xmrig | 81e9e90460c6feda66f8b9b6ecc7c51b3d31a2f82a72d7fcc851fcc7016c7fc1

Analysis

max time kernel
144s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
Size

2.6MB
MD5

51eec792cdcd8a6ab24a797052ecc1d0
SHA1

c7baca0cb7f5cebefbf6d8874e06ca3b4e8ec788
SHA256

81e9e90460c6feda66f8b9b6ecc7c51b3d31a2f82a72d7fcc851fcc7016c7fc1
SHA512

d976e6f0cc84de5e7ef9e4a29edb4d4490f4886a801a750d130f73981c20c792e60a80d3a9cf16dc615a6297deebb61cb70b383a95511e39c6a745f096d926ef
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0I6Gz3N1pF:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2176-0-0x00007FF7C5A10000-0x00007FF7C5E06000-memory.dmp	xmrig
behavioral2/files/0x0007000000023432-6.dat	xmrig
behavioral2/files/0x0007000000023431-8.dat	xmrig
behavioral2/files/0x0007000000023437-44.dat	xmrig
behavioral2/files/0x000700000002343d-80.dat	xmrig
behavioral2/files/0x0007000000023443-100.dat	xmrig
behavioral2/files/0x0007000000023441-116.dat	xmrig
behavioral2/files/0x0007000000023445-125.dat	xmrig
behavioral2/memory/4888-147-0x00007FF6DABF0000-0x00007FF6DAFE6000-memory.dmp	xmrig
behavioral2/memory/4848-160-0x00007FF768620000-0x00007FF768A16000-memory.dmp	xmrig
behavioral2/memory/2084-163-0x00007FF65E5F0000-0x00007FF65E9E6000-memory.dmp	xmrig
behavioral2/memory/1504-167-0x00007FF7E2590000-0x00007FF7E2986000-memory.dmp	xmrig
behavioral2/memory/2372-172-0x00007FF63B600000-0x00007FF63B9F6000-memory.dmp	xmrig
behavioral2/memory/1772-174-0x00007FF7D4320000-0x00007FF7D4716000-memory.dmp	xmrig
behavioral2/memory/4984-173-0x00007FF687430000-0x00007FF687826000-memory.dmp	xmrig
behavioral2/memory/1848-171-0x00007FF773BD0000-0x00007FF773FC6000-memory.dmp	xmrig
behavioral2/memory/3992-170-0x00007FF712E90000-0x00007FF713286000-memory.dmp	xmrig
behavioral2/memory/3516-169-0x00007FF77CFA0000-0x00007FF77D396000-memory.dmp	xmrig
behavioral2/memory/4928-168-0x00007FF6FBA10000-0x00007FF6FBE06000-memory.dmp	xmrig
behavioral2/memory/1784-166-0x00007FF68BF20000-0x00007FF68C316000-memory.dmp	xmrig
behavioral2/memory/856-165-0x00007FF60F150000-0x00007FF60F546000-memory.dmp	xmrig
behavioral2/memory/852-164-0x00007FF6F3000000-0x00007FF6F33F6000-memory.dmp	xmrig
behavioral2/memory/3008-162-0x00007FF7EF670000-0x00007FF7EFA66000-memory.dmp	xmrig
behavioral2/memory/2820-161-0x00007FF630470000-0x00007FF630866000-memory.dmp	xmrig
behavioral2/files/0x000700000002344a-158.dat	xmrig
behavioral2/files/0x0007000000023449-156.dat	xmrig
behavioral2/memory/2352-155-0x00007FF6C7080000-0x00007FF6C7476000-memory.dmp	xmrig
behavioral2/files/0x0007000000023448-153.dat	xmrig
behavioral2/files/0x000800000002343f-151.dat	xmrig
behavioral2/files/0x000800000002343e-149.dat	xmrig
behavioral2/memory/4692-148-0x00007FF79B350000-0x00007FF79B746000-memory.dmp	xmrig
behavioral2/memory/3876-139-0x00007FF61DB00000-0x00007FF61DEF6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023447-132.dat	xmrig
behavioral2/files/0x0007000000023446-130.dat	xmrig
behavioral2/files/0x0007000000023444-128.dat	xmrig
behavioral2/files/0x0007000000023440-121.dat	xmrig
behavioral2/memory/3632-118-0x00007FF6AFDD0000-0x00007FF6B01C6000-memory.dmp	xmrig
behavioral2/files/0x000700000002343c-114.dat	xmrig
behavioral2/memory/2356-111-0x00007FF642F30000-0x00007FF643326000-memory.dmp	xmrig
behavioral2/files/0x0007000000023442-108.dat	xmrig
behavioral2/files/0x000700000002343b-98.dat	xmrig
behavioral2/memory/1160-97-0x00007FF603920000-0x00007FF603D16000-memory.dmp	xmrig
behavioral2/memory/3936-91-0x00007FF60FCB0000-0x00007FF6100A6000-memory.dmp	xmrig
behavioral2/memory/4524-74-0x00007FF6EF130000-0x00007FF6EF526000-memory.dmp	xmrig
behavioral2/files/0x000700000002343a-78.dat	xmrig
behavioral2/files/0x0007000000023438-60.dat	xmrig
behavioral2/files/0x000700000002344b-179.dat	xmrig
behavioral2/files/0x000700000001d9e8-188.dat	xmrig
behavioral2/files/0x000700000002344e-199.dat	xmrig
behavioral2/files/0x0007000000023451-209.dat	xmrig
behavioral2/files/0x0007000000023456-219.dat	xmrig
behavioral2/files/0x0007000000023454-212.dat	xmrig
behavioral2/files/0x0007000000023439-51.dat	xmrig
behavioral2/files/0x0007000000023434-46.dat	xmrig
behavioral2/files/0x0007000000023435-42.dat	xmrig
behavioral2/files/0x0007000000023436-35.dat	xmrig
behavioral2/files/0x000900000002342b-22.dat	xmrig
behavioral2/files/0x0007000000023433-19.dat	xmrig
behavioral2/memory/2176-2066-0x00007FF7C5A10000-0x00007FF7C5E06000-memory.dmp	xmrig
behavioral2/memory/1160-2475-0x00007FF603920000-0x00007FF603D16000-memory.dmp	xmrig
behavioral2/memory/4524-2476-0x00007FF6EF130000-0x00007FF6EF526000-memory.dmp	xmrig
behavioral2/memory/3936-2477-0x00007FF60FCB0000-0x00007FF6100A6000-memory.dmp	xmrig
behavioral2/memory/3876-2479-0x00007FF61DB00000-0x00007FF61DEF6000-memory.dmp	xmrig
behavioral2/memory/3516-2478-0x00007FF77CFA0000-0x00007FF77D396000-memory.dmp	xmrig

Blocklisted process makes network request 5 IoCs

flow	pid	Process
7	4244	powershell.exe
9	4244	powershell.exe
11	4244	powershell.exe
12	4244	powershell.exe
14	4244	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
4244	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3516	zlyvaEA.exe
4524	OMoWJKO.exe
3936	eyFOfQa.exe
1160	cQmeeTW.exe
2356	pdzAmzO.exe
3632	eRyMoIW.exe
3876	kvsuXFw.exe
3992	ZSfEZSw.exe
4888	urLyNSr.exe
4692	NTTvuuH.exe
2352	AvXwGBB.exe
4848	sggCNBk.exe
1848	IKhqrFB.exe
2820	miEmWjs.exe
3008	sJAWZcU.exe
2084	HhlZByr.exe
2372	pOTtwAI.exe
852	RmEUJDr.exe
856	dEkHDit.exe
1784	nmCJzkF.exe
1504	ixzwkPg.exe
4928	GpTseSi.exe
4984	uSyasyv.exe
1772	nREeIHQ.exe
3544	sljIhfT.exe
2096	MLLbZQy.exe
3268	hbyLiXL.exe
2376	eApGcfr.exe
4108	INcCOVh.exe
1312	tHjzEnP.exe
4684	VfvgGoM.exe
4356	vWZBDmn.exe
4368	ghyJVEy.exe
4564	JgqGGLP.exe
2148	UQyYZif.exe
2972	XmPlhWI.exe
4020	mRGklap.exe
2580	haIrCFp.exe
4548	kTDJvcQ.exe
3724	sGJkKff.exe
4468	zQFokJY.exe
4012	svcDmBm.exe
624	KgRAJaF.exe
64	SJUXYaq.exe
3648	XsREztY.exe
800	xtHdmZF.exe
4952	jwixWMA.exe
4416	mhAosay.exe
3944	YuIXRoY.exe
424	jJQwGBE.exe
2116	FZfTTJE.exe
2868	RBLFsts.exe
3852	DUCyvun.exe
4432	HGvuFJm.exe
1520	YAVaxkw.exe
4604	rzaDlct.exe
4396	tOniIwy.exe
808	rUjkUXh.exe
464	uSKocTq.exe
536	BcHsGjP.exe
4552	wxBIVdq.exe
1316	IMccRvD.exe
4612	XQzPCXo.exe
3420	jBzZGji.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2176-0-0x00007FF7C5A10000-0x00007FF7C5E06000-memory.dmp	upx
behavioral2/files/0x0007000000023432-6.dat	upx
behavioral2/files/0x0007000000023431-8.dat	upx
behavioral2/files/0x0007000000023437-44.dat	upx
behavioral2/files/0x000700000002343d-80.dat	upx
behavioral2/files/0x0007000000023443-100.dat	upx
behavioral2/files/0x0007000000023441-116.dat	upx
behavioral2/files/0x0007000000023445-125.dat	upx
behavioral2/memory/4888-147-0x00007FF6DABF0000-0x00007FF6DAFE6000-memory.dmp	upx
behavioral2/memory/4848-160-0x00007FF768620000-0x00007FF768A16000-memory.dmp	upx
behavioral2/memory/2084-163-0x00007FF65E5F0000-0x00007FF65E9E6000-memory.dmp	upx
behavioral2/memory/1504-167-0x00007FF7E2590000-0x00007FF7E2986000-memory.dmp	upx
behavioral2/memory/2372-172-0x00007FF63B600000-0x00007FF63B9F6000-memory.dmp	upx
behavioral2/memory/1772-174-0x00007FF7D4320000-0x00007FF7D4716000-memory.dmp	upx
behavioral2/memory/4984-173-0x00007FF687430000-0x00007FF687826000-memory.dmp	upx
behavioral2/memory/1848-171-0x00007FF773BD0000-0x00007FF773FC6000-memory.dmp	upx
behavioral2/memory/3992-170-0x00007FF712E90000-0x00007FF713286000-memory.dmp	upx
behavioral2/memory/3516-169-0x00007FF77CFA0000-0x00007FF77D396000-memory.dmp	upx
behavioral2/memory/4928-168-0x00007FF6FBA10000-0x00007FF6FBE06000-memory.dmp	upx
behavioral2/memory/1784-166-0x00007FF68BF20000-0x00007FF68C316000-memory.dmp	upx
behavioral2/memory/856-165-0x00007FF60F150000-0x00007FF60F546000-memory.dmp	upx
behavioral2/memory/852-164-0x00007FF6F3000000-0x00007FF6F33F6000-memory.dmp	upx
behavioral2/memory/3008-162-0x00007FF7EF670000-0x00007FF7EFA66000-memory.dmp	upx
behavioral2/memory/2820-161-0x00007FF630470000-0x00007FF630866000-memory.dmp	upx
behavioral2/files/0x000700000002344a-158.dat	upx
behavioral2/files/0x0007000000023449-156.dat	upx
behavioral2/memory/2352-155-0x00007FF6C7080000-0x00007FF6C7476000-memory.dmp	upx
behavioral2/files/0x0007000000023448-153.dat	upx
behavioral2/files/0x000800000002343f-151.dat	upx
behavioral2/files/0x000800000002343e-149.dat	upx
behavioral2/memory/4692-148-0x00007FF79B350000-0x00007FF79B746000-memory.dmp	upx
behavioral2/memory/3876-139-0x00007FF61DB00000-0x00007FF61DEF6000-memory.dmp	upx
behavioral2/files/0x0007000000023447-132.dat	upx
behavioral2/files/0x0007000000023446-130.dat	upx
behavioral2/files/0x0007000000023444-128.dat	upx
behavioral2/files/0x0007000000023440-121.dat	upx
behavioral2/memory/3632-118-0x00007FF6AFDD0000-0x00007FF6B01C6000-memory.dmp	upx
behavioral2/files/0x000700000002343c-114.dat	upx
behavioral2/memory/2356-111-0x00007FF642F30000-0x00007FF643326000-memory.dmp	upx
behavioral2/files/0x0007000000023442-108.dat	upx
behavioral2/files/0x000700000002343b-98.dat	upx
behavioral2/memory/1160-97-0x00007FF603920000-0x00007FF603D16000-memory.dmp	upx
behavioral2/memory/3936-91-0x00007FF60FCB0000-0x00007FF6100A6000-memory.dmp	upx
behavioral2/memory/4524-74-0x00007FF6EF130000-0x00007FF6EF526000-memory.dmp	upx
behavioral2/files/0x000700000002343a-78.dat	upx
behavioral2/files/0x0007000000023438-60.dat	upx
behavioral2/files/0x000700000002344b-179.dat	upx
behavioral2/files/0x000700000001d9e8-188.dat	upx
behavioral2/files/0x000700000002344e-199.dat	upx
behavioral2/files/0x0007000000023451-209.dat	upx
behavioral2/files/0x0007000000023456-219.dat	upx
behavioral2/files/0x0007000000023454-212.dat	upx
behavioral2/files/0x0007000000023439-51.dat	upx
behavioral2/files/0x0007000000023434-46.dat	upx
behavioral2/files/0x0007000000023435-42.dat	upx
behavioral2/files/0x0007000000023436-35.dat	upx
behavioral2/files/0x000900000002342b-22.dat	upx
behavioral2/files/0x0007000000023433-19.dat	upx
behavioral2/memory/2176-2066-0x00007FF7C5A10000-0x00007FF7C5E06000-memory.dmp	upx
behavioral2/memory/1160-2475-0x00007FF603920000-0x00007FF603D16000-memory.dmp	upx
behavioral2/memory/4524-2476-0x00007FF6EF130000-0x00007FF6EF526000-memory.dmp	upx
behavioral2/memory/3936-2477-0x00007FF60FCB0000-0x00007FF6100A6000-memory.dmp	upx
behavioral2/memory/3876-2479-0x00007FF61DB00000-0x00007FF61DEF6000-memory.dmp	upx
behavioral2/memory/3516-2478-0x00007FF77CFA0000-0x00007FF77D396000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
6	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vEzkBjE.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\AhpBIly.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\XChNTHp.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\crTUBIt.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\hOMHDEo.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZBnOvtD.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\rsuQAZn.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\usGGiSB.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\pBCZLmF.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\XLglAFX.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\TPdhFjW.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\HNVnwfL.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\yeOyLES.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\toAdjLp.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\JauFwEq.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\eVJFuIh.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZposlgE.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\ZllTmjo.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\UvhMVJa.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\yCndxQb.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\Fabxigq.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\UKKJzae.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\RQLLNnP.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\GeJKrAI.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\zXADmhR.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\axKueGt.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\mkjTaOF.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\vdPYogs.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\dlpPByk.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\eVAWzVr.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\tAlODkl.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\jpfrsnX.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\klGwuwv.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\akjuofJ.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\TCggyFR.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\OsvuCQB.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\MnRkYxk.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\rHKLuaU.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\JzkchzI.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\LWoIzFI.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\qummLgA.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\iwInaHW.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\WpBBDOp.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\FIngIYe.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\gWSYjie.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\wObqzYv.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\dbbUlPn.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\FWTxmWT.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\RAwWhIM.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\gxSZSOg.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\opqwQGF.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\eRyMoIW.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\cotWyDL.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\ohhoeKv.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\cgRmdJV.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\fnRtIct.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\gceQAkl.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\KnkOReS.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\lUebVuU.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\KFCIYpa.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\iuYiRRL.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\csOWlbo.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\RMPktiK.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
File created	C:\Windows\System\jQGZpHO.exe	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4244	powershell.exe
4244	powershell.exe
4244	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeLockMemoryPrivilege	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
Token: SeLockMemoryPrivilege	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 4244	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	83
PID 2176 wrote to memory of 4244	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	83
PID 2176 wrote to memory of 4524	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	84
PID 2176 wrote to memory of 4524	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	84
PID 2176 wrote to memory of 3516	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	85
PID 2176 wrote to memory of 3516	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	85
PID 2176 wrote to memory of 3936	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	86
PID 2176 wrote to memory of 3936	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	86
PID 2176 wrote to memory of 1160	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	87
PID 2176 wrote to memory of 1160	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	87
PID 2176 wrote to memory of 2356	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	88
PID 2176 wrote to memory of 2356	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	88
PID 2176 wrote to memory of 3632	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	89
PID 2176 wrote to memory of 3632	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	89
PID 2176 wrote to memory of 3876	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	90
PID 2176 wrote to memory of 3876	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	90
PID 2176 wrote to memory of 3992	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	91
PID 2176 wrote to memory of 3992	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	91
PID 2176 wrote to memory of 4888	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	92
PID 2176 wrote to memory of 4888	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	92
PID 2176 wrote to memory of 4692	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	93
PID 2176 wrote to memory of 4692	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	93
PID 2176 wrote to memory of 2352	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	94
PID 2176 wrote to memory of 2352	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	94
PID 2176 wrote to memory of 4848	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	95
PID 2176 wrote to memory of 4848	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	95
PID 2176 wrote to memory of 3008	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	96
PID 2176 wrote to memory of 3008	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	96
PID 2176 wrote to memory of 1848	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	97
PID 2176 wrote to memory of 1848	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	97
PID 2176 wrote to memory of 2820	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	98
PID 2176 wrote to memory of 2820	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	98
PID 2176 wrote to memory of 2084	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	99
PID 2176 wrote to memory of 2084	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	99
PID 2176 wrote to memory of 2372	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	100
PID 2176 wrote to memory of 2372	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	100
PID 2176 wrote to memory of 852	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	101
PID 2176 wrote to memory of 852	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	101
PID 2176 wrote to memory of 856	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	102
PID 2176 wrote to memory of 856	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	102
PID 2176 wrote to memory of 1784	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	103
PID 2176 wrote to memory of 1784	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	103
PID 2176 wrote to memory of 1504	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	104
PID 2176 wrote to memory of 1504	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	104
PID 2176 wrote to memory of 4928	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	105
PID 2176 wrote to memory of 4928	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	105
PID 2176 wrote to memory of 4984	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	106
PID 2176 wrote to memory of 4984	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	106
PID 2176 wrote to memory of 1772	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	107
PID 2176 wrote to memory of 1772	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	107
PID 2176 wrote to memory of 3544	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	108
PID 2176 wrote to memory of 3544	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	108
PID 2176 wrote to memory of 2096	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	109
PID 2176 wrote to memory of 2096	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	109
PID 2176 wrote to memory of 3268	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	110
PID 2176 wrote to memory of 3268	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	110
PID 2176 wrote to memory of 2376	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	111
PID 2176 wrote to memory of 2376	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	111
PID 2176 wrote to memory of 4108	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	112
PID 2176 wrote to memory of 4108	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	112
PID 2176 wrote to memory of 1312	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	113
PID 2176 wrote to memory of 1312	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	113
PID 2176 wrote to memory of 4684	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	114
PID 2176 wrote to memory of 4684	2176	51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe	114

