xmrig | 3c99e0ff4834dd864caca3cfdf550e2816a8268981e723221f6724141d76715f

Analysis

max time kernel
142s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 16:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
Size

2.9MB
MD5

2be3501831f62f6fc6f2f59a8a54f900
SHA1

c2187a3e3e27abbc9d79333e5a5f166ede5cad82
SHA256

3c99e0ff4834dd864caca3cfdf550e2816a8268981e723221f6724141d76715f
SHA512

4fec46cf1a653dfd36fb5ef0b8cb5d4eb1390116cb4c85eff118781c9a4c0315d747b278cac39241b071f64c24d5b18e49a85d099ea04f22b358568bd173980b
SSDEEP

49152:S1G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrWax9hMkHC0IaSEzQR4iRr:S1ONtyBeSFkXV1etEKLlWUTOfeiRA2RN

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/2208-0-0x00007FF7228B0000-0x00007FF722CA6000-memory.dmp	xmrig
behavioral2/files/0x000900000002344b-12.dat	xmrig
behavioral2/files/0x0008000000023456-38.dat	xmrig
behavioral2/memory/4660-42-0x00007FF7BC6F0000-0x00007FF7BCAE6000-memory.dmp	xmrig
behavioral2/files/0x0008000000023455-44.dat	xmrig
behavioral2/files/0x0007000000023457-54.dat	xmrig
behavioral2/files/0x0007000000023459-57.dat	xmrig
behavioral2/files/0x000700000002345c-81.dat	xmrig
behavioral2/files/0x000700000002345b-80.dat	xmrig
behavioral2/memory/3840-79-0x00007FF608890000-0x00007FF608C86000-memory.dmp	xmrig
behavioral2/files/0x000700000002345e-90.dat	xmrig
behavioral2/files/0x000700000002345f-97.dat	xmrig
behavioral2/memory/4120-110-0x00007FF657B70000-0x00007FF657F66000-memory.dmp	xmrig
behavioral2/memory/4116-127-0x00007FF69E050000-0x00007FF69E446000-memory.dmp	xmrig
behavioral2/files/0x0007000000023463-133.dat	xmrig
behavioral2/files/0x0007000000023466-141.dat	xmrig
behavioral2/memory/1476-147-0x00007FF669F30000-0x00007FF66A326000-memory.dmp	xmrig
behavioral2/files/0x0007000000023467-153.dat	xmrig
behavioral2/memory/2952-158-0x00007FF76E5B0000-0x00007FF76E9A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023468-161.dat	xmrig
behavioral2/memory/2032-162-0x00007FF74F9B0000-0x00007FF74FDA6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023467-156.dat	xmrig
behavioral2/memory/5060-155-0x00007FF64A630000-0x00007FF64AA26000-memory.dmp	xmrig
behavioral2/memory/4284-154-0x00007FF6A6B50000-0x00007FF6A6F46000-memory.dmp	xmrig
behavioral2/memory/4868-152-0x00007FF739B00000-0x00007FF739EF6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023465-145.dat	xmrig
behavioral2/memory/3620-142-0x00007FF7C5CA0000-0x00007FF7C6096000-memory.dmp	xmrig
behavioral2/memory/1048-140-0x00007FF7B13B0000-0x00007FF7B17A6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023464-143.dat	xmrig
behavioral2/memory/4152-139-0x00007FF6D4DB0000-0x00007FF6D51A6000-memory.dmp	xmrig
behavioral2/memory/4968-130-0x00007FF79FEF0000-0x00007FF7A02E6000-memory.dmp	xmrig
behavioral2/files/0x0007000000023462-123.dat	xmrig
behavioral2/memory/2256-121-0x00007FF75A500000-0x00007FF75A8F6000-memory.dmp	xmrig
behavioral2/memory/1812-119-0x00007FF6DE910000-0x00007FF6DED06000-memory.dmp	xmrig
behavioral2/files/0x0007000000023462-118.dat	xmrig
behavioral2/files/0x0007000000023461-116.dat	xmrig
behavioral2/memory/2572-115-0x00007FF7F1150000-0x00007FF7F1546000-memory.dmp	xmrig
behavioral2/files/0x0009000000023450-111.dat	xmrig
behavioral2/files/0x0007000000023469-170.dat	xmrig
behavioral2/files/0x000700000002346a-175.dat	xmrig
behavioral2/files/0x000700000002346b-180.dat	xmrig
behavioral2/files/0x000700000002346c-185.dat	xmrig
behavioral2/files/0x000700000002346b-179.dat	xmrig
behavioral2/memory/1172-105-0x00007FF65D1B0000-0x00007FF65D5A6000-memory.dmp	xmrig
behavioral2/files/0x000700000002346f-190.dat	xmrig
behavioral2/files/0x0007000000023471-200.dat	xmrig
behavioral2/files/0x0007000000023470-194.dat	xmrig
behavioral2/memory/556-99-0x00007FF660F10000-0x00007FF661306000-memory.dmp	xmrig
behavioral2/files/0x0007000000023460-98.dat	xmrig
behavioral2/memory/1596-93-0x00007FF6C2C90000-0x00007FF6C3086000-memory.dmp	xmrig
behavioral2/files/0x000700000002345e-88.dat	xmrig
behavioral2/memory/3656-86-0x00007FF7BCDC0000-0x00007FF7BD1B6000-memory.dmp	xmrig
behavioral2/files/0x000700000002345a-74.dat	xmrig
behavioral2/files/0x000700000002345d-77.dat	xmrig
behavioral2/files/0x000700000002345c-76.dat	xmrig
behavioral2/files/0x0007000000023458-61.dat	xmrig
behavioral2/memory/4092-58-0x00007FF60AF50000-0x00007FF60B346000-memory.dmp	xmrig
behavioral2/memory/4092-1860-0x00007FF60AF50000-0x00007FF60B346000-memory.dmp	xmrig
behavioral2/memory/2208-1540-0x00007FF7228B0000-0x00007FF722CA6000-memory.dmp	xmrig
behavioral2/memory/2304-51-0x00007FF6BF6E0000-0x00007FF6BFAD6000-memory.dmp	xmrig
behavioral2/memory/3720-46-0x00007FF749B30000-0x00007FF749F26000-memory.dmp	xmrig
behavioral2/files/0x0007000000023454-34.dat	xmrig
behavioral2/files/0x0007000000023453-25.dat	xmrig
behavioral2/files/0x000800000002327d-7.dat	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
