xmrig | 72189283e085fba0724a00f7ea6e1f23a1160caf7e042354ea6649b53166e0a2

Analysis

max time kernel
72s
max time network
52s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
Size

3.0MB
MD5

6595d1125d45777f24bea62b56451bc0
SHA1

112c04b5beadac4e3440dd1d489a74ad8e30daf3
SHA256

72189283e085fba0724a00f7ea6e1f23a1160caf7e042354ea6649b53166e0a2
SHA512

9811dc8c1a4d9195eec6a52835d11be5a4877996e4a5528a1245046f786287543d451c96fcd1d056c657c028b1e6a4318593ffdbe80fef48548fb52977da1f95
SSDEEP

49152:71G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hm6lgVJUwD+8feEb6:71ONtyBeSFkXV1etEKLlWUTOfeiRA2RK

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/4000-0-0x00007FF62A160000-0x00007FF62A556000-memory.dmp	xmrig
behavioral2/files/0x00080000000233c9-6.dat	xmrig
behavioral2/files/0x00070000000233cd-21.dat	xmrig
behavioral2/files/0x00070000000233d0-26.dat	xmrig
behavioral2/files/0x00080000000233cf-32.dat	xmrig
behavioral2/files/0x00080000000233ce-37.dat	xmrig
behavioral2/files/0x00070000000233d1-41.dat	xmrig
behavioral2/files/0x00070000000233d2-46.dat	xmrig
behavioral2/files/0x00070000000233d5-59.dat	xmrig
behavioral2/memory/1784-61-0x00007FF683170000-0x00007FF683566000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d4-66.dat	xmrig
behavioral2/files/0x00070000000233d7-73.dat	xmrig
behavioral2/files/0x00070000000233d8-81.dat	xmrig
behavioral2/files/0x00070000000233da-92.dat	xmrig
behavioral2/memory/4744-96-0x00007FF7D2000000-0x00007FF7D23F6000-memory.dmp	xmrig
behavioral2/memory/1808-101-0x00007FF67C140000-0x00007FF67C536000-memory.dmp	xmrig
behavioral2/memory/4608-103-0x00007FF611140000-0x00007FF611536000-memory.dmp	xmrig
behavioral2/memory/1224-105-0x00007FF7B54E0000-0x00007FF7B58D6000-memory.dmp	xmrig
behavioral2/memory/464-104-0x00007FF702020000-0x00007FF702416000-memory.dmp	xmrig
behavioral2/memory/4648-102-0x00007FF65E170000-0x00007FF65E566000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d9-97.dat	xmrig
behavioral2/memory/1196-93-0x00007FF6AE710000-0x00007FF6AEB06000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d6-90.dat	xmrig
behavioral2/memory/4468-88-0x00007FF727BD0000-0x00007FF727FC6000-memory.dmp	xmrig
behavioral2/memory/3020-86-0x00007FF628C90000-0x00007FF629086000-memory.dmp	xmrig
behavioral2/memory/4676-80-0x00007FF765440000-0x00007FF765836000-memory.dmp	xmrig
behavioral2/memory/3432-74-0x00007FF71EEB0000-0x00007FF71F2A6000-memory.dmp	xmrig
behavioral2/files/0x00070000000233d3-72.dat	xmrig
behavioral2/memory/3428-69-0x00007FF728EF0000-0x00007FF7292E6000-memory.dmp	xmrig
behavioral2/memory/4564-65-0x00007FF78AE10000-0x00007FF78B206000-memory.dmp	xmrig
behavioral2/memory/2264-60-0x00007FF74C990000-0x00007FF74CD86000-memory.dmp	xmrig
behavioral2/files/0x00070000000233db-109.dat	xmrig
behavioral2/files/0x00080000000233ca-118.dat	xmrig
behavioral2/files/0x00070000000233dc-122.dat	xmrig
behavioral2/files/0x00070000000233dd-135.dat	xmrig
behavioral2/files/0x00070000000233df-143.dat	xmrig
behavioral2/memory/2004-154-0x00007FF7B6430000-0x00007FF7B6826000-memory.dmp	xmrig
behavioral2/memory/1092-165-0x00007FF7CD880000-0x00007FF7CDC76000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e3-173.dat	xmrig
behavioral2/memory/740-172-0x00007FF658000000-0x00007FF6583F6000-memory.dmp	xmrig
behavioral2/memory/1276-171-0x00007FF61B860000-0x00007FF61BC56000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e5-169.dat	xmrig
behavioral2/files/0x00070000000233e4-167.dat	xmrig
behavioral2/memory/1240-166-0x00007FF7F33E0000-0x00007FF7F37D6000-memory.dmp	xmrig
behavioral2/files/0x00070000000233e2-162.dat	xmrig
behavioral2/files/0x00070000000233e1-160.dat	xmrig
behavioral2/files/0x00070000000233e0-150.dat	xmrig
behavioral2/memory/2300-147-0x00007FF767CA0000-0x00007FF768096000-memory.dmp	xmrig
behavioral2/files/0x00070000000233de-140.dat	xmrig
behavioral2/memory/540-131-0x00007FF7905E0000-0x00007FF7909D6000-memory.dmp	xmrig
behavioral2/memory/3700-125-0x00007FF6CDA30000-0x00007FF6CDE26000-memory.dmp	xmrig
behavioral2/memory/4692-124-0x00007FF631910000-0x00007FF631D06000-memory.dmp	xmrig
behavioral2/files/0x00070000000233ea-197.dat	xmrig
behavioral2/files/0x00070000000233e9-193.dat	xmrig
behavioral2/files/0x00070000000233e8-188.dat	xmrig
behavioral2/files/0x00070000000233e6-181.dat	xmrig
behavioral2/files/0x00070000000233e7-182.dat	xmrig
behavioral2/memory/4000-1620-0x00007FF62A160000-0x00007FF62A556000-memory.dmp	xmrig
behavioral2/memory/4744-1921-0x00007FF7D2000000-0x00007FF7D23F6000-memory.dmp	xmrig
behavioral2/memory/540-2105-0x00007FF7905E0000-0x00007FF7909D6000-memory.dmp	xmrig
behavioral2/memory/1808-3860-0x00007FF67C140000-0x00007FF67C536000-memory.dmp	xmrig
behavioral2/memory/2264-3861-0x00007FF74C990000-0x00007FF74CD86000-memory.dmp	xmrig
behavioral2/memory/1784-3862-0x00007FF683170000-0x00007FF683566000-memory.dmp	xmrig
behavioral2/memory/4564-3863-0x00007FF78AE10000-0x00007FF78B206000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
1492	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
1808	MxPBPbd.exe
2264	uUpEVwL.exe
1784	gaIneim.exe
4564	uudwopY.exe
3428	NTdhmid.exe
3432	FSOsTTb.exe
4676	WHHWgRP.exe
4648	fnuTsXB.exe
3020	XkcATqc.exe
4468	WBgdihG.exe
4608	wSecTpY.exe
1196	bSXwTRt.exe
464	tRCgrVH.exe
4744	LIclGnM.exe
1224	OZdPvdp.exe
4692	nbRTHlJ.exe
2300	dXykhWw.exe
2004	EETxJHq.exe
3700	wLZawCb.exe
1092	jqhQzQs.exe
540	BXGckiL.exe
1240	pHzwVHm.exe
740	dcrqvDQ.exe
1276	InPfhaS.exe
1568	nFDZsHF.exe
772	SEEImHS.exe
2152	ABjdJBQ.exe
3644	uaftjqu.exe
64	ytocmmn.exe
2024	mCoZmXd.exe
1944	iFIYsdR.exe
4248	RxyqokY.exe
1452	XgrumcY.exe
4276	kAaPQFs.exe
4824	xIxRMEK.exe
4436	qcpDnuI.exe
396	vTweZTk.exe
920	VFLhgWJ.exe
2464	WIXkWcm.exe
2328	FfOEOTb.exe
5016	BmdtqLe.exe
712	bCYLLCh.exe
4420	DMiLKcs.exe
2052	xXWphjh.exe
3944	kmADaqX.exe
4888	OjNUGrf.exe
1260	KWMHXqt.exe
1500	tkmCbbI.exe
688	VgsYmwp.exe
1060	rremLqo.exe
3920	fUpuCYC.exe
1636	crVMNYL.exe
2840	MvXkqmr.exe
1984	nvaJHgJ.exe
2176	aJKWQHa.exe
3192	sphGSxC.exe
2236	RRNyQSz.exe
324	ILMQNix.exe
3460	AxwWCCT.exe
5048	fNLupyy.exe
2568	bEwgMpl.exe
876	KthCIME.exe
1420	wMePGJr.exe
5052	JlwQLFQ.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4000-0-0x00007FF62A160000-0x00007FF62A556000-memory.dmp	upx
behavioral2/files/0x00080000000233c9-6.dat	upx
behavioral2/files/0x00070000000233cd-21.dat	upx
behavioral2/files/0x00070000000233d0-26.dat	upx
behavioral2/files/0x00080000000233cf-32.dat	upx
behavioral2/files/0x00080000000233ce-37.dat	upx
behavioral2/files/0x00070000000233d1-41.dat	upx
behavioral2/files/0x00070000000233d2-46.dat	upx
behavioral2/files/0x00070000000233d5-59.dat	upx
behavioral2/memory/1784-61-0x00007FF683170000-0x00007FF683566000-memory.dmp	upx
behavioral2/files/0x00070000000233d4-66.dat	upx
behavioral2/files/0x00070000000233d7-73.dat	upx
behavioral2/files/0x00070000000233d8-81.dat	upx
behavioral2/files/0x00070000000233da-92.dat	upx
behavioral2/memory/4744-96-0x00007FF7D2000000-0x00007FF7D23F6000-memory.dmp	upx
behavioral2/memory/1808-101-0x00007FF67C140000-0x00007FF67C536000-memory.dmp	upx
behavioral2/memory/4608-103-0x00007FF611140000-0x00007FF611536000-memory.dmp	upx
behavioral2/memory/1224-105-0x00007FF7B54E0000-0x00007FF7B58D6000-memory.dmp	upx
behavioral2/memory/464-104-0x00007FF702020000-0x00007FF702416000-memory.dmp	upx
behavioral2/memory/4648-102-0x00007FF65E170000-0x00007FF65E566000-memory.dmp	upx
behavioral2/files/0x00070000000233d9-97.dat	upx
behavioral2/memory/1196-93-0x00007FF6AE710000-0x00007FF6AEB06000-memory.dmp	upx
behavioral2/files/0x00070000000233d6-90.dat	upx
behavioral2/memory/4468-88-0x00007FF727BD0000-0x00007FF727FC6000-memory.dmp	upx
behavioral2/memory/3020-86-0x00007FF628C90000-0x00007FF629086000-memory.dmp	upx
behavioral2/memory/4676-80-0x00007FF765440000-0x00007FF765836000-memory.dmp	upx
behavioral2/memory/3432-74-0x00007FF71EEB0000-0x00007FF71F2A6000-memory.dmp	upx
behavioral2/files/0x00070000000233d3-72.dat	upx
behavioral2/memory/3428-69-0x00007FF728EF0000-0x00007FF7292E6000-memory.dmp	upx
behavioral2/memory/4564-65-0x00007FF78AE10000-0x00007FF78B206000-memory.dmp	upx
behavioral2/memory/2264-60-0x00007FF74C990000-0x00007FF74CD86000-memory.dmp	upx
behavioral2/files/0x00070000000233db-109.dat	upx
behavioral2/files/0x00080000000233ca-118.dat	upx
behavioral2/files/0x00070000000233dc-122.dat	upx
behavioral2/files/0x00070000000233dd-135.dat	upx
behavioral2/files/0x00070000000233df-143.dat	upx
behavioral2/memory/2004-154-0x00007FF7B6430000-0x00007FF7B6826000-memory.dmp	upx
behavioral2/memory/1092-165-0x00007FF7CD880000-0x00007FF7CDC76000-memory.dmp	upx
behavioral2/files/0x00070000000233e3-173.dat	upx
behavioral2/memory/740-172-0x00007FF658000000-0x00007FF6583F6000-memory.dmp	upx
behavioral2/memory/1276-171-0x00007FF61B860000-0x00007FF61BC56000-memory.dmp	upx
behavioral2/files/0x00070000000233e5-169.dat	upx
behavioral2/files/0x00070000000233e4-167.dat	upx
behavioral2/memory/1240-166-0x00007FF7F33E0000-0x00007FF7F37D6000-memory.dmp	upx
behavioral2/files/0x00070000000233e2-162.dat	upx
behavioral2/files/0x00070000000233e1-160.dat	upx
behavioral2/files/0x00070000000233e0-150.dat	upx
behavioral2/memory/2300-147-0x00007FF767CA0000-0x00007FF768096000-memory.dmp	upx
behavioral2/files/0x00070000000233de-140.dat	upx
behavioral2/memory/540-131-0x00007FF7905E0000-0x00007FF7909D6000-memory.dmp	upx
behavioral2/memory/3700-125-0x00007FF6CDA30000-0x00007FF6CDE26000-memory.dmp	upx
behavioral2/memory/4692-124-0x00007FF631910000-0x00007FF631D06000-memory.dmp	upx
behavioral2/files/0x00070000000233ea-197.dat	upx
behavioral2/files/0x00070000000233e9-193.dat	upx
behavioral2/files/0x00070000000233e8-188.dat	upx
behavioral2/files/0x00070000000233e6-181.dat	upx
behavioral2/files/0x00070000000233e7-182.dat	upx
behavioral2/memory/4000-1620-0x00007FF62A160000-0x00007FF62A556000-memory.dmp	upx
behavioral2/memory/4744-1921-0x00007FF7D2000000-0x00007FF7D23F6000-memory.dmp	upx
behavioral2/memory/540-2105-0x00007FF7905E0000-0x00007FF7909D6000-memory.dmp	upx
behavioral2/memory/1808-3860-0x00007FF67C140000-0x00007FF67C536000-memory.dmp	upx
behavioral2/memory/2264-3861-0x00007FF74C990000-0x00007FF74CD86000-memory.dmp	upx
behavioral2/memory/1784-3862-0x00007FF683170000-0x00007FF683566000-memory.dmp	upx
behavioral2/memory/4564-3863-0x00007FF78AE10000-0x00007FF78B206000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SBTjsjd.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\zpaXCWM.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\FzReOLI.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\yLQNAoZ.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\vLFHZaF.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\BeZVVXG.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\JaSVRXk.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\PehoExt.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\dOrNcGb.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\rQFPsui.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\JiYUPnT.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\WOTqVla.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\OjNUGrf.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\Eksxfpa.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\SZafFbY.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\lEPQqhr.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\CFgRdXB.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\DhgXlYo.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\kaPmYfO.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\NeHeqEM.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\aRvuzJg.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\moUVMTw.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\yvHZbkB.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\VOwVcPZ.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\NFhRbSS.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\ybkBmBH.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\eujqVGV.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\dNWnHts.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\qrVmHIF.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\ZfvPWFy.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\ddiYKxH.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\agPlcmr.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\macbTER.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\wljcGWB.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\yGvZWKM.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\vqyRIYy.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\xcqwjAl.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\yKwzQqb.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\foyeUyj.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\GmSrRcj.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\mpUUkux.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\lJLFZHv.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\vNaVnXY.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\aDFYZfG.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\brkmxmH.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\GLgkklJ.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\JopUFeF.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\DWSvOzf.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\aZyzrDY.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\bYTibfE.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\eJfLdjz.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\fgEeWjM.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\jYCAcms.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\sgrtVQZ.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\lTxPdcg.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\AucrvEV.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\IVHkSSJ.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\mglsxMb.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\nufPYcf.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\sODJVEN.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\vCcqXzr.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\LCeBeNo.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\ZOcRtjt.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
File created	C:\Windows\System\jCEluxZ.exe	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1492	powershell.exe
1492	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
Token: SeDebugPrivilege	1492	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 1492	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	82
PID 4000 wrote to memory of 1492	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	82
PID 4000 wrote to memory of 1808	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	84
PID 4000 wrote to memory of 1808	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	84
PID 4000 wrote to memory of 2264	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	85
PID 4000 wrote to memory of 2264	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	85
PID 4000 wrote to memory of 1784	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	86
PID 4000 wrote to memory of 1784	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	86
PID 4000 wrote to memory of 4564	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	87
PID 4000 wrote to memory of 4564	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	87
PID 4000 wrote to memory of 3428	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	88
PID 4000 wrote to memory of 3428	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	88
PID 4000 wrote to memory of 3432	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	89
PID 4000 wrote to memory of 3432	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	89
PID 4000 wrote to memory of 4676	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	90
PID 4000 wrote to memory of 4676	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	90
PID 4000 wrote to memory of 4648	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	91
PID 4000 wrote to memory of 4648	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	91
PID 4000 wrote to memory of 3020	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	92
PID 4000 wrote to memory of 3020	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	92
PID 4000 wrote to memory of 4468	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	93
PID 4000 wrote to memory of 4468	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	93
PID 4000 wrote to memory of 4608	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	94
PID 4000 wrote to memory of 4608	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	94
PID 4000 wrote to memory of 1196	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	95
PID 4000 wrote to memory of 1196	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	95
PID 4000 wrote to memory of 464	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	96
PID 4000 wrote to memory of 464	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	96
PID 4000 wrote to memory of 4744	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	97
PID 4000 wrote to memory of 4744	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	97
PID 4000 wrote to memory of 1224	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	98
PID 4000 wrote to memory of 1224	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	98
PID 4000 wrote to memory of 4692	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	99
PID 4000 wrote to memory of 4692	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	99
PID 4000 wrote to memory of 2300	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	101
PID 4000 wrote to memory of 2300	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	101
PID 4000 wrote to memory of 2004	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	102
PID 4000 wrote to memory of 2004	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	102
PID 4000 wrote to memory of 3700	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	103
PID 4000 wrote to memory of 3700	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	103
PID 4000 wrote to memory of 1092	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	104
PID 4000 wrote to memory of 1092	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	104
PID 4000 wrote to memory of 540	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	105
PID 4000 wrote to memory of 540	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	105
PID 4000 wrote to memory of 1240	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	106
PID 4000 wrote to memory of 1240	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	106
PID 4000 wrote to memory of 740	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	107
PID 4000 wrote to memory of 740	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	107
PID 4000 wrote to memory of 1276	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	108
PID 4000 wrote to memory of 1276	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	108
PID 4000 wrote to memory of 1568	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	109
PID 4000 wrote to memory of 1568	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	109
PID 4000 wrote to memory of 772	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	110
PID 4000 wrote to memory of 772	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	110
PID 4000 wrote to memory of 2152	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	111
PID 4000 wrote to memory of 2152	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	111
PID 4000 wrote to memory of 3644	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	112
PID 4000 wrote to memory of 3644	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	112
PID 4000 wrote to memory of 64	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	114
PID 4000 wrote to memory of 64	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	114
PID 4000 wrote to memory of 2024	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	115
PID 4000 wrote to memory of 2024	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	115
PID 4000 wrote to memory of 1944	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	116
PID 4000 wrote to memory of 1944	4000	6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe	116

