xmrig | 86f9f0932184316327ad8bbeeb822ac7f982fcad7b71d1a31b39adb2ddf1331a

Analysis

max time kernel
65s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
Size

2.9MB
MD5

6075d826cb700dc5cb65e01633007340
SHA1

1ef6fea3fb2f5486b3d3a548938d3a7a757b72b7
SHA256

86f9f0932184316327ad8bbeeb822ac7f982fcad7b71d1a31b39adb2ddf1331a
SHA512

2f12f9d0af530e78b402830d83385cf7c6c0b7b0cc51ee5cc38b175f2606a211b29f31bf13a37e91ebc98d6f26e8f907caa997b8602c4c3808274f73cd788fb0
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IlnASEx/mlV:71ONtyBeSFkXV1etEKLlWUTOfeiRA2Rd

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3708-0-0x00007FF696ED0000-0x00007FF6972C6000-memory.dmp	xmrig
behavioral2/files/0x000700000002340e-7.dat	xmrig
behavioral2/files/0x000700000002340f-21.dat	xmrig
behavioral2/files/0x0007000000023412-35.dat	xmrig
behavioral2/files/0x0007000000023415-52.dat	xmrig
behavioral2/files/0x0007000000023414-61.dat	xmrig
behavioral2/files/0x0007000000023418-72.dat	xmrig
behavioral2/files/0x000700000002341d-97.dat	xmrig
behavioral2/files/0x0007000000023419-108.dat	xmrig
behavioral2/files/0x000700000002341e-122.dat	xmrig
behavioral2/memory/4728-130-0x00007FF697650000-0x00007FF697A46000-memory.dmp	xmrig
behavioral2/memory/4156-135-0x00007FF712E50000-0x00007FF713246000-memory.dmp	xmrig
behavioral2/memory/1612-138-0x00007FF6A1960000-0x00007FF6A1D56000-memory.dmp	xmrig
behavioral2/memory/1188-142-0x00007FF6664D0000-0x00007FF6668C6000-memory.dmp	xmrig
behavioral2/memory/4948-146-0x00007FF643380000-0x00007FF643776000-memory.dmp	xmrig
behavioral2/files/0x000800000002340a-151.dat	xmrig
behavioral2/files/0x0007000000023428-181.dat	xmrig
behavioral2/memory/1968-188-0x00007FF68A900000-0x00007FF68ACF6000-memory.dmp	xmrig
behavioral2/memory/3288-215-0x00007FF729090000-0x00007FF729486000-memory.dmp	xmrig
behavioral2/files/0x0007000000023427-205.dat	xmrig
behavioral2/files/0x0007000000023426-200.dat	xmrig
behavioral2/files/0x0007000000023425-197.dat	xmrig
behavioral2/files/0x0007000000023424-195.dat	xmrig
behavioral2/files/0x0008000000023422-193.dat	xmrig
behavioral2/files/0x000700000002342c-187.dat	xmrig
behavioral2/files/0x0008000000023421-185.dat	xmrig
behavioral2/files/0x000700000002342b-184.dat	xmrig
behavioral2/files/0x000700000002342a-183.dat	xmrig
behavioral2/files/0x0007000000023429-182.dat	xmrig
behavioral2/memory/4916-147-0x00007FF778C20000-0x00007FF779016000-memory.dmp	xmrig
behavioral2/memory/2652-145-0x00007FF78A490000-0x00007FF78A886000-memory.dmp	xmrig
behavioral2/memory/3580-144-0x00007FF727C40000-0x00007FF728036000-memory.dmp	xmrig
behavioral2/memory/2344-143-0x00007FF772A40000-0x00007FF772E36000-memory.dmp	xmrig
behavioral2/memory/2608-141-0x00007FF6EDB90000-0x00007FF6EDF86000-memory.dmp	xmrig
behavioral2/memory/2300-140-0x00007FF7DAF60000-0x00007FF7DB356000-memory.dmp	xmrig
behavioral2/memory/4848-139-0x00007FF639420000-0x00007FF639816000-memory.dmp	xmrig
behavioral2/memory/3528-137-0x00007FF7194D0000-0x00007FF7198C6000-memory.dmp	xmrig
behavioral2/memory/2316-136-0x00007FF6FB7B0000-0x00007FF6FBBA6000-memory.dmp	xmrig
behavioral2/memory/2780-134-0x00007FF701B20000-0x00007FF701F16000-memory.dmp	xmrig
behavioral2/files/0x0007000000023423-132.dat	xmrig
behavioral2/memory/4168-131-0x00007FF655FF0000-0x00007FF6563E6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023420-127.dat	xmrig
behavioral2/files/0x000700000002341f-125.dat	xmrig
behavioral2/memory/892-124-0x00007FF61BF00000-0x00007FF61C2F6000-memory.dmp	xmrig
behavioral2/files/0x000700000002341c-118.dat	xmrig
behavioral2/memory/4880-113-0x00007FF79FEB0000-0x00007FF7A02A6000-memory.dmp	xmrig
behavioral2/files/0x000700000002341b-112.dat	xmrig
behavioral2/files/0x000700000002341a-110.dat	xmrig
behavioral2/memory/2668-102-0x00007FF638F90000-0x00007FF639386000-memory.dmp	xmrig
behavioral2/files/0x0007000000023416-99.dat	xmrig
behavioral2/files/0x0007000000023417-95.dat	xmrig
behavioral2/memory/3016-82-0x00007FF62BC10000-0x00007FF62C006000-memory.dmp	xmrig
behavioral2/files/0x0007000000023413-75.dat	xmrig
behavioral2/memory/4452-47-0x00007FF79B350000-0x00007FF79B746000-memory.dmp	xmrig
behavioral2/files/0x0007000000023411-50.dat	xmrig
behavioral2/files/0x0007000000023410-39.dat	xmrig
behavioral2/memory/2312-36-0x00007FF6DDFD0000-0x00007FF6DE3C6000-memory.dmp	xmrig
behavioral2/files/0x000700000002340d-15.dat	xmrig
behavioral2/files/0x0008000000023409-23.dat	xmrig
behavioral2/memory/2300-2036-0x00007FF7DAF60000-0x00007FF7DB356000-memory.dmp	xmrig
behavioral2/memory/3016-2038-0x00007FF62BC10000-0x00007FF62C006000-memory.dmp	xmrig
behavioral2/memory/2312-2037-0x00007FF6DDFD0000-0x00007FF6DE3C6000-memory.dmp	xmrig
behavioral2/memory/4452-2039-0x00007FF79B350000-0x00007FF79B746000-memory.dmp	xmrig
behavioral2/memory/2668-2040-0x00007FF638F90000-0x00007FF639386000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4764	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2312	JYCwnEZ.exe
2300	PYDtaht.exe
4452	AhImQQP.exe
3016	fERnyXz.exe
2668	OccZlvF.exe
2608	QZoTWKD.exe
4880	bYAzaml.exe
1188	mCTdjmU.exe
892	lQOwEmG.exe
2344	BvhPzZe.exe
4728	TxFOpVE.exe
4168	qUrqvHw.exe
3580	FeNlSRE.exe
2780	GrRThrr.exe
4156	JWUUGso.exe
2316	ZXQTpGO.exe
3528	XctTXDv.exe
2652	uAscyzK.exe
1612	ywCHdRg.exe
4948	ZFcyYbk.exe
4848	PFtgnVE.exe
4916	hLdFbCX.exe
1968	ZBtWucn.exe
3288	GlMmoJs.exe
1212	jWqlPvd.exe
1600	lYxCAoB.exe
1876	mLPpQOx.exe
4940	DEitRSQ.exe
3028	gBmXTdU.exe
1244	sXYKGTD.exe
3984	TrfRxDu.exe
4144	nqdnkss.exe
2476	JrqAWoS.exe
1692	dFhFoOo.exe
1280	LrLdvrk.exe
856	lgJGMvw.exe
1276	ULHqalU.exe
3572	bvkAuCI.exe
4544	MVBrUFe.exe
4592	Zaoxkcw.exe
4912	fgEhJZO.exe
3888	eoZEEwk.exe
2820	gTaElaQ.exe
4424	rnByXuG.exe
636	btwhAox.exe
4636	RqpuAZI.exe
1764	opEyYBI.exe
2856	QlJCIGA.exe
4216	XTrjmUn.exe
548	tmkCIYH.exe
1260	SoAOFXr.exe
4228	zrbJTdT.exe
4628	JbYIBxw.exe
4976	PxnaSfG.exe
3148	ttlIAOi.exe
2836	qgcCeQH.exe
5064	ddsGsHA.exe
3852	UytKwoP.exe
2216	EScuwZI.exe
1604	ZMQqjie.exe
2176	CFvIlUL.exe
3516	mdSWqSu.exe
3772	UqJHvFI.exe
1668	BTfBwgD.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3708-0-0x00007FF696ED0000-0x00007FF6972C6000-memory.dmp	upx
behavioral2/files/0x000700000002340e-7.dat	upx
behavioral2/files/0x000700000002340f-21.dat	upx
behavioral2/files/0x0007000000023412-35.dat	upx
behavioral2/files/0x0007000000023415-52.dat	upx
behavioral2/files/0x0007000000023414-61.dat	upx
behavioral2/files/0x0007000000023418-72.dat	upx
behavioral2/files/0x000700000002341d-97.dat	upx
behavioral2/files/0x0007000000023419-108.dat	upx
behavioral2/files/0x000700000002341e-122.dat	upx
behavioral2/memory/4728-130-0x00007FF697650000-0x00007FF697A46000-memory.dmp	upx
behavioral2/memory/4156-135-0x00007FF712E50000-0x00007FF713246000-memory.dmp	upx
behavioral2/memory/1612-138-0x00007FF6A1960000-0x00007FF6A1D56000-memory.dmp	upx
behavioral2/memory/1188-142-0x00007FF6664D0000-0x00007FF6668C6000-memory.dmp	upx
behavioral2/memory/4948-146-0x00007FF643380000-0x00007FF643776000-memory.dmp	upx
behavioral2/files/0x000800000002340a-151.dat	upx
behavioral2/files/0x0007000000023428-181.dat	upx
behavioral2/memory/1968-188-0x00007FF68A900000-0x00007FF68ACF6000-memory.dmp	upx
behavioral2/memory/3288-215-0x00007FF729090000-0x00007FF729486000-memory.dmp	upx
behavioral2/files/0x0007000000023427-205.dat	upx
behavioral2/files/0x0007000000023426-200.dat	upx
behavioral2/files/0x0007000000023425-197.dat	upx
behavioral2/files/0x0007000000023424-195.dat	upx
behavioral2/files/0x0008000000023422-193.dat	upx
behavioral2/files/0x000700000002342c-187.dat	upx
behavioral2/files/0x0008000000023421-185.dat	upx
behavioral2/files/0x000700000002342b-184.dat	upx
behavioral2/files/0x000700000002342a-183.dat	upx
behavioral2/files/0x0007000000023429-182.dat	upx
behavioral2/memory/4916-147-0x00007FF778C20000-0x00007FF779016000-memory.dmp	upx
behavioral2/memory/2652-145-0x00007FF78A490000-0x00007FF78A886000-memory.dmp	upx
behavioral2/memory/3580-144-0x00007FF727C40000-0x00007FF728036000-memory.dmp	upx
behavioral2/memory/2344-143-0x00007FF772A40000-0x00007FF772E36000-memory.dmp	upx
behavioral2/memory/2608-141-0x00007FF6EDB90000-0x00007FF6EDF86000-memory.dmp	upx
behavioral2/memory/2300-140-0x00007FF7DAF60000-0x00007FF7DB356000-memory.dmp	upx
behavioral2/memory/4848-139-0x00007FF639420000-0x00007FF639816000-memory.dmp	upx
behavioral2/memory/3528-137-0x00007FF7194D0000-0x00007FF7198C6000-memory.dmp	upx
behavioral2/memory/2316-136-0x00007FF6FB7B0000-0x00007FF6FBBA6000-memory.dmp	upx
behavioral2/memory/2780-134-0x00007FF701B20000-0x00007FF701F16000-memory.dmp	upx
behavioral2/files/0x0007000000023423-132.dat	upx
behavioral2/memory/4168-131-0x00007FF655FF0000-0x00007FF6563E6000-memory.dmp	upx
behavioral2/files/0x0007000000023420-127.dat	upx
behavioral2/files/0x000700000002341f-125.dat	upx
behavioral2/memory/892-124-0x00007FF61BF00000-0x00007FF61C2F6000-memory.dmp	upx
behavioral2/files/0x000700000002341c-118.dat	upx
behavioral2/memory/4880-113-0x00007FF79FEB0000-0x00007FF7A02A6000-memory.dmp	upx
behavioral2/files/0x000700000002341b-112.dat	upx
behavioral2/files/0x000700000002341a-110.dat	upx
behavioral2/memory/2668-102-0x00007FF638F90000-0x00007FF639386000-memory.dmp	upx
behavioral2/files/0x0007000000023416-99.dat	upx
behavioral2/files/0x0007000000023417-95.dat	upx
behavioral2/memory/3016-82-0x00007FF62BC10000-0x00007FF62C006000-memory.dmp	upx
behavioral2/files/0x0007000000023413-75.dat	upx
behavioral2/memory/4452-47-0x00007FF79B350000-0x00007FF79B746000-memory.dmp	upx
behavioral2/files/0x0007000000023411-50.dat	upx
behavioral2/files/0x0007000000023410-39.dat	upx
behavioral2/memory/2312-36-0x00007FF6DDFD0000-0x00007FF6DE3C6000-memory.dmp	upx
behavioral2/files/0x000700000002340d-15.dat	upx
behavioral2/files/0x0008000000023409-23.dat	upx
behavioral2/memory/2300-2036-0x00007FF7DAF60000-0x00007FF7DB356000-memory.dmp	upx
behavioral2/memory/3016-2038-0x00007FF62BC10000-0x00007FF62C006000-memory.dmp	upx
behavioral2/memory/2312-2037-0x00007FF6DDFD0000-0x00007FF6DE3C6000-memory.dmp	upx
behavioral2/memory/4452-2039-0x00007FF79B350000-0x00007FF79B746000-memory.dmp	upx
behavioral2/memory/2668-2040-0x00007FF638F90000-0x00007FF639386000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PMIIWyg.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\EdHfYzQ.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\wGcuUWE.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\BlWDYSl.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\SyYMDdk.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\NZxdSXV.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\vqinZvd.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\TGHnMPE.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\IbuKfJf.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\khQLCho.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\NixDyPB.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\IAfnnBX.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\SviTbBN.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\mqwJXYy.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\MRVtSLL.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\xYHUkgU.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\UHuBBEV.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\ACHiaDV.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\qYhTrXs.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\wVLtDhM.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\NPUyHPC.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\MjmfPPr.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\BnCiAmz.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\bijCffz.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\fHkFXNr.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\pKxPtxw.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\XqogMvN.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\TLJNudr.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\VDeFedd.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\SIiJByR.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\KhJJgGq.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\QUKTsYk.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\oGDYQHF.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\bVHWSkP.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\ukwIuVa.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\AUJQZRl.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\UvSNodM.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\dynRmVd.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\MJdjyrh.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\YGpZIbI.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\BqMuRNq.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\ulenRGh.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\srSkUZh.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\DJmlhor.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\IiayfSa.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\huwvnXh.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\YvFDJfz.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\mTSbmbZ.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\eDDyRbs.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\KexmFiM.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\SCyhYGH.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\UstaiMx.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\ZXQTpGO.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\OItZzPd.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\pywkaiy.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\zoEVoAK.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\HSElMlf.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\zZRccup.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\CvPVmeX.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\rgMQzSj.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\WJxprpb.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\rIAFELl.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\iVMRWCn.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
File created	C:\Windows\System\GkxePYu.exe	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4764	powershell.exe
4764	powershell.exe
4764	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
Token: SeDebugPrivilege	4764	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3708 wrote to memory of 4764	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	82
PID 3708 wrote to memory of 4764	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	82
PID 3708 wrote to memory of 2312	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	83
PID 3708 wrote to memory of 2312	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	83
PID 3708 wrote to memory of 2300	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	84
PID 3708 wrote to memory of 2300	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	84
PID 3708 wrote to memory of 4452	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	85
PID 3708 wrote to memory of 4452	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	85
PID 3708 wrote to memory of 3016	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	86
PID 3708 wrote to memory of 3016	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	86
PID 3708 wrote to memory of 2668	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	87
PID 3708 wrote to memory of 2668	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	87
PID 3708 wrote to memory of 2608	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	88
PID 3708 wrote to memory of 2608	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	88
PID 3708 wrote to memory of 4880	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	89
PID 3708 wrote to memory of 4880	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	89
PID 3708 wrote to memory of 892	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	90
PID 3708 wrote to memory of 892	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	90
PID 3708 wrote to memory of 1188	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	91
PID 3708 wrote to memory of 1188	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	91
PID 3708 wrote to memory of 2344	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	92
PID 3708 wrote to memory of 2344	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	92
PID 3708 wrote to memory of 4728	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	93
PID 3708 wrote to memory of 4728	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	93
PID 3708 wrote to memory of 4168	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	94
PID 3708 wrote to memory of 4168	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	94
PID 3708 wrote to memory of 3580	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	95
PID 3708 wrote to memory of 3580	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	95
PID 3708 wrote to memory of 2780	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	96
PID 3708 wrote to memory of 2780	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	96
PID 3708 wrote to memory of 4156	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	97
PID 3708 wrote to memory of 4156	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	97
PID 3708 wrote to memory of 2316	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	98
PID 3708 wrote to memory of 2316	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	98
PID 3708 wrote to memory of 3528	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	99
PID 3708 wrote to memory of 3528	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	99
PID 3708 wrote to memory of 2652	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	100
PID 3708 wrote to memory of 2652	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	100
PID 3708 wrote to memory of 1612	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	101
PID 3708 wrote to memory of 1612	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	101
PID 3708 wrote to memory of 4948	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	102
PID 3708 wrote to memory of 4948	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	102
PID 3708 wrote to memory of 4848	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	103
PID 3708 wrote to memory of 4848	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	103
PID 3708 wrote to memory of 4916	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	104
PID 3708 wrote to memory of 4916	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	104
PID 3708 wrote to memory of 1968	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	105
PID 3708 wrote to memory of 1968	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	105
PID 3708 wrote to memory of 3288	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	106
PID 3708 wrote to memory of 3288	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	106
PID 3708 wrote to memory of 1212	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	107
PID 3708 wrote to memory of 1212	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	107
PID 3708 wrote to memory of 1600	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	108
PID 3708 wrote to memory of 1600	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	108
PID 3708 wrote to memory of 1876	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	109
PID 3708 wrote to memory of 1876	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	109
PID 3708 wrote to memory of 4940	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	110
PID 3708 wrote to memory of 4940	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	110
PID 3708 wrote to memory of 3028	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	111
PID 3708 wrote to memory of 3028	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	111
PID 3708 wrote to memory of 1244	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	112
PID 3708 wrote to memory of 1244	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	112
PID 3708 wrote to memory of 3984	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	113
PID 3708 wrote to memory of 3984	3708	6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe	113

