xmrig | eb41bf7c77fe81144e8be3d8532a5382545100cf007799b604f95dae35b06340

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
Size

1.4MB
MD5

9ff0fae51209819f3449f1918280e320
SHA1

9028681c9abde53e6459378c5fcf37c5bc33a562
SHA256

eb41bf7c77fe81144e8be3d8532a5382545100cf007799b604f95dae35b06340
SHA512

d7a8531eef9d97417692a9ec41d0ad2f04172c95129892e241125cf643a7a2082e3e8ed7ed9d2cb84fe5014d1e853883ebeb6ca92a41be73030afd0c57ee2181
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkUCCWvLEvjhnXwx8/2Pbx/mbf+Bogs:Lz071uv4BPMkHC0IlnASEx/mlT

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 49 IoCs

miner

resource	yara_rule
behavioral2/memory/4204-388-0x00007FF61A130000-0x00007FF61A522000-memory.dmp	xmrig
behavioral2/memory/5020-389-0x00007FF7715A0000-0x00007FF771992000-memory.dmp	xmrig
behavioral2/memory/1112-387-0x00007FF749B00000-0x00007FF749EF2000-memory.dmp	xmrig
behavioral2/memory/1884-400-0x00007FF692110000-0x00007FF692502000-memory.dmp	xmrig
behavioral2/memory/3864-405-0x00007FF74D0F0000-0x00007FF74D4E2000-memory.dmp	xmrig
behavioral2/memory/4076-426-0x00007FF786420000-0x00007FF786812000-memory.dmp	xmrig
behavioral2/memory/2708-447-0x00007FF692900000-0x00007FF692CF2000-memory.dmp	xmrig
behavioral2/memory/3516-456-0x00007FF716E00000-0x00007FF7171F2000-memory.dmp	xmrig
behavioral2/memory/2968-463-0x00007FF7DF720000-0x00007FF7DFB12000-memory.dmp	xmrig
behavioral2/memory/1448-469-0x00007FF6587B0000-0x00007FF658BA2000-memory.dmp	xmrig
behavioral2/memory/1684-479-0x00007FF7BF550000-0x00007FF7BF942000-memory.dmp	xmrig
behavioral2/memory/4804-483-0x00007FF7CD110000-0x00007FF7CD502000-memory.dmp	xmrig
behavioral2/memory/3576-486-0x00007FF61D660000-0x00007FF61DA52000-memory.dmp	xmrig
behavioral2/memory/3160-488-0x00007FF7CAF10000-0x00007FF7CB302000-memory.dmp	xmrig
behavioral2/memory/3660-489-0x00007FF61A500000-0x00007FF61A8F2000-memory.dmp	xmrig
behavioral2/memory/2144-487-0x00007FF79B980000-0x00007FF79BD72000-memory.dmp	xmrig
behavioral2/memory/4476-482-0x00007FF681C80000-0x00007FF682072000-memory.dmp	xmrig
behavioral2/memory/2120-472-0x00007FF7A0F30000-0x00007FF7A1322000-memory.dmp	xmrig
behavioral2/memory/4608-446-0x00007FF7F7680000-0x00007FF7F7A72000-memory.dmp	xmrig
behavioral2/memory/4884-437-0x00007FF6672C0000-0x00007FF6676B2000-memory.dmp	xmrig
behavioral2/memory/4348-433-0x00007FF6B51D0000-0x00007FF6B55C2000-memory.dmp	xmrig
behavioral2/memory/2148-406-0x00007FF6E6C40000-0x00007FF6E7032000-memory.dmp	xmrig
behavioral2/memory/4196-66-0x00007FF74CA70000-0x00007FF74CE62000-memory.dmp	xmrig
behavioral2/memory/2024-27-0x00007FF6F34F0000-0x00007FF6F38E2000-memory.dmp	xmrig
behavioral2/memory/4880-1976-0x00007FF7DD6F0000-0x00007FF7DDAE2000-memory.dmp	xmrig
behavioral2/memory/3576-2026-0x00007FF61D660000-0x00007FF61DA52000-memory.dmp	xmrig
behavioral2/memory/2024-2028-0x00007FF6F34F0000-0x00007FF6F38E2000-memory.dmp	xmrig
behavioral2/memory/4196-2032-0x00007FF74CA70000-0x00007FF74CE62000-memory.dmp	xmrig
behavioral2/memory/1112-2031-0x00007FF749B00000-0x00007FF749EF2000-memory.dmp	xmrig
behavioral2/memory/5020-2035-0x00007FF7715A0000-0x00007FF771992000-memory.dmp	xmrig
behavioral2/memory/1884-2039-0x00007FF692110000-0x00007FF692502000-memory.dmp	xmrig
behavioral2/memory/2148-2044-0x00007FF6E6C40000-0x00007FF6E7032000-memory.dmp	xmrig
behavioral2/memory/2144-2042-0x00007FF79B980000-0x00007FF79BD72000-memory.dmp	xmrig
behavioral2/memory/4204-2040-0x00007FF61A130000-0x00007FF61A522000-memory.dmp	xmrig
behavioral2/memory/3864-2037-0x00007FF74D0F0000-0x00007FF74D4E2000-memory.dmp	xmrig
behavioral2/memory/3660-2053-0x00007FF61A500000-0x00007FF61A8F2000-memory.dmp	xmrig
behavioral2/memory/1684-2073-0x00007FF7BF550000-0x00007FF7BF942000-memory.dmp	xmrig
behavioral2/memory/4476-2072-0x00007FF681C80000-0x00007FF682072000-memory.dmp	xmrig
behavioral2/memory/2120-2069-0x00007FF7A0F30000-0x00007FF7A1322000-memory.dmp	xmrig
behavioral2/memory/1448-2066-0x00007FF6587B0000-0x00007FF658BA2000-memory.dmp	xmrig
behavioral2/memory/3516-2064-0x00007FF716E00000-0x00007FF7171F2000-memory.dmp	xmrig
behavioral2/memory/4608-2061-0x00007FF7F7680000-0x00007FF7F7A72000-memory.dmp	xmrig
behavioral2/memory/2708-2060-0x00007FF692900000-0x00007FF692CF2000-memory.dmp	xmrig
behavioral2/memory/4884-2056-0x00007FF6672C0000-0x00007FF6676B2000-memory.dmp	xmrig
behavioral2/memory/4348-2052-0x00007FF6B51D0000-0x00007FF6B55C2000-memory.dmp	xmrig
behavioral2/memory/4804-2077-0x00007FF7CD110000-0x00007FF7CD502000-memory.dmp	xmrig
behavioral2/memory/2968-2068-0x00007FF7DF720000-0x00007FF7DFB12000-memory.dmp	xmrig
behavioral2/memory/3160-2050-0x00007FF7CAF10000-0x00007FF7CB302000-memory.dmp	xmrig
behavioral2/memory/4076-2046-0x00007FF786420000-0x00007FF786812000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	3004	powershell.exe
5	3004	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3004	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3576	ZyOyOoz.exe
2024	xaUmaSr.exe
4196	yRkPxHS.exe
1112	CVlTPyV.exe
2144	dgIOoIf.exe
4204	HTDCJiG.exe
5020	NakxUcJ.exe
1884	zMxoYzj.exe
3864	bBjyJPc.exe
3160	JseuLmz.exe
2148	QUoOCzm.exe
4076	lHuTDGp.exe
4348	EFphaxn.exe
3660	xAGxSMl.exe
4884	RmeBzVT.exe
4608	acjwPTI.exe
2708	ItnMaOU.exe
3516	yXWuSbv.exe
2968	jpRWulu.exe
1448	pKtleBv.exe
2120	uJXQxxZ.exe
1684	EiNgwSB.exe
4476	OgydFLB.exe
4804	XJMKcRh.exe
4116	YZnFIkg.exe
1984	ZIyWjBh.exe
2948	qjSxiFA.exe
684	aYcnKHE.exe
4588	DLmHRUq.exe
1348	RNfCRDy.exe
3968	RHSqQQo.exe
3640	KMsycdH.exe
4988	OBOtJDx.exe
3556	VzgInnE.exe
3596	xubBMwJ.exe
3852	ScLCmyD.exe
3048	EZUUnBI.exe
3508	rKlbFXb.exe
3884	psFClUe.exe
3500	CsIcdED.exe
432	spMwJuo.exe
3440	rqMfkkr.exe
5016	pnLHUAs.exe
5008	gZEyxPT.exe
1764	nxdPlfF.exe
4644	wiELqjB.exe
2724	XMGsPEo.exe
2568	zXsoHUT.exe
4412	YWycXBt.exe
916	FpOhwfo.exe
2160	tTnhOiQ.exe
4028	VzynOeg.exe
1768	MDysSan.exe
4928	bLuxefC.exe
1924	VqfGhdN.exe
2836	kgmefAb.exe
1060	zQhtxUS.exe
4016	UvjodCA.exe
3684	QmjsFZZ.exe
4620	jcWjFNp.exe
5112	SGuFKYd.exe
3772	MLczcoe.exe
412	JrRWKvZ.exe
4760	mgQkSZn.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4880-0-0x00007FF7DD6F0000-0x00007FF7DDAE2000-memory.dmp	upx
behavioral2/files/0x00070000000233f2-8.dat	upx
behavioral2/files/0x0008000000022f51-6.dat	upx
behavioral2/files/0x00080000000233f1-9.dat	upx
behavioral2/files/0x00070000000233f3-20.dat	upx
behavioral2/files/0x00070000000233f4-28.dat	upx
behavioral2/files/0x00070000000233f5-43.dat	upx
behavioral2/files/0x00080000000233f8-54.dat	upx
behavioral2/files/0x00070000000233f9-60.dat	upx
behavioral2/files/0x00070000000233fb-76.dat	upx
behavioral2/files/0x00070000000233fd-83.dat	upx
behavioral2/files/0x00070000000233ff-101.dat	upx
behavioral2/files/0x0007000000023401-116.dat	upx
behavioral2/files/0x0007000000023407-146.dat	upx
behavioral2/files/0x000700000002340c-171.dat	upx
behavioral2/memory/4204-388-0x00007FF61A130000-0x00007FF61A522000-memory.dmp	upx
behavioral2/memory/5020-389-0x00007FF7715A0000-0x00007FF771992000-memory.dmp	upx
behavioral2/memory/1112-387-0x00007FF749B00000-0x00007FF749EF2000-memory.dmp	upx
behavioral2/memory/1884-400-0x00007FF692110000-0x00007FF692502000-memory.dmp	upx
behavioral2/memory/3864-405-0x00007FF74D0F0000-0x00007FF74D4E2000-memory.dmp	upx
behavioral2/memory/4076-426-0x00007FF786420000-0x00007FF786812000-memory.dmp	upx
behavioral2/memory/2708-447-0x00007FF692900000-0x00007FF692CF2000-memory.dmp	upx
behavioral2/memory/3516-456-0x00007FF716E00000-0x00007FF7171F2000-memory.dmp	upx
behavioral2/memory/2968-463-0x00007FF7DF720000-0x00007FF7DFB12000-memory.dmp	upx
behavioral2/memory/1448-469-0x00007FF6587B0000-0x00007FF658BA2000-memory.dmp	upx
behavioral2/memory/1684-479-0x00007FF7BF550000-0x00007FF7BF942000-memory.dmp	upx
behavioral2/memory/4804-483-0x00007FF7CD110000-0x00007FF7CD502000-memory.dmp	upx
behavioral2/memory/3576-486-0x00007FF61D660000-0x00007FF61DA52000-memory.dmp	upx
behavioral2/memory/3160-488-0x00007FF7CAF10000-0x00007FF7CB302000-memory.dmp	upx
behavioral2/memory/3660-489-0x00007FF61A500000-0x00007FF61A8F2000-memory.dmp	upx
behavioral2/memory/2144-487-0x00007FF79B980000-0x00007FF79BD72000-memory.dmp	upx
behavioral2/memory/4476-482-0x00007FF681C80000-0x00007FF682072000-memory.dmp	upx
behavioral2/memory/2120-472-0x00007FF7A0F30000-0x00007FF7A1322000-memory.dmp	upx
behavioral2/memory/4608-446-0x00007FF7F7680000-0x00007FF7F7A72000-memory.dmp	upx
behavioral2/memory/4884-437-0x00007FF6672C0000-0x00007FF6676B2000-memory.dmp	upx
behavioral2/memory/4348-433-0x00007FF6B51D0000-0x00007FF6B55C2000-memory.dmp	upx
behavioral2/memory/2148-406-0x00007FF6E6C40000-0x00007FF6E7032000-memory.dmp	upx
behavioral2/files/0x000700000002340f-178.dat	upx
behavioral2/files/0x000700000002340d-176.dat	upx
behavioral2/files/0x000700000002340e-173.dat	upx
behavioral2/files/0x000700000002340b-166.dat	upx
behavioral2/files/0x000700000002340a-161.dat	upx
behavioral2/files/0x0007000000023409-156.dat	upx
behavioral2/files/0x0007000000023408-151.dat	upx
behavioral2/files/0x0007000000023406-141.dat	upx
behavioral2/files/0x0007000000023405-136.dat	upx
behavioral2/files/0x0007000000023404-131.dat	upx
behavioral2/files/0x0007000000023403-126.dat	upx
behavioral2/files/0x0007000000023402-121.dat	upx
behavioral2/files/0x0007000000023400-111.dat	upx
behavioral2/files/0x00080000000233ef-106.dat	upx
behavioral2/files/0x00070000000233fe-96.dat	upx
behavioral2/files/0x00070000000233fc-86.dat	upx
behavioral2/files/0x00070000000233fa-81.dat	upx
behavioral2/files/0x00080000000233f7-72.dat	upx
behavioral2/memory/4196-66-0x00007FF74CA70000-0x00007FF74CE62000-memory.dmp	upx
behavioral2/files/0x00070000000233f6-55.dat	upx
behavioral2/memory/2024-27-0x00007FF6F34F0000-0x00007FF6F38E2000-memory.dmp	upx
behavioral2/memory/4880-1976-0x00007FF7DD6F0000-0x00007FF7DDAE2000-memory.dmp	upx
behavioral2/memory/3576-2026-0x00007FF61D660000-0x00007FF61DA52000-memory.dmp	upx
behavioral2/memory/2024-2028-0x00007FF6F34F0000-0x00007FF6F38E2000-memory.dmp	upx
behavioral2/memory/4196-2032-0x00007FF74CA70000-0x00007FF74CE62000-memory.dmp	upx
behavioral2/memory/1112-2031-0x00007FF749B00000-0x00007FF749EF2000-memory.dmp	upx