C:\Users\Admin\AppData\Local\Temp\6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6595d1125d45777f24bea62b56451bc0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1492
- C:\Windows\System\MxPBPbd.exe
  C:\Windows\System\MxPBPbd.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\uUpEVwL.exe
  C:\Windows\System\uUpEVwL.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\gaIneim.exe
  C:\Windows\System\gaIneim.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\uudwopY.exe
  C:\Windows\System\uudwopY.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\NTdhmid.exe
  C:\Windows\System\NTdhmid.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\FSOsTTb.exe
  C:\Windows\System\FSOsTTb.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\WHHWgRP.exe
  C:\Windows\System\WHHWgRP.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\fnuTsXB.exe
  C:\Windows\System\fnuTsXB.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\XkcATqc.exe
  C:\Windows\System\XkcATqc.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\WBgdihG.exe
  C:\Windows\System\WBgdihG.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\wSecTpY.exe
  C:\Windows\System\wSecTpY.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\bSXwTRt.exe
  C:\Windows\System\bSXwTRt.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\tRCgrVH.exe
  C:\Windows\System\tRCgrVH.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\LIclGnM.exe
  C:\Windows\System\LIclGnM.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\OZdPvdp.exe
  C:\Windows\System\OZdPvdp.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\nbRTHlJ.exe
  C:\Windows\System\nbRTHlJ.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\dXykhWw.exe
  C:\Windows\System\dXykhWw.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\EETxJHq.exe
  C:\Windows\System\EETxJHq.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\wLZawCb.exe
  C:\Windows\System\wLZawCb.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\jqhQzQs.exe
  C:\Windows\System\jqhQzQs.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\BXGckiL.exe
  C:\Windows\System\BXGckiL.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\pHzwVHm.exe
  C:\Windows\System\pHzwVHm.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\dcrqvDQ.exe
  C:\Windows\System\dcrqvDQ.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\InPfhaS.exe
  C:\Windows\System\InPfhaS.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\nFDZsHF.exe
  C:\Windows\System\nFDZsHF.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\SEEImHS.exe
  C:\Windows\System\SEEImHS.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\ABjdJBQ.exe
  C:\Windows\System\ABjdJBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\uaftjqu.exe
  C:\Windows\System\uaftjqu.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\ytocmmn.exe
  C:\Windows\System\ytocmmn.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\mCoZmXd.exe
  C:\Windows\System\mCoZmXd.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\iFIYsdR.exe
  C:\Windows\System\iFIYsdR.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\RxyqokY.exe
  C:\Windows\System\RxyqokY.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\XgrumcY.exe
  C:\Windows\System\XgrumcY.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\kAaPQFs.exe
  C:\Windows\System\kAaPQFs.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\xIxRMEK.exe
  C:\Windows\System\xIxRMEK.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\qcpDnuI.exe
  C:\Windows\System\qcpDnuI.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\vTweZTk.exe
  C:\Windows\System\vTweZTk.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\VFLhgWJ.exe
  C:\Windows\System\VFLhgWJ.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\WIXkWcm.exe
  C:\Windows\System\WIXkWcm.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\FfOEOTb.exe
  C:\Windows\System\FfOEOTb.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\BmdtqLe.exe
  C:\Windows\System\BmdtqLe.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\bCYLLCh.exe
  C:\Windows\System\bCYLLCh.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\DMiLKcs.exe
  C:\Windows\System\DMiLKcs.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\xXWphjh.exe
  C:\Windows\System\xXWphjh.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\kmADaqX.exe
  C:\Windows\System\kmADaqX.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\OjNUGrf.exe
  C:\Windows\System\OjNUGrf.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\KWMHXqt.exe
  C:\Windows\System\KWMHXqt.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\tkmCbbI.exe
  C:\Windows\System\tkmCbbI.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\VgsYmwp.exe
  C:\Windows\System\VgsYmwp.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\rremLqo.exe
  C:\Windows\System\rremLqo.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\fUpuCYC.exe
  C:\Windows\System\fUpuCYC.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\crVMNYL.exe
  C:\Windows\System\crVMNYL.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\MvXkqmr.exe
  C:\Windows\System\MvXkqmr.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\nvaJHgJ.exe
  C:\Windows\System\nvaJHgJ.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\aJKWQHa.exe
  C:\Windows\System\aJKWQHa.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\sphGSxC.exe
  C:\Windows\System\sphGSxC.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\RRNyQSz.exe
  C:\Windows\System\RRNyQSz.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ILMQNix.exe
  C:\Windows\System\ILMQNix.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\AxwWCCT.exe
  C:\Windows\System\AxwWCCT.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\fNLupyy.exe
  C:\Windows\System\fNLupyy.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\bEwgMpl.exe
  C:\Windows\System\bEwgMpl.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\KthCIME.exe
  C:\Windows\System\KthCIME.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\wMePGJr.exe
  C:\Windows\System\wMePGJr.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\JlwQLFQ.exe
  C:\Windows\System\JlwQLFQ.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\RkZbeZw.exe
  C:\Windows\System\RkZbeZw.exe
  2⤵
  PID:1592
- C:\Windows\System\KNxDuiM.exe
  C:\Windows\System\KNxDuiM.exe
  2⤵
  PID:4216
- C:\Windows\System\XqnTljy.exe
  C:\Windows\System\XqnTljy.exe
  2⤵
  PID:3756
- C:\Windows\System\FPtiLIF.exe
  C:\Windows\System\FPtiLIF.exe
  2⤵
  PID:692
- C:\Windows\System\UbACCcm.exe
  C:\Windows\System\UbACCcm.exe
  2⤵
  PID:2528
- C:\Windows\System\MdiFluj.exe
  C:\Windows\System\MdiFluj.exe
  2⤵
  PID:2128
- C:\Windows\System\HYwopQi.exe
  C:\Windows\System\HYwopQi.exe
  2⤵
  PID:2572
- C:\Windows\System\iadYOfz.exe
  C:\Windows\System\iadYOfz.exe
  2⤵
  PID:3808
- C:\Windows\System\sMuHOuR.exe
  C:\Windows\System\sMuHOuR.exe
  2⤵
  PID:2228
- C:\Windows\System\bgGapNg.exe
  C:\Windows\System\bgGapNg.exe
  2⤵
  PID:4764
- C:\Windows\System\eWPpgui.exe
  C:\Windows\System\eWPpgui.exe
  2⤵
  PID:3584
- C:\Windows\System\YCKxjQI.exe
  C:\Windows\System\YCKxjQI.exe
  2⤵
  PID:3624
- C:\Windows\System\LUbuAUo.exe
  C:\Windows\System\LUbuAUo.exe
  2⤵
  PID:3564
- C:\Windows\System\VfGfcCJ.exe
  C:\Windows\System\VfGfcCJ.exe
  2⤵
  PID:2332
- C:\Windows\System\QiEgifF.exe
  C:\Windows\System\QiEgifF.exe
  2⤵
  PID:1912
- C:\Windows\System\NHIboXX.exe
  C:\Windows\System\NHIboXX.exe
  2⤵
  PID:4012
- C:\Windows\System\mTceued.exe
  C:\Windows\System\mTceued.exe
  2⤵
  PID:4320
- C:\Windows\System\yMZwPQA.exe
  C:\Windows\System\yMZwPQA.exe
  2⤵
  PID:2720
- C:\Windows\System\CssRZIv.exe
  C:\Windows\System\CssRZIv.exe
  2⤵
  PID:4664
- C:\Windows\System\frmZqcF.exe
  C:\Windows\System\frmZqcF.exe
  2⤵
  PID:1124
- C:\Windows\System\uEWxcUr.exe
  C:\Windows\System\uEWxcUr.exe
  2⤵
  PID:3228
- C:\Windows\System\lqGrFEc.exe
  C:\Windows\System\lqGrFEc.exe
  2⤵
  PID:1740
- C:\Windows\System\WgNKbVb.exe
  C:\Windows\System\WgNKbVb.exe
  2⤵
  PID:3172
- C:\Windows\System\hUAlLRB.exe
  C:\Windows\System\hUAlLRB.exe
  2⤵
  PID:4660
- C:\Windows\System\pzJKHZy.exe
  C:\Windows\System\pzJKHZy.exe
  2⤵
  PID:1996
- C:\Windows\System\OKyETir.exe
  C:\Windows\System\OKyETir.exe
  2⤵
  PID:3636
- C:\Windows\System\moUFLxo.exe
  C:\Windows\System\moUFLxo.exe
  2⤵
  PID:1852
- C:\Windows\System\YVnQBzI.exe
  C:\Windows\System\YVnQBzI.exe
  2⤵
  PID:5156
- C:\Windows\System\fCTjkEB.exe
  C:\Windows\System\fCTjkEB.exe
  2⤵
  PID:5184
- C:\Windows\System\wnUBXpS.exe
  C:\Windows\System\wnUBXpS.exe
  2⤵
  PID:5220
- C:\Windows\System\AvrSSaX.exe
  C:\Windows\System\AvrSSaX.exe
  2⤵
  PID:5248
- C:\Windows\System\kaPmYfO.exe
  C:\Windows\System\kaPmYfO.exe
  2⤵
  PID:5280
- C:\Windows\System\WnGIjgJ.exe
  C:\Windows\System\WnGIjgJ.exe
  2⤵
  PID:5300
- C:\Windows\System\yDgWoaM.exe
  C:\Windows\System\yDgWoaM.exe
  2⤵
  PID:5332
- C:\Windows\System\xSjSKQW.exe
  C:\Windows\System\xSjSKQW.exe
  2⤵
  PID:5360
- C:\Windows\System\qnbhlMr.exe
  C:\Windows\System\qnbhlMr.exe
  2⤵
  PID:5388
- C:\Windows\System\eLwdSVS.exe
  C:\Windows\System\eLwdSVS.exe
  2⤵
  PID:5416
- C:\Windows\System\SBsqIfD.exe
  C:\Windows\System\SBsqIfD.exe
  2⤵
  PID:5444
- C:\Windows\System\mYMkLLm.exe
  C:\Windows\System\mYMkLLm.exe
  2⤵
  PID:5468
- C:\Windows\System\iAkVviR.exe
  C:\Windows\System\iAkVviR.exe
  2⤵
  PID:5500
- C:\Windows\System\NIaVFbY.exe
  C:\Windows\System\NIaVFbY.exe
  2⤵
  PID:5528
- C:\Windows\System\shvPvvd.exe
  C:\Windows\System\shvPvvd.exe
  2⤵
  PID:5556
- C:\Windows\System\FoFacRT.exe
  C:\Windows\System\FoFacRT.exe
  2⤵
  PID:5576
- C:\Windows\System\JOocMRE.exe
  C:\Windows\System\JOocMRE.exe
  2⤵
  PID:5592
- C:\Windows\System\oenMusk.exe
  C:\Windows\System\oenMusk.exe
  2⤵
  PID:5616
- C:\Windows\System\nZnPEvR.exe
  C:\Windows\System\nZnPEvR.exe
  2⤵
  PID:5660
- C:\Windows\System\NsJvJDE.exe
  C:\Windows\System\NsJvJDE.exe
  2⤵
  PID:5700
- C:\Windows\System\foNIBlP.exe
  C:\Windows\System\foNIBlP.exe
  2⤵
  PID:5728
- C:\Windows\System\TMTadmA.exe
  C:\Windows\System\TMTadmA.exe
  2⤵
  PID:5760
- C:\Windows\System\XHTlEGF.exe
  C:\Windows\System\XHTlEGF.exe
  2⤵
  PID:5788
