICz.exe
  2⤵
  PID:11312
- C:\Windows\System\ROwwmjm.exe
  C:\Windows\System\ROwwmjm.exe
  2⤵
  PID:11340
- C:\Windows\System\sGRZBAk.exe
  C:\Windows\System\sGRZBAk.exe
  2⤵
  PID:11368
- C:\Windows\System\boTEJMo.exe
  C:\Windows\System\boTEJMo.exe
  2⤵
  PID:11396
- C:\Windows\System\TwXtrLq.exe
  C:\Windows\System\TwXtrLq.exe
  2⤵
  PID:11424
- C:\Windows\System\hnuwQft.exe
  C:\Windows\System\hnuwQft.exe
  2⤵
  PID:11452
- C:\Windows\System\HPDucYs.exe
  C:\Windows\System\HPDucYs.exe
  2⤵
  PID:11480
- C:\Windows\System\HlgRrWX.exe
  C:\Windows\System\HlgRrWX.exe
  2⤵
  PID:11508
- C:\Windows\System\aDtchjc.exe
  C:\Windows\System\aDtchjc.exe
  2⤵
  PID:11536
- C:\Windows\System\FLTQDoL.exe
  C:\Windows\System\FLTQDoL.exe
  2⤵
  PID:11564
- C:\Windows\System\LCZAHBC.exe
  C:\Windows\System\LCZAHBC.exe
  2⤵
  PID:11592
- C:\Windows\System\DacxRlR.exe
  C:\Windows\System\DacxRlR.exe
  2⤵
  PID:11620
- C:\Windows\System\lFBxaHC.exe
  C:\Windows\System\lFBxaHC.exe
  2⤵
  PID:11648
- C:\Windows\System\hugQfrz.exe
  C:\Windows\System\hugQfrz.exe
  2⤵
  PID:11676
- C:\Windows\System\poSuxue.exe
  C:\Windows\System\poSuxue.exe
  2⤵
  PID:11704
- C:\Windows\System\sugPeWC.exe
  C:\Windows\System\sugPeWC.exe
  2⤵
  PID:11732
- C:\Windows\System\CnpDKoc.exe
  C:\Windows\System\CnpDKoc.exe
  2⤵
  PID:11760
- C:\Windows\System\XSFLPlo.exe
  C:\Windows\System\XSFLPlo.exe
  2⤵
  PID:11788
- C:\Windows\System\LokdXBM.exe
  C:\Windows\System\LokdXBM.exe
  2⤵
  PID:11816
- C:\Windows\System\GkuPtuR.exe
  C:\Windows\System\GkuPtuR.exe
  2⤵
  PID:11844
- C:\Windows\System\nEBpZrn.exe
  C:\Windows\System\nEBpZrn.exe
  2⤵
  PID:11872
- C:\Windows\System\kttKESA.exe
  C:\Windows\System\kttKESA.exe
  2⤵
  PID:11900
- C:\Windows\System\nbRPbOZ.exe
  C:\Windows\System\nbRPbOZ.exe
  2⤵
  PID:11928
- C:\Windows\System\JHmEEhV.exe
  C:\Windows\System\JHmEEhV.exe
  2⤵
  PID:11956
- C:\Windows\System\VZgqnFp.exe
  C:\Windows\System\VZgqnFp.exe
  2⤵
  PID:11984
- C:\Windows\System\fQuCpBa.exe
  C:\Windows\System\fQuCpBa.exe
  2⤵
  PID:12012
- C:\Windows\System\kFRTWzJ.exe
  C:\Windows\System\kFRTWzJ.exe
  2⤵
  PID:12040
- C:\Windows\System\iwUEhia.exe
  C:\Windows\System\iwUEhia.exe
  2⤵
  PID:12072
- C:\Windows\System\QbRPzto.exe
  C:\Windows\System\QbRPzto.exe
  2⤵
  PID:12100
- C:\Windows\System\FIMaqbw.exe
  C:\Windows\System\FIMaqbw.exe
  2⤵
  PID:12128
- C:\Windows\System\PeKhElp.exe
  C:\Windows\System\PeKhElp.exe
  2⤵
  PID:12160
- C:\Windows\System\yQoUdZo.exe
  C:\Windows\System\yQoUdZo.exe
  2⤵
  PID:12188
- C:\Windows\System\zAUjvDJ.exe
  C:\Windows\System\zAUjvDJ.exe
  2⤵
  PID:12216
- C:\Windows\System\eqtVutF.exe
  C:\Windows\System\eqtVutF.exe
  2⤵
  PID:12244
- C:\Windows\System\IaalpPQ.exe
  C:\Windows\System\IaalpPQ.exe
  2⤵
  PID:12272
- C:\Windows\System\OHxFgOZ.exe
  C:\Windows\System\OHxFgOZ.exe
  2⤵
  PID:11296
- C:\Windows\System\ghERaqF.exe
  C:\Windows\System\ghERaqF.exe
  2⤵
  PID:11364
- C:\Windows\System\IJwAAmn.exe
  C:\Windows\System\IJwAAmn.exe
  2⤵
  PID:11420
- C:\Windows\System\JMBesFW.exe
  C:\Windows\System\JMBesFW.exe
  2⤵
  PID:11496
- C:\Windows\System\SpwLOVQ.exe
  C:\Windows\System\SpwLOVQ.exe
  2⤵
  PID:11556
- C:\Windows\System\sHkVNtj.exe
  C:\Windows\System\sHkVNtj.exe
  2⤵
  PID:11616
- C:\Windows\System\DiDogzX.exe
  C:\Windows\System\DiDogzX.exe
  2⤵
  PID:11668
- C:\Windows\System\VuLoDHm.exe