behavioral2/memory/5020-2035-0x00007FF7715A0000-0x00007FF771992000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vZkzvQm.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\hHuqaHh.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\JLNstzN.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\rhxiGzA.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\MtjIYHT.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\RVheamm.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\vcsYJPd.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\hneaNHD.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\uOEJOcD.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\UYmkIgc.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\zpbTmuM.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\yXsYPhm.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\yRkPxHS.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\yxudmbB.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\TxluWlx.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\SVNLBCF.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\fxZzmsu.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\xubBMwJ.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\psFClUe.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\cWkdith.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\XJMKcRh.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\HXdbhja.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\MVuTvlr.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\FgJbNPP.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\ulObUGj.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\CTqqMCe.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\hdzyndp.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\AdBAVxI.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\ZIyWjBh.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\VeTCvWL.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\dePNkJE.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\bbfOOVD.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\FLgBihz.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\NMsZvQl.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\ZkwIXTB.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\inEFvzQ.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\yCiiOtV.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\XkynNXF.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\JcZNuxU.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\CsVtCbj.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\GnHCdRb.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\udAZhAV.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\cGhNHEY.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\JtNAODW.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\NDoAtGw.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\qKubNyz.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\siSpDfi.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\RNfCRDy.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\tUfmQjN.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\kVkhhCt.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\HvmcyXY.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\XRETxbd.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\hQAInGu.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\ftpXzyb.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\JAJqkgO.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\RaRQKRG.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\tTnhOiQ.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\IRUcSCL.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\VLDUQjp.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\FnKtOhb.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\uJXQxxZ.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\ScLCmyD.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\dsCPhLv.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
File created	C:\Windows\System\qQPWJEi.exe	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3004	powershell.exe
3004	powershell.exe
3004	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeLockMemoryPrivilege	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 3004	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	83
PID 4880 wrote to memory of 3004	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	83
PID 4880 wrote to memory of 3576	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	84
PID 4880 wrote to memory of 3576	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	84
PID 4880 wrote to memory of 2024	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	85
PID 4880 wrote to memory of 2024	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	85
PID 4880 wrote to memory of 1112	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	86
PID 4880 wrote to memory of 1112	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	86
PID 4880 wrote to memory of 4196	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	87
PID 4880 wrote to memory of 4196	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	87
PID 4880 wrote to memory of 2144	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	88
PID 4880 wrote to memory of 2144	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	88
PID 4880 wrote to memory of 4204	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	89
PID 4880 wrote to memory of 4204	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	89
PID 4880 wrote to memory of 5020	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	90
PID 4880 wrote to memory of 5020	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	90
PID 4880 wrote to memory of 1884	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	91
PID 4880 wrote to memory of 1884	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	91
PID 4880 wrote to memory of 3864	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	92
PID 4880 wrote to memory of 3864	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	92
PID 4880 wrote to memory of 3160	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	93
PID 4880 wrote to memory of 3160	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	93
PID 4880 wrote to memory of 2148	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	94
PID 4880 wrote to memory of 2148	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	94
PID 4880 wrote to memory of 4076	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	95
PID 4880 wrote to memory of 4076	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	95
PID 4880 wrote to memory of 4348	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	96
PID 4880 wrote to memory of 4348	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	96
PID 4880 wrote to memory of 3660	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	97
PID 4880 wrote to memory of 3660	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	97
PID 4880 wrote to memory of 4884	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	98
PID 4880 wrote to memory of 4884	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	98
PID 4880 wrote to memory of 4608	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	99
PID 4880 wrote to memory of 4608	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	99
PID 4880 wrote to memory of 2708	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	100
PID 4880 wrote to memory of 2708	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	100
PID 4880 wrote to memory of 3516	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	101
PID 4880 wrote to memory of 3516	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	101
PID 4880 wrote to memory of 2968	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	102
PID 4880 wrote to memory of 2968	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	102
PID 4880 wrote to memory of 1448	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	103
PID 4880 wrote to memory of 1448	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	103
PID 4880 wrote to memory of 2120	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	104
PID 4880 wrote to memory of 2120	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	104
PID 4880 wrote to memory of 1684	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	105
PID 4880 wrote to memory of 1684	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	105
PID 4880 wrote to memory of 4476	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	106
PID 4880 wrote to memory of 4476	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	106
PID 4880 wrote to memory of 4804	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	107
PID 4880 wrote to memory of 4804	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	107
PID 4880 wrote to memory of 4116	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	108
PID 4880 wrote to memory of 4116	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	108
PID 4880 wrote to memory of 1984	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	109
PID 4880 wrote to memory of 1984	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	109
PID 4880 wrote to memory of 2948	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	110
PID 4880 wrote to memory of 2948	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	110
PID 4880 wrote to memory of 684	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	111
PID 4880 wrote to memory of 684	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	111
PID 4880 wrote to memory of 4588	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	112
PID 4880 wrote to memory of 4588	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	112
PID 4880 wrote to memory of 1348	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	113
PID 4880 wrote to memory of 1348	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	113
PID 4880 wrote to memory of 3968	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	114
PID 4880 wrote to memory of 3968	4880	9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9ff0fae51209819f3449f1918280e320_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "3004" "2972" "1216" "2976" "0" "0" "2980" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:12680
- C:\Windows\System\ZyOyOoz.exe
  C:\Windows\System\ZyOyOoz.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\xaUmaSr.exe
  C:\Windows\System\xaUmaSr.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\CVlTPyV.exe
  C:\Windows\System\CVlTPyV.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\yRkPxHS.exe
  C:\Windows\System\yRkPxHS.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\dgIOoIf.exe
  C:\Windows\System\dgIOoIf.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\HTDCJiG.exe
  C:\Windows\System\HTDCJiG.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\NakxUcJ.exe
  C:\Windows\System\NakxUcJ.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\zMxoYzj.exe
  C:\Windows\System\zMxoYzj.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\bBjyJPc.exe
  C:\Windows\System\bBjyJPc.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\JseuLmz.exe
  C:\Windows\System\JseuLmz.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\QUoOCzm.exe
  C:\Windows\System\QUoOCzm.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\lHuTDGp.exe
  C:\Windows\System\lHuTDGp.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\EFphaxn.exe
  C:\Windows\System\EFphaxn.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\xAGxSMl.exe
  C:\Windows\System\xAGxSMl.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\RmeBzVT.exe
  C:\Windows\System\RmeBzVT.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\acjwPTI.exe
  C:\Windows\System\acjwPTI.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\ItnMaOU.exe
  C:\Windows\System\ItnMaOU.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\yXWuSbv.exe
  C:\Windows\System\yXWuSbv.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\jpRWulu.exe
  C:\Windows\System\jpRWulu.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\pKtleBv.exe
  C:\Windows\System\pKtleBv.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\uJXQxxZ.exe
  C:\Windows\System\uJXQxxZ.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\EiNgwSB.exe
  C:\Windows\System\EiNgwSB.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\OgydFLB.exe
  C:\Windows\System\OgydFLB.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\XJMKcRh.exe