10	2124	powershell.exe
12	2124	powershell.exe
22	2124	powershell.exe
23	2124	powershell.exe
26	2124	powershell.exe
35	2124	powershell.exe
36	2124	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2124	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
3840	XFErhRC.exe
4660	bRAeLdb.exe
3720	nmidpHU.exe
2304	jGUrraU.exe
3656	qpVPIyN.exe
1596	LuJqTrf.exe
556	UwVyLYq.exe
4092	OOngFsZ.exe
1172	JanujiU.exe
2256	shUaqQU.exe
4116	MCjVxBO.exe
4120	lgBxcZe.exe
2572	YnMJatz.exe
4968	btrkWfW.exe
4152	nBvBeNM.exe
1812	zIOdVxg.exe
1048	RkGfnep.exe
3620	DKpmqjc.exe
1476	xjZbkjR.exe
4284	gDbmSgm.exe
5060	nbCNCvu.exe
4868	WnmGYbx.exe
2952	KAgrTVC.exe
2032	ZLWTEEy.exe
2332	YDPqbXN.exe
4252	NrPFzAM.exe
3972	JwXudxX.exe
4208	rEictAv.exe
3332	yzPHYKC.exe
968	lkbcaxn.exe
2108	JwRIrDA.exe
648	BsVAapK.exe
2040	NXMZKSf.exe
4072	nIBTFJo.exe
1636	evyHiqZ.exe
3568	vmRaUix.exe
524	bWbKgoc.exe
4224	kJbbvGC.exe
2120	UnvWBGd.exe
2300	cDLTDSY.exe
3444	epRYHwT.exe
3732	mJjVsza.exe
2956	mRwnjeL.exe
2716	DlhbHmz.exe
4860	okeKXsp.exe
4088	oNMOaCg.exe
4972	zAIwYRw.exe
3968	BszdMrr.exe
3484	xlEYGwV.exe
4460	JbqcOkr.exe
3052	zbbCpPW.exe
2016	zGjRDrI.exe
3960	DGmxJMs.exe
2664	wEyLWLQ.exe
1032	OSynpRM.exe
4464	GjSWQzX.exe
3864	bHrddls.exe
1504	hvbesqp.exe
3628	lDwDyxz.exe
2684	QCUgTZR.exe
4348	faCBnKG.exe
2768	eevBzxg.exe
3640	zMEjfVD.exe
948	ikrDdPs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2208-0-0x00007FF7228B0000-0x00007FF722CA6000-memory.dmp	upx
behavioral2/files/0x000900000002344b-12.dat	upx
behavioral2/files/0x0008000000023456-38.dat	upx
behavioral2/memory/4660-42-0x00007FF7BC6F0000-0x00007FF7BCAE6000-memory.dmp	upx
behavioral2/files/0x0008000000023455-44.dat	upx
behavioral2/files/0x0007000000023457-54.dat	upx
behavioral2/files/0x0007000000023459-57.dat	upx
behavioral2/files/0x000700000002345c-81.dat	upx
behavioral2/files/0x000700000002345b-80.dat	upx
behavioral2/memory/3840-79-0x00007FF608890000-0x00007FF608C86000-memory.dmp	upx
behavioral2/files/0x000700000002345e-90.dat	upx
behavioral2/files/0x000700000002345f-97.dat	upx
behavioral2/memory/4120-110-0x00007FF657B70000-0x00007FF657F66000-memory.dmp	upx
behavioral2/memory/4116-127-0x00007FF69E050000-0x00007FF69E446000-memory.dmp	upx
behavioral2/files/0x0007000000023463-133.dat	upx
behavioral2/files/0x0007000000023466-141.dat	upx
behavioral2/memory/1476-147-0x00007FF669F30000-0x00007FF66A326000-memory.dmp	upx
behavioral2/files/0x0007000000023467-153.dat	upx
behavioral2/memory/2952-158-0x00007FF76E5B0000-0x00007FF76E9A6000-memory.dmp	upx
behavioral2/files/0x0007000000023468-161.dat	upx
behavioral2/memory/2032-162-0x00007FF74F9B0000-0x00007FF74FDA6000-memory.dmp	upx
behavioral2/files/0x0007000000023467-156.dat	upx
behavioral2/memory/5060-155-0x00007FF64A630000-0x00007FF64AA26000-memory.dmp	upx
behavioral2/memory/4284-154-0x00007FF6A6B50000-0x00007FF6A6F46000-memory.dmp	upx
behavioral2/memory/4868-152-0x00007FF739B00000-0x00007FF739EF6000-memory.dmp	upx
behavioral2/files/0x0007000000023465-145.dat	upx
behavioral2/memory/3620-142-0x00007FF7C5CA0000-0x00007FF7C6096000-memory.dmp	upx
behavioral2/memory/1048-140-0x00007FF7B13B0000-0x00007FF7B17A6000-memory.dmp	upx
behavioral2/files/0x0007000000023464-143.dat	upx
behavioral2/memory/4152-139-0x00007FF6D4DB0000-0x00007FF6D51A6000-memory.dmp	upx
behavioral2/memory/4968-130-0x00007FF79FEF0000-0x00007FF7A02E6000-memory.dmp	upx
behavioral2/files/0x0007000000023462-123.dat	upx
behavioral2/memory/2256-121-0x00007FF75A500000-0x00007FF75A8F6000-memory.dmp	upx
behavioral2/memory/1812-119-0x00007FF6DE910000-0x00007FF6DED06000-memory.dmp	upx
behavioral2/files/0x0007000000023462-118.dat	upx
behavioral2/files/0x0007000000023461-116.dat	upx
behavioral2/memory/2572-115-0x00007FF7F1150000-0x00007FF7F1546000-memory.dmp	upx
behavioral2/files/0x0009000000023450-111.dat	upx
behavioral2/files/0x0007000000023469-170.dat	upx
behavioral2/files/0x000700000002346a-175.dat	upx
behavioral2/files/0x000700000002346b-180.dat	upx
behavioral2/files/0x000700000002346c-185.dat	upx
behavioral2/files/0x000700000002346b-179.dat	upx
behavioral2/memory/1172-105-0x00007FF65D1B0000-0x00007FF65D5A6000-memory.dmp	upx
behavioral2/files/0x000700000002346f-190.dat	upx
behavioral2/files/0x0007000000023471-200.dat	upx
behavioral2/files/0x0007000000023470-194.dat	upx
behavioral2/memory/556-99-0x00007FF660F10000-0x00007FF661306000-memory.dmp	upx
behavioral2/files/0x0007000000023460-98.dat	upx
behavioral2/memory/1596-93-0x00007FF6C2C90000-0x00007FF6C3086000-memory.dmp	upx
behavioral2/files/0x000700000002345d-91.dat	upx
behavioral2/files/0x000700000002345e-88.dat	upx
behavioral2/memory/3656-86-0x00007FF7BCDC0000-0x00007FF7BD1B6000-memory.dmp	upx
behavioral2/files/0x000700000002345a-74.dat	upx
behavioral2/files/0x000700000002345d-77.dat	upx
behavioral2/files/0x000700000002345c-76.dat	upx
behavioral2/files/0x0007000000023458-61.dat	upx