  C:\Windows\System\VuLoDHm.exe
  2⤵
  PID:11744
- C:\Windows\System\xuIdyCS.exe
  C:\Windows\System\xuIdyCS.exe
  2⤵
  PID:11808
- C:\Windows\System\fRupJqp.exe
  C:\Windows\System\fRupJqp.exe
  2⤵
  PID:11868
- C:\Windows\System\wQMdnRK.exe
  C:\Windows\System\wQMdnRK.exe
  2⤵
  PID:11952
- C:\Windows\System\CkNnVPp.exe
  C:\Windows\System\CkNnVPp.exe
  2⤵
  PID:12024
- C:\Windows\System\vhldWTL.exe
  C:\Windows\System\vhldWTL.exe
  2⤵
  PID:12092
- C:\Windows\System\CGKOBwB.exe
  C:\Windows\System\CGKOBwB.exe
  2⤵
  PID:12156
- C:\Windows\System\mAamdfQ.exe
  C:\Windows\System\mAamdfQ.exe
  2⤵
  PID:12228
- C:\Windows\System\AeopbId.exe
  C:\Windows\System\AeopbId.exe
  2⤵
  PID:11276
- C:\Windows\System\vQiKxcC.exe
  C:\Windows\System\vQiKxcC.exe
  2⤵
  PID:11416
- C:\Windows\System\wuTfMBo.exe
  C:\Windows\System\wuTfMBo.exe
  2⤵
  PID:11584
- C:\Windows\System\nfBJFQw.exe
  C:\Windows\System\nfBJFQw.exe
  2⤵
  PID:11776
- C:\Windows\System\YxjzFCM.exe
  C:\Windows\System\YxjzFCM.exe
  2⤵
  PID:400
- C:\Windows\System\OVCDccA.exe
  C:\Windows\System\OVCDccA.exe
  2⤵
  PID:11912
- C:\Windows\System\mEBxVQj.exe
  C:\Windows\System\mEBxVQj.exe
  2⤵
  PID:11980
- C:\Windows\System\cMazRcp.exe
  C:\Windows\System\cMazRcp.exe
  2⤵
  PID:12140
- C:\Windows\System\wBvFHzK.exe
  C:\Windows\System\wBvFHzK.exe
  2⤵
  PID:12284
- C:\Windows\System\vkUYwRE.exe
  C:\Windows\System\vkUYwRE.exe
  2⤵
  PID:11660
- C:\Windows\System\RBOOBdc.exe
  C:\Windows\System\RBOOBdc.exe
  2⤵
  PID:11840
- C:\Windows\System\joeUAyV.exe
  C:\Windows\System\joeUAyV.exe
  2⤵
  PID:12088
- C:\Windows\System\hfLLMts.exe
  C:\Windows\System\hfLLMts.exe
  2⤵
  PID:11784
- C:\Windows\System\BHgowvF.exe
  C:\Windows\System\BHgowvF.exe
  2⤵
  PID:11528
- C:\Windows\System\HzifiNa.exe
  C:\Windows\System\HzifiNa.exe
  2⤵
  PID:12292
- C:\Windows\System\bcNqFao.exe
  C:\Windows\System\bcNqFao.exe
  2⤵
  PID:12320
- C:\Windows\System\mHXGznv.exe
  C:\Windows\System\mHXGznv.exe
  2⤵
  PID:12348
- C:\Windows\System\SBFDPdk.exe
  C:\Windows\System\SBFDPdk.exe
  2⤵
  PID:12376
- C:\Windows\System\oXenKPS.exe
  C:\Windows\System\oXenKPS.exe
  2⤵
  PID:12404
- C:\Windows\System\oKpmJOh.exe
  C:\Windows\System\oKpmJOh.exe
  2⤵
  PID:12432
- C:\Windows\System\lffdqcH.exe
  C:\Windows\System\lffdqcH.exe
  2⤵
  PID:12460
- C:\Windows\System\WnaAQdy.exe
  C:\Windows\System\WnaAQdy.exe
  2⤵
  PID:12488
- C:\Windows\System\OVDwgFY.exe
  C:\Windows\System\OVDwgFY.exe
  2⤵
  PID:12520
- C:\Windows\System\XfHuZEb.exe
  C:\Windows\System\XfHuZEb.exe
  2⤵
  PID:12556
- C:\Windows\System\PrraWLr.exe
  C:\Windows\System\PrraWLr.exe
  2⤵
  PID:12576
- C:\Windows\System\qHJDBVS.exe
  C:\Windows\System\qHJDBVS.exe
  2⤵
  PID:12604
- C:\Windows\System\qFrKwKK.exe
  C:\Windows\System\qFrKwKK.exe
  2⤵
  PID:12632
- C:\Windows\System\jpqvJgs.exe
  C:\Windows\System\jpqvJgs.exe
  2⤵
  PID:12660
- C:\Windows\System\uGVQuOV.exe
  C:\Windows\System\uGVQuOV.exe
  2⤵
  PID:12688
- C:\Windows\System\fQeDdzn.exe
  C:\Windows\System\fQeDdzn.exe
  2⤵
  PID:12716
- C:\Windows\System\VqmGzep.exe
  C:\Windows\System\VqmGzep.exe
  2⤵
  PID:12744
- C:\Windows\System\zuuurOF.exe
  C:\Windows\System\zuuurOF.exe
  2⤵
  PID:12772
- C:\Windows\System\dxMcOVo.exe
  C:\Windows\System\dxMcOVo.exe
  2⤵
  PID:12800
- C:\Windows\System\XaYJfdU.exe
  C:\Windows\System\XaYJfdU.exe
  2⤵
  PID:12828
