xmrig | 67487add347e45505986c64c07aeb544fe0a94e495dcedfa1cd091e7cb5aa16b

Analysis

max time kernel
93s
max time network
118s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
Size

3.0MB
MD5

64369a353a8e035763c14ae2782c40d0
SHA1

3f67d0bcc058a4a1e0adf75503f198e0cfe04401
SHA256

67487add347e45505986c64c07aeb544fe0a94e495dcedfa1cd091e7cb5aa16b
SHA512

c2ae73f0da2ff8fec5ba2d0a44f1f4d943bd967d87de90116e8cc978b91ead2486f620f851c42ed1b5b4efab8793dd4f82b11525eed69e203189efd557ecdce3
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkFfdg6NsOaQ:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RQ

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/3420-0-0x00007FF75B140000-0x00007FF75B536000-memory.dmp	xmrig
behavioral2/files/0x000700000002345d-8.dat	xmrig
behavioral2/files/0x000800000002345c-11.dat	xmrig
behavioral2/files/0x0007000000023461-41.dat	xmrig
behavioral2/memory/2248-44-0x00007FF7FCD10000-0x00007FF7FD106000-memory.dmp	xmrig
behavioral2/files/0x0007000000023462-48.dat	xmrig
behavioral2/files/0x0008000000023464-59.dat	xmrig
behavioral2/memory/1576-66-0x00007FF656700000-0x00007FF656AF6000-memory.dmp	xmrig
behavioral2/memory/4804-74-0x00007FF7B6F50000-0x00007FF7B7346000-memory.dmp	xmrig
behavioral2/memory/5096-79-0x00007FF75F820000-0x00007FF75FC16000-memory.dmp	xmrig
behavioral2/files/0x0007000000023466-77.dat	xmrig
behavioral2/memory/2592-76-0x00007FF667C30000-0x00007FF668026000-memory.dmp	xmrig
behavioral2/memory/3508-75-0x00007FF7270E0000-0x00007FF7274D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023465-70.dat	xmrig
behavioral2/files/0x0007000000023460-62.dat	xmrig
behavioral2/memory/2332-60-0x00007FF7712A0000-0x00007FF771696000-memory.dmp	xmrig
behavioral2/memory/556-53-0x00007FF7BA590000-0x00007FF7BA986000-memory.dmp	xmrig
behavioral2/files/0x000700000002345f-52.dat	xmrig
behavioral2/memory/4884-49-0x00007FF64F510000-0x00007FF64F906000-memory.dmp	xmrig
behavioral2/files/0x000700000002345e-29.dat	xmrig
behavioral2/memory/2100-26-0x00007FF7AC0B0000-0x00007FF7AC4A6000-memory.dmp	xmrig
behavioral2/files/0x0005000000022f58-18.dat	xmrig
behavioral2/memory/4392-16-0x00007FF6B6100000-0x00007FF6B64F6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023467-94.dat	xmrig
behavioral2/files/0x0007000000023468-104.dat	xmrig
behavioral2/memory/2816-102-0x00007FF765460000-0x00007FF765856000-memory.dmp	xmrig
behavioral2/files/0x000700000002346b-107.dat	xmrig
behavioral2/files/0x000700000002346c-120.dat	xmrig
behavioral2/files/0x0007000000023470-132.dat	xmrig
behavioral2/files/0x0007000000023474-163.dat	xmrig
behavioral2/files/0x0007000000023477-165.dat	xmrig
behavioral2/memory/3720-166-0x00007FF7092D0000-0x00007FF7096C6000-memory.dmp	xmrig
behavioral2/memory/2052-177-0x00007FF74A060000-0x00007FF74A456000-memory.dmp	xmrig
behavioral2/memory/3068-184-0x00007FF6F0560000-0x00007FF6F0956000-memory.dmp	xmrig
behavioral2/memory/2248-187-0x00007FF7FCD10000-0x00007FF7FD106000-memory.dmp	xmrig
behavioral2/files/0x0007000000023479-185.dat	xmrig
behavioral2/memory/3420-178-0x00007FF75B140000-0x00007FF75B536000-memory.dmp	xmrig
behavioral2/memory/4156-175-0x00007FF76EAE0000-0x00007FF76EED6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023471-157.dat	xmrig
behavioral2/memory/4040-155-0x00007FF7FD760000-0x00007FF7FDB56000-memory.dmp	xmrig
behavioral2/files/0x000700000002346f-154.dat	xmrig
behavioral2/memory/336-151-0x00007FF651D60000-0x00007FF652156000-memory.dmp	xmrig
behavioral2/memory/4832-145-0x00007FF7AC3E0000-0x00007FF7AC7D6000-memory.dmp	xmrig
behavioral2/memory/4672-128-0x00007FF763620000-0x00007FF763A16000-memory.dmp	xmrig
behavioral2/memory/3680-115-0x00007FF79FF10000-0x00007FF7A0306000-memory.dmp	xmrig
behavioral2/files/0x000700000002347d-196.dat	xmrig
behavioral2/files/0x0007000000023481-216.dat	xmrig
behavioral2/files/0x0007000000023482-227.dat	xmrig
behavioral2/files/0x0007000000023486-243.dat	xmrig
behavioral2/files/0x000700000002348a-253.dat	xmrig
behavioral2/files/0x000700000002348e-269.dat	xmrig
behavioral2/memory/4392-717-0x00007FF6B6100000-0x00007FF6B64F6000-memory.dmp	xmrig
behavioral2/memory/4884-727-0x00007FF64F510000-0x00007FF64F906000-memory.dmp	xmrig
behavioral2/memory/556-729-0x00007FF7BA590000-0x00007FF7BA986000-memory.dmp	xmrig
behavioral2/memory/4344-739-0x00007FF7D0B00000-0x00007FF7D0EF6000-memory.dmp	xmrig
behavioral2/memory/428-752-0x00007FF7156C0000-0x00007FF715AB6000-memory.dmp	xmrig
behavioral2/memory/4408-744-0x00007FF635EE0000-0x00007FF6362D6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023491-273.dat	xmrig
behavioral2/files/0x000700000002348d-264.dat	xmrig
behavioral2/files/0x0007000000023489-248.dat	xmrig
behavioral2/files/0x0007000000023485-231.dat	xmrig
behavioral2/files/0x0007000000023480-204.dat	xmrig
behavioral2/memory/2332-1052-0x00007FF7712A0000-0x00007FF771696000-memory.dmp	xmrig
behavioral2/memory/2816-1623-0x00007FF765460000-0x00007FF765856000-memory.dmp	xmrig

Blocklisted process makes network request 9 IoCs

flow	pid	Process
3	4248	powershell.exe
7	4248	powershell.exe
13	4248	powershell.exe
14	4248	powershell.exe
17	4248	powershell.exe
18	4248	powershell.exe
19	4248	powershell.exe
25	4248	powershell.exe
26	4248	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4248	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
4392	GBnoPwT.exe
2100	zNxiXNS.exe
1576	NtExnVE.exe
2248	wlsjbRH.exe
4804	kZLrrju.exe
4884	BxgMguL.exe
3508	QdHikAm.exe
556	XcvlTBQ.exe
2592	lQOolas.exe
2332	RvINXmT.exe
5096	wfOOfxD.exe
2816	muDclBK.exe
3680	nTcvtsi.exe
4672	ktFUEWj.exe
4040	QaYkoJM.exe
4832	UnHZeWt.exe
336	noGghED.exe
3720	ccYqAJe.exe
2052	hZjZleY.exe
4156	BiUhlMF.exe
3068	ZnlRmhP.exe
4344	kliQahv.exe
4408	BmLXzeY.exe
428	TrgbUyM.exe
4336	olFGHDc.exe
116	WgvkKCc.exe
1852	jTWhXrP.exe
3372	AnWlinJ.exe
3752	IjMUBqj.exe
4864	LAmPPRX.exe
4048	SYZQIQr.exe
4968	MaZfnrS.exe
3968	FJflmGD.exe
4892	DMLSjvp.exe
1044	pCsUtoK.exe
3984	Dpcjkbl.exe
1876	kIxUXHT.exe
2068	kuFShjP.exe
4136	FjctFkG.exe
2428	vgWBgYi.exe
3736	OvSxfdp.exe
4880	bofVPsO.exe
3236	vjmeCPw.exe
3228	EkyXcKM.exe
4876	wGNnUgP.exe
2200	RAGeuvh.exe
2712	FqeKlae.exe
4120	IuiXYsO.exe
3812	gCpGlnn.exe
4184	sMOtkmh.exe
3536	vVcAkOk.exe
5020	jzESsRo.exe
2260	dajAVvU.exe
2404	NYelbZw.exe
2612	TFuNGwc.exe
4560	sMWatgX.exe
3724	hQOHQUP.exe
216	TGIpdgS.exe
2740	qdRWgVD.exe
2604	eZaHWGW.exe
1816	mHVzQtW.exe
2144	qUrCSRZ.exe
3864	ZDFxCeV.exe
3428	xgXqtCn.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3420-0-0x00007FF75B140000-0x00007FF75B536000-memory.dmp	upx
behavioral2/files/0x000700000002345d-8.dat	upx
behavioral2/files/0x000800000002345c-11.dat	upx
behavioral2/files/0x0007000000023461-41.dat	upx
behavioral2/memory/2248-44-0x00007FF7FCD10000-0x00007FF7FD106000-memory.dmp	upx
behavioral2/files/0x0007000000023462-48.dat	upx
behavioral2/files/0x0008000000023464-59.dat	upx
behavioral2/memory/1576-66-0x00007FF656700000-0x00007FF656AF6000-memory.dmp	upx
behavioral2/memory/4804-74-0x00007FF7B6F50000-0x00007FF7B7346000-memory.dmp	upx
behavioral2/memory/5096-79-0x00007FF75F820000-0x00007FF75FC16000-memory.dmp	upx
behavioral2/files/0x0007000000023466-77.dat	upx
behavioral2/memory/2592-76-0x00007FF667C30000-0x00007FF668026000-memory.dmp	upx
behavioral2/memory/3508-75-0x00007FF7270E0000-0x00007FF7274D6000-memory.dmp	upx
behavioral2/files/0x0007000000023465-70.dat	upx
behavioral2/files/0x0007000000023460-62.dat	upx
behavioral2/memory/2332-60-0x00007FF7712A0000-0x00007FF771696000-memory.dmp	upx
behavioral2/memory/556-53-0x00007FF7BA590000-0x00007FF7BA986000-memory.dmp	upx
behavioral2/files/0x000700000002345f-52.dat	upx
behavioral2/memory/4884-49-0x00007FF64F510000-0x00007FF64F906000-memory.dmp	upx
behavioral2/files/0x000700000002345e-29.dat	upx
behavioral2/memory/2100-26-0x00007FF7AC0B0000-0x00007FF7AC4A6000-memory.dmp	upx
behavioral2/files/0x0005000000022f58-18.dat	upx
behavioral2/memory/4392-16-0x00007FF6B6100000-0x00007FF6B64F6000-memory.dmp	upx
behavioral2/files/0x0007000000023467-94.dat	upx
behavioral2/files/0x0007000000023468-104.dat	upx
behavioral2/memory/2816-102-0x00007FF765460000-0x00007FF765856000-memory.dmp	upx
behavioral2/files/0x000700000002346b-107.dat	upx
behavioral2/files/0x000700000002346c-120.dat	upx
behavioral2/files/0x0007000000023470-132.dat	upx
behavioral2/files/0x0007000000023474-163.dat	upx
behavioral2/files/0x0007000000023477-165.dat	upx
behavioral2/memory/3720-166-0x00007FF7092D0000-0x00007FF7096C6000-memory.dmp	upx
behavioral2/memory/2052-177-0x00007FF74A060000-0x00007FF74A456000-memory.dmp	upx
behavioral2/memory/3068-184-0x00007FF6F0560000-0x00007FF6F0956000-memory.dmp	upx
behavioral2/memory/2248-187-0x00007FF7FCD10000-0x00007FF7FD106000-memory.dmp	upx
behavioral2/files/0x0007000000023479-185.dat	upx
behavioral2/memory/3420-178-0x00007FF75B140000-0x00007FF75B536000-memory.dmp	upx
behavioral2/memory/4156-175-0x00007FF76EAE0000-0x00007FF76EED6000-memory.dmp	upx
behavioral2/files/0x0007000000023471-157.dat	upx
behavioral2/memory/4040-155-0x00007FF7FD760000-0x00007FF7FDB56000-memory.dmp	upx
behavioral2/files/0x000700000002346f-154.dat	upx
behavioral2/memory/336-151-0x00007FF651D60000-0x00007FF652156000-memory.dmp	upx
behavioral2/memory/4832-145-0x00007FF7AC3E0000-0x00007FF7AC7D6000-memory.dmp	upx
behavioral2/memory/4672-128-0x00007FF763620000-0x00007FF763A16000-memory.dmp	upx
behavioral2/memory/3680-115-0x00007FF79FF10000-0x00007FF7A0306000-memory.dmp	upx
behavioral2/files/0x000700000002347d-196.dat	upx
behavioral2/files/0x0007000000023481-216.dat	upx
behavioral2/files/0x0007000000023482-227.dat	upx
behavioral2/files/0x0007000000023486-243.dat	upx
behavioral2/files/0x000700000002348a-253.dat	upx
behavioral2/files/0x000700000002348e-269.dat	upx
behavioral2/memory/4392-717-0x00007FF6B6100000-0x00007FF6B64F6000-memory.dmp	upx
behavioral2/memory/4884-727-0x00007FF64F510000-0x00007FF64F906000-memory.dmp	upx
behavioral2/memory/556-729-0x00007FF7BA590000-0x00007FF7BA986000-memory.dmp	upx
behavioral2/memory/4344-739-0x00007FF7D0B00000-0x00007FF7D0EF6000-memory.dmp	upx
behavioral2/memory/428-752-0x00007FF7156C0000-0x00007FF715AB6000-memory.dmp	upx
behavioral2/memory/4408-744-0x00007FF635EE0000-0x00007FF6362D6000-memory.dmp	upx
behavioral2/files/0x0007000000023491-273.dat	upx
behavioral2/files/0x000700000002348d-264.dat	upx
behavioral2/files/0x0007000000023489-248.dat	upx
behavioral2/files/0x0007000000023485-231.dat	upx
behavioral2/files/0x0007000000023480-204.dat	upx
behavioral2/memory/2332-1052-0x00007FF7712A0000-0x00007FF771696000-memory.dmp	upx
behavioral2/memory/2816-1623-0x00007FF765460000-0x00007FF765856000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zNcOJzA.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\AxRiyXG.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\uRwfmCX.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZKoSqsF.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\cBXTCqn.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\yxqgsPJ.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\ImPdPaN.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\lUSsMZN.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\IDSXpVD.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\lUcraVt.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\nxJToWX.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\fVhMpbP.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\fuGcWzj.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\fKkSRMp.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\WrWHmrr.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\FfpPFtV.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\fWqdkej.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\iNauwJa.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\TrNdlDw.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\WKXvren.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\qvIKGkc.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\udtklsi.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\XlzgsjM.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\HEibOiZ.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\QdhUlmt.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\qeQCouR.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\KXOZTuQ.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\glpuYOj.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\lvaAKNK.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\hPYxxCy.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\RBbmLYF.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\thUoIAh.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\LhJtJfd.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\HwazJMN.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\mqvUApc.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\zZWuOUp.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\PSaNtxe.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\CdLGCio.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\EkyXcKM.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\cnGYRfd.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\JTZQgLN.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\rRLlOKz.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\PJZbxwW.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\QIHoUVx.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\ezgtaWa.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\JSwdjDW.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\veCPMfR.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\HnTMDBe.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\sagbIvr.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\EvgDXLF.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\sxcsShO.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\MaAJSIO.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\lafbBzN.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\cRHTsgB.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\FuaZYkr.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\QQCxulO.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\JXHzIpr.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\MBPfwBR.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\pqOSkEq.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\pPCfPiI.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\dsngJeC.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\XhpoMhM.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\BxgMguL.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
File created	C:\Windows\System\WoPrndW.exe	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4248	powershell.exe
4248	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
Token: SeDebugPrivilege	4248	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3420 wrote to memory of 4248	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	84
PID 3420 wrote to memory of 4248	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	84
PID 3420 wrote to memory of 4392	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	85
PID 3420 wrote to memory of 4392	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	85
PID 3420 wrote to memory of 2100	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	86
PID 3420 wrote to memory of 2100	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	86
PID 3420 wrote to memory of 1576	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	87
PID 3420 wrote to memory of 1576	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	87
PID 3420 wrote to memory of 2248	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	88
PID 3420 wrote to memory of 2248	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	88
PID 3420 wrote to memory of 4804	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	89
PID 3420 wrote to memory of 4804	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	89
PID 3420 wrote to memory of 3508	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	90
PID 3420 wrote to memory of 3508	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	90
PID 3420 wrote to memory of 4884	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	91
PID 3420 wrote to memory of 4884	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	91
PID 3420 wrote to memory of 556	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	92
PID 3420 wrote to memory of 556	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	92
PID 3420 wrote to memory of 2592	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	93
PID 3420 wrote to memory of 2592	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	93
PID 3420 wrote to memory of 2332	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	94
PID 3420 wrote to memory of 2332	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	94
PID 3420 wrote to memory of 5096	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	95
PID 3420 wrote to memory of 5096	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	95
PID 3420 wrote to memory of 2816	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	96
PID 3420 wrote to memory of 2816	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	96
PID 3420 wrote to memory of 3680	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	99
PID 3420 wrote to memory of 3680	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	99
PID 3420 wrote to memory of 4672	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	100
PID 3420 wrote to memory of 4672	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	100
PID 3420 wrote to memory of 4040	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	101
PID 3420 wrote to memory of 4040	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	101
PID 3420 wrote to memory of 4832	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	102
PID 3420 wrote to memory of 4832	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	102
PID 3420 wrote to memory of 336	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	103
PID 3420 wrote to memory of 336	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	103
PID 3420 wrote to memory of 3720	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	104
PID 3420 wrote to memory of 3720	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	104
PID 3420 wrote to memory of 2052	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	105
PID 3420 wrote to memory of 2052	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	105
PID 3420 wrote to memory of 4156	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	106
PID 3420 wrote to memory of 4156	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	106
PID 3420 wrote to memory of 3068	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	107
PID 3420 wrote to memory of 3068	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	107
PID 3420 wrote to memory of 4344	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	108
PID 3420 wrote to memory of 4344	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	108
PID 3420 wrote to memory of 4408	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	109
PID 3420 wrote to memory of 4408	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	109
PID 3420 wrote to memory of 428	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	110
PID 3420 wrote to memory of 428	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	110
PID 3420 wrote to memory of 4336	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	111
PID 3420 wrote to memory of 4336	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	111
PID 3420 wrote to memory of 116	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	112
PID 3420 wrote to memory of 116	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	112
PID 3420 wrote to memory of 1852	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	113
PID 3420 wrote to memory of 1852	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	113
PID 3420 wrote to memory of 3372	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	114
PID 3420 wrote to memory of 3372	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	114
PID 3420 wrote to memory of 3752	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	115
PID 3420 wrote to memory of 3752	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	115
PID 3420 wrote to memory of 4864	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	116
PID 3420 wrote to memory of 4864	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	116
PID 3420 wrote to memory of 4048	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	117
PID 3420 wrote to memory of 4048	3420	64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe	117