behavioral2/memory/4092-58-0x00007FF60AF50000-0x00007FF60B346000-memory.dmp	upx
behavioral2/memory/4092-1860-0x00007FF60AF50000-0x00007FF60B346000-memory.dmp	upx
behavioral2/memory/2208-1540-0x00007FF7228B0000-0x00007FF722CA6000-memory.dmp	upx
behavioral2/memory/2304-51-0x00007FF6BF6E0000-0x00007FF6BFAD6000-memory.dmp	upx
behavioral2/memory/3720-46-0x00007FF749B30000-0x00007FF749F26000-memory.dmp	upx
behavioral2/files/0x0007000000023454-34.dat	upx
behavioral2/files/0x0007000000023453-25.dat	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zMEjfVD.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\XjSYByz.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\ruJbRyL.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\VxfObYo.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\KoVVfYV.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\RIBGnrG.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\yfhvbYj.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\lSZfJjN.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\fHqkjmv.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\yGPbmsi.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\SRFCrTc.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\RTCJpwx.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\kkYEvhM.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\KWoETXS.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\GLFkztV.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\DbkQJal.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\qZZGUCf.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\jCvtziI.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\JwRIrDA.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\tODXqyK.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\qjpieLm.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\lvMxMlN.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\reLVMWo.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\ajwrpdh.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\syYyCVi.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\bwoPHFA.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\vOzfUYC.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\juASwAl.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\MVhewqg.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\RjZebct.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\vVPgFlM.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\xdiIoGl.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\MoKiOuX.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\MIEoPyf.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\SlKtHWD.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\pFUecOI.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\SoEKuwh.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\eZegAEY.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\CtalGIe.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\FVMHBqJ.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\HAsTlvW.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\gecVUmD.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\dozIArl.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\ZlGAfBZ.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\AWKfNdi.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\ShPvwKG.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\fnNcxbk.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\LUIiauo.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\ktCszQr.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\jQpAZsk.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\PTmpxfm.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\wZEfuem.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\XBcvrcZ.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\TZqgTUA.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\dfRlkNp.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\SqUzPVU.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\nbCNCvu.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\HfTNjcy.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\RduXrJZ.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\qcylOyr.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\jkJUTKK.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\OsSsvTn.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\rUfReJu.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
File created	C:\Windows\System\RiIEDLA.exe	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2124	powershell.exe
2124	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeLockMemoryPrivilege	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2124	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	84
PID 2208 wrote to memory of 2124	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	84