- C:\Windows\System\ZrbhJwV.exe
  C:\Windows\System\ZrbhJwV.exe
  2⤵
  PID:12856
- C:\Windows\System\nLNRixj.exe
  C:\Windows\System\nLNRixj.exe
  2⤵
  PID:12884
- C:\Windows\System\pFzoiSg.exe
  C:\Windows\System\pFzoiSg.exe
  2⤵
  PID:12912
- C:\Windows\System\PrknVLL.exe
  C:\Windows\System\PrknVLL.exe
  2⤵
  PID:12940
- C:\Windows\System\dDkllnq.exe
  C:\Windows\System\dDkllnq.exe
  2⤵
  PID:12968
- C:\Windows\System\mERVLqF.exe
  C:\Windows\System\mERVLqF.exe
  2⤵
  PID:12996
- C:\Windows\System\GshXIuW.exe
  C:\Windows\System\GshXIuW.exe
  2⤵
  PID:13024
- C:\Windows\System\MfOlfgy.exe
  C:\Windows\System\MfOlfgy.exe
  2⤵
  PID:13052
- C:\Windows\System\uqxMZjF.exe
  C:\Windows\System\uqxMZjF.exe
  2⤵
  PID:13080
- C:\Windows\System\BKHZdvI.exe
  C:\Windows\System\BKHZdvI.exe
  2⤵
  PID:13108
- C:\Windows\System\BMDAfBV.exe
  C:\Windows\System\BMDAfBV.exe
  2⤵
  PID:13136
- C:\Windows\System\sSLdNuo.exe
  C:\Windows\System\sSLdNuo.exe
  2⤵
  PID:13164
- C:\Windows\System\EcfLBNe.exe
  C:\Windows\System\EcfLBNe.exe
  2⤵
  PID:13192
- C:\Windows\System\jhihRyO.exe
  C:\Windows\System\jhihRyO.exe
  2⤵
  PID:13220
- C:\Windows\System\jrhQdra.exe
  C:\Windows\System\jrhQdra.exe
  2⤵
  PID:13248
- C:\Windows\System\IHCrNcF.exe
  C:\Windows\System\IHCrNcF.exe
  2⤵
  PID:13272
- C:\Windows\System\emIDzKD.exe
  C:\Windows\System\emIDzKD.exe
  2⤵
  PID:13304
- C:\Windows\System\HpPSNTw.exe
  C:\Windows\System\HpPSNTw.exe
  2⤵
  PID:12340
- C:\Windows\System\gXilsVn.exe
  C:\Windows\System\gXilsVn.exe
  2⤵
  PID:12144
- C:\Windows\System\wWMUuwi.exe
  C:\Windows\System\wWMUuwi.exe
  2⤵
  PID:12456
- C:\Windows\System\iVYDyeH.exe
  C:\Windows\System\iVYDyeH.exe
  2⤵
  PID:12532
- C:\Windows\System\xgsLLmu.exe
  C:\Windows\System\xgsLLmu.exe
  2⤵
  PID:12596
- C:\Windows\System\hhVCvTn.exe
  C:\Windows\System\hhVCvTn.exe
  2⤵
  PID:12652
- C:\Windows\System\tFOQtRc.exe
  C:\Windows\System\tFOQtRc.exe
  2⤵
  PID:12728
- C:\Windows\System\ipnALiF.exe
  C:\Windows\System\ipnALiF.exe
  2⤵
  PID:12792
- C:\Windows\System\sWFxxee.exe
  C:\Windows\System\sWFxxee.exe
  2⤵
  PID:12852
- C:\Windows\System\iOjZJVY.exe
  C:\Windows\System\iOjZJVY.exe
  2⤵
  PID:12924
- C:\Windows\System\VQLdZaR.exe
  C:\Windows\System\VQLdZaR.exe
  2⤵
  PID:12988
- C:\Windows\System\gXAIuUv.exe
  C:\Windows\System\gXAIuUv.exe
  2⤵
  PID:13048
- C:\Windows\System\ervMYZE.exe
  C:\Windows\System\ervMYZE.exe
  2⤵
  PID:13120
- C:\Windows\System\jjqCtwY.exe
  C:\Windows\System\jjqCtwY.exe
  2⤵
  PID:13184
- C:\Windows\System\XyoDPgd.exe
  C:\Windows\System\XyoDPgd.exe
  2⤵
  PID:13244
- C:\Windows\System\PEKzIVc.exe
  C:\Windows\System\PEKzIVc.exe
  2⤵
  PID:12304
- C:\Windows\System\UXBUslF.exe
  C:\Windows\System\UXBUslF.exe
  2⤵
  PID:12448
- C:\Windows\System\SReKilZ.exe
  C:\Windows\System\SReKilZ.exe
  2⤵
  PID:12684
- C:\Windows\System\OsriIQI.exe
  C:\Windows\System\OsriIQI.exe
  2⤵
  PID:13076
- C:\Windows\System\KFSEXrC.exe
  C:\Windows\System\KFSEXrC.exe
  2⤵
  PID:13292
- C:\Windows\System\KImwPUu.exe
  C:\Windows\System\KImwPUu.exe
  2⤵
  PID:12908
- C:\Windows\System\oNpyiNu.exe
  C:\Windows\System\oNpyiNu.exe
  2⤵
  PID:3356
- C:\Windows\System\girBUxR.exe
  C:\Windows\System\girBUxR.exe
  2⤵
  PID:13240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a4hfl2qu.n3e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ARVhTPF.exe