C:\Users\Admin\AppData\Local\Temp\64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\64369a353a8e035763c14ae2782c40d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4248
- C:\Windows\System\GBnoPwT.exe
  C:\Windows\System\GBnoPwT.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\zNxiXNS.exe
  C:\Windows\System\zNxiXNS.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\NtExnVE.exe
  C:\Windows\System\NtExnVE.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\wlsjbRH.exe
  C:\Windows\System\wlsjbRH.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\kZLrrju.exe
  C:\Windows\System\kZLrrju.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\QdHikAm.exe
  C:\Windows\System\QdHikAm.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\BxgMguL.exe
  C:\Windows\System\BxgMguL.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\XcvlTBQ.exe
  C:\Windows\System\XcvlTBQ.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\lQOolas.exe
  C:\Windows\System\lQOolas.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\RvINXmT.exe
  C:\Windows\System\RvINXmT.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\wfOOfxD.exe
  C:\Windows\System\wfOOfxD.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\muDclBK.exe
  C:\Windows\System\muDclBK.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\nTcvtsi.exe
  C:\Windows\System\nTcvtsi.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\ktFUEWj.exe
  C:\Windows\System\ktFUEWj.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\QaYkoJM.exe
  C:\Windows\System\QaYkoJM.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\UnHZeWt.exe
  C:\Windows\System\UnHZeWt.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\noGghED.exe
  C:\Windows\System\noGghED.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\ccYqAJe.exe
  C:\Windows\System\ccYqAJe.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\hZjZleY.exe
  C:\Windows\System\hZjZleY.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\BiUhlMF.exe
  C:\Windows\System\BiUhlMF.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\ZnlRmhP.exe
  C:\Windows\System\ZnlRmhP.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\kliQahv.exe
  C:\Windows\System\kliQahv.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\BmLXzeY.exe
  C:\Windows\System\BmLXzeY.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\TrgbUyM.exe
  C:\Windows\System\TrgbUyM.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\olFGHDc.exe
  C:\Windows\System\olFGHDc.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\WgvkKCc.exe
  C:\Windows\System\WgvkKCc.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\jTWhXrP.exe
  C:\Windows\System\jTWhXrP.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\AnWlinJ.exe
  C:\Windows\System\AnWlinJ.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\IjMUBqj.exe
  C:\Windows\System\IjMUBqj.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\LAmPPRX.exe
  C:\Windows\System\LAmPPRX.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\SYZQIQr.exe
  C:\Windows\System\SYZQIQr.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\MaZfnrS.exe
  C:\Windows\System\MaZfnrS.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\FJflmGD.exe
  C:\Windows\System\FJflmGD.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\DMLSjvp.exe
  C:\Windows\System\DMLSjvp.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\pCsUtoK.exe
  C:\Windows\System\pCsUtoK.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\Dpcjkbl.exe
  C:\Windows\System\Dpcjkbl.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\kIxUXHT.exe
  C:\Windows\System\kIxUXHT.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\kuFShjP.exe
  C:\Windows\System\kuFShjP.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\FjctFkG.exe
  C:\Windows\System\FjctFkG.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\vgWBgYi.exe
  C:\Windows\System\vgWBgYi.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\OvSxfdp.exe
  C:\Windows\System\OvSxfdp.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\bofVPsO.exe
  C:\Windows\System\bofVPsO.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\vjmeCPw.exe
  C:\Windows\System\vjmeCPw.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\EkyXcKM.exe
  C:\Windows\System\EkyXcKM.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\wGNnUgP.exe
  C:\Windows\System\wGNnUgP.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\RAGeuvh.exe
  C:\Windows\System\RAGeuvh.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\FqeKlae.exe
  C:\Windows\System\FqeKlae.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\IuiXYsO.exe
  C:\Windows\System\IuiXYsO.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\gCpGlnn.exe
  C:\Windows\System\gCpGlnn.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\sMOtkmh.exe
  C:\Windows\System\sMOtkmh.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\vVcAkOk.exe
  C:\Windows\System\vVcAkOk.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\jzESsRo.exe
  C:\Windows\System\jzESsRo.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\dajAVvU.exe
  C:\Windows\System\dajAVvU.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\NYelbZw.exe
  C:\Windows\System\NYelbZw.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\TFuNGwc.exe
  C:\Windows\System\TFuNGwc.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\sMWatgX.exe
  C:\Windows\System\sMWatgX.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\hQOHQUP.exe
  C:\Windows\System\hQOHQUP.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\TGIpdgS.exe
  C:\Windows\System\TGIpdgS.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\qdRWgVD.exe
  C:\Windows\System\qdRWgVD.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\eZaHWGW.exe
  C:\Windows\System\eZaHWGW.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\mHVzQtW.exe
  C:\Windows\System\mHVzQtW.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\qUrCSRZ.exe
  C:\Windows\System\qUrCSRZ.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\ZDFxCeV.exe
  C:\Windows\System\ZDFxCeV.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\xgXqtCn.exe
  C:\Windows\System\xgXqtCn.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\UHFrjzg.exe
  C:\Windows\System\UHFrjzg.exe
  2⤵
  PID:4372
- C:\Windows\System\ZjymtdD.exe
  C:\Windows\System\ZjymtdD.exe
  2⤵
  PID:940
- C:\Windows\System\YvKPgUs.exe
  C:\Windows\System\YvKPgUs.exe
  2⤵
  PID:2540
- C:\Windows\System\uJOHMaI.exe
  C:\Windows\System\uJOHMaI.exe
  2⤵
  PID:4900
- C:\Windows\System\uvMijzN.exe
  C:\Windows\System\uvMijzN.exe
  2⤵
  PID:3600
- C:\Windows\System\DdkPMsR.exe
  C:\Windows\System\DdkPMsR.exe
  2⤵
  PID:2984
- C:\Windows\System\wexMgEN.exe
  C:\Windows\System\wexMgEN.exe
  2⤵
  PID:5056
- C:\Windows\System\MBPfwBR.exe
  C:\Windows\System\MBPfwBR.exe
  2⤵
  PID:1432
- C:\Windows\System\xHFjchU.exe
  C:\Windows\System\xHFjchU.exe
  2⤵
  PID:3748
- C:\Windows\System\Bxkfezc.exe
  C:\Windows\System\Bxkfezc.exe
  2⤵
  PID:3584
- C:\Windows\System\ouGKNPm.exe
  C:\Windows\System\ouGKNPm.exe
  2⤵
  PID:5064
- C:\Windows\System\OlKlSmy.exe
  C:\Windows\System\OlKlSmy.exe
  2⤵
  PID:880
- C:\Windows\System\lFbfUfP.exe
  C:\Windows\System\lFbfUfP.exe
  2⤵
  PID:1992
- C:\Windows\System\gKvsIwg.exe
  C:\Windows\System\gKvsIwg.exe
  2⤵
  PID:5140
- C:\Windows\System\ILQGAUv.exe
  C:\Windows\System\ILQGAUv.exe
  2⤵
  PID:5164
- C:\Windows\System\MXrbtyP.exe
  C:\Windows\System\MXrbtyP.exe
  2⤵
  PID:5204
- C:\Windows\System\GCAdORK.exe
  C:\Windows\System\GCAdORK.exe
  2⤵
  PID:5236
- C:\Windows\System\ujTrsiP.exe
  C:\Windows\System\ujTrsiP.exe
  2⤵
  PID:5264
- C:\Windows\System\ReEfbMF.exe
  C:\Windows\System\ReEfbMF.exe
  2⤵
  PID:5304
- C:\Windows\System\SZApDPa.exe
  C:\Windows\System\SZApDPa.exe
  2⤵
  PID:5332
- C:\Windows\System\pBfNmpa.exe
  C:\Windows\System\pBfNmpa.exe
  2⤵
  PID:5372
- C:\Windows\System\clvXhKA.exe
  C:\Windows\System\clvXhKA.exe
  2⤵
  PID:5404
- C:\Windows\System\Xpolcix.exe
  C:\Windows\System\Xpolcix.exe
  2⤵
  PID:5428
- C:\Windows\System\IVeHPKd.exe
  C:\Windows\System\IVeHPKd.exe
  2⤵
  PID:5468
- C:\Windows\System\yVNbHcv.exe
  C:\Windows\System\yVNbHcv.exe
  2⤵
  PID:5508
- C:\Windows\System\WTiedJW.exe
  C:\Windows\System\WTiedJW.exe
  2⤵
  PID:5532
- C:\Windows\System\QTZwMzA.exe
  C:\Windows\System\QTZwMzA.exe
  2⤵
  PID:5588
- C:\Windows\System\eLugFaI.exe
  C:\Windows\System\eLugFaI.exe
  2⤵
  PID:5616
- C:\Windows\System\dahJKGW.exe
  C:\Windows\System\dahJKGW.exe
  2⤵
  PID:5652
- C:\Windows\System\tWlxfJD.exe
  C:\Windows\System\tWlxfJD.exe
  2⤵
  PID:5696
- C:\Windows\System\jxFDTsY.exe
  C:\Windows\System\jxFDTsY.exe
  2⤵
  PID:5712
- C:\Windows\System\XVWtsso.exe
  C:\Windows\System\XVWtsso.exe
  2⤵
  PID:5760
- C:\Windows\System\TFymgRe.exe
  C:\Windows\System\TFymgRe.exe
  2⤵
  PID:5800
- C:\Windows\System\veCPMfR.exe
  C:\Windows\System\veCPMfR.exe
  2⤵
  PID:5828
- C:\Windows\System\mMUIwYF.exe
  C:\Windows\System\mMUIwYF.exe
  2⤵
  PID:5868
- C:\Windows\System\FMDwuTN.exe
  C:\Windows\System\FMDwuTN.exe
  2⤵
  PID:5916
- C:\Windows\System\dYOjDmP.exe
  C:\Windows\System\dYOjDmP.exe
  2⤵
  PID:5940
- C:\Windows\System\XJbtJSk.exe
  C:\Windows\System\XJbtJSk.exe
  2⤵
  PID:5992
- C:\Windows\System\rMMDhzZ.exe
  C:\Windows\System\rMMDhzZ.exe
  2⤵
  PID:6020
- C:\Windows\System\WwgBfsy.exe
  C:\Windows\System\WwgBfsy.exe
  2⤵
  PID:6048
- C:\Windows\System\BuxLBRJ.exe
  C:\Windows\System\BuxLBRJ.exe
  2⤵
  PID:6084
- C:\Windows\System\fuGcWzj.exe
  C:\Windows\System\fuGcWzj.exe
  2⤵
  PID:6112
- C:\Windows\System\CPOdQrz.exe
  C:\Windows\System\CPOdQrz.exe
  2⤵
  PID:6140
- C:\Windows\System\mYMehxE.exe
  C:\Windows\System\mYMehxE.exe
  2⤵