C:\Users\Admin\AppData\Local\Temp\51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\51eec792cdcd8a6ab24a797052ecc1d0_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4244
- C:\Windows\System\OMoWJKO.exe
  C:\Windows\System\OMoWJKO.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\zlyvaEA.exe
  C:\Windows\System\zlyvaEA.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\eyFOfQa.exe
  C:\Windows\System\eyFOfQa.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\cQmeeTW.exe
  C:\Windows\System\cQmeeTW.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\pdzAmzO.exe
  C:\Windows\System\pdzAmzO.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\eRyMoIW.exe
  C:\Windows\System\eRyMoIW.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\kvsuXFw.exe
  C:\Windows\System\kvsuXFw.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\ZSfEZSw.exe
  C:\Windows\System\ZSfEZSw.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\urLyNSr.exe
  C:\Windows\System\urLyNSr.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\NTTvuuH.exe
  C:\Windows\System\NTTvuuH.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\AvXwGBB.exe
  C:\Windows\System\AvXwGBB.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\sggCNBk.exe
  C:\Windows\System\sggCNBk.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\sJAWZcU.exe
  C:\Windows\System\sJAWZcU.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\IKhqrFB.exe
  C:\Windows\System\IKhqrFB.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\miEmWjs.exe
  C:\Windows\System\miEmWjs.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\HhlZByr.exe
  C:\Windows\System\HhlZByr.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\pOTtwAI.exe
  C:\Windows\System\pOTtwAI.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\RmEUJDr.exe
  C:\Windows\System\RmEUJDr.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\dEkHDit.exe
  C:\Windows\System\dEkHDit.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\nmCJzkF.exe
  C:\Windows\System\nmCJzkF.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\ixzwkPg.exe
  C:\Windows\System\ixzwkPg.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\GpTseSi.exe
  C:\Windows\System\GpTseSi.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\uSyasyv.exe
  C:\Windows\System\uSyasyv.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\nREeIHQ.exe
  C:\Windows\System\nREeIHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\sljIhfT.exe
  C:\Windows\System\sljIhfT.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\MLLbZQy.exe
  C:\Windows\System\MLLbZQy.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\hbyLiXL.exe
  C:\Windows\System\hbyLiXL.exe
  2⤵
  - Executes dropped EXE
  PID:3268
- C:\Windows\System\eApGcfr.exe
  C:\Windows\System\eApGcfr.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\INcCOVh.exe
  C:\Windows\System\INcCOVh.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\tHjzEnP.exe
  C:\Windows\System\tHjzEnP.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\VfvgGoM.exe
  C:\Windows\System\VfvgGoM.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\vWZBDmn.exe
  C:\Windows\System\vWZBDmn.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\ghyJVEy.exe
  C:\Windows\System\ghyJVEy.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\JgqGGLP.exe
  C:\Windows\System\JgqGGLP.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\UQyYZif.exe
  C:\Windows\System\UQyYZif.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\XmPlhWI.exe
  C:\Windows\System\XmPlhWI.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\mRGklap.exe
  C:\Windows\System\mRGklap.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\haIrCFp.exe
  C:\Windows\System\haIrCFp.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\kTDJvcQ.exe
  C:\Windows\System\kTDJvcQ.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\sGJkKff.exe
  C:\Windows\System\sGJkKff.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\zQFokJY.exe
  C:\Windows\System\zQFokJY.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\svcDmBm.exe
  C:\Windows\System\svcDmBm.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\KgRAJaF.exe
  C:\Windows\System\KgRAJaF.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\SJUXYaq.exe
  C:\Windows\System\SJUXYaq.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\XsREztY.exe
  C:\Windows\System\XsREztY.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\xtHdmZF.exe
  C:\Windows\System\xtHdmZF.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\jwixWMA.exe
  C:\Windows\System\jwixWMA.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\mhAosay.exe
  C:\Windows\System\mhAosay.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\YuIXRoY.exe
  C:\Windows\System\YuIXRoY.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\jJQwGBE.exe
  C:\Windows\System\jJQwGBE.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\FZfTTJE.exe
  C:\Windows\System\FZfTTJE.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\RBLFsts.exe
  C:\Windows\System\RBLFsts.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\DUCyvun.exe
  C:\Windows\System\DUCyvun.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\HGvuFJm.exe
  C:\Windows\System\HGvuFJm.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\YAVaxkw.exe
  C:\Windows\System\YAVaxkw.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\rzaDlct.exe
  C:\Windows\System\rzaDlct.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\tOniIwy.exe
  C:\Windows\System\tOniIwy.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\rUjkUXh.exe
  C:\Windows\System\rUjkUXh.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\uSKocTq.exe
  C:\Windows\System\uSKocTq.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\BcHsGjP.exe
  C:\Windows\System\BcHsGjP.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\wxBIVdq.exe
  C:\Windows\System\wxBIVdq.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\IMccRvD.exe
  C:\Windows\System\IMccRvD.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\XQzPCXo.exe
  C:\Windows\System\XQzPCXo.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\jBzZGji.exe
  C:\Windows\System\jBzZGji.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\OqjgFKb.exe
  C:\Windows\System\OqjgFKb.exe
  2⤵
  PID:2408
- C:\Windows\System\RKkngaS.exe
  C:\Windows\System\RKkngaS.exe
  2⤵
  PID:4556
- C:\Windows\System\dGtsAhw.exe
  C:\Windows\System\dGtsAhw.exe
  2⤵
  PID:3664
- C:\Windows\System\rEjcDgi.exe
  C:\Windows\System\rEjcDgi.exe
  2⤵
  PID:5040
- C:\Windows\System\VXVpAAO.exe
  C:\Windows\System\VXVpAAO.exe
  2⤵
  PID:2960
- C:\Windows\System\NMgCeKe.exe
  C:\Windows\System\NMgCeKe.exe
  2⤵
  PID:4640
- C:\Windows\System\oSgeYBZ.exe
  C:\Windows\System\oSgeYBZ.exe
  2⤵
  PID:1140
- C:\Windows\System\kzewPmM.exe
  C:\Windows\System\kzewPmM.exe
  2⤵
  PID:4656
- C:\Windows\System\YdHzuEz.exe
  C:\Windows\System\YdHzuEz.exe
  2⤵
  PID:5036
- C:\Windows\System\ULcmkmu.exe
  C:\Windows\System\ULcmkmu.exe
  2⤵
  PID:4500
- C:\Windows\System\dYSMJxP.exe
  C:\Windows\System\dYSMJxP.exe
  2⤵
  PID:3092
- C:\Windows\System\IrGFsWX.exe
  C:\Windows\System\IrGFsWX.exe
  2⤵
  PID:4196
- C:\Windows\System\NOjPCmD.exe
  C:\Windows\System\NOjPCmD.exe
  2⤵
  PID:792
- C:\Windows\System\cdUCyVP.exe
  C:\Windows\System\cdUCyVP.exe
  2⤵
  PID:1536
- C:\Windows\System\LoXbLEO.exe
  C:\Windows\System\LoXbLEO.exe
  2⤵
  PID:3064
- C:\Windows\System\FBsVNPB.exe
  C:\Windows\System\FBsVNPB.exe
  2⤵
  PID:4508
- C:\Windows\System\eAlUQdk.exe
  C:\Windows\System\eAlUQdk.exe
  2⤵
  PID:848
- C:\Windows\System\KnkOReS.exe
  C:\Windows\System\KnkOReS.exe
  2⤵
  PID:2500
- C:\Windows\System\ObcZZSJ.exe
  C:\Windows\System\ObcZZSJ.exe
  2⤵
  PID:4884
- C:\Windows\System\epFfCgS.exe
  C:\Windows\System\epFfCgS.exe
  2⤵
  PID:5180
- C:\Windows\System\RPytUTr.exe
  C:\Windows\System\RPytUTr.exe
  2⤵
  PID:5200
- C:\Windows\System\uwpzcdI.exe
  C:\Windows\System\uwpzcdI.exe
  2⤵
  PID:5248
- C:\Windows\System\YqiomDj.exe
  C:\Windows\System\YqiomDj.exe
  2⤵
  PID:5316
- C:\Windows\System\mHhcsMp.exe
  C:\Windows\System\mHhcsMp.exe
  2⤵
  PID:5344
- C:\Windows\System\tpYsvUO.exe
  C:\Windows\System\tpYsvUO.exe
  2⤵
  PID:5396
- C:\Windows\System\wkXNHFe.exe
  C:\Windows\System\wkXNHFe.exe
  2⤵
  PID:5424
- C:\Windows\System\amICgZC.exe
  C:\Windows\System\amICgZC.exe
  2⤵
  PID:5456
- C:\Windows\System\NAMrcmh.exe
  C:\Windows\System\NAMrcmh.exe
  2⤵
  PID:5492
- C:\Windows\System\sTNBWYc.exe
  C:\Windows\System\sTNBWYc.exe
  2⤵
  PID:5524
- C:\Windows\System\bDfZAVY.exe
  C:\Windows\System\bDfZAVY.exe
  2⤵
  PID:5568
- C:\Windows\System\updvyCw.exe
  C:\Windows\System\updvyCw.exe
  2⤵
  PID:5592
- C:\Windows\System\kmRlIrE.exe
  C:\Windows\System\kmRlIrE.exe
  2⤵
  PID:5624
- C:\Windows\System\FSOHnna.exe
  C:\Windows\System\FSOHnna.exe
  2⤵
  PID:5668
- C:\Windows\System\cXOEyBQ.exe
  C:\Windows\System\cXOEyBQ.exe
  2⤵
  PID:5700
- C:\Windows\System\NHMwBDQ.exe
  C:\Windows\System\NHMwBDQ.exe
  2⤵
  PID:5728
- C:\Windows\System\eBJTAyK.exe
  C:\Windows\System\eBJTAyK.exe
  2⤵
  PID:5772
- C:\Windows\System\JQoBwgO.exe
  C:\Windows\System\JQoBwgO.exe
  2⤵
  PID:5800
- C:\Windows\System\ggvxazY.exe
  C:\Windows\System\ggvxazY.exe
  2⤵
  PID:5828
- C:\Windows\System\vrqTQFJ.exe
  C:\Windows\System\vrqTQFJ.exe
  2⤵
  PID:5864
- C:\Windows\System\BnKrXTa.exe
  C:\Windows\System\BnKrXTa.exe
  2⤵
  PID:5896
- C:\Windows\System\MnRkYxk.exe
  C:\Windows\System\MnRkYxk.exe
  2⤵
  PID:5920
- C:\Windows\System\fTpmovh.exe
  C:\Windows\System\fTpmovh.exe
  2⤵
  PID:5956
- C:\Windows\System\yWXfgHf.exe
  C:\Windows\System\yWXfgHf.exe
  2⤵
  PID:5984
- C:\Windows\System\iwJJelJ.exe
  C:\Windows\System\iwJJelJ.exe