Filesize
3.1MB

MD5
e66a3b85d10db02c8076cb843b4496e6

SHA1
7dfebfbde4374c454ab6b199efd2af7e474a8856

SHA256
3b10cd28fd4e9dda53762f98e5d761ba6690bf24e2fc992d968dbe3f083f63eb

SHA512
02b7301483447178d1389ba1c9d64590a3ab121746b50c748ec98309995d27c5c2c9358281b0ce9bcf3f0a1d5b6ea5a51d7fe6f68c358d629fd50902a5b5ec77

Download Submit
C:\Windows\System\BqyHbZP.exe

Filesize
3.1MB

MD5
9fed3f78e77290780406bd7be19d8a2f

SHA1
879b3606a5a5eaa5e9f5e6a95a1784c4c61a0844

SHA256
9b22b998ab7e6b9385a336db98b5277f4863bf6f7d4af994f3890ade644c2245

SHA512
f3c606f6abcf32cd0fcc9fc54a8cbb44336ea62ed616f1d7b7ca8a44fe2bb059fdb8a11c7d627367c27e16f958e796215ac4c3a0d162dda929cabcfff7cf7e7d

Download Submit
C:\Windows\System\ErkRUbo.exe

Filesize
3.1MB

MD5
9d800561429402fc5ac1b9966c2f0b6a

SHA1
c7802758c435c4ff0fcde00dcc1970ec6674942f

SHA256
241df04abbbcdf923a1856dff7732d1336e7338276af98f0ff1f7354947fa12e

SHA512
97947e480e62ede622f631c1074e0c3c9764539e3ccfafd36ac022151cb37d20b80892774a1f961a2e917bd8999c1e52625bc551060139cb35c0d390ea3c230b

Download Submit
C:\Windows\System\HqWrntB.exe

Filesize
3.1MB

MD5
17aed4ecb336aa00ec912338099ef896

SHA1
74d4f652a56d6949c74140e93e98560d274194c2

SHA256
7898bbb459c28063904d64d5094b76a7b95488741b2928e6669197471f63cecb

SHA512
678c0fde43261068031f411c78f86f4c46d861cc07da018dfd501c5a8b9202b369f9b8a0817379328c8af5c522e0772ae02cc17cfaae25a927e7fff4f579601e

Download Submit
C:\Windows\System\HypEywS.exe

Filesize
3.1MB

MD5
e71425c5b97614572c4650e0ed09796d

SHA1
fc86d444a2b700fa3cbfd884f0279ea92447aa11

SHA256
61816bb6a8eee9a1dfe6c29670151f446cba541ba2e7512ecce283db14fdc519

SHA512
655a8d8be0dcbfa6857fdf954050eee93f4faf94e903845b920154c73929b162982d1e94a3f6af0d4a6243572683c366e8a167ced1747cb552a7086c537e779a

Download Submit
C:\Windows\System\KQnvyaO.exe

Filesize
3.1MB

MD5
8e941165f1e2d137a9eebd5c2d69622e

SHA1
a373bf1f22bf258d6023d5e1919e90c49fd84c3e

SHA256
119ef92f76a4545f8d47a3e732812f903b67109e409c40e9b04f62415a16b505

SHA512
1b2a37b25e5a347cd5d0f6ff5ee796c2c7aa54ffb6834cb734cf5c30ecc42e3ec386eb44bbf0c013409f38ba7a0b7342ac3a19bef7519389de43239e9f2f76c5

Download Submit
C:\Windows\System\LYXhTmy.exe

Filesize
3.1MB

MD5
857752b310142699167454191108ef17

SHA1
bce2bae891ca86060c60a1c27823f3f27770c040

SHA256
2f981673e96e3e9ced1b1d20afafca1781accf2bf0e1415bdbdee4ef70a41183

SHA512
7bb575eafdda413c8930851d1105f0c257a22f0fd4248d012f730ce15900599cd43cf3f83cc5007b4f63648135256608e9343fb5f935e4e26c341a441ac932d3

Download Submit
C:\Windows\System\OUevYel.exe

Filesize
3.1MB

MD5
5583bf804d5c783fb527111385817a75

SHA1
650bf8e0811be40eb0b761e5c54efed2e9de9c5b

SHA256
9552327b435105ebbf14019dcc2a7163f5f09ef1f7f4851efec0a8dd385cd61a

SHA512
3027f70f093623ac082f08c11649a50ba817be796d9c6d8415e52a9de9e6545fe46433b1b9b9cc6697c66c24a1f2ec6184c870d9891d328062c50032b4214fca

Download Submit
C:\Windows\System\PmItEyT.exe

Filesize
3.1MB

MD5
49ac807adcd83dcc70db6f030cb346bb

SHA1
caca0ecd9c08a5431325533dff97945cb9c4e754

SHA256
06d7a9bf3e80dbb8f6e22ddf41c5e059d2e8ad273cf3e22d40c2bc831516977e

SHA512
c4f8bb0e7e188d179788bb496ebcffc1bf767d57fe2a41262cf8893f21b827a5d37dbd2240160e7c256ef28e2d9c96afd630bcb0f0f832bc7eebef991a034299