PID 2208 wrote to memory of 3840	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	85
PID 2208 wrote to memory of 3840	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	85
PID 2208 wrote to memory of 4660	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	86
PID 2208 wrote to memory of 4660	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	86
PID 2208 wrote to memory of 3720	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	87
PID 2208 wrote to memory of 3720	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	87
PID 2208 wrote to memory of 2304	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	88
PID 2208 wrote to memory of 2304	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	88
PID 2208 wrote to memory of 3656	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	89
PID 2208 wrote to memory of 3656	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	89
PID 2208 wrote to memory of 1596	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	90
PID 2208 wrote to memory of 1596	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	90
PID 2208 wrote to memory of 556	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	91
PID 2208 wrote to memory of 556	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	91
PID 2208 wrote to memory of 4092	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	92
PID 2208 wrote to memory of 4092	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	92
PID 2208 wrote to memory of 1172	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	93
PID 2208 wrote to memory of 1172	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	93
PID 2208 wrote to memory of 2256	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	94
PID 2208 wrote to memory of 2256	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	94
PID 2208 wrote to memory of 4116	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	95
PID 2208 wrote to memory of 4116	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	95
PID 2208 wrote to memory of 4120	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	96
PID 2208 wrote to memory of 4120	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	96
PID 2208 wrote to memory of 2572	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	97
PID 2208 wrote to memory of 2572	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	97
PID 2208 wrote to memory of 4968	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	98
PID 2208 wrote to memory of 4968	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	98
PID 2208 wrote to memory of 4152	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	99
PID 2208 wrote to memory of 4152	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	99
PID 2208 wrote to memory of 1812	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	100
PID 2208 wrote to memory of 1812	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	100
PID 2208 wrote to memory of 1048	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	101
PID 2208 wrote to memory of 1048	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	101
PID 2208 wrote to memory of 3620	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	102
PID 2208 wrote to memory of 3620	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	102
PID 2208 wrote to memory of 1476	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	103
PID 2208 wrote to memory of 1476	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	103
PID 2208 wrote to memory of 4284	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	104
PID 2208 wrote to memory of 4284	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	104
PID 2208 wrote to memory of 5060	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	105
PID 2208 wrote to memory of 5060	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	105
PID 2208 wrote to memory of 4868	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	106
PID 2208 wrote to memory of 4868	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	106
PID 2208 wrote to memory of 2952	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	107
PID 2208 wrote to memory of 2952	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	107
PID 2208 wrote to memory of 2032	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	108
PID 2208 wrote to memory of 2032	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	108
PID 2208 wrote to memory of 2332	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	109
PID 2208 wrote to memory of 2332	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	109
PID 2208 wrote to memory of 4252	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	110
PID 2208 wrote to memory of 4252	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	110
PID 2208 wrote to memory of 3972	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	111