  C:\Windows\System\XJMKcRh.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\YZnFIkg.exe
  C:\Windows\System\YZnFIkg.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\ZIyWjBh.exe
  C:\Windows\System\ZIyWjBh.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\qjSxiFA.exe
  C:\Windows\System\qjSxiFA.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\aYcnKHE.exe
  C:\Windows\System\aYcnKHE.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\DLmHRUq.exe
  C:\Windows\System\DLmHRUq.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\RNfCRDy.exe
  C:\Windows\System\RNfCRDy.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\RHSqQQo.exe
  C:\Windows\System\RHSqQQo.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\KMsycdH.exe
  C:\Windows\System\KMsycdH.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\OBOtJDx.exe
  C:\Windows\System\OBOtJDx.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\VzgInnE.exe
  C:\Windows\System\VzgInnE.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\xubBMwJ.exe
  C:\Windows\System\xubBMwJ.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\ScLCmyD.exe
  C:\Windows\System\ScLCmyD.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\EZUUnBI.exe
  C:\Windows\System\EZUUnBI.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\rKlbFXb.exe
  C:\Windows\System\rKlbFXb.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\psFClUe.exe
  C:\Windows\System\psFClUe.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\CsIcdED.exe
  C:\Windows\System\CsIcdED.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\spMwJuo.exe
  C:\Windows\System\spMwJuo.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\rqMfkkr.exe
  C:\Windows\System\rqMfkkr.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\pnLHUAs.exe
  C:\Windows\System\pnLHUAs.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\gZEyxPT.exe
  C:\Windows\System\gZEyxPT.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\nxdPlfF.exe
  C:\Windows\System\nxdPlfF.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\wiELqjB.exe
  C:\Windows\System\wiELqjB.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\XMGsPEo.exe
  C:\Windows\System\XMGsPEo.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\zXsoHUT.exe
  C:\Windows\System\zXsoHUT.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\YWycXBt.exe
  C:\Windows\System\YWycXBt.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\FpOhwfo.exe
  C:\Windows\System\FpOhwfo.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\tTnhOiQ.exe
  C:\Windows\System\tTnhOiQ.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\VzynOeg.exe
  C:\Windows\System\VzynOeg.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\MDysSan.exe
  C:\Windows\System\MDysSan.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\bLuxefC.exe
  C:\Windows\System\bLuxefC.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\VqfGhdN.exe
  C:\Windows\System\VqfGhdN.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\kgmefAb.exe
  C:\Windows\System\kgmefAb.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\zQhtxUS.exe
  C:\Windows\System\zQhtxUS.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\UvjodCA.exe
  C:\Windows\System\UvjodCA.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\QmjsFZZ.exe
  C:\Windows\System\QmjsFZZ.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\jcWjFNp.exe
  C:\Windows\System\jcWjFNp.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\SGuFKYd.exe
  C:\Windows\System\SGuFKYd.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\MLczcoe.exe
  C:\Windows\System\MLczcoe.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\JrRWKvZ.exe
  C:\Windows\System\JrRWKvZ.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\mgQkSZn.exe
  C:\Windows\System\mgQkSZn.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\vltmuvC.exe
  C:\Windows\System\vltmuvC.exe
  2⤵
  PID:1584
- C:\Windows\System\kGQUMZL.exe
  C:\Windows\System\kGQUMZL.exe
  2⤵
  PID:3336
- C:\Windows\System\CsVtCbj.exe
  C:\Windows\System\CsVtCbj.exe
  2⤵
  PID:3608
- C:\Windows\System\NfbsIaU.exe
  C:\Windows\System\NfbsIaU.exe
  2⤵
  PID:2924
- C:\Windows\System\ZWELyEL.exe
  C:\Windows\System\ZWELyEL.exe
  2⤵
  PID:4400
- C:\Windows\System\yCiiOtV.exe
  C:\Windows\System\yCiiOtV.exe
  2⤵
  PID:2280
- C:\Windows\System\cWkdith.exe
  C:\Windows\System\cWkdith.exe
  2⤵
  PID:1644
- C:\Windows\System\mHZoegp.exe
  C:\Windows\System\mHZoegp.exe
  2⤵
  PID:4960
- C:\Windows\System\dbAeZoF.exe
  C:\Windows\System\dbAeZoF.exe
  2⤵
  PID:436
- C:\Windows\System\sqkITxW.exe
  C:\Windows\System\sqkITxW.exe
  2⤵
  PID:2972
- C:\Windows\System\TiWBbtk.exe
  C:\Windows\System\TiWBbtk.exe
  2⤵
  PID:4324
- C:\Windows\System\HaOSxYl.exe
  C:\Windows\System\HaOSxYl.exe
  2⤵
  PID:4440
- C:\Windows\System\SVNLBCF.exe
  C:\Windows\System\SVNLBCF.exe
  2⤵
  PID:692
- C:\Windows\System\EleQdTa.exe
  C:\Windows\System\EleQdTa.exe
  2⤵
  PID:3536
- C:\Windows\System\KUSkTNc.exe
  C:\Windows\System\KUSkTNc.exe
  2⤵
  PID:4900
- C:\Windows\System\dsCPhLv.exe
  C:\Windows\System\dsCPhLv.exe
  2⤵
  PID:3308
- C:\Windows\System\jRlLNjA.exe
  C:\Windows\System\jRlLNjA.exe
  2⤵
  PID:4232
- C:\Windows\System\IRUcSCL.exe
  C:\Windows\System\IRUcSCL.exe
  2⤵
  PID:2816
- C:\Windows\System\IEZNlui.exe
  C:\Windows\System\IEZNlui.exe
  2⤵
  PID:2592
- C:\Windows\System\mfQwHdA.exe
  C:\Windows\System\mfQwHdA.exe
  2⤵
  PID:1648
- C:\Windows\System\VLDUQjp.exe
  C:\Windows\System\VLDUQjp.exe
  2⤵
  PID:2624
- C:\Windows\System\gHvCAHq.exe
  C:\Windows\System\gHvCAHq.exe
  2⤵
  PID:2696
- C:\Windows\System\OCjhISz.exe
  C:\Windows\System\OCjhISz.exe
  2⤵
  PID:3228
- C:\Windows\System\IlhVzMz.exe
  C:\Windows\System\IlhVzMz.exe
  2⤵
  PID:232
- C:\Windows\System\wWQOskn.exe
  C:\Windows\System\wWQOskn.exe
  2⤵
  PID:5132
- C:\Windows\System\EtTAvAe.exe
  C:\Windows\System\EtTAvAe.exe
  2⤵
  PID:5164
- C:\Windows\System\JcqFmbv.exe
  C:\Windows\System\JcqFmbv.exe
  2⤵
  PID:5188
- C:\Windows\System\alLacxO.exe
  C:\Windows\System\alLacxO.exe
  2⤵
  PID:5216
- C:\Windows\System\pBcQSMJ.exe
  C:\Windows\System\pBcQSMJ.exe
  2⤵
  PID:5248
- C:\Windows\System\GRDRshd.exe
  C:\Windows\System\GRDRshd.exe
  2⤵
  PID:5272
- C:\Windows\System\qDpMHqW.exe
  C:\Windows\System\qDpMHqW.exe
  2⤵
  PID:5300
- C:\Windows\System\wJYITuB.exe
  C:\Windows\System\wJYITuB.exe
  2⤵
  PID:5328
- C:\Windows\System\AeCZpAg.exe
  C:\Windows\System\AeCZpAg.exe
  2⤵
  PID:5356
- C:\Windows\System\RVheamm.exe
  C:\Windows\System\RVheamm.exe
  2⤵
  PID:5388
- C:\Windows\System\ebsblQV.exe
  C:\Windows\System\ebsblQV.exe
  2⤵
  PID:5416
- C:\Windows\System\UfNftDd.exe
  C:\Windows\System\UfNftDd.exe
  2⤵
  PID:5448
- C:\Windows\System\rDKrlfB.exe
  C:\Windows\System\rDKrlfB.exe
  2⤵
  PID:5476
- C:\Windows\System\CmFPKET.exe
  C:\Windows\System\CmFPKET.exe
  2⤵
  PID:5508
- C:\Windows\System\BnoZFdF.exe
  C:\Windows\System\BnoZFdF.exe
  2⤵
  PID:5536
- C:\Windows\System\ZVUgNsr.exe
  C:\Windows\System\ZVUgNsr.exe
  2⤵
  PID:5604
- C:\Windows\System\ITbXXck.exe
  C:\Windows\System\ITbXXck.exe
  2⤵
  PID:5624
- C:\Windows\System\UIuEYtq.exe
  C:\Windows\System\UIuEYtq.exe
  2⤵
  PID:5656
- C:\Windows\System\ypwppcq.exe
  C:\Windows\System\ypwppcq.exe
  2⤵
  PID:5672
- C:\Windows\System\Ibxfiiy.exe
  C:\Windows\System\Ibxfiiy.exe
  2⤵
  PID:5696
- C:\Windows\System\iHWVSLR.exe
  C:\Windows\System\iHWVSLR.exe
  2⤵
  PID:5716
- C:\Windows\System\cGaYgfw.exe
  C:\Windows\System\cGaYgfw.exe
  2⤵
  PID:5768
- C:\Windows\System\mLSPHyu.exe
  C:\Windows\System\mLSPHyu.exe
  2⤵
  PID:5784
- C:\Windows\System\JvWOAye.exe
  C:\Windows\System\JvWOAye.exe
  2⤵
  PID:5812
- C:\Windows\System\fMUDrVK.exe
  C:\Windows\System\fMUDrVK.exe
  2⤵
  PID:5828
- C:\Windows\System\UtYreEu.exe
  C:\Windows\System\UtYreEu.exe
  2⤵
  PID:5864
- C:\Windows\System\XsklneO.exe
  C:\Windows\System\XsklneO.exe
  2⤵
  PID:5880
- C:\Windows\System\pSiZona.exe
  C:\Windows\System\pSiZona.exe
  2⤵
  PID:5904
- C:\Windows\System\RmlGUhm.exe
  C:\Windows\System\RmlGUhm.exe
  2⤵
  PID:5920
- C:\Windows\System\fFxjTaw.exe
  C:\Windows\System\fFxjTaw.exe
  2⤵
  PID:5956
- C:\Windows\System\zwxQWdL.exe
  C:\Windows\System\zwxQWdL.exe
  2⤵
  PID:5980
- C:\Windows\System\qMoFsKP.exe
  C:\Windows\System\qMoFsKP.exe
  2⤵
  PID:6016
- C:\Windows\System\FsQbfxx.exe
  C:\Windows\System\FsQbfxx.exe
  2⤵
  PID:6036
- C:\Windows\System\tUfmQjN.exe
  C:\Windows\System\tUfmQjN.exe
  2⤵
  PID:6136
- C:\Windows\System\FAzHdww.exe
  C:\Windows\System\FAzHdww.exe
  2⤵
  PID:2508
- C:\Windows\System\dsPYGXq.exe
  C:\Windows\System\dsPYGXq.exe
  2⤵
  PID:2736
- C:\Windows\System\MTxPdPS.exe
  C:\Windows\System\MTxPdPS.exe
  2⤵
  PID:4612
- C:\Windows\System\ySGUibo.exe
  C:\Windows\System\ySGUibo.exe
  2⤵
  PID:1248
- C:\Windows\System\mLQkhbo.exe
  C:\Windows\System\mLQkhbo.exe
  2⤵
  PID:3648
- C:\Windows\System\aWHZkIx.exe
  C:\Windows\System\aWHZkIx.exe
  2⤵
  PID:5240
- C:\Windows\System\NbhCTLv.exe
  C:\Windows\System\NbhCTLv.exe
  2⤵
  PID:5324
- C:\Windows\System\seqXBMM.exe
  C:\Windows\System\seqXBMM.exe
  2⤵
  PID:5352
- C:\Windows\System\vcsYJPd.exe
  C:\Windows\System\vcsYJPd.exe
  2⤵
  PID:5432
- C:\Windows\System\TnqtZaf.exe
  C:\Windows\System\TnqtZaf.exe
  2⤵
  PID:5556
- C:\Windows\System\iVZJozY.exe
  C:\Windows\System\iVZJozY.exe
  2⤵
  PID:3448
- C:\Windows\System\hfZJAtu.exe
  C:\Windows\System\hfZJAtu.exe
  2⤵
  PID:3208
- C:\Windows\System\tltKGVU.exe
  C:\Windows\System\tltKGVU.exe
  2⤵
  PID:4748
- C:\Windows\System\xeulaXH.exe
  C:\Windows\System\xeulaXH.exe
  2⤵
  PID:2440
- C:\Windows\System\HNNytyZ.exe
  C:\Windows\System\HNNytyZ.exe
  2⤵
  PID:5616
- C:\Windows\System\bARcfwi.exe
  C:\Windows\System\bARcfwi.exe
  2⤵
  PID:5680
- C:\Windows\System\zROPwiN.exe
  C:\Windows\System\zROPwiN.exe
  2⤵
  PID:5804
- C:\Windows\System\cbtNcwK.exe
  C:\Windows\System\cbtNcwK.exe
  2⤵
  PID:5748
- C:\Windows\System\BKHKUlk.exe
  C:\Windows\System\BKHKUlk.exe
  2⤵
  PID:5856
- C:\Windows\System\WxlWZAM.exe
  C:\Windows\System\WxlWZAM.exe
  2⤵
  PID:5892
- C:\Windows\System\lsKCTiK.exe
  C:\Windows\System\lsKCTiK.exe
  2⤵
  PID:6028
- C:\Windows\System\FEQEmCK.exe
  C:\Windows\System\FEQEmCK.exe
  2⤵
  PID:6032
- C:\Windows\System\VBIChJv.exe
  C:\Windows\System\VBIChJv.exe
  2⤵
  PID:6120
- C:\Windows\System\kkTCobL.exe
  C:\Windows\System\kkTCobL.exe
  2⤵
  PID:4396
- C:\Windows\System\yPuOvKX.exe
  C:\Windows\System\yPuOvKX.exe
  2⤵
  PID:4144
- C:\Windows\System\jzImFpf.exe
  C:\Windows\System\jzImFpf.exe
  2⤵
  PID:1776
- C:\Windows\System\lnZYKPI.exe
  C:\Windows\System\lnZYKPI.exe
  2⤵
  PID:1468
- C:\Windows\System\nuasBsU.exe
  C:\Windows\System\nuasBsU.exe
  2⤵
  PID:2256
- C:\Windows\System\RMTaTKA.exe
  C:\Windows\System\RMTaTKA.exe
  2⤵
  PID:5496
- C:\Windows\System\znYpmmR.exe
  C:\Windows\System\znYpmmR.exe
  2⤵
  PID:2488
- C:\Windows\System\IiBSkBd.exe
  C:\Windows\System\IiBSkBd.exe
  2⤵
  PID:1760
- C:\Windows\System\oPeJJTr.exe
  C:\Windows\System\oPeJJTr.exe
  2⤵
  PID:5524
- C:\Windows\System\ZWVfhst.exe
  C:\Windows\System\ZWVfhst.exe
  2⤵
  PID:3076
- C:\Windows\System\ZlLJQgS.exe
  C:\Windows\System\ZlLJQgS.exe
  2⤵
  PID:5596
- C:\Windows\System\XEcHeKH.exe
  C:\Windows\System\XEcHeKH.exe
  2⤵
  PID:5692
- C:\Windows\System\OrbDJdP.exe