  PID:4652
- C:\Windows\System\bfJMxSH.exe
  C:\Windows\System\bfJMxSH.exe
  2⤵
  PID:4228
- C:\Windows\System\gEjUeDF.exe
  C:\Windows\System\gEjUeDF.exe
  2⤵
  PID:348
- C:\Windows\System\VMLkbEn.exe
  C:\Windows\System\VMLkbEn.exe
  2⤵
  PID:5156
- C:\Windows\System\QrmMoah.exe
  C:\Windows\System\QrmMoah.exe
  2⤵
  PID:5200
- C:\Windows\System\XrYYzzg.exe
  C:\Windows\System\XrYYzzg.exe
  2⤵
  PID:5256
- C:\Windows\System\EWHwTHm.exe
  C:\Windows\System\EWHwTHm.exe
  2⤵
  PID:5348
- C:\Windows\System\thUoIAh.exe
  C:\Windows\System\thUoIAh.exe
  2⤵
  PID:5388
- C:\Windows\System\QQYmnDz.exe
  C:\Windows\System\QQYmnDz.exe
  2⤵
  PID:5452
- C:\Windows\System\EtlEWhQ.exe
  C:\Windows\System\EtlEWhQ.exe
  2⤵
  PID:5524
- C:\Windows\System\mgYUThH.exe
  C:\Windows\System\mgYUThH.exe
  2⤵
  PID:5560
- C:\Windows\System\nMmnftl.exe
  C:\Windows\System\nMmnftl.exe
  2⤵
  PID:5604
- C:\Windows\System\fOOYahr.exe
  C:\Windows\System\fOOYahr.exe
  2⤵
  PID:5668
- C:\Windows\System\SMhXrKa.exe
  C:\Windows\System\SMhXrKa.exe
  2⤵
  PID:5708
- C:\Windows\System\cynrwGR.exe
  C:\Windows\System\cynrwGR.exe
  2⤵
  PID:5752
- C:\Windows\System\aXboNnR.exe
  C:\Windows\System\aXboNnR.exe
  2⤵
  PID:5816
- C:\Windows\System\HdRBfDU.exe
  C:\Windows\System\HdRBfDU.exe
  2⤵
  PID:5864
- C:\Windows\System\JdzuMpP.exe
  C:\Windows\System\JdzuMpP.exe
  2⤵
  PID:5924
- C:\Windows\System\fGQPaHB.exe
  C:\Windows\System\fGQPaHB.exe
  2⤵
  PID:5972
- C:\Windows\System\qJitrJt.exe
  C:\Windows\System\qJitrJt.exe
  2⤵
  PID:6032
- C:\Windows\System\sxcsShO.exe
  C:\Windows\System\sxcsShO.exe
  2⤵
  PID:6096
- C:\Windows\System\qaiJvCJ.exe
  C:\Windows\System\qaiJvCJ.exe
  2⤵
  PID:4104
- C:\Windows\System\jYjsQBy.exe
  C:\Windows\System\jYjsQBy.exe
  2⤵
  PID:4208
- C:\Windows\System\KArKOEl.exe
  C:\Windows\System\KArKOEl.exe
  2⤵
  PID:5228
- C:\Windows\System\wqqILxW.exe
  C:\Windows\System\wqqILxW.exe
  2⤵
  PID:5356
- C:\Windows\System\ysJZLUz.exe
  C:\Windows\System\ysJZLUz.exe
  2⤵
  PID:5488
- C:\Windows\System\PfceSfw.exe
  C:\Windows\System\PfceSfw.exe
  2⤵
  PID:5580
- C:\Windows\System\ZkAeHZs.exe
  C:\Windows\System\ZkAeHZs.exe
  2⤵
  PID:5740
- C:\Windows\System\FhvZWRo.exe
  C:\Windows\System\FhvZWRo.exe
  2⤵
  PID:5852
- C:\Windows\System\mKboCSv.exe
  C:\Windows\System\mKboCSv.exe
  2⤵
  PID:3972
- C:\Windows\System\ABTuGYP.exe
  C:\Windows\System\ABTuGYP.exe
  2⤵
  PID:6004
- C:\Windows\System\CTylHqz.exe
  C:\Windows\System\CTylHqz.exe
  2⤵
  PID:3920
- C:\Windows\System\KcnHfCu.exe
  C:\Windows\System\KcnHfCu.exe
  2⤵
  PID:5176
- C:\Windows\System\VFZCMCj.exe
  C:\Windows\System\VFZCMCj.exe
  2⤵
  PID:5288
- C:\Windows\System\RLzWPRB.exe
  C:\Windows\System\RLzWPRB.exe
  2⤵
  PID:4948
- C:\Windows\System\snDpyaS.exe
  C:\Windows\System\snDpyaS.exe
  2⤵
  PID:5060
- C:\Windows\System\kdrcFnM.exe
  C:\Windows\System\kdrcFnM.exe
  2⤵
  PID:1284
- C:\Windows\System\OBEkVIJ.exe
  C:\Windows\System\OBEkVIJ.exe
  2⤵
  PID:5556
- C:\Windows\System\zACnCHK.exe
  C:\Windows\System\zACnCHK.exe
  2⤵
  PID:5684
- C:\Windows\System\tOeNtPt.exe
  C:\Windows\System\tOeNtPt.exe
  2⤵
  PID:1512
- C:\Windows\System\IExtQtE.exe
  C:\Windows\System\IExtQtE.exe
  2⤵
  PID:6132
- C:\Windows\System\gqphQfO.exe
  C:\Windows\System\gqphQfO.exe
  2⤵
  PID:5132
- C:\Windows\System\uryIbJx.exe
  C:\Windows\System\uryIbJx.exe
  2⤵
  PID:6168
- C:\Windows\System\lkrhAcD.exe
  C:\Windows\System\lkrhAcD.exe
  2⤵
  PID:6208
- C:\Windows\System\hCgzTsp.exe
  C:\Windows\System\hCgzTsp.exe
  2⤵
  PID:6224
- C:\Windows\System\lafbBzN.exe
  C:\Windows\System\lafbBzN.exe
  2⤵
  PID:6252
- C:\Windows\System\SkkfIJm.exe
  C:\Windows\System\SkkfIJm.exe
  2⤵
  PID:6268
- C:\Windows\System\wfYihEy.exe
  C:\Windows\System\wfYihEy.exe
  2⤵
  PID:6284
- C:\Windows\System\lbTceoT.exe
  C:\Windows\System\lbTceoT.exe
  2⤵
  PID:6336
- C:\Windows\System\CTlGMSS.exe
  C:\Windows\System\CTlGMSS.exe
  2⤵
  PID:6364
- C:\Windows\System\VsRxbbj.exe
  C:\Windows\System\VsRxbbj.exe
  2⤵
  PID:6400
- C:\Windows\System\lBvgymi.exe
  C:\Windows\System\lBvgymi.exe
  2⤵
  PID:6420
- C:\Windows\System\mzTbxNk.exe
  C:\Windows\System\mzTbxNk.exe
  2⤵
  PID:6448
- C:\Windows\System\WaUwyfM.exe
  C:\Windows\System\WaUwyfM.exe
  2⤵
  PID:6480
- C:\Windows\System\iKZnVcD.exe
  C:\Windows\System\iKZnVcD.exe
  2⤵
  PID:6508
- C:\Windows\System\Fwbgdsh.exe
  C:\Windows\System\Fwbgdsh.exe
  2⤵
  PID:6536
- C:\Windows\System\YUQGHWI.exe
  C:\Windows\System\YUQGHWI.exe
  2⤵
  PID:6568
- C:\Windows\System\xTASUJp.exe
  C:\Windows\System\xTASUJp.exe
  2⤵
  PID:6592
- C:\Windows\System\UYjFBUF.exe
  C:\Windows\System\UYjFBUF.exe
  2⤵
  PID:6620
- C:\Windows\System\qamowpP.exe
  C:\Windows\System\qamowpP.exe
  2⤵
  PID:6636
- C:\Windows\System\ormszcY.exe
  C:\Windows\System\ormszcY.exe
  2⤵
  PID:6676
- C:\Windows\System\Iaufesc.exe
  C:\Windows\System\Iaufesc.exe
  2⤵
  PID:6704
- C:\Windows\System\GYGKbbj.exe
  C:\Windows\System\GYGKbbj.exe
  2⤵
  PID:6752
- C:\Windows\System\NKhxnIK.exe
  C:\Windows\System\NKhxnIK.exe
  2⤵
  PID:6776
- C:\Windows\System\OfMPhyQ.exe
  C:\Windows\System\OfMPhyQ.exe
  2⤵
  PID:6816
- C:\Windows\System\inSkMlS.exe
  C:\Windows\System\inSkMlS.exe
  2⤵
  PID:6840
- C:\Windows\System\AeqpkRW.exe
  C:\Windows\System\AeqpkRW.exe
  2⤵
  PID:6872
- C:\Windows\System\GjTEztY.exe
  C:\Windows\System\GjTEztY.exe
  2⤵
  PID:6900
- C:\Windows\System\rvetcab.exe
  C:\Windows\System\rvetcab.exe
  2⤵
  PID:6928
- C:\Windows\System\HEpDMWd.exe
  C:\Windows\System\HEpDMWd.exe
  2⤵
  PID:6956
- C:\Windows\System\LPAufFs.exe
  C:\Windows\System\LPAufFs.exe
  2⤵
  PID:6984
- C:\Windows\System\qcrUSUU.exe
  C:\Windows\System\qcrUSUU.exe
  2⤵
  PID:7012
- C:\Windows\System\zSrHWRH.exe
  C:\Windows\System\zSrHWRH.exe
  2⤵
  PID:7040
- C:\Windows\System\vDvMwJu.exe
  C:\Windows\System\vDvMwJu.exe
  2⤵
  PID:7068
- C:\Windows\System\cLUubci.exe
  C:\Windows\System\cLUubci.exe
  2⤵
  PID:7096
- C:\Windows\System\srkSOYX.exe
  C:\Windows\System\srkSOYX.exe
  2⤵
  PID:7140
- C:\Windows\System\lJmqJWi.exe
  C:\Windows\System\lJmqJWi.exe
  2⤵
  PID:7160
- C:\Windows\System\sZLOlrl.exe
  C:\Windows\System\sZLOlrl.exe
  2⤵
  PID:408
- C:\Windows\System\vNSggky.exe
  C:\Windows\System\vNSggky.exe
  2⤵
  PID:4264
- C:\Windows\System\ZfuKsmA.exe
  C:\Windows\System\ZfuKsmA.exe
  2⤵
  PID:6188
- C:\Windows\System\MmmFYBz.exe
  C:\Windows\System\MmmFYBz.exe
  2⤵
  PID:6192
- C:\Windows\System\LqCFwpP.exe
  C:\Windows\System\LqCFwpP.exe
  2⤵
  PID:6260
- C:\Windows\System\OZgilqh.exe
  C:\Windows\System\OZgilqh.exe
  2⤵
  PID:6308
- C:\Windows\System\AJxLLPE.exe
  C:\Windows\System\AJxLLPE.exe
  2⤵
  PID:6376
- C:\Windows\System\eICKAEs.exe
  C:\Windows\System\eICKAEs.exe
  2⤵
  PID:6416
- C:\Windows\System\uRsAqrl.exe
  C:\Windows\System\uRsAqrl.exe
  2⤵
  PID:6456
- C:\Windows\System\svcrMab.exe
  C:\Windows\System\svcrMab.exe
  2⤵
  PID:6588
- C:\Windows\System\zsZDyQp.exe
  C:\Windows\System\zsZDyQp.exe
  2⤵
  PID:6628
- C:\Windows\System\goRbqHc.exe
  C:\Windows\System\goRbqHc.exe
  2⤵
  PID:6700
- C:\Windows\System\CoKvlmW.exe
  C:\Windows\System\CoKvlmW.exe
  2⤵
  PID:6760
- C:\Windows\System\BdeHnZv.exe
  C:\Windows\System\BdeHnZv.exe
  2⤵
  PID:6836
- C:\Windows\System\SLBNawv.exe
  C:\Windows\System\SLBNawv.exe
  2⤵
  PID:6912
- C:\Windows\System\sjPfQmd.exe
  C:\Windows\System\sjPfQmd.exe
  2⤵
  PID:6796
- C:\Windows\System\UeLHiHz.exe
  C:\Windows\System\UeLHiHz.exe
  2⤵
  PID:7036
- C:\Windows\System\bHnwHWc.exe
  C:\Windows\System\bHnwHWc.exe
  2⤵
  PID:7080
- C:\Windows\System\NvFovxG.exe
  C:\Windows\System\NvFovxG.exe
  2⤵
  PID:7156
- C:\Windows\System\AtXnyUa.exe
  C:\Windows\System\AtXnyUa.exe
  2⤵
  PID:6156
- C:\Windows\System\RZIoxBZ.exe
  C:\Windows\System\RZIoxBZ.exe
  2⤵
  PID:4304
- C:\Windows\System\AdFFtta.exe
  C:\Windows\System\AdFFtta.exe
  2⤵
  PID:6332
- C:\Windows\System\qJriUCO.exe
  C:\Windows\System\qJriUCO.exe
  2⤵
  PID:6560
- C:\Windows\System\fSLBSJb.exe
  C:\Windows\System\fSLBSJb.exe
  2⤵
  PID:6688
- C:\Windows\System\jUONwas.exe
  C:\Windows\System\jUONwas.exe
  2⤵
  PID:6720
- C:\Windows\System\EARsQxM.exe
  C:\Windows\System\EARsQxM.exe
  2⤵
  PID:6176
- C:\Windows\System\AUnPNyE.exe
  C:\Windows\System\AUnPNyE.exe
  2⤵
  PID:7148
- C:\Windows\System\cABAVqm.exe
  C:\Windows\System\cABAVqm.exe
  2⤵
  PID:1352
- C:\Windows\System\GtAAnUh.exe
  C:\Windows\System\GtAAnUh.exe
  2⤵
  PID:6556
- C:\Windows\System\chDOoIi.exe
  C:\Windows\System\chDOoIi.exe
  2⤵
  PID:6892
- C:\Windows\System\NvVvEtJ.exe
  C:\Windows\System\NvVvEtJ.exe
  2⤵
  PID:3152
- C:\Windows\System\UtmmwSP.exe
  C:\Windows\System\UtmmwSP.exe
  2⤵
  PID:7092
- C:\Windows\System\tTkwrJc.exe
  C:\Windows\System\tTkwrJc.exe
  2⤵
  PID:7172
- C:\Windows\System\JgPBElx.exe
  C:\Windows\System\JgPBElx.exe
  2⤵
  PID:7200
- C:\Windows\System\uULAJpf.exe
  C:\Windows\System\uULAJpf.exe
  2⤵
  PID:7228
- C:\Windows\System\BpPDKIG.exe
  C:\Windows\System\BpPDKIG.exe
  2⤵
  PID:7256
- C:\Windows\System\hDKTkWl.exe
  C:\Windows\System\hDKTkWl.exe
  2⤵
  PID:7272
- C:\Windows\System\OHIqGkD.exe
  C:\Windows\System\OHIqGkD.exe
  2⤵
  PID:7312
- C:\Windows\System\crbasPD.exe
  C:\Windows\System\crbasPD.exe
  2⤵
  PID:7340
- C:\Windows\System\HQYxQfG.exe
  C:\Windows\System\HQYxQfG.exe
  2⤵
  PID:7368
- C:\Windows\System\mQPwivL.exe
  C:\Windows\System\mQPwivL.exe
  2⤵
  PID:7392
- C:\Windows\System\gtMTYNf.exe
  C:\Windows\System\gtMTYNf.exe
  2⤵
  PID:7412
- C:\Windows\System\sDrTLgw.exe
  C:\Windows\System\sDrTLgw.exe
  2⤵
  PID:7440
- C:\Windows\System\VcbubTc.exe
  C:\Windows\System\VcbubTc.exe
  2⤵
  PID:7480
- C:\Windows\System\YkRcWhO.exe
  C:\Windows\System\YkRcWhO.exe
  2⤵
  PID:7512