PID 2208 wrote to memory of 3972	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	111
PID 2208 wrote to memory of 4208	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	112
PID 2208 wrote to memory of 4208	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	112
PID 2208 wrote to memory of 3332	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	113
PID 2208 wrote to memory of 3332	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	113
PID 2208 wrote to memory of 968	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	114
PID 2208 wrote to memory of 968	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	114
PID 2208 wrote to memory of 2108	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	115
PID 2208 wrote to memory of 2108	2208	2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe	115

C:\Users\Admin\AppData\Local\Temp\2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2be3501831f62f6fc6f2f59a8a54f900_NeikiAnalytics.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\System\XFErhRC.exe
  C:\Windows\System\XFErhRC.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\bRAeLdb.exe
  C:\Windows\System\bRAeLdb.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\nmidpHU.exe
  C:\Windows\System\nmidpHU.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\jGUrraU.exe
  C:\Windows\System\jGUrraU.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\qpVPIyN.exe
  C:\Windows\System\qpVPIyN.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\LuJqTrf.exe
  C:\Windows\System\LuJqTrf.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\UwVyLYq.exe
  C:\Windows\System\UwVyLYq.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\OOngFsZ.exe
  C:\Windows\System\OOngFsZ.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\JanujiU.exe
  C:\Windows\System\JanujiU.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\shUaqQU.exe
  C:\Windows\System\shUaqQU.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\MCjVxBO.exe
  C:\Windows\System\MCjVxBO.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\lgBxcZe.exe
  C:\Windows\System\lgBxcZe.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\YnMJatz.exe
  C:\Windows\System\YnMJatz.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\btrkWfW.exe
  C:\Windows\System\btrkWfW.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\nBvBeNM.exe
  C:\Windows\System\nBvBeNM.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\zIOdVxg.exe
  C:\Windows\System\zIOdVxg.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\RkGfnep.exe
  C:\Windows\System\RkGfnep.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\DKpmqjc.exe
  C:\Windows\System\DKpmqjc.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\xjZbkjR.exe
  C:\Windows\System\xjZbkjR.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\gDbmSgm.exe
  C:\Windows\System\gDbmSgm.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\nbCNCvu.exe
  C:\Windows\System\nbCNCvu.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\WnmGYbx.exe
  C:\Windows\System\WnmGYbx.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\KAgrTVC.exe
  C:\Windows\System\KAgrTVC.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\ZLWTEEy.exe
  C:\Windows\System\ZLWTEEy.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\YDPqbXN.exe
  C:\Windows\System\YDPqbXN.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\NrPFzAM.exe
  C:\Windows\System\NrPFzAM.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\JwXudxX.exe
  C:\Windows\System\JwXudxX.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\rEictAv.exe
  C:\Windows\System\rEictAv.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\yzPHYKC.exe
  C:\Windows\System\yzPHYKC.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\lkbcaxn.exe
  C:\Windows\System\lkbcaxn.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\JwRIrDA.exe
  C:\Windows\System\JwRIrDA.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\BsVAapK.exe
  C:\Windows\System\BsVAapK.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\NXMZKSf.exe
  C:\Windows\System\NXMZKSf.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\nIBTFJo.exe
  C:\Windows\System\nIBTFJo.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\evyHiqZ.exe
  C:\Windows\System\evyHiqZ.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\vmRaUix.exe
  C:\Windows\System\vmRaUix.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\bWbKgoc.exe
  C:\Windows\System\bWbKgoc.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\kJbbvGC.exe
  C:\Windows\System\kJbbvGC.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\UnvWBGd.exe
  C:\Windows\System\UnvWBGd.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\cDLTDSY.exe
  C:\Windows\System\cDLTDSY.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\epRYHwT.exe
  C:\Windows\System\epRYHwT.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\mJjVsza.exe