  2⤵
  PID:6012
- C:\Windows\System\lRGHXbd.exe
  C:\Windows\System\lRGHXbd.exe
  2⤵
  PID:6040
- C:\Windows\System\rUJkBHr.exe
  C:\Windows\System\rUJkBHr.exe
  2⤵
  PID:6088
- C:\Windows\System\IQuzQxo.exe
  C:\Windows\System\IQuzQxo.exe
  2⤵
  PID:6120
- C:\Windows\System\kyfTZVJ.exe
  C:\Windows\System\kyfTZVJ.exe
  2⤵
  PID:4820
- C:\Windows\System\uiPLGnS.exe
  C:\Windows\System\uiPLGnS.exe
  2⤵
  PID:5152
- C:\Windows\System\yifDccd.exe
  C:\Windows\System\yifDccd.exe
  2⤵
  PID:5220
- C:\Windows\System\kbhjrNU.exe
  C:\Windows\System\kbhjrNU.exe
  2⤵
  PID:5272
- C:\Windows\System\cuzTJsX.exe
  C:\Windows\System\cuzTJsX.exe
  2⤵
  PID:5296
- C:\Windows\System\OPZDvpk.exe
  C:\Windows\System\OPZDvpk.exe
  2⤵
  PID:5372
- C:\Windows\System\zzPidjO.exe
  C:\Windows\System\zzPidjO.exe
  2⤵
  PID:2044
- C:\Windows\System\NscfTPV.exe
  C:\Windows\System\NscfTPV.exe
  2⤵
  PID:5488
- C:\Windows\System\vwJbEhl.exe
  C:\Windows\System\vwJbEhl.exe
  2⤵
  PID:5544
- C:\Windows\System\BOjBFuS.exe
  C:\Windows\System\BOjBFuS.exe
  2⤵
  PID:5612
- C:\Windows\System\rjbeuuN.exe
  C:\Windows\System\rjbeuuN.exe
  2⤵
  PID:5636
- C:\Windows\System\zCTaaHS.exe
  C:\Windows\System\zCTaaHS.exe
  2⤵
  PID:5712
- C:\Windows\System\ugVIJnN.exe
  C:\Windows\System\ugVIJnN.exe
  2⤵
  PID:5820
- C:\Windows\System\FvFRLRU.exe
  C:\Windows\System\FvFRLRU.exe
  2⤵
  PID:5876
- C:\Windows\System\JRjukqU.exe
  C:\Windows\System\JRjukqU.exe
  2⤵
  PID:5940
- C:\Windows\System\ZRuHQAu.exe
  C:\Windows\System\ZRuHQAu.exe
  2⤵
  PID:6024
- C:\Windows\System\burOkyx.exe
  C:\Windows\System\burOkyx.exe
  2⤵
  PID:6084
- C:\Windows\System\wUwfvUJ.exe
  C:\Windows\System\wUwfvUJ.exe
  2⤵
  PID:6140
- C:\Windows\System\GNSeKNO.exe
  C:\Windows\System\GNSeKNO.exe
  2⤵
  PID:5144
- C:\Windows\System\QMFejGk.exe
  C:\Windows\System\QMFejGk.exe
  2⤵
  PID:4360
- C:\Windows\System\jqCfMET.exe
  C:\Windows\System\jqCfMET.exe
  2⤵
  PID:5300
- C:\Windows\System\kUnNQsY.exe
  C:\Windows\System\kUnNQsY.exe
  2⤵
  PID:4792
- C:\Windows\System\QLBhkjW.exe
  C:\Windows\System\QLBhkjW.exe
  2⤵
  PID:5620
- C:\Windows\System\hSBsEke.exe
  C:\Windows\System\hSBsEke.exe
  2⤵
  PID:5792
- C:\Windows\System\OHFkuCW.exe
  C:\Windows\System\OHFkuCW.exe
  2⤵
  PID:5928
- C:\Windows\System\QhyWiib.exe
  C:\Windows\System\QhyWiib.exe
  2⤵
  PID:6008
- C:\Windows\System\qZMhfte.exe
  C:\Windows\System\qZMhfte.exe
  2⤵
  PID:2628
- C:\Windows\System\JnEzohO.exe
  C:\Windows\System\JnEzohO.exe
  2⤵
  PID:5136
- C:\Windows\System\Szqhyia.exe
  C:\Windows\System\Szqhyia.exe
  2⤵
  PID:5388
- C:\Windows\System\sHHvxpL.exe
  C:\Windows\System\sHHvxpL.exe
  2⤵
  PID:5744
- C:\Windows\System\AwyjEMR.exe
  C:\Windows\System\AwyjEMR.exe
  2⤵
  PID:6052
- C:\Windows\System\Yetirjk.exe
  C:\Windows\System\Yetirjk.exe
  2⤵
  PID:5376
- C:\Windows\System\OIsEvUl.exe
  C:\Windows\System\OIsEvUl.exe
  2⤵
  PID:5976
- C:\Windows\System\laaFiwj.exe
  C:\Windows\System\laaFiwj.exe
  2⤵
  PID:6136
- C:\Windows\System\zDkrqlb.exe
  C:\Windows\System\zDkrqlb.exe
  2⤵
  PID:5916
- C:\Windows\System\iRYbtfY.exe
  C:\Windows\System\iRYbtfY.exe
  2⤵
  PID:6188
- C:\Windows\System\FxGStyf.exe
  C:\Windows\System\FxGStyf.exe
  2⤵
  PID:6228
- C:\Windows\System\fgtTUwx.exe
  C:\Windows\System\fgtTUwx.exe
  2⤵
  PID:6280
- C:\Windows\System\CgpDyrT.exe
  C:\Windows\System\CgpDyrT.exe
  2⤵
  PID:6300
- C:\Windows\System\DjZkPrw.exe
  C:\Windows\System\DjZkPrw.exe
  2⤵
  PID:6328
- C:\Windows\System\TAOyNGg.exe
  C:\Windows\System\TAOyNGg.exe
  2⤵
  PID:6356
- C:\Windows\System\vhHhZHp.exe
  C:\Windows\System\vhHhZHp.exe
  2⤵
  PID:6384
- C:\Windows\System\vgfmxjj.exe
  C:\Windows\System\vgfmxjj.exe
  2⤵
  PID:6428
- C:\Windows\System\nDtsODD.exe
  C:\Windows\System\nDtsODD.exe
  2⤵
  PID:6452
- C:\Windows\System\lZdSzYf.exe
  C:\Windows\System\lZdSzYf.exe
  2⤵
  PID:6488
- C:\Windows\System\bEPTnkt.exe
  C:\Windows\System\bEPTnkt.exe
  2⤵
  PID:6508
- C:\Windows\System\iMkCDOF.exe
  C:\Windows\System\iMkCDOF.exe
  2⤵
  PID:6536
- C:\Windows\System\lUebVuU.exe
  C:\Windows\System\lUebVuU.exe
  2⤵
  PID:6564
- C:\Windows\System\zQmCzhX.exe
  C:\Windows\System\zQmCzhX.exe
  2⤵
  PID:6592
- C:\Windows\System\fWVHDBd.exe
  C:\Windows\System\fWVHDBd.exe
  2⤵
  PID:6624
- C:\Windows\System\SGChbsb.exe
  C:\Windows\System\SGChbsb.exe
  2⤵
  PID:6648
- C:\Windows\System\JxnwPtX.exe
  C:\Windows\System\JxnwPtX.exe
  2⤵
  PID:6680
- C:\Windows\System\DJSMvJN.exe
  C:\Windows\System\DJSMvJN.exe
  2⤵
  PID:6712
- C:\Windows\System\kfWJwcp.exe
  C:\Windows\System\kfWJwcp.exe
  2⤵
  PID:6744
- C:\Windows\System\IOZdVTW.exe
  C:\Windows\System\IOZdVTW.exe
  2⤵
  PID:6788
- C:\Windows\System\unrcfpD.exe
  C:\Windows\System\unrcfpD.exe
  2⤵
  PID:6820
- C:\Windows\System\suHxYYn.exe
  C:\Windows\System\suHxYYn.exe
  2⤵
  PID:6848
- C:\Windows\System\CKbVAXY.exe
  C:\Windows\System\CKbVAXY.exe
  2⤵
  PID:6876
- C:\Windows\System\dXSVotP.exe
  C:\Windows\System\dXSVotP.exe
  2⤵
  PID:6900
- C:\Windows\System\NXGyMeo.exe
  C:\Windows\System\NXGyMeo.exe
  2⤵
  PID:6932
- C:\Windows\System\iksxDGg.exe
  C:\Windows\System\iksxDGg.exe
  2⤵
  PID:6956
- C:\Windows\System\OMchMGN.exe
  C:\Windows\System\OMchMGN.exe
  2⤵
  PID:6984
- C:\Windows\System\nEaQzzR.exe
  C:\Windows\System\nEaQzzR.exe
  2⤵
  PID:7012
- C:\Windows\System\SFgbqTA.exe
  C:\Windows\System\SFgbqTA.exe
  2⤵
  PID:7040
- C:\Windows\System\kyCOHUG.exe
  C:\Windows\System\kyCOHUG.exe
  2⤵
  PID:7068
- C:\Windows\System\SHxlaiL.exe
  C:\Windows\System\SHxlaiL.exe
  2⤵
  PID:7096
- C:\Windows\System\oRhKjsJ.exe
  C:\Windows\System\oRhKjsJ.exe
  2⤵
  PID:7128
- C:\Windows\System\ZUbahKu.exe
  C:\Windows\System\ZUbahKu.exe
  2⤵
  PID:7152
- C:\Windows\System\cIBnJqa.exe
  C:\Windows\System\cIBnJqa.exe
  2⤵
  PID:6216
- C:\Windows\System\XNkogwC.exe
  C:\Windows\System\XNkogwC.exe
  2⤵
  PID:6312
- C:\Windows\System\sFoDfAX.exe
  C:\Windows\System\sFoDfAX.exe
  2⤵
  PID:6368
- C:\Windows\System\PVVCzEp.exe
  C:\Windows\System\PVVCzEp.exe
  2⤵
  PID:6440
- C:\Windows\System\mIsfkPj.exe
  C:\Windows\System\mIsfkPj.exe
  2⤵
  PID:6504
- C:\Windows\System\JXFlWGp.exe
  C:\Windows\System\JXFlWGp.exe
  2⤵
  PID:6576
- C:\Windows\System\lsPHNzo.exe
  C:\Windows\System\lsPHNzo.exe
  2⤵
  PID:6644
- C:\Windows\System\nYBcJUh.exe
  C:\Windows\System\nYBcJUh.exe
  2⤵
  PID:6724
- C:\Windows\System\xyZqzSI.exe
  C:\Windows\System\xyZqzSI.exe
  2⤵
  PID:6804
- C:\Windows\System\GrIRmdg.exe
  C:\Windows\System\GrIRmdg.exe
  2⤵
  PID:6868
- C:\Windows\System\OJgRHwl.exe
  C:\Windows\System\OJgRHwl.exe
  2⤵
  PID:6940
- C:\Windows\System\NKwYZbc.exe
  C:\Windows\System\NKwYZbc.exe
  2⤵
  PID:7004
- C:\Windows\System\KiIGjyR.exe
  C:\Windows\System\KiIGjyR.exe
  2⤵
  PID:5796
- C:\Windows\System\erDsdJy.exe
  C:\Windows\System\erDsdJy.exe
  2⤵
  PID:7164
- C:\Windows\System\CjIYxUs.exe
  C:\Windows\System\CjIYxUs.exe
  2⤵
  PID:6268
- C:\Windows\System\GyhjEMq.exe
  C:\Windows\System\GyhjEMq.exe
  2⤵
  PID:6496
- C:\Windows\System\ccXpkWM.exe
  C:\Windows\System\ccXpkWM.exe
  2⤵
  PID:6828
- C:\Windows\System\ygNFMCg.exe
  C:\Windows\System\ygNFMCg.exe
  2⤵
  PID:7148
- C:\Windows\System\sHYmUfP.exe
  C:\Windows\System\sHYmUfP.exe
  2⤵
  PID:5064
- C:\Windows\System\LmdPMlE.exe
  C:\Windows\System\LmdPMlE.exe
  2⤵
  PID:6164
- C:\Windows\System\zupUiHi.exe
  C:\Windows\System\zupUiHi.exe
  2⤵
  PID:7172
- C:\Windows\System\ZYHWiuw.exe
  C:\Windows\System\ZYHWiuw.exe
  2⤵
  PID:7216
- C:\Windows\System\AWFTgCE.exe
  C:\Windows\System\AWFTgCE.exe
  2⤵
  PID:7260
- C:\Windows\System\rNLRpiU.exe
  C:\Windows\System\rNLRpiU.exe
  2⤵
  PID:7316
- C:\Windows\System\hnoLLdC.exe
  C:\Windows\System\hnoLLdC.exe
  2⤵
  PID:7364
- C:\Windows\System\DeyopAS.exe
  C:\Windows\System\DeyopAS.exe
  2⤵
  PID:7380
- C:\Windows\System\OkVrxmk.exe
  C:\Windows\System\OkVrxmk.exe
  2⤵
  PID:7408
- C:\Windows\System\atkyJxK.exe
  C:\Windows\System\atkyJxK.exe
  2⤵
  PID:7440
- C:\Windows\System\elHvZWb.exe
  C:\Windows\System\elHvZWb.exe
  2⤵
  PID:7480
- C:\Windows\System\tNtzgpn.exe
  C:\Windows\System\tNtzgpn.exe
  2⤵
  PID:7508
- C:\Windows\System\HRcDzlR.exe
  C:\Windows\System\HRcDzlR.exe
  2⤵
  PID:7528
- C:\Windows\System\eFBQVMV.exe
  C:\Windows\System\eFBQVMV.exe
  2⤵
  PID:7560
- C:\Windows\System\JpNWGDs.exe
  C:\Windows\System\JpNWGDs.exe
  2⤵
  PID:7584
- C:\Windows\System\kvAIGVB.exe
  C:\Windows\System\kvAIGVB.exe
  2⤵
  PID:7600
- C:\Windows\System\AMrKinV.exe
  C:\Windows\System\AMrKinV.exe
  2⤵
  PID:7648
- C:\Windows\System\AoZVHWE.exe
  C:\Windows\System\AoZVHWE.exe
  2⤵
  PID:7680
- C:\Windows\System\MADEwAp.exe
  C:\Windows\System\MADEwAp.exe
  2⤵
  PID:7720
- C:\Windows\System\SmkYVUp.exe
  C:\Windows\System\SmkYVUp.exe
  2⤵
  PID:7760
- C:\Windows\System\FvrkFFv.exe
  C:\Windows\System\FvrkFFv.exe
  2⤵
  PID:7792
- C:\Windows\System\yyDBaiX.exe
  C:\Windows\System\yyDBaiX.exe
  2⤵
  PID:7820
- C:\Windows\System\KmwPQRy.exe
  C:\Windows\System\KmwPQRy.exe
  2⤵
  PID:7848
- C:\Windows\System\KUkJloh.exe
  C:\Windows\System\KUkJloh.exe
  2⤵
  PID:7880
- C:\Windows\System\GBYvFtK.exe
  C:\Windows\System\GBYvFtK.exe
  2⤵
  PID:7908
- C:\Windows\System\dLZNsFV.exe
  C:\Windows\System\dLZNsFV.exe
  2⤵
  PID:7936
- C:\Windows\System\qZmeHPx.exe
  C:\Windows\System\qZmeHPx.exe
  2⤵
  PID:7968
- C:\Windows\System\CMdRSZt.exe
  C:\Windows\System\CMdRSZt.exe
  2⤵
  PID:7992
- C:\Windows\System\APnRxQR.exe
  C:\Windows\System\APnRxQR.exe
  2⤵
  PID:8020
- C:\Windows\System\BWNParB.exe
  C:\Windows\System\BWNParB.exe
  2⤵
  PID:8052
- C:\Windows\System\JVEqQrg.exe
  C:\Windows\System\JVEqQrg.exe
  2⤵
  PID:8076
- C:\Windows\System\qTEFRfq.exe
  C:\Windows\System\qTEFRfq.exe
  2⤵
  PID:8100