C:\Users\Admin\AppData\Local\Temp\6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6075d826cb700dc5cb65e01633007340_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3708
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4764
- C:\Windows\System\JYCwnEZ.exe
  C:\Windows\System\JYCwnEZ.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\PYDtaht.exe
  C:\Windows\System\PYDtaht.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\AhImQQP.exe
  C:\Windows\System\AhImQQP.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\fERnyXz.exe
  C:\Windows\System\fERnyXz.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\OccZlvF.exe
  C:\Windows\System\OccZlvF.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\QZoTWKD.exe
  C:\Windows\System\QZoTWKD.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\bYAzaml.exe
  C:\Windows\System\bYAzaml.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\lQOwEmG.exe
  C:\Windows\System\lQOwEmG.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\mCTdjmU.exe
  C:\Windows\System\mCTdjmU.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\BvhPzZe.exe
  C:\Windows\System\BvhPzZe.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\TxFOpVE.exe
  C:\Windows\System\TxFOpVE.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\qUrqvHw.exe
  C:\Windows\System\qUrqvHw.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\FeNlSRE.exe
  C:\Windows\System\FeNlSRE.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\GrRThrr.exe
  C:\Windows\System\GrRThrr.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\JWUUGso.exe
  C:\Windows\System\JWUUGso.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\ZXQTpGO.exe
  C:\Windows\System\ZXQTpGO.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\XctTXDv.exe
  C:\Windows\System\XctTXDv.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\uAscyzK.exe
  C:\Windows\System\uAscyzK.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\ywCHdRg.exe
  C:\Windows\System\ywCHdRg.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ZFcyYbk.exe
  C:\Windows\System\ZFcyYbk.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\PFtgnVE.exe
  C:\Windows\System\PFtgnVE.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\hLdFbCX.exe
  C:\Windows\System\hLdFbCX.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\ZBtWucn.exe
  C:\Windows\System\ZBtWucn.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\GlMmoJs.exe
  C:\Windows\System\GlMmoJs.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\jWqlPvd.exe
  C:\Windows\System\jWqlPvd.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\lYxCAoB.exe
  C:\Windows\System\lYxCAoB.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\mLPpQOx.exe
  C:\Windows\System\mLPpQOx.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\DEitRSQ.exe
  C:\Windows\System\DEitRSQ.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\gBmXTdU.exe
  C:\Windows\System\gBmXTdU.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\sXYKGTD.exe
  C:\Windows\System\sXYKGTD.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\TrfRxDu.exe
  C:\Windows\System\TrfRxDu.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\nqdnkss.exe
  C:\Windows\System\nqdnkss.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\JrqAWoS.exe
  C:\Windows\System\JrqAWoS.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\dFhFoOo.exe
  C:\Windows\System\dFhFoOo.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\LrLdvrk.exe
  C:\Windows\System\LrLdvrk.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\lgJGMvw.exe
  C:\Windows\System\lgJGMvw.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\ULHqalU.exe
  C:\Windows\System\ULHqalU.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\bvkAuCI.exe
  C:\Windows\System\bvkAuCI.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\MVBrUFe.exe
  C:\Windows\System\MVBrUFe.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\Zaoxkcw.exe
  C:\Windows\System\Zaoxkcw.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\fgEhJZO.exe
  C:\Windows\System\fgEhJZO.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\eoZEEwk.exe
  C:\Windows\System\eoZEEwk.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\gTaElaQ.exe
  C:\Windows\System\gTaElaQ.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\rnByXuG.exe
  C:\Windows\System\rnByXuG.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\btwhAox.exe
  C:\Windows\System\btwhAox.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\RqpuAZI.exe
  C:\Windows\System\RqpuAZI.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\opEyYBI.exe
  C:\Windows\System\opEyYBI.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\QlJCIGA.exe
  C:\Windows\System\QlJCIGA.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\XTrjmUn.exe
  C:\Windows\System\XTrjmUn.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\tmkCIYH.exe
  C:\Windows\System\tmkCIYH.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\SoAOFXr.exe
  C:\Windows\System\SoAOFXr.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\zrbJTdT.exe
  C:\Windows\System\zrbJTdT.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\JbYIBxw.exe
  C:\Windows\System\JbYIBxw.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\PxnaSfG.exe
  C:\Windows\System\PxnaSfG.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\ttlIAOi.exe
  C:\Windows\System\ttlIAOi.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\qgcCeQH.exe
  C:\Windows\System\qgcCeQH.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\ddsGsHA.exe
  C:\Windows\System\ddsGsHA.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\UytKwoP.exe
  C:\Windows\System\UytKwoP.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\EScuwZI.exe
  C:\Windows\System\EScuwZI.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\ZMQqjie.exe
  C:\Windows\System\ZMQqjie.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\mdSWqSu.exe
  C:\Windows\System\mdSWqSu.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\CFvIlUL.exe
  C:\Windows\System\CFvIlUL.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\UqJHvFI.exe
  C:\Windows\System\UqJHvFI.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\BTfBwgD.exe
  C:\Windows\System\BTfBwgD.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\UMQBuaF.exe
  C:\Windows\System\UMQBuaF.exe
  2⤵
  PID:1448
- C:\Windows\System\twkCYxj.exe
  C:\Windows\System\twkCYxj.exe
  2⤵
  PID:744
- C:\Windows\System\Csbaots.exe
  C:\Windows\System\Csbaots.exe
  2⤵
  PID:4704
- C:\Windows\System\WzTyDmV.exe
  C:\Windows\System\WzTyDmV.exe
  2⤵
  PID:4952
- C:\Windows\System\lkhbdoi.exe
  C:\Windows\System\lkhbdoi.exe
  2⤵
  PID:3876
- C:\Windows\System\lXpPblx.exe
  C:\Windows\System\lXpPblx.exe
  2⤵
  PID:2076
- C:\Windows\System\ymKnNqX.exe
  C:\Windows\System\ymKnNqX.exe
  2⤵
  PID:760
- C:\Windows\System\ckBTefC.exe
  C:\Windows\System\ckBTefC.exe
  2⤵
  PID:1744
- C:\Windows\System\vKUIMkz.exe
  C:\Windows\System\vKUIMkz.exe
  2⤵
  PID:2544
- C:\Windows\System\RoqABmH.exe
  C:\Windows\System\RoqABmH.exe
  2⤵
  PID:4768
- C:\Windows\System\cGrTglG.exe
  C:\Windows\System\cGrTglG.exe
  2⤵
  PID:4956
- C:\Windows\System\NYTrmnD.exe
  C:\Windows\System\NYTrmnD.exe
  2⤵
  PID:2680
- C:\Windows\System\ynbnFTS.exe
  C:\Windows\System\ynbnFTS.exe
  2⤵
  PID:2192
- C:\Windows\System\TFUrMGe.exe
  C:\Windows\System\TFUrMGe.exe
  2⤵
  PID:3924
- C:\Windows\System\bbIzAaX.exe
  C:\Windows\System\bbIzAaX.exe
  2⤵
  PID:1308
- C:\Windows\System\sbDGMjC.exe
  C:\Windows\System\sbDGMjC.exe
  2⤵
  PID:888
- C:\Windows\System\yaqSEkp.exe
  C:\Windows\System\yaqSEkp.exe
  2⤵
  PID:3252
- C:\Windows\System\qgfHcrl.exe
  C:\Windows\System\qgfHcrl.exe
  2⤵
  PID:4608
- C:\Windows\System\IwRMbBf.exe
  C:\Windows\System\IwRMbBf.exe
  2⤵
  PID:4320
- C:\Windows\System\JkCYhDl.exe
  C:\Windows\System\JkCYhDl.exe
  2⤵
  PID:624
- C:\Windows\System\PYGbGJQ.exe
  C:\Windows\System\PYGbGJQ.exe
  2⤵
  PID:640
- C:\Windows\System\pclChVQ.exe
  C:\Windows\System\pclChVQ.exe
  2⤵
  PID:1200
- C:\Windows\System\oTEMTQI.exe
  C:\Windows\System\oTEMTQI.exe
  2⤵
  PID:2248
- C:\Windows\System\fotoiWA.exe
  C:\Windows\System\fotoiWA.exe
  2⤵
  PID:1640
- C:\Windows\System\Mlgujtf.exe
  C:\Windows\System\Mlgujtf.exe
  2⤵
  PID:4564
- C:\Windows\System\oqwynOH.exe
  C:\Windows\System\oqwynOH.exe
  2⤵
  PID:3156
- C:\Windows\System\Rknuhvg.exe
  C:\Windows\System\Rknuhvg.exe
  2⤵
  PID:2832
- C:\Windows\System\GXGerWW.exe
  C:\Windows\System\GXGerWW.exe
  2⤵
  PID:1108
- C:\Windows\System\mpNAesa.exe
  C:\Windows\System\mpNAesa.exe
  2⤵
  PID:2004
- C:\Windows\System\VhHGDSy.exe
  C:\Windows\System\VhHGDSy.exe
  2⤵
  PID:2436
- C:\Windows\System\AuqaqtW.exe
  C:\Windows\System\AuqaqtW.exe
  2⤵
  PID:5136
- C:\Windows\System\PBiUCpD.exe
  C:\Windows\System\PBiUCpD.exe
  2⤵
  PID:5172
- C:\Windows\System\ZaRDeyQ.exe
  C:\Windows\System\ZaRDeyQ.exe
  2⤵
  PID:5200
- C:\Windows\System\sOcxQIu.exe
  C:\Windows\System\sOcxQIu.exe
  2⤵
  PID:5220
- C:\Windows\System\GjYlVyL.exe
  C:\Windows\System\GjYlVyL.exe
  2⤵
  PID:5256
- C:\Windows\System\YWHuraq.exe
  C:\Windows\System\YWHuraq.exe
  2⤵
  PID:5284
- C:\Windows\System\KuzAzyG.exe
  C:\Windows\System\KuzAzyG.exe
  2⤵
  PID:5312
- C:\Windows\System\JFByQCo.exe
  C:\Windows\System\JFByQCo.exe
  2⤵
  PID:5340
- C:\Windows\System\VMJDZMT.exe
  C:\Windows\System\VMJDZMT.exe
  2⤵
  PID:5368
- C:\Windows\System\ZXdAALK.exe
  C:\Windows\System\ZXdAALK.exe
  2⤵
  PID:5396
- C:\Windows\System\aicAFqM.exe
  C:\Windows\System\aicAFqM.exe
  2⤵
  PID:5416
- C:\Windows\System\VjkCWAF.exe
  C:\Windows\System\VjkCWAF.exe
  2⤵
  PID:5452
- C:\Windows\System\nbgXNxq.exe
  C:\Windows\System\nbgXNxq.exe
  2⤵
  PID:5480
- C:\Windows\System\IdbElVl.exe