- C:\Windows\System\kafmCQx.exe
  C:\Windows\System\kafmCQx.exe
  2⤵
  PID:5816
- C:\Windows\System\KpAwiiz.exe
  C:\Windows\System\KpAwiiz.exe
  2⤵
  PID:5844
- C:\Windows\System\VoYwXJN.exe
  C:\Windows\System\VoYwXJN.exe
  2⤵
  PID:5872
- C:\Windows\System\rcbrePK.exe
  C:\Windows\System\rcbrePK.exe
  2⤵
  PID:5892
- C:\Windows\System\mLbrgFh.exe
  C:\Windows\System\mLbrgFh.exe
  2⤵
  PID:5920
- C:\Windows\System\kMBckSt.exe
  C:\Windows\System\kMBckSt.exe
  2⤵
  PID:5936
- C:\Windows\System\yeeIuNA.exe
  C:\Windows\System\yeeIuNA.exe
  2⤵
  PID:5964
- C:\Windows\System\AsHWnXP.exe
  C:\Windows\System\AsHWnXP.exe
  2⤵
  PID:6008
- C:\Windows\System\dcKUdPR.exe
  C:\Windows\System\dcKUdPR.exe
  2⤵
  PID:6036
- C:\Windows\System\EimWgXF.exe
  C:\Windows\System\EimWgXF.exe
  2⤵
  PID:6064
- C:\Windows\System\KGlXlir.exe
  C:\Windows\System\KGlXlir.exe
  2⤵
  PID:6092
- C:\Windows\System\gJsOduJ.exe
  C:\Windows\System\gJsOduJ.exe
  2⤵
  PID:6128
- C:\Windows\System\yjnESrM.exe
  C:\Windows\System\yjnESrM.exe
  2⤵
  PID:5140
- C:\Windows\System\gKGmdZk.exe
  C:\Windows\System\gKGmdZk.exe
  2⤵
  PID:5228
- C:\Windows\System\NINEZzL.exe
  C:\Windows\System\NINEZzL.exe
  2⤵
  PID:5268
- C:\Windows\System\TWyhqWQ.exe
  C:\Windows\System\TWyhqWQ.exe
  2⤵
  PID:5340
- C:\Windows\System\ROkseSO.exe
  C:\Windows\System\ROkseSO.exe
  2⤵
  PID:5400
- C:\Windows\System\umvADgz.exe
  C:\Windows\System\umvADgz.exe
  2⤵
  PID:5452
- C:\Windows\System\orIQZah.exe
  C:\Windows\System\orIQZah.exe
  2⤵
  PID:5536
- C:\Windows\System\ahVmwIU.exe
  C:\Windows\System\ahVmwIU.exe
  2⤵
  PID:5588
- C:\Windows\System\aPtVifG.exe
  C:\Windows\System\aPtVifG.exe
  2⤵
  PID:5648
- C:\Windows\System\qoplipN.exe
  C:\Windows\System\qoplipN.exe
  2⤵
  PID:5720
- C:\Windows\System\LCeBeNo.exe
  C:\Windows\System\LCeBeNo.exe
  2⤵
  PID:5796
- C:\Windows\System\cjysaja.exe
  C:\Windows\System\cjysaja.exe
  2⤵
  PID:5856
- C:\Windows\System\dVezLNX.exe
  C:\Windows\System\dVezLNX.exe
  2⤵
  PID:5912
- C:\Windows\System\kMMVSSs.exe
  C:\Windows\System\kMMVSSs.exe
  2⤵
  PID:5984
- C:\Windows\System\uKsXXKo.exe
  C:\Windows\System\uKsXXKo.exe
  2⤵
  PID:6028
- C:\Windows\System\VgYDORA.exe
  C:\Windows\System\VgYDORA.exe
  2⤵
  PID:6088
- C:\Windows\System\ooqQqOW.exe
  C:\Windows\System\ooqQqOW.exe
  2⤵
  PID:820
- C:\Windows\System\TbhLnuF.exe
  C:\Windows\System\TbhLnuF.exe
  2⤵
  PID:5292
- C:\Windows\System\FkMfnRH.exe
  C:\Windows\System\FkMfnRH.exe
  2⤵
  PID:4332
- C:\Windows\System\EOAECSU.exe
  C:\Windows\System\EOAECSU.exe
  2⤵
  PID:5548
- C:\Windows\System\MQpOZwx.exe
  C:\Windows\System\MQpOZwx.exe
  2⤵
  PID:5708
- C:\Windows\System\ltHxOXH.exe
  C:\Windows\System\ltHxOXH.exe
  2⤵
  PID:5804
- C:\Windows\System\GqcjOJn.exe
  C:\Windows\System\GqcjOJn.exe
  2⤵
  PID:5960
- C:\Windows\System\uotUdgL.exe
  C:\Windows\System\uotUdgL.exe
  2⤵
  PID:6076
- C:\Windows\System\hdqxDrG.exe
  C:\Windows\System\hdqxDrG.exe
  2⤵
  PID:5316
- C:\Windows\System\jIbjcFY.exe
  C:\Windows\System\jIbjcFY.exe
  2⤵
  PID:5208
- C:\Windows\System\UHCluoz.exe
  C:\Windows\System\UHCluoz.exe
  2⤵
  PID:5836
- C:\Windows\System\mjFAdrr.exe
  C:\Windows\System\mjFAdrr.exe
  2⤵
  PID:4656
- C:\Windows\System\fmKRQLD.exe
  C:\Windows\System\fmKRQLD.exe
  2⤵
  PID:5740
- C:\Windows\System\EFRJEFb.exe
  C:\Windows\System\EFRJEFb.exe
  2⤵
  PID:6020
- C:\Windows\System\IGnWTAj.exe
  C:\Windows\System\IGnWTAj.exe
  2⤵
  PID:6168
- C:\Windows\System\dCyPIfU.exe
  C:\Windows\System\dCyPIfU.exe
  2⤵
  PID:6196
- C:\Windows\System\nfFHQaO.exe
  C:\Windows\System\nfFHQaO.exe
  2⤵
  PID:6224
- C:\Windows\System\nmxubEU.exe
  C:\Windows\System\nmxubEU.exe
  2⤵
  PID:6252
- C:\Windows\System\uwcTobb.exe
  C:\Windows\System\uwcTobb.exe
  2⤵
  PID:6280
- C:\Windows\System\UisVKgT.exe
  C:\Windows\System\UisVKgT.exe
  2⤵
  PID:6308
- C:\Windows\System\NoCDmCd.exe
  C:\Windows\System\NoCDmCd.exe
  2⤵
  PID:6336
- C:\Windows\System\AGzeaJc.exe
  C:\Windows\System\AGzeaJc.exe
  2⤵
  PID:6364
- C:\Windows\System\qPtieYM.exe
  C:\Windows\System\qPtieYM.exe
  2⤵
  PID:6392
- C:\Windows\System\BeZVVXG.exe
  C:\Windows\System\BeZVVXG.exe
  2⤵
  PID:6420
- C:\Windows\System\jhMOlOb.exe
  C:\Windows\System\jhMOlOb.exe
  2⤵
  PID:6448
- C:\Windows\System\wsiDirn.exe
  C:\Windows\System\wsiDirn.exe
  2⤵
  PID:6476
- C:\Windows\System\jwaMdaD.exe
  C:\Windows\System\jwaMdaD.exe
  2⤵
  PID:6504
- C:\Windows\System\tPvPxap.exe
  C:\Windows\System\tPvPxap.exe
  2⤵
  PID:6532
- C:\Windows\System\sjIzAIO.exe
  C:\Windows\System\sjIzAIO.exe
  2⤵
  PID:6560
- C:\Windows\System\ceKZssh.exe
  C:\Windows\System\ceKZssh.exe
  2⤵
  PID:6588
- C:\Windows\System\pmnTEJQ.exe
  C:\Windows\System\pmnTEJQ.exe
  2⤵
  PID:6608
- C:\Windows\System\PEVdyZw.exe
  C:\Windows\System\PEVdyZw.exe
  2⤵
  PID:6644
- C:\Windows\System\bOAHnHr.exe
  C:\Windows\System\bOAHnHr.exe
  2⤵
  PID:6672
- C:\Windows\System\xoeXepS.exe
  C:\Windows\System\xoeXepS.exe
  2⤵
  PID:6700
- C:\Windows\System\sOhOwPR.exe
  C:\Windows\System\sOhOwPR.exe
  2⤵
  PID:6728
- C:\Windows\System\wYNeyft.exe
  C:\Windows\System\wYNeyft.exe
  2⤵
  PID:6756
- C:\Windows\System\sACfRmz.exe
  C:\Windows\System\sACfRmz.exe
  2⤵
  PID:6784
- C:\Windows\System\xwyoEPr.exe
  C:\Windows\System\xwyoEPr.exe
  2⤵
  PID:6808
- C:\Windows\System\RlWwKKq.exe
  C:\Windows\System\RlWwKKq.exe
  2⤵
  PID:6840
- C:\Windows\System\dSwnUxD.exe
  C:\Windows\System\dSwnUxD.exe
  2⤵
  PID:6868
- C:\Windows\System\IzIDcPp.exe
  C:\Windows\System\IzIDcPp.exe
  2⤵
  PID:6896
- C:\Windows\System\jaCjDtf.exe
  C:\Windows\System\jaCjDtf.exe
  2⤵
  PID:6920
- C:\Windows\System\gsjxdPv.exe
  C:\Windows\System\gsjxdPv.exe
  2⤵
  PID:6952
- C:\Windows\System\ciTBiNh.exe
  C:\Windows\System\ciTBiNh.exe
  2⤵
  PID:6980
- C:\Windows\System\LqQaHeF.exe
  C:\Windows\System\LqQaHeF.exe
  2⤵
  PID:7008
- C:\Windows\System\sdgVugc.exe
  C:\Windows\System\sdgVugc.exe
  2⤵
  PID:7036
- C:\Windows\System\xkUmDBo.exe
  C:\Windows\System\xkUmDBo.exe
  2⤵
  PID:7064
- C:\Windows\System\cXSCzof.exe
  C:\Windows\System\cXSCzof.exe
  2⤵
  PID:7092
- C:\Windows\System\rDaIWWW.exe
  C:\Windows\System\rDaIWWW.exe
  2⤵
  PID:7120
- C:\Windows\System\rPkNpDe.exe
  C:\Windows\System\rPkNpDe.exe
  2⤵
  PID:7148
- C:\Windows\System\yRtPUkA.exe
  C:\Windows\System\yRtPUkA.exe
  2⤵
  PID:6176
- C:\Windows\System\nbsRbgP.exe
  C:\Windows\System\nbsRbgP.exe
  2⤵
  PID:6216
- C:\Windows\System\bmFutvN.exe
  C:\Windows\System\bmFutvN.exe
  2⤵
  PID:6288
- C:\Windows\System\VTZUaPq.exe
  C:\Windows\System\VTZUaPq.exe
  2⤵
  PID:6348
- C:\Windows\System\sPmbljA.exe
  C:\Windows\System\sPmbljA.exe
  2⤵
  PID:6432
- C:\Windows\System\GfcJSel.exe
  C:\Windows\System\GfcJSel.exe
  2⤵
  PID:6496
- C:\Windows\System\eDFpztX.exe
  C:\Windows\System\eDFpztX.exe
  2⤵
  PID:6568
- C:\Windows\System\GeXbMEK.exe
  C:\Windows\System\GeXbMEK.exe
  2⤵
  PID:6628
- C:\Windows\System\IhJtSQU.exe
  C:\Windows\System\IhJtSQU.exe
  2⤵
  PID:6720
- C:\Windows\System\FBXPFfs.exe
  C:\Windows\System\FBXPFfs.exe
  2⤵
  PID:6796
- C:\Windows\System\fESWLhc.exe
  C:\Windows\System\fESWLhc.exe
  2⤵
  PID:6832
- C:\Windows\System\yUtneJy.exe
  C:\Windows\System\yUtneJy.exe
  2⤵
  PID:6908
- C:\Windows\System\tUnWsJY.exe
  C:\Windows\System\tUnWsJY.exe
  2⤵
  PID:6988
- C:\Windows\System\AWNeEYr.exe
  C:\Windows\System\AWNeEYr.exe
  2⤵
  PID:7048
- C:\Windows\System\GcrLnww.exe
  C:\Windows\System\GcrLnww.exe
  2⤵
  PID:7108
- C:\Windows\System\leKvZDd.exe
  C:\Windows\System\leKvZDd.exe
  2⤵
  PID:7164
- C:\Windows\System\qLAbQYu.exe
  C:\Windows\System\qLAbQYu.exe
  2⤵
  PID:6272
- C:\Windows\System\ShhJYGg.exe
  C:\Windows\System\ShhJYGg.exe
  2⤵
  PID:6456
- C:\Windows\System\KPDCrhW.exe
  C:\Windows\System\KPDCrhW.exe
  2⤵
  PID:6604
- C:\Windows\System\mtbEZmq.exe
  C:\Windows\System\mtbEZmq.exe
  2⤵
  PID:3012
- C:\Windows\System\HauCKDi.exe
  C:\Windows\System\HauCKDi.exe
  2⤵
  PID:6692
- C:\Windows\System\lDHUaoH.exe
  C:\Windows\System\lDHUaoH.exe
  2⤵
  PID:1256
- C:\Windows\System\Lrmenwr.exe
  C:\Windows\System\Lrmenwr.exe
  2⤵
  PID:6996
- C:\Windows\System\NMOminG.exe
  C:\Windows\System\NMOminG.exe
  2⤵
  PID:7076
- C:\Windows\System\mtubExS.exe
  C:\Windows\System\mtubExS.exe
  2⤵
  PID:6344
- C:\Windows\System\SYFVequ.exe
  C:\Windows\System\SYFVequ.exe
  2⤵
  PID:4296
- C:\Windows\System\VoxhuTd.exe
  C:\Windows\System\VoxhuTd.exe
  2⤵
  PID:6876
- C:\Windows\System\LjLpvec.exe
  C:\Windows\System\LjLpvec.exe
  2⤵
  PID:6204
- C:\Windows\System\pSoVJdr.exe
  C:\Windows\System\pSoVJdr.exe
  2⤵
  PID:640
- C:\Windows\System\ArojppD.exe
  C:\Windows\System\ArojppD.exe
  2⤵
  PID:6880
- C:\Windows\System\VoWeeWP.exe
  C:\Windows\System\VoWeeWP.exe
  2⤵
  PID:7180
- C:\Windows\System\KjIHEmk.exe
  C:\Windows\System\KjIHEmk.exe
  2⤵
  PID:7208
- C:\Windows\System\dChmlmj.exe
  C:\Windows\System\dChmlmj.exe
  2⤵
  PID:7236
- C:\Windows\System\DkFVPlu.exe
  C:\Windows\System\DkFVPlu.exe
  2⤵
  PID:7260
- C:\Windows\System\aVGtcdM.exe
  C:\Windows\System\aVGtcdM.exe
  2⤵
  PID:7292
- C:\Windows\System\ckmdsRF.exe
  C:\Windows\System\ckmdsRF.exe
  2⤵
  PID:7320
- C:\Windows\System\VHvTsiU.exe
  C:\Windows\System\VHvTsiU.exe
  2⤵
  PID:7348
- C:\Windows\System\isZEpSO.exe
  C:\Windows\System\isZEpSO.exe
  2⤵
  PID:7376
- C:\Windows\System\rIXXKQF.exe
  C:\Windows\System\rIXXKQF.exe
  2⤵
  PID:7404
- C:\Windows\System\GYudDlz.exe
  C:\Windows\System\GYudDlz.exe
  2⤵
  PID:7432
- C:\Windows\System\cKNmJNj.exe
  C:\Windows\System\cKNmJNj.exe
  2⤵
  PID:7460
- C:\Windows\System\aNZUuaX.exe
  C:\Windows\System\aNZUuaX.exe
  2⤵
  PID:7488
- C:\Windows\System\SVgAmVc.exe
  C:\Windows\System\SVgAmVc.exe
  2⤵
  PID:7516
- C:\Windows\System\hhGNIBb.exe
  C:\Windows\System\hhGNIBb.exe
  2⤵
  PID:7544
- C:\Windows\System\WWMtsCv.exe
  C:\Windows\System\WWMtsCv.exe
  2⤵
  PID:7564
- C:\Windows\System\UlJJwkg.exe
  C:\Windows\System\UlJJwkg.exe
  2⤵
  PID:7600
- C:\Windows\System\yLLlZXY.exe
  C:\Windows\System\yLLlZXY.exe
  2⤵
  PID:7628
- C:\Windows\System\nHhpcXk.exe
  C:\Windows\System\nHhpcXk.exe
  2⤵
  PID:7656
- C:\Windows\System\aKrycIG.exe
  C:\Windows\System\aKrycIG.exe
  2⤵
  PID:7684
- C:\Windows\System\UokCDpt.exe
  C:\Windows\System\UokCDpt.exe