- C:\Windows\System\hAlPHWZ.exe
  C:\Windows\System\hAlPHWZ.exe
  2⤵
  PID:8136
- C:\Windows\System\zHBVKnw.exe
  C:\Windows\System\zHBVKnw.exe
  2⤵
  PID:8156
- C:\Windows\System\uEZKvVP.exe
  C:\Windows\System\uEZKvVP.exe
  2⤵
  PID:8184
- C:\Windows\System\djusbtx.exe
  C:\Windows\System\djusbtx.exe
  2⤵
  PID:7252
- C:\Windows\System\yRrTtke.exe
  C:\Windows\System\yRrTtke.exe
  2⤵
  PID:7360
- C:\Windows\System\MGkZxNv.exe
  C:\Windows\System\MGkZxNv.exe
  2⤵
  PID:7432
- C:\Windows\System\sVGScmz.exe
  C:\Windows\System\sVGScmz.exe
  2⤵
  PID:7504
- C:\Windows\System\GTBTKGv.exe
  C:\Windows\System\GTBTKGv.exe
  2⤵
  PID:7536
- C:\Windows\System\fxUTjWc.exe
  C:\Windows\System\fxUTjWc.exe
  2⤵
  PID:7668
- C:\Windows\System\tWoIeZw.exe
  C:\Windows\System\tWoIeZw.exe
  2⤵
  PID:7784
- C:\Windows\System\URehOsd.exe
  C:\Windows\System\URehOsd.exe
  2⤵
  PID:7736
- C:\Windows\System\qdxYCSh.exe
  C:\Windows\System\qdxYCSh.exe
  2⤵
  PID:7780
- C:\Windows\System\GHXErBn.exe
  C:\Windows\System\GHXErBn.exe
  2⤵
  PID:7928
- C:\Windows\System\DDaNwYO.exe
  C:\Windows\System\DDaNwYO.exe
  2⤵
  PID:7984
- C:\Windows\System\tntwwGh.exe
  C:\Windows\System\tntwwGh.exe
  2⤵
  PID:8040
- C:\Windows\System\UxvFuwn.exe
  C:\Windows\System\UxvFuwn.exe
  2⤵
  PID:8120
- C:\Windows\System\qUrHJMr.exe
  C:\Windows\System\qUrHJMr.exe
  2⤵
  PID:8176
- C:\Windows\System\urkyCox.exe
  C:\Windows\System\urkyCox.exe
  2⤵
  PID:7212
- C:\Windows\System\YbnKRVz.exe
  C:\Windows\System\YbnKRVz.exe
  2⤵
  PID:7396
- C:\Windows\System\TgheuBl.exe
  C:\Windows\System\TgheuBl.exe
  2⤵
  PID:7556
- C:\Windows\System\jcHwRjR.exe
  C:\Windows\System\jcHwRjR.exe
  2⤵
  PID:7832
- C:\Windows\System\WFThyhh.exe
  C:\Windows\System\WFThyhh.exe
  2⤵
  PID:8068
- C:\Windows\System\ZfPJdsu.exe
  C:\Windows\System\ZfPJdsu.exe
  2⤵
  PID:6736
- C:\Windows\System\WCzdzyn.exe
  C:\Windows\System\WCzdzyn.exe
  2⤵
  PID:7712
- C:\Windows\System\NbXZotf.exe
  C:\Windows\System\NbXZotf.exe
  2⤵
  PID:8096
- C:\Windows\System\lXozZVG.exe
  C:\Windows\System\lXozZVG.exe
  2⤵
  PID:7492
- C:\Windows\System\oYwtHev.exe
  C:\Windows\System\oYwtHev.exe
  2⤵
  PID:7376
- C:\Windows\System\antCilM.exe
  C:\Windows\System\antCilM.exe
  2⤵
  PID:8212
- C:\Windows\System\RDOvyjx.exe
  C:\Windows\System\RDOvyjx.exe
  2⤵
  PID:8240
- C:\Windows\System\jCaItvf.exe
  C:\Windows\System\jCaItvf.exe
  2⤵
  PID:8268
- C:\Windows\System\eiXATTV.exe
  C:\Windows\System\eiXATTV.exe
  2⤵
  PID:8296
- C:\Windows\System\QKXhJUv.exe
  C:\Windows\System\QKXhJUv.exe
  2⤵
  PID:8324
- C:\Windows\System\uEJBEtr.exe
  C:\Windows\System\uEJBEtr.exe
  2⤵
  PID:8352
- C:\Windows\System\WPnAWgZ.exe
  C:\Windows\System\WPnAWgZ.exe
  2⤵
  PID:8380
- C:\Windows\System\zcEfvFF.exe
  C:\Windows\System\zcEfvFF.exe
  2⤵
  PID:8408
- C:\Windows\System\DtSkFEc.exe
  C:\Windows\System\DtSkFEc.exe
  2⤵
  PID:8436
- C:\Windows\System\ZFfZFbk.exe
  C:\Windows\System\ZFfZFbk.exe
  2⤵
  PID:8464
- C:\Windows\System\RKOUqUI.exe
  C:\Windows\System\RKOUqUI.exe
  2⤵
  PID:8496
- C:\Windows\System\VYVDLOV.exe
  C:\Windows\System\VYVDLOV.exe
  2⤵
  PID:8524
- C:\Windows\System\YzRnpUv.exe
  C:\Windows\System\YzRnpUv.exe
  2⤵
  PID:8552
- C:\Windows\System\JRGUarG.exe
  C:\Windows\System\JRGUarG.exe
  2⤵
  PID:8580
- C:\Windows\System\WpBBDOp.exe
  C:\Windows\System\WpBBDOp.exe
  2⤵
  PID:8608
- C:\Windows\System\dVveFcn.exe
  C:\Windows\System\dVveFcn.exe
  2⤵
  PID:8636
- C:\Windows\System\uRlHoRf.exe
  C:\Windows\System\uRlHoRf.exe
  2⤵
  PID:8664
- C:\Windows\System\mGRMqqq.exe
  C:\Windows\System\mGRMqqq.exe
  2⤵
  PID:8692
- C:\Windows\System\EfRVDec.exe
  C:\Windows\System\EfRVDec.exe
  2⤵
  PID:8720
- C:\Windows\System\beWdjzh.exe
  C:\Windows\System\beWdjzh.exe
  2⤵
  PID:8748
- C:\Windows\System\wdcYVUq.exe
  C:\Windows\System\wdcYVUq.exe
  2⤵
  PID:8776
- C:\Windows\System\jhYiquc.exe
  C:\Windows\System\jhYiquc.exe
  2⤵
  PID:8804
- C:\Windows\System\pWfVSXt.exe
  C:\Windows\System\pWfVSXt.exe
  2⤵
  PID:8832
- C:\Windows\System\wOwpHjY.exe
  C:\Windows\System\wOwpHjY.exe
  2⤵
  PID:8860
- C:\Windows\System\HQkwQls.exe
  C:\Windows\System\HQkwQls.exe
  2⤵
  PID:8888
- C:\Windows\System\PsPtORx.exe
  C:\Windows\System\PsPtORx.exe
  2⤵
  PID:8916
- C:\Windows\System\RhxmTmE.exe
  C:\Windows\System\RhxmTmE.exe
  2⤵
  PID:8944
- C:\Windows\System\FZthdYI.exe
  C:\Windows\System\FZthdYI.exe
  2⤵
  PID:8976
- C:\Windows\System\nSOzIxG.exe
  C:\Windows\System\nSOzIxG.exe
  2⤵
  PID:9004
- C:\Windows\System\vPmnubz.exe
  C:\Windows\System\vPmnubz.exe
  2⤵
  PID:9032
- C:\Windows\System\KLilWGx.exe
  C:\Windows\System\KLilWGx.exe
  2⤵
  PID:9072
- C:\Windows\System\wFfNIhZ.exe
  C:\Windows\System\wFfNIhZ.exe
  2⤵
  PID:9108
- C:\Windows\System\yKvEBkt.exe
  C:\Windows\System\yKvEBkt.exe
  2⤵
  PID:9148
- C:\Windows\System\NTXxUIU.exe
  C:\Windows\System\NTXxUIU.exe
  2⤵
  PID:9184
- C:\Windows\System\XdkSxOQ.exe
  C:\Windows\System\XdkSxOQ.exe
  2⤵
  PID:8196
- C:\Windows\System\EeZewrn.exe
  C:\Windows\System\EeZewrn.exe
  2⤵
  PID:8264
- C:\Windows\System\zPKQPYq.exe
  C:\Windows\System\zPKQPYq.exe
  2⤵
  PID:8344
- C:\Windows\System\DHrmQUv.exe
  C:\Windows\System\DHrmQUv.exe
  2⤵
  PID:8404
- C:\Windows\System\BUmpowW.exe
  C:\Windows\System\BUmpowW.exe
  2⤵
  PID:8476
- C:\Windows\System\IdicXPJ.exe
  C:\Windows\System\IdicXPJ.exe
  2⤵
  PID:8544
- C:\Windows\System\iIIRORB.exe
  C:\Windows\System\iIIRORB.exe
  2⤵
  PID:8604
- C:\Windows\System\zqAVrPv.exe
  C:\Windows\System\zqAVrPv.exe
  2⤵
  PID:8660
- C:\Windows\System\lULnchw.exe
  C:\Windows\System\lULnchw.exe
  2⤵
  PID:8732
- C:\Windows\System\KOaEXJf.exe
  C:\Windows\System\KOaEXJf.exe
  2⤵
  PID:8796
- C:\Windows\System\BcfVyuX.exe
  C:\Windows\System\BcfVyuX.exe
  2⤵
  PID:8828
- C:\Windows\System\ZeUvLMC.exe
  C:\Windows\System\ZeUvLMC.exe
  2⤵
  PID:8900
- C:\Windows\System\hcrjiFo.exe
  C:\Windows\System\hcrjiFo.exe
  2⤵
  PID:8988
- C:\Windows\System\TGGsqNi.exe
  C:\Windows\System\TGGsqNi.exe
  2⤵
  PID:9064
- C:\Windows\System\rrXNMOP.exe
  C:\Windows\System\rrXNMOP.exe
  2⤵
  PID:9156
- C:\Windows\System\CjuOlev.exe
  C:\Windows\System\CjuOlev.exe
  2⤵
  PID:8232
- C:\Windows\System\rpYMwec.exe
  C:\Windows\System\rpYMwec.exe
  2⤵
  PID:8400
- C:\Windows\System\TubrvNc.exe
  C:\Windows\System\TubrvNc.exe
  2⤵
  PID:8520
- C:\Windows\System\gQShSUe.exe
  C:\Windows\System\gQShSUe.exe
  2⤵
  PID:8688
- C:\Windows\System\WDlDiKg.exe
  C:\Windows\System\WDlDiKg.exe
  2⤵
  PID:8856
- C:\Windows\System\CtishTW.exe
  C:\Windows\System\CtishTW.exe
  2⤵
  PID:8972
- C:\Windows\System\KwjlrZV.exe
  C:\Windows\System\KwjlrZV.exe
  2⤵
  PID:9196
- C:\Windows\System\eyslFXE.exe
  C:\Windows\System\eyslFXE.exe
  2⤵
  PID:8536
- C:\Windows\System\gKjpits.exe
  C:\Windows\System\gKjpits.exe
  2⤵
  PID:8760
- C:\Windows\System\QxhavHE.exe
  C:\Windows\System\QxhavHE.exe
  2⤵
  PID:8456
- C:\Windows\System\iyjKBcA.exe
  C:\Windows\System\iyjKBcA.exe
  2⤵
  PID:8316
- C:\Windows\System\VUTkBXr.exe
  C:\Windows\System\VUTkBXr.exe
  2⤵
  PID:9232
- C:\Windows\System\ZposlgE.exe
  C:\Windows\System\ZposlgE.exe
  2⤵
  PID:9260
- C:\Windows\System\qVCTVWF.exe
  C:\Windows\System\qVCTVWF.exe
  2⤵
  PID:9296
- C:\Windows\System\edRVxHY.exe
  C:\Windows\System\edRVxHY.exe
  2⤵
  PID:9328
- C:\Windows\System\mwIXaHW.exe
  C:\Windows\System\mwIXaHW.exe
  2⤵
  PID:9356
- C:\Windows\System\PKlxkgT.exe
  C:\Windows\System\PKlxkgT.exe
  2⤵
  PID:9384
- C:\Windows\System\SEqxXGh.exe
  C:\Windows\System\SEqxXGh.exe
  2⤵
  PID:9412
- C:\Windows\System\xupsdCP.exe
  C:\Windows\System\xupsdCP.exe
  2⤵
  PID:9440
- C:\Windows\System\UWOgIPn.exe
  C:\Windows\System\UWOgIPn.exe
  2⤵
  PID:9468
- C:\Windows\System\dWEtHCk.exe
  C:\Windows\System\dWEtHCk.exe
  2⤵
  PID:9496
- C:\Windows\System\rcrejvf.exe
  C:\Windows\System\rcrejvf.exe
  2⤵
  PID:9528
- C:\Windows\System\mMXemje.exe
  C:\Windows\System\mMXemje.exe
  2⤵
  PID:9556
- C:\Windows\System\yCnAaut.exe
  C:\Windows\System\yCnAaut.exe
  2⤵
  PID:9584
- C:\Windows\System\QXMPslL.exe
  C:\Windows\System\QXMPslL.exe
  2⤵
  PID:9612
- C:\Windows\System\WtEyJSe.exe
  C:\Windows\System\WtEyJSe.exe
  2⤵
  PID:9640
- C:\Windows\System\vWIpWmY.exe
  C:\Windows\System\vWIpWmY.exe
  2⤵
  PID:9668
- C:\Windows\System\tAdPHIe.exe
  C:\Windows\System\tAdPHIe.exe
  2⤵
  PID:9696
- C:\Windows\System\BKWPFSw.exe
  C:\Windows\System\BKWPFSw.exe
  2⤵
  PID:9724
- C:\Windows\System\HZlQkZz.exe
  C:\Windows\System\HZlQkZz.exe
  2⤵
  PID:9752
- C:\Windows\System\UcrMyrB.exe
  C:\Windows\System\UcrMyrB.exe
  2⤵
  PID:9780
- C:\Windows\System\AywtoIj.exe
  C:\Windows\System\AywtoIj.exe
  2⤵
  PID:9812
- C:\Windows\System\sOVHmMd.exe
  C:\Windows\System\sOVHmMd.exe
  2⤵
  PID:9840
- C:\Windows\System\aRmmZYR.exe
  C:\Windows\System\aRmmZYR.exe
  2⤵
  PID:9868
- C:\Windows\System\abJRvNa.exe
  C:\Windows\System\abJRvNa.exe
  2⤵
  PID:9896
- C:\Windows\System\TtXBRCG.exe
  C:\Windows\System\TtXBRCG.exe
  2⤵
  PID:9932
- C:\Windows\System\DDDLskj.exe
  C:\Windows\System\DDDLskj.exe
  2⤵
  PID:9972
- C:\Windows\System\sBUpYfR.exe
  C:\Windows\System\sBUpYfR.exe
  2⤵
  PID:10012
- C:\Windows\System\riqqYGh.exe
  C:\Windows\System\riqqYGh.exe
  2⤵
  PID:10040
- C:\Windows\System\AOFerMk.exe
  C:\Windows\System\AOFerMk.exe
  2⤵
  PID:10068
- C:\Windows\System\AvvFkwR.exe
  C:\Windows\System\AvvFkwR.exe
  2⤵
  PID:10100
- C:\Windows\System\nJSLhOM.exe
  C:\Windows\System\nJSLhOM.exe
  2⤵
  PID:10148
- C:\Windows\System\QfcxdlX.exe
  C:\Windows\System\QfcxdlX.exe
  2⤵
  PID:10176
- C:\Windows\System\MHvhUzS.exe
  C:\Windows\System\MHvhUzS.exe
  2⤵
  PID:10216
- C:\Windows\System\JFmASQx.exe
  C:\Windows\System\JFmASQx.exe
  2⤵
  PID:9228
- C:\Windows\System\ETVaWeN.exe