  C:\Windows\System\IdbElVl.exe
  2⤵
  PID:5500
- C:\Windows\System\FHTqpdV.exe
  C:\Windows\System\FHTqpdV.exe
  2⤵
  PID:5528
- C:\Windows\System\RivflqD.exe
  C:\Windows\System\RivflqD.exe
  2⤵
  PID:5564
- C:\Windows\System\OlEjYsw.exe
  C:\Windows\System\OlEjYsw.exe
  2⤵
  PID:5584
- C:\Windows\System\ugwyHIY.exe
  C:\Windows\System\ugwyHIY.exe
  2⤵
  PID:5612
- C:\Windows\System\OJZUMVa.exe
  C:\Windows\System\OJZUMVa.exe
  2⤵
  PID:5648
- C:\Windows\System\NSZoguh.exe
  C:\Windows\System\NSZoguh.exe
  2⤵
  PID:5680
- C:\Windows\System\hNFSWIs.exe
  C:\Windows\System\hNFSWIs.exe
  2⤵
  PID:5708
- C:\Windows\System\qKyCllF.exe
  C:\Windows\System\qKyCllF.exe
  2⤵
  PID:5728
- C:\Windows\System\UAxsEVJ.exe
  C:\Windows\System\UAxsEVJ.exe
  2⤵
  PID:5768
- C:\Windows\System\XmfuaXk.exe
  C:\Windows\System\XmfuaXk.exe
  2⤵
  PID:5796
- C:\Windows\System\axKbkJr.exe
  C:\Windows\System\axKbkJr.exe
  2⤵
  PID:5816
- C:\Windows\System\AgHvxuy.exe
  C:\Windows\System\AgHvxuy.exe
  2⤵
  PID:5852
- C:\Windows\System\siszjYt.exe
  C:\Windows\System\siszjYt.exe
  2⤵
  PID:5884
- C:\Windows\System\yrfXftq.exe
  C:\Windows\System\yrfXftq.exe
  2⤵
  PID:5908
- C:\Windows\System\feEchdk.exe
  C:\Windows\System\feEchdk.exe
  2⤵
  PID:5932
- C:\Windows\System\eWzXMZD.exe
  C:\Windows\System\eWzXMZD.exe
  2⤵
  PID:5968
- C:\Windows\System\pmnajKu.exe
  C:\Windows\System\pmnajKu.exe
  2⤵
  PID:5996
- C:\Windows\System\lVNYZel.exe
  C:\Windows\System\lVNYZel.exe
  2⤵
  PID:6016
- C:\Windows\System\qtdqxTi.exe
  C:\Windows\System\qtdqxTi.exe
  2⤵
  PID:6044
- C:\Windows\System\QwXXScm.exe
  C:\Windows\System\QwXXScm.exe
  2⤵
  PID:6076
- C:\Windows\System\QPoSXlY.exe
  C:\Windows\System\QPoSXlY.exe
  2⤵
  PID:6108
- C:\Windows\System\gHtFKZT.exe
  C:\Windows\System\gHtFKZT.exe
  2⤵
  PID:6136
- C:\Windows\System\XguxJSR.exe
  C:\Windows\System\XguxJSR.exe
  2⤵
  PID:5164
- C:\Windows\System\cEhkrRR.exe
  C:\Windows\System\cEhkrRR.exe
  2⤵
  PID:5232
- C:\Windows\System\beUXuNc.exe
  C:\Windows\System\beUXuNc.exe
  2⤵
  PID:5296
- C:\Windows\System\eZPnqSf.exe
  C:\Windows\System\eZPnqSf.exe
  2⤵
  PID:5376
- C:\Windows\System\xcarNjU.exe
  C:\Windows\System\xcarNjU.exe
  2⤵
  PID:5408
- C:\Windows\System\VOodPQU.exe
  C:\Windows\System\VOodPQU.exe
  2⤵
  PID:5496
- C:\Windows\System\EdHfYzQ.exe
  C:\Windows\System\EdHfYzQ.exe
  2⤵
  PID:5540
- C:\Windows\System\HChrKfI.exe
  C:\Windows\System\HChrKfI.exe
  2⤵
  PID:5576
- C:\Windows\System\uRkzoYF.exe
  C:\Windows\System\uRkzoYF.exe
  2⤵
  PID:5608
- C:\Windows\System\IrVRztq.exe
  C:\Windows\System\IrVRztq.exe
  2⤵
  PID:5688
- C:\Windows\System\QOkXsZs.exe
  C:\Windows\System\QOkXsZs.exe
  2⤵
  PID:5808
- C:\Windows\System\ZSkscSq.exe
  C:\Windows\System\ZSkscSq.exe
  2⤵
  PID:5872
- C:\Windows\System\duZvpWs.exe
  C:\Windows\System\duZvpWs.exe
  2⤵
  PID:5916
- C:\Windows\System\akCwPcr.exe
  C:\Windows\System\akCwPcr.exe
  2⤵
  PID:5988
- C:\Windows\System\hcMdyTq.exe
  C:\Windows\System\hcMdyTq.exe
  2⤵
  PID:6084
- C:\Windows\System\vZGxqzp.exe
  C:\Windows\System\vZGxqzp.exe
  2⤵
  PID:5124
- C:\Windows\System\MqnPyQe.exe
  C:\Windows\System\MqnPyQe.exe
  2⤵
  PID:5264
- C:\Windows\System\MfWHDkd.exe
  C:\Windows\System\MfWHDkd.exe
  2⤵
  PID:5384
- C:\Windows\System\CMewShp.exe
  C:\Windows\System\CMewShp.exe
  2⤵
  PID:5572
- C:\Windows\System\BFOVJdL.exe
  C:\Windows\System\BFOVJdL.exe
  2⤵
  PID:5700
- C:\Windows\System\jJfPWJo.exe
  C:\Windows\System\jJfPWJo.exe
  2⤵
  PID:5868
- C:\Windows\System\uWRwwSS.exe
  C:\Windows\System\uWRwwSS.exe
  2⤵
  PID:6056
- C:\Windows\System\tIDZWdv.exe
  C:\Windows\System\tIDZWdv.exe
  2⤵
  PID:5348
- C:\Windows\System\IhWdtvK.exe
  C:\Windows\System\IhWdtvK.exe
  2⤵
  PID:5520
- C:\Windows\System\KXXmCXo.exe
  C:\Windows\System\KXXmCXo.exe
  2⤵
  PID:6008
- C:\Windows\System\ZbTXrsT.exe
  C:\Windows\System\ZbTXrsT.exe
  2⤵
  PID:5656
- C:\Windows\System\Czsfpmg.exe
  C:\Windows\System\Czsfpmg.exe
  2⤵
  PID:5488
- C:\Windows\System\uiMqivA.exe
  C:\Windows\System\uiMqivA.exe
  2⤵
  PID:6164
- C:\Windows\System\BhWwogy.exe
  C:\Windows\System\BhWwogy.exe
  2⤵
  PID:6192
- C:\Windows\System\hRVPwkb.exe
  C:\Windows\System\hRVPwkb.exe
  2⤵
  PID:6224
- C:\Windows\System\BFZmlGd.exe
  C:\Windows\System\BFZmlGd.exe
  2⤵
  PID:6248
- C:\Windows\System\RFPjzBY.exe
  C:\Windows\System\RFPjzBY.exe
  2⤵
  PID:6276
- C:\Windows\System\swcvYNf.exe
  C:\Windows\System\swcvYNf.exe
  2⤵
  PID:6292
- C:\Windows\System\SAdPPXE.exe
  C:\Windows\System\SAdPPXE.exe
  2⤵
  PID:6316
- C:\Windows\System\LHyyXqM.exe
  C:\Windows\System\LHyyXqM.exe
  2⤵
  PID:6344
- C:\Windows\System\afLNgcP.exe
  C:\Windows\System\afLNgcP.exe
  2⤵
  PID:6364
- C:\Windows\System\mIoXNMM.exe
  C:\Windows\System\mIoXNMM.exe
  2⤵
  PID:6416
- C:\Windows\System\kWFlkJq.exe
  C:\Windows\System\kWFlkJq.exe
  2⤵
  PID:6444
- C:\Windows\System\lTNXUgW.exe
  C:\Windows\System\lTNXUgW.exe
  2⤵
  PID:6480
- C:\Windows\System\fFTPDJw.exe
  C:\Windows\System\fFTPDJw.exe
  2⤵
  PID:6500
- C:\Windows\System\VQwlRUm.exe
  C:\Windows\System\VQwlRUm.exe
  2⤵
  PID:6528
- C:\Windows\System\hObWlWH.exe
  C:\Windows\System\hObWlWH.exe
  2⤵
  PID:6556
- C:\Windows\System\kDdKOYi.exe
  C:\Windows\System\kDdKOYi.exe
  2⤵
  PID:6588
- C:\Windows\System\gZxsFti.exe
  C:\Windows\System\gZxsFti.exe
  2⤵
  PID:6612
- C:\Windows\System\QQeBiIz.exe
  C:\Windows\System\QQeBiIz.exe
  2⤵
  PID:6628
- C:\Windows\System\vkmZuEp.exe
  C:\Windows\System\vkmZuEp.exe
  2⤵
  PID:6676
- C:\Windows\System\cLMJLJU.exe
  C:\Windows\System\cLMJLJU.exe
  2⤵
  PID:6704
- C:\Windows\System\LJBiwQj.exe
  C:\Windows\System\LJBiwQj.exe
  2⤵
  PID:6724
- C:\Windows\System\qoJYKwq.exe
  C:\Windows\System\qoJYKwq.exe
  2⤵
  PID:6740
- C:\Windows\System\CoufZfL.exe
  C:\Windows\System\CoufZfL.exe
  2⤵
  PID:6780
- C:\Windows\System\xTBTkdO.exe
  C:\Windows\System\xTBTkdO.exe
  2⤵
  PID:6816
- C:\Windows\System\vzZDfbt.exe
  C:\Windows\System\vzZDfbt.exe
  2⤵
  PID:6840
- C:\Windows\System\XowWyha.exe
  C:\Windows\System\XowWyha.exe
  2⤵
  PID:6864
- C:\Windows\System\QSJXZZa.exe
  C:\Windows\System\QSJXZZa.exe
  2⤵
  PID:6880
- C:\Windows\System\nfCykPt.exe
  C:\Windows\System\nfCykPt.exe
  2⤵
  PID:6920
- C:\Windows\System\SlBnOjN.exe
  C:\Windows\System\SlBnOjN.exe
  2⤵
  PID:6936
- C:\Windows\System\HIrWyRh.exe
  C:\Windows\System\HIrWyRh.exe
  2⤵
  PID:6952
- C:\Windows\System\Ervpnek.exe
  C:\Windows\System\Ervpnek.exe
  2⤵
  PID:6992
- C:\Windows\System\GxfYIWw.exe
  C:\Windows\System\GxfYIWw.exe
  2⤵
  PID:7020
- C:\Windows\System\JjsQvBC.exe
  C:\Windows\System\JjsQvBC.exe
  2⤵
  PID:7068
- C:\Windows\System\XHaLUvX.exe
  C:\Windows\System\XHaLUvX.exe
  2⤵
  PID:7088
- C:\Windows\System\hHeQYDL.exe
  C:\Windows\System\hHeQYDL.exe
  2⤵
  PID:7116
- C:\Windows\System\URUYHSG.exe
  C:\Windows\System\URUYHSG.exe
  2⤵
  PID:7144
- C:\Windows\System\yqBbMFM.exe
  C:\Windows\System\yqBbMFM.exe
  2⤵
  PID:6176
- C:\Windows\System\KXoOKbA.exe
  C:\Windows\System\KXoOKbA.exe
  2⤵
  PID:6236
- C:\Windows\System\XWskQro.exe
  C:\Windows\System\XWskQro.exe
  2⤵
  PID:6288
- C:\Windows\System\CRPdPKj.exe
  C:\Windows\System\CRPdPKj.exe
  2⤵
  PID:6352
- C:\Windows\System\zyiUron.exe
  C:\Windows\System\zyiUron.exe
  2⤵
  PID:6436
- C:\Windows\System\MVPckic.exe
  C:\Windows\System\MVPckic.exe
  2⤵
  PID:6488
- C:\Windows\System\VhRdNMy.exe
  C:\Windows\System\VhRdNMy.exe
  2⤵
  PID:6524
- C:\Windows\System\hEyiuIZ.exe
  C:\Windows\System\hEyiuIZ.exe
  2⤵
  PID:6608
- C:\Windows\System\jfQREvT.exe
  C:\Windows\System\jfQREvT.exe
  2⤵
  PID:6684
- C:\Windows\System\TxUmkXB.exe
  C:\Windows\System\TxUmkXB.exe
  2⤵
  PID:6732
- C:\Windows\System\YKPcjoL.exe
  C:\Windows\System\YKPcjoL.exe
  2⤵
  PID:6776
- C:\Windows\System\pWTaLvP.exe
  C:\Windows\System\pWTaLvP.exe
  2⤵
  PID:6872
- C:\Windows\System\yrSansI.exe
  C:\Windows\System\yrSansI.exe
  2⤵
  PID:6908
- C:\Windows\System\bCTPJXZ.exe
  C:\Windows\System\bCTPJXZ.exe
  2⤵
  PID:6948
- C:\Windows\System\hMMcuVI.exe
  C:\Windows\System\hMMcuVI.exe
  2⤵
  PID:7032
- C:\Windows\System\EaEtHLa.exe
  C:\Windows\System\EaEtHLa.exe
  2⤵
  PID:7128
- C:\Windows\System\GRzKwKv.exe
  C:\Windows\System\GRzKwKv.exe
  2⤵
  PID:7164
- C:\Windows\System\jmxdkqD.exe
  C:\Windows\System\jmxdkqD.exe
  2⤵
  PID:6284
- C:\Windows\System\ABnSwPs.exe
  C:\Windows\System\ABnSwPs.exe
  2⤵
  PID:6456
- C:\Windows\System\ydGYOVo.exe
  C:\Windows\System\ydGYOVo.exe
  2⤵
  PID:6660
- C:\Windows\System\BpgQAyh.exe
  C:\Windows\System\BpgQAyh.exe
  2⤵
  PID:6824
- C:\Windows\System\SOsPblz.exe
  C:\Windows\System\SOsPblz.exe
  2⤵
  PID:6904
- C:\Windows\System\XwpQJzB.exe
  C:\Windows\System\XwpQJzB.exe
  2⤵
  PID:7056
- C:\Windows\System\ivuvOPf.exe
  C:\Windows\System\ivuvOPf.exe
  2⤵
  PID:6272
- C:\Windows\System\fasfgwi.exe
  C:\Windows\System\fasfgwi.exe
  2⤵
  PID:6576
- C:\Windows\System\lMpQavx.exe
  C:\Windows\System\lMpQavx.exe
  2⤵
  PID:6972
- C:\Windows\System\xSqJlsP.exe
  C:\Windows\System\xSqJlsP.exe
  2⤵
  PID:6356
- C:\Windows\System\gztREDw.exe
  C:\Windows\System\gztREDw.exe
  2⤵
  PID:7180
- C:\Windows\System\ceZjrdt.exe
  C:\Windows\System\ceZjrdt.exe
  2⤵
  PID:7196
- C:\Windows\System\PMzHZEs.exe
  C:\Windows\System\PMzHZEs.exe
  2⤵
  PID:7224
- C:\Windows\System\VqDlKUU.exe
  C:\Windows\System\VqDlKUU.exe
  2⤵
  PID:7264
- C:\Windows\System\NMVelAs.exe
  C:\Windows\System\NMVelAs.exe
  2⤵
  PID:7300
- C:\Windows\System\kWIUYLf.exe
  C:\Windows\System\kWIUYLf.exe
  2⤵
  PID:7320
- C:\Windows\System\cHkfqwI.exe
  C:\Windows\System\cHkfqwI.exe
  2⤵
  PID:7336
- C:\Windows\System\BdthxZZ.exe
  C:\Windows\System\BdthxZZ.exe
  2⤵
  PID:7364
- C:\Windows\System\StoZobk.exe
  C:\Windows\System\StoZobk.exe