  C:\Windows\System\OrbDJdP.exe
  2⤵
  PID:5840
- C:\Windows\System\SwguKhu.exe
  C:\Windows\System\SwguKhu.exe
  2⤵
  PID:5912
- C:\Windows\System\mjOXIPH.exe
  C:\Windows\System\mjOXIPH.exe
  2⤵
  PID:5972
- C:\Windows\System\VRiBKyG.exe
  C:\Windows\System\VRiBKyG.exe
  2⤵
  PID:6004
- C:\Windows\System\mYIrxgs.exe
  C:\Windows\System\mYIrxgs.exe
  2⤵
  PID:5384
- C:\Windows\System\XRETxbd.exe
  C:\Windows\System\XRETxbd.exe
  2⤵
  PID:428
- C:\Windows\System\hQAInGu.exe
  C:\Windows\System\hQAInGu.exe
  2⤵
  PID:2552
- C:\Windows\System\PGTpunR.exe
  C:\Windows\System\PGTpunR.exe
  2⤵
  PID:5740
- C:\Windows\System\kVkhhCt.exe
  C:\Windows\System\kVkhhCt.exe
  2⤵
  PID:5800
- C:\Windows\System\gxfzbSa.exe
  C:\Windows\System\gxfzbSa.exe
  2⤵
  PID:1160
- C:\Windows\System\VeTCvWL.exe
  C:\Windows\System\VeTCvWL.exe
  2⤵
  PID:4636
- C:\Windows\System\DMRpief.exe
  C:\Windows\System\DMRpief.exe
  2⤵
  PID:6152
- C:\Windows\System\GiRLbVC.exe
  C:\Windows\System\GiRLbVC.exe
  2⤵
  PID:6192
- C:\Windows\System\RskxleH.exe
  C:\Windows\System\RskxleH.exe
  2⤵
  PID:6208
- C:\Windows\System\jfzsQdi.exe
  C:\Windows\System\jfzsQdi.exe
  2⤵
  PID:6244
- C:\Windows\System\OyBmGVO.exe
  C:\Windows\System\OyBmGVO.exe
  2⤵
  PID:6272
- C:\Windows\System\ktkYHPC.exe
  C:\Windows\System\ktkYHPC.exe
  2⤵
  PID:6288
- C:\Windows\System\JsKSopZ.exe
  C:\Windows\System\JsKSopZ.exe
  2⤵
  PID:6312
- C:\Windows\System\UIXZtmJ.exe
  C:\Windows\System\UIXZtmJ.exe
  2⤵
  PID:6336
- C:\Windows\System\pwDJnhS.exe
  C:\Windows\System\pwDJnhS.exe
  2⤵
  PID:6392
- C:\Windows\System\UKVfOpY.exe
  C:\Windows\System\UKVfOpY.exe
  2⤵
  PID:6412
- C:\Windows\System\CyXbqGw.exe
  C:\Windows\System\CyXbqGw.exe
  2⤵
  PID:6432
- C:\Windows\System\KvGGauv.exe
  C:\Windows\System\KvGGauv.exe
  2⤵
  PID:6476
- C:\Windows\System\rGaaqnO.exe
  C:\Windows\System\rGaaqnO.exe
  2⤵
  PID:6504
- C:\Windows\System\WlfpQCf.exe
  C:\Windows\System\WlfpQCf.exe
  2⤵
  PID:6560
- C:\Windows\System\HVcisFD.exe
  C:\Windows\System\HVcisFD.exe
  2⤵
  PID:6600
- C:\Windows\System\yPwTcna.exe
  C:\Windows\System\yPwTcna.exe
  2⤵
  PID:6616
- C:\Windows\System\CIHVWGi.exe
  C:\Windows\System\CIHVWGi.exe
  2⤵
  PID:6660
- C:\Windows\System\kqVNWTm.exe
  C:\Windows\System\kqVNWTm.exe
  2⤵
  PID:6708
- C:\Windows\System\kKdDcWb.exe
  C:\Windows\System\kKdDcWb.exe
  2⤵
  PID:6728
- C:\Windows\System\qwVMlWB.exe
  C:\Windows\System\qwVMlWB.exe
  2⤵
  PID:6752
- C:\Windows\System\PwSDOci.exe
  C:\Windows\System\PwSDOci.exe
  2⤵
  PID:6768
- C:\Windows\System\PMAQZTN.exe
  C:\Windows\System\PMAQZTN.exe
  2⤵
  PID:6788
- C:\Windows\System\aaLNCIV.exe
  C:\Windows\System\aaLNCIV.exe
  2⤵
  PID:6804
- C:\Windows\System\MsozRWL.exe
  C:\Windows\System\MsozRWL.exe
  2⤵
  PID:6832
- C:\Windows\System\dbYqhHS.exe
  C:\Windows\System\dbYqhHS.exe
  2⤵
  PID:6848
- C:\Windows\System\KbaIVZQ.exe
  C:\Windows\System\KbaIVZQ.exe
  2⤵
  PID:6872
- C:\Windows\System\BcEVWNA.exe
  C:\Windows\System\BcEVWNA.exe
  2⤵
  PID:6904
- C:\Windows\System\PeNeSXJ.exe
  C:\Windows\System\PeNeSXJ.exe
  2⤵
  PID:6920
- C:\Windows\System\lUUVUkA.exe
  C:\Windows\System\lUUVUkA.exe
  2⤵
  PID:6948
- C:\Windows\System\LXdMHZB.exe
  C:\Windows\System\LXdMHZB.exe
  2⤵
  PID:6964
- C:\Windows\System\NOuGCzI.exe
  C:\Windows\System\NOuGCzI.exe
  2⤵
  PID:6988
- C:\Windows\System\OuKHuFp.exe
  C:\Windows\System\OuKHuFp.exe
  2⤵
  PID:7008
- C:\Windows\System\gkVySsO.exe
  C:\Windows\System\gkVySsO.exe
  2⤵
  PID:7028
- C:\Windows\System\Ibnhixy.exe
  C:\Windows\System\Ibnhixy.exe
  2⤵
  PID:7052
- C:\Windows\System\UwJSHmr.exe
  C:\Windows\System\UwJSHmr.exe
  2⤵
  PID:7136
- C:\Windows\System\pzVLBwu.exe
  C:\Windows\System\pzVLBwu.exe
  2⤵
  PID:7160
- C:\Windows\System\FjIrVnL.exe
  C:\Windows\System\FjIrVnL.exe
  2⤵
  PID:6172
- C:\Windows\System\fXJArdt.exe
  C:\Windows\System\fXJArdt.exe
  2⤵
  PID:6184
- C:\Windows\System\YHWxxTP.exe
  C:\Windows\System\YHWxxTP.exe
  2⤵
  PID:6268
- C:\Windows\System\eWoOqsB.exe
  C:\Windows\System\eWoOqsB.exe
  2⤵
  PID:6280
- C:\Windows\System\bXCRKIj.exe
  C:\Windows\System\bXCRKIj.exe
  2⤵
  PID:6420
- C:\Windows\System\UTNLSzP.exe
  C:\Windows\System\UTNLSzP.exe
  2⤵
  PID:6384
- C:\Windows\System\KsrcIFH.exe
  C:\Windows\System\KsrcIFH.exe
  2⤵
  PID:6464
- C:\Windows\System\CWYHQKw.exe
  C:\Windows\System\CWYHQKw.exe
  2⤵
  PID:6492
- C:\Windows\System\djNjDyj.exe
  C:\Windows\System\djNjDyj.exe
  2⤵
  PID:6612
- C:\Windows\System\mrouQnV.exe
  C:\Windows\System\mrouQnV.exe
  2⤵
  PID:6656
- C:\Windows\System\jcIWEav.exe
  C:\Windows\System\jcIWEav.exe
  2⤵
  PID:6884
- C:\Windows\System\ftpXzyb.exe
  C:\Windows\System\ftpXzyb.exe
  2⤵
  PID:6900
- C:\Windows\System\yxudmbB.exe
  C:\Windows\System\yxudmbB.exe
  2⤵
  PID:6960
- C:\Windows\System\tZMDjvE.exe
  C:\Windows\System\tZMDjvE.exe
  2⤵
  PID:7004
- C:\Windows\System\LkyWwrs.exe
  C:\Windows\System\LkyWwrs.exe
  2⤵
  PID:7084
- C:\Windows\System\XkynNXF.exe
  C:\Windows\System\XkynNXF.exe
  2⤵
  PID:7124
- C:\Windows\System\XMKLhem.exe
  C:\Windows\System\XMKLhem.exe
  2⤵
  PID:3376
- C:\Windows\System\AAOVPpy.exe
  C:\Windows\System\AAOVPpy.exe
  2⤵
  PID:6332
- C:\Windows\System\hJDjrpV.exe
  C:\Windows\System\hJDjrpV.exe
  2⤵
  PID:6148
- C:\Windows\System\qFykVuN.exe
  C:\Windows\System\qFykVuN.exe
  2⤵
  PID:6468
- C:\Windows\System\pypAhVm.exe
  C:\Windows\System\pypAhVm.exe
  2⤵
  PID:6668
- C:\Windows\System\YgRZeMH.exe
  C:\Windows\System\YgRZeMH.exe
  2⤵
  PID:6748
- C:\Windows\System\eLFJMMS.exe
  C:\Windows\System\eLFJMMS.exe
  2⤵
  PID:6896
- C:\Windows\System\KMXVpZV.exe
  C:\Windows\System\KMXVpZV.exe
  2⤵
  PID:6972
- C:\Windows\System\MFJvaOJ.exe
  C:\Windows\System\MFJvaOJ.exe
  2⤵
  PID:7144
- C:\Windows\System\GmkEQku.exe
  C:\Windows\System\GmkEQku.exe
  2⤵
  PID:6400
- C:\Windows\System\auypaAh.exe
  C:\Windows\System\auypaAh.exe
  2⤵
  PID:7172
- C:\Windows\System\qUktgnn.exe
  C:\Windows\System\qUktgnn.exe
  2⤵
  PID:7192
- C:\Windows\System\xrUiuET.exe
  C:\Windows\System\xrUiuET.exe
  2⤵
  PID:7212
- C:\Windows\System\aSPbewG.exe
  C:\Windows\System\aSPbewG.exe
  2⤵
  PID:7240
- C:\Windows\System\MEFTBrN.exe
  C:\Windows\System\MEFTBrN.exe
  2⤵
  PID:7256
- C:\Windows\System\tjVkfet.exe
  C:\Windows\System\tjVkfet.exe
  2⤵
  PID:7304
- C:\Windows\System\ziTzRun.exe
  C:\Windows\System\ziTzRun.exe
  2⤵
  PID:7324
- C:\Windows\System\iDqPfsC.exe
  C:\Windows\System\iDqPfsC.exe
  2⤵
  PID:7340
- C:\Windows\System\UgWkmQT.exe
  C:\Windows\System\UgWkmQT.exe
  2⤵
  PID:7380
- C:\Windows\System\sGuDZUx.exe
  C:\Windows\System\sGuDZUx.exe
  2⤵
  PID:7412
- C:\Windows\System\GsOIhqn.exe
  C:\Windows\System\GsOIhqn.exe
  2⤵
  PID:7432
- C:\Windows\System\VvTwVwP.exe
  C:\Windows\System\VvTwVwP.exe
  2⤵
  PID:7452
- C:\Windows\System\SMkGRYP.exe
  C:\Windows\System\SMkGRYP.exe
  2⤵
  PID:7472
- C:\Windows\System\pjCQRNx.exe
  C:\Windows\System\pjCQRNx.exe
  2⤵
  PID:7504
- C:\Windows\System\reBTuLl.exe
  C:\Windows\System\reBTuLl.exe
  2⤵
  PID:7532
- C:\Windows\System\QQOzvyV.exe
  C:\Windows\System\QQOzvyV.exe
  2⤵
  PID:7592
- C:\Windows\System\HAzkfOF.exe
  C:\Windows\System\HAzkfOF.exe
  2⤵
  PID:7616
- C:\Windows\System\acbhTfn.exe
  C:\Windows\System\acbhTfn.exe
  2⤵
  PID:7652
- C:\Windows\System\axGXrAx.exe
  C:\Windows\System\axGXrAx.exe
  2⤵
  PID:7680
- C:\Windows\System\jQhWjdP.exe
  C:\Windows\System\jQhWjdP.exe
  2⤵
  PID:7716
- C:\Windows\System\chZNKfJ.exe
  C:\Windows\System\chZNKfJ.exe
  2⤵
  PID:7760
- C:\Windows\System\uWPcMea.exe
  C:\Windows\System\uWPcMea.exe
  2⤵
  PID:7780
- C:\Windows\System\XSJMPor.exe
  C:\Windows\System\XSJMPor.exe
  2⤵
  PID:7800
- C:\Windows\System\shmTxnn.exe
  C:\Windows\System\shmTxnn.exe
  2⤵
  PID:7820
- C:\Windows\System\FIeCzah.exe
  C:\Windows\System\FIeCzah.exe
  2⤵
  PID:7848
- C:\Windows\System\qPwaNeN.exe
  C:\Windows\System\qPwaNeN.exe
  2⤵
  PID:7868
- C:\Windows\System\NiMZEQv.exe
  C:\Windows\System\NiMZEQv.exe
  2⤵
  PID:7892
- C:\Windows\System\YVkHQRE.exe
  C:\Windows\System\YVkHQRE.exe
  2⤵
  PID:7916
- C:\Windows\System\lYbkTBC.exe
  C:\Windows\System\lYbkTBC.exe
  2⤵
  PID:7940
- C:\Windows\System\bHAexcd.exe
  C:\Windows\System\bHAexcd.exe
  2⤵
  PID:7956
- C:\Windows\System\Inqvfcd.exe
  C:\Windows\System\Inqvfcd.exe
  2⤵
  PID:7976
- C:\Windows\System\ouxygRj.exe
  C:\Windows\System\ouxygRj.exe
  2⤵
  PID:8024
- C:\Windows\System\xaHpUde.exe
  C:\Windows\System\xaHpUde.exe
  2⤵
  PID:8076
- C:\Windows\System\LOMbNxz.exe
  C:\Windows\System\LOMbNxz.exe
  2⤵
  PID:8092
- C:\Windows\System\EbfFNfm.exe
  C:\Windows\System\EbfFNfm.exe
  2⤵
  PID:8112
- C:\Windows\System\ufohPhr.exe
  C:\Windows\System\ufohPhr.exe
  2⤵
  PID:8152
- C:\Windows\System\qkNWSYN.exe
  C:\Windows\System\qkNWSYN.exe
  2⤵
  PID:8188
- C:\Windows\System\cGhNHEY.exe
  C:\Windows\System\cGhNHEY.exe
  2⤵
  PID:7000
- C:\Windows\System\zpSyuAa.exe
  C:\Windows\System\zpSyuAa.exe
  2⤵
  PID:7208
- C:\Windows\System\vdxCuqk.exe
  C:\Windows\System\vdxCuqk.exe
  2⤵
  PID:7248
- C:\Windows\System\FAWvQdG.exe
  C:\Windows\System\FAWvQdG.exe
  2⤵
  PID:7264
- C:\Windows\System\tMpiJIw.exe
  C:\Windows\System\tMpiJIw.exe
  2⤵
  PID:7312
- C:\Windows\System\HXdbhja.exe
  C:\Windows\System\HXdbhja.exe
  2⤵
  PID:7364
- C:\Windows\System\iTBlflX.exe
  C:\Windows\System\iTBlflX.exe
  2⤵
  PID:7500
- C:\Windows\System\iUNctes.exe
  C:\Windows\System\iUNctes.exe
  2⤵
  PID:7512
- C:\Windows\System\BzcUgLs.exe
  C:\Windows\System\BzcUgLs.exe
  2⤵
  PID:7644
- C:\Windows\System\vsDjfYz.exe
  C:\Windows\System\vsDjfYz.exe
  2⤵
  PID:7696
- C:\Windows\System\YAnrfhI.exe
  C:\Windows\System\YAnrfhI.exe
  2⤵
  PID:7796
- C:\Windows\System\UShBSsw.exe
  C:\Windows\System\UShBSsw.exe
  2⤵
  PID:7928
- C:\Windows\System\wglOEKF.exe
  C:\Windows\System\wglOEKF.exe
  2⤵
  PID:7952
- C:\Windows\System\ECPlppL.exe
  C:\Windows\System\ECPlppL.exe
  2⤵
  PID:8124
- C:\Windows\System\vcvifjx.exe
  C:\Windows\System\vcvifjx.exe
  2⤵
  PID:8108
- C:\Windows\System\xfxjpdT.exe
  C:\Windows\System\xfxjpdT.exe
  2⤵
  PID:8184
- C:\Windows\System\lROJbTB.exe
  C:\Windows\System\lROJbTB.exe
  2⤵
  PID:6428
- C:\Windows\System\EkqRwVV.exe
  C:\Windows\System\EkqRwVV.exe
  2⤵
  PID:6236
- C:\Windows\System\OIeTqGs.exe
  C:\Windows\System\OIeTqGs.exe
  2⤵
  PID:7428
- C:\Windows\System\ccXsGZl.exe
  C:\Windows\System\ccXsGZl.exe
  2⤵
  PID:7280
- C:\Windows\System\bIYuZkH.exe
  C:\Windows\System\bIYuZkH.exe
  2⤵
  PID:7752
- C:\Windows\System\JapbBFN.exe
  C:\Windows\System\JapbBFN.exe
  2⤵
  PID:7984
- C:\Windows\System\vgwcLvd.exe
  C:\Windows\System\vgwcLvd.exe
  2⤵
  PID:8048
- C:\Windows\System\uOZZGUC.exe
  C:\Windows\System\uOZZGUC.exe
  2⤵
  PID:8084
- C:\Windows\System\VHTlIEN.exe
  C:\Windows\System\VHTlIEN.exe
  2⤵
  PID:7204
- C:\Windows\System\iJacVvC.exe
  C:\Windows\System\iJacVvC.exe
  2⤵
  PID:7828
- C:\Windows\System\WiMmhDM.exe
  C:\Windows\System\WiMmhDM.exe
  2⤵
  PID:3808
- C:\Windows\System\PRpPCGf.exe
  C:\Windows\System\PRpPCGf.exe
  2⤵
  PID:7692
- C:\Windows\System\hneaNHD.exe
  C:\Windows\System\hneaNHD.exe
  2⤵
  PID:8216
- C:\Windows\System\vZkzvQm.exe
  C:\Windows\System\vZkzvQm.exe
  2⤵
  PID:8236
- C:\Windows\System\aSXZzlz.exe
  C:\Windows\System\aSXZzlz.exe
  2⤵
  PID:8256
- C:\Windows\System\RoBvPSP.exe