  C:\Windows\System\ETVaWeN.exe
  2⤵
  PID:9308
- C:\Windows\System\BnEISgq.exe
  C:\Windows\System\BnEISgq.exe
  2⤵
  PID:9380
- C:\Windows\System\zUURfBh.exe
  C:\Windows\System\zUURfBh.exe
  2⤵
  PID:9436
- C:\Windows\System\MJkRZIC.exe
  C:\Windows\System\MJkRZIC.exe
  2⤵
  PID:9508
- C:\Windows\System\NXupqqe.exe
  C:\Windows\System\NXupqqe.exe
  2⤵
  PID:9576
- C:\Windows\System\oULHQlj.exe
  C:\Windows\System\oULHQlj.exe
  2⤵
  PID:9624
- C:\Windows\System\XBpUWxf.exe
  C:\Windows\System\XBpUWxf.exe
  2⤵
  PID:9708
- C:\Windows\System\enPMVcO.exe
  C:\Windows\System\enPMVcO.exe
  2⤵
  PID:9772
- C:\Windows\System\EixWZQQ.exe
  C:\Windows\System\EixWZQQ.exe
  2⤵
  PID:9204
- C:\Windows\System\BwAAkeg.exe
  C:\Windows\System\BwAAkeg.exe
  2⤵
  PID:9140
- C:\Windows\System\QpMTHne.exe
  C:\Windows\System\QpMTHne.exe
  2⤵
  PID:9832
- C:\Windows\System\WxeayXX.exe
  C:\Windows\System\WxeayXX.exe
  2⤵
  PID:9892
- C:\Windows\System\ysyArBL.exe
  C:\Windows\System\ysyArBL.exe
  2⤵
  PID:9996
- C:\Windows\System\KQLUGKy.exe
  C:\Windows\System\KQLUGKy.exe
  2⤵
  PID:10056
- C:\Windows\System\TzlGajF.exe
  C:\Windows\System\TzlGajF.exe
  2⤵
  PID:10136
- C:\Windows\System\fjfkGgt.exe
  C:\Windows\System\fjfkGgt.exe
  2⤵
  PID:9952
- C:\Windows\System\ufokYcV.exe
  C:\Windows\System\ufokYcV.exe
  2⤵
  PID:9944
- C:\Windows\System\gadyDOt.exe
  C:\Windows\System\gadyDOt.exe
  2⤵
  PID:9288
- C:\Windows\System\qqjLhod.exe
  C:\Windows\System\qqjLhod.exe
  2⤵
  PID:9432
- C:\Windows\System\CWkwLQV.exe
  C:\Windows\System\CWkwLQV.exe
  2⤵
  PID:9604
- C:\Windows\System\GOPbWtQ.exe
  C:\Windows\System\GOPbWtQ.exe
  2⤵
  PID:9736
- C:\Windows\System\GyLMcib.exe
  C:\Windows\System\GyLMcib.exe
  2⤵
  PID:9316
- C:\Windows\System\faGKCCP.exe
  C:\Windows\System\faGKCCP.exe
  2⤵
  PID:9888
- C:\Windows\System\inZWnrR.exe
  C:\Windows\System\inZWnrR.exe
  2⤵
  PID:10092
- C:\Windows\System\jMBkXwr.exe
  C:\Windows\System\jMBkXwr.exe
  2⤵
  PID:9940
- C:\Windows\System\msasOst.exe
  C:\Windows\System\msasOst.exe
  2⤵
  PID:9568
- C:\Windows\System\ixQerHA.exe
  C:\Windows\System\ixQerHA.exe
  2⤵
  PID:8372
- C:\Windows\System\IzrFBDx.exe
  C:\Windows\System\IzrFBDx.exe
  2⤵
  PID:10032
- C:\Windows\System\mXqvCOM.exe
  C:\Windows\System\mXqvCOM.exe
  2⤵
  PID:4408
- C:\Windows\System\gtFdNvf.exe
  C:\Windows\System\gtFdNvf.exe
  2⤵
  PID:4088
- C:\Windows\System\bovgcRy.exe
  C:\Windows\System\bovgcRy.exe
  2⤵
  PID:9352
- C:\Windows\System\RMPktiK.exe
  C:\Windows\System\RMPktiK.exe
  2⤵
  PID:5756
- C:\Windows\System\BgCtvZn.exe
  C:\Windows\System\BgCtvZn.exe
  2⤵
  PID:9408
- C:\Windows\System\rsuQAZn.exe
  C:\Windows\System\rsuQAZn.exe
  2⤵
  PID:10208
- C:\Windows\System\EUOYucc.exe
  C:\Windows\System\EUOYucc.exe
  2⤵
  PID:1912
- C:\Windows\System\wMUurxg.exe
  C:\Windows\System\wMUurxg.exe
  2⤵
  PID:9552
- C:\Windows\System\aWbBHiu.exe
  C:\Windows\System\aWbBHiu.exe
  2⤵
  PID:6404
- C:\Windows\System\iikCCUI.exe
  C:\Windows\System\iikCCUI.exe
  2⤵
  PID:688
- C:\Windows\System\ACojcSC.exe
  C:\Windows\System\ACojcSC.exe
  2⤵
  PID:10268
- C:\Windows\System\AERrNeZ.exe
  C:\Windows\System\AERrNeZ.exe
  2⤵
  PID:10296
- C:\Windows\System\MGNiAnd.exe
  C:\Windows\System\MGNiAnd.exe
  2⤵
  PID:10324
- C:\Windows\System\wCDNxCM.exe
  C:\Windows\System\wCDNxCM.exe
  2⤵
  PID:10352
- C:\Windows\System\ycmpbuy.exe
  C:\Windows\System\ycmpbuy.exe
  2⤵
  PID:10380
- C:\Windows\System\rMVIrfU.exe
  C:\Windows\System\rMVIrfU.exe
  2⤵
  PID:10408
- C:\Windows\System\jvPrVQH.exe
  C:\Windows\System\jvPrVQH.exe
  2⤵
  PID:10436
- C:\Windows\System\BcdMAlI.exe
  C:\Windows\System\BcdMAlI.exe
  2⤵
  PID:10464
- C:\Windows\System\dPpuLGj.exe
  C:\Windows\System\dPpuLGj.exe
  2⤵
  PID:10492
- C:\Windows\System\WAAPYTj.exe
  C:\Windows\System\WAAPYTj.exe
  2⤵
  PID:10520
- C:\Windows\System\JqXepju.exe
  C:\Windows\System\JqXepju.exe
  2⤵
  PID:10548
- C:\Windows\System\dVmSsnZ.exe
  C:\Windows\System\dVmSsnZ.exe
  2⤵
  PID:10576
- C:\Windows\System\vPGInuj.exe
  C:\Windows\System\vPGInuj.exe
  2⤵
  PID:10604
- C:\Windows\System\ZsafPui.exe
  C:\Windows\System\ZsafPui.exe
  2⤵
  PID:10632
- C:\Windows\System\zlHiFfU.exe
  C:\Windows\System\zlHiFfU.exe
  2⤵
  PID:10660
- C:\Windows\System\phGCSNk.exe
  C:\Windows\System\phGCSNk.exe
  2⤵
  PID:10688
- C:\Windows\System\KIDwmmd.exe
  C:\Windows\System\KIDwmmd.exe
  2⤵
  PID:10716
- C:\Windows\System\ABLDeMq.exe
  C:\Windows\System\ABLDeMq.exe
  2⤵
  PID:10744
- C:\Windows\System\IkToJSG.exe
  C:\Windows\System\IkToJSG.exe
  2⤵
  PID:10772
- C:\Windows\System\VOYzCeI.exe
  C:\Windows\System\VOYzCeI.exe
  2⤵
  PID:10792
- C:\Windows\System\ChlqUlY.exe
  C:\Windows\System\ChlqUlY.exe
  2⤵
  PID:10820
- C:\Windows\System\fWolrlT.exe
  C:\Windows\System\fWolrlT.exe
  2⤵
  PID:10856
- C:\Windows\System\IhBYBnG.exe
  C:\Windows\System\IhBYBnG.exe
  2⤵
  PID:10884
- C:\Windows\System\NDBaACp.exe
  C:\Windows\System\NDBaACp.exe
  2⤵
  PID:10912
- C:\Windows\System\LnxOqtH.exe
  C:\Windows\System\LnxOqtH.exe
  2⤵
  PID:10940
- C:\Windows\System\lJFjtLv.exe
  C:\Windows\System\lJFjtLv.exe
  2⤵
  PID:10968
- C:\Windows\System\XYeFiJO.exe
  C:\Windows\System\XYeFiJO.exe
  2⤵
  PID:10996
- C:\Windows\System\mMEzpku.exe
  C:\Windows\System\mMEzpku.exe
  2⤵
  PID:11024
- C:\Windows\System\KMGUXZZ.exe
  C:\Windows\System\KMGUXZZ.exe
  2⤵
  PID:11052
- C:\Windows\System\byQgGhl.exe
  C:\Windows\System\byQgGhl.exe
  2⤵
  PID:11080
- C:\Windows\System\dgdXJee.exe
  C:\Windows\System\dgdXJee.exe
  2⤵
  PID:11108
- C:\Windows\System\xWcejTy.exe
  C:\Windows\System\xWcejTy.exe
  2⤵
  PID:11136
- C:\Windows\System\bNkeOOj.exe
  C:\Windows\System\bNkeOOj.exe
  2⤵
  PID:11164
- C:\Windows\System\zAyKQrZ.exe
  C:\Windows\System\zAyKQrZ.exe
  2⤵
  PID:11192
- C:\Windows\System\olvpZSO.exe
  C:\Windows\System\olvpZSO.exe
  2⤵
  PID:11220
- C:\Windows\System\RChJChG.exe
  C:\Windows\System\RChJChG.exe
  2⤵
  PID:11248
- C:\Windows\System\KbrDLFD.exe
  C:\Windows\System\KbrDLFD.exe
  2⤵
  PID:10264
- C:\Windows\System\NbLXXgB.exe
  C:\Windows\System\NbLXXgB.exe
  2⤵
  PID:10336
- C:\Windows\System\NzNmDXJ.exe
  C:\Windows\System\NzNmDXJ.exe
  2⤵
  PID:10400
- C:\Windows\System\bKHuAue.exe
  C:\Windows\System\bKHuAue.exe
  2⤵
  PID:10476
- C:\Windows\System\pKSLIYp.exe
  C:\Windows\System\pKSLIYp.exe
  2⤵
  PID:10544
- C:\Windows\System\HlYTFvD.exe
  C:\Windows\System\HlYTFvD.exe
  2⤵
  PID:10616
- C:\Windows\System\ZaiKyRi.exe
  C:\Windows\System\ZaiKyRi.exe
  2⤵
  PID:10684
- C:\Windows\System\FZljiZS.exe
  C:\Windows\System\FZljiZS.exe
  2⤵
  PID:10740
- C:\Windows\System\OJxDiRz.exe
  C:\Windows\System\OJxDiRz.exe
  2⤵
  PID:10808
- C:\Windows\System\EcrNrWJ.exe
  C:\Windows\System\EcrNrWJ.exe
  2⤵
  PID:10876
- C:\Windows\System\otqFUkC.exe
  C:\Windows\System\otqFUkC.exe
  2⤵
  PID:10932
- C:\Windows\System\rOGzQGH.exe
  C:\Windows\System\rOGzQGH.exe
  2⤵
  PID:10992
- C:\Windows\System\BSFxYDK.exe
  C:\Windows\System\BSFxYDK.exe
  2⤵
  PID:11064
- C:\Windows\System\kcGeWrd.exe
  C:\Windows\System\kcGeWrd.exe
  2⤵
  PID:11128
- C:\Windows\System\tsjZYYY.exe
  C:\Windows\System\tsjZYYY.exe
  2⤵
  PID:11188
- C:\Windows\System\uHevvxX.exe
  C:\Windows\System\uHevvxX.exe
  2⤵
  PID:11260
- C:\Windows\System\XYXJMWQ.exe
  C:\Windows\System\XYXJMWQ.exe
  2⤵
  PID:10392
- C:\Windows\System\QbIlcqI.exe
  C:\Windows\System\QbIlcqI.exe
  2⤵
  PID:10540
- C:\Windows\System\CIxvKxD.exe
  C:\Windows\System\CIxvKxD.exe
  2⤵
  PID:10728
- C:\Windows\System\TZNpnlC.exe
  C:\Windows\System\TZNpnlC.exe
  2⤵
  PID:10852
- C:\Windows\System\AzLvfQu.exe
  C:\Windows\System\AzLvfQu.exe
  2⤵
  PID:10988
- C:\Windows\System\kPcJwTf.exe
  C:\Windows\System\kPcJwTf.exe
  2⤵
  PID:11160
- C:\Windows\System\BDJJBDa.exe
  C:\Windows\System\BDJJBDa.exe
  2⤵
  PID:10320
- C:\Windows\System\SLnSjjU.exe
  C:\Windows\System\SLnSjjU.exe
  2⤵
  PID:10672
- C:\Windows\System\fmdAorC.exe
  C:\Windows\System\fmdAorC.exe
  2⤵
  PID:11048
- C:\Windows\System\RoKTfqP.exe
  C:\Windows\System\RoKTfqP.exe
  2⤵
  PID:10600
- C:\Windows\System\Eaktvat.exe
  C:\Windows\System\Eaktvat.exe
  2⤵
  PID:10512
- C:\Windows\System\MWayqBx.exe
  C:\Windows\System\MWayqBx.exe
  2⤵
  PID:11280
- C:\Windows\System\zwvRJeu.exe
  C:\Windows\System\zwvRJeu.exe
  2⤵
  PID:11308
- C:\Windows\System\JOhOmQm.exe
  C:\Windows\System\JOhOmQm.exe
  2⤵
  PID:11336
- C:\Windows\System\zVukPLe.exe
  C:\Windows\System\zVukPLe.exe
  2⤵
  PID:11364
- C:\Windows\System\unvnieh.exe
  C:\Windows\System\unvnieh.exe
  2⤵
  PID:11392
- C:\Windows\System\saPoDor.exe
  C:\Windows\System\saPoDor.exe
  2⤵
  PID:11420
- C:\Windows\System\lTHNoWm.exe
  C:\Windows\System\lTHNoWm.exe
  2⤵
  PID:11448
- C:\Windows\System\Wvjsest.exe
  C:\Windows\System\Wvjsest.exe
  2⤵
  PID:11476
- C:\Windows\System\lLvYWuQ.exe
  C:\Windows\System\lLvYWuQ.exe
  2⤵
  PID:11504
- C:\Windows\System\QUBdjLu.exe
  C:\Windows\System\QUBdjLu.exe
  2⤵
  PID:11524
- C:\Windows\System\ZzwBlXW.exe
  C:\Windows\System\ZzwBlXW.exe
  2⤵
  PID:11548
- C:\Windows\System\UwytQAg.exe
  C:\Windows\System\UwytQAg.exe
  2⤵
  PID:11588
- C:\Windows\System\OVizHXQ.exe
  C:\Windows\System\OVizHXQ.exe
  2⤵
  PID:11616
- C:\Windows\System\rBxVRun.exe
  C:\Windows\System\rBxVRun.exe
  2⤵
  PID:11644
- C:\Windows\System\RVnGetK.exe
  C:\Windows\System\RVnGetK.exe
  2⤵
  PID:11672
- C:\Windows\System\fvgiyra.exe
  C:\Windows\System\fvgiyra.exe
  2⤵
  PID:11700
- C:\Windows\System\awyFMJt.exe
  C:\Windows\System\awyFMJt.exe
  2⤵
  PID:11728
- C:\Windows\System\IiukUWV.exe
  C:\Windows\System\IiukUWV.exe
  2⤵
  PID:11756
- C:\Windows\System\yQiXjzh.exe
  C:\Windows\System\yQiXjzh.exe
  2⤵
  PID:11784
- C:\Windows\System\tsPIyLv.exe