  2⤵
  PID:7408
- C:\Windows\System\LgrYKXt.exe
  C:\Windows\System\LgrYKXt.exe
  2⤵
  PID:7432
- C:\Windows\System\TfToWVQ.exe
  C:\Windows\System\TfToWVQ.exe
  2⤵
  PID:7452
- C:\Windows\System\UmMNfIP.exe
  C:\Windows\System\UmMNfIP.exe
  2⤵
  PID:7488
- C:\Windows\System\dUDrtES.exe
  C:\Windows\System\dUDrtES.exe
  2⤵
  PID:7504
- C:\Windows\System\mgdilNj.exe
  C:\Windows\System\mgdilNj.exe
  2⤵
  PID:7532
- C:\Windows\System\VfDJlzO.exe
  C:\Windows\System\VfDJlzO.exe
  2⤵
  PID:7564
- C:\Windows\System\fjghwAA.exe
  C:\Windows\System\fjghwAA.exe
  2⤵
  PID:7600
- C:\Windows\System\mYmUTMw.exe
  C:\Windows\System\mYmUTMw.exe
  2⤵
  PID:7628
- C:\Windows\System\grFSeaM.exe
  C:\Windows\System\grFSeaM.exe
  2⤵
  PID:7656
- C:\Windows\System\uwkUueW.exe
  C:\Windows\System\uwkUueW.exe
  2⤵
  PID:7680
- C:\Windows\System\FazSNVc.exe
  C:\Windows\System\FazSNVc.exe
  2⤵
  PID:7704
- C:\Windows\System\TFUTNSC.exe
  C:\Windows\System\TFUTNSC.exe
  2⤵
  PID:7736
- C:\Windows\System\kVgpwpT.exe
  C:\Windows\System\kVgpwpT.exe
  2⤵
  PID:7768
- C:\Windows\System\qIsijBq.exe
  C:\Windows\System\qIsijBq.exe
  2⤵
  PID:7796
- C:\Windows\System\WODdTXs.exe
  C:\Windows\System\WODdTXs.exe
  2⤵
  PID:7816
- C:\Windows\System\gvMZYcF.exe
  C:\Windows\System\gvMZYcF.exe
  2⤵
  PID:7848
- C:\Windows\System\AvEULes.exe
  C:\Windows\System\AvEULes.exe
  2⤵
  PID:7884
- C:\Windows\System\cjUuSvF.exe
  C:\Windows\System\cjUuSvF.exe
  2⤵
  PID:7900
- C:\Windows\System\GJGKpbf.exe
  C:\Windows\System\GJGKpbf.exe
  2⤵
  PID:7936
- C:\Windows\System\KUctXAw.exe
  C:\Windows\System\KUctXAw.exe
  2⤵
  PID:7968
- C:\Windows\System\YEiCAMS.exe
  C:\Windows\System\YEiCAMS.exe
  2⤵
  PID:7996
- C:\Windows\System\tPJZDAS.exe
  C:\Windows\System\tPJZDAS.exe
  2⤵
  PID:8016
- C:\Windows\System\VMUfUpQ.exe
  C:\Windows\System\VMUfUpQ.exe
  2⤵
  PID:8040
- C:\Windows\System\ZpKhZRq.exe
  C:\Windows\System\ZpKhZRq.exe
  2⤵
  PID:8080
- C:\Windows\System\sGQpLWD.exe
  C:\Windows\System\sGQpLWD.exe
  2⤵
  PID:8096
- C:\Windows\System\Eqswecr.exe
  C:\Windows\System\Eqswecr.exe
  2⤵
  PID:8124
- C:\Windows\System\YvMjCvw.exe
  C:\Windows\System\YvMjCvw.exe
  2⤵
  PID:8140
- C:\Windows\System\EoZKUkn.exe
  C:\Windows\System\EoZKUkn.exe
  2⤵
  PID:8180
- C:\Windows\System\WwQHOMe.exe
  C:\Windows\System\WwQHOMe.exe
  2⤵
  PID:7212
- C:\Windows\System\fuxCyvE.exe
  C:\Windows\System\fuxCyvE.exe
  2⤵
  PID:7276
- C:\Windows\System\iTxwLyf.exe
  C:\Windows\System\iTxwLyf.exe
  2⤵
  PID:7328
- C:\Windows\System\MCdmbev.exe
  C:\Windows\System\MCdmbev.exe
  2⤵
  PID:7416
- C:\Windows\System\FISBSUH.exe
  C:\Windows\System\FISBSUH.exe
  2⤵
  PID:7476
- C:\Windows\System\HuMZoen.exe
  C:\Windows\System\HuMZoen.exe
  2⤵
  PID:7496
- C:\Windows\System\WKuZfwm.exe
  C:\Windows\System\WKuZfwm.exe
  2⤵
  PID:6216
- C:\Windows\System\HDTeyHt.exe
  C:\Windows\System\HDTeyHt.exe
  2⤵
  PID:7652
- C:\Windows\System\iRRuKnP.exe
  C:\Windows\System\iRRuKnP.exe
  2⤵
  PID:7720
- C:\Windows\System\SPHoYRa.exe
  C:\Windows\System\SPHoYRa.exe
  2⤵
  PID:7812
- C:\Windows\System\zRmHURw.exe
  C:\Windows\System\zRmHURw.exe
  2⤵
  PID:7864
- C:\Windows\System\cAeAygg.exe
  C:\Windows\System\cAeAygg.exe
  2⤵
  PID:7932
- C:\Windows\System\MzMMDPF.exe
  C:\Windows\System\MzMMDPF.exe
  2⤵
  PID:7992
- C:\Windows\System\mdOwqWh.exe
  C:\Windows\System\mdOwqWh.exe
  2⤵
  PID:8024
- C:\Windows\System\vxBnppT.exe
  C:\Windows\System\vxBnppT.exe
  2⤵
  PID:8108
- C:\Windows\System\zfhtapV.exe
  C:\Windows\System\zfhtapV.exe
  2⤵
  PID:8188
- C:\Windows\System\kmkxGld.exe
  C:\Windows\System\kmkxGld.exe
  2⤵
  PID:7236
- C:\Windows\System\LDReDoe.exe
  C:\Windows\System\LDReDoe.exe
  2⤵
  PID:7360
- C:\Windows\System\kHgjHvq.exe
  C:\Windows\System\kHgjHvq.exe
  2⤵
  PID:7556
- C:\Windows\System\kxIfOsr.exe
  C:\Windows\System\kxIfOsr.exe
  2⤵
  PID:7712
- C:\Windows\System\uFfrRGv.exe
  C:\Windows\System\uFfrRGv.exe
  2⤵
  PID:7912
- C:\Windows\System\ZvirONh.exe
  C:\Windows\System\ZvirONh.exe
  2⤵
  PID:8060
- C:\Windows\System\qJXavew.exe
  C:\Windows\System\qJXavew.exe
  2⤵
  PID:8116
- C:\Windows\System\nqLDkmp.exe
  C:\Windows\System\nqLDkmp.exe
  2⤵
  PID:7480
- C:\Windows\System\gIIzDZw.exe
  C:\Windows\System\gIIzDZw.exe
  2⤵
  PID:7640
- C:\Windows\System\raHhbKA.exe
  C:\Windows\System\raHhbKA.exe
  2⤵
  PID:7192
- C:\Windows\System\owqXFtb.exe
  C:\Windows\System\owqXFtb.exe
  2⤵
  PID:7620
- C:\Windows\System\BwqdrYJ.exe
  C:\Windows\System\BwqdrYJ.exe
  2⤵
  PID:7544
- C:\Windows\System\iDQUudV.exe
  C:\Windows\System\iDQUudV.exe
  2⤵
  PID:8224
- C:\Windows\System\IiayfSa.exe
  C:\Windows\System\IiayfSa.exe
  2⤵
  PID:8252
- C:\Windows\System\neNVcnm.exe
  C:\Windows\System\neNVcnm.exe
  2⤵
  PID:8272
- C:\Windows\System\luHXvXT.exe
  C:\Windows\System\luHXvXT.exe
  2⤵
  PID:8308
- C:\Windows\System\RItIogw.exe
  C:\Windows\System\RItIogw.exe
  2⤵
  PID:8336
- C:\Windows\System\agKytyP.exe
  C:\Windows\System\agKytyP.exe
  2⤵
  PID:8368
- C:\Windows\System\oOWvCNq.exe
  C:\Windows\System\oOWvCNq.exe
  2⤵
  PID:8392
- C:\Windows\System\bAZYRHx.exe
  C:\Windows\System\bAZYRHx.exe
  2⤵
  PID:8420
- C:\Windows\System\NdXbSwG.exe
  C:\Windows\System\NdXbSwG.exe
  2⤵
  PID:8448
- C:\Windows\System\YCnGuQn.exe
  C:\Windows\System\YCnGuQn.exe
  2⤵
  PID:8476
- C:\Windows\System\PjLcDxx.exe
  C:\Windows\System\PjLcDxx.exe
  2⤵
  PID:8492
- C:\Windows\System\cAiYQuq.exe
  C:\Windows\System\cAiYQuq.exe
  2⤵
  PID:8524
- C:\Windows\System\QhXEDFY.exe
  C:\Windows\System\QhXEDFY.exe
  2⤵
  PID:8548
- C:\Windows\System\bImQRFc.exe
  C:\Windows\System\bImQRFc.exe
  2⤵
  PID:8588
- C:\Windows\System\FjyhUXw.exe
  C:\Windows\System\FjyhUXw.exe
  2⤵
  PID:8616
- C:\Windows\System\eCnGsbT.exe
  C:\Windows\System\eCnGsbT.exe
  2⤵
  PID:8632
- C:\Windows\System\wtaticE.exe
  C:\Windows\System\wtaticE.exe
  2⤵
  PID:8664
- C:\Windows\System\FHEEEKL.exe
  C:\Windows\System\FHEEEKL.exe
  2⤵
  PID:8700
- C:\Windows\System\OmgewJn.exe
  C:\Windows\System\OmgewJn.exe
  2⤵
  PID:8716
- C:\Windows\System\nileJRu.exe
  C:\Windows\System\nileJRu.exe
  2⤵
  PID:8744
- C:\Windows\System\SDfEoKI.exe
  C:\Windows\System\SDfEoKI.exe
  2⤵
  PID:8776
- C:\Windows\System\jSGSMFe.exe
  C:\Windows\System\jSGSMFe.exe
  2⤵
  PID:8800
- C:\Windows\System\aoGfrIc.exe
  C:\Windows\System\aoGfrIc.exe
  2⤵
  PID:8828
- C:\Windows\System\uWOlAje.exe
  C:\Windows\System\uWOlAje.exe
  2⤵
  PID:8868
- C:\Windows\System\UrMKNqT.exe
  C:\Windows\System\UrMKNqT.exe
  2⤵
  PID:8884
- C:\Windows\System\BywHwTe.exe
  C:\Windows\System\BywHwTe.exe
  2⤵
  PID:8924
- C:\Windows\System\uSqbRJd.exe
  C:\Windows\System\uSqbRJd.exe
  2⤵
  PID:8960
- C:\Windows\System\dUMJVuS.exe
  C:\Windows\System\dUMJVuS.exe
  2⤵
  PID:8976
- C:\Windows\System\EdWMTwQ.exe
  C:\Windows\System\EdWMTwQ.exe
  2⤵
  PID:9004
- C:\Windows\System\eYvgcwO.exe
  C:\Windows\System\eYvgcwO.exe
  2⤵
  PID:9028
- C:\Windows\System\HYuiDZL.exe
  C:\Windows\System\HYuiDZL.exe
  2⤵
  PID:9060
- C:\Windows\System\DLAlmUm.exe
  C:\Windows\System\DLAlmUm.exe
  2⤵
  PID:9092
- C:\Windows\System\wMpjhtD.exe
  C:\Windows\System\wMpjhtD.exe
  2⤵
  PID:9116
- C:\Windows\System\WjvReru.exe
  C:\Windows\System\WjvReru.exe
  2⤵
  PID:9144
- C:\Windows\System\FhyBkRf.exe
  C:\Windows\System\FhyBkRf.exe
  2⤵
  PID:9172
- C:\Windows\System\USglnQg.exe
  C:\Windows\System\USglnQg.exe
  2⤵
  PID:9188
- C:\Windows\System\kvqzQeR.exe
  C:\Windows\System\kvqzQeR.exe
  2⤵
  PID:8220
- C:\Windows\System\OItZzPd.exe
  C:\Windows\System\OItZzPd.exe
  2⤵
  PID:8260
- C:\Windows\System\hPWIJeR.exe
  C:\Windows\System\hPWIJeR.exe
  2⤵
  PID:8328
- C:\Windows\System\IoqSEBk.exe
  C:\Windows\System\IoqSEBk.exe
  2⤵
  PID:8440
- C:\Windows\System\WUjHbmO.exe
  C:\Windows\System\WUjHbmO.exe
  2⤵
  PID:8488
- C:\Windows\System\CCLbHYi.exe
  C:\Windows\System\CCLbHYi.exe
  2⤵
  PID:8560
- C:\Windows\System\ORqrJkS.exe
  C:\Windows\System\ORqrJkS.exe
  2⤵
  PID:8624
- C:\Windows\System\QJdDgMc.exe
  C:\Windows\System\QJdDgMc.exe
  2⤵
  PID:8708
- C:\Windows\System\LgitkqU.exe
  C:\Windows\System\LgitkqU.exe
  2⤵
  PID:8784
- C:\Windows\System\TWVksnA.exe
  C:\Windows\System\TWVksnA.exe
  2⤵
  PID:8820
- C:\Windows\System\DTrfsfc.exe
  C:\Windows\System\DTrfsfc.exe
  2⤵
  PID:8908
- C:\Windows\System\BTYVBZS.exe
  C:\Windows\System\BTYVBZS.exe
  2⤵
  PID:8956
- C:\Windows\System\ODMHOcW.exe
  C:\Windows\System\ODMHOcW.exe
  2⤵
  PID:9024
- C:\Windows\System\IoiiJCM.exe
  C:\Windows\System\IoiiJCM.exe
  2⤵
  PID:9072
- C:\Windows\System\ubVMQJj.exe
  C:\Windows\System\ubVMQJj.exe
  2⤵
  PID:9132
- C:\Windows\System\qIaKnAv.exe
  C:\Windows\System\qIaKnAv.exe
  2⤵
  PID:8248
- C:\Windows\System\zEwzQsA.exe
  C:\Windows\System\zEwzQsA.exe
  2⤵
  PID:8236
- C:\Windows\System\WyZNSah.exe
  C:\Windows\System\WyZNSah.exe
  2⤵
  PID:8520
- C:\Windows\System\IxrLlto.exe
  C:\Windows\System\IxrLlto.exe
  2⤵
  PID:8628
- C:\Windows\System\lGGlKaU.exe
  C:\Windows\System\lGGlKaU.exe
  2⤵
  PID:8756
- C:\Windows\System\CFEcnXD.exe
  C:\Windows\System\CFEcnXD.exe
  2⤵
  PID:8936
- C:\Windows\System\lPJYwMm.exe
  C:\Windows\System\lPJYwMm.exe
  2⤵
  PID:9052
- C:\Windows\System\rvZSdqF.exe
  C:\Windows\System\rvZSdqF.exe
  2⤵
  PID:9212
- C:\Windows\System\NoqHRHX.exe
  C:\Windows\System\NoqHRHX.exe
  2⤵
  PID:8728
- C:\Windows\System\rsUqChC.exe
  C:\Windows\System\rsUqChC.exe
  2⤵
  PID:9020
- C:\Windows\System\SukNtBD.exe
  C:\Windows\System\SukNtBD.exe
  2⤵
  PID:9164
- C:\Windows\System\gGeWLEC.exe
  C:\Windows\System\gGeWLEC.exe
  2⤵
  PID:9184
- C:\Windows\System\XzuQGVT.exe
  C:\Windows\System\XzuQGVT.exe
  2⤵
  PID:9220
- C:\Windows\System\wGcuUWE.exe
  C:\Windows\System\wGcuUWE.exe
  2⤵
  PID:9244