- C:\Windows\System\iNauwJa.exe
  C:\Windows\System\iNauwJa.exe
  2⤵
  PID:7540
- C:\Windows\System\qBuaGuK.exe
  C:\Windows\System\qBuaGuK.exe
  2⤵
  PID:7568
- C:\Windows\System\dFYgZBQ.exe
  C:\Windows\System\dFYgZBQ.exe
  2⤵
  PID:7596
- C:\Windows\System\pDJoOCk.exe
  C:\Windows\System\pDJoOCk.exe
  2⤵
  PID:7624
- C:\Windows\System\cnGYRfd.exe
  C:\Windows\System\cnGYRfd.exe
  2⤵
  PID:7652
- C:\Windows\System\mEhPbZm.exe
  C:\Windows\System\mEhPbZm.exe
  2⤵
  PID:7668
- C:\Windows\System\KQzyNas.exe
  C:\Windows\System\KQzyNas.exe
  2⤵
  PID:7684
- C:\Windows\System\DyXBzND.exe
  C:\Windows\System\DyXBzND.exe
  2⤵
  PID:7712
- C:\Windows\System\JMfviKf.exe
  C:\Windows\System\JMfviKf.exe
  2⤵
  PID:7744
- C:\Windows\System\ELISvdK.exe
  C:\Windows\System\ELISvdK.exe
  2⤵
  PID:7792
- C:\Windows\System\amCSuyP.exe
  C:\Windows\System\amCSuyP.exe
  2⤵
  PID:7816
- C:\Windows\System\hqcdpDu.exe
  C:\Windows\System\hqcdpDu.exe
  2⤵
  PID:7852
- C:\Windows\System\JTZQgLN.exe
  C:\Windows\System\JTZQgLN.exe
  2⤵
  PID:7868
- C:\Windows\System\CufQAPd.exe
  C:\Windows\System\CufQAPd.exe
  2⤵
  PID:7884
- C:\Windows\System\XgQSUtD.exe
  C:\Windows\System\XgQSUtD.exe
  2⤵
  PID:7924
- C:\Windows\System\lAGTsJq.exe
  C:\Windows\System\lAGTsJq.exe
  2⤵
  PID:7964
- C:\Windows\System\rAGwytC.exe
  C:\Windows\System\rAGwytC.exe
  2⤵
  PID:7980
- C:\Windows\System\mrBGBSg.exe
  C:\Windows\System\mrBGBSg.exe
  2⤵
  PID:8008
- C:\Windows\System\Ooizstn.exe
  C:\Windows\System\Ooizstn.exe
  2⤵
  PID:8048
- C:\Windows\System\ujyJyuL.exe
  C:\Windows\System\ujyJyuL.exe
  2⤵
  PID:8076
- C:\Windows\System\OjthlGq.exe
  C:\Windows\System\OjthlGq.exe
  2⤵
  PID:8104
- C:\Windows\System\UWdcsqC.exe
  C:\Windows\System\UWdcsqC.exe
  2⤵
  PID:8132
- C:\Windows\System\XrcqwTD.exe
  C:\Windows\System\XrcqwTD.exe
  2⤵
  PID:8160
- C:\Windows\System\UNdnaak.exe
  C:\Windows\System\UNdnaak.exe
  2⤵
  PID:8176
- C:\Windows\System\ZUuiUNp.exe
  C:\Windows\System\ZUuiUNp.exe
  2⤵
  PID:7196
- C:\Windows\System\IYOWvTT.exe
  C:\Windows\System\IYOWvTT.exe
  2⤵
  PID:7224
- C:\Windows\System\XCHfbdP.exe
  C:\Windows\System\XCHfbdP.exe
  2⤵
  PID:7332
- C:\Windows\System\nltNNPS.exe
  C:\Windows\System\nltNNPS.exe
  2⤵
  PID:7408
- C:\Windows\System\PNRtxsC.exe
  C:\Windows\System\PNRtxsC.exe
  2⤵
  PID:7452
- C:\Windows\System\nGKtehO.exe
  C:\Windows\System\nGKtehO.exe
  2⤵
  PID:7532
- C:\Windows\System\BadULHu.exe
  C:\Windows\System\BadULHu.exe
  2⤵
  PID:7616
- C:\Windows\System\MqoBfYs.exe
  C:\Windows\System\MqoBfYs.exe
  2⤵
  PID:7680
- C:\Windows\System\XHVlgJn.exe
  C:\Windows\System\XHVlgJn.exe
  2⤵
  PID:7704
- C:\Windows\System\dyoyrCl.exe
  C:\Windows\System\dyoyrCl.exe
  2⤵
  PID:7788
- C:\Windows\System\XlzgsjM.exe
  C:\Windows\System\XlzgsjM.exe
  2⤵
  PID:7948
- C:\Windows\System\nXhTuKD.exe
  C:\Windows\System\nXhTuKD.exe
  2⤵
  PID:7972
- C:\Windows\System\QYrCxZb.exe
  C:\Windows\System\QYrCxZb.exe
  2⤵
  PID:8036
- C:\Windows\System\aStqMIo.exe
  C:\Windows\System\aStqMIo.exe
  2⤵
  PID:8100
- C:\Windows\System\zJscRhi.exe
  C:\Windows\System\zJscRhi.exe
  2⤵
  PID:8156
- C:\Windows\System\sKnqjZh.exe
  C:\Windows\System\sKnqjZh.exe
  2⤵
  PID:7052
- C:\Windows\System\AXFuCTn.exe
  C:\Windows\System\AXFuCTn.exe
  2⤵
  PID:7336
- C:\Windows\System\tuiYyJt.exe
  C:\Windows\System\tuiYyJt.exe
  2⤵
  PID:7536
- C:\Windows\System\VyEtQPT.exe
  C:\Windows\System\VyEtQPT.exe
  2⤵
  PID:7728
- C:\Windows\System\FQmvSGr.exe
  C:\Windows\System\FQmvSGr.exe
  2⤵
  PID:7896
- C:\Windows\System\XXEEUcQ.exe
  C:\Windows\System\XXEEUcQ.exe
  2⤵
  PID:8032
- C:\Windows\System\CRdgKKo.exe
  C:\Windows\System\CRdgKKo.exe
  2⤵
  PID:6632
- C:\Windows\System\oVDowhn.exe
  C:\Windows\System\oVDowhn.exe
  2⤵
  PID:7500
- C:\Windows\System\krOzPrf.exe
  C:\Windows\System\krOzPrf.exe
  2⤵
  PID:7848
- C:\Windows\System\soGigcg.exe
  C:\Windows\System\soGigcg.exe
  2⤵
  PID:7248
- C:\Windows\System\ZAJXCpK.exe
  C:\Windows\System\ZAJXCpK.exe
  2⤵
  PID:8096
- C:\Windows\System\rzotiUy.exe
  C:\Windows\System\rzotiUy.exe
  2⤵
  PID:8200
- C:\Windows\System\XBaWLeX.exe
  C:\Windows\System\XBaWLeX.exe
  2⤵
  PID:8228
- C:\Windows\System\YTaJGGK.exe
  C:\Windows\System\YTaJGGK.exe
  2⤵
  PID:8256
- C:\Windows\System\IlmRVbW.exe
  C:\Windows\System\IlmRVbW.exe
  2⤵
  PID:8284
- C:\Windows\System\SnFTCfx.exe
  C:\Windows\System\SnFTCfx.exe
  2⤵
  PID:8312
- C:\Windows\System\cdvLIkt.exe
  C:\Windows\System\cdvLIkt.exe
  2⤵
  PID:8340
- C:\Windows\System\kjFODEj.exe
  C:\Windows\System\kjFODEj.exe
  2⤵
  PID:8368
- C:\Windows\System\cJNehfx.exe
  C:\Windows\System\cJNehfx.exe
  2⤵
  PID:8396
- C:\Windows\System\czmGbRu.exe
  C:\Windows\System\czmGbRu.exe
  2⤵
  PID:8424
- C:\Windows\System\YKpaSOL.exe
  C:\Windows\System\YKpaSOL.exe
  2⤵
  PID:8452
- C:\Windows\System\hKPzQnt.exe
  C:\Windows\System\hKPzQnt.exe
  2⤵
  PID:8480
- C:\Windows\System\lFfzGKJ.exe
  C:\Windows\System\lFfzGKJ.exe
  2⤵
  PID:8508
- C:\Windows\System\OQlvSTM.exe
  C:\Windows\System\OQlvSTM.exe
  2⤵
  PID:8536
- C:\Windows\System\iXbexqw.exe
  C:\Windows\System\iXbexqw.exe
  2⤵
  PID:8564
- C:\Windows\System\YlHhyAI.exe
  C:\Windows\System\YlHhyAI.exe
  2⤵
  PID:8592
- C:\Windows\System\DpEWrVh.exe
  C:\Windows\System\DpEWrVh.exe
  2⤵
  PID:8620
- C:\Windows\System\mCCHjfi.exe
  C:\Windows\System\mCCHjfi.exe
  2⤵
  PID:8648
- C:\Windows\System\HomPeOo.exe
  C:\Windows\System\HomPeOo.exe
  2⤵
  PID:8676
- C:\Windows\System\pqOSkEq.exe
  C:\Windows\System\pqOSkEq.exe
  2⤵
  PID:8704
- C:\Windows\System\XoBuBbg.exe
  C:\Windows\System\XoBuBbg.exe
  2⤵
  PID:8732
- C:\Windows\System\XlbazwM.exe
  C:\Windows\System\XlbazwM.exe
  2⤵
  PID:8760
- C:\Windows\System\PXbBMWn.exe
  C:\Windows\System\PXbBMWn.exe
  2⤵
  PID:8788
- C:\Windows\System\QDzmmRY.exe
  C:\Windows\System\QDzmmRY.exe
  2⤵
  PID:8816
- C:\Windows\System\AXABRvg.exe
  C:\Windows\System\AXABRvg.exe
  2⤵
  PID:8844
- C:\Windows\System\fPXKNWZ.exe
  C:\Windows\System\fPXKNWZ.exe
  2⤵
  PID:8872
- C:\Windows\System\UIFgUDj.exe
  C:\Windows\System\UIFgUDj.exe
  2⤵
  PID:8900
- C:\Windows\System\qZqquaA.exe
  C:\Windows\System\qZqquaA.exe
  2⤵
  PID:8916
- C:\Windows\System\WOPnfkM.exe
  C:\Windows\System\WOPnfkM.exe
  2⤵
  PID:8956
- C:\Windows\System\AXWjJDT.exe
  C:\Windows\System\AXWjJDT.exe
  2⤵
  PID:8984
- C:\Windows\System\GTwBcSE.exe
  C:\Windows\System\GTwBcSE.exe
  2⤵
  PID:9012
- C:\Windows\System\LVeBAtR.exe
  C:\Windows\System\LVeBAtR.exe
  2⤵
  PID:9040
- C:\Windows\System\qMkgPnm.exe
  C:\Windows\System\qMkgPnm.exe
  2⤵
  PID:9068
- C:\Windows\System\GBusZYW.exe
  C:\Windows\System\GBusZYW.exe
  2⤵
  PID:9100
- C:\Windows\System\nJULOQO.exe
  C:\Windows\System\nJULOQO.exe
  2⤵
  PID:9128
- C:\Windows\System\nnAxbaU.exe
  C:\Windows\System\nnAxbaU.exe
  2⤵
  PID:9156
- C:\Windows\System\VsAlMOK.exe
  C:\Windows\System\VsAlMOK.exe
  2⤵
  PID:9184
- C:\Windows\System\balVDPa.exe
  C:\Windows\System\balVDPa.exe
  2⤵
  PID:9212
- C:\Windows\System\AbMZFfc.exe
  C:\Windows\System\AbMZFfc.exe
  2⤵
  PID:8248
- C:\Windows\System\WEhsRuR.exe
  C:\Windows\System\WEhsRuR.exe
  2⤵
  PID:8304
- C:\Windows\System\hZaOByf.exe
  C:\Windows\System\hZaOByf.exe
  2⤵
  PID:8384
- C:\Windows\System\jvZBAVo.exe
  C:\Windows\System\jvZBAVo.exe
  2⤵
  PID:8444
- C:\Windows\System\VqHvWyw.exe
  C:\Windows\System\VqHvWyw.exe
  2⤵
  PID:8504
- C:\Windows\System\eSWzkmw.exe
  C:\Windows\System\eSWzkmw.exe
  2⤵
  PID:8580
- C:\Windows\System\STUeIWm.exe
  C:\Windows\System\STUeIWm.exe
  2⤵
  PID:8632
- C:\Windows\System\TxnGYDo.exe
  C:\Windows\System\TxnGYDo.exe
  2⤵
  PID:8696
- C:\Windows\System\SLCqXLo.exe
  C:\Windows\System\SLCqXLo.exe
  2⤵
  PID:7996
- C:\Windows\System\KPnpLPW.exe
  C:\Windows\System\KPnpLPW.exe
  2⤵
  PID:8804
- C:\Windows\System\cVddUDA.exe
  C:\Windows\System\cVddUDA.exe
  2⤵
  PID:8860
- C:\Windows\System\lQLcCte.exe
  C:\Windows\System\lQLcCte.exe
  2⤵
  PID:8944
- C:\Windows\System\rhCZdTT.exe
  C:\Windows\System\rhCZdTT.exe
  2⤵
  PID:8996
- C:\Windows\System\FsXDMdx.exe
  C:\Windows\System\FsXDMdx.exe
  2⤵
  PID:9060
- C:\Windows\System\SUhZaxH.exe
  C:\Windows\System\SUhZaxH.exe
  2⤵
  PID:9120
- C:\Windows\System\HnTMDBe.exe
  C:\Windows\System\HnTMDBe.exe
  2⤵
  PID:9168
- C:\Windows\System\qzZQqeT.exe
  C:\Windows\System\qzZQqeT.exe
  2⤵
  PID:9208
- C:\Windows\System\FKUwGwI.exe
  C:\Windows\System\FKUwGwI.exe
  2⤵
  PID:8420
- C:\Windows\System\BpflyPp.exe
  C:\Windows\System\BpflyPp.exe
  2⤵
  PID:8612
- C:\Windows\System\iEYJYGa.exe
  C:\Windows\System\iEYJYGa.exe
  2⤵
  PID:8748
- C:\Windows\System\IxEbTtq.exe
  C:\Windows\System\IxEbTtq.exe
  2⤵
  PID:8912
- C:\Windows\System\yonLgnV.exe
  C:\Windows\System\yonLgnV.exe
  2⤵
  PID:9036
- C:\Windows\System\Txrpgvu.exe
  C:\Windows\System\Txrpgvu.exe
  2⤵
  PID:9148
- C:\Windows\System\hmHlTHN.exe
  C:\Windows\System\hmHlTHN.exe
  2⤵
  PID:8308
- C:\Windows\System\QwlJgCa.exe
  C:\Windows\System\QwlJgCa.exe
  2⤵
  PID:8836
- C:\Windows\System\dbHbowh.exe
  C:\Windows\System\dbHbowh.exe
  2⤵
  PID:8360
- C:\Windows\System\DNCoDnQ.exe
  C:\Windows\System\DNCoDnQ.exe
  2⤵
  PID:9008
- C:\Windows\System\kXekuvo.exe
  C:\Windows\System\kXekuvo.exe
  2⤵
  PID:8728
- C:\Windows\System\WoPrndW.exe
  C:\Windows\System\WoPrndW.exe
  2⤵
  PID:9244
- C:\Windows\System\xZRBUoF.exe
  C:\Windows\System\xZRBUoF.exe
  2⤵
  PID:9272
- C:\Windows\System\Cwxyeav.exe
  C:\Windows\System\Cwxyeav.exe
  2⤵
  PID:9300
- C:\Windows\System\QVtgBIA.exe
  C:\Windows\System\QVtgBIA.exe
  2⤵
  PID:9328
- C:\Windows\System\aXcmKqo.exe
  C:\Windows\System\aXcmKqo.exe
  2⤵
  PID:9356
- C:\Windows\System\nzISVrv.exe
  C:\Windows\System\nzISVrv.exe
  2⤵
  PID:9380
- C:\Windows\System\NIZLBRe.exe