Download Submit
C:\Windows\System\SXcmvRU.exe

Filesize
3.1MB

MD5
5bc8b4f95916d5cf43f40dc3cd379899

SHA1
f495c8c16751f87ca5800aa39eabfada3649828d

SHA256
45921994aaefbf094e2fa9f0d7e8d4d39766011cdd22fd694a59a5d629d6ae14

SHA512
e47e10156f7bedf93011efdca81b025a81b70695bb6f29ea4ff7b0b3d54022d075ff3d7d1ed71e6bfbc84e38abb4837717e0a3421afad63650692f6ccd8e842a

Download Submit
C:\Windows\System\UOsCHWq.exe

Filesize
3.1MB

MD5
305d8c3946ecffd3efcc3272971b4e3d

SHA1
48fc856fe7ea3a2f1e0b0b397ac49132343be9a6

SHA256
16bd1474d9e7a0fb466a1d2ae80f13d8025dda435f7c6790a82b15f33e1a4696

SHA512
67fb35c6ae5f82647ee00226c04f652b64fb3fae2090689048f0333c51b3d04af1768234908a09369cc2484c6e3a78d314f343e37c8e893e3a958f85e87e6b58

Download Submit
C:\Windows\System\WEMuUez.exe

Filesize
3.1MB

MD5
e647972379aee3e0bb362ef983c17548

SHA1
40f8bd139fa01e0f74343e19f4797e5536613d46

SHA256
c114cb3ddad1156f2a9cbf9d9aa92dfc79ac9f96cb0e82fe3a9ef3d921f9138b

SHA512
18a0b2263be29c051b0194397f3bee5ea242524cfb4d39caa10374bc9fe25df4aaa396164b03ecb8a77e8aaee1da86e802ac3e5d31702f4301e481e8646f7d6e

Download Submit
C:\Windows\System\XbPqoiz.exe

Filesize
3.1MB

MD5
d7dc2ebe7fb1952fe7d4f06d35a7117b

SHA1
0822a9d5b32aab769b473b966709cb91da93cc00

SHA256
82b5463e1d499e5bdc5d6ac5a162fe0d2feba9ead6821de051e49c87bab34549

SHA512
526e0cd604db02b6179924e126980c5cc816472a7b38d332821c47322180c7db73b32fe24dec60db9ea38bc4ab29771dc7142fc730a6cbb2b248f77a5bf00306

Download Submit
C:\Windows\System\YjMtENW.exe

Filesize
3.1MB

MD5
d85ff0d9963172670e59a11aa283ed9a

SHA1
b8bb8759bb73e072a55e60f09d19ffd99e771cfb

SHA256
02ea31aedfcffdf5f2882d195c20397862c6e07fdd7da69556f41ca23488a452

SHA512
3f83ce113601b51cf076c337073c668c70b0e04c9f53c8e98e96c75fa415f47e9bd6fdf96b87039788251e51e724bb604b329f19fadfdd49125ff5efc009e746

Download Submit
C:\Windows\System\bmZmvMH.exe

Filesize
3.1MB

MD5
be5d62c622596a0c34b0ca86c469d85e

SHA1
ed76c5fd8ecf7215cfa75214fba08365749c1691

SHA256
0f1cb1fd810fc68e4ed01f378bf4320df38237d7331599923277f83bd04f1e14

SHA512
099ac50bb1bb5dc42bb54883725ac750c3a460463074d1dc7d8dac4b2512aea65cda86f9389749dd043073fc37f964f74bd9b16d3fa459ca52aac5fb381aeb50

Download Submit
C:\Windows\System\dmrdDMV.exe

Filesize
3.1MB

MD5
46d45e7485153bbbfcae6a9471cef9de

SHA1
58092e1c70f311e015aef2f60e811f94ba3b1a33

SHA256
51216c530eb4e81449f585a025b47e2472fbcdb47fed278e551c8a9da49a9f99

SHA512
def5057ad271e4e09c930ca9bdc8801af3d32b5d4834f6b4bc047f7e1d134351bee0e2f397c2f8489a694187a8b3e6fc7fc997e871d1ba61d719fa0691003353

Download Submit
C:\Windows\System\dnukPFr.exe

Filesize
3.1MB

MD5
ed922387526d539fd7a2861aa94632b6

SHA1
cdc84d44b18e004766425f5f357d1d23280e6b6a

SHA256
5112f15660283ce07b3cb7a32f6c8daf78fd7e23197ded62af3edbdfe002595a

SHA512
4944c8fe07fb3ecb24fcde1c7528cadf6a715b4f7a25340e4142e72388a454914e0db86b00eb0084de6158d5d97a6068ba9f9cef7da67349af1652cf4f236825

Download Submit
C:\Windows\System\fXujLXH.exe

Filesize
3.1MB

MD5
3312dbbdc0370ea22fff491ffba36209

SHA1
ff3142c6554bb8354638732a0e35779b445d59e8

SHA256
ef468b69ea95bc2f77b8ffe425d8b99a40941735a50f3ee15a7ae34f205838f2

SHA512
68d8781dae8e933c2f31e1a50b114ba869c9ffcc0d16e0f906c1467cc4f6ea692c3adf660a2418bd2bc14fcab9a6bf4e7ffb4e169c4d0478bd7e175eda827127