  C:\Windows\System\RoBvPSP.exe
  2⤵
  PID:8284
- C:\Windows\System\GpaAnbu.exe
  C:\Windows\System\GpaAnbu.exe
  2⤵
  PID:8304
- C:\Windows\System\diLrDGI.exe
  C:\Windows\System\diLrDGI.exe
  2⤵
  PID:8324
- C:\Windows\System\UUUvMyA.exe
  C:\Windows\System\UUUvMyA.exe
  2⤵
  PID:8344
- C:\Windows\System\FnKtOhb.exe
  C:\Windows\System\FnKtOhb.exe
  2⤵
  PID:8360
- C:\Windows\System\doPmbuI.exe
  C:\Windows\System\doPmbuI.exe
  2⤵
  PID:8424
- C:\Windows\System\qSxCIYT.exe
  C:\Windows\System\qSxCIYT.exe
  2⤵
  PID:8440
- C:\Windows\System\wucvEOV.exe
  C:\Windows\System\wucvEOV.exe
  2⤵
  PID:8464
- C:\Windows\System\HvgDDAh.exe
  C:\Windows\System\HvgDDAh.exe
  2⤵
  PID:8520
- C:\Windows\System\zNSJOFJ.exe
  C:\Windows\System\zNSJOFJ.exe
  2⤵
  PID:8540
- C:\Windows\System\zEiGWGF.exe
  C:\Windows\System\zEiGWGF.exe
  2⤵
  PID:8568
- C:\Windows\System\litwEUJ.exe
  C:\Windows\System\litwEUJ.exe
  2⤵
  PID:8592
- C:\Windows\System\aiehTDZ.exe
  C:\Windows\System\aiehTDZ.exe
  2⤵
  PID:8620
- C:\Windows\System\fpDWquj.exe
  C:\Windows\System\fpDWquj.exe
  2⤵
  PID:8664
- C:\Windows\System\BKdwUGS.exe
  C:\Windows\System\BKdwUGS.exe
  2⤵
  PID:8680
- C:\Windows\System\MvYMLik.exe
  C:\Windows\System\MvYMLik.exe
  2⤵
  PID:8712
- C:\Windows\System\hYPNbSg.exe
  C:\Windows\System\hYPNbSg.exe
  2⤵
  PID:8740
- C:\Windows\System\hKFAwKx.exe
  C:\Windows\System\hKFAwKx.exe
  2⤵
  PID:8804
- C:\Windows\System\VMyrfPI.exe
  C:\Windows\System\VMyrfPI.exe
  2⤵
  PID:8824
- C:\Windows\System\XEUrfEA.exe
  C:\Windows\System\XEUrfEA.exe
  2⤵
  PID:8852
- C:\Windows\System\fxZzmsu.exe
  C:\Windows\System\fxZzmsu.exe
  2⤵
  PID:8872
- C:\Windows\System\xyZcNBY.exe
  C:\Windows\System\xyZcNBY.exe
  2⤵
  PID:8888
- C:\Windows\System\ErsggOS.exe
  C:\Windows\System\ErsggOS.exe
  2⤵
  PID:8916
- C:\Windows\System\cjRQLzp.exe
  C:\Windows\System\cjRQLzp.exe
  2⤵
  PID:8936
- C:\Windows\System\ZVsMipF.exe
  C:\Windows\System\ZVsMipF.exe
  2⤵
  PID:8968
- C:\Windows\System\LHvmdSX.exe
  C:\Windows\System\LHvmdSX.exe
  2⤵
  PID:9028
- C:\Windows\System\hHuqaHh.exe
  C:\Windows\System\hHuqaHh.exe
  2⤵
  PID:9044
- C:\Windows\System\szNcxHC.exe
  C:\Windows\System\szNcxHC.exe
  2⤵
  PID:9068
- C:\Windows\System\jswluDT.exe
  C:\Windows\System\jswluDT.exe
  2⤵
  PID:9104
- C:\Windows\System\OMsJnNZ.exe
  C:\Windows\System\OMsJnNZ.exe
  2⤵
  PID:9124
- C:\Windows\System\fYIswjA.exe
  C:\Windows\System\fYIswjA.exe
  2⤵
  PID:9164
- C:\Windows\System\lHfpMPf.exe
  C:\Windows\System\lHfpMPf.exe
  2⤵
  PID:9204
- C:\Windows\System\NlYkEVj.exe
  C:\Windows\System\NlYkEVj.exe
  2⤵
  PID:7672
- C:\Windows\System\LHFfBhr.exe
  C:\Windows\System\LHFfBhr.exe
  2⤵
  PID:8208
- C:\Windows\System\KsXuKzN.exe
  C:\Windows\System\KsXuKzN.exe
  2⤵
  PID:8356
- C:\Windows\System\mAdTVUd.exe
  C:\Windows\System\mAdTVUd.exe
  2⤵
  PID:8404
- C:\Windows\System\iAGQYrj.exe
  C:\Windows\System\iAGQYrj.exe
  2⤵
  PID:8420
- C:\Windows\System\xOVAnmg.exe
  C:\Windows\System\xOVAnmg.exe
  2⤵
  PID:8508
- C:\Windows\System\PKcsIfz.exe
  C:\Windows\System\PKcsIfz.exe
  2⤵
  PID:8600
- C:\Windows\System\NUOBAOk.exe
  C:\Windows\System\NUOBAOk.exe
  2⤵
  PID:8560
- C:\Windows\System\EuZSYGU.exe
  C:\Windows\System\EuZSYGU.exe
  2⤵
  PID:8648
- C:\Windows\System\njYdlFV.exe
  C:\Windows\System\njYdlFV.exe
  2⤵
  PID:8732
- C:\Windows\System\CxPBXcT.exe
  C:\Windows\System\CxPBXcT.exe
  2⤵
  PID:8796
- C:\Windows\System\xXGcAZJ.exe
  C:\Windows\System\xXGcAZJ.exe
  2⤵
  PID:8832
- C:\Windows\System\hfigMhj.exe
  C:\Windows\System\hfigMhj.exe
  2⤵
  PID:8908
- C:\Windows\System\SDiIEfX.exe
  C:\Windows\System\SDiIEfX.exe
  2⤵
  PID:8960
- C:\Windows\System\BiwolYI.exe
  C:\Windows\System\BiwolYI.exe
  2⤵
  PID:9096
- C:\Windows\System\yTsInRu.exe
  C:\Windows\System\yTsInRu.exe
  2⤵
  PID:9184
- C:\Windows\System\NLrCWpy.exe
  C:\Windows\System\NLrCWpy.exe
  2⤵
  PID:9160
- C:\Windows\System\FxyCWXH.exe
  C:\Windows\System\FxyCWXH.exe
  2⤵
  PID:8232
- C:\Windows\System\OEtldvA.exe
  C:\Windows\System\OEtldvA.exe
  2⤵
  PID:8332
- C:\Windows\System\vTDYCTj.exe
  C:\Windows\System\vTDYCTj.exe
  2⤵
  PID:8380
- C:\Windows\System\BWOIdlA.exe
  C:\Windows\System\BWOIdlA.exe
  2⤵
  PID:8616
- C:\Windows\System\JAJqkgO.exe
  C:\Windows\System\JAJqkgO.exe
  2⤵
  PID:8976
- C:\Windows\System\TxluWlx.exe
  C:\Windows\System\TxluWlx.exe
  2⤵
  PID:8956
- C:\Windows\System\jYChbRP.exe
  C:\Windows\System\jYChbRP.exe
  2⤵
  PID:8016
- C:\Windows\System\jyTWcTf.exe
  C:\Windows\System\jyTWcTf.exe
  2⤵
  PID:2468
- C:\Windows\System\UYmkIgc.exe
  C:\Windows\System\UYmkIgc.exe
  2⤵
  PID:8576
- C:\Windows\System\hmRqDTT.exe
  C:\Windows\System\hmRqDTT.exe
  2⤵
  PID:404
- C:\Windows\System\mljwHLd.exe
  C:\Windows\System\mljwHLd.exe
  2⤵
  PID:8584
- C:\Windows\System\jPMsPhj.exe
  C:\Windows\System\jPMsPhj.exe
  2⤵
  PID:9228
- C:\Windows\System\srjplWU.exe
  C:\Windows\System\srjplWU.exe
  2⤵
  PID:9244
- C:\Windows\System\AFfEZMX.exe
  C:\Windows\System\AFfEZMX.exe
  2⤵
  PID:9264
- C:\Windows\System\caVtMxr.exe
  C:\Windows\System\caVtMxr.exe
  2⤵
  PID:9308
- C:\Windows\System\fFrsAdV.exe
  C:\Windows\System\fFrsAdV.exe
  2⤵
  PID:9336
- C:\Windows\System\PxMTJkh.exe
  C:\Windows\System\PxMTJkh.exe
  2⤵
  PID:9364
- C:\Windows\System\EzUwRVR.exe
  C:\Windows\System\EzUwRVR.exe
  2⤵
  PID:9408
- C:\Windows\System\NHqmKpU.exe
  C:\Windows\System\NHqmKpU.exe
  2⤵
  PID:9428
- C:\Windows\System\lUCHiBZ.exe
  C:\Windows\System\lUCHiBZ.exe
  2⤵
  PID:9456
- C:\Windows\System\PbheZqn.exe
  C:\Windows\System\PbheZqn.exe
  2⤵
  PID:9488
- C:\Windows\System\iSErUeh.exe
  C:\Windows\System\iSErUeh.exe
  2⤵
  PID:9508
- C:\Windows\System\zpbTmuM.exe
  C:\Windows\System\zpbTmuM.exe
  2⤵
  PID:9528
- C:\Windows\System\tLhxYkw.exe
  C:\Windows\System\tLhxYkw.exe
  2⤵
  PID:9556
- C:\Windows\System\dePNkJE.exe
  C:\Windows\System\dePNkJE.exe
  2⤵
  PID:9576
- C:\Windows\System\htqvdYZ.exe
  C:\Windows\System\htqvdYZ.exe
  2⤵
  PID:9600
- C:\Windows\System\eqTRttY.exe
  C:\Windows\System\eqTRttY.exe
  2⤵
  PID:9616
- C:\Windows\System\MiBupWH.exe
  C:\Windows\System\MiBupWH.exe
  2⤵
  PID:9644
- C:\Windows\System\SSWQTzb.exe
  C:\Windows\System\SSWQTzb.exe
  2⤵
  PID:9680
- C:\Windows\System\IlAknJJ.exe
  C:\Windows\System\IlAknJJ.exe
  2⤵
  PID:9700
- C:\Windows\System\yXsYPhm.exe
  C:\Windows\System\yXsYPhm.exe
  2⤵
  PID:9728
- C:\Windows\System\bsAKPQj.exe
  C:\Windows\System\bsAKPQj.exe
  2⤵
  PID:9824
- C:\Windows\System\vVTDSeX.exe
  C:\Windows\System\vVTDSeX.exe
  2⤵
  PID:9840
- C:\Windows\System\nLxPiUR.exe
  C:\Windows\System\nLxPiUR.exe
  2⤵
  PID:9860
- C:\Windows\System\qJeyeia.exe
  C:\Windows\System\qJeyeia.exe
  2⤵
  PID:9940
- C:\Windows\System\EkVzqvu.exe
  C:\Windows\System\EkVzqvu.exe
  2⤵
  PID:9972
- C:\Windows\System\OmkTHbS.exe
  C:\Windows\System\OmkTHbS.exe
  2⤵
  PID:9988
- C:\Windows\System\yYsWlVg.exe
  C:\Windows\System\yYsWlVg.exe
  2⤵
  PID:10004
- C:\Windows\System\ZafqgwF.exe
  C:\Windows\System\ZafqgwF.exe
  2⤵
  PID:10020
- C:\Windows\System\fjvmhbA.exe
  C:\Windows\System\fjvmhbA.exe
  2⤵
  PID:10036
- C:\Windows\System\ZWqNCcP.exe
  C:\Windows\System\ZWqNCcP.exe
  2⤵
  PID:10116
- C:\Windows\System\LsAvMca.exe
  C:\Windows\System\LsAvMca.exe
  2⤵
  PID:10136
- C:\Windows\System\nngyARg.exe
  C:\Windows\System\nngyARg.exe
  2⤵
  PID:10152
- C:\Windows\System\JtNAODW.exe
  C:\Windows\System\JtNAODW.exe
  2⤵
  PID:10176
- C:\Windows\System\iJuRhyT.exe
  C:\Windows\System\iJuRhyT.exe
  2⤵
  PID:10192
- C:\Windows\System\FgJbNPP.exe
  C:\Windows\System\FgJbNPP.exe
  2⤵
  PID:10220
- C:\Windows\System\WEYIBEj.exe
  C:\Windows\System\WEYIBEj.exe
  2⤵
  PID:8488
- C:\Windows\System\eudEVZd.exe
  C:\Windows\System\eudEVZd.exe
  2⤵
  PID:9256
- C:\Windows\System\JLNstzN.exe
  C:\Windows\System\JLNstzN.exe
  2⤵
  PID:9324
- C:\Windows\System\xbKwpoA.exe
  C:\Windows\System\xbKwpoA.exe
  2⤵
  PID:9344
- C:\Windows\System\IbikSnk.exe
  C:\Windows\System\IbikSnk.exe
  2⤵
  PID:9396
- C:\Windows\System\eDbVNuC.exe
  C:\Windows\System\eDbVNuC.exe
  2⤵
  PID:9448
- C:\Windows\System\ZlzAlwX.exe
  C:\Windows\System\ZlzAlwX.exe
  2⤵
  PID:9660
- C:\Windows\System\qQPWJEi.exe
  C:\Windows\System\qQPWJEi.exe
  2⤵
  PID:9744
- C:\Windows\System\JVzKzqx.exe
  C:\Windows\System\JVzKzqx.exe
  2⤵
  PID:9784
- C:\Windows\System\bcHxHVR.exe
  C:\Windows\System\bcHxHVR.exe
  2⤵
  PID:9832
- C:\Windows\System\MBNZzMJ.exe
  C:\Windows\System\MBNZzMJ.exe
  2⤵
  PID:9984
- C:\Windows\System\CDCAxvO.exe
  C:\Windows\System\CDCAxvO.exe
  2⤵
  PID:9912
- C:\Windows\System\JcZNuxU.exe
  C:\Windows\System\JcZNuxU.exe
  2⤵
  PID:4628
- C:\Windows\System\MzYDIQs.exe
  C:\Windows\System\MzYDIQs.exe
  2⤵
  PID:3732
- C:\Windows\System\hjeCjEy.exe
  C:\Windows\System\hjeCjEy.exe
  2⤵
  PID:10068
- C:\Windows\System\RItOCXm.exe
  C:\Windows\System\RItOCXm.exe
  2⤵
  PID:10076
- C:\Windows\System\TvoCGmA.exe
  C:\Windows\System\TvoCGmA.exe
  2⤵
  PID:10112
- C:\Windows\System\BgGeqBx.exe
  C:\Windows\System\BgGeqBx.exe
  2⤵
  PID:10172
- C:\Windows\System\hriTGcA.exe
  C:\Windows\System\hriTGcA.exe
  2⤵
  PID:9572
- C:\Windows\System\RORCqAj.exe
  C:\Windows\System\RORCqAj.exe
  2⤵
  PID:9420
- C:\Windows\System\nYzdbJJ.exe
  C:\Windows\System\nYzdbJJ.exe
  2⤵
  PID:9932
- C:\Windows\System\uGpUdOp.exe
  C:\Windows\System\uGpUdOp.exe
  2⤵
  PID:9724
- C:\Windows\System\UMzUGXE.exe
  C:\Windows\System\UMzUGXE.exe
  2⤵
  PID:9748
- C:\Windows\System\VDlwPxP.exe
  C:\Windows\System\VDlwPxP.exe
  2⤵
  PID:10088
- C:\Windows\System\RaRQKRG.exe
  C:\Windows\System\RaRQKRG.exe
  2⤵
  PID:10052
- C:\Windows\System\xunUwEo.exe
  C:\Windows\System\xunUwEo.exe
  2⤵
  PID:4656
- C:\Windows\System\ugJUiVN.exe
  C:\Windows\System\ugJUiVN.exe
  2⤵
  PID:9296
- C:\Windows\System\mbKaQtY.exe
  C:\Windows\System\mbKaQtY.exe
  2⤵
  PID:9220
- C:\Windows\System\FSbayzI.exe
  C:\Windows\System\FSbayzI.exe
  2⤵
  PID:9836
- C:\Windows\System\Cbzculc.exe
  C:\Windows\System\Cbzculc.exe
  2⤵
  PID:10104
- C:\Windows\System\MnflUbQ.exe
  C:\Windows\System\MnflUbQ.exe
  2⤵
  PID:9548
- C:\Windows\System\IMGwMAK.exe
  C:\Windows\System\IMGwMAK.exe
  2⤵
  PID:10056
- C:\Windows\System\TbZqPvL.exe
  C:\Windows\System\TbZqPvL.exe
  2⤵
  PID:10260
- C:\Windows\System\GnHCdRb.exe
  C:\Windows\System\GnHCdRb.exe
  2⤵
  PID:10276
- C:\Windows\System\OAXOnCG.exe
  C:\Windows\System\OAXOnCG.exe
  2⤵
  PID:10324
- C:\Windows\System\BsUztOi.exe
  C:\Windows\System\BsUztOi.exe
  2⤵
  PID:10340
- C:\Windows\System\hVcdSAC.exe
  C:\Windows\System\hVcdSAC.exe
  2⤵
  PID:10360
- C:\Windows\System\xYnkoXu.exe
  C:\Windows\System\xYnkoXu.exe
  2⤵
  PID:10388
- C:\Windows\System\vOLQmID.exe
  C:\Windows\System\vOLQmID.exe
  2⤵
  PID:10428
- C:\Windows\System\UtXUuRZ.exe
  C:\Windows\System\UtXUuRZ.exe
  2⤵
  PID:10452
- C:\Windows\System\UQcGDVm.exe
  C:\Windows\System\UQcGDVm.exe
  2⤵
  PID:10468
- C:\Windows\System\xMcJEWD.exe
  C:\Windows\System\xMcJEWD.exe
  2⤵
  PID:10488
- C:\Windows\System\lePSHac.exe
  C:\Windows\System\lePSHac.exe
  2⤵
  PID:10512
- C:\Windows\System\fcjBDwM.exe
  C:\Windows\System\fcjBDwM.exe
  2⤵
  PID:10532
- C:\Windows\System\FxSlrMc.exe
  C:\Windows\System\FxSlrMc.exe
  2⤵
  PID:10556
- C:\Windows\System\hFNbXQz.exe