  C:\Windows\System\mJjVsza.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\mRwnjeL.exe
  C:\Windows\System\mRwnjeL.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\DlhbHmz.exe
  C:\Windows\System\DlhbHmz.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\okeKXsp.exe
  C:\Windows\System\okeKXsp.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\oNMOaCg.exe
  C:\Windows\System\oNMOaCg.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\zAIwYRw.exe
  C:\Windows\System\zAIwYRw.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\BszdMrr.exe
  C:\Windows\System\BszdMrr.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\xlEYGwV.exe
  C:\Windows\System\xlEYGwV.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\JbqcOkr.exe
  C:\Windows\System\JbqcOkr.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\zbbCpPW.exe
  C:\Windows\System\zbbCpPW.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\zGjRDrI.exe
  C:\Windows\System\zGjRDrI.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\DGmxJMs.exe
  C:\Windows\System\DGmxJMs.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\wEyLWLQ.exe
  C:\Windows\System\wEyLWLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\OSynpRM.exe
  C:\Windows\System\OSynpRM.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\GjSWQzX.exe
  C:\Windows\System\GjSWQzX.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\bHrddls.exe
  C:\Windows\System\bHrddls.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\hvbesqp.exe
  C:\Windows\System\hvbesqp.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\lDwDyxz.exe
  C:\Windows\System\lDwDyxz.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\QCUgTZR.exe
  C:\Windows\System\QCUgTZR.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\faCBnKG.exe
  C:\Windows\System\faCBnKG.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\eevBzxg.exe
  C:\Windows\System\eevBzxg.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\zMEjfVD.exe
  C:\Windows\System\zMEjfVD.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\ikrDdPs.exe
  C:\Windows\System\ikrDdPs.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\kadCYfY.exe
  C:\Windows\System\kadCYfY.exe
  2⤵
  PID:4720
- C:\Windows\System\EPTOUIq.exe
  C:\Windows\System\EPTOUIq.exe
  2⤵
  PID:5140
- C:\Windows\System\KRQDdfQ.exe
  C:\Windows\System\KRQDdfQ.exe
  2⤵
  PID:5176
- C:\Windows\System\fHqkjmv.exe
  C:\Windows\System\fHqkjmv.exe
  2⤵
  PID:5212
- C:\Windows\System\MDtnkfX.exe
  C:\Windows\System\MDtnkfX.exe
  2⤵
  PID:5236
- C:\Windows\System\SlNFsUd.exe
  C:\Windows\System\SlNFsUd.exe
  2⤵
  PID:5264
- C:\Windows\System\nXZeWvI.exe
  C:\Windows\System\nXZeWvI.exe
  2⤵
  PID:5300
- C:\Windows\System\ZfxWlcq.exe
  C:\Windows\System\ZfxWlcq.exe
  2⤵
  PID:5360
- C:\Windows\System\gPjGhSX.exe
  C:\Windows\System\gPjGhSX.exe
  2⤵
  PID:5400
- C:\Windows\System\CFUmKhG.exe
  C:\Windows\System\CFUmKhG.exe
  2⤵
  PID:5444
- C:\Windows\System\XaFeRlw.exe
  C:\Windows\System\XaFeRlw.exe
  2⤵
  PID:5472
- C:\Windows\System\pXUQjOX.exe
  C:\Windows\System\pXUQjOX.exe
  2⤵
  PID:5504
- C:\Windows\System\VCmyxdB.exe
  C:\Windows\System\VCmyxdB.exe
  2⤵
  PID:5536
- C:\Windows\System\HKCQseZ.exe
  C:\Windows\System\HKCQseZ.exe
  2⤵
  PID:5616
- C:\Windows\System\daoNaMi.exe
  C:\Windows\System\daoNaMi.exe
  2⤵
  PID:5668
- C:\Windows\System\MNhUnMk.exe
  C:\Windows\System\MNhUnMk.exe
  2⤵
  PID:5716
- C:\Windows\System\oRoatYt.exe
  C:\Windows\System\oRoatYt.exe
  2⤵
  PID:5756
- C:\Windows\System\qZZheOs.exe
  C:\Windows\System\qZZheOs.exe
  2⤵
  PID:5820
- C:\Windows\System\NMTiVwB.exe
  C:\Windows\System\NMTiVwB.exe
  2⤵
  PID:5876
- C:\Windows\System\pQgSLnw.exe
  C:\Windows\System\pQgSLnw.exe
  2⤵
  PID:5916
- C:\Windows\System\SFrDUFI.exe
  C:\Windows\System\SFrDUFI.exe
  2⤵
  PID:5968
- C:\Windows\System\WgASbdN.exe
  C:\Windows\System\WgASbdN.exe
  2⤵
  PID:5984
- C:\Windows\System\XjSYByz.exe
  C:\Windows\System\XjSYByz.exe
  2⤵
  PID:6060
- C:\Windows\System\TtOAnIa.exe
  C:\Windows\System\TtOAnIa.exe
  2⤵
  PID:6128
- C:\Windows\System\aHNnQVX.exe
  C:\Windows\System\aHNnQVX.exe
  2⤵
  PID:5208
- C:\Windows\System\OFyInhd.exe
  C:\Windows\System\OFyInhd.exe
  2⤵
  PID:5248
- C:\Windows\System\bjbTpRM.exe
  C:\Windows\System\bjbTpRM.exe
  2⤵
  PID:2164
- C:\Windows\System\eLLEADg.exe
  C:\Windows\System\eLLEADg.exe
  2⤵
  PID:5332
- C:\Windows\System\tODXqyK.exe
  C:\Windows\System\tODXqyK.exe
  2⤵
  PID:5460
- C:\Windows\System\DoLFrFc.exe
  C:\Windows\System\DoLFrFc.exe
  2⤵
  PID:5548
- C:\Windows\System\eKUhQjT.exe
  C:\Windows\System\eKUhQjT.exe
  2⤵
  PID:5608
- C:\Windows\System\rwJItzv.exe
  C:\Windows\System\rwJItzv.exe
  2⤵
  PID:5744
- C:\Windows\System\EvtuYXO.exe
  C:\Windows\System\EvtuYXO.exe
  2⤵
  PID:5788
- C:\Windows\System\qClXOlB.exe