  2⤵
  PID:7712
- C:\Windows\System\kdzMWWw.exe
  C:\Windows\System\kdzMWWw.exe
  2⤵
  PID:7740
- C:\Windows\System\LkoSGrF.exe
  C:\Windows\System\LkoSGrF.exe
  2⤵
  PID:7768
- C:\Windows\System\iRNFDRC.exe
  C:\Windows\System\iRNFDRC.exe
  2⤵
  PID:7796
- C:\Windows\System\KKranua.exe
  C:\Windows\System\KKranua.exe
  2⤵
  PID:7824
- C:\Windows\System\NRoKlMC.exe
  C:\Windows\System\NRoKlMC.exe
  2⤵
  PID:7852
- C:\Windows\System\jEcGJig.exe
  C:\Windows\System\jEcGJig.exe
  2⤵
  PID:7880
- C:\Windows\System\VcnwskC.exe
  C:\Windows\System\VcnwskC.exe
  2⤵
  PID:7912
- C:\Windows\System\dvvYQsN.exe
  C:\Windows\System\dvvYQsN.exe
  2⤵
  PID:7936
- C:\Windows\System\kfAFyul.exe
  C:\Windows\System\kfAFyul.exe
  2⤵
  PID:7968
- C:\Windows\System\JGefFhC.exe
  C:\Windows\System\JGefFhC.exe
  2⤵
  PID:7988
- C:\Windows\System\wSXKYBI.exe
  C:\Windows\System\wSXKYBI.exe
  2⤵
  PID:8024
- C:\Windows\System\OePUIlz.exe
  C:\Windows\System\OePUIlz.exe
  2⤵
  PID:8052
- C:\Windows\System\ipVnKnJ.exe
  C:\Windows\System\ipVnKnJ.exe
  2⤵
  PID:8080
- C:\Windows\System\urTYnek.exe
  C:\Windows\System\urTYnek.exe
  2⤵
  PID:8108
- C:\Windows\System\mAwdQJW.exe
  C:\Windows\System\mAwdQJW.exe
  2⤵
  PID:8136
- C:\Windows\System\jDHxujZ.exe
  C:\Windows\System\jDHxujZ.exe
  2⤵
  PID:8160
- C:\Windows\System\lNcdXJK.exe
  C:\Windows\System\lNcdXJK.exe
  2⤵
  PID:7172
- C:\Windows\System\SJeGmtG.exe
  C:\Windows\System\SJeGmtG.exe
  2⤵
  PID:7244
- C:\Windows\System\DaQSIxG.exe
  C:\Windows\System\DaQSIxG.exe
  2⤵
  PID:7304
- C:\Windows\System\seZShIo.exe
  C:\Windows\System\seZShIo.exe
  2⤵
  PID:7360
- C:\Windows\System\tlnHxju.exe
  C:\Windows\System\tlnHxju.exe
  2⤵
  PID:7440
- C:\Windows\System\GMdFwma.exe
  C:\Windows\System\GMdFwma.exe
  2⤵
  PID:7496
- C:\Windows\System\jpEEGHN.exe
  C:\Windows\System\jpEEGHN.exe
  2⤵
  PID:7556
- C:\Windows\System\GXxfvIs.exe
  C:\Windows\System\GXxfvIs.exe
  2⤵
  PID:7616
- C:\Windows\System\OXTNCmr.exe
  C:\Windows\System\OXTNCmr.exe
  2⤵
  PID:7692
- C:\Windows\System\KRlNOOg.exe
  C:\Windows\System\KRlNOOg.exe
  2⤵
  PID:7756
- C:\Windows\System\kJjpgBn.exe
  C:\Windows\System\kJjpgBn.exe
  2⤵
  PID:7812
- C:\Windows\System\gOpUryo.exe
  C:\Windows\System\gOpUryo.exe
  2⤵
  PID:7888
- C:\Windows\System\eBsUTqv.exe
  C:\Windows\System\eBsUTqv.exe
  2⤵
  PID:7952
- C:\Windows\System\LtdJBWp.exe
  C:\Windows\System\LtdJBWp.exe
  2⤵
  PID:8008
- C:\Windows\System\WUmmezK.exe
  C:\Windows\System\WUmmezK.exe
  2⤵
  PID:8068
- C:\Windows\System\tneaswr.exe
  C:\Windows\System\tneaswr.exe
  2⤵
  PID:8148
- C:\Windows\System\hWOYTbz.exe
  C:\Windows\System\hWOYTbz.exe
  2⤵
  PID:7216
- C:\Windows\System\MGFdNoH.exe
  C:\Windows\System\MGFdNoH.exe
  2⤵
  PID:7388
- C:\Windows\System\numRZCX.exe
  C:\Windows\System\numRZCX.exe
  2⤵
  PID:7524
- C:\Windows\System\XoYiTjs.exe
  C:\Windows\System\XoYiTjs.exe
  2⤵
  PID:7664
- C:\Windows\System\KQKuoZM.exe
  C:\Windows\System\KQKuoZM.exe
  2⤵
  PID:7840
- C:\Windows\System\DsbKLjy.exe
  C:\Windows\System\DsbKLjy.exe
  2⤵
  PID:7980
- C:\Windows\System\isprrPa.exe
  C:\Windows\System\isprrPa.exe
  2⤵
  PID:8116
- C:\Windows\System\flyOxbg.exe
  C:\Windows\System\flyOxbg.exe
  2⤵
  PID:7276
- C:\Windows\System\CFVHGsC.exe
  C:\Windows\System\CFVHGsC.exe
  2⤵
  PID:7588
- C:\Windows\System\ovEoiyF.exe
  C:\Windows\System\ovEoiyF.exe
  2⤵
  PID:8032
- C:\Windows\System\qVampYW.exe
  C:\Windows\System\qVampYW.exe
  2⤵
  PID:7448
- C:\Windows\System\plorrGb.exe
  C:\Windows\System\plorrGb.exe
  2⤵
  PID:8180
- C:\Windows\System\xfecgyU.exe
  C:\Windows\System\xfecgyU.exe
  2⤵
  PID:8200
- C:\Windows\System\BuMAkSH.exe
  C:\Windows\System\BuMAkSH.exe
  2⤵
  PID:8232
- C:\Windows\System\WCejHVH.exe
  C:\Windows\System\WCejHVH.exe
  2⤵
  PID:8260
- C:\Windows\System\JaSVRXk.exe
  C:\Windows\System\JaSVRXk.exe
  2⤵
  PID:8288
- C:\Windows\System\WqvAxWF.exe
  C:\Windows\System\WqvAxWF.exe
  2⤵
  PID:8316
- C:\Windows\System\KPJHZCn.exe
  C:\Windows\System\KPJHZCn.exe
  2⤵
  PID:8344
- C:\Windows\System\hGGgjJk.exe
  C:\Windows\System\hGGgjJk.exe
  2⤵
  PID:8372
- C:\Windows\System\VgMZeKv.exe
  C:\Windows\System\VgMZeKv.exe
  2⤵
  PID:8400
- C:\Windows\System\dpRrkGf.exe
  C:\Windows\System\dpRrkGf.exe
  2⤵
  PID:8428
- C:\Windows\System\QPrcONT.exe
  C:\Windows\System\QPrcONT.exe
  2⤵
  PID:8456
- C:\Windows\System\yaHOZbY.exe
  C:\Windows\System\yaHOZbY.exe
  2⤵
  PID:8488
- C:\Windows\System\jrjCMsx.exe
  C:\Windows\System\jrjCMsx.exe
  2⤵
  PID:8516
- C:\Windows\System\RMypSwB.exe
  C:\Windows\System\RMypSwB.exe
  2⤵
  PID:8544
- C:\Windows\System\ZJeTQji.exe
  C:\Windows\System\ZJeTQji.exe
  2⤵
  PID:8572
- C:\Windows\System\DuThLWS.exe
  C:\Windows\System\DuThLWS.exe
  2⤵
  PID:8600
- C:\Windows\System\IYcwrqm.exe
  C:\Windows\System\IYcwrqm.exe
  2⤵
  PID:8628
- C:\Windows\System\bFluELG.exe
  C:\Windows\System\bFluELG.exe
  2⤵
  PID:8656
- C:\Windows\System\uKcNtfG.exe
  C:\Windows\System\uKcNtfG.exe
  2⤵
  PID:8672
- C:\Windows\System\GHfHbFh.exe
  C:\Windows\System\GHfHbFh.exe
  2⤵
  PID:8712
- C:\Windows\System\JkcgOWf.exe
  C:\Windows\System\JkcgOWf.exe
  2⤵
  PID:8740
- C:\Windows\System\ZWgWBsw.exe
  C:\Windows\System\ZWgWBsw.exe
  2⤵
  PID:8768
- C:\Windows\System\izserYQ.exe
  C:\Windows\System\izserYQ.exe
  2⤵
  PID:8796
- C:\Windows\System\zFZvLWy.exe
  C:\Windows\System\zFZvLWy.exe
  2⤵
  PID:8824
- C:\Windows\System\REmLtzR.exe
  C:\Windows\System\REmLtzR.exe
  2⤵
  PID:8852
- C:\Windows\System\HcTLVhp.exe
  C:\Windows\System\HcTLVhp.exe
  2⤵
  PID:8880
- C:\Windows\System\DJPmAZg.exe
  C:\Windows\System\DJPmAZg.exe
  2⤵
  PID:8908
- C:\Windows\System\IqmSDlr.exe
  C:\Windows\System\IqmSDlr.exe
  2⤵
  PID:8936
- C:\Windows\System\ZzhcgiV.exe
  C:\Windows\System\ZzhcgiV.exe
  2⤵
  PID:8964
- C:\Windows\System\GMlJgIk.exe
  C:\Windows\System\GMlJgIk.exe
  2⤵
  PID:8992
- C:\Windows\System\xseXweA.exe
  C:\Windows\System\xseXweA.exe
  2⤵
  PID:9028
- C:\Windows\System\HnETjnD.exe
  C:\Windows\System\HnETjnD.exe
  2⤵
  PID:9056
- C:\Windows\System\iLLQOOT.exe
  C:\Windows\System\iLLQOOT.exe
  2⤵
  PID:9084
- C:\Windows\System\zNWJLdd.exe
  C:\Windows\System\zNWJLdd.exe
  2⤵
  PID:9112
- C:\Windows\System\NawbHXx.exe
  C:\Windows\System\NawbHXx.exe
  2⤵
  PID:9140
- C:\Windows\System\EhalXBJ.exe
  C:\Windows\System\EhalXBJ.exe
  2⤵
  PID:9168
- C:\Windows\System\gbPZMAS.exe
  C:\Windows\System\gbPZMAS.exe
  2⤵
  PID:9196
- C:\Windows\System\EMwMCxT.exe
  C:\Windows\System\EMwMCxT.exe
  2⤵
  PID:8212
- C:\Windows\System\tVyQqzH.exe
  C:\Windows\System\tVyQqzH.exe
  2⤵
  PID:8280
- C:\Windows\System\vFYiZtU.exe
  C:\Windows\System\vFYiZtU.exe
  2⤵
  PID:8336
- C:\Windows\System\sPtPUNE.exe
  C:\Windows\System\sPtPUNE.exe
  2⤵
  PID:8416
- C:\Windows\System\ScRgulx.exe
  C:\Windows\System\ScRgulx.exe
  2⤵
  PID:8480
- C:\Windows\System\mhIoScF.exe
  C:\Windows\System\mhIoScF.exe
  2⤵
  PID:8540
- C:\Windows\System\MkyZaBe.exe
  C:\Windows\System\MkyZaBe.exe
  2⤵
  PID:8616
- C:\Windows\System\PgkzyvT.exe
  C:\Windows\System\PgkzyvT.exe
  2⤵
  PID:8652
- C:\Windows\System\NFhRbSS.exe
  C:\Windows\System\NFhRbSS.exe
  2⤵
  PID:8736
- C:\Windows\System\BYgEGAr.exe
  C:\Windows\System\BYgEGAr.exe
  2⤵
  PID:8808
- C:\Windows\System\nzQFFYw.exe
  C:\Windows\System\nzQFFYw.exe
  2⤵
  PID:8872
- C:\Windows\System\rTsgRku.exe
  C:\Windows\System\rTsgRku.exe
  2⤵
  PID:8932
- C:\Windows\System\VwrtHHA.exe
  C:\Windows\System\VwrtHHA.exe
  2⤵
  PID:9004
- C:\Windows\System\iUtneOD.exe
  C:\Windows\System\iUtneOD.exe
  2⤵
  PID:9052
- C:\Windows\System\fuMLXlY.exe
  C:\Windows\System\fuMLXlY.exe
  2⤵
  PID:9128
- C:\Windows\System\QkRkOXd.exe
  C:\Windows\System\QkRkOXd.exe
  2⤵
  PID:9188
- C:\Windows\System\jNyOpoX.exe
  C:\Windows\System\jNyOpoX.exe
  2⤵
  PID:8256
- C:\Windows\System\pKXdVaw.exe
  C:\Windows\System\pKXdVaw.exe
  2⤵
  PID:8440
- C:\Windows\System\wqbZpHc.exe
  C:\Windows\System\wqbZpHc.exe
  2⤵
  PID:8592
- C:\Windows\System\TakzHSi.exe
  C:\Windows\System\TakzHSi.exe
  2⤵
  PID:8732
- C:\Windows\System\cqIFNib.exe
  C:\Windows\System\cqIFNib.exe
  2⤵
  PID:8904
- C:\Windows\System\pDNuxsS.exe
  C:\Windows\System\pDNuxsS.exe
  2⤵
  PID:9040
- C:\Windows\System\QAMnjMQ.exe
  C:\Windows\System\QAMnjMQ.exe
  2⤵
  PID:9180
- C:\Windows\System\TJxgqNJ.exe
  C:\Windows\System\TJxgqNJ.exe
  2⤵
  PID:8508
- C:\Windows\System\oWvBFva.exe
  C:\Windows\System\oWvBFva.exe
  2⤵
  PID:8792
- C:\Windows\System\ewoCVbA.exe
  C:\Windows\System\ewoCVbA.exe
  2⤵
  PID:9152
- C:\Windows\System\vghePBB.exe
  C:\Windows\System\vghePBB.exe
  2⤵
  PID:8724
- C:\Windows\System\xZIxEDw.exe
  C:\Windows\System\xZIxEDw.exe
  2⤵
  PID:8392
- C:\Windows\System\XrhheZr.exe
  C:\Windows\System\XrhheZr.exe
  2⤵
  PID:9236
- C:\Windows\System\piNWBQS.exe
  C:\Windows\System\piNWBQS.exe
  2⤵
  PID:9264
- C:\Windows\System\JEJzkvp.exe
  C:\Windows\System\JEJzkvp.exe
  2⤵
  PID:9292
- C:\Windows\System\gslOSeQ.exe
  C:\Windows\System\gslOSeQ.exe
  2⤵
  PID:9320
- C:\Windows\System\frGjUpF.exe
  C:\Windows\System\frGjUpF.exe
  2⤵
  PID:9348
- C:\Windows\System\ijiojyn.exe
  C:\Windows\System\ijiojyn.exe
  2⤵
  PID:9380
- C:\Windows\System\BVaWZtm.exe
  C:\Windows\System\BVaWZtm.exe
  2⤵
  PID:9408
- C:\Windows\System\GqmojBm.exe
  C:\Windows\System\GqmojBm.exe
  2⤵
  PID:9436
- C:\Windows\System\RjjxFzs.exe
  C:\Windows\System\RjjxFzs.exe
  2⤵
  PID:9464
- C:\Windows\System\mGdHsLF.exe
  C:\Windows\System\mGdHsLF.exe
  2⤵
  PID:9492
- C:\Windows\System\KfcJBJP.exe
  C:\Windows\System\KfcJBJP.exe
  2⤵
  PID:9520
- C:\Windows\System\VEHoJLS.exe
  C:\Windows\System\VEHoJLS.exe
  2⤵
  PID:9548
- C:\Windows\System\gOlHwwZ.exe
  C:\Windows\System\gOlHwwZ.exe
  2⤵
  PID:9576
- C:\Windows\System\qmtUkUO.exe
  C:\Windows\System\qmtUkUO.exe
  2⤵
  PID:9604
- C:\Windows\System\MpmBvbv.exe
  C:\Windows\System\MpmBvbv.exe
  2⤵
  PID:9632
- C:\Windows\System\mcHKmgc.exe
  C:\Windows\System\mcHKmgc.exe
  2⤵
  PID:9660
- C:\Windows\System\HFmFOKB.exe
  C:\Windows\System\HFmFOKB.exe
  2⤵
  PID:9688
- C:\Windows\System\AQwxgsG.exe
  C:\Windows\System\AQwxgsG.exe
  2⤵
  PID:9716
- C:\Windows\System\FrqgOdN.exe
  C:\Windows\System\FrqgOdN.exe
  2⤵
  PID:9744
- C:\Windows\System\BwBmUkR.exe