  C:\Windows\System\NIZLBRe.exe
  2⤵
  PID:9412
- C:\Windows\System\cRHTsgB.exe
  C:\Windows\System\cRHTsgB.exe
  2⤵
  PID:9440
- C:\Windows\System\OJsZRQa.exe
  C:\Windows\System\OJsZRQa.exe
  2⤵
  PID:9460
- C:\Windows\System\GiGLxdp.exe
  C:\Windows\System\GiGLxdp.exe
  2⤵
  PID:9496
- C:\Windows\System\OZPlLDc.exe
  C:\Windows\System\OZPlLDc.exe
  2⤵
  PID:9520
- C:\Windows\System\tqwWVmA.exe
  C:\Windows\System\tqwWVmA.exe
  2⤵
  PID:9552
- C:\Windows\System\sOYDiPt.exe
  C:\Windows\System\sOYDiPt.exe
  2⤵
  PID:9584
- C:\Windows\System\wDquzGZ.exe
  C:\Windows\System\wDquzGZ.exe
  2⤵
  PID:9612
- C:\Windows\System\VBUvHPc.exe
  C:\Windows\System\VBUvHPc.exe
  2⤵
  PID:9640
- C:\Windows\System\tJslPRT.exe
  C:\Windows\System\tJslPRT.exe
  2⤵
  PID:9668
- C:\Windows\System\pCVgYVM.exe
  C:\Windows\System\pCVgYVM.exe
  2⤵
  PID:9688
- C:\Windows\System\pPCfPiI.exe
  C:\Windows\System\pPCfPiI.exe
  2⤵
  PID:9720
- C:\Windows\System\TqmQQSA.exe
  C:\Windows\System\TqmQQSA.exe
  2⤵
  PID:9744
- C:\Windows\System\WmBEFFw.exe
  C:\Windows\System\WmBEFFw.exe
  2⤵
  PID:9776
- C:\Windows\System\HDAQeLM.exe
  C:\Windows\System\HDAQeLM.exe
  2⤵
  PID:9812
- C:\Windows\System\jioHevi.exe
  C:\Windows\System\jioHevi.exe
  2⤵
  PID:9828
- C:\Windows\System\IAqizYN.exe
  C:\Windows\System\IAqizYN.exe
  2⤵
  PID:9868
- C:\Windows\System\oyPuVrR.exe
  C:\Windows\System\oyPuVrR.exe
  2⤵
  PID:9896
- C:\Windows\System\zfYgTJE.exe
  C:\Windows\System\zfYgTJE.exe
  2⤵
  PID:9924
- C:\Windows\System\iCkXeGx.exe
  C:\Windows\System\iCkXeGx.exe
  2⤵
  PID:9952
- C:\Windows\System\IBLdshi.exe
  C:\Windows\System\IBLdshi.exe
  2⤵
  PID:9980
- C:\Windows\System\WeTShIP.exe
  C:\Windows\System\WeTShIP.exe
  2⤵
  PID:10008
- C:\Windows\System\ylDLaPU.exe
  C:\Windows\System\ylDLaPU.exe
  2⤵
  PID:10028
- C:\Windows\System\QrZfUUB.exe
  C:\Windows\System\QrZfUUB.exe
  2⤵
  PID:10056
- C:\Windows\System\mxdgkTg.exe
  C:\Windows\System\mxdgkTg.exe
  2⤵
  PID:10092
- C:\Windows\System\RRXgnrb.exe
  C:\Windows\System\RRXgnrb.exe
  2⤵
  PID:10124
- C:\Windows\System\IEICuRt.exe
  C:\Windows\System\IEICuRt.exe
  2⤵
  PID:10152
- C:\Windows\System\EuvtmFU.exe
  C:\Windows\System\EuvtmFU.exe
  2⤵
  PID:10172
- C:\Windows\System\iNzGOXs.exe
  C:\Windows\System\iNzGOXs.exe
  2⤵
  PID:10208
- C:\Windows\System\sZoVqSt.exe
  C:\Windows\System\sZoVqSt.exe
  2⤵
  PID:10236
- C:\Windows\System\YonSRiy.exe
  C:\Windows\System\YonSRiy.exe
  2⤵
  PID:9268
- C:\Windows\System\rIjYmmi.exe
  C:\Windows\System\rIjYmmi.exe
  2⤵
  PID:9340
- C:\Windows\System\WSrVLUj.exe
  C:\Windows\System\WSrVLUj.exe
  2⤵
  PID:9396
- C:\Windows\System\XeGpFPk.exe
  C:\Windows\System\XeGpFPk.exe
  2⤵
  PID:9452
- C:\Windows\System\sfEbDbR.exe
  C:\Windows\System\sfEbDbR.exe
  2⤵
  PID:9504
- C:\Windows\System\YeccLcL.exe
  C:\Windows\System\YeccLcL.exe
  2⤵
  PID:9600
- C:\Windows\System\ZzeybNQ.exe
  C:\Windows\System\ZzeybNQ.exe
  2⤵
  PID:9660
- C:\Windows\System\PBcioUW.exe
  C:\Windows\System\PBcioUW.exe
  2⤵
  PID:9712
- C:\Windows\System\DXzrwTx.exe
  C:\Windows\System\DXzrwTx.exe
  2⤵
  PID:9788
- C:\Windows\System\zSzjSVK.exe
  C:\Windows\System\zSzjSVK.exe
  2⤵
  PID:9844
- C:\Windows\System\NGhdMWH.exe
  C:\Windows\System\NGhdMWH.exe
  2⤵
  PID:9916
- C:\Windows\System\GzMdwER.exe
  C:\Windows\System\GzMdwER.exe
  2⤵
  PID:9992
- C:\Windows\System\ZLksrLT.exe
  C:\Windows\System\ZLksrLT.exe
  2⤵
  PID:10048
- C:\Windows\System\cHbsFNo.exe
  C:\Windows\System\cHbsFNo.exe
  2⤵
  PID:10120
- C:\Windows\System\WcieJOY.exe
  C:\Windows\System\WcieJOY.exe
  2⤵
  PID:10180
- C:\Windows\System\odhUMky.exe
  C:\Windows\System\odhUMky.exe
  2⤵
  PID:9264
- C:\Windows\System\fmYlTzo.exe
  C:\Windows\System\fmYlTzo.exe
  2⤵
  PID:9404
- C:\Windows\System\PusomLB.exe
  C:\Windows\System\PusomLB.exe
  2⤵
  PID:9636
- C:\Windows\System\mQGqJTt.exe
  C:\Windows\System\mQGqJTt.exe
  2⤵
  PID:9684
- C:\Windows\System\axJRRSr.exe
  C:\Windows\System\axJRRSr.exe
  2⤵
  PID:9884
- C:\Windows\System\BLBkMXF.exe
  C:\Windows\System\BLBkMXF.exe
  2⤵
  PID:10024
- C:\Windows\System\sgzPqvN.exe
  C:\Windows\System\sgzPqvN.exe
  2⤵
  PID:10144
- C:\Windows\System\nXxVzsP.exe
  C:\Windows\System\nXxVzsP.exe
  2⤵
  PID:9448
- C:\Windows\System\YoZFInw.exe
  C:\Windows\System\YoZFInw.exe
  2⤵
  PID:9800
- C:\Windows\System\ELUbieD.exe
  C:\Windows\System\ELUbieD.exe
  2⤵
  PID:10136
- C:\Windows\System\mTrOuWr.exe
  C:\Windows\System\mTrOuWr.exe
  2⤵
  PID:9680
- C:\Windows\System\euSiMHe.exe
  C:\Windows\System\euSiMHe.exe
  2⤵
  PID:10252
- C:\Windows\System\xGlOiTo.exe
  C:\Windows\System\xGlOiTo.exe
  2⤵
  PID:10280
- C:\Windows\System\hTuFGbt.exe
  C:\Windows\System\hTuFGbt.exe
  2⤵
  PID:10308
- C:\Windows\System\yJwxQSB.exe
  C:\Windows\System\yJwxQSB.exe
  2⤵
  PID:10336
- C:\Windows\System\KyobpFS.exe
  C:\Windows\System\KyobpFS.exe
  2⤵
  PID:10364
- C:\Windows\System\ggfcDkc.exe
  C:\Windows\System\ggfcDkc.exe
  2⤵
  PID:10392
- C:\Windows\System\LOxCwkR.exe
  C:\Windows\System\LOxCwkR.exe
  2⤵
  PID:10420
- C:\Windows\System\PQBZNAc.exe
  C:\Windows\System\PQBZNAc.exe
  2⤵
  PID:10448
- C:\Windows\System\AHIycWc.exe
  C:\Windows\System\AHIycWc.exe
  2⤵
  PID:10476
- C:\Windows\System\bWdzesB.exe
  C:\Windows\System\bWdzesB.exe
  2⤵
  PID:10504
- C:\Windows\System\akWqDFB.exe
  C:\Windows\System\akWqDFB.exe
  2⤵
  PID:10532
- C:\Windows\System\JlienMM.exe
  C:\Windows\System\JlienMM.exe
  2⤵
  PID:10560
- C:\Windows\System\usrAgSB.exe
  C:\Windows\System\usrAgSB.exe
  2⤵
  PID:10588
- C:\Windows\System\NUmnGbM.exe
  C:\Windows\System\NUmnGbM.exe
  2⤵
  PID:10616
- C:\Windows\System\MmWUHdY.exe
  C:\Windows\System\MmWUHdY.exe
  2⤵
  PID:10644
- C:\Windows\System\mRnAzTb.exe
  C:\Windows\System\mRnAzTb.exe
  2⤵
  PID:10672
- C:\Windows\System\cdjieLH.exe
  C:\Windows\System\cdjieLH.exe
  2⤵
  PID:10700
- C:\Windows\System\gWHjgAN.exe
  C:\Windows\System\gWHjgAN.exe
  2⤵
  PID:10728
- C:\Windows\System\ekiuqWE.exe
  C:\Windows\System\ekiuqWE.exe
  2⤵
  PID:10748
- C:\Windows\System\cDmEoAt.exe
  C:\Windows\System\cDmEoAt.exe
  2⤵
  PID:10768
- C:\Windows\System\CgmhjBj.exe
  C:\Windows\System\CgmhjBj.exe
  2⤵
  PID:10792
- C:\Windows\System\CJyUxRJ.exe
  C:\Windows\System\CJyUxRJ.exe
  2⤵
  PID:10832
- C:\Windows\System\ypqjVsT.exe
  C:\Windows\System\ypqjVsT.exe
  2⤵
  PID:10872
- C:\Windows\System\TeUaFYf.exe
  C:\Windows\System\TeUaFYf.exe
  2⤵
  PID:10900
- C:\Windows\System\aCmhUsP.exe
  C:\Windows\System\aCmhUsP.exe
  2⤵
  PID:10920
- C:\Windows\System\sdoRSZD.exe
  C:\Windows\System\sdoRSZD.exe
  2⤵
  PID:10960
- C:\Windows\System\oLCvBSt.exe
  C:\Windows\System\oLCvBSt.exe
  2⤵
  PID:10988
- C:\Windows\System\qVpkuuU.exe
  C:\Windows\System\qVpkuuU.exe
  2⤵
  PID:11016
- C:\Windows\System\mnXAhmp.exe
  C:\Windows\System\mnXAhmp.exe
  2⤵
  PID:11040
- C:\Windows\System\ByDWkIP.exe
  C:\Windows\System\ByDWkIP.exe
  2⤵
  PID:11076
- C:\Windows\System\WaqxxJz.exe
  C:\Windows\System\WaqxxJz.exe
  2⤵
  PID:11104
- C:\Windows\System\bVtHFJw.exe
  C:\Windows\System\bVtHFJw.exe
  2⤵
  PID:11120
- C:\Windows\System\cTcaIVb.exe
  C:\Windows\System\cTcaIVb.exe
  2⤵
  PID:11160
- C:\Windows\System\gXbFWzu.exe
  C:\Windows\System\gXbFWzu.exe
  2⤵
  PID:11188
- C:\Windows\System\mkeXYwg.exe
  C:\Windows\System\mkeXYwg.exe
  2⤵
  PID:11204
- C:\Windows\System\APeJmuW.exe
  C:\Windows\System\APeJmuW.exe
  2⤵
  PID:11232
- C:\Windows\System\mUfSdQc.exe
  C:\Windows\System\mUfSdQc.exe
  2⤵
  PID:11248
- C:\Windows\System\SkJrvLp.exe
  C:\Windows\System\SkJrvLp.exe
  2⤵
  PID:10264
- C:\Windows\System\ubaoKNi.exe
  C:\Windows\System\ubaoKNi.exe
  2⤵
  PID:10360
- C:\Windows\System\SePlBoK.exe
  C:\Windows\System\SePlBoK.exe
  2⤵
  PID:10432
- C:\Windows\System\BXfpUkL.exe
  C:\Windows\System\BXfpUkL.exe
  2⤵
  PID:10496
- C:\Windows\System\ZIsqfQB.exe
  C:\Windows\System\ZIsqfQB.exe
  2⤵
  PID:10572
- C:\Windows\System\olHJSyq.exe
  C:\Windows\System\olHJSyq.exe
  2⤵
  PID:10628
- C:\Windows\System\FIZNAAo.exe
  C:\Windows\System\FIZNAAo.exe
  2⤵
  PID:10656
- C:\Windows\System\CJEmPHI.exe
  C:\Windows\System\CJEmPHI.exe
  2⤵
  PID:10740
- C:\Windows\System\rdyAbRs.exe
  C:\Windows\System\rdyAbRs.exe
  2⤵
  PID:10784
- C:\Windows\System\PpRcOHh.exe
  C:\Windows\System\PpRcOHh.exe
  2⤵
  PID:10912
- C:\Windows\System\hzVyUFp.exe
  C:\Windows\System\hzVyUFp.exe
  2⤵
  PID:10756
- C:\Windows\System\vbmbvEf.exe
  C:\Windows\System\vbmbvEf.exe
  2⤵
  PID:11024
- C:\Windows\System\CMEdLDX.exe
  C:\Windows\System\CMEdLDX.exe
  2⤵
  PID:11096
- C:\Windows\System\TpsxdSr.exe
  C:\Windows\System\TpsxdSr.exe
  2⤵
  PID:11144
- C:\Windows\System\PAkxGRS.exe
  C:\Windows\System\PAkxGRS.exe
  2⤵
  PID:11220
- C:\Windows\System\IDmwOPo.exe
  C:\Windows\System\IDmwOPo.exe
  2⤵
  PID:10248
- C:\Windows\System\nnljMNv.exe
  C:\Windows\System\nnljMNv.exe
  2⤵
  PID:10404
- C:\Windows\System\nwwWUxe.exe
  C:\Windows\System\nwwWUxe.exe
  2⤵
  PID:10544
- C:\Windows\System\WKTyEBb.exe
  C:\Windows\System\WKTyEBb.exe
  2⤵
  PID:10684
- C:\Windows\System\EsDGkCR.exe
  C:\Windows\System\EsDGkCR.exe
  2⤵
  PID:10868
- C:\Windows\System\RdyYLCf.exe
  C:\Windows\System\RdyYLCf.exe
  2⤵
  PID:1804
- C:\Windows\System\OJPnHzx.exe
  C:\Windows\System\OJPnHzx.exe
  2⤵
  PID:2556
- C:\Windows\System\dHqlpjH.exe
  C:\Windows\System\dHqlpjH.exe
  2⤵
  PID:10808
- C:\Windows\System\iEblPyx.exe
  C:\Windows\System\iEblPyx.exe
  2⤵
  PID:3848
- C:\Windows\System\celipeq.exe
  C:\Windows\System\celipeq.exe
  2⤵
  PID:4464
- C:\Windows\System\rRLlOKz.exe
  C:\Windows\System\rRLlOKz.exe
  2⤵
  PID:10980
- C:\Windows\System\hQwHQWZ.exe
  C:\Windows\System\hQwHQWZ.exe
  2⤵
  PID:11180
- C:\Windows\System\eEpKYfN.exe
  C:\Windows\System\eEpKYfN.exe