- C:\Windows\System\evVSEuv.exe
  C:\Windows\System\evVSEuv.exe
  2⤵
  PID:9272
- C:\Windows\System\jzClSCW.exe
  C:\Windows\System\jzClSCW.exe
  2⤵
  PID:9312
- C:\Windows\System\Vgawwcl.exe
  C:\Windows\System\Vgawwcl.exe
  2⤵
  PID:9340
- C:\Windows\System\ksQvAMe.exe
  C:\Windows\System\ksQvAMe.exe
  2⤵
  PID:9368
- C:\Windows\System\qCUIQfS.exe
  C:\Windows\System\qCUIQfS.exe
  2⤵
  PID:9384
- C:\Windows\System\DaRuVOp.exe
  C:\Windows\System\DaRuVOp.exe
  2⤵
  PID:9424
- C:\Windows\System\yGiZiKD.exe
  C:\Windows\System\yGiZiKD.exe
  2⤵
  PID:9440
- C:\Windows\System\CaVYNey.exe
  C:\Windows\System\CaVYNey.exe
  2⤵
  PID:9480
- C:\Windows\System\OoYoAFB.exe
  C:\Windows\System\OoYoAFB.exe
  2⤵
  PID:9508
- C:\Windows\System\DnchnvA.exe
  C:\Windows\System\DnchnvA.exe
  2⤵
  PID:9536
- C:\Windows\System\rQLVdFs.exe
  C:\Windows\System\rQLVdFs.exe
  2⤵
  PID:9564
- C:\Windows\System\HzbEdUd.exe
  C:\Windows\System\HzbEdUd.exe
  2⤵
  PID:9592
- C:\Windows\System\LKYVNXD.exe
  C:\Windows\System\LKYVNXD.exe
  2⤵
  PID:9620
- C:\Windows\System\yItpPxc.exe
  C:\Windows\System\yItpPxc.exe
  2⤵
  PID:9640
- C:\Windows\System\YPjVJqM.exe
  C:\Windows\System\YPjVJqM.exe
  2⤵
  PID:9668
- C:\Windows\System\cPMoUcJ.exe
  C:\Windows\System\cPMoUcJ.exe
  2⤵
  PID:9692
- C:\Windows\System\UNhItXU.exe
  C:\Windows\System\UNhItXU.exe
  2⤵
  PID:9720
- C:\Windows\System\AbrlQEs.exe
  C:\Windows\System\AbrlQEs.exe
  2⤵
  PID:9756
- C:\Windows\System\eHUejdG.exe
  C:\Windows\System\eHUejdG.exe
  2⤵
  PID:9780
- C:\Windows\System\XuIRhGu.exe
  C:\Windows\System\XuIRhGu.exe
  2⤵
  PID:9804
- C:\Windows\System\reDcdEk.exe
  C:\Windows\System\reDcdEk.exe
  2⤵
  PID:9844
- C:\Windows\System\utpDxfr.exe
  C:\Windows\System\utpDxfr.exe
  2⤵
  PID:9872
- C:\Windows\System\txLgglb.exe
  C:\Windows\System\txLgglb.exe
  2⤵
  PID:9900
- C:\Windows\System\Zbwklgm.exe
  C:\Windows\System\Zbwklgm.exe
  2⤵
  PID:9928
- C:\Windows\System\bEaAtUP.exe
  C:\Windows\System\bEaAtUP.exe
  2⤵
  PID:9964
- C:\Windows\System\Uldvdax.exe
  C:\Windows\System\Uldvdax.exe
  2⤵
  PID:10004
- C:\Windows\System\RMhpwhw.exe
  C:\Windows\System\RMhpwhw.exe
  2⤵
  PID:10020
- C:\Windows\System\eQFwCMv.exe
  C:\Windows\System\eQFwCMv.exe
  2⤵
  PID:10048
- C:\Windows\System\sDHhJei.exe
  C:\Windows\System\sDHhJei.exe
  2⤵
  PID:10076
- C:\Windows\System\NgeZYPW.exe
  C:\Windows\System\NgeZYPW.exe
  2⤵
  PID:10104
- C:\Windows\System\ynCXsjC.exe
  C:\Windows\System\ynCXsjC.exe
  2⤵
  PID:10132
- C:\Windows\System\wCUBKdR.exe
  C:\Windows\System\wCUBKdR.exe
  2⤵
  PID:10160
- C:\Windows\System\zpzDYgl.exe
  C:\Windows\System\zpzDYgl.exe
  2⤵
  PID:10188
- C:\Windows\System\MBiJCsT.exe
  C:\Windows\System\MBiJCsT.exe
  2⤵
  PID:10216
- C:\Windows\System\EDDZtqL.exe
  C:\Windows\System\EDDZtqL.exe
  2⤵
  PID:9228
- C:\Windows\System\NsfszhO.exe
  C:\Windows\System\NsfszhO.exe
  2⤵
  PID:9284
- C:\Windows\System\PzwSIuP.exe
  C:\Windows\System\PzwSIuP.exe
  2⤵
  PID:9356
- C:\Windows\System\gMFudMy.exe
  C:\Windows\System\gMFudMy.exe
  2⤵
  PID:9408
- C:\Windows\System\WNqdNJn.exe
  C:\Windows\System\WNqdNJn.exe
  2⤵
  PID:9476
- C:\Windows\System\MhdWvBY.exe
  C:\Windows\System\MhdWvBY.exe
  2⤵
  PID:9552
- C:\Windows\System\CXHNEkH.exe
  C:\Windows\System\CXHNEkH.exe
  2⤵
  PID:9608
- C:\Windows\System\kBVPHrY.exe
  C:\Windows\System\kBVPHrY.exe
  2⤵
  PID:9688
- C:\Windows\System\CjAxQOG.exe
  C:\Windows\System\CjAxQOG.exe
  2⤵
  PID:9732
- C:\Windows\System\hVWbuBa.exe
  C:\Windows\System\hVWbuBa.exe
  2⤵
  PID:9816
- C:\Windows\System\WbSbkFM.exe
  C:\Windows\System\WbSbkFM.exe
  2⤵
  PID:9884
- C:\Windows\System\TJoEiDb.exe
  C:\Windows\System\TJoEiDb.exe
  2⤵
  PID:4148
- C:\Windows\System\MwlUcNx.exe
  C:\Windows\System\MwlUcNx.exe
  2⤵
  PID:556
- C:\Windows\System\EaQDbHB.exe
  C:\Windows\System\EaQDbHB.exe
  2⤵
  PID:10000
- C:\Windows\System\vGwwfki.exe
  C:\Windows\System\vGwwfki.exe
  2⤵
  PID:10012
- C:\Windows\System\UXYELIE.exe
  C:\Windows\System\UXYELIE.exe
  2⤵
  PID:8600
- C:\Windows\System\pRlwaCU.exe
  C:\Windows\System\pRlwaCU.exe
  2⤵
  PID:10128
- C:\Windows\System\tknLSqB.exe
  C:\Windows\System\tknLSqB.exe
  2⤵
  PID:10184
- C:\Windows\System\qbIjpLV.exe
  C:\Windows\System\qbIjpLV.exe
  2⤵
  PID:9240
- C:\Windows\System\gSrZMBh.exe
  C:\Windows\System\gSrZMBh.exe
  2⤵
  PID:9396
- C:\Windows\System\HQndyMm.exe
  C:\Windows\System\HQndyMm.exe
  2⤵
  PID:9548
- C:\Windows\System\LwhQANL.exe
  C:\Windows\System\LwhQANL.exe
  2⤵
  PID:9704
- C:\Windows\System\gjKajsu.exe
  C:\Windows\System\gjKajsu.exe
  2⤵
  PID:9856
- C:\Windows\System\SSaxftX.exe
  C:\Windows\System\SSaxftX.exe
  2⤵
  PID:2892
- C:\Windows\System\qWNXQxk.exe
  C:\Windows\System\qWNXQxk.exe
  2⤵
  PID:10040
- C:\Windows\System\VCeLVNZ.exe
  C:\Windows\System\VCeLVNZ.exe
  2⤵
  PID:10156
- C:\Windows\System\YEEIeIg.exe
  C:\Windows\System\YEEIeIg.exe
  2⤵
  PID:9504
- C:\Windows\System\IkMuLlj.exe
  C:\Windows\System\IkMuLlj.exe
  2⤵
  PID:9840
- C:\Windows\System\AnFOmyG.exe
  C:\Windows\System\AnFOmyG.exe
  2⤵
  PID:10072
- C:\Windows\System\eOJtLxa.exe
  C:\Windows\System\eOJtLxa.exe
  2⤵
  PID:9788
- C:\Windows\System\TdKObYj.exe
  C:\Windows\System\TdKObYj.exe
  2⤵
  PID:9460
- C:\Windows\System\ZJuqQMS.exe
  C:\Windows\System\ZJuqQMS.exe
  2⤵
  PID:10256
- C:\Windows\System\etSavCC.exe
  C:\Windows\System\etSavCC.exe
  2⤵
  PID:10284
- C:\Windows\System\xOHMIQp.exe
  C:\Windows\System\xOHMIQp.exe
  2⤵
  PID:10312
- C:\Windows\System\kWYJHlT.exe
  C:\Windows\System\kWYJHlT.exe
  2⤵
  PID:10340
- C:\Windows\System\miQaOFv.exe
  C:\Windows\System\miQaOFv.exe
  2⤵
  PID:10368
- C:\Windows\System\zltlztu.exe
  C:\Windows\System\zltlztu.exe
  2⤵
  PID:10396
- C:\Windows\System\AaERpey.exe
  C:\Windows\System\AaERpey.exe
  2⤵
  PID:10424
- C:\Windows\System\LinrkIa.exe
  C:\Windows\System\LinrkIa.exe
  2⤵
  PID:10452
- C:\Windows\System\WYtVjgR.exe
  C:\Windows\System\WYtVjgR.exe
  2⤵
  PID:10480
- C:\Windows\System\TUwfEuW.exe
  C:\Windows\System\TUwfEuW.exe
  2⤵
  PID:10508
- C:\Windows\System\Znmgjzc.exe
  C:\Windows\System\Znmgjzc.exe
  2⤵
  PID:10536
- C:\Windows\System\takRawj.exe
  C:\Windows\System\takRawj.exe
  2⤵
  PID:10564
- C:\Windows\System\YPZicMO.exe
  C:\Windows\System\YPZicMO.exe
  2⤵
  PID:10592
- C:\Windows\System\YoZwqsJ.exe
  C:\Windows\System\YoZwqsJ.exe
  2⤵
  PID:10620
- C:\Windows\System\AhcckRA.exe
  C:\Windows\System\AhcckRA.exe
  2⤵
  PID:10648
- C:\Windows\System\efnoDqU.exe
  C:\Windows\System\efnoDqU.exe
  2⤵
  PID:10676
- C:\Windows\System\xaOivsl.exe
  C:\Windows\System\xaOivsl.exe
  2⤵
  PID:10704
- C:\Windows\System\lzjmPDB.exe
  C:\Windows\System\lzjmPDB.exe
  2⤵
  PID:10732
- C:\Windows\System\WnxddPp.exe
  C:\Windows\System\WnxddPp.exe
  2⤵
  PID:10760
- C:\Windows\System\MYYNiTb.exe
  C:\Windows\System\MYYNiTb.exe
  2⤵
  PID:10788
- C:\Windows\System\yGWaBfN.exe
  C:\Windows\System\yGWaBfN.exe
  2⤵
  PID:10816
- C:\Windows\System\DfwRofd.exe
  C:\Windows\System\DfwRofd.exe
  2⤵
  PID:10844
- C:\Windows\System\WWHMPLD.exe
  C:\Windows\System\WWHMPLD.exe
  2⤵
  PID:10872
- C:\Windows\System\suFOjDj.exe
  C:\Windows\System\suFOjDj.exe
  2⤵
  PID:10900
- C:\Windows\System\VdnJhnt.exe
  C:\Windows\System\VdnJhnt.exe
  2⤵
  PID:10928
- C:\Windows\System\lUXGarg.exe
  C:\Windows\System\lUXGarg.exe
  2⤵
  PID:10956
- C:\Windows\System\rxDfacH.exe
  C:\Windows\System\rxDfacH.exe
  2⤵
  PID:10984
- C:\Windows\System\FLPpblD.exe
  C:\Windows\System\FLPpblD.exe
  2⤵
  PID:11012
- C:\Windows\System\HQWFMKn.exe
  C:\Windows\System\HQWFMKn.exe
  2⤵
  PID:11040
- C:\Windows\System\MMWQBVw.exe
  C:\Windows\System\MMWQBVw.exe
  2⤵
  PID:11068
- C:\Windows\System\gvXAkXz.exe
  C:\Windows\System\gvXAkXz.exe
  2⤵
  PID:11084
- C:\Windows\System\dqAKMGq.exe
  C:\Windows\System\dqAKMGq.exe
  2⤵
  PID:11128
- C:\Windows\System\KSucNSg.exe
  C:\Windows\System\KSucNSg.exe
  2⤵
  PID:11152
- C:\Windows\System\VREVhpa.exe
  C:\Windows\System\VREVhpa.exe
  2⤵
  PID:11180
- C:\Windows\System\rechRnj.exe
  C:\Windows\System\rechRnj.exe
  2⤵
  PID:11212
- C:\Windows\System\KwSmdSS.exe
  C:\Windows\System\KwSmdSS.exe
  2⤵
  PID:11252
- C:\Windows\System\frBXzse.exe
  C:\Windows\System\frBXzse.exe
  2⤵
  PID:10248
- C:\Windows\System\jWBibML.exe
  C:\Windows\System\jWBibML.exe
  2⤵
  PID:10308
- C:\Windows\System\apFBcSR.exe
  C:\Windows\System\apFBcSR.exe
  2⤵
  PID:10380
- C:\Windows\System\NqQMrNQ.exe
  C:\Windows\System\NqQMrNQ.exe
  2⤵
  PID:10444
- C:\Windows\System\PnnaBGf.exe
  C:\Windows\System\PnnaBGf.exe
  2⤵
  PID:5056
- C:\Windows\System\fAIjqKT.exe
  C:\Windows\System\fAIjqKT.exe
  2⤵
  PID:10548
- C:\Windows\System\KERftYK.exe
  C:\Windows\System\KERftYK.exe
  2⤵
  PID:10604
- C:\Windows\System\rKKUdac.exe
  C:\Windows\System\rKKUdac.exe
  2⤵
  PID:10668
- C:\Windows\System\LbjZClJ.exe
  C:\Windows\System\LbjZClJ.exe
  2⤵
  PID:9520
- C:\Windows\System\ZjSZAep.exe
  C:\Windows\System\ZjSZAep.exe
  2⤵
  PID:10800
- C:\Windows\System\uqqnSfg.exe
  C:\Windows\System\uqqnSfg.exe
  2⤵
  PID:10864
- C:\Windows\System\uoePWEg.exe
  C:\Windows\System\uoePWEg.exe
  2⤵
  PID:10924
- C:\Windows\System\khuvjrr.exe
  C:\Windows\System\khuvjrr.exe
  2⤵
  PID:10996
- C:\Windows\System\VJlnHch.exe
  C:\Windows\System\VJlnHch.exe
  2⤵
  PID:11064
- C:\Windows\System\hiZWNYP.exe
  C:\Windows\System\hiZWNYP.exe
  2⤵
  PID:11112
- C:\Windows\System\dVGngoD.exe
  C:\Windows\System\dVGngoD.exe
  2⤵
  PID:11164
- C:\Windows\System\gHxLVmU.exe
  C:\Windows\System\gHxLVmU.exe
  2⤵
  PID:11224
- C:\Windows\System\QMzgOah.exe
  C:\Windows\System\QMzgOah.exe
  2⤵
  PID:9656
- C:\Windows\System\oLweYeK.exe
  C:\Windows\System\oLweYeK.exe
  2⤵
  PID:10336
- C:\Windows\System\gHPIdCe.exe
  C:\Windows\System\gHPIdCe.exe