  C:\Windows\System\tsPIyLv.exe
  2⤵
  PID:11812
- C:\Windows\System\mcJfxHe.exe
  C:\Windows\System\mcJfxHe.exe
  2⤵
  PID:11840
- C:\Windows\System\eVjLZxc.exe
  C:\Windows\System\eVjLZxc.exe
  2⤵
  PID:11868
- C:\Windows\System\mbcNLOU.exe
  C:\Windows\System\mbcNLOU.exe
  2⤵
  PID:11896
- C:\Windows\System\crTUBIt.exe
  C:\Windows\System\crTUBIt.exe
  2⤵
  PID:11924
- C:\Windows\System\TLJpuRY.exe
  C:\Windows\System\TLJpuRY.exe
  2⤵
  PID:11952
- C:\Windows\System\ONzacsj.exe
  C:\Windows\System\ONzacsj.exe
  2⤵
  PID:11980
- C:\Windows\System\lEhDIJU.exe
  C:\Windows\System\lEhDIJU.exe
  2⤵
  PID:12008
- C:\Windows\System\bmdZRiH.exe
  C:\Windows\System\bmdZRiH.exe
  2⤵
  PID:12036
- C:\Windows\System\FMFlatI.exe
  C:\Windows\System\FMFlatI.exe
  2⤵
  PID:12064
- C:\Windows\System\RUngjMR.exe
  C:\Windows\System\RUngjMR.exe
  2⤵
  PID:12092
- C:\Windows\System\BxRbIvb.exe
  C:\Windows\System\BxRbIvb.exe
  2⤵
  PID:12120
- C:\Windows\System\xHIlgnA.exe
  C:\Windows\System\xHIlgnA.exe
  2⤵
  PID:12148
- C:\Windows\System\XZrGVnC.exe
  C:\Windows\System\XZrGVnC.exe
  2⤵
  PID:12176
- C:\Windows\System\NhuVIVd.exe
  C:\Windows\System\NhuVIVd.exe
  2⤵
  PID:12204
- C:\Windows\System\IhKynEI.exe
  C:\Windows\System\IhKynEI.exe
  2⤵
  PID:12232
- C:\Windows\System\hUmJsvc.exe
  C:\Windows\System\hUmJsvc.exe
  2⤵
  PID:12260
- C:\Windows\System\IXfBpBe.exe
  C:\Windows\System\IXfBpBe.exe
  2⤵
  PID:10288
- C:\Windows\System\uWTtXAA.exe
  C:\Windows\System\uWTtXAA.exe
  2⤵
  PID:11328
- C:\Windows\System\usxoINV.exe
  C:\Windows\System\usxoINV.exe
  2⤵
  PID:11388
- C:\Windows\System\oFIrBsw.exe
  C:\Windows\System\oFIrBsw.exe
  2⤵
  PID:11460
- C:\Windows\System\BeteFFi.exe
  C:\Windows\System\BeteFFi.exe
  2⤵
  PID:11516
- C:\Windows\System\ZecIfWH.exe
  C:\Windows\System\ZecIfWH.exe
  2⤵
  PID:11544
- C:\Windows\System\MMrkuJW.exe
  C:\Windows\System\MMrkuJW.exe
  2⤵
  PID:11656
- C:\Windows\System\MyHqTxe.exe
  C:\Windows\System\MyHqTxe.exe
  2⤵
  PID:11720
- C:\Windows\System\KqRJmPG.exe
  C:\Windows\System\KqRJmPG.exe
  2⤵
  PID:1480
- C:\Windows\System\GNRdSwZ.exe
  C:\Windows\System\GNRdSwZ.exe
  2⤵
  PID:11776
- C:\Windows\System\GYaWEdw.exe
  C:\Windows\System\GYaWEdw.exe
  2⤵
  PID:11832
- C:\Windows\System\ObZeUoH.exe
  C:\Windows\System\ObZeUoH.exe
  2⤵
  PID:11908
- C:\Windows\System\czGzUBK.exe
  C:\Windows\System\czGzUBK.exe
  2⤵
  PID:10376
- C:\Windows\System\KpFgqyw.exe
  C:\Windows\System\KpFgqyw.exe
  2⤵
  PID:12028
- C:\Windows\System\zdSgQpr.exe
  C:\Windows\System\zdSgQpr.exe
  2⤵
  PID:12088
- C:\Windows\System\BEzEImt.exe
  C:\Windows\System\BEzEImt.exe
  2⤵
  PID:12160
- C:\Windows\System\BkqBgCg.exe
  C:\Windows\System\BkqBgCg.exe
  2⤵
  PID:12224
- C:\Windows\System\RgUVobY.exe
  C:\Windows\System\RgUVobY.exe
  2⤵
  PID:12284
- C:\Windows\System\OZBVhpC.exe
  C:\Windows\System\OZBVhpC.exe
  2⤵
  PID:11416
- C:\Windows\System\mDfPWNg.exe
  C:\Windows\System\mDfPWNg.exe
  2⤵
  PID:11532
- C:\Windows\System\YNYrVBg.exe
  C:\Windows\System\YNYrVBg.exe
  2⤵
  PID:4484
- C:\Windows\System\llvJhXV.exe
  C:\Windows\System\llvJhXV.exe
  2⤵
  PID:11964
- C:\Windows\System\zvAIeKV.exe
  C:\Windows\System\zvAIeKV.exe
  2⤵
  PID:12188
- C:\Windows\System\BrRKtEN.exe
  C:\Windows\System\BrRKtEN.exe
  2⤵
  PID:11684
- C:\Windows\System\FHIgYCz.exe
  C:\Windows\System\FHIgYCz.exe
  2⤵
  PID:11936
- C:\Windows\System\nwTVZlZ.exe
  C:\Windows\System\nwTVZlZ.exe
  2⤵
  PID:12328
- C:\Windows\System\MrVUosf.exe
  C:\Windows\System\MrVUosf.exe
  2⤵
  PID:12360
- C:\Windows\System\RQdRRsO.exe
  C:\Windows\System\RQdRRsO.exe
  2⤵
  PID:12384
- C:\Windows\System\SHOvagb.exe
  C:\Windows\System\SHOvagb.exe
  2⤵
  PID:12432
- C:\Windows\System\pcWQrKJ.exe
  C:\Windows\System\pcWQrKJ.exe
  2⤵
  PID:12464
- C:\Windows\System\XimHCFT.exe
  C:\Windows\System\XimHCFT.exe
  2⤵
  PID:12492
- C:\Windows\System\ScorKhx.exe
  C:\Windows\System\ScorKhx.exe
  2⤵
  PID:12524
- C:\Windows\System\GLHpUCQ.exe
  C:\Windows\System\GLHpUCQ.exe
  2⤵
  PID:12540
- C:\Windows\System\uFSsKFk.exe
  C:\Windows\System\uFSsKFk.exe
  2⤵
  PID:12600
- C:\Windows\System\TBlhOlP.exe
  C:\Windows\System\TBlhOlP.exe
  2⤵
  PID:12620
- C:\Windows\System\BuORIUe.exe
  C:\Windows\System\BuORIUe.exe
  2⤵
  PID:12648
- C:\Windows\System\tyBfaqc.exe
  C:\Windows\System\tyBfaqc.exe
  2⤵
  PID:12676
- C:\Windows\System\qwNfguw.exe
  C:\Windows\System\qwNfguw.exe
  2⤵
  PID:12704
- C:\Windows\System\UqqEKCJ.exe
  C:\Windows\System\UqqEKCJ.exe
  2⤵
  PID:12732
- C:\Windows\System\MKgemvv.exe
  C:\Windows\System\MKgemvv.exe
  2⤵
  PID:12760
- C:\Windows\System\lIrMjQQ.exe
  C:\Windows\System\lIrMjQQ.exe
  2⤵
  PID:12788
- C:\Windows\System\svuDLlz.exe
  C:\Windows\System\svuDLlz.exe
  2⤵
  PID:12816
- C:\Windows\System\QsgZtgP.exe
  C:\Windows\System\QsgZtgP.exe
  2⤵
  PID:12844
- C:\Windows\System\yEByEbJ.exe
  C:\Windows\System\yEByEbJ.exe
  2⤵
  PID:12872
- C:\Windows\System\kzrmpfb.exe
  C:\Windows\System\kzrmpfb.exe
  2⤵
  PID:12900
- C:\Windows\System\wyqDjTH.exe
  C:\Windows\System\wyqDjTH.exe
  2⤵
  PID:12928
- C:\Windows\System\lfneTso.exe
  C:\Windows\System\lfneTso.exe
  2⤵
  PID:12956
- C:\Windows\System\nAChxLw.exe
  C:\Windows\System\nAChxLw.exe
  2⤵
  PID:12980
- C:\Windows\System\iYfXBYl.exe
  C:\Windows\System\iYfXBYl.exe
  2⤵
  PID:13008
- C:\Windows\System\TtPaNIE.exe
  C:\Windows\System\TtPaNIE.exe
  2⤵
  PID:13028
- C:\Windows\System\UKxsUgO.exe
  C:\Windows\System\UKxsUgO.exe
  2⤵
  PID:13064
- C:\Windows\System\PYRjOTk.exe
  C:\Windows\System\PYRjOTk.exe
  2⤵
  PID:13084
- C:\Windows\System\mfCSQqH.exe
  C:\Windows\System\mfCSQqH.exe
  2⤵
  PID:13112
- C:\Windows\System\AGRPkAJ.exe
  C:\Windows\System\AGRPkAJ.exe
  2⤵
  PID:13140
- C:\Windows\System\nlwBCuu.exe
  C:\Windows\System\nlwBCuu.exe
  2⤵
  PID:13168
- C:\Windows\System\YEzHkWU.exe
  C:\Windows\System\YEzHkWU.exe
  2⤵
  PID:13208
- C:\Windows\System\eWgTJUQ.exe
  C:\Windows\System\eWgTJUQ.exe
  2⤵
  PID:13196
- C:\Windows\System\FKRBNOE.exe
  C:\Windows\System\FKRBNOE.exe
  2⤵
  PID:13216
- C:\Windows\System\IwIKGei.exe
  C:\Windows\System\IwIKGei.exe
  2⤵
  PID:13264
- C:\Windows\System\KGjkBXA.exe
  C:\Windows\System\KGjkBXA.exe
  2⤵
  PID:13292
- C:\Windows\System\PbcmTcH.exe
  C:\Windows\System\PbcmTcH.exe
  2⤵
  PID:11752
- C:\Windows\System\ypnBnoA.exe
  C:\Windows\System\ypnBnoA.exe
  2⤵
  PID:12356
- C:\Windows\System\hOmRugB.exe
  C:\Windows\System\hOmRugB.exe
  2⤵
  PID:12416
- C:\Windows\System\yoXQZDe.exe
  C:\Windows\System\yoXQZDe.exe
  2⤵
  PID:12488
- C:\Windows\System\qDgJLHy.exe
  C:\Windows\System\qDgJLHy.exe
  2⤵
  PID:12564
- C:\Windows\System\GmtbFxk.exe
  C:\Windows\System\GmtbFxk.exe
  2⤵
  PID:12632
- C:\Windows\System\BmKNsdx.exe
  C:\Windows\System\BmKNsdx.exe
  2⤵
  PID:12700
- C:\Windows\System\UgpaRsP.exe
  C:\Windows\System\UgpaRsP.exe
  2⤵
  PID:12724
- C:\Windows\System\JVRxojH.exe
  C:\Windows\System\JVRxojH.exe
  2⤵
  PID:7120
- C:\Windows\System\bRUKcET.exe
  C:\Windows\System\bRUKcET.exe
  2⤵
  PID:6172
- C:\Windows\System\NisqjMu.exe
  C:\Windows\System\NisqjMu.exe
  2⤵
  PID:3960
- C:\Windows\System\EMELCVz.exe
  C:\Windows\System\EMELCVz.exe
  2⤵
  PID:12772
- C:\Windows\System\LHArhNX.exe
  C:\Windows\System\LHArhNX.exe
  2⤵
  PID:4288
- C:\Windows\System\uxWvYuD.exe
  C:\Windows\System\uxWvYuD.exe
  2⤵
  PID:7348
- C:\Windows\System\oeRFhZP.exe
  C:\Windows\System\oeRFhZP.exe
  2⤵
  PID:4704
- C:\Windows\System\ETaRcSt.exe
  C:\Windows\System\ETaRcSt.exe
  2⤵
  PID:1604
- C:\Windows\System\YolcZRG.exe
  C:\Windows\System\YolcZRG.exe
  2⤵
  PID:2996
- C:\Windows\System\Cnennwv.exe
  C:\Windows\System\Cnennwv.exe
  2⤵
  PID:13096
- C:\Windows\System\WayIMeo.exe
  C:\Windows\System\WayIMeo.exe
  2⤵
  PID:12988
- C:\Windows\System\ePRQfVV.exe
  C:\Windows\System\ePRQfVV.exe
  2⤵
  PID:13128
- C:\Windows\System\qpXYTiF.exe
  C:\Windows\System\qpXYTiF.exe
  2⤵
  PID:13124
- C:\Windows\System\XJxydTj.exe
  C:\Windows\System\XJxydTj.exe
  2⤵
  PID:13304
- C:\Windows\System\aSRYOUd.exe
  C:\Windows\System\aSRYOUd.exe
  2⤵
  PID:12400
- C:\Windows\System\lKyNvol.exe
  C:\Windows\System\lKyNvol.exe
  2⤵
  PID:12536
- C:\Windows\System\Lfgyrgr.exe
  C:\Windows\System\Lfgyrgr.exe
  2⤵
  PID:12752
- C:\Windows\System\kVLxTCV.exe
  C:\Windows\System\kVLxTCV.exe
  2⤵
  PID:6236
- C:\Windows\System\YtwZFkD.exe
  C:\Windows\System\YtwZFkD.exe
  2⤵
  PID:3536
- C:\Windows\System\pYKUGDL.exe
  C:\Windows\System\pYKUGDL.exe
  2⤵
  PID:7204
- C:\Windows\System\Fxockfi.exe
  C:\Windows\System\Fxockfi.exe
  2⤵
  PID:4208
- C:\Windows\System\PyvRYbs.exe
  C:\Windows\System\PyvRYbs.exe
  2⤵
  PID:13080
- C:\Windows\System\fUHowqg.exe
  C:\Windows\System\fUHowqg.exe
  2⤵
  PID:13256
- C:\Windows\System\ZllTmjo.exe
  C:\Windows\System\ZllTmjo.exe
  2⤵
  PID:12532
- C:\Windows\System\ozQHzTU.exe
  C:\Windows\System\ozQHzTU.exe
  2⤵
  PID:6152
- C:\Windows\System\oNgthLt.exe
  C:\Windows\System\oNgthLt.exe
  2⤵
  PID:12884
- C:\Windows\System\vctPIDN.exe
  C:\Windows\System\vctPIDN.exe
  2⤵
  PID:13204
- C:\Windows\System\tvFaPCf.exe
  C:\Windows\System\tvFaPCf.exe
  2⤵
  PID:6156
- C:\Windows\System\ZWdpCcE.exe
  C:\Windows\System\ZWdpCcE.exe
  2⤵
  PID:12380
- C:\Windows\System\CQQhAaw.exe
  C:\Windows\System\CQQhAaw.exe
  2⤵
  PID:13320
- C:\Windows\System\SzEEMuY.exe
  C:\Windows\System\SzEEMuY.exe
  2⤵
  PID:13348
- C:\Windows\System\ZyKvmbP.exe
  C:\Windows\System\ZyKvmbP.exe
  2⤵
  PID:13376
- C:\Windows\System\WPQNhgZ.exe
  C:\Windows\System\WPQNhgZ.exe
  2⤵
  PID:13404
- C:\Windows\System\uRxaXjG.exe
  C:\Windows\System\uRxaXjG.exe
  2⤵
  PID:13432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gpifpfjw.r5z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\AvXwGBB.exe