Download Submit
C:\Windows\System\gnidRGO.exe

Filesize
3.1MB

MD5
59c4607fb7013ce72121d54b2995f5bf

SHA1
977f215a4f9018b6b24f8584b3c5cda0dcf04503

SHA256
e8a767652aac587d06ef783299397df0a84680e2537f2449f740bfb7e8450b6b

SHA512
3d9ab6984adfa897ad4e88ea3b9d6b73ac05ba597668f79267118678bf9821c34c20adee73596da123b4c76ca37ef49b2f4b669ef42f3d6e8882df9570044a8e

Download Submit
C:\Windows\System\lvLiWux.exe

Filesize
3.1MB

MD5
0b01a9a7ece1b12ad0255e4e586d8028

SHA1
618572de8daccbe79754a6bec37fad0b9eb512d4

SHA256
8bc70dba9a4eadead416080d90513e6de1e33ec267ddf72097ef83f398e2df69

SHA512
73188d7023c2be81ff19976466f00c954f514c85baa0ae826dae28bf88fc2d9ae7c8fbdd7c28d22a90d929971850bd37082d1f5e15f06a98a0e4c20010691df4

Download Submit
C:\Windows\System\mDPDYKq.exe

Filesize
3.1MB

MD5
517d4ecab9039e532fe949d8d67e71fc

SHA1
fbc1a5895afb50e6098ced0dc0a227984667722b

SHA256
4b207a0467ef3acd7b2a5f5c36da0167fab90579a474ff66d5ad310e0e87a8c8

SHA512
2b18a23b3c4ee58c056766c963eddbb1a6e924883f806e001d3304c5eee04e8f2305baa4b9609e8fa077c6cb8057845fdb248c0d725aa8f755d0ca09ca2744ff

Download Submit
C:\Windows\System\nAetehb.exe

Filesize
3.1MB

MD5
6d9177f41917dc52e91cae8c3a36a774

SHA1
2d446d661202badcb87737c1ac7c167a738a84d8

SHA256
de4a4a8b8edd339db4966ad45c3dd66b79d83a613a709a4fc12880f1b304b5e4

SHA512
72673118313e26dbc68e179ab0dda72b5ac870c65236fda3f342218b11af943bc12bb16bbfa399ee34a621b21f12268790e4c4892007cd8407f22bf0c54dc0fc

Download Submit
C:\Windows\System\nFiXhvk.exe

Filesize
3.1MB

MD5
886eb8178b43e2ba2ca46a917f6bdcaa

SHA1
68a13616910e4d8fce0e9d489c83b9fb02ebb544

SHA256
391c72377b13117d0158368c5e154dd107458b9f31ff888b7096e9023609aa76

SHA512
a1e84c64af02037b4bd13c1b2cd9d575f7f8be523c2b86bee24a7e9210c382b61da597b09cadcc829fd30187b392c0162dd2dbcf04790c843fe05502ed01069c

Download Submit
C:\Windows\System\oAhWNLK.exe

Filesize
3.1MB

MD5
af9d48007d03eb2b73d5e94592138965

SHA1
c88e9326bc82b2f12d78ff77db3c7f4690ad5c22

SHA256
d4dc932a86763b73de69343ab566e37aaf7f45d0594ad0ddc29f189327a06c1f

SHA512
4fecc5fe8969c9668f3fe83cc64ec63d98131ef6e53166c3ee7e0faa0fb66b700006f7fd89b3893b1baa051c73d93ea80ad95414ea9e1737be645c3a3b0dfe2a

Download Submit
C:\Windows\System\qdwLNrh.exe

Filesize
3.1MB

MD5
ea1daf4e76c54c36d195558f1aa2c064

SHA1
2b580637b159de4e7959055f9dbf33235477326a

SHA256
1be4ae9dedade23a8195997832adcf25b7ba1b1f825ad6b35d9481d0c817b271

SHA512
f45d8aebedf5c24e5a92a5b1079993b706ba6d778e6962518b0f6aab5e413a84d1c2e6264750e4730c017e3ea4641ca40a4fef607236ca5b122da1e240f8c156

Download Submit
C:\Windows\System\sYUwWjg.exe

Filesize
3.1MB

MD5
840e619f132ec78a80a3b0f2bac1b7ee

SHA1
bca28ff6cfefb5a91c7e67a35cb223d887bd5e72

SHA256
5a55b2c62020dbff386c2873ebc8a2a27d53fb077cec85e98d7e85e621c8df9c

SHA512
5e79d8e9865701bd852cf9fdf7bf74ebb1a1b81f9337925ba8cbcb9fb9095277aa5a38691dac55e70f7f2e979b7c92ec960dd9cef092fb7e7478f0b5666d63f7

Download Submit
C:\Windows\System\thOgqhM.exe

Filesize
3.1MB

MD5
761a738486ad8c3d637abb6a98046742

SHA1
060d469343ed0e2494f907578ede1cb62d79681f

SHA256
98eb94af49b8326086d3959ca1a243d7c2719bc013c69fd866365c5eb93ab2be

SHA512
0c7676dc608649cc5e488486a2a3571770ad7e73d728758d376379e573464276018a9e7b188bc22c28a061f52f638fd3321a977db048841a87cdddd2014246ee

Download Submit
C:\Windows\System\uAwmGQY.exe

Filesize
3.1MB

MD5
94ea81b5cd5a68f6565cd03acf3f48ae

SHA1
5e269fe8dc6b87e7375474da115e0d1e2949f930

SHA256
77d4d72247d1ebd0805574711d06395b36019152a969df5b2eb4bf2dc560406d

SHA512
d24e97ccfcdd53bd68d35d2d613c5b0fbae5fef76a4ca2b128a3843dc87cfa20f5e4603ebaa9b49ffe00316a84c70f8b1ffcf8ef150a4392e70564dd942e4685