  2⤵
  PID:10436
- C:\Windows\System\ofiDBAb.exe
  C:\Windows\System\ofiDBAb.exe
  2⤵
  PID:10504
- C:\Windows\System\MfBQwRs.exe
  C:\Windows\System\MfBQwRs.exe
  2⤵
  PID:10636
- C:\Windows\System\cpEHgFi.exe
  C:\Windows\System\cpEHgFi.exe
  2⤵
  PID:10724
- C:\Windows\System\YjvdLqC.exe
  C:\Windows\System\YjvdLqC.exe
  2⤵
  PID:10828
- C:\Windows\System\AyznajI.exe
  C:\Windows\System\AyznajI.exe
  2⤵
  PID:10840
- C:\Windows\System\nRbilqz.exe
  C:\Windows\System\nRbilqz.exe
  2⤵
  PID:10980
- C:\Windows\System\ExjolKo.exe
  C:\Windows\System\ExjolKo.exe
  2⤵
  PID:11172
- C:\Windows\System\FVEboLW.exe
  C:\Windows\System\FVEboLW.exe
  2⤵
  PID:10416
- C:\Windows\System\uZVzjKM.exe
  C:\Windows\System\uZVzjKM.exe
  2⤵
  PID:10532
- C:\Windows\System\uyUdPiS.exe
  C:\Windows\System\uyUdPiS.exe
  2⤵
  PID:10976
- C:\Windows\System\JZtnNMR.exe
  C:\Windows\System\JZtnNMR.exe
  2⤵
  PID:11272
- C:\Windows\System\sAEsquQ.exe
  C:\Windows\System\sAEsquQ.exe
  2⤵
  PID:11308
- C:\Windows\System\WugOQuh.exe
  C:\Windows\System\WugOQuh.exe
  2⤵
  PID:11352
- C:\Windows\System\SNszkgK.exe
  C:\Windows\System\SNszkgK.exe
  2⤵
  PID:11388
- C:\Windows\System\SKkqooo.exe
  C:\Windows\System\SKkqooo.exe
  2⤵
  PID:11420
- C:\Windows\System\ZADGGIe.exe
  C:\Windows\System\ZADGGIe.exe
  2⤵
  PID:11464
- C:\Windows\System\vCtbMJG.exe
  C:\Windows\System\vCtbMJG.exe
  2⤵
  PID:11508
- C:\Windows\System\HLbdNNz.exe
  C:\Windows\System\HLbdNNz.exe
  2⤵
  PID:11540
- C:\Windows\System\ZxVtSpQ.exe
  C:\Windows\System\ZxVtSpQ.exe
  2⤵
  PID:11560
- C:\Windows\System\BXgECWs.exe
  C:\Windows\System\BXgECWs.exe
  2⤵
  PID:11588
- C:\Windows\System\GniUrMI.exe
  C:\Windows\System\GniUrMI.exe
  2⤵
  PID:11624
- C:\Windows\System\bwbZEeQ.exe
  C:\Windows\System\bwbZEeQ.exe
  2⤵
  PID:11644
- C:\Windows\System\UOocuIG.exe
  C:\Windows\System\UOocuIG.exe
  2⤵
  PID:11668
- C:\Windows\System\NJGuomz.exe
  C:\Windows\System\NJGuomz.exe
  2⤵
  PID:11696
- C:\Windows\System\UfAezXQ.exe
  C:\Windows\System\UfAezXQ.exe
  2⤵
  PID:11736
- C:\Windows\System\pTgvOCn.exe
  C:\Windows\System\pTgvOCn.exe
  2⤵
  PID:11764
- C:\Windows\System\fOUziGa.exe
  C:\Windows\System\fOUziGa.exe
  2⤵
  PID:11792
- C:\Windows\System\ESXJPWb.exe
  C:\Windows\System\ESXJPWb.exe
  2⤵
  PID:11820
- C:\Windows\System\CDYvApS.exe
  C:\Windows\System\CDYvApS.exe
  2⤵
  PID:11848
- C:\Windows\System\ParJgtN.exe
  C:\Windows\System\ParJgtN.exe
  2⤵
  PID:11880
- C:\Windows\System\SBmjDcX.exe
  C:\Windows\System\SBmjDcX.exe
  2⤵
  PID:11916
- C:\Windows\System\eTlhQPy.exe
  C:\Windows\System\eTlhQPy.exe
  2⤵
  PID:11932
- C:\Windows\System\TblulYf.exe
  C:\Windows\System\TblulYf.exe
  2⤵
  PID:11948
- C:\Windows\System\sDJbCuw.exe
  C:\Windows\System\sDJbCuw.exe
  2⤵
  PID:11972
- C:\Windows\System\pztIBAU.exe
  C:\Windows\System\pztIBAU.exe
  2⤵
  PID:11992
- C:\Windows\System\ABFvETl.exe
  C:\Windows\System\ABFvETl.exe
  2⤵
  PID:12016
- C:\Windows\System\hrYKBnn.exe
  C:\Windows\System\hrYKBnn.exe
  2⤵
  PID:12040
- C:\Windows\System\srCAmHP.exe
  C:\Windows\System\srCAmHP.exe
  2⤵
  PID:12064
- C:\Windows\System\IUccFeE.exe
  C:\Windows\System\IUccFeE.exe
  2⤵
  PID:12084
- C:\Windows\System\PHaCWuL.exe
  C:\Windows\System\PHaCWuL.exe
  2⤵
  PID:12112
- C:\Windows\System\pFMOfEa.exe
  C:\Windows\System\pFMOfEa.exe
  2⤵
  PID:12140
- C:\Windows\System\puauLqc.exe
  C:\Windows\System\puauLqc.exe
  2⤵
  PID:12156
- C:\Windows\System\TCHcQxq.exe
  C:\Windows\System\TCHcQxq.exe
  2⤵
  PID:12184
- C:\Windows\System\reXUDUK.exe
  C:\Windows\System\reXUDUK.exe
  2⤵
  PID:12212
- C:\Windows\System\aLGebed.exe
  C:\Windows\System\aLGebed.exe
  2⤵
  PID:12244
- C:\Windows\System\hqvekCf.exe
  C:\Windows\System\hqvekCf.exe
  2⤵
  PID:12280
- C:\Windows\System\EgpRoop.exe
  C:\Windows\System\EgpRoop.exe
  2⤵
  PID:11080
- C:\Windows\System\dGWwgMs.exe
  C:\Windows\System\dGWwgMs.exe
  2⤵
  PID:11292
- C:\Windows\System\VylobwL.exe
  C:\Windows\System\VylobwL.exe
  2⤵
  PID:11348
- C:\Windows\System\dBhmyXM.exe
  C:\Windows\System\dBhmyXM.exe
  2⤵
  PID:11536
- C:\Windows\System\hpfSbCK.exe
  C:\Windows\System\hpfSbCK.exe
  2⤵
  PID:11596
- C:\Windows\System\bemABTG.exe
  C:\Windows\System\bemABTG.exe
  2⤵
  PID:11632
- C:\Windows\System\jsXTIxi.exe
  C:\Windows\System\jsXTIxi.exe
  2⤵
  PID:11680
- C:\Windows\System\RnlKrpK.exe
  C:\Windows\System\RnlKrpK.exe
  2⤵
  PID:11760
- C:\Windows\System\AVhMcRC.exe
  C:\Windows\System\AVhMcRC.exe
  2⤵
  PID:11900
- C:\Windows\System\peSLoVw.exe
  C:\Windows\System\peSLoVw.exe
  2⤵
  PID:11928
- C:\Windows\System\ysPkqWW.exe
  C:\Windows\System\ysPkqWW.exe
  2⤵
  PID:12036
- C:\Windows\System\khbaHhA.exe
  C:\Windows\System\khbaHhA.exe
  2⤵
  PID:388
- C:\Windows\System\DNGwItK.exe
  C:\Windows\System\DNGwItK.exe
  2⤵
  PID:4860
- C:\Windows\System\ydnOcVp.exe
  C:\Windows\System\ydnOcVp.exe
  2⤵
  PID:392
- C:\Windows\System\FzfZdJr.exe
  C:\Windows\System\FzfZdJr.exe
  2⤵
  PID:12000
- C:\Windows\System\vmyNmoV.exe
  C:\Windows\System\vmyNmoV.exe
  2⤵
  PID:12128
- C:\Windows\System\JOIwtbI.exe
  C:\Windows\System\JOIwtbI.exe
  2⤵
  PID:12148
- C:\Windows\System\veufdlQ.exe
  C:\Windows\System\veufdlQ.exe
  2⤵
  PID:12168
- C:\Windows\System\fiVjICD.exe
  C:\Windows\System\fiVjICD.exe
  2⤵
  PID:11444
- C:\Windows\System\KUfiDTv.exe
  C:\Windows\System\KUfiDTv.exe
  2⤵
  PID:11384
- C:\Windows\System\SytuYko.exe
  C:\Windows\System\SytuYko.exe
  2⤵
  PID:11576
- C:\Windows\System\WLNkZoF.exe
  C:\Windows\System\WLNkZoF.exe
  2⤵
  PID:11728
- C:\Windows\System\cngMmrY.exe
  C:\Windows\System\cngMmrY.exe
  2⤵
  PID:3872
- C:\Windows\System\gxsplhc.exe
  C:\Windows\System\gxsplhc.exe
  2⤵
  PID:12096
- C:\Windows\System\GoGItMV.exe
  C:\Windows\System\GoGItMV.exe
  2⤵
  PID:11980
- C:\Windows\System\TufZEYM.exe
  C:\Windows\System\TufZEYM.exe
  2⤵
  PID:12124
- C:\Windows\System\cbvSSci.exe
  C:\Windows\System\cbvSSci.exe
  2⤵
  PID:12260
- C:\Windows\System\fXqIqEi.exe
  C:\Windows\System\fXqIqEi.exe
  2⤵
  PID:11488
- C:\Windows\System\myuNega.exe
  C:\Windows\System\myuNega.exe
  2⤵
  PID:11964
- C:\Windows\System\HXTCGqH.exe
  C:\Windows\System\HXTCGqH.exe
  2⤵
  PID:2796
- C:\Windows\System\RBmnKgF.exe
  C:\Windows\System\RBmnKgF.exe
  2⤵
  PID:12204
- C:\Windows\System\kMeMmCr.exe
  C:\Windows\System\kMeMmCr.exe
  2⤵
  PID:11988
- C:\Windows\System\UhxlQPW.exe
  C:\Windows\System\UhxlQPW.exe
  2⤵
  PID:12296
- C:\Windows\System\ORceqSx.exe
  C:\Windows\System\ORceqSx.exe
  2⤵
  PID:12320
- C:\Windows\System\uTrYExF.exe
  C:\Windows\System\uTrYExF.exe
  2⤵
  PID:12352
- C:\Windows\System\DSLQVNX.exe
  C:\Windows\System\DSLQVNX.exe
  2⤵
  PID:12368
- C:\Windows\System\nQTiEzh.exe
  C:\Windows\System\nQTiEzh.exe
  2⤵
  PID:12396
- C:\Windows\System\kCXpTaC.exe
  C:\Windows\System\kCXpTaC.exe
  2⤵
  PID:12432
- C:\Windows\System\kiVWwzZ.exe
  C:\Windows\System\kiVWwzZ.exe
  2⤵
  PID:12456
- C:\Windows\System\bxoQGcA.exe
  C:\Windows\System\bxoQGcA.exe
  2⤵
  PID:12488
- C:\Windows\System\cmFpSVj.exe
  C:\Windows\System\cmFpSVj.exe
  2⤵
  PID:12512
- C:\Windows\System\AHePfdV.exe
  C:\Windows\System\AHePfdV.exe
  2⤵
  PID:12536
- C:\Windows\System\ZJRRehU.exe
  C:\Windows\System\ZJRRehU.exe
  2⤵
  PID:12568
- C:\Windows\System\YSSwGPI.exe
  C:\Windows\System\YSSwGPI.exe
  2⤵
  PID:12604
- C:\Windows\System\myvQXuz.exe
  C:\Windows\System\myvQXuz.exe
  2⤵
  PID:12632
- C:\Windows\System\yPWHNhk.exe
  C:\Windows\System\yPWHNhk.exe
  2⤵
  PID:12648
- C:\Windows\System\DzuoAZL.exe
  C:\Windows\System\DzuoAZL.exe
  2⤵
  PID:12676
- C:\Windows\System\layMAaB.exe
  C:\Windows\System\layMAaB.exe
  2⤵
  PID:12712
- C:\Windows\System\cHywRjz.exe
  C:\Windows\System\cHywRjz.exe
  2⤵
  PID:12732
- C:\Windows\System\QdycbuM.exe
  C:\Windows\System\QdycbuM.exe
  2⤵
  PID:12768
- C:\Windows\System\YbSSygG.exe
  C:\Windows\System\YbSSygG.exe
  2⤵
  PID:12788
- C:\Windows\System\sSyJcqa.exe
  C:\Windows\System\sSyJcqa.exe
  2⤵
  PID:12808
- C:\Windows\System\OupYljW.exe
  C:\Windows\System\OupYljW.exe
  2⤵
  PID:12844
- C:\Windows\System\VRDEucV.exe
  C:\Windows\System\VRDEucV.exe
  2⤵
  PID:12876
- C:\Windows\System\bWbrJmP.exe
  C:\Windows\System\bWbrJmP.exe
  2⤵
  PID:12904
- C:\Windows\System\qItmwtz.exe
  C:\Windows\System\qItmwtz.exe
  2⤵
  PID:12932
- C:\Windows\System\xdqYsoR.exe
  C:\Windows\System\xdqYsoR.exe
  2⤵
  PID:12968
- C:\Windows\System\lPmaGID.exe
  C:\Windows\System\lPmaGID.exe
  2⤵
  PID:12996
- C:\Windows\System\XCqqOtx.exe
  C:\Windows\System\XCqqOtx.exe
  2⤵
  PID:13012
- C:\Windows\System\qKlfrxU.exe
  C:\Windows\System\qKlfrxU.exe
  2⤵
  PID:13052
- C:\Windows\System\OESVvOd.exe
  C:\Windows\System\OESVvOd.exe
  2⤵
  PID:13072
- C:\Windows\System\LawxIbc.exe
  C:\Windows\System\LawxIbc.exe
  2⤵
  PID:13104
- C:\Windows\System\SykxZFP.exe
  C:\Windows\System\SykxZFP.exe
  2⤵
  PID:13124
- C:\Windows\System\irgMFIp.exe
  C:\Windows\System\irgMFIp.exe
  2⤵
  PID:13152
- C:\Windows\System\SwzaGEE.exe
  C:\Windows\System\SwzaGEE.exe
  2⤵
  PID:13188
- C:\Windows\System\BVmcIJn.exe
  C:\Windows\System\BVmcIJn.exe
  2⤵
  PID:13208
- C:\Windows\System\SnJQuqU.exe
  C:\Windows\System\SnJQuqU.exe
  2⤵
  PID:13236
- C:\Windows\System\DqoZdCH.exe
  C:\Windows\System\DqoZdCH.exe
  2⤵
  PID:13272
- C:\Windows\System\yvMcdkc.exe
  C:\Windows\System\yvMcdkc.exe
  2⤵
  PID:13300
- C:\Windows\System\UspLekp.exe
  C:\Windows\System\UspLekp.exe
  2⤵
  PID:11380
- C:\Windows\System\DtsFMCH.exe
  C:\Windows\System\DtsFMCH.exe
  2⤵
  PID:12348
- C:\Windows\System\uxkJvhE.exe
  C:\Windows\System\uxkJvhE.exe
  2⤵
  PID:12384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jxq4icvo.v13.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AhImQQP.exe