  C:\Windows\System\hFNbXQz.exe
  2⤵
  PID:10608
- C:\Windows\System\ulObUGj.exe
  C:\Windows\System\ulObUGj.exe
  2⤵
  PID:10628
- C:\Windows\System\FLgBihz.exe
  C:\Windows\System\FLgBihz.exe
  2⤵
  PID:10652
- C:\Windows\System\JfvGpDX.exe
  C:\Windows\System\JfvGpDX.exe
  2⤵
  PID:10672
- C:\Windows\System\jZmKOMy.exe
  C:\Windows\System\jZmKOMy.exe
  2⤵
  PID:10696
- C:\Windows\System\krFWNUb.exe
  C:\Windows\System\krFWNUb.exe
  2⤵
  PID:10764
- C:\Windows\System\vrDVJHi.exe
  C:\Windows\System\vrDVJHi.exe
  2⤵
  PID:10784
- C:\Windows\System\EKscBcf.exe
  C:\Windows\System\EKscBcf.exe
  2⤵
  PID:10800
- C:\Windows\System\kRsrLjs.exe
  C:\Windows\System\kRsrLjs.exe
  2⤵
  PID:10820
- C:\Windows\System\HnajdLZ.exe
  C:\Windows\System\HnajdLZ.exe
  2⤵
  PID:10840
- C:\Windows\System\casEYUP.exe
  C:\Windows\System\casEYUP.exe
  2⤵
  PID:10856
- C:\Windows\System\LCctxEe.exe
  C:\Windows\System\LCctxEe.exe
  2⤵
  PID:10916
- C:\Windows\System\hKYxXDD.exe
  C:\Windows\System\hKYxXDD.exe
  2⤵
  PID:10936
- C:\Windows\System\uXqEcXh.exe
  C:\Windows\System\uXqEcXh.exe
  2⤵
  PID:10980
- C:\Windows\System\SyQyBIb.exe
  C:\Windows\System\SyQyBIb.exe
  2⤵
  PID:10996
- C:\Windows\System\iFRTvPU.exe
  C:\Windows\System\iFRTvPU.exe
  2⤵
  PID:11020
- C:\Windows\System\WlaiLrT.exe
  C:\Windows\System\WlaiLrT.exe
  2⤵
  PID:11040
- C:\Windows\System\jceCBPO.exe
  C:\Windows\System\jceCBPO.exe
  2⤵
  PID:11064
- C:\Windows\System\jSmhnci.exe
  C:\Windows\System\jSmhnci.exe
  2⤵
  PID:11128
- C:\Windows\System\fJTsEsg.exe
  C:\Windows\System\fJTsEsg.exe
  2⤵
  PID:11148
- C:\Windows\System\rQomZfr.exe
  C:\Windows\System\rQomZfr.exe
  2⤵
  PID:11172
- C:\Windows\System\qJZBqGC.exe
  C:\Windows\System\qJZBqGC.exe
  2⤵
  PID:11188
- C:\Windows\System\afzznNz.exe
  C:\Windows\System\afzznNz.exe
  2⤵
  PID:11224
- C:\Windows\System\SkacECW.exe
  C:\Windows\System\SkacECW.exe
  2⤵
  PID:11248
- C:\Windows\System\pcfWPCc.exe
  C:\Windows\System\pcfWPCc.exe
  2⤵
  PID:9212
- C:\Windows\System\TFDJhwr.exe
  C:\Windows\System\TFDJhwr.exe
  2⤵
  PID:10272
- C:\Windows\System\MVuTvlr.exe
  C:\Windows\System\MVuTvlr.exe
  2⤵
  PID:10412
- C:\Windows\System\HqZdhsp.exe
  C:\Windows\System\HqZdhsp.exe
  2⤵
  PID:10508
- C:\Windows\System\PWQGNeW.exe
  C:\Windows\System\PWQGNeW.exe
  2⤵
  PID:10576
- C:\Windows\System\QqhBGPm.exe
  C:\Windows\System\QqhBGPm.exe
  2⤵
  PID:10580
- C:\Windows\System\oKaVHou.exe
  C:\Windows\System\oKaVHou.exe
  2⤵
  PID:10688
- C:\Windows\System\oMIhxaG.exe
  C:\Windows\System\oMIhxaG.exe
  2⤵
  PID:10728
- C:\Windows\System\rhxiGzA.exe
  C:\Windows\System\rhxiGzA.exe
  2⤵
  PID:10752
- C:\Windows\System\JQDXhXk.exe
  C:\Windows\System\JQDXhXk.exe
  2⤵
  PID:10816
- C:\Windows\System\MtjIYHT.exe
  C:\Windows\System\MtjIYHT.exe
  2⤵
  PID:10852
- C:\Windows\System\xfaLcNh.exe
  C:\Windows\System\xfaLcNh.exe
  2⤵
  PID:10932
- C:\Windows\System\fVocJyo.exe
  C:\Windows\System\fVocJyo.exe
  2⤵
  PID:11008
- C:\Windows\System\AgvknSf.exe
  C:\Windows\System\AgvknSf.exe
  2⤵
  PID:11036
- C:\Windows\System\tgDZSTG.exe
  C:\Windows\System\tgDZSTG.exe
  2⤵
  PID:11124
- C:\Windows\System\PUnBRLl.exe
  C:\Windows\System\PUnBRLl.exe
  2⤵
  PID:11156
- C:\Windows\System\CtRIXsr.exe
  C:\Windows\System\CtRIXsr.exe
  2⤵
  PID:11236
- C:\Windows\System\QRkswtD.exe
  C:\Windows\System\QRkswtD.exe
  2⤵
  PID:10436
- C:\Windows\System\ivlefrQ.exe
  C:\Windows\System\ivlefrQ.exe
  2⤵
  PID:10540
- C:\Windows\System\jkbtAYN.exe
  C:\Windows\System\jkbtAYN.exe
  2⤵
  PID:10772
- C:\Windows\System\wbNdsQF.exe
  C:\Windows\System\wbNdsQF.exe
  2⤵
  PID:10864
- C:\Windows\System\zrNHZXJ.exe
  C:\Windows\System\zrNHZXJ.exe
  2⤵
  PID:11084
- C:\Windows\System\jdpzhLZ.exe
  C:\Windows\System\jdpzhLZ.exe
  2⤵
  PID:11096
- C:\Windows\System\uiwPeYk.exe
  C:\Windows\System\uiwPeYk.exe
  2⤵
  PID:10376
- C:\Windows\System\tuGRBVg.exe
  C:\Windows\System\tuGRBVg.exe
  2⤵
  PID:9636
- C:\Windows\System\SYwvtCg.exe
  C:\Windows\System\SYwvtCg.exe
  2⤵
  PID:10648
- C:\Windows\System\zWSghxz.exe
  C:\Windows\System\zWSghxz.exe
  2⤵
  PID:10992
- C:\Windows\System\zVDNeYI.exe
  C:\Windows\System\zVDNeYI.exe
  2⤵
  PID:11272
- C:\Windows\System\qlNbRxl.exe
  C:\Windows\System\qlNbRxl.exe
  2⤵
  PID:11320
- C:\Windows\System\ZWBVfRx.exe
  C:\Windows\System\ZWBVfRx.exe
  2⤵
  PID:11340
- C:\Windows\System\WCmrNiT.exe
  C:\Windows\System\WCmrNiT.exe
  2⤵
  PID:11368
- C:\Windows\System\kJHzOnD.exe
  C:\Windows\System\kJHzOnD.exe
  2⤵
  PID:11392
- C:\Windows\System\nzwgjBQ.exe
  C:\Windows\System\nzwgjBQ.exe
  2⤵
  PID:11408
- C:\Windows\System\jKKgWCD.exe
  C:\Windows\System\jKKgWCD.exe
  2⤵
  PID:11428
- C:\Windows\System\ivmZUov.exe
  C:\Windows\System\ivmZUov.exe
  2⤵
  PID:11452
- C:\Windows\System\eIApzep.exe
  C:\Windows\System\eIApzep.exe
  2⤵
  PID:11472
- C:\Windows\System\VtmDAGm.exe
  C:\Windows\System\VtmDAGm.exe
  2⤵
  PID:11504
- C:\Windows\System\xEodrov.exe
  C:\Windows\System\xEodrov.exe
  2⤵
  PID:11524
- C:\Windows\System\vzTVhPY.exe
  C:\Windows\System\vzTVhPY.exe
  2⤵
  PID:11548
- C:\Windows\System\AGmJPfW.exe
  C:\Windows\System\AGmJPfW.exe
  2⤵
  PID:11568
- C:\Windows\System\ZjcPfEC.exe
  C:\Windows\System\ZjcPfEC.exe
  2⤵
  PID:11624
- C:\Windows\System\jMBxLRE.exe
  C:\Windows\System\jMBxLRE.exe
  2⤵
  PID:11664
- C:\Windows\System\WzfJfxe.exe
  C:\Windows\System\WzfJfxe.exe
  2⤵
  PID:11684
- C:\Windows\System\NMsZvQl.exe
  C:\Windows\System\NMsZvQl.exe
  2⤵
  PID:11712
- C:\Windows\System\DSPaJXq.exe
  C:\Windows\System\DSPaJXq.exe
  2⤵
  PID:11756
- C:\Windows\System\kTTtlyY.exe
  C:\Windows\System\kTTtlyY.exe
  2⤵
  PID:11780
- C:\Windows\System\IrTVOSj.exe
  C:\Windows\System\IrTVOSj.exe
  2⤵
  PID:11804
- C:\Windows\System\AlfDefe.exe
  C:\Windows\System\AlfDefe.exe
  2⤵
  PID:11836
- C:\Windows\System\PNMyFTU.exe
  C:\Windows\System\PNMyFTU.exe
  2⤵
  PID:11868
- C:\Windows\System\CoidmyE.exe
  C:\Windows\System\CoidmyE.exe
  2⤵
  PID:11904
- C:\Windows\System\cIFmPrZ.exe
  C:\Windows\System\cIFmPrZ.exe
  2⤵
  PID:11928
- C:\Windows\System\WGrCZur.exe
  C:\Windows\System\WGrCZur.exe
  2⤵
  PID:11948
- C:\Windows\System\RxHWYWu.exe
  C:\Windows\System\RxHWYWu.exe
  2⤵
  PID:11968
- C:\Windows\System\XjKDvbp.exe
  C:\Windows\System\XjKDvbp.exe
  2⤵
  PID:11992
- C:\Windows\System\qUCaVqo.exe
  C:\Windows\System\qUCaVqo.exe
  2⤵
  PID:12036
- C:\Windows\System\PnxQYKm.exe
  C:\Windows\System\PnxQYKm.exe
  2⤵
  PID:12060
- C:\Windows\System\mPQcBDt.exe
  C:\Windows\System\mPQcBDt.exe
  2⤵
  PID:12080
- C:\Windows\System\NDoAtGw.exe
  C:\Windows\System\NDoAtGw.exe
  2⤵
  PID:12104
- C:\Windows\System\njgzqNq.exe
  C:\Windows\System\njgzqNq.exe
  2⤵
  PID:12144
- C:\Windows\System\xngOWuA.exe
  C:\Windows\System\xngOWuA.exe
  2⤵
  PID:12176
- C:\Windows\System\aWNFAzt.exe
  C:\Windows\System\aWNFAzt.exe
  2⤵
  PID:12204
- C:\Windows\System\KqGZcRk.exe
  C:\Windows\System\KqGZcRk.exe
  2⤵
  PID:12232
- C:\Windows\System\ojWhcMW.exe
  C:\Windows\System\ojWhcMW.exe
  2⤵
  PID:12252
- C:\Windows\System\HEaIXul.exe
  C:\Windows\System\HEaIXul.exe
  2⤵
  PID:12272
- C:\Windows\System\bgAWbzP.exe
  C:\Windows\System\bgAWbzP.exe
  2⤵
  PID:10952
- C:\Windows\System\qKubNyz.exe
  C:\Windows\System\qKubNyz.exe
  2⤵
  PID:11312
- C:\Windows\System\NIibWXK.exe
  C:\Windows\System\NIibWXK.exe
  2⤵
  PID:11352
- C:\Windows\System\lBJKvpy.exe
  C:\Windows\System\lBJKvpy.exe
  2⤵
  PID:11380
- C:\Windows\System\EKbtVKz.exe
  C:\Windows\System\EKbtVKz.exe
  2⤵
  PID:11436
- C:\Windows\System\siSpDfi.exe
  C:\Windows\System\siSpDfi.exe
  2⤵
  PID:11588
- C:\Windows\System\qJhsUwb.exe
  C:\Windows\System\qJhsUwb.exe
  2⤵
  PID:11680
- C:\Windows\System\SnbxZjB.exe
  C:\Windows\System\SnbxZjB.exe
  2⤵
  PID:11736
- C:\Windows\System\RGqMcvt.exe
  C:\Windows\System\RGqMcvt.exe
  2⤵
  PID:11776
- C:\Windows\System\HJHFygn.exe
  C:\Windows\System\HJHFygn.exe
  2⤵
  PID:11828
- C:\Windows\System\zFFOLcx.exe
  C:\Windows\System\zFFOLcx.exe
  2⤵
  PID:11052
- C:\Windows\System\nFZtZXj.exe
  C:\Windows\System\nFZtZXj.exe
  2⤵
  PID:1464
- C:\Windows\System\ySDkrrL.exe
  C:\Windows\System\ySDkrrL.exe
  2⤵
  PID:12012
- C:\Windows\System\esHQBQr.exe
  C:\Windows\System\esHQBQr.exe
  2⤵
  PID:12024
- C:\Windows\System\uuMKNtS.exe
  C:\Windows\System\uuMKNtS.exe
  2⤵
  PID:12100
- C:\Windows\System\VqQVhzL.exe
  C:\Windows\System\VqQVhzL.exe
  2⤵
  PID:12156
- C:\Windows\System\dbtDiDY.exe
  C:\Windows\System\dbtDiDY.exe
  2⤵
  PID:12212
- C:\Windows\System\dHTBAVK.exe
  C:\Windows\System\dHTBAVK.exe
  2⤵
  PID:12224
- C:\Windows\System\ileXnhO.exe
  C:\Windows\System\ileXnhO.exe
  2⤵
  PID:12268
- C:\Windows\System\DuvbyVw.exe
  C:\Windows\System\DuvbyVw.exe
  2⤵
  PID:10592
- C:\Windows\System\xQFjaqW.exe
  C:\Windows\System\xQFjaqW.exe
  2⤵
  PID:11500
- C:\Windows\System\PEMdRhy.exe
  C:\Windows\System\PEMdRhy.exe
  2⤵
  PID:11820
- C:\Windows\System\CTqqMCe.exe
  C:\Windows\System\CTqqMCe.exe
  2⤵
  PID:12008
- C:\Windows\System\XEMHYuP.exe
  C:\Windows\System\XEMHYuP.exe
  2⤵
  PID:2804
- C:\Windows\System\WkyFqWK.exe
  C:\Windows\System\WkyFqWK.exe
  2⤵
  PID:12184
- C:\Windows\System\hdzyndp.exe
  C:\Windows\System\hdzyndp.exe
  2⤵
  PID:12264
- C:\Windows\System\NqpoHHa.exe
  C:\Windows\System\NqpoHHa.exe
  2⤵
  PID:11060
- C:\Windows\System\ELLCkfF.exe
  C:\Windows\System\ELLCkfF.exe
  2⤵
  PID:12140
- C:\Windows\System\rkFYPHL.exe
  C:\Windows\System\rkFYPHL.exe
  2⤵
  PID:12196
- C:\Windows\System\yybjfEy.exe
  C:\Windows\System\yybjfEy.exe
  2⤵
  PID:11864
- C:\Windows\System\BdnNLkk.exe
  C:\Windows\System\BdnNLkk.exe
  2⤵
  PID:12316
- C:\Windows\System\mcFBMQB.exe
  C:\Windows\System\mcFBMQB.exe
  2⤵
  PID:12348
- C:\Windows\System\ZkwIXTB.exe
  C:\Windows\System\ZkwIXTB.exe
  2⤵
  PID:12368
- C:\Windows\System\ZzHyxBL.exe
  C:\Windows\System\ZzHyxBL.exe
  2⤵
  PID:12392
- C:\Windows\System\CvVdHkb.exe
  C:\Windows\System\CvVdHkb.exe
  2⤵
  PID:12420
- C:\Windows\System\xVlfWfI.exe
  C:\Windows\System\xVlfWfI.exe
  2⤵
  PID:12440
- C:\Windows\System\vueyiVp.exe
  C:\Windows\System\vueyiVp.exe
  2⤵
  PID:12476
- C:\Windows\System\QxkpAWo.exe
  C:\Windows\System\QxkpAWo.exe
  2⤵
  PID:12496
- C:\Windows\System\EagGtAV.exe
  C:\Windows\System\EagGtAV.exe
  2⤵
  PID:12520
- C:\Windows\System\OSpNbvj.exe
  C:\Windows\System\OSpNbvj.exe
  2⤵
  PID:12540
- C:\Windows\System\lPoPgUS.exe
  C:\Windows\System\lPoPgUS.exe
  2⤵
  PID:12596
- C:\Windows\System\lrCUuOx.exe
  C:\Windows\System\lrCUuOx.exe
  2⤵
  PID:12636
- C:\Windows\System\CizIlKE.exe
  C:\Windows\System\CizIlKE.exe
  2⤵
  PID:12656
- C:\Windows\System\zenGIvT.exe
  C:\Windows\System\zenGIvT.exe
  2⤵
  PID:12672
- C:\Windows\System\VAeFSNV.exe
  C:\Windows\System\VAeFSNV.exe
  2⤵
  PID:12700
- C:\Windows\System\IOuHasI.exe
  C:\Windows\System\IOuHasI.exe
  2⤵
  PID:12752
- C:\Windows\System\lAYiiPF.exe
  C:\Windows\System\lAYiiPF.exe
  2⤵
  PID:12768
- C:\Windows\System\MaNgYur.exe
  C:\Windows\System\MaNgYur.exe
  2⤵
  PID:12788
- C:\Windows\System\iMAuEIK.exe
  C:\Windows\System\iMAuEIK.exe
  2⤵
  PID:12808
- C:\Windows\System\DrQIAmn.exe
  C:\Windows\System\DrQIAmn.exe
  2⤵
  PID:12948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yutk2vnd.cyh.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\CVlTPyV.exe