  C:\Windows\System\qClXOlB.exe
  2⤵
  PID:5848
- C:\Windows\System\kCaZqGI.exe
  C:\Windows\System\kCaZqGI.exe
  2⤵
  PID:5896
- C:\Windows\System\tqPjPVZ.exe
  C:\Windows\System\tqPjPVZ.exe
  2⤵
  PID:2724
- C:\Windows\System\aynkRTK.exe
  C:\Windows\System\aynkRTK.exe
  2⤵
  PID:4764
- C:\Windows\System\VjTZnCd.exe
  C:\Windows\System\VjTZnCd.exe
  2⤵
  PID:6104
- C:\Windows\System\mjiHxKX.exe
  C:\Windows\System\mjiHxKX.exe
  2⤵
  PID:5132
- C:\Windows\System\OgKBSTz.exe
  C:\Windows\System\OgKBSTz.exe
  2⤵
  PID:5252
- C:\Windows\System\APzRBhV.exe
  C:\Windows\System\APzRBhV.exe
  2⤵
  PID:5348
- C:\Windows\System\ZTvKiiV.exe
  C:\Windows\System\ZTvKiiV.exe
  2⤵
  PID:6032
- C:\Windows\System\BLhaUpl.exe
  C:\Windows\System\BLhaUpl.exe
  2⤵
  PID:5700
- C:\Windows\System\fBSkURY.exe
  C:\Windows\System\fBSkURY.exe
  2⤵
  PID:5860
- C:\Windows\System\rnuohZF.exe
  C:\Windows\System\rnuohZF.exe
  2⤵
  PID:5932
- C:\Windows\System\ruJbRyL.exe
  C:\Windows\System\ruJbRyL.exe
  2⤵
  PID:6004
- C:\Windows\System\nfivaoj.exe
  C:\Windows\System\nfivaoj.exe
  2⤵
  PID:6056
- C:\Windows\System\GLhukoM.exe
  C:\Windows\System\GLhukoM.exe
  2⤵
  PID:5316
- C:\Windows\System\SgyCbia.exe
  C:\Windows\System\SgyCbia.exe
  2⤵
  PID:5796
- C:\Windows\System\yGPbmsi.exe
  C:\Windows\System\yGPbmsi.exe
  2⤵
  PID:5892
- C:\Windows\System\iYeVmMA.exe
  C:\Windows\System\iYeVmMA.exe
  2⤵
  PID:3996
- C:\Windows\System\OqEVeEE.exe
  C:\Windows\System\OqEVeEE.exe
  2⤵
  PID:5320
- C:\Windows\System\MBysRif.exe
  C:\Windows\System\MBysRif.exe
  2⤵
  PID:748
- C:\Windows\System\fsACUMl.exe
  C:\Windows\System\fsACUMl.exe
  2⤵
  PID:5844
- C:\Windows\System\bCbFwzg.exe
  C:\Windows\System\bCbFwzg.exe
  2⤵
  PID:5396
- C:\Windows\System\CAWPTjt.exe
  C:\Windows\System\CAWPTjt.exe
  2⤵
  PID:6116
- C:\Windows\System\hHvATkZ.exe
  C:\Windows\System\hHvATkZ.exe
  2⤵
  PID:6184
- C:\Windows\System\gehMGee.exe
  C:\Windows\System\gehMGee.exe
  2⤵
  PID:6228
- C:\Windows\System\DzTagMz.exe
  C:\Windows\System\DzTagMz.exe
  2⤵
  PID:6264
- C:\Windows\System\iKnezSd.exe
  C:\Windows\System\iKnezSd.exe
  2⤵
  PID:6288
- C:\Windows\System\BRjyJSF.exe
  C:\Windows\System\BRjyJSF.exe
  2⤵
  PID:6316
- C:\Windows\System\ADiUxrB.exe
  C:\Windows\System\ADiUxrB.exe
  2⤵
  PID:6344
- C:\Windows\System\VxfObYo.exe
  C:\Windows\System\VxfObYo.exe
  2⤵
  PID:6380
- C:\Windows\System\ljKSSXW.exe
  C:\Windows\System\ljKSSXW.exe
  2⤵
  PID:6412
- C:\Windows\System\QuKilwU.exe
  C:\Windows\System\QuKilwU.exe
  2⤵
  PID:6448
- C:\Windows\System\WtIuRJd.exe
  C:\Windows\System\WtIuRJd.exe
  2⤵
  PID:6480
- C:\Windows\System\zWxlZjV.exe
  C:\Windows\System\zWxlZjV.exe
  2⤵
  PID:6512
- C:\Windows\System\cpQwZUM.exe
  C:\Windows\System\cpQwZUM.exe
  2⤵
  PID:6552
- C:\Windows\System\cckecEJ.exe
  C:\Windows\System\cckecEJ.exe
  2⤵
  PID:6572
- C:\Windows\System\JtGGDUi.exe
  C:\Windows\System\JtGGDUi.exe
  2⤵
  PID:6608
- C:\Windows\System\GQezTtp.exe
  C:\Windows\System\GQezTtp.exe
  2⤵
  PID:6644
- C:\Windows\System\ebWIsuX.exe
  C:\Windows\System\ebWIsuX.exe
  2⤵
  PID:6680
- C:\Windows\System\uZglMdR.exe
  C:\Windows\System\uZglMdR.exe
  2⤵
  PID:6712
- C:\Windows\System\ipzBxzB.exe
  C:\Windows\System\ipzBxzB.exe
  2⤵
  PID:6748
- C:\Windows\System\bCkzNPS.exe
  C:\Windows\System\bCkzNPS.exe
  2⤵
  PID:6784
- C:\Windows\System\ZgXWYeQ.exe
  C:\Windows\System\ZgXWYeQ.exe
  2⤵
  PID:6808
- C:\Windows\System\DzXXsHb.exe
  C:\Windows\System\DzXXsHb.exe
  2⤵
  PID:6836
- C:\Windows\System\uZpqYri.exe
  C:\Windows\System\uZpqYri.exe
  2⤵
  PID:6876
- C:\Windows\System\kTTjSCH.exe
  C:\Windows\System\kTTjSCH.exe
  2⤵
  PID:6920
- C:\Windows\System\PFDHAkF.exe
  C:\Windows\System\PFDHAkF.exe
  2⤵
  PID:6948
- C:\Windows\System\imnDJJT.exe
  C:\Windows\System\imnDJJT.exe
  2⤵
  PID:6976
- C:\Windows\System\aEUNCuq.exe
  C:\Windows\System\aEUNCuq.exe
  2⤵
  PID:7012
- C:\Windows\System\CVLtmxy.exe
  C:\Windows\System\CVLtmxy.exe
  2⤵
  PID:7040
- C:\Windows\System\NnaRZMZ.exe
  C:\Windows\System\NnaRZMZ.exe
  2⤵
  PID:7064
- C:\Windows\System\DOWxhBk.exe
  C:\Windows\System\DOWxhBk.exe
  2⤵
  PID:7100
- C:\Windows\System\nyWfoyQ.exe
  C:\Windows\System\nyWfoyQ.exe
  2⤵
  PID:7132
- C:\Windows\System\hnRzWZy.exe
  C:\Windows\System\hnRzWZy.exe
  2⤵
  PID:7160
- C:\Windows\System\TLYBRgZ.exe
  C:\Windows\System\TLYBRgZ.exe
  2⤵
  PID:6164
- C:\Windows\System\bwoPHFA.exe
  C:\Windows\System\bwoPHFA.exe
  2⤵
  PID:6240
- C:\Windows\System\ijTMaPo.exe
  C:\Windows\System\ijTMaPo.exe
  2⤵
  PID:6284
- C:\Windows\System\XEtYlDJ.exe
  C:\Windows\System\XEtYlDJ.exe
  2⤵
  PID:6356
- C:\Windows\System\BDonFhD.exe
  C:\Windows\System\BDonFhD.exe
  2⤵
  PID:6408
- C:\Windows\System\ZRmEDai.exe
  C:\Windows\System\ZRmEDai.exe
  2⤵
  PID:6476
- C:\Windows\System\lWtZOUI.exe
  C:\Windows\System\lWtZOUI.exe
  2⤵
  PID:6520