  2⤵
  PID:10724
- C:\Windows\System\BczsIXf.exe
  C:\Windows\System\BczsIXf.exe
  2⤵
  PID:10388
- C:\Windows\System\inDwcPM.exe
  C:\Windows\System\inDwcPM.exe
  2⤵
  PID:9528
- C:\Windows\System\BcoVpVd.exe
  C:\Windows\System\BcoVpVd.exe
  2⤵
  PID:11072
- C:\Windows\System\dePPYFj.exe
  C:\Windows\System\dePPYFj.exe
  2⤵
  PID:1468
- C:\Windows\System\MkTQXLb.exe
  C:\Windows\System\MkTQXLb.exe
  2⤵
  PID:11244
- C:\Windows\System\PVSoorY.exe
  C:\Windows\System\PVSoorY.exe
  2⤵
  PID:11276
- C:\Windows\System\YtglUPI.exe
  C:\Windows\System\YtglUPI.exe
  2⤵
  PID:11304
- C:\Windows\System\LvUvSVS.exe
  C:\Windows\System\LvUvSVS.exe
  2⤵
  PID:11332
- C:\Windows\System\xJbMpwo.exe
  C:\Windows\System\xJbMpwo.exe
  2⤵
  PID:11360
- C:\Windows\System\bNaUssp.exe
  C:\Windows\System\bNaUssp.exe
  2⤵
  PID:11388
- C:\Windows\System\AaxdyAt.exe
  C:\Windows\System\AaxdyAt.exe
  2⤵
  PID:11416
- C:\Windows\System\JJfqKNM.exe
  C:\Windows\System\JJfqKNM.exe
  2⤵
  PID:11448
- C:\Windows\System\umKtjal.exe
  C:\Windows\System\umKtjal.exe
  2⤵
  PID:11476
- C:\Windows\System\seAFiYR.exe
  C:\Windows\System\seAFiYR.exe
  2⤵
  PID:11500
- C:\Windows\System\AUGEHip.exe
  C:\Windows\System\AUGEHip.exe
  2⤵
  PID:11532
- C:\Windows\System\ETgvtiW.exe
  C:\Windows\System\ETgvtiW.exe
  2⤵
  PID:11560
- C:\Windows\System\yPhFCwC.exe
  C:\Windows\System\yPhFCwC.exe
  2⤵
  PID:11588
- C:\Windows\System\LvKSnyY.exe
  C:\Windows\System\LvKSnyY.exe
  2⤵
  PID:11616
- C:\Windows\System\epDUfTX.exe
  C:\Windows\System\epDUfTX.exe
  2⤵
  PID:11644
- C:\Windows\System\UcmKkhU.exe
  C:\Windows\System\UcmKkhU.exe
  2⤵
  PID:11672
- C:\Windows\System\DcRJpDN.exe
  C:\Windows\System\DcRJpDN.exe
  2⤵
  PID:11700
- C:\Windows\System\DWrKRPJ.exe
  C:\Windows\System\DWrKRPJ.exe
  2⤵
  PID:11724
- C:\Windows\System\Rztjbrt.exe
  C:\Windows\System\Rztjbrt.exe
  2⤵
  PID:11756
- C:\Windows\System\xQQJAOJ.exe
  C:\Windows\System\xQQJAOJ.exe
  2⤵
  PID:11784
- C:\Windows\System\eJFQtvv.exe
  C:\Windows\System\eJFQtvv.exe
  2⤵
  PID:11812
- C:\Windows\System\uLhWqOn.exe
  C:\Windows\System\uLhWqOn.exe
  2⤵
  PID:11840
- C:\Windows\System\Uzfhgrp.exe
  C:\Windows\System\Uzfhgrp.exe
  2⤵
  PID:11868
- C:\Windows\System\zXbmohr.exe
  C:\Windows\System\zXbmohr.exe
  2⤵
  PID:11952
- C:\Windows\System\prYEDaY.exe
  C:\Windows\System\prYEDaY.exe
  2⤵
  PID:11980
- C:\Windows\System\ABdzJkb.exe
  C:\Windows\System\ABdzJkb.exe
  2⤵
  PID:12008
- C:\Windows\System\SccgohQ.exe
  C:\Windows\System\SccgohQ.exe
  2⤵
  PID:12036
- C:\Windows\System\yNxlDml.exe
  C:\Windows\System\yNxlDml.exe
  2⤵
  PID:12064
- C:\Windows\System\VkAwnYD.exe
  C:\Windows\System\VkAwnYD.exe
  2⤵
  PID:12092
- C:\Windows\System\OAudOyU.exe
  C:\Windows\System\OAudOyU.exe
  2⤵
  PID:12140
- C:\Windows\System\snFtAzy.exe
  C:\Windows\System\snFtAzy.exe
  2⤵
  PID:12168
- C:\Windows\System\BJaaFum.exe
  C:\Windows\System\BJaaFum.exe
  2⤵
  PID:12204
- C:\Windows\System\pAhrsDg.exe
  C:\Windows\System\pAhrsDg.exe
  2⤵
  PID:12244
- C:\Windows\System\MlBcRcg.exe
  C:\Windows\System\MlBcRcg.exe
  2⤵
  PID:12272
- C:\Windows\System\anScAlz.exe
  C:\Windows\System\anScAlz.exe
  2⤵
  PID:11316
- C:\Windows\System\tiwCwLv.exe
  C:\Windows\System\tiwCwLv.exe
  2⤵
  PID:11380
- C:\Windows\System\zxOSnLJ.exe
  C:\Windows\System\zxOSnLJ.exe
  2⤵
  PID:11444
- C:\Windows\System\CDcAVFA.exe
  C:\Windows\System\CDcAVFA.exe
  2⤵
  PID:11524
- C:\Windows\System\KYvtWIo.exe
  C:\Windows\System\KYvtWIo.exe
  2⤵
  PID:11608
- C:\Windows\System\TSTaELL.exe
  C:\Windows\System\TSTaELL.exe
  2⤵
  PID:11656
- C:\Windows\System\ZeTzFIy.exe
  C:\Windows\System\ZeTzFIy.exe
  2⤵
  PID:11708
- C:\Windows\System\WaDlakg.exe
  C:\Windows\System\WaDlakg.exe
  2⤵
  PID:11776
- C:\Windows\System\PcJblnF.exe
  C:\Windows\System\PcJblnF.exe
  2⤵
  PID:11856
- C:\Windows\System\usSrVYC.exe
  C:\Windows\System\usSrVYC.exe
  2⤵
  PID:11908
- C:\Windows\System\qHtZATb.exe
  C:\Windows\System\qHtZATb.exe
  2⤵
  PID:11944
- C:\Windows\System\DpLElLn.exe
  C:\Windows\System\DpLElLn.exe
  2⤵
  PID:12020
- C:\Windows\System\hHYBBrl.exe
  C:\Windows\System\hHYBBrl.exe
  2⤵
  PID:12164
- C:\Windows\System\GYDBPCK.exe
  C:\Windows\System\GYDBPCK.exe
  2⤵
  PID:12196
- C:\Windows\System\mymXHIo.exe
  C:\Windows\System\mymXHIo.exe
  2⤵
  PID:12264
- C:\Windows\System\LwfbnoX.exe
  C:\Windows\System\LwfbnoX.exe
  2⤵
  PID:11412
- C:\Windows\System\yTXJmuB.exe
  C:\Windows\System\yTXJmuB.exe
  2⤵
  PID:11580
- C:\Windows\System\HcqumXx.exe
  C:\Windows\System\HcqumXx.exe
  2⤵
  PID:11768
- C:\Windows\System\zLOXZKk.exe
  C:\Windows\System\zLOXZKk.exe
  2⤵
  PID:11928
- C:\Windows\System\FTQUSOo.exe
  C:\Windows\System\FTQUSOo.exe
  2⤵
  PID:3540
- C:\Windows\System\NgyMxwz.exe
  C:\Windows\System\NgyMxwz.exe
  2⤵
  PID:11268
- C:\Windows\System\YDlRQdC.exe
  C:\Windows\System\YDlRQdC.exe
  2⤵
  PID:11716
- C:\Windows\System\AlLENII.exe
  C:\Windows\System\AlLENII.exe
  2⤵
  PID:11896
- C:\Windows\System\RpiOCDI.exe
  C:\Windows\System\RpiOCDI.exe
  2⤵
  PID:11996
- C:\Windows\System\NpwZppu.exe
  C:\Windows\System\NpwZppu.exe
  2⤵
  PID:11664
- C:\Windows\System\ovVImJP.exe
  C:\Windows\System\ovVImJP.exe
  2⤵
  PID:2836
- C:\Windows\System\sYqGPNj.exe
  C:\Windows\System\sYqGPNj.exe
  2⤵
  PID:12316
- C:\Windows\System\APiFNSX.exe
  C:\Windows\System\APiFNSX.exe
  2⤵
  PID:12344
- C:\Windows\System\UpvgrYK.exe
  C:\Windows\System\UpvgrYK.exe
  2⤵
  PID:12372
- C:\Windows\System\otjvBVW.exe
  C:\Windows\System\otjvBVW.exe
  2⤵
  PID:12404
- C:\Windows\System\uUKXIsf.exe
  C:\Windows\System\uUKXIsf.exe
  2⤵
  PID:12420
- C:\Windows\System\OSzzlDp.exe
  C:\Windows\System\OSzzlDp.exe
  2⤵
  PID:12460
- C:\Windows\System\nfVzuaR.exe
  C:\Windows\System\nfVzuaR.exe
  2⤵
  PID:12488
- C:\Windows\System\kAvdEoI.exe
  C:\Windows\System\kAvdEoI.exe
  2⤵
  PID:12508
- C:\Windows\System\KndXRBR.exe
  C:\Windows\System\KndXRBR.exe
  2⤵
  PID:12548
- C:\Windows\System\JRcEkFA.exe
  C:\Windows\System\JRcEkFA.exe
  2⤵
  PID:12576
- C:\Windows\System\qKtLfEz.exe
  C:\Windows\System\qKtLfEz.exe
  2⤵
  PID:12604
- C:\Windows\System\HhHDmtN.exe
  C:\Windows\System\HhHDmtN.exe
  2⤵
  PID:12632
- C:\Windows\System\cBbJCdh.exe
  C:\Windows\System\cBbJCdh.exe
  2⤵
  PID:12648
- C:\Windows\System\nkGtqDM.exe
  C:\Windows\System\nkGtqDM.exe
  2⤵
  PID:12688
- C:\Windows\System\DHXSRkv.exe
  C:\Windows\System\DHXSRkv.exe
  2⤵
  PID:12716
- C:\Windows\System\qEGJGIG.exe
  C:\Windows\System\qEGJGIG.exe
  2⤵
  PID:12744
- C:\Windows\System\qOgLlQN.exe
  C:\Windows\System\qOgLlQN.exe
  2⤵
  PID:12760
- C:\Windows\System\ByQnjpw.exe
  C:\Windows\System\ByQnjpw.exe
  2⤵
  PID:12800
- C:\Windows\System\suDwqPE.exe
  C:\Windows\System\suDwqPE.exe
  2⤵
  PID:12828
- C:\Windows\System\lzLnWyj.exe
  C:\Windows\System\lzLnWyj.exe
  2⤵
  PID:12856
- C:\Windows\System\FjewUMO.exe
  C:\Windows\System\FjewUMO.exe
  2⤵
  PID:12884
- C:\Windows\System\ceAdeaB.exe
  C:\Windows\System\ceAdeaB.exe
  2⤵
  PID:12912
- C:\Windows\System\MUNJUxS.exe
  C:\Windows\System\MUNJUxS.exe
  2⤵
  PID:12932
- C:\Windows\System\sagbIvr.exe
  C:\Windows\System\sagbIvr.exe
  2⤵
  PID:12956
- C:\Windows\System\MNGTYDZ.exe
  C:\Windows\System\MNGTYDZ.exe
  2⤵
  PID:12984
- C:\Windows\System\SQTgWQQ.exe
  C:\Windows\System\SQTgWQQ.exe
  2⤵
  PID:13016
- C:\Windows\System\GblxmYE.exe
  C:\Windows\System\GblxmYE.exe
  2⤵
  PID:13044
- C:\Windows\System\XNzbooD.exe
  C:\Windows\System\XNzbooD.exe
  2⤵
  PID:13084
- C:\Windows\System\CJTzYbw.exe
  C:\Windows\System\CJTzYbw.exe
  2⤵
  PID:13112
- C:\Windows\System\eaIUyfG.exe
  C:\Windows\System\eaIUyfG.exe
  2⤵
  PID:13140
- C:\Windows\System\zDZDyTo.exe
  C:\Windows\System\zDZDyTo.exe
  2⤵
  PID:13168
- C:\Windows\System\aBgROxT.exe
  C:\Windows\System\aBgROxT.exe
  2⤵
  PID:13196
- C:\Windows\System\WQFsYte.exe
  C:\Windows\System\WQFsYte.exe
  2⤵
  PID:13220
- C:\Windows\System\CpENSun.exe
  C:\Windows\System\CpENSun.exe
  2⤵
  PID:13244
- C:\Windows\System\OiNUStM.exe
  C:\Windows\System\OiNUStM.exe
  2⤵
  PID:13284
- C:\Windows\System\nOeCXJX.exe
  C:\Windows\System\nOeCXJX.exe
  2⤵
  PID:13304
- C:\Windows\System\pFGQDak.exe
  C:\Windows\System\pFGQDak.exe
  2⤵
  PID:12304
- C:\Windows\System\hRctEEU.exe
  C:\Windows\System\hRctEEU.exe
  2⤵
  PID:4276
- C:\Windows\System\zietKdb.exe
  C:\Windows\System\zietKdb.exe
  2⤵
  PID:1748
- C:\Windows\System\vtEtTcH.exe
  C:\Windows\System\vtEtTcH.exe
  2⤵
  PID:12472
- C:\Windows\System\TwklAeT.exe
  C:\Windows\System\TwklAeT.exe
  2⤵
  PID:12516
- C:\Windows\System\ImPdPaN.exe
  C:\Windows\System\ImPdPaN.exe
  2⤵
  PID:12596
- C:\Windows\System\hXVOVMi.exe
  C:\Windows\System\hXVOVMi.exe
  2⤵
  PID:12684
- C:\Windows\System\qVBiOTb.exe
  C:\Windows\System\qVBiOTb.exe
  2⤵
  PID:12732
- C:\Windows\System\HEibOiZ.exe
  C:\Windows\System\HEibOiZ.exe
  2⤵
  PID:12796
- C:\Windows\System\pZlVCtg.exe
  C:\Windows\System\pZlVCtg.exe
  2⤵
  PID:12876
- C:\Windows\System\fKkSRMp.exe
  C:\Windows\System\fKkSRMp.exe
  2⤵
  PID:12924
- C:\Windows\System\SPAUSDl.exe
  C:\Windows\System\SPAUSDl.exe
  2⤵
  PID:12968
- C:\Windows\System\oKSsiUB.exe
  C:\Windows\System\oKSsiUB.exe
  2⤵
  PID:13060
- C:\Windows\System\wBkgkDE.exe
  C:\Windows\System\wBkgkDE.exe
  2⤵
  PID:13108
- C:\Windows\System\XcqapRR.exe
  C:\Windows\System\XcqapRR.exe
  2⤵
  PID:1828
- C:\Windows\System\BMhfOeH.exe
  C:\Windows\System\BMhfOeH.exe
  2⤵
  PID:13236
- C:\Windows\System\pUxLZYY.exe
  C:\Windows\System\pUxLZYY.exe
  2⤵
  PID:12416
- C:\Windows\System\TjkbRtS.exe
  C:\Windows\System\TjkbRtS.exe
  2⤵
  PID:12480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rvrxdgdo.510.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AnWlinJ.exe