  C:\Windows\System\BwBmUkR.exe
  2⤵
  PID:9772
- C:\Windows\System\NPHoOrT.exe
  C:\Windows\System\NPHoOrT.exe
  2⤵
  PID:9800
- C:\Windows\System\cHTllcY.exe
  C:\Windows\System\cHTllcY.exe
  2⤵
  PID:9828
- C:\Windows\System\QVLZYwg.exe
  C:\Windows\System\QVLZYwg.exe
  2⤵
  PID:9856
- C:\Windows\System\NbsIUUC.exe
  C:\Windows\System\NbsIUUC.exe
  2⤵
  PID:9884
- C:\Windows\System\MRFvKls.exe
  C:\Windows\System\MRFvKls.exe
  2⤵
  PID:9912
- C:\Windows\System\bSjSOVs.exe
  C:\Windows\System\bSjSOVs.exe
  2⤵
  PID:9940
- C:\Windows\System\hSUCWaB.exe
  C:\Windows\System\hSUCWaB.exe
  2⤵
  PID:9968
- C:\Windows\System\tbYYrNr.exe
  C:\Windows\System\tbYYrNr.exe
  2⤵
  PID:9996
- C:\Windows\System\AxPlTwq.exe
  C:\Windows\System\AxPlTwq.exe
  2⤵
  PID:10024
- C:\Windows\System\XUKRjSz.exe
  C:\Windows\System\XUKRjSz.exe
  2⤵
  PID:10052
- C:\Windows\System\WUakkWp.exe
  C:\Windows\System\WUakkWp.exe
  2⤵
  PID:10080
- C:\Windows\System\wqvgrHJ.exe
  C:\Windows\System\wqvgrHJ.exe
  2⤵
  PID:10108
- C:\Windows\System\eqnJTCG.exe
  C:\Windows\System\eqnJTCG.exe
  2⤵
  PID:10136
- C:\Windows\System\dReARdB.exe
  C:\Windows\System\dReARdB.exe
  2⤵
  PID:10164
- C:\Windows\System\wMDQqep.exe
  C:\Windows\System\wMDQqep.exe
  2⤵
  PID:10192
- C:\Windows\System\hGYrIeO.exe
  C:\Windows\System\hGYrIeO.exe
  2⤵
  PID:10220
- C:\Windows\System\DXdzACj.exe
  C:\Windows\System\DXdzACj.exe
  2⤵
  PID:9232
- C:\Windows\System\KipXexN.exe
  C:\Windows\System\KipXexN.exe
  2⤵
  PID:9308
- C:\Windows\System\jYYKEeE.exe
  C:\Windows\System\jYYKEeE.exe
  2⤵
  PID:9372
- C:\Windows\System\TGhmjGh.exe
  C:\Windows\System\TGhmjGh.exe
  2⤵
  PID:9432
- C:\Windows\System\FCuQoSa.exe
  C:\Windows\System\FCuQoSa.exe
  2⤵
  PID:9504
- C:\Windows\System\CelUHdT.exe
  C:\Windows\System\CelUHdT.exe
  2⤵
  PID:9568
- C:\Windows\System\UruFubS.exe
  C:\Windows\System\UruFubS.exe
  2⤵
  PID:9624
- C:\Windows\System\JJBbkrW.exe
  C:\Windows\System\JJBbkrW.exe
  2⤵
  PID:9684
- C:\Windows\System\sWVxrbD.exe
  C:\Windows\System\sWVxrbD.exe
  2⤵
  PID:9760
- C:\Windows\System\ZMvPmhg.exe
  C:\Windows\System\ZMvPmhg.exe
  2⤵
  PID:9820
- C:\Windows\System\mnqNdLF.exe
  C:\Windows\System\mnqNdLF.exe
  2⤵
  PID:9880
- C:\Windows\System\krKTMtl.exe
  C:\Windows\System\krKTMtl.exe
  2⤵
  PID:9956
- C:\Windows\System\WROTgsN.exe
  C:\Windows\System\WROTgsN.exe
  2⤵
  PID:10016
- C:\Windows\System\gOSNOst.exe
  C:\Windows\System\gOSNOst.exe
  2⤵
  PID:10076
- C:\Windows\System\nyFqRfm.exe
  C:\Windows\System\nyFqRfm.exe
  2⤵
  PID:10152
- C:\Windows\System\aSsuqIu.exe
  C:\Windows\System\aSsuqIu.exe
  2⤵
  PID:10212
- C:\Windows\System\ynbFlFt.exe
  C:\Windows\System\ynbFlFt.exe
  2⤵
  PID:9288
- C:\Windows\System\crYjdwC.exe
  C:\Windows\System\crYjdwC.exe
  2⤵
  PID:9476
- C:\Windows\System\ReJeIyV.exe
  C:\Windows\System\ReJeIyV.exe
  2⤵
  PID:9620
- C:\Windows\System\QnsmUhC.exe
  C:\Windows\System\QnsmUhC.exe
  2⤵
  PID:9740
- C:\Windows\System\LZOSNCD.exe
  C:\Windows\System\LZOSNCD.exe
  2⤵
  PID:9924
- C:\Windows\System\bubniXZ.exe
  C:\Windows\System\bubniXZ.exe
  2⤵
  PID:10064
- C:\Windows\System\ozVUSFu.exe
  C:\Windows\System\ozVUSFu.exe
  2⤵
  PID:10188
- C:\Windows\System\UlwPapp.exe
  C:\Windows\System\UlwPapp.exe
  2⤵
  PID:9428
- C:\Windows\System\mrOvCja.exe
  C:\Windows\System\mrOvCja.exe
  2⤵
  PID:9852
- C:\Windows\System\nHrOsTY.exe
  C:\Windows\System\nHrOsTY.exe
  2⤵
  PID:10128
- C:\Windows\System\EHZAvTb.exe
  C:\Windows\System\EHZAvTb.exe
  2⤵
  PID:9712
- C:\Windows\System\eObZqLC.exe
  C:\Windows\System\eObZqLC.exe
  2⤵
  PID:9600
- C:\Windows\System\jJIUBkH.exe
  C:\Windows\System\jJIUBkH.exe
  2⤵
  PID:10248
- C:\Windows\System\IBvNQHD.exe
  C:\Windows\System\IBvNQHD.exe
  2⤵
  PID:10276
- C:\Windows\System\ybkBmBH.exe
  C:\Windows\System\ybkBmBH.exe
  2⤵
  PID:10308
- C:\Windows\System\LNNkdjA.exe
  C:\Windows\System\LNNkdjA.exe
  2⤵
  PID:10336
- C:\Windows\System\brpzwBB.exe
  C:\Windows\System\brpzwBB.exe
  2⤵
  PID:10368
- C:\Windows\System\dBXfBtY.exe
  C:\Windows\System\dBXfBtY.exe
  2⤵
  PID:10396
- C:\Windows\System\ZPrZqoc.exe
  C:\Windows\System\ZPrZqoc.exe
  2⤵
  PID:10420
- C:\Windows\System\umzaMbm.exe
  C:\Windows\System\umzaMbm.exe
  2⤵
  PID:10452
- C:\Windows\System\zPbWLMt.exe
  C:\Windows\System\zPbWLMt.exe
  2⤵
  PID:10480
- C:\Windows\System\QZMnPib.exe
  C:\Windows\System\QZMnPib.exe
  2⤵
  PID:10508
- C:\Windows\System\FydeBfO.exe
  C:\Windows\System\FydeBfO.exe
  2⤵
  PID:10548
- C:\Windows\System\SBQnAFq.exe
  C:\Windows\System\SBQnAFq.exe
  2⤵
  PID:10580
- C:\Windows\System\jXxGkOM.exe
  C:\Windows\System\jXxGkOM.exe
  2⤵
  PID:10596
- C:\Windows\System\BJrAQdr.exe
  C:\Windows\System\BJrAQdr.exe
  2⤵
  PID:10612
- C:\Windows\System\RHTZqlI.exe
  C:\Windows\System\RHTZqlI.exe
  2⤵
  PID:10664
- C:\Windows\System\xmRmMVk.exe
  C:\Windows\System\xmRmMVk.exe
  2⤵
  PID:10692
- C:\Windows\System\ZKqfdZN.exe
  C:\Windows\System\ZKqfdZN.exe
  2⤵
  PID:10720
- C:\Windows\System\iCSaBWl.exe
  C:\Windows\System\iCSaBWl.exe
  2⤵
  PID:10748
- C:\Windows\System\tjtnqFm.exe
  C:\Windows\System\tjtnqFm.exe
  2⤵
  PID:10776
- C:\Windows\System\KnfNvPp.exe
  C:\Windows\System\KnfNvPp.exe
  2⤵
  PID:10804
- C:\Windows\System\CDjnpUK.exe
  C:\Windows\System\CDjnpUK.exe
  2⤵
  PID:10832
- C:\Windows\System\UpifjrF.exe
  C:\Windows\System\UpifjrF.exe
  2⤵
  PID:10860
- C:\Windows\System\xgZMkfu.exe
  C:\Windows\System\xgZMkfu.exe
  2⤵
  PID:10888
- C:\Windows\System\MEVzfhM.exe
  C:\Windows\System\MEVzfhM.exe
  2⤵
  PID:10916
- C:\Windows\System\yTDqrlN.exe
  C:\Windows\System\yTDqrlN.exe
  2⤵
  PID:10944
- C:\Windows\System\QXBYKiq.exe
  C:\Windows\System\QXBYKiq.exe
  2⤵
  PID:10972
- C:\Windows\System\cTRtGvk.exe
  C:\Windows\System\cTRtGvk.exe
  2⤵
  PID:11000
- C:\Windows\System\OXklXtd.exe
  C:\Windows\System\OXklXtd.exe
  2⤵
  PID:11028
- C:\Windows\System\aCWWlpL.exe
  C:\Windows\System\aCWWlpL.exe
  2⤵
  PID:11056
- C:\Windows\System\vugrvxz.exe
  C:\Windows\System\vugrvxz.exe
  2⤵
  PID:11084
- C:\Windows\System\htdubXe.exe
  C:\Windows\System\htdubXe.exe
  2⤵
  PID:11112
- C:\Windows\System\dqpGhTc.exe
  C:\Windows\System\dqpGhTc.exe
  2⤵
  PID:11148
- C:\Windows\System\DVHnkvl.exe
  C:\Windows\System\DVHnkvl.exe
  2⤵
  PID:11176
- C:\Windows\System\UEohuNM.exe
  C:\Windows\System\UEohuNM.exe
  2⤵
  PID:11204
- C:\Windows\System\ycMOCJz.exe
  C:\Windows\System\ycMOCJz.exe
  2⤵
  PID:11232
- C:\Windows\System\qRLZdiS.exe
  C:\Windows\System\qRLZdiS.exe
  2⤵
  PID:11260
- C:\Windows\System\dNznkGW.exe
  C:\Windows\System\dNznkGW.exe
  2⤵
  PID:10292
- C:\Windows\System\KpwOqec.exe
  C:\Windows\System\KpwOqec.exe
  2⤵
  PID:10356
- C:\Windows\System\TymPBFP.exe
  C:\Windows\System\TymPBFP.exe
  2⤵
  PID:10436
- C:\Windows\System\XuQTmGX.exe
  C:\Windows\System\XuQTmGX.exe
  2⤵
  PID:10500
- C:\Windows\System\nIqKubk.exe
  C:\Windows\System\nIqKubk.exe
  2⤵
  PID:10540
- C:\Windows\System\ivLIlTF.exe
  C:\Windows\System\ivLIlTF.exe
  2⤵
  PID:10592
- C:\Windows\System\WZGknsW.exe
  C:\Windows\System\WZGknsW.exe
  2⤵
  PID:544
- C:\Windows\System\KaWcQtX.exe
  C:\Windows\System\KaWcQtX.exe
  2⤵
  PID:4604
- C:\Windows\System\TMdiUtg.exe
  C:\Windows\System\TMdiUtg.exe
  2⤵
  PID:10632
- C:\Windows\System\PyUsida.exe
  C:\Windows\System\PyUsida.exe
  2⤵
  PID:10704
- C:\Windows\System\ecVmChq.exe
  C:\Windows\System\ecVmChq.exe
  2⤵
  PID:10768
- C:\Windows\System\TTLhjCV.exe
  C:\Windows\System\TTLhjCV.exe
  2⤵
  PID:10824
- C:\Windows\System\gHEgAtE.exe
  C:\Windows\System\gHEgAtE.exe
  2⤵
  PID:10880
- C:\Windows\System\XQQMkbS.exe
  C:\Windows\System\XQQMkbS.exe
  2⤵
  PID:10940
- C:\Windows\System\MvxBGpy.exe
  C:\Windows\System\MvxBGpy.exe
  2⤵
  PID:11016
- C:\Windows\System\NvVNByi.exe
  C:\Windows\System\NvVNByi.exe
  2⤵
  PID:11076
- C:\Windows\System\dJWEvdv.exe
  C:\Windows\System\dJWEvdv.exe
  2⤵
  PID:11144
- C:\Windows\System\BZcVFVu.exe
  C:\Windows\System\BZcVFVu.exe
  2⤵
  PID:11220
- C:\Windows\System\epkfMXU.exe
  C:\Windows\System\epkfMXU.exe
  2⤵
  PID:10272
- C:\Windows\System\UMSMdEu.exe
  C:\Windows\System\UMSMdEu.exe
  2⤵
  PID:2256
- C:\Windows\System\hnfCWqw.exe
  C:\Windows\System\hnfCWqw.exe
  2⤵
  PID:10532
- C:\Windows\System\xBLUhDr.exe
  C:\Windows\System\xBLUhDr.exe
  2⤵
  PID:1080
- C:\Windows\System\SPihVFx.exe
  C:\Windows\System\SPihVFx.exe
  2⤵
  PID:10628
- C:\Windows\System\QxpHniM.exe
  C:\Windows\System\QxpHniM.exe
  2⤵
  PID:10800
- C:\Windows\System\gjdnhVo.exe
  C:\Windows\System\gjdnhVo.exe
  2⤵
  PID:10928
- C:\Windows\System\qfZtDSp.exe
  C:\Windows\System\qfZtDSp.exe
  2⤵
  PID:11072
- C:\Windows\System\BBnqtfQ.exe
  C:\Windows\System\BBnqtfQ.exe
  2⤵
  PID:11244
- C:\Windows\System\xuhlYnq.exe
  C:\Windows\System\xuhlYnq.exe
  2⤵
  PID:10476
- C:\Windows\System\SxFyAqg.exe
  C:\Windows\System\SxFyAqg.exe
  2⤵
  PID:4632
- C:\Windows\System\UAOYGsY.exe
  C:\Windows\System\UAOYGsY.exe
  2⤵
  PID:10992
- C:\Windows\System\dQqKXCf.exe
  C:\Windows\System\dQqKXCf.exe
  2⤵
  PID:2916
- C:\Windows\System\eiGKuSj.exe
  C:\Windows\System\eiGKuSj.exe
  2⤵
  PID:10908
- C:\Windows\System\MTGkzHk.exe
  C:\Windows\System\MTGkzHk.exe
  2⤵
  PID:10388
- C:\Windows\System\NJPBXEq.exe
  C:\Windows\System\NJPBXEq.exe
  2⤵
  PID:11284
- C:\Windows\System\NlplUXV.exe
  C:\Windows\System\NlplUXV.exe
  2⤵
  PID:11312
- C:\Windows\System\XrnbxiS.exe
  C:\Windows\System\XrnbxiS.exe
  2⤵
  PID:11340
- C:\Windows\System\npfZBJT.exe
  C:\Windows\System\npfZBJT.exe
  2⤵
  PID:11368
- C:\Windows\System\joFYBnM.exe
  C:\Windows\System\joFYBnM.exe
  2⤵
  PID:11396
- C:\Windows\System\OyUOKcP.exe
  C:\Windows\System\OyUOKcP.exe
  2⤵
  PID:11424
- C:\Windows\System\IdObxHt.exe
  C:\Windows\System\IdObxHt.exe
  2⤵
  PID:11452
- C:\Windows\System\OgGRilz.exe
  C:\Windows\System\OgGRilz.exe
  2⤵
  PID:11480
- C:\Windows\System\fiYqFdF.exe
  C:\Windows\System\fiYqFdF.exe
  2⤵
  PID:11508
- C:\Windows\System\XdtDuuL.exe
  C:\Windows\System\XdtDuuL.exe
  2⤵
  PID:11536
- C:\Windows\System\nyapTac.exe
  C:\Windows\System\nyapTac.exe
  2⤵
  PID:11564
- C:\Windows\System\wmqUfra.exe
  C:\Windows\System\wmqUfra.exe
  2⤵
  PID:11592
- C:\Windows\System\FolUcvQ.exe
  C:\Windows\System\FolUcvQ.exe