Filesize
2.6MB

MD5
7018906a0e2f75db4b814567d6358bf5

SHA1
a150605d2793a59c960418dc41aeb4973989f8cc

SHA256
4962a559eed89188f4c158077cefdad67894609e507e335bef4e08701d579a4d

SHA512
6cae44104c0f3d78fa8477553fa6502b10e2fa2e834eae1b443d033032126abc452daa545132796f9f426dfdf85de883506c286722eb9f97b123fa9bfde5d3b7

Download Submit
C:\Windows\System\GpTseSi.exe

Filesize
2.6MB

MD5
49e847d06431a22cd953f2b9dbc410ed

SHA1
2f35f7772455df1bd436669a99ede00c2f68df1f

SHA256
e3eb7b9a17a6e6864a4b7ee62d1d989f7997089e85ce1ea24f93aa8d9c72fda4

SHA512
e8fe6a13877bfe2fcb9ad3f5469a4bfbc23f671743071a4af0be220bc4f6896b4c6fda7bb067ba8cddbf1c2a61b02a0a6e76baa72d9044505deafe3a1946e2ab

Download Submit
C:\Windows\System\HhlZByr.exe

Filesize
2.6MB

MD5
2f80e2e0c394357a97b64c972f14d7f8

SHA1
2ab51d45bcdfc49430b4d8dbfa14e6645485510f

SHA256
8f93382f628f69d46af541f069e3e499c946857aa3a969e5457e37a95d61642a

SHA512
f59f18e20b92f0507be19d69ec695da98496fc49517daac4e7dea291da8c63da4e617924c8de070b08ad732de5c3c3c5d294ba7b263eea1d1b778b5ae7bba561

Download Submit
C:\Windows\System\IKhqrFB.exe

Filesize
2.6MB

MD5
2d435f40c9a41fa998a81f4905226e87

SHA1
8ddc28ee8154026b5491da8ee5ad3a0b3b9120f8

SHA256
3c393884b363114c4e881ccdf9f82f50ce201744399c62105071d00b2cb74c01

SHA512
21debb6c61881b7c3adea1f264094d5c443fe5327190fd3a29908b6b30494e01aad04b069b4c8f749b78a9ea5a6f26a4b5225d6d0d34d377b71808b4b7c7d6b9

Download Submit
C:\Windows\System\INcCOVh.exe

Filesize
2.6MB

MD5
d5d2e2349ceaf3338381484818f3cce4

SHA1
b7eb248125f2e3feed09b00711f191ab036e5053

SHA256
33020e22b3485fb657262a64df6932b085bb6a79410fecc09bd99523bafa7401

SHA512
2e36b76bf044a1168c3f82a01c06a069ea2e213f781c48725de5dea1a218b65e0fabfcf143e1ba2949c9fd94db4d31bd4f7194c1fc5481c1ac3fcb054baf2e65

Download Submit
C:\Windows\System\MLLbZQy.exe

Filesize
2.6MB

MD5
25abd405d1c931611ba21ab07ef59bc7

SHA1
9b76c9c02c9ce996151df643b7d40c306827f31c

SHA256
32acf6168ec7ffd29ed29f0bc9d2d4a862c74153a64a891e229f16e29353fc1d

SHA512
7fd866fa0cb8f8fb650dbfb5e8882263862255fafc41fe9ce4966b2d3664e38446e114af8b6341ff6f24a9295a195da6fbd0e2ff7aa680ee5206aa88fc15cef6

Download Submit
C:\Windows\System\NTTvuuH.exe

Filesize
2.6MB

MD5
a5f5a8bedc4fab8c8b70a731013b5e72

SHA1
8ef51028fdcff86f4b869c396dc2b66fcdf842e9

SHA256
a8f837eaf7a407bca1b1dc1d6d6caa4ce526503bcdfbe007d6fc8cd859ec4deb

SHA512
f9d267b53d9c6e90ad776eb57e768c32de034252f8c343864a7f98c68a5a6a2295ebcedaa9bf09a44067ae2752f53bf3f6dfd12b2a8fd2586a8761bcc31df0bf

Download Submit
C:\Windows\System\OMoWJKO.exe

Filesize
2.6MB

MD5
733f072353b0aa96c2a45c400dd6b24d

SHA1
134f01bec0076b41398176835114e46f2a0b4ad9

SHA256
f8984be48f1a13fc7de29dbed417cd7c1816dc9b4d261bf333eb242e465e3386

SHA512
d81a13e91bb52cb9c68798f443bfd154bada1c7f3a76318b536be97398ad24bc76259122f896cd61343da0861ab1afd3f4c9d7393b5186ef59a058c50455a83d

Download Submit
C:\Windows\System\RmEUJDr.exe

Filesize
2.6MB

MD5
7969973301b810eeeebe9794250f08be

SHA1
e7b8595cff8281eaf91df83fa53791380b4263ab

SHA256
50160c763e739de57ae5e8f43709ce61f5ba1ff23db9e6f36d0131bb5dc6b981

SHA512
320eaa3dc32a4a42d53e137f33bb8451d1a6d094f355ccbecd66dab7c5f29cddae171d249eabf47ed57e5aeb448129ccc105ac46d12d0b1a4e60f244395623fe

Download Submit
C:\Windows\System\RspcUYh.exe

Filesize
8B

MD5
b4264996759d988d82730e6958cf8074

SHA1
7bbc1f74a3ce00994d790da4622d87f15f45b523

SHA256
8ec7039187958fcd27e56e585c4d65242972777fffc8821de830bc1ff1727bca

SHA512
90e2f3e49d27ab4d11cbf031af514cf6fc3a8851362bc0086d9e25b2d97c3341159ec901fb19a665474ceb995371e4f69eda62c3d14f844ace445c61339d139c

Download Submit
C:\Windows\System\VfvgGoM.exe

Filesize
2.6MB

MD5
a5a150257962e476a9d6146786b57120

SHA1
1b2ddf71282b45914d3f21ec53ea9c7e4edf21ca

SHA256
50cd1122df00942782563a37839f37a81aa7abd7190b55eb31b6a9ef77b744d0

SHA512
b72124f707fc3f23bd685ce8edba5437b6c4cedf8813e4a89b9a5504fe7ed489b6008ba10631cae03ec192c1a3a7fc0d3ae860334424eb5c4c954acbeca86063

Download Submit
C:\Windows\System\ZSfEZSw.exe

Filesize
2.6MB

MD5
8de2c4600fb818e280018690902d7ab0

SHA1
0c9660949d96d0f68b3735ee4a314848990765db

SHA256
c4a4e663ca8b894c8772817b43a10756173465615a765c4f54bc858d39e483f5

SHA512
f6fa389f13eecfcfeacb1ea55833f77755d0daa2524588df7cc4e6c722e8541f7d7b6e0201be5d12b4d524b37fad3284181ac54210e8fa5e1042760c4a9916a5

Download Submit
C:\Windows\System\cQmeeTW.exe

Filesize
2.6MB

MD5
4cf664223c97c0c3c1774b624ba5e788

SHA1
3287497a77435e11e193880746e226cc65feca0e

SHA256
20ea7616179ca22a45673aac4b9e797c7bbca2d28c119af2476204c90422d2ee

SHA512
956044c54395955c70213287a576c4822d9d20ecd26a1a7f31c32be7eac9f7a011c15e51b6291cb8065a2639e1d02297435dbc6342129fb49625dab325574810

Download Submit
C:\Windows\System\dEkHDit.exe

Filesize
2.6MB

MD5
978e778cdcbdfb221ed8fde06d00dd62

SHA1
88eb28eea99dac44f03a700e41224b2379b22d45

SHA256
45117d2f266003ff35425488ea5e4a646fe75e75b7e9a267f6e5cdf151640b0b

SHA512
45418c15a07e4190b8769de245047720bc043637243546aedf6769a9011b15e295103aba5e3f9905528b001f42c4fa460bf6253f767406e668ebaf306415c4ac

Download Submit
C:\Windows\System\eApGcfr.exe

Filesize
2.6MB

MD5
aa71fac58be354320d13433d64ba0a2f

SHA1
b041dcccc6d98ddf37d2c4ea62da9da45eb8d6b9

SHA256
2a9b9629a981dcfb189fa161e455f4a2c571c83b0b72453f5338313d26377a8d

SHA512
affce48456a4e7d097bb8580a9ac7466202ee708e48f0e8e1c2305318bcda753d11db839c068e6f4cbf714e0a7dc6c10bf1c03d8c2668078f2745973ed21b993

Download Submit
C:\Windows\System\eRyMoIW.exe

Filesize
2.6MB

MD5
bc89f4c9fefb44ea00cc2034d87c77fd

SHA1
5c37ce31d3e18d85a6b51d620084c9bfbf25ead1

SHA256
a7d4dcee475b86a4e4e75eca9f326340873db4fa0f03b4c8688a967db101e894

SHA512
e0105598055792b7f394dfa684baff80ba1cc5fc7114349adc26cfef805f787701c5da7b21e9274b113d957d1c228666b577926f49f307dc0e4eda6c4e8de30d

Download Submit
C:\Windows\System\eyFOfQa.exe

Filesize
2.6MB

MD5
1dff5b1b08a561a230e399cff29e6e33

SHA1
fa3b4c92d2022b7ac55fa9ac8410bab46ebd82f4

SHA256
29b0b3e813cbc274f42802f085e886275d4592adf48dd7cee2d507e41284b427

SHA512
3ebfe7ea96bf3e5c613091a6f46948c0523aba24fbd24f46fd12585a1a65067dc814ae67340590a9b8a01c796c611383bb925daf4449c7077497cda05b322724

Download Submit
C:\Windows\System\ghyJVEy.exe

Filesize
2.6MB

MD5
583cf3b048897db6c570e119eb56403e

SHA1
bdf3c550174601cde30c125c900149c0222c90a8

SHA256
44c6aa13686bf668dc6ccff5f9444f87904901fa15f79ad3b330aef111963b91

SHA512
47b4095bce6a57522da70d6a21558291f4049e278fe9dd2ceccaccbfd304bc360c71155443919acbba58083cc4c672f80bc90498459bbeefe332c02efd74708f

Download Submit
C:\Windows\System\hbyLiXL.exe

Filesize
2.6MB

MD5
ca82775847440a7dc81a227e7256d746

SHA1
426148dc43acb0729df4a40b2ead00cb98190964

SHA256
2fa02a8d5fe4690bf170c9646b65834ceb0fd378ca681b0d815608b8d446203b

SHA512
66e1d25e6f574216567ddb227dcd4b064a97b042f09fb7d72f7c1d79cfb6bb9c9099cbf4f73e32fcfb8ca87e82c3e60cd0e0c9b563b4defc129035475737ed27

Download Submit
C:\Windows\System\ixzwkPg.exe

Filesize
2.6MB

MD5
f6d800812fbff433e7a1c6f286c75eb4

SHA1
61af2f1886c3ae9d0ff3c79c44d4b9b925739866

SHA256
9dce57e2613bd0a9319501e24bf0ce84a61053fa1d69cf82be905dc382e45216

SHA512
7b6c9962a08124aff2342095e66a299fc0bd7e67b54d7b9a682414c9ed14d5a46045050d81d7f08fec53bea0a98c57b2d94ad1d25bb75e5eb3801231c56ea43a