Filesize
3.0MB

MD5
61c39ab0e6e07d40c09cf8c299157b23

SHA1
4a575a30a3e5bed16d5a9e4508386d2f1d886da3

SHA256
86f7b1f4600a5bd2386e4dcf485442d3b7dfba4376aa9e482b4ae2a6d675ea9e

SHA512
d7963362e297bfb81504030bfa1dc43fd1916cfac6e23971dfe73db637c870a1fda7335dc6d79ec7720e371ffe677fab17ca2f619163928d13ddeb6fd43c8f6e

Download Submit
C:\Windows\System\BiUhlMF.exe

Filesize
3.0MB

MD5
25e0a7fa072a775d5bf38d3a35be5e16

SHA1
d22d7de2f2a1c3835e40743eb36e0bbbb466e887

SHA256
4b6d4f3915dea5cbc9048a7a82f3990c47234819303a18694ee5144dc58662f7

SHA512
1cceb78c147add67565508133a39767c824599740dd4ffd9f04cf54032b38b501f3b37e3e47f549b0affbdce6a5f6e93b1242e48271951dd7d7ca5e9368cf20d

Download Submit
C:\Windows\System\BmLXzeY.exe

Filesize
3.0MB

MD5
7dbd9ad22f3cbabcc1a633e31452f1f5

SHA1
3a77805474d0b31ca3a81977454cb018778508db

SHA256
17a60fd86c5a433b656505ed0febf3d591514c7c2a9e513513d42900343ea4c7

SHA512
249c8a1990e059baaa9535e0ea78056f1515acf2901ed95a5b0c49b606d6ca5c1a961a0005719520243dc13a4f0d767287c509cb0bf327300fd4dd568de3beaa

Download Submit
C:\Windows\System\BxgMguL.exe

Filesize
3.0MB

MD5
82e2790d9e7eb8faba41db0de3de9678

SHA1
b95c155e0374b724d1e09610edd5de6bcc27b93b

SHA256
ab28fb5e0fb1682e2dba65ad44a3e9839d043438283f41aea15c80fc8a135e0f

SHA512
c5fccb2c58be2396018c6afbd911bde4f9d0447acbcc7dfd64d2df4f9fc9e5356c4ad05642a31908491b3650c9dbd707fd08dcf4c16975850aa6ec565be38218

Download Submit
C:\Windows\System\GBnoPwT.exe

Filesize
3.0MB

MD5
44cd55e956017f80782888cac0ff60f4

SHA1
3539f7bedd7bf790e2398095b78fd9fdc9ba8324

SHA256
3668259d7d5aa365e19b07ec70691229697f21a7c2622eea6e74eadc0f44bc03

SHA512
1f69183b28753414346454181a027424e9f35474176795ee98b8d7e1c7eec320278d1d16e9f64902f4bf2050f2d19cdde4d4b82a1789f216c4b639473a639f3f

Download Submit
C:\Windows\System\IjMUBqj.exe

Filesize
3.0MB

MD5
8716605404ebcbf4aa81acbb07835d33

SHA1
5560d5fab29f57791ef6fd0c98f3063f6593bdf4

SHA256
f023fb586cc6776194d4215b4ed0ac73e2eeb66ca324d603e11cc68c5bee4671

SHA512
49144d5eecbab0e46b23395278b42fffae928c11aae497c40a9b48ffcb9967531471242d09585f6b5580fc276c6cf4e02800474c9dc2576a0acad4a54f085bd2

Download Submit
C:\Windows\System\LAmPPRX.exe

Filesize
3.0MB

MD5
ce1abfb536b39e576016599b298e1e73

SHA1
ed184ae793ddd33b0ae3bd6f5565604e8a80d348

SHA256
b824d64067ebb5b26a02d5329362f34be4c4f9d6427a22acd3d6a4bff48c2510

SHA512
0d373ec058c86222e80a6a22014d44306198dc67f9018065286953be0f38d1a963b8c7d191ded36af44ee40e9e7591e965349f3532d3833abb0b2d2c6a3b5006

Download Submit
C:\Windows\System\MaZfnrS.exe

Filesize
3.0MB

MD5
d72b8be7af4638c6311999b5a80774ee

SHA1
dd6f566f89cfe163e5f59c934131c35f94f91e8a

SHA256
eb980bf488c5a92b519198904198ee2a1bf76e022fb7390e8b968fbe90c254de

SHA512
5c2e7003c7117c368afd3c94c824d3d30f84fe21e348f894d2ebb8be170bd3128db4428361a1c4b9a092f0ad1db2309de309c218af9d6a4d7dbe5ca0a577fe81

Download Submit
C:\Windows\System\NtExnVE.exe

Filesize
3.0MB

MD5
03d1d49400070a4bc6da6c6e67752ec6

SHA1
52123785b131d778a860d23eeb8c719c72f6bc05

SHA256
a21ece5f1f75cbdfea6b1b0fd4be316d3fd51a925807b1baf7edb736cbaddc85

SHA512
c18145c56bc224553c5a331c408baca10cbbc123de32fc278b3f39be5a09717f1fb4b8a847d06c9a20db078291783528ef4906ff4847f823db25f512f181783a

Download Submit
C:\Windows\System\QaYkoJM.exe

Filesize
3.0MB

MD5
940252d1e25cd2b9d557da91e3a23c8f

SHA1
8ca5e3a34ea0e995ef956321878add5446408cf6

SHA256
5072a946048cb88554309e1f686a0db1e57560458176d21247e0dc208045c6c2

SHA512
96dd3ba0a12ffec0dff096d678c6345b9a3df21051d43f3ac647116c01a05acc71480c5280108c187c5aabfd928192d80cec973cf11624cd5f08632743ea411e

Download Submit
C:\Windows\System\QdHikAm.exe

Filesize
3.0MB

MD5
c0586ebb1a7c785f09ec6acddd72a79a

SHA1
01f9f910e7932601cacae9a9fe3f74e93c1d6379

SHA256
6d87d6e51cc32cbc98e3dd917eba4024bfcc53912e29c385b5f4ca1ce2e00cb8

SHA512
1203cdead5f2e9a484fd2a097ef1d5641bd03d7677dad70e8a7df4fde8872f6df338f416a33b8a427a3125ac5ccbfab3b7d79aab8b8bef0f73f75485371de007

Download Submit
C:\Windows\System\RvINXmT.exe

Filesize
3.0MB

MD5
f840ea81c5bb3b81debec14bd29febae

SHA1
c496edec6ca8c29e0146f55432b5f1fd83d3a70c

SHA256
0a9eb7d48b3a4baa6d526cbec9bd07e1b7bd9985701c9194e1a44adc18ded054

SHA512
c274590d9bb5b138adba58f100385fe5ad295b68375281407f1e917eefdbd4bc638e486c5a404db20d302ada30cc980c1579105eb001f449519864ee443e04fa

Download Submit
C:\Windows\System\SYZQIQr.exe

Filesize
3.0MB

MD5
8303b2004fd7075bed4930d58b540b1d

SHA1
d6a09abc575e22bf8ad8d613d96664dd9e8570b3

SHA256
582280b54f418e2f5336a3a9457c75cc02081cb9e0773440395ec5fea3974d16

SHA512
5c608164b689780dc0de6fc00b1f9b2e14011f43843937fde51a4c58a8274c88ec6d95d44b2524c74b779962961ed3567d2ebbd1ddbda97dd49039119d348ff1

Download Submit
C:\Windows\System\TrgbUyM.exe

Filesize
3.0MB

MD5
3b11ca2f44ffdfdf1db6ccfa93badb67

SHA1
b45dec51fc52102e352516b79a37f8de473f96c5

SHA256
b0c66601e3bc994c3b838e19845f3ce79daef4b2c4e2e67cbece894cbacf4dfa

SHA512
c853309af3c97e08bc14f70405dc9e48a1039768ee5c9cc85464b310593dc68fa822ccf927b09dbf644faa8fbeae58e3192cfa6b5a601ce3a5ae24cdae98cd83

Download Submit
C:\Windows\System\UnHZeWt.exe

Filesize
3.0MB

MD5
039e3b4f40d586042effe552d0ae05da

SHA1
28160f53f24726f53283267e9fe7e882b703f729

SHA256
6ece62fc336a464a761ed13c6110e24823ef84493df959451660d892c083612b

SHA512
7ac39a8a4e5cf763dfd87355d00f1a821449611391d3a6970385ff81abd6bdd0be4a30a23f46346cce6db80341af1c183f076ca63d3023f24aa08bff02e95076

Download Submit
C:\Windows\System\WgvkKCc.exe

Filesize
3.0MB

MD5
38d7ba50dc08e5482d5b76a867f6b462

SHA1
c5afe6413687238cec682323d8bde435b36fcc91

SHA256
22864a6e94d40ce35b9b969054cd83332a42d370846823180405ab6c7b6ee85a

SHA512
b8116af2587225ec422f920520575c36e2018262f96fa4d510fb7e044030a92634de233b38ddfdd1114def2814a31113cb2049136e4e34327d80cbc2105d886c

Download Submit
C:\Windows\System\XcvlTBQ.exe

Filesize
3.0MB

MD5
9a4e7d1a803c25a3ae674fce15896b18

SHA1
97a2bb3ee6ef8c88fd390a8f1d3b811af523b24f

SHA256
12c8f4aa3ea643e6a8ef9a894f805d0901d983ec995681f6af47dadbd83192b4

SHA512
dc995c1a3defc9fb407c93c9beffdd09a804a0c13cc93e012c7ba603a471f75292d94e0aea63f91b83564cf896df21dd833817450c736b0d4102c822e664bb56

Download Submit
C:\Windows\System\ZnlRmhP.exe

Filesize
3.0MB

MD5
b927d40398cd175ec3b49b8009178f3a

SHA1
43eb5a39e836a0d894ecd6a994a962f6327c9ffd

SHA256
9604cfe0d36020bd8b8d5bf880fa8edf0f8656b66cc365e0aef099649f189aa4

SHA512
b6ac47999826fe356f9579752964fcc3c764cf0d07cf21cf174b6f49c738af02fb8a7e3c1957253bcaff6a6c77d032bb7d16fc6951158a8a1c1b598ef63d9f81

Download Submit
C:\Windows\System\cWWCHxK.exe

Filesize
8B

MD5
67d893d1a2095d39d451d08ee1cc05e9

SHA1
dad7ef4487e41ff3c3e600250e691ed16832dc94

SHA256
cc871666e89dd430f5e3dc9cc361cd1a4ecf7214b4b8daeb86cca2257079f3ce

SHA512
7799e4db272ac6c136cb55f2e50c1582a5027767dc6d148dbf159fdb6f776a047cf2ac573fbb2f2ca5a994173cf0465c93ef3f6e6c86e8981136e854def9801d

Download Submit
C:\Windows\System\ccYqAJe.exe

Filesize
3.0MB

MD5
c74a5f419ef09f734fa422afb14af05f

SHA1
a86f6f2446baf2be7e93d6962227fd6db8b30885

SHA256
20957af656c346c37eb48d062d20ac35687e09aa965bdc15afa63cbfff97933d

SHA512
835295ad6e82eae266d094e4adf8b4e137c60ca3de3b88244eceb15045058c07f41437e3df4360b0c64a89a78368d7dc9af9ded508eb9017b20abb1fee312149

Download Submit
C:\Windows\System\hZjZleY.exe

Filesize
3.0MB

MD5
9ed0e8759bfb860734481d411446c969

SHA1
9a78d356a2f57eaff1860b6b031d3d9fc61aa3bc

SHA256
39e8e26660eb15a8b4469e471fd5132896711a03eaf86bc4e6b626dea981ad6f

SHA512
f1ec236ed4dfe3a18f44b42e31d01adf0c1feb985c23f86dbd37f9cdc1dda609e6c797b48c9d02b9c0bc79ad95d79b281461ba2ddb4d5972b22ff2c8002506d8