  2⤵
  PID:11620
- C:\Windows\System\kBOEKoA.exe
  C:\Windows\System\kBOEKoA.exe
  2⤵
  PID:11648
- C:\Windows\System\Ldegktl.exe
  C:\Windows\System\Ldegktl.exe
  2⤵
  PID:11676
- C:\Windows\System\zHIjbCb.exe
  C:\Windows\System\zHIjbCb.exe
  2⤵
  PID:11704
- C:\Windows\System\GgUwlin.exe
  C:\Windows\System\GgUwlin.exe
  2⤵
  PID:11732
- C:\Windows\System\CfFEOUT.exe
  C:\Windows\System\CfFEOUT.exe
  2⤵
  PID:11760
- C:\Windows\System\RPFwmdr.exe
  C:\Windows\System\RPFwmdr.exe
  2⤵
  PID:11788
- C:\Windows\System\rbProAm.exe
  C:\Windows\System\rbProAm.exe
  2⤵
  PID:11832
- C:\Windows\System\ofrRYGY.exe
  C:\Windows\System\ofrRYGY.exe
  2⤵
  PID:11848
- C:\Windows\System\JKJzBrY.exe
  C:\Windows\System\JKJzBrY.exe
  2⤵
  PID:11880
- C:\Windows\System\bCSLZbO.exe
  C:\Windows\System\bCSLZbO.exe
  2⤵
  PID:11896
- C:\Windows\System\oefQNXP.exe
  C:\Windows\System\oefQNXP.exe
  2⤵
  PID:11920
- C:\Windows\System\ZBenexd.exe
  C:\Windows\System\ZBenexd.exe
  2⤵
  PID:11948
- C:\Windows\System\RFJgZOP.exe
  C:\Windows\System\RFJgZOP.exe
  2⤵
  PID:11968
- C:\Windows\System\TcPGrbY.exe
  C:\Windows\System\TcPGrbY.exe
  2⤵
  PID:12020
- C:\Windows\System\rFiBtTY.exe
  C:\Windows\System\rFiBtTY.exe
  2⤵
  PID:12048
- C:\Windows\System\MTwfATP.exe
  C:\Windows\System\MTwfATP.exe
  2⤵
  PID:12076
- C:\Windows\System\aRXuGpF.exe
  C:\Windows\System\aRXuGpF.exe
  2⤵
  PID:12104
- C:\Windows\System\rwHztok.exe
  C:\Windows\System\rwHztok.exe
  2⤵
  PID:12132
- C:\Windows\System\syeQiiJ.exe
  C:\Windows\System\syeQiiJ.exe
  2⤵
  PID:12160
- C:\Windows\System\vSZnSjx.exe
  C:\Windows\System\vSZnSjx.exe
  2⤵
  PID:12188
- C:\Windows\System\PoNZVSu.exe
  C:\Windows\System\PoNZVSu.exe
  2⤵
  PID:12216
- C:\Windows\System\GsljdSX.exe
  C:\Windows\System\GsljdSX.exe
  2⤵
  PID:12244
- C:\Windows\System\OFpvonX.exe
  C:\Windows\System\OFpvonX.exe
  2⤵
  PID:12272
- C:\Windows\System\jHqVmvh.exe
  C:\Windows\System\jHqVmvh.exe
  2⤵
  PID:3656
- C:\Windows\System\VYdJzRP.exe
  C:\Windows\System\VYdJzRP.exe
  2⤵
  PID:11328
- C:\Windows\System\kuQOOAM.exe
  C:\Windows\System\kuQOOAM.exe
  2⤵
  PID:11388
- C:\Windows\System\uVzQPZg.exe
  C:\Windows\System\uVzQPZg.exe
  2⤵
  PID:11448
- C:\Windows\System\kuFUbdB.exe
  C:\Windows\System\kuFUbdB.exe
  2⤵
  PID:11520
- C:\Windows\System\ZUVDiEp.exe
  C:\Windows\System\ZUVDiEp.exe
  2⤵
  PID:11584
- C:\Windows\System\kqoJSXy.exe
  C:\Windows\System\kqoJSXy.exe
  2⤵
  PID:11640
- C:\Windows\System\pXQwZhY.exe
  C:\Windows\System\pXQwZhY.exe
  2⤵
  PID:11700
- C:\Windows\System\VNbwoIq.exe
  C:\Windows\System\VNbwoIq.exe
  2⤵
  PID:11776
- C:\Windows\System\IuEtwGu.exe
  C:\Windows\System\IuEtwGu.exe
  2⤵
  PID:11840
- C:\Windows\System\svnhtSu.exe
  C:\Windows\System\svnhtSu.exe
  2⤵
  PID:11908
- C:\Windows\System\kjhsQmU.exe
  C:\Windows\System\kjhsQmU.exe
  2⤵
  PID:11992
- C:\Windows\System\EtQEZCz.exe
  C:\Windows\System\EtQEZCz.exe
  2⤵
  PID:12040
- C:\Windows\System\Eksxfpa.exe
  C:\Windows\System\Eksxfpa.exe
  2⤵
  PID:12100
- C:\Windows\System\SIYJHZY.exe
  C:\Windows\System\SIYJHZY.exe
  2⤵
  PID:12172
- C:\Windows\System\dNLtnFy.exe
  C:\Windows\System\dNLtnFy.exe
  2⤵
  PID:12236
- C:\Windows\System\ILxjThQ.exe
  C:\Windows\System\ILxjThQ.exe
  2⤵
  PID:3660
- C:\Windows\System\iQeERtS.exe
  C:\Windows\System\iQeERtS.exe
  2⤵
  PID:11420
- C:\Windows\System\RUDripz.exe
  C:\Windows\System\RUDripz.exe
  2⤵
  PID:11560
- C:\Windows\System\KfyOmoq.exe
  C:\Windows\System\KfyOmoq.exe
  2⤵
  PID:11696
- C:\Windows\System\TZHyPlf.exe
  C:\Windows\System\TZHyPlf.exe
  2⤵
  PID:11888
- C:\Windows\System\PTepxgA.exe
  C:\Windows\System\PTepxgA.exe
  2⤵
  PID:12016
- C:\Windows\System\TGvWCzm.exe
  C:\Windows\System\TGvWCzm.exe
  2⤵
  PID:12156
- C:\Windows\System\GySvawe.exe
  C:\Windows\System\GySvawe.exe
  2⤵
  PID:11356
- C:\Windows\System\AWvcZuQ.exe
  C:\Windows\System\AWvcZuQ.exe
  2⤵
  PID:4684
- C:\Windows\System\GXvaJck.exe
  C:\Windows\System\GXvaJck.exe
  2⤵
  PID:11812
- C:\Windows\System\ZOcRtjt.exe
  C:\Windows\System\ZOcRtjt.exe
  2⤵
  PID:12152
- C:\Windows\System\BLEdEva.exe
  C:\Windows\System\BLEdEva.exe
  2⤵
  PID:11672
- C:\Windows\System\EDOxOPt.exe
  C:\Windows\System\EDOxOPt.exe
  2⤵
  PID:3260
- C:\Windows\System\NnBVgtl.exe
  C:\Windows\System\NnBVgtl.exe
  2⤵
  PID:12296
- C:\Windows\System\bmyvuYc.exe
  C:\Windows\System\bmyvuYc.exe
  2⤵
  PID:12324
- C:\Windows\System\eAuXfhn.exe
  C:\Windows\System\eAuXfhn.exe
  2⤵
  PID:12356
- C:\Windows\System\dOGNcKM.exe
  C:\Windows\System\dOGNcKM.exe
  2⤵
  PID:12384
- C:\Windows\System\dszZyJl.exe
  C:\Windows\System\dszZyJl.exe
  2⤵
  PID:12412
- C:\Windows\System\WNxnocw.exe
  C:\Windows\System\WNxnocw.exe
  2⤵
  PID:12440
- C:\Windows\System\RdEVjqw.exe
  C:\Windows\System\RdEVjqw.exe
  2⤵
  PID:12468
- C:\Windows\System\vpgXttk.exe
  C:\Windows\System\vpgXttk.exe
  2⤵
  PID:12496
- C:\Windows\System\ojvERgS.exe
  C:\Windows\System\ojvERgS.exe
  2⤵
  PID:12524
- C:\Windows\System\oziaKCa.exe
  C:\Windows\System\oziaKCa.exe
  2⤵
  PID:12552
- C:\Windows\System\OaITqBp.exe
  C:\Windows\System\OaITqBp.exe
  2⤵
  PID:12580
- C:\Windows\System\kFEexVt.exe
  C:\Windows\System\kFEexVt.exe
  2⤵
  PID:12608
- C:\Windows\System\lVXwNvA.exe
  C:\Windows\System\lVXwNvA.exe
  2⤵
  PID:12636
- C:\Windows\System\wcvcgDg.exe
  C:\Windows\System\wcvcgDg.exe
  2⤵
  PID:12664
- C:\Windows\System\UySAiqM.exe
  C:\Windows\System\UySAiqM.exe
  2⤵
  PID:12692
- C:\Windows\System\HZcHgNq.exe
  C:\Windows\System\HZcHgNq.exe
  2⤵
  PID:12720
- C:\Windows\System\PaGAurm.exe
  C:\Windows\System\PaGAurm.exe
  2⤵
  PID:12748
- C:\Windows\System\kLEUmVT.exe
  C:\Windows\System\kLEUmVT.exe
  2⤵
  PID:12776
- C:\Windows\System\SBLLdUN.exe
  C:\Windows\System\SBLLdUN.exe
  2⤵
  PID:12804
- C:\Windows\System\BfzkQvJ.exe
  C:\Windows\System\BfzkQvJ.exe
  2⤵
  PID:12832
- C:\Windows\System\FqUPBvx.exe
  C:\Windows\System\FqUPBvx.exe
  2⤵
  PID:12860
- C:\Windows\System\vFQdGXe.exe
  C:\Windows\System\vFQdGXe.exe
  2⤵
  PID:12888
- C:\Windows\System\fdEmbEG.exe
  C:\Windows\System\fdEmbEG.exe
  2⤵
  PID:12916
- C:\Windows\System\NeHeqEM.exe
  C:\Windows\System\NeHeqEM.exe
  2⤵
  PID:12944
- C:\Windows\System\QpSbMuq.exe
  C:\Windows\System\QpSbMuq.exe
  2⤵
  PID:12972
- C:\Windows\System\oIgRNbd.exe
  C:\Windows\System\oIgRNbd.exe
  2⤵
  PID:13000
- C:\Windows\System\wjsQxTB.exe
  C:\Windows\System\wjsQxTB.exe
  2⤵
  PID:13028
- C:\Windows\System\DtCtpiQ.exe
  C:\Windows\System\DtCtpiQ.exe
  2⤵
  PID:13056
- C:\Windows\System\xhtlRkF.exe
  C:\Windows\System\xhtlRkF.exe
  2⤵
  PID:13084
- C:\Windows\System\kCbunHC.exe
  C:\Windows\System\kCbunHC.exe
  2⤵
  PID:13112
- C:\Windows\System\XsTWetq.exe
  C:\Windows\System\XsTWetq.exe
  2⤵
  PID:13140
- C:\Windows\System\vwKTaka.exe
  C:\Windows\System\vwKTaka.exe
  2⤵
  PID:13168
- C:\Windows\System\AKFjWUo.exe
  C:\Windows\System\AKFjWUo.exe
  2⤵
  PID:13196
- C:\Windows\System\CUuSIub.exe
  C:\Windows\System\CUuSIub.exe
  2⤵
  PID:13224
- C:\Windows\System\vzAHijb.exe
  C:\Windows\System\vzAHijb.exe
  2⤵
  PID:13252
- C:\Windows\System\TfCPIEB.exe
  C:\Windows\System\TfCPIEB.exe
  2⤵
  PID:13280
- C:\Windows\System\rxQhwiB.exe
  C:\Windows\System\rxQhwiB.exe
  2⤵
  PID:13308
- C:\Windows\System\uWAluKQ.exe
  C:\Windows\System\uWAluKQ.exe
  2⤵
  PID:12348
- C:\Windows\System\ZNSWxjv.exe
  C:\Windows\System\ZNSWxjv.exe
  2⤵
  PID:12408
- C:\Windows\System\LfUiLpB.exe
  C:\Windows\System\LfUiLpB.exe
  2⤵
  PID:12484
- C:\Windows\System\VwnSApn.exe
  C:\Windows\System\VwnSApn.exe
  2⤵
  PID:12544
- C:\Windows\System\vmrkRAY.exe
  C:\Windows\System\vmrkRAY.exe
  2⤵
  PID:12604
- C:\Windows\System\cIUzCxV.exe
  C:\Windows\System\cIUzCxV.exe
  2⤵
  PID:12676
- C:\Windows\System\Aqshzvy.exe
  C:\Windows\System\Aqshzvy.exe
  2⤵
  PID:4368
- C:\Windows\System\urjhKrY.exe
  C:\Windows\System\urjhKrY.exe
  2⤵
  PID:12796
- C:\Windows\System\jzmJsMQ.exe
  C:\Windows\System\jzmJsMQ.exe
  2⤵
  PID:12856
- C:\Windows\System\bapBsMS.exe
  C:\Windows\System\bapBsMS.exe
  2⤵
  PID:13220
- C:\Windows\System\IvXfpSY.exe
  C:\Windows\System\IvXfpSY.exe
  2⤵
  PID:13268
- C:\Windows\System\xuhtWMy.exe
  C:\Windows\System\xuhtWMy.exe
  2⤵
  PID:12320
- C:\Windows\System\RNNcwfL.exe
  C:\Windows\System\RNNcwfL.exe
  2⤵
  PID:12464
- C:\Windows\System\tjAIKjq.exe
  C:\Windows\System\tjAIKjq.exe
  2⤵
  PID:12600
- C:\Windows\System\lErdEwh.exe
  C:\Windows\System\lErdEwh.exe
  2⤵
  PID:12764
- C:\Windows\System\CVqPlAl.exe
  C:\Windows\System\CVqPlAl.exe
  2⤵
  PID:12844
- C:\Windows\System\zUpNOvt.exe
  C:\Windows\System\zUpNOvt.exe
  2⤵
  PID:12992
- C:\Windows\System\FLkPrZV.exe
  C:\Windows\System\FLkPrZV.exe
  2⤵
  PID:13052
- C:\Windows\System\eYPusqv.exe
  C:\Windows\System\eYPusqv.exe
  2⤵
  PID:13108
- C:\Windows\System\UYMwFZy.exe
  C:\Windows\System\UYMwFZy.exe
  2⤵
  PID:13160
- C:\Windows\System\thXNnCA.exe
  C:\Windows\System\thXNnCA.exe
  2⤵
  PID:13304
- C:\Windows\System\wBTvdaU.exe
  C:\Windows\System\wBTvdaU.exe
  2⤵
  PID:12596
- C:\Windows\System\kYUXhMB.exe
  C:\Windows\System\kYUXhMB.exe
  2⤵
  PID:12928
- C:\Windows\System\ThEDrWv.exe
  C:\Windows\System\ThEDrWv.exe
  2⤵
  PID:13100
- C:\Windows\System\KVrQAjy.exe
  C:\Windows\System\KVrQAjy.exe
  2⤵
  PID:13080
- C:\Windows\System\dCZlDId.exe
  C:\Windows\System\dCZlDId.exe
  2⤵
  PID:13136
- C:\Windows\System\XMoNLFm.exe
  C:\Windows\System\XMoNLFm.exe
  2⤵
  PID:13164
- C:\Windows\System\CQlZTyv.exe
  C:\Windows\System\CQlZTyv.exe
  2⤵
  PID:13328
- C:\Windows\System\LeWpKhN.exe
  C:\Windows\System\LeWpKhN.exe
  2⤵
  PID:13360
- C:\Windows\System\YjHMfkT.exe
  C:\Windows\System\YjHMfkT.exe
  2⤵
  PID:14052
- C:\Windows\System\dDwGbae.exe
  C:\Windows\System\dDwGbae.exe
  2⤵
  PID:13964
- C:\Windows\System\hgiRoLC.exe
  C:\Windows\System\hgiRoLC.exe
  2⤵
  PID:13980
- C:\Windows\System\HAtgflg.exe
  C:\Windows\System\HAtgflg.exe
  2⤵
  PID:14012
- C:\Windows\System\mCEATxm.exe
  C:\Windows\System\mCEATxm.exe
  2⤵
  PID:13348
- C:\Windows\System\oNouFsi.exe
  C:\Windows\System\oNouFsi.exe
  2⤵
  PID:13436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ococydt.au4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\ABjdJBQ.exe