Filesize
1.4MB

MD5
b9d9152cc747a22103f9b82abc64f303

SHA1
741bc4e39ee5433a414105eef612c98fe680c28d

SHA256
99ab224dc2b08c57ab91591cdc5e297cc16fa2f3f80278424baaf8bfd9f9b847

SHA512
af6352a80a400e9e543836cf01543990e2863b5c46a65c6af6984654f86112fe0e2f85d2f51f934fd86c2de4ac9cd67236ce4d5efb8325a9b0e7bb9476ef2ec9

Download Submit
C:\Windows\System\DLmHRUq.exe

Filesize
1.4MB

MD5
1d45d177eee731be58efe5ead29c7bda

SHA1
faecc2da2b601b388f6eaf2bc04c78bcdfd5ee67

SHA256
3a0dba99f3b294f476af680501989fd3778ffe54f8cbcdce9c62a85d22ca1b32

SHA512
1e91a9773692e9d9a6bdc249034367b171ab40a710682b0d0d8485ca124a2eb037cdcfcbf40183dc3d5d9642714ff1523b3ee56bcd3442f4d2e6f4e5db86cc52

Download Submit
C:\Windows\System\EFphaxn.exe

Filesize
1.4MB

MD5
b56bc352e1954ef5264b0339e5e7d55e

SHA1
2902b56731ba38824cd890bcecff8cbd000a7c4a

SHA256
38c61737e0de007d63c9579f35045783828dfac85b4d40b72286514e98318172

SHA512
ee017fc9dc7651f6217b0a7ef8ed47d0a1c8a496068add88ce54e8fb112c7d317f29851ca9d853e7a7c06ccca99a693eb2813a3be32ca1122c90258ee6c3debc

Download Submit
C:\Windows\System\EiNgwSB.exe

Filesize
1.4MB

MD5
840d5dc4ced2e1f6ca4ad98825352465

SHA1
37d754d4a7bb758849c92a15305a87b2bbc4ef0e

SHA256
7497b337205bc7d471bc76a146bc990c652cea8fcb18d45f6da11a42e3cc5247

SHA512
60946cdd01bc72b8a5248e8c6cde6401ef521464707f15c4dcbf36ad2c228bb70c61cefcdd0d82d366d6a528de9f4ff7e1adca84939c4ebae7d766c1e909904a

Download Submit
C:\Windows\System\HTDCJiG.exe

Filesize
1.4MB

MD5
5922459ebc044617f580cb1f5415c511

SHA1
759edf6d139a7c00a51029db6ab25e404d2533bf

SHA256
4abc1bff0a149da327a807d6073d4fc07e4bbfe5d469bff87a3a75d4cc7edfe9

SHA512
9972751bdef9b95d40ef0bd16fed4b4834114e42a8eafa39dadde6c805ae71452d7afee008de8f2f7b8f74bc6a4385b13deef0de513f71c0ef7e891ac5118885

Download Submit
C:\Windows\System\ItnMaOU.exe

Filesize
1.4MB

MD5
8f3b0f34f9d3eced60d630601a5f91f4

SHA1
935edfdf3e12a19dfb71fce2c09c02063eba6a23

SHA256
8ff11a5c93032752ed2eb86c745fe2896c870ae724be0583cb60ee6fe03da02d

SHA512
a31640ca49de6721afb50ecb46f261bc6dc04922e004c6358cac2e176fec7c1abada7b8d24b6cde127dc44331d36d1326343c6a04b2e21aebcd0b21a9d901799

Download Submit
C:\Windows\System\JseuLmz.exe

Filesize
1.4MB

MD5
a7158ca3fbfff43672bd429b0b2e5b40

SHA1
88cb54d9249e04d9246f8265822dc2a513dde2ee

SHA256
06b75a578390830497753cff2ae6e33254feb9c176dcf013bbdd2fd335cae44b

SHA512
3bb4dd3f7e8c68afbe444e9f1b39c8f682fa4d0aa469fa21b29ed810446a71b6a1c2fa9c183f1258ba8b27d836b4e8825c1395ced342d25fe3f1fb0808a1a086

Download Submit
C:\Windows\System\KMsycdH.exe

Filesize
1.4MB

MD5
022f5c5f4268ddda946b3301d8db3565

SHA1
900e4506e66daa02968c28c4fb7969ae2fc47e8b

SHA256
7b8443ae778d45350e08dbb179987f81bd2f9d330062d502b372dee19eb2fc8a

SHA512
2d19b0df0502b0f36102c581396a57aab3e973c0cddcaf8d54952d8b4f5fc581243f702f6563095100e87dfd47b9289af61cf6566fa520bf3368b3f6f6d7169b

Download Submit
C:\Windows\System\NakxUcJ.exe

Filesize
1.4MB

MD5
65c573a2de8b8a302c2ff3ae49b4469d

SHA1
5bbb32331827d5cf8656c47243c506d2d2933e20

SHA256
30857f4589560deb55af3c1632e4030a9fd2f62fdab4e08183ac63819e730acf

SHA512
e5c0c87314bf3dd00c6b68300f385ab72708850b4106a6ff0c2cd495bc9dd944b3232ff08fc5d730159395997f6b03f424074557de02bb58a20356a717544dc5

Download Submit
C:\Windows\System\OBOtJDx.exe

Filesize
1.4MB

MD5
93e98fd6f1e3dccd27ce2432c0195be2

SHA1
e0f69438f76e7b2610ac172f3eaf2d7eb7d1737a

SHA256
38db010815e784596dbbdb0e0c51eb7daf089ecee3a5cc2b81d2f3d07e83398c

SHA512
600aa317539277fa12403e35221fd395df253238800a22c6bebd3e1848ee5d0c8c54e775dbe9e0d48281f8983241a9c1fba4e296eda5c434ef4550069f0e3c30

Download Submit
C:\Windows\System\OgydFLB.exe

Filesize
1.4MB

MD5
bb1f5f7ff5a2e623da1d6b1a3f3de58f

SHA1
5b2fc12e621458f5d878969524165853d214487d

SHA256
c40d53a9d40e5a07ce6d5416af07bce43f7ebc2f1329dc24904986c54a55a4b0

SHA512
1c279be7c1d7e6940d94a4bf44db209408d7974843aa8a9a61ffed89bcd261235a5119956fe1f4d71dfc55fb48a260e081e83a389e22f1232d8962fdb47126a7

Download Submit
C:\Windows\System\QUoOCzm.exe

Filesize
1.4MB

MD5
5a0e541817de667c4f19dca70ca1136a

SHA1
ad03cedeaab62e52381a5c724fcfb47e7cb5b8a8

SHA256
24fd79806eca7adf3f1447676ee669118555703b12b9820422d8f591ea34198b

SHA512
2d593c6e3a4372c3cc5cee15714886c343f955bb2ec15c1a707873ee5bf1fdf389b0a0de5cbb2a8d334af175fe167da684780ff385df5011c60223ebd9032ab9

Download Submit
C:\Windows\System\RHSqQQo.exe

Filesize
1.4MB

MD5
cfcb5511e6a4e7d1b3a08fe4c5b4d1df

SHA1
1e4a8a8bac34528ee073dd1d0ce54f88a196668c

SHA256
c84b29ec734c7860ee6c1e9def39d3de3e7b3251cc69b3daf679cfa2424c99be

SHA512
faae3581ffe8214c4d8fa7e9a8bc1259cf7030b0e128ba8b7ddf7f3ee5d91b7759806593479bb28a64bfffdcb1d1ab78028592a6d9ba57aeb406ffb4328ed61b

Download Submit
C:\Windows\System\RNfCRDy.exe

Filesize
1.4MB

MD5
1b7cb68ee1edd104578bac0b1dae4c52

SHA1
ba09c79dec21a4ea3fc71172008906664ace99fb

SHA256
c54bdb76c77cc61a2e44f3c4996db7f26ed7b0ee0a7c46441142634baebabfb7

SHA512
0df14007ab67fe09aecd1ef2b4a93af5a64f7bce6fe41267baec9f525a9fa7b7c2305ae0080f039eaf5ec7880590e7c4568c946b3d543bfe4fd1e76928876b3a

Download Submit
C:\Windows\System\RmeBzVT.exe

Filesize
1.4MB

MD5
79d9d1cb2575221f3805bf3e3ad55eb0

SHA1
da318dce8df8c61eeafc7d98aaf25df188d7fcf2

SHA256
1fb02b0efacf4cf06731e55e93af3aeb85f69cf670c965377636a4bbd800afa7

SHA512
80a51d4723113856260bf3209b1e14f108fedf2d23ac2b3725ce0b1fa8e440cad65d50b4200e9c1e9f28bb7f39955d96a820cd5bd92ed653f82dfcfa79f82f77

Download Submit
C:\Windows\System\XJMKcRh.exe

Filesize
1.4MB

MD5
d09921db4e43d4076464e60e3de82be5

SHA1
4d3a0d0a88db8efe8dbc19ecee903fc89390aa30

SHA256
46b3ef3e1b447abfb2efa485755f24b6101ff8f82f7942bfa84db68d443ae0af

SHA512
5644cd591c861f6a3d6d2e0fe629d0a7ce78b0202f5788f54b4f7a18716d37eeca2d18d39f6c1fc98a35943d1f6bd319ddd7a7e56dd32b360fb6543819d9407a

Download Submit
C:\Windows\System\YZnFIkg.exe

Filesize
1.4MB

MD5
8c69c7628f1b43705efbe92a48b11878

SHA1
0bead0dbcd394b693e0a5e808d40047107d8edd1

SHA256
c3ff84366881614743eb6d353248793a5e97596f1b3eef43a44c2078041ec365

SHA512
d6a89886074604bdcc6df35119b92fecf8b7699dd865aa26cd644f53d200cbfe53cc9a831e39bd1e67d8f0bc4f1e33c1babab0fdcf90a70b0deab1ebfd945201

Download Submit
C:\Windows\System\ZIyWjBh.exe

Filesize
1.4MB

MD5
240e008178010ba18f44b2cdbade1feb

SHA1
ed3d23a7a553ef160d3aac0c6566ceb8093f0f3d

SHA256
54434d88432af64b0bc1f4bcf5e52bd480a1f59a4d5582e8e8da7996e5814e2b

SHA512
d43457755bfba9a75b5113076bc856297dd5900ec094ecc28e85a43ffc95b4dd7b5e5795b3b3fc5dc4afefe998f3bc312550070e2b05bbff2cc5ba56674b455a

Download Submit
C:\Windows\System\ZyOyOoz.exe

Filesize
1.4MB

MD5
748300255ac8640a856e3f7293314ebb

SHA1
5d6b574f37d5161229398ec5c201e6ce9095c0ba

SHA256
d4307f6f1e5d547344fdbc934aff5e8c245cd5180f85d6d659fee54a6027b220

SHA512
7e8744b1df0ae89d5a5f0cfbdc76886ac68dbfc09bb99833af65aa091cb0f995bb2469a10815c564919e48aae83c127466ecd8df1653234d2b390ed015a01214

Download Submit
C:\Windows\System\aYcnKHE.exe

Filesize
1.4MB

MD5
2ee170105be9c5a3c41adb1c16b6c96f

SHA1
81a2d77629edec1d5d72e784fe0d4124ac21c2b5

SHA256
7f24c066aa5d93c58b9eea0cf1a42414f0c9e208a54c4d8c9ccd19abff3d8b51

SHA512
bee253992ec0fceab21b8ee3fe558b57fcbde4973ca53db1aa19633be7d0af46b276dcecadf4c5472a5c782ff3eca4a7ff94446673323be07a8f1c996d3c58a3

Download Submit
C:\Windows\System\acjwPTI.exe

Filesize
1.4MB

MD5
a2613ed100eda1d7437204bd1381dd5a

SHA1
03b4a1b60066ceb0f453fbe2c5dcf0b84ff256a0

SHA256
273e582bb6288a27613263c60e514cf35e29dca8ceae4442ada0cfe25cb8a10f

SHA512
3caf1e55cf0cb6d52b9b0b3ac1f5f87ef9ea4162a77582c1c689347472695b0d8a7ffd8dd59ab7b7dfb1821c04bd340938a0b82b21b7ddffad2954fb23cd1cae