Download Submit
C:\Windows\System\jTWhXrP.exe

Filesize
3.0MB

MD5
671168fd4341640d43639a8479483bd0

SHA1
da8a288bfa1f5ba6880ebb3fa80a2e9d584c47dd

SHA256
03e578b5cac4f5e4909dc7c53cc6b6cc1021dd5e5dafed11da2a9f5a16d6f745

SHA512
fc779e166a5394c6337f04143ace699180fe36a5d9cd247db349643f0e010e6ac1fbcdcbc145e6730f9594874b01903372ac8d81386c2649907239852435443e

Download Submit
C:\Windows\System\kZLrrju.exe

Filesize
3.0MB

MD5
2ac4ff04cabf509c1ec129a05a59efc6

SHA1
7fc285f62e8984a5aea9a03ef5580bc438087399

SHA256
99847be74ec17abe5fbe400009d38e1f4b85cadad83d53044e73ade13d716a41

SHA512
c7351cef173f5373fbbc62c79785bebe6c03830ec4a10bfdb2720519c23e6e8f8d5b040c16d613c4111ec18ca871c1ca9f3add81cf05e2ad557b06781699fd7c

Download Submit
C:\Windows\System\kliQahv.exe

Filesize
3.0MB

MD5
9098b4a0926c660f2502f2d6bc1ceb7d

SHA1
950167f8f839a5d9007a2cebd8d087ced41c2d42

SHA256
628a5696da425d0e48f1aa3e52f873310f340709abe4e7a968702e343e5b7db2

SHA512
5c4723e8a41871f728c02a7f081c8d70595ef9d265f644c7952c5e92d749b88d94ef91ac509a4a661c9270c6b8d12c000f1e4529d810d027ce525216e4b92e13

Download Submit
C:\Windows\System\ktFUEWj.exe

Filesize
3.0MB

MD5
839853b11a6806d5fad6bb4710146470

SHA1
706a03531f5d4befd4068e6576edd827b648f266

SHA256
e84b35e44b66df4413cf8c7c83d0b4ec2d6ca323ee6bfd425430b772c5e51c36

SHA512
d6f61d578d6f839c7c5b55df6909852b8f1e7d9c1eeb54b1b4d1050b49d5e10cff522a2539985d8d9942ed13c8fbfd0f0a3c976843fdc4a52187aff43930c93c

Download Submit
C:\Windows\System\lQOolas.exe

Filesize
3.0MB

MD5
06cab782b6245b7bcadb6ab443eea174

SHA1
0cf7af5d4951d65b53294c2f4d040e3627ba6027

SHA256
13d49c1906ae565d9c1c045e60b809953c4240593925ce2ee7c72482c890fc94

SHA512
e7d2555b02601328d6a86c7775bc418254c40d0513ef3dd309a49980355d0dae800529719836cd360001ab5037f9c4317e4e8b6099621a9ea2a348559bb1966a

Download Submit
C:\Windows\System\muDclBK.exe

Filesize
3.0MB

MD5
d054fde7d87eec9aa8f3eec3817d6f86

SHA1
9085eb55c1a11a65ca876a6ccf571e040d486e7d

SHA256
29e0a91fd7769fefe87fe6b2779ce9d2571a188415e6b96e8baee8106b02d7f3

SHA512
9486790366e3efc0539193b283946b4426494ce245e70da5ea5ab9c6aaf436c7170b8d1acb3bbbfa2271bcc483f1481b95b7425efe0e90ef7cf8cddabdbad8fb

Download Submit
C:\Windows\System\nTcvtsi.exe

Filesize
3.0MB

MD5
500cc6ac4e6dd40826eaae4f6af2b270

SHA1
1e16c123f811e960f6cba818f0eda57d2b109fa9

SHA256
98d3a97301e70600fb40ebaa743ba82d1160090b2a2538329b324fd9ee9997f7

SHA512
d6b287c851e16def33e7111981df1afdc1f0573c4deeb405353468319a1a748c9a3e3f9af385becaf7a138e79299fc5badec6eac385bac339a3caf6da22f5e5d

Download Submit
C:\Windows\System\noGghED.exe

Filesize
3.0MB

MD5
7ae9cb7072245980f3898080f953d160

SHA1
6b35acdc2d8b748176a854839cd2d5f52dfe7317

SHA256
6bddcc4cd1c489b8cf314a90e21ec303c0677a552bf007ea3b8f05ed6af44940

SHA512
5353d0e818e2a4a3810f4973dfc568a9a6770de46d1032f35b1d09ef6f4bd617c381ef38777fb70784c80e895a02567205d868322a46e0d24bd75ccf9075ebea

Download Submit
C:\Windows\System\olFGHDc.exe

Filesize
3.0MB

MD5
6162d7e86d7a42933228ef1d2de5190f

SHA1
66a4234a259e8793ef40960eac7d8baf45e69def

SHA256
3826aed11407a48f6ad13829c831e46e33d652b66ace2327681ab3371aa52444

SHA512
0cc7cca18b6d6e6bff0fa9ee4270165da96018417170b15550ecbd3e50bfb45cc159d4792e24899b5c98571339f4d12704777f252ebe834ec45f8f9e75f6f4bb

Download Submit
C:\Windows\System\wfOOfxD.exe

Filesize
3.0MB

MD5
6402c4e6611d9ecfcbbc7086a8637c3c

SHA1
c6c1ccae6cae0a6c6cea98a95ace40ec53e48090

SHA256
d409cf7f7afb5068783937ae6306d53411e11ca9593a2980e245685994777c2a

SHA512
d4ea6bace236f9e5c051d5a4c00221af7dde1d5fec6e8b5894bd8d3f8eaea36bc65f12616cae24d5f978f31295d1582d24c1a719eab5b08911288e7bf1d28085

Download Submit
C:\Windows\System\wlsjbRH.exe

Filesize
3.0MB

MD5
f4316637f17a3fb601b26bc6130af818

SHA1
dba47367f470b866ecf6ee95cf77ef9d01594783

SHA256
2344c8410c0cf87687563d514d83feebe35e05f7db342e4ed02c5a9bf0c8461b

SHA512
568801a62cfc7411ddc5c0948755be467056ad465ab77afb724d02270aaa0bd5c62c53d300fecb3a346b06feb347976d2df33dfd80721fffbbb40ef4a23edf3d

Download Submit
C:\Windows\System\zNxiXNS.exe

Filesize
3.0MB

MD5
d3e3b6b69817d2ae634d7233c5e38def

SHA1
66928ccdcff827835712e6a7590e5b82dee22126

SHA256
bbb965de17d8a61419f3f66f2757cc81b3739e704b22879ad8070a8db829ac2f

SHA512
b1fab8965d09b745a17ec42fb76c36dc19d216a6b37fb3e51de553b72fa6f030c1d7ba8031c05b1c0bc0c8912dd1158fcc4473062eddac4aa45ed2ec38ef6839

Download Submit
memory/336-2375-0x00007FF651D60000-0x00007FF652156000-memory.dmp

Filesize
4.0MB

Download
memory/336-151-0x00007FF651D60000-0x00007FF652156000-memory.dmp

Filesize
4.0MB

Download
memory/428-752-0x00007FF7156C0000-0x00007FF715AB6000-memory.dmp

Filesize
4.0MB

Download
memory/428-2379-0x00007FF7156C0000-0x00007FF715AB6000-memory.dmp

Filesize
4.0MB

Download
memory/556-729-0x00007FF7BA590000-0x00007FF7BA986000-memory.dmp

Filesize
4.0MB

Download
memory/556-2365-0x00007FF7BA590000-0x00007FF7BA986000-memory.dmp

Filesize
4.0MB

Download
memory/556-53-0x00007FF7BA590000-0x00007FF7BA986000-memory.dmp

Filesize
4.0MB

Download
memory/1576-2356-0x00007FF656700000-0x00007FF656AF6000-memory.dmp

Filesize
4.0MB

Download
memory/1576-66-0x00007FF656700000-0x00007FF656AF6000-memory.dmp

Filesize
4.0MB

Download
memory/2052-2354-0x00007FF74A060000-0x00007FF74A456000-memory.dmp

Filesize
4.0MB

Download
memory/2052-2374-0x00007FF74A060000-0x00007FF74A456000-memory.dmp

Filesize
4.0MB

Download
memory/2052-177-0x00007FF74A060000-0x00007FF74A456000-memory.dmp

Filesize
4.0MB

Download
memory/2100-26-0x00007FF7AC0B0000-0x00007FF7AC4A6000-memory.dmp

Filesize
4.0MB

Download
memory/2100-2355-0x00007FF7AC0B0000-0x00007FF7AC4A6000-memory.dmp

Filesize
4.0MB

Download
memory/2248-187-0x00007FF7FCD10000-0x00007FF7FD106000-memory.dmp

Filesize
4.0MB

Download
memory/2248-44-0x00007FF7FCD10000-0x00007FF7FD106000-memory.dmp

Filesize
4.0MB

Download
memory/2248-2360-0x00007FF7FCD10000-0x00007FF7FD106000-memory.dmp

Filesize
4.0MB

Download
memory/2332-60-0x00007FF7712A0000-0x00007FF771696000-memory.dmp

Filesize
4.0MB

Download
memory/2332-1052-0x00007FF7712A0000-0x00007FF771696000-memory.dmp

Filesize
4.0MB

Download
memory/2332-2363-0x00007FF7712A0000-0x00007FF771696000-memory.dmp

Filesize
4.0MB

Download
memory/2592-76-0x00007FF667C30000-0x00007FF668026000-memory.dmp

Filesize
4.0MB

Download
memory/2592-2364-0x00007FF667C30000-0x00007FF668026000-memory.dmp

Filesize
4.0MB

Download
memory/2816-102-0x00007FF765460000-0x00007FF765856000-memory.dmp

Filesize
4.0MB

Download
memory/2816-2368-0x00007FF765460000-0x00007FF765856000-memory.dmp

Filesize
4.0MB

Download
memory/2816-1623-0x00007FF765460000-0x00007FF765856000-memory.dmp

Filesize
4.0MB

Download
memory/3068-184-0x00007FF6F0560000-0x00007FF6F0956000-memory.dmp

Filesize
4.0MB

Download
memory/3068-2366-0x00007FF6F0560000-0x00007FF6F0956000-memory.dmp

Filesize
4.0MB

Download
memory/3068-2370-0x00007FF6F0560000-0x00007FF6F0956000-memory.dmp

Filesize
4.0MB

Download
memory/3420-178-0x00007FF75B140000-0x00007FF75B536000-memory.dmp

Filesize
4.0MB

Download
memory/3420-0-0x00007FF75B140000-0x00007FF75B536000-memory.dmp

Filesize
4.0MB

Download
memory/3420-1-0x000001D58FE70000-0x000001D58FE80000-memory.dmp

Filesize
64KB

Download
memory/3508-2361-0x00007FF7270E0000-0x00007FF7274D6000-memory.dmp

Filesize
4.0MB

Download
memory/3508-75-0x00007FF7270E0000-0x00007FF7274D6000-memory.dmp

Filesize
4.0MB

Download
memory/3680-2367-0x00007FF79FF10000-0x00007FF7A0306000-memory.dmp

Filesize
4.0MB

Download
memory/3680-115-0x00007FF79FF10000-0x00007FF7A0306000-memory.dmp

Filesize
4.0MB

Download
memory/3720-2376-0x00007FF7092D0000-0x00007FF7096C6000-memory.dmp

Filesize
4.0MB

Download
memory/3720-166-0x00007FF7092D0000-0x00007FF7096C6000-memory.dmp

Filesize
4.0MB

Download
memory/4040-155-0x00007FF7FD760000-0x00007FF7FDB56000-memory.dmp

Filesize
4.0MB

Download
memory/4040-2371-0x00007FF7FD760000-0x00007FF7FDB56000-memory.dmp

Filesize
4.0MB

Download
memory/4156-175-0x00007FF76EAE0000-0x00007FF76EED6000-memory.dmp

Filesize
4.0MB

Download
memory/4156-2353-0x00007FF76EAE0000-0x00007FF76EED6000-memory.dmp

Filesize
4.0MB

Download
memory/4156-2372-0x00007FF76EAE0000-0x00007FF76EED6000-memory.dmp

Filesize
4.0MB

Download
memory/4248-80-0x0000023A4DD40000-0x0000023A4E4E6000-memory.dmp

Filesize
7.6MB

Download
memory/4248-46-0x0000023A4B050000-0x0000023A4B072000-memory.dmp

Filesize
136KB

Download
memory/4248-183-0x00007FF8E3240000-0x00007FF8E3509000-memory.dmp

Filesize
2.8MB

Download
memory/4248-6-0x00007FF8E3240000-0x00007FF8E3509000-memory.dmp

Filesize
2.8MB

Download
memory/4344-739-0x00007FF7D0B00000-0x00007FF7D0EF6000-memory.dmp

Filesize
4.0MB

Download
memory/4344-2377-0x00007FF7D0B00000-0x00007FF7D0EF6000-memory.dmp

Filesize
4.0MB

Download
memory/4392-2359-0x00007FF6B6100000-0x00007FF6B64F6000-memory.dmp

Filesize
4.0MB

Download
memory/4392-717-0x00007FF6B6100000-0x00007FF6B64F6000-memory.dmp

Filesize
4.0MB

Download
memory/4392-16-0x00007FF6B6100000-0x00007FF6B64F6000-memory.dmp

Filesize
4.0MB

Download
memory/4408-744-0x00007FF635EE0000-0x00007FF6362D6000-memory.dmp

Filesize
4.0MB

Download
memory/4408-2378-0x00007FF635EE0000-0x00007FF6362D6000-memory.dmp

Filesize
4.0MB

Download
memory/4672-128-0x00007FF763620000-0x00007FF763A16000-memory.dmp

Filesize
4.0MB

Download
memory/4672-2369-0x00007FF763620000-0x00007FF763A16000-memory.dmp

Filesize
4.0MB

Download
memory/4804-74-0x00007FF7B6F50000-0x00007FF7B7346000-memory.dmp

Filesize
4.0MB

Download
memory/4804-2357-0x00007FF7B6F50000-0x00007FF7B7346000-memory.dmp

Filesize
4.0MB

Download
memory/4832-2373-0x00007FF7AC3E0000-0x00007FF7AC7D6000-memory.dmp

Filesize
4.0MB

Download
memory/4832-2174-0x00007FF7AC3E0000-0x00007FF7AC7D6000-memory.dmp

Filesize
4.0MB

Download
memory/4832-145-0x00007FF7AC3E0000-0x00007FF7AC7D6000-memory.dmp

Filesize
4.0MB

Download
memory/4884-49-0x00007FF64F510000-0x00007FF64F906000-memory.dmp

Filesize
4.0MB

Download
memory/4884-727-0x00007FF64F510000-0x00007FF64F906000-memory.dmp

Filesize
4.0MB

Download
memory/4884-2358-0x00007FF64F510000-0x00007FF64F906000-memory.dmp

Filesize
4.0MB

Download
memory/5096-2362-0x00007FF75F820000-0x00007FF75FC16000-memory.dmp

Filesize
4.0MB

Download
memory/5096-79-0x00007FF75F820000-0x00007FF75FC16000-memory.dmp

Filesize
4.0MB

Download
memory/5096-1620-0x00007FF75F820000-0x00007FF75FC16000-memory.dmp

Filesize
4.0MB

Download