Download Submit
C:\Windows\System\uiPPDnf.exe

Filesize
3.1MB

MD5
42f0b4bfe804d50a423bd3b9cb9036ac

SHA1
7674b959ccf50c8772531ffdfdf1f75f290cbb7c

SHA256
6d7a17c9ed05877c825ea313926456622ac523c62a52a65754cf6decf5ae07b9

SHA512
26dd443da8ab8be0a1ad5a15d78b3923beb4b682a9e5d01b3442ada77a6ef431cac408d0723d6ea0c735e3f5cc7046ac571dcc359cf234f7d22f53f7169a7071

Download Submit
C:\Windows\System\vCKvoXl.exe

Filesize
3.1MB

MD5
a8f6de1e9b9af46678ef27a0c2c83930

SHA1
ff9461020c496d8f112d05adbeea5ed614269ea4

SHA256
9333b575a5703ea7ea5c0b26f4b94440f5aeb3a8a13f83614a0cefe7905606a8

SHA512
b0adf010a356cedf56437ed48365d817a04c08ab92485504576d2cbb0796614c17ccd4587f5b1cbe262a20846305594b635d6f9da6791a4d5c7a172d404a4db1

Download Submit
C:\Windows\System\wKTLUim.exe

Filesize
3.1MB

MD5
59530c487a6023361a93e1189b7d0b63

SHA1
e872bd01521ba82ff500aaee790156558a9a4eb5

SHA256
2a2b8463c832909933a215cce7164c38c02f2cdf36350026de92426cac1dd468

SHA512
8e193916f9c57d38c1f7a2981550af9efa1cb9c8966d4cbcef1ce2ce13836b942a6fd04bb3f5289daeffb35da45fcf91f052c2a5e6a0f5ce5764325ba4242a94

Download Submit
C:\Windows\System\yBGpwuM.exe

Filesize
3.1MB

MD5
546658c173340ebc73c5c2d175adf264

SHA1
07ba35d2703eb48788da594205f2366bbe5827c9

SHA256
518dac8aa4b1758d09b21dc0548486552e0ffba0c438583e1e65ff006719ca6a

SHA512
0446a5b4495b24c655e99b9d7fdc5f45bae78e641d9981d634dae8fb503ed1a1a688df0a8bfff381f4210840aa904122aa6a49d6177ec471d3749f10309bc061

Download Submit
C:\Windows\System\zSsHzvQ.exe

Filesize
3.1MB

MD5
4b7e0902ea0b29cdfae6c35b8f73ad19

SHA1
ab7c900511cd2150b9bee32316b41da83a0a065a

SHA256
28e84f52930bcfce00afcd3a17068f23fb8031d5abe45185078fa92c5a8d7996

SHA512
84f271694b48302a19579c05136cd1780d877da14ea68c14d0fa6c4e04c8993dc90a2497f7cd5547c40f7cd3552d4ae74e702756e22cb140d01933377c006e27