Filesize
2.9MB

MD5
2a70cc2595943c8924f864b1b327d87f

SHA1
3fb996f0a4bc4265504ad0448496ed6a29c4aa94

SHA256
00faa420e7c66b0e80001eb4d3a9a01c507b8553064f57b0274c5f275f346d89

SHA512
9cbb94556a8c5ba50f782e914f06d0f25d19f7e041c92cbdcd8d3a311425c12b28f99faabfa0f9ea5f37b19e0e91f395bd4430234be1bb646824f075ee685e55

Download Submit
C:\Windows\System\BvhPzZe.exe

Filesize
2.9MB

MD5
5cba6d2ce9aef932297f78c279316d81

SHA1
3f1f56b68f0618efa90349f6ee90359ce8113cb3

SHA256
a349402be7a63fa48622f431eb9f50cdb037f1f8a2b7cb0f3ab3b3949e3d4188

SHA512
6c43c6afec706adc414d5aeeea5282878910e389eb1c04e62790a23eac9fa61d49f39d71ec075c843bcb57debf2d050285ae20935cab2304d96d9f41b058225f

Download Submit
C:\Windows\System\DEitRSQ.exe

Filesize
2.9MB

MD5
2f27b07e43d5b149a74cdd2d98203148

SHA1
9ab99ccfa0e8d0ad09d98523d0ead23a02f33d8c

SHA256
8b41ed1279f4e0073bd17ca57f16dfae3b67169a0ce14e6f074330f5a0512909

SHA512
3dceab77144126c58c196b7a1bee60ea663d66fb4f0f86a7d4ee876acd5558ae69628dbd6ef1b0c7d2e57027dbb4551b3a84c89df74df7079b27218cd85374c7

Download Submit
C:\Windows\System\FeNlSRE.exe

Filesize
2.9MB

MD5
0b1623fdc050f4f17b05ce124611d1d5

SHA1
4a089f2a9899bd7b4902fa65f9ae754901b39f71

SHA256
abf5a42113c9443e7e312f66f5d1a59024e69641933bb1f94ac6f18f70c298c1

SHA512
b0c134033b15810fa61e6160a5b72ff2e110c18c71a055dbc2a32050c293b82db9fdf750ee58128f4d26dff48bea0ad259bedec5d7b28b049bc57b6dba8d0453

Download Submit
C:\Windows\System\GlMmoJs.exe

Filesize
2.9MB

MD5
73c7268146c371b8183069d38f988fdd

SHA1
94a58a772b90c456249cd54b6abf15ea1b3a7ae8

SHA256
dc8684b65f82aa306ff36dbeee7f49c7b0372d24b7f74cde1d6c707c1f21bf45

SHA512
762de07a123781f6bcaa8685280fabe3d91c5fd68b9b9c9f38f74818e3a33726bc460b5af3b50fac2e795997e0ca5199e46ce518f31b4f04ff3ba5b6089ae85f

Download Submit
C:\Windows\System\GrRThrr.exe

Filesize
2.9MB

MD5
5c92130934e32b0b674e4b2c8be48347

SHA1
b29b2e09f89a013f6d6c1fea5b17811bb03f12f6

SHA256
40c6f846834299fb5627df8eab38ec76d94dab78c3fa96abc7b7a2ab9f4b25a5

SHA512
c7b9cf7a3680889729cc172d74e73cf3a558adfd4483c238b41115fee9542bc6a523998dfc8b89061943a801b711356d87eadeb9d56e4e6f2622936c9beb98d1

Download Submit
C:\Windows\System\JWUUGso.exe

Filesize
2.9MB

MD5
8afee3e4170a21962d6ec7d07fa9ce0a

SHA1
662aae57b2986597e7668546aabeb250a559e43b

SHA256
d5614fe5abe53bce19aab660c385c4c96cf794374b3d94b4060d1cd50905c85a

SHA512
c93e051b6ff3f6b0195471d7673c04cab6a205d32000354849e108ed29aa9c81575951074236b700b92f44f0e3d13d14324ea3b8c565ea40c3f2e0358c14315a

Download Submit
C:\Windows\System\JYCwnEZ.exe

Filesize
2.9MB

MD5
64db494051d1c4aef75fb387209aec81

SHA1
128f619d2d7045dd74b38b9dd30d13d4c99bc299

SHA256
6f6808ba9afaa1ee252d24dca39221656f6f40905e0f82962cc89609b7daf68e

SHA512
7220169cfcdc511088eeb1651c9f2e3b4bf1ad8575b6259b93e99a4906e986e3d9c9b3a7f34075f46d531eeaf84fa6f6403b6211a94b722cde46139ae334c9fe

Download Submit
C:\Windows\System\JrqAWoS.exe

Filesize
2.9MB

MD5
65d5f2b9737ade937eea6a8d342b027f

SHA1
8264d1c368bcea7a5159709dd6b91579dea54889

SHA256
45a75b839c1b16f55020960ef61e3d781ff22cbabbd0734d481d09c2e1989454

SHA512
d0a95906fb9869c83d8cfe808cd5c7b0d09b6f7dfbd15e4989970359c5a1b2b97b234d147c46012e07e65ed9af19be003793176d1ef1954a47193d1e821eee1e

Download Submit
C:\Windows\System\OccZlvF.exe

Filesize
2.9MB

MD5
ae199113d83bae65f12539576a937814

SHA1
bb66e772c66214ea40d6e906fd454ad42b8d6795

SHA256
9cbea6956e54d8dd104a9a124c1c45b6dbf608d898f327bbccc30573733eef5e

SHA512
4071abac57314e1b0df83230fa14d1e4fba7de7ef5f92129f5dc27f694414f89f47b1b0ffeeab6ffe5e700f47969c4e7d9ef175efce1e32f9994dfa29da0abf3

Download Submit
C:\Windows\System\PFtgnVE.exe

Filesize
2.9MB

MD5
0f5a4197d441950d5e7ba56e3198a59a

SHA1
5006dc222dda47dbea3651758a79b74e5ca48135

SHA256
e94fa45bbbffa4e0b13422668bfcd4d0f4657a04190dcc46639a65dbb022ba32

SHA512
8d0ca73e2d0c24b35c2f6cf610a2da1b968d95a922461bacca449e83e9a27d9c99275cabc6dc3e498de021966dc10141b0efa55662b06a0377deedbc373dd7f8

Download Submit
C:\Windows\System\PYDtaht.exe

Filesize
2.9MB

MD5
8c1086eaffe241ce696126a61158e09b

SHA1
a98fde2761e2e915f62fb012858fb38aa58c8fbb

SHA256
d76a3f3ffa16c79da9452d71afb0ab74b5ea2389754e7c7f4daed7d1ea9fd4d4

SHA512
b39733cfbff63952d0990cbd94d3b4310fb3f9cf65797de301a14a0fb2f47d08f8dbc2c2289481b8b08ebbd39d6e7971ae013e815518211636fc710552363432

Download Submit
C:\Windows\System\QZoTWKD.exe

Filesize
2.9MB

MD5
713b92677f6766e8fe6c7c0411f721f1

SHA1
c69e218d2a2e9f875148b9bf915511f0ba525dfc

SHA256
ab3804d941595227761c46fe532170396989f6085b732ba58e47508ab7da5a9b

SHA512
8d090d9e8b941627ed7ebe7cc166c5f3539a1444e8370f04dd5b962607800351e51d58a6a83fe8bc228aee1813b1ee0f53abef3f488d8bbf777a3c0c6e93e283

Download Submit
C:\Windows\System\TrfRxDu.exe

Filesize
2.9MB

MD5
5ffe8453df2638aa8e0e724252ac79d9

SHA1
f13f2f25bb8bb909a2ef3d9b328d3c64b91d5729

SHA256
5da687ee387adf8cc45d4d02446385f75ccffd01c87c564964b8c0f78ca12896

SHA512
e6f828ad9624835a11debbd1a056bc4eefd34972cd3e1742f28498fef2f6b73051bf743ae753ff81e415527f5378ae5dde35781a4e8e95a64224f2be422aa383

Download Submit
C:\Windows\System\TxFOpVE.exe

Filesize
2.9MB

MD5
a554adab0a276d0edf83887c2d8634da

SHA1
f64582ee1a56d350f8a4f21cbef58d5eb65db75e

SHA256
63c60ac7f8d8b491d925602febebb3493db48b350f1cbf739e4e28f96ecd5849

SHA512
c7aa13bb5ef1cc33e4af19845703e378ffa78ea4fad1d36167c1fd1e4e929618ec99e84d6f793276306a2f1ae595f4a8e1218235a313230d6fa6468f5567713a

Download Submit
C:\Windows\System\XctTXDv.exe

Filesize
2.9MB

MD5
af8a9082c6904cbaac3f95e30e08c71d

SHA1
1fa0d57abeb2fa48973c3ed07ca88a2c55de734a

SHA256
5da0a68734f75d6a4db0f2c9c39c45dc95fad71d8f973a367f3bdc32096320db

SHA512
7848a97cf83a7d223f3ee542d627d2e73d9f51721747705b6e780543f2e6c3042a319201fcc7119c8c163c1a897b0feb48b6de4032d151eb2feb147e6032f1b3

Download Submit
C:\Windows\System\ZBtWucn.exe

Filesize
2.9MB

MD5
feb16e6fe5c6ef95d36c120a68594193

SHA1
482949be81d47b27f8fb4f95c79ac79273b07894

SHA256
6eddfbc37d22d9bdbb632113ba9a4513fe201a7d37cc79f036f726ec9f2ea3f3

SHA512
b326cd773fb5e2768b6d6d738b6dc4b172ae89ed29e5c04af8a83d2b3f4a0ee0c4bcc03ba8948f5324bb3e97fc3119b99e98524ecc771631e4b5b3417c2d6520

Download Submit
C:\Windows\System\ZFcyYbk.exe

Filesize
2.9MB

MD5
8ff94dd915b2d44d10862e1cb010d287

SHA1
1bbeead235cfe3c7862cd4e74cb311db7873d358

SHA256
12340ea80fef9eb5587cb6ee754e142629f0260663ff64e7271ffd8f8ceb845c

SHA512
d052f44a595aeee0185b47ba9149dd710e454aefab1ccc80d716f88cf2e69be7f505654cbb45703136eb0eed0c908af3d6eecc5d0b41da35deb249918cd9da3c

Download Submit
C:\Windows\System\ZXQTpGO.exe

Filesize
2.9MB

MD5
0f54c9184a8c65931d8b1aa7d1258d83

SHA1
f414f30f02d879a2671b610c3f490a657e0c20e5

SHA256
548b9f4f9073f75ad617a467806e5244f872c59480e415918f259a3d83d998e1

SHA512
0ba017c1bd5447033d51ecc982b6c956989009dfba851c352ff3d6e74b928170f9257759b8883eadd34818ed0ca7950e4e0a1b5a016b6d7b338274df70d1da34

Download Submit
C:\Windows\System\bYAzaml.exe

Filesize
2.9MB

MD5
746a78741bef940916798c8eeb1cf36b

SHA1
6904c823ecb8108f060bab170b9de264f0494238

SHA256
e5fee5c212fc85c2f4ed05532b1a63fea1f88eff284ac5148cac80c44b88cfc0

SHA512
e6688db4d57bae4000b1962c77a7f62fdb7a2193df5313845b312aa9ff530e7644a0bd68f9f762c0e30e3d3642b8b0276f0a8b0ecc34960fd53d57b3081c92ed

Download Submit
C:\Windows\System\dFhFoOo.exe

Filesize
2.9MB

MD5
30a2c550845ed210733c15e5f3e6a08b

SHA1
ef2c0da29f83df4fa82e6fd78f6e6c8ecbe4a92d

SHA256
6c52a09ba9910103fd8f4c0cae9973c86fe6dc7c0ff7488d81022e6c9ae6ec16

SHA512
8d5536f5a556b0330bb94c9252856d9c9821518528681c295a7309f050cce88e2f03bf0d6e0db9ae8d6facbcf11bdbd5c2b820b3246fea9bf97ef95353a80408