Filesize
3.0MB

MD5
665d3d0d3838cb20399f2d5215564eb5

SHA1
37373a4c6e41311deef82415761932beae2ea931

SHA256
3e76e6cb96b880ce6107120d4cca7b94487cc69d5a304853cd8312cbbd4f268a

SHA512
008bea4ebacbb34b5ee83989d93d6063c8da159f3fd53a3bf2cf9e7980236cbbbab6c75315a5281378178f41c5236f01119b5f6f50a1e829159a72aa57f94b09

Download Submit
C:\Windows\System\BXGckiL.exe

Filesize
3.0MB

MD5
e286d334c6de9f30628328f8baad8824

SHA1
7d14cbf1f181bc56802016daed65ed39ea00950f

SHA256
4c43e8c70d6f74c399cd12d58a5a5bf292b4528b95a17108bccabfb8107fd949

SHA512
cbd09cb006cc09d9fe2a9be4aaaf11a74a6d6ae0f68c6bba40866792a8ea5ef6983a1234976dba9e53e7a96180579e56e6c050c7d3dc9a0e90fb0fffe5a04fc6

Download Submit
C:\Windows\System\EETxJHq.exe

Filesize
3.0MB

MD5
6d73420d797856968c2a10da044a26c3

SHA1
8cb91bd2492ec74ca951bf613f89b0c101b26b95

SHA256
e8f5168286067e24e7f14fbcf75a200ecc345dccde655f14b55ec36c2f1f6b67

SHA512
9fb927cfbe4fcea31b41160537976324b05c996fa19af1d3226991f9d0437dd80b4eab941302453fec1b3c07f3ac22dd7c53302bce775645434d97fd2687645f

Download Submit
C:\Windows\System\FSOsTTb.exe

Filesize
3.0MB

MD5
b6e3224b58f91c239ad725d19f004d37

SHA1
4b53a9e24dc56dd88402d6adf105369fd941f249

SHA256
a087067315fcfcde32fd5e4fa973b4fabe94cad5998aaebd5549935becf02bca

SHA512
43a38a7c1a898402c93107083b3ea9f8e62833117aea81165378248e593007c84fa16e29ff20f27ce767c761f6bcdccbe2b4a34c3c51692d549701dc2c131bac

Download Submit
C:\Windows\System\InPfhaS.exe

Filesize
3.0MB

MD5
a5c29a241b137d9415791e0df8ee18e4

SHA1
59c1bc3dbdc0c3389cbbecf83e8b8947a97e8c64

SHA256
9896ae871fa8727d340b2147b3280d40bc2650447e6a2b66e8e3f19917d0422e

SHA512
97c6fcb6de8c91f67526e712741bbf3bdc562f10fa28a7d837658f3bdf49ff8200f4a2635f37197346ae9c9a1ce33f4a74e889ad619e6afc7dbb3172d52d8c72

Download Submit
C:\Windows\System\LIclGnM.exe

Filesize
3.0MB

MD5
78ed459ff8ddb684811b2f88f220d734

SHA1
786ff5ef05f3a09188120266ca3684d5ef44efd2

SHA256
8ab2db59b82f447ec03320d5739b5fc68960ff6c07cd58dc6c383f8cecddcb06

SHA512
f31f95a81912fc9d13f3364f9d1ac7ef83584b8deccb476fc5f51a65d7797d195de9b8237ef648bd80349cc2798606555a0a3827a5d9da360f285bc9348fd923

Download Submit
C:\Windows\System\MxPBPbd.exe

Filesize
3.0MB

MD5
d2841ae4f8efff67d9906a11d0b31490

SHA1
4a6bf7ecf82875af78f1b8286afd43294d47af9c

SHA256
d15d83520684f353649ef92a849aee2382be1786dc7d729ad81104a1b517d2ea

SHA512
e3030a5bd0e9a720ced3b6fe659b0f7306aafe41223496216577c158e9f968fe277b2d73140a4b837069274a53c9fe2cae2dd083feef02dcfe1394eb001820c1

Download Submit
C:\Windows\System\NTdhmid.exe

Filesize
3.0MB

MD5
9ae7426a42aaf8d5ee0f61eb41f5befe

SHA1
1ef69d95d0631a7bd25c42265ea6aa956d02eed5

SHA256
cb7dd81272b91c958db4c86f0db2b19a5274c832a0728c7f2a4ef2afeb2d0e9b

SHA512
4e6d3d3ecd143d36de8a3ea8d8c98bdace019d756700c5ff9b0b15e6bdf06b6c0558b5d617a95814d89d822000df0b68844321837817c0f24df549a2fb6fc856

Download Submit
C:\Windows\System\OZdPvdp.exe

Filesize
3.0MB

MD5
8e8389f884a348e3928d756becc24bc5

SHA1
cd43842281954d9d49521598d06bd732ab4d285f

SHA256
c6da6b99d8b4878bffb8c61798ca33aac8a581e88365b150d1b64116e4070d22

SHA512
959cd099d409fffd19b86175fc8086371739939d529fb3d75c00d54f4ae4457e3d49901318320e20b0cced90881d0dc269792625b266d29b26d5ca07d43e63ae

Download Submit
C:\Windows\System\RxyqokY.exe

Filesize
3.0MB

MD5
3c924652c721343204e9d4e0a42c35af

SHA1
874ed0652efc602953df17ae18d3c22847ad0035

SHA256
b38d426e9f4a033738b392c5982c7f5607820c1b620c4ce8a76eaaabd9b0d446

SHA512
3720c6613d2c2e284f5e496786df14a2dc72094caaff481059d0e998dfa56e1e89a4d1119c2755c35221812b119e9814208e80b0e0b18418f435cc515900ca50

Download Submit
C:\Windows\System\SEEImHS.exe

Filesize
3.0MB

MD5
020699f744d10af6ebdf3c1437b27a15

SHA1
6b2effc2d62aacc3c3f8310aa915cff144485965

SHA256
44654b605f5da27e1e08918c57a3be98d77172b626c2275920c509d8775408b6

SHA512
57597e603e401d7d111b8ac9df9bff586d978a8cce184d16a8a25fcc18115c81dbaa826edf861335e9bf813b05151b6c1f67e7c08eb0a212acff1ace19948406

Download Submit
C:\Windows\System\WBgdihG.exe

Filesize
3.0MB

MD5
1826a448b6d83259a1b21d94c2d2c74d

SHA1
42a9b242ac9755d80887b561254579c71efe53a5

SHA256
7c5301c381a13a4447defff39028bbe10f1c3e20d3c1ac9fc8847dd3d6793895

SHA512
7d8368596fd2108e3bc40e3acb1323aa015f5d6b635b92ab8f996c7d737e74f632256e8d29b5dd9f90ad21d0214b4ab60762dd5a993f9a2465ca45aa9cec1d7e

Download Submit
C:\Windows\System\WHHWgRP.exe

Filesize
3.0MB

MD5
29e1e8180793b4689057f2909eac9d18

SHA1
1748d05629c427e259c40ebdd48feb270a5bb4d6

SHA256
96adf11cf25944b1779c15fb8e99fc46175f898361d1b9c29597dd94e0a5e029

SHA512
b8c13b185de91e9b742fbf4a63492f28be9937f408d3b7274c0d8ed67b80039aff8fae7a1efd1697950934145269429af799e94ff4b4421e0f15d90d239b63a3

Download Submit
C:\Windows\System\XkcATqc.exe

Filesize
3.0MB

MD5
f6112850c46976508118c2481ba7c0fb

SHA1
656f42689ce7c6336c14235e22b6d321e10cdb3f

SHA256
2744f19e663041824a6de7256c5e64877d9b74c19462bb18136f42e4b97d9233

SHA512
fb1401bc65503f3580088cb14b0913fe68e17c34f52e4e022feedde37ef80c692a4317bb98210dc7a0f03bf7385d0bec59372bb73c65c044527cc5293f7cc4b1

Download Submit
C:\Windows\System\bSXwTRt.exe

Filesize
3.0MB

MD5
af5bec58805a9914915ae68ecc430ed9

SHA1
80675a93d9abefa20f6f0a4aebdd119e53b6d96f

SHA256
db493a4d60a1ae686616c9104efe68a0e7b7f9a3cf794ca992990d3e33290e1d

SHA512
3ed8881252f3d8c768b4120d475a7f2c908fa2c2a34d7829a357fe2020612288fe269effbc82c413869e10f564d3dc4f0fca80d6973ef17dbc49d996f894e5db

Download Submit
C:\Windows\System\dXykhWw.exe

Filesize
3.0MB

MD5
55b6f9a10e57f55a771f3e009bb94b76

SHA1
93df227e07a9f32ec1ecdebd84195b0e4ed14562

SHA256
38345805d63e1f29df16516a15b429d9827598de642529e4027af7eb514f8648

SHA512
f292d4d313a52f715afa8a8ea017947d330adbbe4c59872c3e417877d8a890af139a30bae379c24876317f429b10d582b17d3f9c362f3f9148139e5333916b2e

Download Submit
C:\Windows\System\dcrqvDQ.exe

Filesize
3.0MB

MD5
25dd5baf48211d16540e093d7cc715a9

SHA1
1614aafd19a9a0c999ff342a5b08b3fd85f10f55

SHA256
d727e2126ac87bfdc3b5cd701966ad58cb26d9c63567ff918b9c9347aa1d78cd

SHA512
5651fe718627768a2d1c1663e60416bf0f50ef6d46d52c81d42ff5929e158d0cd0c8f3b50db19730f47a3358ba378095e0816cc483a689c913669c14789ae8a5

Download Submit
C:\Windows\System\fnuTsXB.exe

Filesize
3.0MB

MD5
0d961f9141638e18fa95fe04f245638b

SHA1
7f4172ac22d76245f4e8c96b1b8806740e9103ed

SHA256
91c228e0fe54a724b3f03646bde2b48618929312ca6fa88fecdab109ecf21c4a

SHA512
ce0585976d63ce3ea3eea8652c4bbd7d01080fc99684bbd442065db36445291376ba6d49e5542a6dc0fcad7105f72e882f301eda86fd8b5a8135482343103ad1

Download Submit
C:\Windows\System\gaIneim.exe

Filesize
3.0MB

MD5
2caac0ea268fd848100a64b9b0729220

SHA1
b63270d81eb7b568e43d247ac6ba9899807de651

SHA256
64b65445f533016aee0bc5aa7d5128d9c66afc9c1161927ca48edb7cc8d01a00

SHA512
b012f935ccd868e48bf6bf1d1b2191bc6e58ff2bbec055469253b6e65beee1b5d9037ca0d4f2ea4bb639c45d37dc066913daa0c99347bdf708e61acfd8f67a56