Download Submit
memory/324-1-0x000002C647940000-0x000002C647950000-memory.dmp

Filesize
64KB

Download
memory/324-1280-0x00007FF704860000-0x00007FF704C56000-memory.dmp

Filesize
4.0MB

Download
memory/324-0-0x00007FF704860000-0x00007FF704C56000-memory.dmp

Filesize
4.0MB

Download
memory/376-86-0x00007FF6213F0000-0x00007FF6217E6000-memory.dmp

Filesize
4.0MB

Download
memory/376-3040-0x00007FF6213F0000-0x00007FF6217E6000-memory.dmp

Filesize
4.0MB

Download
memory/380-108-0x00007FF7199A0000-0x00007FF719D96000-memory.dmp

Filesize
4.0MB

Download
memory/380-3042-0x00007FF7199A0000-0x00007FF719D96000-memory.dmp

Filesize
4.0MB

Download
memory/536-3044-0x00007FF7EE890000-0x00007FF7EEC86000-memory.dmp

Filesize
4.0MB

Download
memory/536-131-0x00007FF7EE890000-0x00007FF7EEC86000-memory.dmp

Filesize
4.0MB

Download
memory/1068-81-0x00007FF67DCA0000-0x00007FF67E096000-memory.dmp

Filesize
4.0MB

Download
memory/1068-3041-0x00007FF67DCA0000-0x00007FF67E096000-memory.dmp

Filesize
4.0MB

Download
memory/1312-3033-0x00007FF7D0CB0000-0x00007FF7D10A6000-memory.dmp

Filesize
4.0MB

Download
memory/1312-64-0x00007FF7D0CB0000-0x00007FF7D10A6000-memory.dmp

Filesize
4.0MB

Download
memory/1584-107-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp

Filesize
4.0MB

Download
memory/1584-3043-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp

Filesize
4.0MB

Download
memory/1584-1889-0x00007FF6FA1B0000-0x00007FF6FA5A6000-memory.dmp

Filesize
4.0MB

Download
memory/1736-85-0x00007FF657EF0000-0x00007FF6582E6000-memory.dmp

Filesize
4.0MB

Download
memory/1736-3034-0x00007FF657EF0000-0x00007FF6582E6000-memory.dmp

Filesize
4.0MB

Download
memory/1784-142-0x00007FF773880000-0x00007FF773C76000-memory.dmp

Filesize
4.0MB

Download
memory/1784-3048-0x00007FF773880000-0x00007FF773C76000-memory.dmp

Filesize
4.0MB

Download
memory/1888-185-0x00007FF74EF60000-0x00007FF74F356000-memory.dmp

Filesize
4.0MB

Download
memory/1888-3053-0x00007FF74EF60000-0x00007FF74F356000-memory.dmp

Filesize
4.0MB

Download
memory/2120-3032-0x00007FF757000000-0x00007FF7573F6000-memory.dmp

Filesize
4.0MB

Download
memory/2120-84-0x00007FF757000000-0x00007FF7573F6000-memory.dmp

Filesize
4.0MB

Download
memory/2172-3035-0x00007FF6E26B0000-0x00007FF6E2AA6000-memory.dmp

Filesize
4.0MB

Download
memory/2172-75-0x00007FF6E26B0000-0x00007FF6E2AA6000-memory.dmp

Filesize
4.0MB

Download
memory/2452-3037-0x00007FF7CE170000-0x00007FF7CE566000-memory.dmp

Filesize
4.0MB

Download
memory/2452-77-0x00007FF7CE170000-0x00007FF7CE566000-memory.dmp

Filesize
4.0MB

Download
memory/2704-106-0x00000124FCB50000-0x00000124FD2F6000-memory.dmp

Filesize
7.6MB

Download
memory/2704-28-0x00007FFCEE8A0000-0x00007FFCEF361000-memory.dmp

Filesize
10.8MB

Download
memory/2704-5-0x00007FFCEE8A3000-0x00007FFCEE8A5000-memory.dmp

Filesize
8KB

Download
memory/2704-1285-0x00007FFCEE8A0000-0x00007FFCEF361000-memory.dmp

Filesize
10.8MB

Download
memory/2704-19-0x00007FFCEE8A0000-0x00007FFCEF361000-memory.dmp

Filesize
10.8MB

Download
memory/2704-1583-0x00007FFCEE8A3000-0x00007FFCEE8A5000-memory.dmp

Filesize
8KB

Download
memory/2704-42-0x00000124E1C00000-0x00000124E1C22000-memory.dmp

Filesize
136KB

Download
memory/2756-140-0x00007FF65DA00000-0x00007FF65DDF6000-memory.dmp

Filesize
4.0MB

Download
memory/2756-3046-0x00007FF65DA00000-0x00007FF65DDF6000-memory.dmp

Filesize
4.0MB

Download
memory/2768-3030-0x00007FF73EA10000-0x00007FF73EE06000-memory.dmp

Filesize
4.0MB

Download
memory/2768-50-0x00007FF73EA10000-0x00007FF73EE06000-memory.dmp

Filesize
4.0MB

Download
memory/3048-3036-0x00007FF6EE8E0000-0x00007FF6EECD6000-memory.dmp

Filesize
4.0MB

Download
memory/3048-82-0x00007FF6EE8E0000-0x00007FF6EECD6000-memory.dmp

Filesize
4.0MB

Download
memory/3152-175-0x00007FF6009A0000-0x00007FF600D96000-memory.dmp

Filesize
4.0MB

Download
memory/3152-3052-0x00007FF6009A0000-0x00007FF600D96000-memory.dmp

Filesize
4.0MB

Download
memory/3648-87-0x00007FF68AFB0000-0x00007FF68B3A6000-memory.dmp

Filesize
4.0MB

Download
memory/3648-3038-0x00007FF68AFB0000-0x00007FF68B3A6000-memory.dmp

Filesize
4.0MB

Download
memory/3844-3029-0x00007FF7FE170000-0x00007FF7FE566000-memory.dmp

Filesize
4.0MB

Download
memory/3844-83-0x00007FF7FE170000-0x00007FF7FE566000-memory.dmp

Filesize
4.0MB

Download
memory/3920-149-0x00007FF60BEF0000-0x00007FF60C2E6000-memory.dmp

Filesize
4.0MB

Download
memory/3920-3051-0x00007FF60BEF0000-0x00007FF60C2E6000-memory.dmp

Filesize
4.0MB

Download
memory/3976-122-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp

Filesize
4.0MB

Download
memory/3976-1892-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp

Filesize
4.0MB

Download
memory/3976-3045-0x00007FF7A57F0000-0x00007FF7A5BE6000-memory.dmp

Filesize
4.0MB

Download
memory/4036-3031-0x00007FF7A8360000-0x00007FF7A8756000-memory.dmp

Filesize
4.0MB

Download
memory/4036-56-0x00007FF7A8360000-0x00007FF7A8756000-memory.dmp

Filesize
4.0MB

Download
memory/4108-3049-0x00007FF7A6980000-0x00007FF7A6D76000-memory.dmp

Filesize
4.0MB

Download
memory/4108-134-0x00007FF7A6980000-0x00007FF7A6D76000-memory.dmp

Filesize
4.0MB

Download
memory/4980-143-0x00007FF6B9A00000-0x00007FF6B9DF6000-memory.dmp

Filesize
4.0MB

Download
memory/4980-3047-0x00007FF6B9A00000-0x00007FF6B9DF6000-memory.dmp

Filesize
4.0MB

Download
memory/5084-145-0x00007FF787820000-0x00007FF787C16000-memory.dmp

Filesize
4.0MB

Download
memory/5084-3050-0x00007FF787820000-0x00007FF787C16000-memory.dmp

Filesize
4.0MB

Download