Download Submit
C:\Windows\System\fERnyXz.exe

Filesize
2.9MB

MD5
c94e85135f28ac653ee576667fe17f8b

SHA1
b26f3ff7d5c1d7827a916b6265ffac11cafad3d2

SHA256
9825f668a6ef2cd495bc4e48feacb0628a71556cf003502e7248c154e448f52c

SHA512
6a12ebaec25e213a78e708b8d3f7c252e1f8d48113fe82e44afa378e163de8541150b1b884ffa8e7a1d1848e86317167c657baaab8ed6c2a79e5a31ef0006c6c

Download Submit
C:\Windows\System\gBmXTdU.exe

Filesize
2.9MB

MD5
7ed95ca68a420514023bafbd2c1336bc

SHA1
16c40c431218437617516dcb481492dade43fa00

SHA256
b56f0ac8fdd5a4b7be34e7f14ca317ace8293625bf61aecf35f27edded97bbbc

SHA512
6b7f2ee328a833f219790d8dfa37a2041566cd0ce50f9d9b30623b68afb101697a0d5ccb8069a881aa1f745408057500ba1516e9f664db97153180176d7a028e

Download Submit
C:\Windows\System\hLdFbCX.exe

Filesize
2.9MB

MD5
367f7bdceac8d4d4cfe77d54149d55cf

SHA1
ab7fca100ad38aa6f038fef0ff4611291a82c5b6

SHA256
ad5e629068e9099494b7364bb22b54190cda2e6a5a4c30055ba070a7d68eafdd

SHA512
414d1b35d60656e203597b62b2379a5502efded948d06a0b5c584510a79170e320ca9c4cd9aa89771614bd662650317a52dfc6604c5ed7b84987401351913243

Download Submit
C:\Windows\System\jWqlPvd.exe

Filesize
2.9MB

MD5
aa12f93d92cee85082d11a83bab45050

SHA1
a92ee9dd457e846d241434c0afbe8a4c27701383

SHA256
02d20aadb5b4d6015891ee562f3dc89f0079a7e720c79bea004dcf90c82c5b48

SHA512
7ba62321dd5675596a00edc8c53502241536e6bc6a64a41943d74a969ee5431d81731e51c4d7e3e62e790bcdf65c33b743df02196de84e72e528334a7e224eef

Download Submit
C:\Windows\System\lQOwEmG.exe

Filesize
2.9MB

MD5
7fef24f5e906a62ca4e7118d8b7aae9d

SHA1
673b7b18791a21e34239fe4181c4d1add794ce78

SHA256
45792738789765bc8c304cb4c3037b250236a654120fbcf5ce5041a1162f484d

SHA512
e1446016195f7dd241c3fe6cc0c36d11b7b9c003ab40218abb91e866ce4e2c6d870a1b32d7a20db24951bd788271aea6196f84b4e5440d036981a2d9ba9149a4

Download Submit
C:\Windows\System\lYxCAoB.exe

Filesize
2.9MB

MD5
f639d6858651d7c627b8eb42adfc3761

SHA1
68017e4ebe42b8276cf4023148656ac4ae198e16

SHA256
93e48cfcc22bec9edc6c27666a6ae6401e7be53dadace4542bf20fdf63098481

SHA512
898bfa47bdce6a756c9d62488f31cc7067edc284e236eca073901758cfee168a6bde54b2106af7f5c041f90bf642fbd3ec1b3c5aa2eb73fdc5f00b102821e647

Download Submit
C:\Windows\System\mCTdjmU.exe

Filesize
2.9MB

MD5
268c5af2a65af211ae275194788070a6

SHA1
f6d5388434b9c677a1ff31b488ebc40d45f2303c

SHA256
7648388c83dd079f97b81353e707d0b84a078259c65e367fea2bdd01fdb00d2f

SHA512
7e1e925d06c029b5d130bdf6b7b6f6bf0940a93d91be0eaeabb9b3d95d98b01f5f2dda3c7514c97abe592f4d3b1238b98e5dceade1e24684880a192e0455005b

Download Submit
C:\Windows\System\mLPpQOx.exe

Filesize
2.9MB

MD5
0960b9cfcc15a6932a59467103b372cf

SHA1
62569c24846a8d4df671c24ab84b2d9cab549aae

SHA256
cb735403470d994b3a24c9636247971ff37d1df7c478d97c36ae02ddcb5591cd

SHA512
0cf54f9875e05fafd191cfa217d6efe921451aa436b7b589d3ae229108f86e4099f5fdce01f6c41c87c00646b97e132fa4ae5c83699ac74425e13353da618c28

Download Submit
C:\Windows\System\nqdnkss.exe

Filesize
2.9MB

MD5
c8a575477d95cf12ec3d99cee6eb391b

SHA1
645a898f406bd7601a305cbe4d10b2a089039db2

SHA256
005bd3c8cd947a0c4dbc62d68c2bb46c47ac42256abb08cba65226cd619dbb96

SHA512
be54f5ec7333c0bd3ec3822003a62f46197976ce53e1ef63bae2089f26eea85c3aa60e044c11d04092e2887b0e684b3a5ed7ccd0fc18567801b020318df97040

Download Submit
C:\Windows\System\qUrqvHw.exe

Filesize
2.9MB

MD5
d3c99c25987f179e983c938c794fbccd

SHA1
41ea6ff0ffb13face7128c24498af3a510f3466a

SHA256
24ae65321793b98381652b4de5b5f233b40864b81ceba47f145df38a225ac8b5

SHA512
c77c429a22fc86ad4ac63302f2ef6b7b1612b1267d367d1b54ce87ff87001cfcd2fa6a510b1ef4d3a9d1c36b799e4966a31ebc94b487807259a6f9dd353fcb16

Download Submit
C:\Windows\System\sXYKGTD.exe

Filesize
2.9MB

MD5
70ceb7f4d39c2281276cc0ac1b587d86

SHA1
e9eaf33a5e7326618008427c4261266fcb32f834

SHA256
c0e5f9912d4a96532fd6511fb851cbca4c6ebc1cb33e6d8768053cdb2db3f267

SHA512
939896df4c9f9a982fe7ffb50f6f29d3f70216644b391618d5a9a3ed06fbec10dc358c9f3ebab4fa4f07922317ce46fc3c0ea823c1eb6f9ad14a52610bf8bc89

Download Submit
C:\Windows\System\uAscyzK.exe

Filesize
2.9MB

MD5
76e50da9896700be2f6cf6e10d2f70ab

SHA1
b601a6921aff35a7d6f0a17880b53f3df544bb00

SHA256
4168d331dec5cc2ed81aaf43a51567677d6c3b727fa809f3a53424e9f7c8f1d9

SHA512
1f394c52cec3fcd9c0fb89a1b501cfc4bc61d8ba9dec1d51387572338db27057f947af1c1aa8f3d34bafb38b68162635be4268146c655840a5525794ef8ff9d2

Download Submit
C:\Windows\System\yjaxqYN.exe

Filesize
8B

MD5
f249cce64f1edf5dc7bee5be6e2d5ad9

SHA1
0d569e38ec2ee4118bd367894784a63582261e47

SHA256
c376b4c1019dfb02d31ea3137efb150405ef95ba0305dcf5e026248ffc8d7cc2

SHA512
fdeb5b006eba899c911e624dadfb6c7b2eb030236757e187df8ba8d194a5a42df30b590d0fcf3f859b2532e60fc00c33154f75c1e6481913447ff2fa15b08be2

Download Submit
C:\Windows\System\ywCHdRg.exe

Filesize
2.9MB

MD5
dd8f3b240fab90114c2d971bf239b12b

SHA1
d2d9cfba8c73857f33d92dcdaf8c67543352d745

SHA256
d5cb57e0efe95ff93231ded8ca2805c4d491c19d8144396b3faf1fa41bda3afd

SHA512
1c01d084a51ff6d638731ce90c0348c7120ce9d4ec8a8cad701dd12ab62ba66a597a37d2d698b4f237bd93026eb9dab8a15d9911e587dcba9796af8b3278b6f0

Download Submit
memory/892-124-0x00007FF61BF00000-0x00007FF61C2F6000-memory.dmp

Filesize
4.0MB

Download
memory/892-2046-0x00007FF61BF00000-0x00007FF61C2F6000-memory.dmp

Filesize
4.0MB

Download
memory/1188-142-0x00007FF6664D0000-0x00007FF6668C6000-memory.dmp

Filesize
4.0MB

Download
memory/1188-2044-0x00007FF6664D0000-0x00007FF6668C6000-memory.dmp

Filesize
4.0MB

Download
memory/1612-138-0x00007FF6A1960000-0x00007FF6A1D56000-memory.dmp

Filesize
4.0MB

Download
memory/1612-2051-0x00007FF6A1960000-0x00007FF6A1D56000-memory.dmp

Filesize
4.0MB

Download
memory/1968-2058-0x00007FF68A900000-0x00007FF68ACF6000-memory.dmp

Filesize
4.0MB

Download
memory/1968-188-0x00007FF68A900000-0x00007FF68ACF6000-memory.dmp

Filesize
4.0MB

Download
memory/2300-2036-0x00007FF7DAF60000-0x00007FF7DB356000-memory.dmp

Filesize
4.0MB

Download
memory/2300-140-0x00007FF7DAF60000-0x00007FF7DB356000-memory.dmp

Filesize
4.0MB

Download
memory/2312-2037-0x00007FF6DDFD0000-0x00007FF6DE3C6000-memory.dmp

Filesize
4.0MB

Download
memory/2312-36-0x00007FF6DDFD0000-0x00007FF6DE3C6000-memory.dmp

Filesize
4.0MB

Download
memory/2316-136-0x00007FF6FB7B0000-0x00007FF6FBBA6000-memory.dmp

Filesize
4.0MB

Download
memory/2316-2055-0x00007FF6FB7B0000-0x00007FF6FBBA6000-memory.dmp

Filesize
4.0MB

Download
memory/2344-143-0x00007FF772A40000-0x00007FF772E36000-memory.dmp

Filesize
4.0MB

Download
memory/2344-2043-0x00007FF772A40000-0x00007FF772E36000-memory.dmp

Filesize
4.0MB

Download
memory/2608-141-0x00007FF6EDB90000-0x00007FF6EDF86000-memory.dmp

Filesize
4.0MB

Download
memory/2608-2042-0x00007FF6EDB90000-0x00007FF6EDF86000-memory.dmp

Filesize
4.0MB

Download
memory/2652-145-0x00007FF78A490000-0x00007FF78A886000-memory.dmp

Filesize
4.0MB

Download
memory/2652-2052-0x00007FF78A490000-0x00007FF78A886000-memory.dmp

Filesize
4.0MB

Download
memory/2668-2040-0x00007FF638F90000-0x00007FF639386000-memory.dmp

Filesize
4.0MB

Download
memory/2668-102-0x00007FF638F90000-0x00007FF639386000-memory.dmp

Filesize
4.0MB

Download
memory/2780-134-0x00007FF701B20000-0x00007FF701F16000-memory.dmp

Filesize
4.0MB

Download
memory/2780-2049-0x00007FF701B20000-0x00007FF701F16000-memory.dmp

Filesize
4.0MB

Download
memory/3016-2038-0x00007FF62BC10000-0x00007FF62C006000-memory.dmp

Filesize
4.0MB

Download
memory/3016-82-0x00007FF62BC10000-0x00007FF62C006000-memory.dmp

Filesize
4.0MB

Download
memory/3288-2059-0x00007FF729090000-0x00007FF729486000-memory.dmp

Filesize
4.0MB

Download
memory/3288-215-0x00007FF729090000-0x00007FF729486000-memory.dmp

Filesize
4.0MB

Download
memory/3528-2053-0x00007FF7194D0000-0x00007FF7198C6000-memory.dmp

Filesize
4.0MB

Download
memory/3528-137-0x00007FF7194D0000-0x00007FF7198C6000-memory.dmp

Filesize
4.0MB

Download
memory/3580-144-0x00007FF727C40000-0x00007FF728036000-memory.dmp

Filesize
4.0MB

Download
memory/3580-2048-0x00007FF727C40000-0x00007FF728036000-memory.dmp

Filesize
4.0MB

Download
memory/3708-0-0x00007FF696ED0000-0x00007FF6972C6000-memory.dmp

Filesize
4.0MB

Download
memory/3708-1-0x0000028AAA610000-0x0000028AAA620000-memory.dmp

Filesize
64KB

Download
memory/4156-135-0x00007FF712E50000-0x00007FF713246000-memory.dmp

Filesize
4.0MB

Download
memory/4156-2050-0x00007FF712E50000-0x00007FF713246000-memory.dmp

Filesize
4.0MB

Download
memory/4168-131-0x00007FF655FF0000-0x00007FF6563E6000-memory.dmp

Filesize
4.0MB

Download
memory/4168-2047-0x00007FF655FF0000-0x00007FF6563E6000-memory.dmp

Filesize
4.0MB

Download
memory/4452-47-0x00007FF79B350000-0x00007FF79B746000-memory.dmp

Filesize
4.0MB

Download
memory/4452-2039-0x00007FF79B350000-0x00007FF79B746000-memory.dmp

Filesize
4.0MB

Download
memory/4728-130-0x00007FF697650000-0x00007FF697A46000-memory.dmp

Filesize
4.0MB

Download
memory/4728-2045-0x00007FF697650000-0x00007FF697A46000-memory.dmp

Filesize
4.0MB

Download
memory/4764-105-0x000001796C310000-0x000001796C332000-memory.dmp

Filesize
136KB

Download
memory/4764-69-0x00007FFE76E50000-0x00007FFE77911000-memory.dmp

Filesize
10.8MB

Download
memory/4764-1615-0x00007FFE76E50000-0x00007FFE77911000-memory.dmp

Filesize
10.8MB

Download
memory/4764-8-0x00007FFE76E53000-0x00007FFE76E55000-memory.dmp

Filesize
8KB

Download
memory/4764-31-0x00007FFE76E50000-0x00007FFE77911000-memory.dmp

Filesize
10.8MB

Download
memory/4848-139-0x00007FF639420000-0x00007FF639816000-memory.dmp

Filesize
4.0MB

Download
memory/4848-2054-0x00007FF639420000-0x00007FF639816000-memory.dmp

Filesize
4.0MB

Download
memory/4880-113-0x00007FF79FEB0000-0x00007FF7A02A6000-memory.dmp

Filesize
4.0MB

Download
memory/4880-2041-0x00007FF79FEB0000-0x00007FF7A02A6000-memory.dmp

Filesize
4.0MB

Download
memory/4916-2057-0x00007FF778C20000-0x00007FF779016000-memory.dmp

Filesize
4.0MB

Download
memory/4916-147-0x00007FF778C20000-0x00007FF779016000-memory.dmp

Filesize
4.0MB

Download
memory/4948-2056-0x00007FF643380000-0x00007FF643776000-memory.dmp

Filesize
4.0MB

Download
memory/4948-146-0x00007FF643380000-0x00007FF643776000-memory.dmp

Filesize
4.0MB

Download