Download Submit
C:\Windows\System\iFIYsdR.exe

Filesize
3.0MB

MD5
154c9fafe9355e129b901ab5c850f1d7

SHA1
645ed421d6428e8f4bf00ea92309c7626c986b48

SHA256
54c65fd7d8d4f9f5e0ede83d09dff4d6e0e3feb50270a4f9f6f59abcd7f777c2

SHA512
85e71cea8e795a01922c16f67f383178228e7c55400bc6df656c32e09a75b51441a2856b5ac8189e97ce1c63de9ce4d1d597fe8e79b154e8fad7b1570942d619

Download Submit
C:\Windows\System\jqhQzQs.exe

Filesize
3.0MB

MD5
e2caf3eafe328c7f6c76a4719f84d81e

SHA1
19974484eecc1119e89ec6308b222460be192a02

SHA256
80c2f9172e8828c16585d05e698657d770dd1b05a28c8e82e375b7941a91aa20

SHA512
aa30ca0109d9ba09f5248a3963e5d5f3cccff46c09afa6a340de82e09a9adae93256f28254e2b8d5b116914269a9ab8a9f9eba1759073ea76d3d35b6c2f6c54d

Download Submit
C:\Windows\System\mCoZmXd.exe

Filesize
3.0MB

MD5
eea2556bef41ea240c159ca22d6fc4bc

SHA1
7d7e8185413624ffc3c8a4de2d03ca8b0801bb62

SHA256
ad365cbb04b4142f56a4264e02bb5338d86567aff308f72b6077e972bcc08ea6

SHA512
7d225b7a666ece8ebe1fc01398f47e671f169f3337118fb03f1ca168167923ec1951a834912490926ba9be06159aeeaf6c061342fda973b4b855a05cb0a3c40d

Download Submit
C:\Windows\System\nFDZsHF.exe

Filesize
3.0MB

MD5
b559334c139672198ef16e667da3bd09

SHA1
74c9d4d17f4f5f4c7cd3a08d87f424d16db34548

SHA256
2009997135eb3088410afac8dee117d72e690d72642f2cb86216b58ddd149a89

SHA512
0a0444347a0672106ecddb3e8a39ca60b6488a97bec4e5603f39eaf57253839a01066f7d990d32304f4fb75ce6aa5621c04951f6b29e81687e0b2fa23be6ea53

Download Submit
C:\Windows\System\nbRTHlJ.exe

Filesize
3.0MB

MD5
5110b4b620e2ce8a6b44828baf476f47

SHA1
0f852570266799e01f0e28fca78b648066065c96

SHA256
304c0732c43d823e89972c4ce1f91cd6a0e354e88cfde61ea88ef2aed2e2e37e

SHA512
c866ba92e82aa36dd8c534a7602a823fb57476a6325c11ae08419723ddd1b5a8fa9678a2ed4399336c9bdcdd8189ed0bf57d4e68b6d22297ff90c5659e72762a

Download Submit
C:\Windows\System\pHzwVHm.exe

Filesize
3.0MB

MD5
9f3b36ae34af0d3025ffcd7c33fa3426

SHA1
fbfd0a9be992d9b6fdf48102972486d028dae81e

SHA256
f525ca8bf248d532725b7a1628ade9db5bdab13890f30186eaaee44ef60b1f1e

SHA512
ad530f6191ac531a48930a29351a1d8c9e39c4668b1b3f97fc3439eac54f698620bf832c0bdfa666e0f862847cad198dfb07be5e132c2b239b1cf15284de8019

Download Submit
C:\Windows\System\tRCgrVH.exe

Filesize
3.0MB

MD5
831d0e674dd5c4c128a97e42f5dd4f29

SHA1
6b8aff2c2f76723f9247c7cf134d819dfc12577f

SHA256
adcfb4d94bacb996279b3f5c69de1f55c1989ac82001e72e2dcfc01f2369541b

SHA512
900df63a974e83ae27c3acaa4a12f1762295c29fd9ebc9e08109c753dea9f7d83394f33d167af3b0cb90f220c2718b6e221be35c03006ba2b269f9f10c1440a6

Download Submit
C:\Windows\System\uUpEVwL.exe

Filesize
3.0MB

MD5
8a96f46c54f7723de2af9af5ac837564

SHA1
62dd4a97546c0964c7c5ece4d44261e6050fb10a

SHA256
763714e8db859e9bd5e205150c85a3bb0d8c702560b65624822b9d7b7d96a155

SHA512
937a8e178cf394976e26f091fa793f91743377692a3c863b954aeb754377531a7d6d147180e1e782cc4e58540ec67dcbc6f17d367ed08ef07b56926902352a81

Download Submit
C:\Windows\System\uaftjqu.exe

Filesize
3.0MB

MD5
af30595324147b54d2c0f48533d57f99

SHA1
510f2f6051f55f4bf6237f408f82ccd4e9f95c7d

SHA256
55867ac26c75076dbd81f9c57ab8bbeea31c57ced1386ba7ac365ec78d5d040f

SHA512
7469dbc881847b8ca3ebecb306a83a8387f2ef53e54235aa50df470873803fda812877d32f3e800019f4384dc9a9535065b6504320c599246e69cb649b93df15

Download Submit
C:\Windows\System\uudwopY.exe

Filesize
3.0MB

MD5
8b9b1074dcc831bf43fdcdf30119cc82

SHA1
7d281bfd87890b5a307749d14c5047560ca8b95c

SHA256
a96e13fcc131ff7b0163d2e7272dbd53595ffdb1f392cfed4cb058606fe824c5

SHA512
54fe18e9f36b372b1ede6c617abadd9c84221f51bc3ddf5343caee0ea4a8c624184d3663c0d0a9345f97bbb9c3947f597612781b9febe9a3c9b5c3dfd9f2da3b

Download Submit
C:\Windows\System\wLZawCb.exe

Filesize
3.0MB

MD5
a64ce1f7c0f831bc706efe182f7b907a

SHA1
621dca312170352679e8c64d68034f2084bf8745

SHA256
8983b9bf9abee6cc8a4c066f3a7a0ffd5cf6e077df1a842c53dad1cc2e361ed9

SHA512
516f6c28afb97cf6de78e87c0ea841441acaad8230d6190e17f99c1e46ebd8d8ad6c3f52f2e9c23aab2aedb31f307bb356ae3f638c7a33bc91ca41a6fe712e67

Download Submit
C:\Windows\System\wSecTpY.exe

Filesize
3.0MB

MD5
abcb6d32e172e807d863b5c88f4a8ee3

SHA1
f80e443f684e887926139c281698e01752bcdc08

SHA256
56dcb9db257bcbd60a201bbf4f08120fec6304623fda1e87d82bbf531e39cd6b

SHA512
ec5dcc76f19e7b2ae2af03b0f485042ce79a8de454086b3e2ecc2e156f4bd11b2b1f8582bc24e590df60a3e1e50c43f52fe1ceaab59b0662d4500c889cc8141e

Download Submit
C:\Windows\System\yrtQMRg.exe

Filesize
8B

MD5
b8a3c1e6cc9a50b346def727b3d7a860

SHA1
15093b675605081a7767a26d0a563bfcb43c6568

SHA256
e37780eb1d53fe75c5cc3bd249a8bd564fc73852e06cf51a52ae359e05a14d2e

SHA512
6b22816e411f3a6dd1a4031dffae307e9dce8029b6e7e492184fa08f7ebb45788244af1736892e71305ef599b8dffef0a8711787ee5981b5165c26807e94f9fe

Download Submit
C:\Windows\System\ytocmmn.exe

Filesize
3.0MB

MD5
8903c081ee331704a84b1903b6f33f48

SHA1
3e5668f0d17906f8d4cefb1b38dfcb2b6ecc224b

SHA256
7d4c6166ffe51d369c86557bb7196160a98a37521e706d24426c50012a10452e

SHA512
33b4eae04550dbe89086ef2a7cbe7dbf6f7ad413b4ca07f874f56063c30abb986a78e59de82d0e53fa336fd64e5b7c1eecc51c4aa1fa28fa1335812d0f5fec9a

Download Submit
memory/464-104-0x00007FF702020000-0x00007FF702416000-memory.dmp

Filesize
4.0MB

Download
memory/464-3872-0x00007FF702020000-0x00007FF702416000-memory.dmp

Filesize
4.0MB

Download
memory/540-2105-0x00007FF7905E0000-0x00007FF7909D6000-memory.dmp

Filesize
4.0MB

Download
memory/540-131-0x00007FF7905E0000-0x00007FF7909D6000-memory.dmp

Filesize
4.0MB

Download
memory/540-3879-0x00007FF7905E0000-0x00007FF7909D6000-memory.dmp

Filesize
4.0MB

Download
memory/740-172-0x00007FF658000000-0x00007FF6583F6000-memory.dmp

Filesize
4.0MB

Download
memory/740-3882-0x00007FF658000000-0x00007FF6583F6000-memory.dmp

Filesize
4.0MB

Download
memory/1092-3880-0x00007FF7CD880000-0x00007FF7CDC76000-memory.dmp

Filesize
4.0MB

Download
memory/1092-165-0x00007FF7CD880000-0x00007FF7CDC76000-memory.dmp

Filesize
4.0MB

Download
memory/1196-93-0x00007FF6AE710000-0x00007FF6AEB06000-memory.dmp

Filesize
4.0MB

Download
memory/1196-3868-0x00007FF6AE710000-0x00007FF6AEB06000-memory.dmp

Filesize
4.0MB

Download
memory/1224-3873-0x00007FF7B54E0000-0x00007FF7B58D6000-memory.dmp

Filesize
4.0MB

Download
memory/1224-105-0x00007FF7B54E0000-0x00007FF7B58D6000-memory.dmp

Filesize
4.0MB

Download
memory/1240-3883-0x00007FF7F33E0000-0x00007FF7F37D6000-memory.dmp

Filesize
4.0MB

Download
memory/1240-166-0x00007FF7F33E0000-0x00007FF7F37D6000-memory.dmp

Filesize
4.0MB

Download
memory/1276-171-0x00007FF61B860000-0x00007FF61BC56000-memory.dmp

Filesize
4.0MB

Download
memory/1276-3881-0x00007FF61B860000-0x00007FF61BC56000-memory.dmp

Filesize
4.0MB

Download
memory/1492-3-0x00007FFB43783000-0x00007FFB43785000-memory.dmp

Filesize
8KB

Download
memory/1492-54-0x00007FFB43780000-0x00007FFB44241000-memory.dmp

Filesize
10.8MB

Download
memory/1492-18-0x000002065DA30000-0x000002065DA52000-memory.dmp

Filesize
136KB

Download
memory/1492-47-0x00007FFB43780000-0x00007FFB44241000-memory.dmp

Filesize
10.8MB

Download
memory/1492-1382-0x00007FFB43780000-0x00007FFB44241000-memory.dmp

Filesize
10.8MB

Download
memory/1784-3862-0x00007FF683170000-0x00007FF683566000-memory.dmp

Filesize
4.0MB

Download
memory/1784-61-0x00007FF683170000-0x00007FF683566000-memory.dmp

Filesize
4.0MB

Download
memory/1808-101-0x00007FF67C140000-0x00007FF67C536000-memory.dmp

Filesize
4.0MB

Download
memory/1808-3860-0x00007FF67C140000-0x00007FF67C536000-memory.dmp

Filesize
4.0MB

Download
memory/2004-3878-0x00007FF7B6430000-0x00007FF7B6826000-memory.dmp

Filesize
4.0MB

Download
memory/2004-154-0x00007FF7B6430000-0x00007FF7B6826000-memory.dmp

Filesize
4.0MB

Download
memory/2264-60-0x00007FF74C990000-0x00007FF74CD86000-memory.dmp

Filesize
4.0MB

Download
memory/2264-3861-0x00007FF74C990000-0x00007FF74CD86000-memory.dmp

Filesize
4.0MB

Download
memory/2300-3876-0x00007FF767CA0000-0x00007FF768096000-memory.dmp

Filesize
4.0MB

Download
memory/2300-147-0x00007FF767CA0000-0x00007FF768096000-memory.dmp

Filesize
4.0MB

Download
memory/3020-86-0x00007FF628C90000-0x00007FF629086000-memory.dmp

Filesize
4.0MB

Download
memory/3020-3869-0x00007FF628C90000-0x00007FF629086000-memory.dmp

Filesize
4.0MB

Download
memory/3428-69-0x00007FF728EF0000-0x00007FF7292E6000-memory.dmp

Filesize
4.0MB

Download
memory/3428-3864-0x00007FF728EF0000-0x00007FF7292E6000-memory.dmp

Filesize
4.0MB

Download
memory/3432-74-0x00007FF71EEB0000-0x00007FF71F2A6000-memory.dmp

Filesize
4.0MB

Download
memory/3432-3865-0x00007FF71EEB0000-0x00007FF71F2A6000-memory.dmp

Filesize
4.0MB

Download
memory/3700-125-0x00007FF6CDA30000-0x00007FF6CDE26000-memory.dmp

Filesize
4.0MB

Download
memory/3700-3877-0x00007FF6CDA30000-0x00007FF6CDE26000-memory.dmp

Filesize
4.0MB

Download
memory/4000-1-0x0000019E7A9D0000-0x0000019E7A9E0000-memory.dmp

Filesize
64KB

Download
memory/4000-0-0x00007FF62A160000-0x00007FF62A556000-memory.dmp

Filesize
4.0MB

Download
memory/4000-1620-0x00007FF62A160000-0x00007FF62A556000-memory.dmp

Filesize
4.0MB

Download
memory/4468-88-0x00007FF727BD0000-0x00007FF727FC6000-memory.dmp

Filesize
4.0MB

Download
memory/4468-3867-0x00007FF727BD0000-0x00007FF727FC6000-memory.dmp

Filesize
4.0MB

Download
memory/4564-3863-0x00007FF78AE10000-0x00007FF78B206000-memory.dmp

Filesize
4.0MB

Download
memory/4564-65-0x00007FF78AE10000-0x00007FF78B206000-memory.dmp

Filesize
4.0MB

Download
memory/4608-3871-0x00007FF611140000-0x00007FF611536000-memory.dmp

Filesize
4.0MB

Download
memory/4608-103-0x00007FF611140000-0x00007FF611536000-memory.dmp

Filesize
4.0MB

Download
memory/4648-3870-0x00007FF65E170000-0x00007FF65E566000-memory.dmp

Filesize
4.0MB

Download
memory/4648-102-0x00007FF65E170000-0x00007FF65E566000-memory.dmp

Filesize
4.0MB

Download
memory/4676-80-0x00007FF765440000-0x00007FF765836000-memory.dmp

Filesize
4.0MB

Download
memory/4676-3866-0x00007FF765440000-0x00007FF765836000-memory.dmp

Filesize
4.0MB

Download
memory/4692-3875-0x00007FF631910000-0x00007FF631D06000-memory.dmp

Filesize
4.0MB

Download
memory/4692-124-0x00007FF631910000-0x00007FF631D06000-memory.dmp

Filesize
4.0MB

Download
memory/4744-1921-0x00007FF7D2000000-0x00007FF7D23F6000-memory.dmp

Filesize
4.0MB

Download
memory/4744-3874-0x00007FF7D2000000-0x00007FF7D23F6000-memory.dmp

Filesize
4.0MB

Download
memory/4744-96-0x00007FF7D2000000-0x00007FF7D23F6000-memory.dmp

Filesize
4.0MB

Download