Download Submit
C:\Windows\System\kvsuXFw.exe

Filesize
2.6MB

MD5
6c0871e76eba6a54d18b03eb7468fd7f

SHA1
5131fd395a1535bbfddc298e746eecf7425f3e56

SHA256
6f2ac182fbe4a88ea76c7a8a558e7a9d290c20e31ffa9fa636da17f5cc835f18

SHA512
e613d1f2a908b72950f795d05a7577148a9294081c423c417b104ac6ea57dbb2bd4a932046e89acb8d1269d8368b2dfcf486ff8457b76586053e7450ead7fb92

Download Submit
C:\Windows\System\miEmWjs.exe

Filesize
2.6MB

MD5
a6b93c9b9601ee89d504b833e0ad1dff

SHA1
f6331dc29befc6a57d7422b408807676d2c31dc0

SHA256
96a3f1c1c4d5257fa31775463dff92cc2ce7dd8171a1e9cda6c1a5dd89143378

SHA512
4c0a9bc6a94e0b8ef8f5e0d48554fb8add0e21e97116d62fd8074169d8f0d81510aa3e6cb4e964179c40bdecdaa9ebecea4b30ce597af476043fac0a3637fece

Download Submit
C:\Windows\System\nREeIHQ.exe

Filesize
2.6MB

MD5
f3592d51c3966a15d3f0994be138d45c

SHA1
6c7a6dc5694e6fea916bcfd48e1270176554483c

SHA256
24a0741a714b132aed85863e2c4d753b68e71374af3852ea4d100e1e922dcd59

SHA512
2fdfe3504950c355de33e15c6279502e8567c523a67a73c578fd6689a47c2c5ad1d515e589f48bfbdd2c8145d92fb6688c70c77c7de4a91ea8de135c57c3f53f

Download Submit
C:\Windows\System\nmCJzkF.exe

Filesize
2.6MB

MD5
26e68f0dad32cccbf2e9c9215e793f54

SHA1
79a653e99a22491d36d47a5de69320e6f7a9d29a

SHA256
38f1de180c08476397e7f5fe2ac1accd8d4bfe2aff63c45622f44d4fb582a50f

SHA512
5385495441a754ae55995e2061f0561699ff26ef76df92325e4273f358e5015d539be5819d36459157c4691919b7c2d842990d652a2baf02da53329c38613240

Download Submit
C:\Windows\System\pOTtwAI.exe

Filesize
2.6MB

MD5
234abea8c5de9dfbd5beed99d7d40a8e

SHA1
60484a29de8ceddee54c33e108dde78a35a2156a

SHA256
b43d9ed29feca68ec7e11a071c03de065977447dc03c508fa396bfbd8c50937f

SHA512
4f17b8c7ca1aea39fec3ea6d31c8495a88e9744f4238dd102ad7776f48965d9056fb13e6b72976dd08674030fe4a37a749f2562bfe6a0908e6e30c31106d896e

Download Submit
C:\Windows\System\pdzAmzO.exe

Filesize
2.6MB

MD5
ee8bafb61f98c21cc0be0f448ad0ae96

SHA1
6538f6204bd59670784fc85eb39acb12ce9d1011

SHA256
fb4c0872eca87e72897bc4adbedccdc7edf222a91fa53a74dec49ea73b69410a

SHA512
73e50f5e4ec3aae28d8f7025063e68cce0f791b1d5aaa7323c7cc86d33de1a1e9525922030fe672ff3c1a554b73370cb95952faf0cecd3b04cf01094dd5a0ecd

Download Submit
C:\Windows\System\sJAWZcU.exe

Filesize
2.6MB

MD5
bc9e66a68a61b216a7976bd0eb76994c

SHA1
eedcbb3d3dea3c055081109ffe9ad7819d3e8f6f

SHA256
7349d708ced8eaf55016124f939e54aedbb8e2fe09ff745c2f1444f80a33d28c

SHA512
0b7bfc199071e15d215799e440ae789ea3c37aad288f7689befbbfd92f4f5742d4e43e104b0d40e96c32d6ef0fd4a70a63843183cc1d436a5f84b4af5e28bbce

Download Submit
C:\Windows\System\sggCNBk.exe

Filesize
2.6MB

MD5
44b6d2019d2b7ca6cd9f24898ad646ac

SHA1
f2d217e3d27f07d3113f50e33abe60d57611425d

SHA256
67e1592b55939d4eb2b3b183e5a4c7ec60108c785082ce8f0f6313d363180a65

SHA512
3dcb584817f2d1507f59f9fc5305d03356f3e5b67d9d50ffc8173cac1dedec146f46a139a1744675b7a542e3233ee93e63906e103362e4ac7d2f8ba646e4dc96

Download Submit
C:\Windows\System\sljIhfT.exe

Filesize
2.6MB

MD5
06ea76c64b2e126ebe2b2fc87433225f

SHA1
9e4d3d244606e0dc96b879fbd638c7ff38b1534b

SHA256
aa19a8abf8d69eb9859fe9608b58984b37c60c3b7bfe3e6ad1d8f8e833d231fb

SHA512
92e3d65f90fe284daef982088bbf9422aefc67dfa758896cc50d5df2572c16b343ecb81338621ff74c7f90914712edb325a037ce0c04a1c4fc25e70115d83023

Download Submit
C:\Windows\System\tHjzEnP.exe

Filesize
2.6MB

MD5
1a99fcf484d5694ee19305ccdf417cb2

SHA1
2c710eb341a56e6682a1931d8a77a2817b736195

SHA256
d3333995b7515d156d4fbcf8afffe6ab978f4146763c253bf0e15c910fd3674e

SHA512
d199b488067d7806147691781ecb4f04b70c5aa160b99afb68e712647674ec9b4c9de521bbc8b7eef4a968d1de704c0807ab0a3302a90543b9c379e3f34a9ed6

Download Submit
C:\Windows\System\uSyasyv.exe

Filesize
2.6MB

MD5
60fcc4cd28e2304807429a250392eb51

SHA1
e217b9bd34193cac39077faabc59c5634570fdc2

SHA256
56034dc2fa225fd1f20a453b85b1a300c285c221030d4e3840fe8be6793d8a84

SHA512
2da3fe4074224966be1acd94cb712cd2f6a4b01b63542ec249ae5a87492b9407664f9d5651625e2454dd8c1bac60806e9baa1d86f3a16d648b32173587abc78b

Download Submit
C:\Windows\System\urLyNSr.exe

Filesize
2.6MB

MD5
b0fbe810be61f54e5a63fce0a250d75c

SHA1
6367126f11eb4f8633456671c17bbf169ab0c1ac

SHA256
1e1602ea194b12ef8f10dedfdee4f1b353f101e6d880192811ecb268664d74d4

SHA512
16b4049bdeef14ed1c47cbfbe386f019a2d39700f445d187cc224d00f65c1926c1a7bcab120c491a0ce5c8b44c4f8b4e29c547387d53489a71df4abd174b63db

Download Submit
C:\Windows\System\vWZBDmn.exe

Filesize
2.6MB

MD5
c8a076ed9a595cc65b4e5cf77c692592

SHA1
7f68970f57d5c9e0a21227e6b42f733a9bc6cc87

SHA256
c752b3b8525df8363a071d0dbbdd5c7909ab38832b54fa277f021d2c1b7acec3

SHA512
9f4b9102b42f982a1ea9d266ab51ea4bf2769a639c31d3f0b2611fd8ee720c65efc1eed796b35186e5e9fb3d06e4735a587c890953b884ec9de42d682a588f40

Download Submit
C:\Windows\System\zlyvaEA.exe

Filesize
2.6MB

MD5
9cc6242104463127deac63c144d32a62

SHA1
62eea5c9d7473988a8f5639c80bb474edd55e171

SHA256
8734a799ef774d8d843e0297c6836e3ae3b5fe481aedf679d6dd44a5b43874a4

SHA512
a785247ff11c18a874b515e98e1fc1a7fe5b0e25bf9397f2b7a7597266ae7738c0b061bb913c7a79a587654fb7d84c703c1330da4775fbee0f561d7e59e2c47e

Download Submit
memory/852-2490-0x00007FF6F3000000-0x00007FF6F33F6000-memory.dmp

Filesize
4.0MB

Download
memory/852-164-0x00007FF6F3000000-0x00007FF6F33F6000-memory.dmp

Filesize
4.0MB

Download
memory/856-165-0x00007FF60F150000-0x00007FF60F546000-memory.dmp

Filesize
4.0MB

Download
memory/856-2495-0x00007FF60F150000-0x00007FF60F546000-memory.dmp

Filesize
4.0MB

Download
memory/1160-97-0x00007FF603920000-0x00007FF603D16000-memory.dmp

Filesize
4.0MB

Download
memory/1160-2475-0x00007FF603920000-0x00007FF603D16000-memory.dmp

Filesize
4.0MB

Download
memory/1504-167-0x00007FF7E2590000-0x00007FF7E2986000-memory.dmp

Filesize
4.0MB

Download
memory/1504-2497-0x00007FF7E2590000-0x00007FF7E2986000-memory.dmp

Filesize
4.0MB

Download
memory/1772-174-0x00007FF7D4320000-0x00007FF7D4716000-memory.dmp

Filesize
4.0MB

Download
memory/1772-2494-0x00007FF7D4320000-0x00007FF7D4716000-memory.dmp

Filesize
4.0MB

Download
memory/1784-2498-0x00007FF68BF20000-0x00007FF68C316000-memory.dmp

Filesize
4.0MB

Download
memory/1784-166-0x00007FF68BF20000-0x00007FF68C316000-memory.dmp

Filesize
4.0MB

Download
memory/1848-171-0x00007FF773BD0000-0x00007FF773FC6000-memory.dmp

Filesize
4.0MB

Download
memory/1848-2488-0x00007FF773BD0000-0x00007FF773FC6000-memory.dmp

Filesize
4.0MB

Download
memory/2084-2492-0x00007FF65E5F0000-0x00007FF65E9E6000-memory.dmp

Filesize
4.0MB

Download
memory/2084-163-0x00007FF65E5F0000-0x00007FF65E9E6000-memory.dmp

Filesize
4.0MB

Download
memory/2176-1-0x0000028DAD520000-0x0000028DAD530000-memory.dmp

Filesize
64KB

Download
memory/2176-0-0x00007FF7C5A10000-0x00007FF7C5E06000-memory.dmp

Filesize
4.0MB

Download
memory/2176-2066-0x00007FF7C5A10000-0x00007FF7C5E06000-memory.dmp

Filesize
4.0MB

Download
memory/2352-155-0x00007FF6C7080000-0x00007FF6C7476000-memory.dmp

Filesize
4.0MB

Download
memory/2352-2485-0x00007FF6C7080000-0x00007FF6C7476000-memory.dmp

Filesize
4.0MB

Download
memory/2356-111-0x00007FF642F30000-0x00007FF643326000-memory.dmp

Filesize
4.0MB

Download
memory/2356-2480-0x00007FF642F30000-0x00007FF643326000-memory.dmp

Filesize
4.0MB

Download
memory/2372-2489-0x00007FF63B600000-0x00007FF63B9F6000-memory.dmp

Filesize
4.0MB

Download
memory/2372-172-0x00007FF63B600000-0x00007FF63B9F6000-memory.dmp

Filesize
4.0MB

Download
memory/2820-2491-0x00007FF630470000-0x00007FF630866000-memory.dmp

Filesize
4.0MB

Download
memory/2820-161-0x00007FF630470000-0x00007FF630866000-memory.dmp

Filesize
4.0MB

Download
memory/3008-2487-0x00007FF7EF670000-0x00007FF7EFA66000-memory.dmp

Filesize
4.0MB

Download
memory/3008-162-0x00007FF7EF670000-0x00007FF7EFA66000-memory.dmp

Filesize
4.0MB

Download
memory/3516-169-0x00007FF77CFA0000-0x00007FF77D396000-memory.dmp

Filesize
4.0MB

Download
memory/3516-2478-0x00007FF77CFA0000-0x00007FF77D396000-memory.dmp

Filesize
4.0MB

Download
memory/3632-2481-0x00007FF6AFDD0000-0x00007FF6B01C6000-memory.dmp

Filesize
4.0MB

Download
memory/3632-118-0x00007FF6AFDD0000-0x00007FF6B01C6000-memory.dmp

Filesize
4.0MB

Download
memory/3876-2479-0x00007FF61DB00000-0x00007FF61DEF6000-memory.dmp

Filesize
4.0MB

Download
memory/3876-139-0x00007FF61DB00000-0x00007FF61DEF6000-memory.dmp

Filesize
4.0MB

Download
memory/3936-91-0x00007FF60FCB0000-0x00007FF6100A6000-memory.dmp

Filesize
4.0MB

Download
memory/3936-2477-0x00007FF60FCB0000-0x00007FF6100A6000-memory.dmp

Filesize
4.0MB

Download
memory/3992-170-0x00007FF712E90000-0x00007FF713286000-memory.dmp

Filesize
4.0MB

Download
memory/3992-2484-0x00007FF712E90000-0x00007FF713286000-memory.dmp

Filesize
4.0MB

Download
memory/4244-72-0x0000028323F40000-0x0000028323F62000-memory.dmp

Filesize
136KB

Download
memory/4244-7-0x00007FF844743000-0x00007FF844745000-memory.dmp

Filesize
8KB

Download
memory/4244-2067-0x00007FF844743000-0x00007FF844745000-memory.dmp

Filesize
8KB

Download
memory/4244-37-0x00007FF844740000-0x00007FF845201000-memory.dmp

Filesize
10.8MB

Download
memory/4244-175-0x0000028324C10000-0x00000283253B6000-memory.dmp

Filesize
7.6MB

Download
memory/4244-56-0x00007FF844740000-0x00007FF845201000-memory.dmp

Filesize
10.8MB

Download
memory/4524-74-0x00007FF6EF130000-0x00007FF6EF526000-memory.dmp

Filesize
4.0MB

Download
memory/4524-2476-0x00007FF6EF130000-0x00007FF6EF526000-memory.dmp

Filesize
4.0MB

Download
memory/4692-148-0x00007FF79B350000-0x00007FF79B746000-memory.dmp

Filesize
4.0MB

Download
memory/4692-2482-0x00007FF79B350000-0x00007FF79B746000-memory.dmp

Filesize
4.0MB

Download
memory/4848-2486-0x00007FF768620000-0x00007FF768A16000-memory.dmp

Filesize
4.0MB

Download
memory/4848-160-0x00007FF768620000-0x00007FF768A16000-memory.dmp

Filesize
4.0MB

Download
memory/4888-2483-0x00007FF6DABF0000-0x00007FF6DAFE6000-memory.dmp

Filesize
4.0MB

Download
memory/4888-147-0x00007FF6DABF0000-0x00007FF6DAFE6000-memory.dmp

Filesize
4.0MB

Download
memory/4928-168-0x00007FF6FBA10000-0x00007FF6FBE06000-memory.dmp

Filesize
4.0MB

Download
memory/4928-2496-0x00007FF6FBA10000-0x00007FF6FBE06000-memory.dmp

Filesize
4.0MB

Download
memory/4984-173-0x00007FF687430000-0x00007FF687826000-memory.dmp

Filesize
4.0MB

Download
memory/4984-2493-0x00007FF687430000-0x00007FF687826000-memory.dmp

Filesize
4.0MB

Download