Download Submit
C:\Windows\System\bBjyJPc.exe

Filesize
1.4MB

MD5
5de8ce264efc80a8201fd4cc344381bd

SHA1
f2eda64c40318380b681a8b44ac8ce8b172b9b3b

SHA256
8bb5055fc9c64e75148815a2c48f5e848c869bab8312e1faebe6ee7bfd963c81

SHA512
1f573c9e72c9ae742884d8da3fec2e01b6932a95a2ec6b4d805ffbeabf3d2524954d44564116c2a3dd616290f9fa5c52008ba7ff57e1994b58ed47e2a18982d6

Download Submit
C:\Windows\System\dgIOoIf.exe

Filesize
1.4MB

MD5
3bfb9f4f4b9c9ad38f52f40ce8326d6c

SHA1
aceb5c5683390d6087a53755df5b109abfd85979

SHA256
2a6efdcf3d10576cf359d94cd181472858cf37b54773e02cde012da3d9c47e6b

SHA512
9f5d82600c51a940268a17fc2feca068c1e0b0fc6c2e02f15ffb461c898f83acbb6320181353b0c5d75dc30d5ccd200b314932cb61de9c2e1ba6c1b708af1341

Download Submit
C:\Windows\System\jpRWulu.exe

Filesize
1.4MB

MD5
ab2257f59d1c65a100ca4d8fbbe7d55d

SHA1
4e31f9bfd8f3584eeada6af761f14132081700ed

SHA256
127e77cdb7e8afbf3bf8b2ab0e3c1cc2d2e9be2db8df0e9c8053b2298131d02d

SHA512
04cba9697b8a9d718653deb169d2c6d342a6ba51b3f462ce4ee2d9f9ee1611f0b77818424d5b3bd43a251bfb5680b27e46ab3593a23e0e85b2189fa30dca6173

Download Submit
C:\Windows\System\lHuTDGp.exe

Filesize
1.4MB

MD5
a417a39bf0b6a5a73d2ef4bea48f874c

SHA1
e9e77749e7dee47e641b50fdd73ed9080176edb1

SHA256
a93b2da56c981a814419afd56469f28a7c5f2e85cf9acb4c58331d4716c28611

SHA512
aed456d8eed10655bd16c74f35f51972721904aaa0fa63b261c65b1a8026f908ee5b79b67b6cf113f130c2587e96f79d2798ac14ad0a8042a873fcb42d3f3d8d

Download Submit
C:\Windows\System\pKtleBv.exe

Filesize
1.4MB

MD5
b2c82192038eb0711a3f90670637af1c

SHA1
40813a11646390f4e7cdc2588131fb3a9a2b8129

SHA256
d597932fef281a408e9d446ec46bcc6439197be0f0f514c8e458bdc188508da0

SHA512
ee84585228b38d7dbe09fb9a09296e16a1f2b02257b0a447ac99e7848bb5007674e9a482650f307da5c64b008b4679286ac606d9ef2093e8b6350993c66fbdc3

Download Submit
C:\Windows\System\qjSxiFA.exe

Filesize
1.4MB

MD5
35f0c6eedbb645a1ead09a71ccf9d388

SHA1
545518c8004bb38bb4a3e14df8d9f54e4cb216ad

SHA256
98f859f50253fbf70bf05499c9688df6455024b419f338e5cef4dd2c11af3e50

SHA512
f76ca9400fa1c76811e695245f2084b6f07ab4fea5fd58454fc0ae749e89bcb6a06b7bb0deb7929de828b2b1f2ba4cd1bcc8b07b18584b214ad5a08fde8f970c

Download Submit
C:\Windows\System\uJXQxxZ.exe

Filesize
1.4MB

MD5
184fb9d74f7b99da8a70393d0e33d1c3

SHA1
ce537fe7c40cacfced30ea103df79b4d5dcd585f

SHA256
1449f85be9d86c4371b658b7e768637189002e77b90eef4b7d653b981ab71a1e

SHA512
e188abfcadf5ad956387bb6d35e475a19f479a5c33ec60cb4b4e537240ad0dfffd2068b8cbcac5b3a5d0cc33a9a840bbc2e71064187b4268fd3394a9ce7b824d

Download Submit
C:\Windows\System\xAGxSMl.exe

Filesize
1.4MB

MD5
9d1cddbba006ed77eae2f2e1934fb032

SHA1
2fdccce26fddac78a649aff7665926f5ecc647cb

SHA256
044314a8e3c244007242ac9a73ce27bebb2ac2a48cbe1eccf4d71d15ecbd689c

SHA512
c50f4c69933f2cad3b33ea17c35a796e538ceaa20874438a83a9e35334bf646f1ad36f9879cad459147ac2dd4820e66731f3c1ed240ab5b4ed9b16a6f5ad6a6a

Download Submit
C:\Windows\System\xaUmaSr.exe

Filesize
1.4MB

MD5
e1126dee762a47658672454064cd3c09

SHA1
27b3286b4b2f635732069a18d99a2550a040d2e8

SHA256
6109aa628f03d810de96973dfb5c696408a68871f7080197d3bdc247c7ef2f9b

SHA512
20fb6748d8ddbc5fb1d4c77956c771b77c90f71de2a5ade1fe9554a8b3d76c95107100c9bb1ba37ab359d03ce14dbd4f162b1c7c84ee1ebfa79a84b2269eb93b

Download Submit
C:\Windows\System\yRkPxHS.exe

Filesize
1.4MB

MD5
c502044b66554a950d451d189015289d

SHA1
267fccf431a52883b86cbe7c8230343f6bd96055

SHA256
82085c5bc06fa16d08b7f768e2b1da479d0f0355c19e480cd2346c5cd65b45f3

SHA512
cbe31cc01e9ab6363ea14b1a127a61dfa48a48dfb2373602754cd0ab7e0fa814cd98101e3f550e2584da925d730730889772e282c306ff9fdcf882bf6a10a18b

Download Submit
C:\Windows\System\yTCglTx.exe

Filesize
8B

MD5
cf50e241303d497858ee01855fb582c8

SHA1
071c6ca1d65e04749f98c6a703cbc804ec84ade3

SHA256
501a1602089109b7d1620eb45678928ef48594bd3e9d379e4d9cd5c0f3bdf610

SHA512
9acf492462174dc95aadbf576467af6a3992f55fe198a880427aa6ca9bf21c04fc7a421b1986a9d47e9b0a48e3c4b3d86850c8700c25e99a738c34f1ba7766bb

Download Submit
C:\Windows\System\yXWuSbv.exe

Filesize
1.4MB

MD5
98fd803e8f4ab2c260f5f86aa842d0e2

SHA1
0497c5f08401f17fe6ce3fba42bddbb5dd551b74

SHA256
3a4a1b511cf8a5947f584e34d5520d9f7a263f59ad417ee0844a32e928dc14d3

SHA512
b39d7ec0c59526f89442bf0ca09ba8cf4ff4ceed390006231d83866509dd4da43e412527d3baafe97b8243b139f2a7fd9731d2c7d000095892337c7f9107eaa9

Download Submit
C:\Windows\System\zMxoYzj.exe

Filesize
1.4MB

MD5
ab2a28f2c91adfe8a204189096de2e6f

SHA1
ede23703993b19b95ea1124d38b58a03e8e18cb8

SHA256
eef355ac9d6700489f8e0803fe9563d588e09ffbc60611c883a338bf917c4764

SHA512
3e03382d347bedab9807e72db3c1ba6df11c41edd7073f43413d8f370891db47c77a594154768640d6f19e47341f9d707708c7659342250d8a7a0f44ccf254dc

Download Submit
memory/1112-2031-0x00007FF749B00000-0x00007FF749EF2000-memory.dmp

Filesize
3.9MB

Download
memory/1112-387-0x00007FF749B00000-0x00007FF749EF2000-memory.dmp

Filesize
3.9MB

Download
memory/1448-2066-0x00007FF6587B0000-0x00007FF658BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1448-469-0x00007FF6587B0000-0x00007FF658BA2000-memory.dmp

Filesize
3.9MB

Download
memory/1684-2073-0x00007FF7BF550000-0x00007FF7BF942000-memory.dmp

Filesize
3.9MB

Download
memory/1684-479-0x00007FF7BF550000-0x00007FF7BF942000-memory.dmp

Filesize
3.9MB

Download
memory/1884-2039-0x00007FF692110000-0x00007FF692502000-memory.dmp

Filesize
3.9MB

Download
memory/1884-400-0x00007FF692110000-0x00007FF692502000-memory.dmp

Filesize
3.9MB

Download
memory/2024-27-0x00007FF6F34F0000-0x00007FF6F38E2000-memory.dmp

Filesize
3.9MB

Download
memory/2024-2028-0x00007FF6F34F0000-0x00007FF6F38E2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-2069-0x00007FF7A0F30000-0x00007FF7A1322000-memory.dmp

Filesize
3.9MB

Download
memory/2120-472-0x00007FF7A0F30000-0x00007FF7A1322000-memory.dmp

Filesize
3.9MB

Download
memory/2144-2042-0x00007FF79B980000-0x00007FF79BD72000-memory.dmp

Filesize
3.9MB

Download
memory/2144-487-0x00007FF79B980000-0x00007FF79BD72000-memory.dmp

Filesize
3.9MB

Download
memory/2148-406-0x00007FF6E6C40000-0x00007FF6E7032000-memory.dmp

Filesize
3.9MB

Download
memory/2148-2044-0x00007FF6E6C40000-0x00007FF6E7032000-memory.dmp

Filesize
3.9MB

Download
memory/2708-447-0x00007FF692900000-0x00007FF692CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-2060-0x00007FF692900000-0x00007FF692CF2000-memory.dmp

Filesize
3.9MB

Download
memory/2968-463-0x00007FF7DF720000-0x00007FF7DFB12000-memory.dmp

Filesize
3.9MB

Download
memory/2968-2068-0x00007FF7DF720000-0x00007FF7DFB12000-memory.dmp

Filesize
3.9MB

Download
memory/3004-2021-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp

Filesize
10.8MB

Download
memory/3004-367-0x00000273AC520000-0x00000273ACCC6000-memory.dmp

Filesize
7.6MB

Download
memory/3004-2011-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp

Filesize
10.8MB

Download
memory/3004-57-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp

Filesize
10.8MB

Download
memory/3004-38-0x00000273AB840000-0x00000273AB862000-memory.dmp

Filesize
136KB

Download
memory/3004-5-0x00007FFA75253000-0x00007FFA75255000-memory.dmp

Filesize
8KB

Download
memory/3004-2010-0x00007FFA75253000-0x00007FFA75255000-memory.dmp

Filesize
8KB

Download
memory/3004-21-0x00007FFA75250000-0x00007FFA75D11000-memory.dmp

Filesize
10.8MB

Download
memory/3160-488-0x00007FF7CAF10000-0x00007FF7CB302000-memory.dmp

Filesize
3.9MB

Download
memory/3160-2050-0x00007FF7CAF10000-0x00007FF7CB302000-memory.dmp

Filesize
3.9MB

Download
memory/3516-2064-0x00007FF716E00000-0x00007FF7171F2000-memory.dmp

Filesize
3.9MB

Download
memory/3516-456-0x00007FF716E00000-0x00007FF7171F2000-memory.dmp

Filesize
3.9MB

Download
memory/3576-2026-0x00007FF61D660000-0x00007FF61DA52000-memory.dmp

Filesize
3.9MB

Download
memory/3576-486-0x00007FF61D660000-0x00007FF61DA52000-memory.dmp

Filesize
3.9MB

Download
memory/3660-489-0x00007FF61A500000-0x00007FF61A8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3660-2053-0x00007FF61A500000-0x00007FF61A8F2000-memory.dmp

Filesize
3.9MB

Download
memory/3864-405-0x00007FF74D0F0000-0x00007FF74D4E2000-memory.dmp

Filesize
3.9MB

Download
memory/3864-2037-0x00007FF74D0F0000-0x00007FF74D4E2000-memory.dmp

Filesize
3.9MB

Download
memory/4076-2046-0x00007FF786420000-0x00007FF786812000-memory.dmp

Filesize
3.9MB

Download
memory/4076-426-0x00007FF786420000-0x00007FF786812000-memory.dmp

Filesize
3.9MB

Download
memory/4196-66-0x00007FF74CA70000-0x00007FF74CE62000-memory.dmp

Filesize
3.9MB

Download
memory/4196-2032-0x00007FF74CA70000-0x00007FF74CE62000-memory.dmp

Filesize
3.9MB

Download
memory/4204-388-0x00007FF61A130000-0x00007FF61A522000-memory.dmp

Filesize
3.9MB

Download
memory/4204-2040-0x00007FF61A130000-0x00007FF61A522000-memory.dmp

Filesize
3.9MB

Download
memory/4348-433-0x00007FF6B51D0000-0x00007FF6B55C2000-memory.dmp

Filesize
3.9MB

Download
memory/4348-2052-0x00007FF6B51D0000-0x00007FF6B55C2000-memory.dmp

Filesize
3.9MB

Download
memory/4476-482-0x00007FF681C80000-0x00007FF682072000-memory.dmp

Filesize
3.9MB

Download
memory/4476-2072-0x00007FF681C80000-0x00007FF682072000-memory.dmp

Filesize
3.9MB

Download
memory/4608-2061-0x00007FF7F7680000-0x00007FF7F7A72000-memory.dmp

Filesize
3.9MB

Download
memory/4608-446-0x00007FF7F7680000-0x00007FF7F7A72000-memory.dmp

Filesize
3.9MB

Download
memory/4804-483-0x00007FF7CD110000-0x00007FF7CD502000-memory.dmp

Filesize
3.9MB

Download
memory/4804-2077-0x00007FF7CD110000-0x00007FF7CD502000-memory.dmp

Filesize
3.9MB

Download
memory/4880-0-0x00007FF7DD6F0000-0x00007FF7DDAE2000-memory.dmp

Filesize
3.9MB

Download
memory/4880-1976-0x00007FF7DD6F0000-0x00007FF7DDAE2000-memory.dmp

Filesize
3.9MB

Download
memory/4880-1-0x000001F0A4A90000-0x000001F0A4AA0000-memory.dmp

Filesize
64KB

Download
memory/4884-2056-0x00007FF6672C0000-0x00007FF6676B2000-memory.dmp

Filesize
3.9MB

Download
memory/4884-437-0x00007FF6672C0000-0x00007FF6676B2000-memory.dmp

Filesize
3.9MB

Download
memory/5020-389-0x00007FF7715A0000-0x00007FF771992000-memory.dmp

Filesize
3.9MB

Download
memory/5020-2035-0x00007FF7715A0000-0x00007FF771992000-memory.dmp

Filesize
3.9MB

Download