- C:\Windows\System\yWfDgKe.exe
  C:\Windows\System\yWfDgKe.exe
  2⤵
  PID:6584
- C:\Windows\System\bsrZwhR.exe
  C:\Windows\System\bsrZwhR.exe
  2⤵
  PID:6632
- C:\Windows\System\udnOwcM.exe
  C:\Windows\System\udnOwcM.exe
  2⤵
  PID:6692
- C:\Windows\System\rHDvrDq.exe
  C:\Windows\System\rHDvrDq.exe
  2⤵
  PID:6740
- C:\Windows\System\kXoHunf.exe
  C:\Windows\System\kXoHunf.exe
  2⤵
  PID:1280
- C:\Windows\System\DCqSfHs.exe
  C:\Windows\System\DCqSfHs.exe
  2⤵
  PID:6868
- C:\Windows\System\SRFCrTc.exe
  C:\Windows\System\SRFCrTc.exe
  2⤵
  PID:6956
- C:\Windows\System\pFUecOI.exe
  C:\Windows\System\pFUecOI.exe
  2⤵
  PID:7028
- C:\Windows\System\hQJiSGD.exe
  C:\Windows\System\hQJiSGD.exe
  2⤵
  PID:7088
- C:\Windows\System\KYYThdH.exe
  C:\Windows\System\KYYThdH.exe
  2⤵
  PID:7152
- C:\Windows\System\GZyVNuD.exe
  C:\Windows\System\GZyVNuD.exe
  2⤵
  PID:6272
- C:\Windows\System\uwlAXHo.exe
  C:\Windows\System\uwlAXHo.exe
  2⤵
  PID:6396
- C:\Windows\System\acwZuBD.exe
  C:\Windows\System\acwZuBD.exe
  2⤵
  PID:6536
- C:\Windows\System\bPsOdbo.exe
  C:\Windows\System\bPsOdbo.exe
  2⤵
  PID:6600
- C:\Windows\System\AYUxoPG.exe
  C:\Windows\System\AYUxoPG.exe
  2⤵
  PID:4104
- C:\Windows\System\GpGKRZQ.exe
  C:\Windows\System\GpGKRZQ.exe
  2⤵
  PID:6896
- C:\Windows\System\jzVkmpZ.exe
  C:\Windows\System\jzVkmpZ.exe
  2⤵
  PID:7060
- C:\Windows\System\iUCLnbF.exe
  C:\Windows\System\iUCLnbF.exe
  2⤵
  PID:7144
- C:\Windows\System\qjpieLm.exe
  C:\Windows\System\qjpieLm.exe
  2⤵
  PID:6156
- C:\Windows\System\SoEKuwh.exe
  C:\Windows\System\SoEKuwh.exe
  2⤵
  PID:6696
- C:\Windows\System\GEctXjL.exe
  C:\Windows\System\GEctXjL.exe
  2⤵
  PID:3892
- C:\Windows\System\QDSaDlq.exe
  C:\Windows\System\QDSaDlq.exe
  2⤵
  PID:6872
- C:\Windows\System\GzRoJgr.exe
  C:\Windows\System\GzRoJgr.exe
  2⤵
  PID:7120
- C:\Windows\System\RduXrJZ.exe
  C:\Windows\System\RduXrJZ.exe
  2⤵
  PID:6464
- C:\Windows\System\hmIWVsv.exe
  C:\Windows\System\hmIWVsv.exe
  2⤵
  PID:6800
- C:\Windows\System\AJykxUb.exe
  C:\Windows\System\AJykxUb.exe
  2⤵
  PID:6392
- C:\Windows\System\hxwpPOJ.exe
  C:\Windows\System\hxwpPOJ.exe
  2⤵
  PID:7092
- C:\Windows\System\oVKdaTt.exe
  C:\Windows\System\oVKdaTt.exe
  2⤵
  PID:7192
- C:\Windows\System\kStZdxl.exe
  C:\Windows\System\kStZdxl.exe
  2⤵
  PID:7220
- C:\Windows\System\JmPWEZH.exe
  C:\Windows\System\JmPWEZH.exe
  2⤵
  PID:7316
- C:\Windows\System\BbHCuHU.exe
  C:\Windows\System\BbHCuHU.exe
  2⤵
  PID:7336
- C:\Windows\System\eZegAEY.exe
  C:\Windows\System\eZegAEY.exe
  2⤵
  PID:7352
- C:\Windows\System\XcfgBDc.exe
  C:\Windows\System\XcfgBDc.exe
  2⤵
  PID:7368
- C:\Windows\System\SEMRzAo.exe
  C:\Windows\System\SEMRzAo.exe
  2⤵
  PID:7420
- C:\Windows\System\hiQZcTf.exe
  C:\Windows\System\hiQZcTf.exe
  2⤵
  PID:7464
- C:\Windows\System\lJrKSTJ.exe
  C:\Windows\System\lJrKSTJ.exe
  2⤵
  PID:7508
- C:\Windows\System\CLoctxG.exe
  C:\Windows\System\CLoctxG.exe
  2⤵
  PID:7540
- C:\Windows\System\IJkiEqU.exe
  C:\Windows\System\IJkiEqU.exe
  2⤵
  PID:7576
- C:\Windows\System\hUWuLjI.exe
  C:\Windows\System\hUWuLjI.exe
  2⤵
  PID:7604
- C:\Windows\System\HfTNjcy.exe
  C:\Windows\System\HfTNjcy.exe
  2⤵
  PID:7640
- C:\Windows\System\cpvjiuF.exe
  C:\Windows\System\cpvjiuF.exe
  2⤵
  PID:7668
- C:\Windows\System\RjZebct.exe
  C:\Windows\System\RjZebct.exe
  2⤵
  PID:7696
- C:\Windows\System\QEBNZTi.exe
  C:\Windows\System\QEBNZTi.exe
  2⤵
  PID:7724
- C:\Windows\System\AsQxIyN.exe
  C:\Windows\System\AsQxIyN.exe
  2⤵
  PID:7752
- C:\Windows\System\ZtvcYdQ.exe
  C:\Windows\System\ZtvcYdQ.exe
  2⤵
  PID:7784
- C:\Windows\System\AyHpnmr.exe
  C:\Windows\System\AyHpnmr.exe
  2⤵
  PID:7816
- C:\Windows\System\rUfReJu.exe
  C:\Windows\System\rUfReJu.exe
  2⤵
  PID:7844
- C:\Windows\System\EgJqFHf.exe
  C:\Windows\System\EgJqFHf.exe
  2⤵
  PID:7876
- C:\Windows\System\uSJLNHq.exe
  C:\Windows\System\uSJLNHq.exe
  2⤵
  PID:7900
- C:\Windows\System\TkHawSP.exe
  C:\Windows\System\TkHawSP.exe
  2⤵
  PID:7932
- C:\Windows\System\MoKiOuX.exe
  C:\Windows\System\MoKiOuX.exe
  2⤵
  PID:7956
- C:\Windows\System\IJygJvI.exe
  C:\Windows\System\IJygJvI.exe
  2⤵
  PID:7984
- C:\Windows\System\BRLwXUE.exe
  C:\Windows\System\BRLwXUE.exe
  2⤵
  PID:8012
- C:\Windows\System\lvMxMlN.exe
  C:\Windows\System\lvMxMlN.exe
  2⤵
  PID:8048
- C:\Windows\System\mqxyTmw.exe
  C:\Windows\System\mqxyTmw.exe
  2⤵
  PID:8072
- C:\Windows\System\zaIzWeJ.exe
  C:\Windows\System\zaIzWeJ.exe
  2⤵
  PID:8100
- C:\Windows\System\KoVVfYV.exe
  C:\Windows\System\KoVVfYV.exe
  2⤵
  PID:8128
- C:\Windows\System\EbdWDed.exe
  C:\Windows\System\EbdWDed.exe
  2⤵
  PID:8160
- C:\Windows\System\kuEFbFP.exe
  C:\Windows\System\kuEFbFP.exe
  2⤵
  PID:7180
- C:\Windows\System\zbzfgzi.exe
  C:\Windows\System\zbzfgzi.exe
  2⤵
  PID:7328
- C:\Windows\System\IwDBEKv.exe
  C:\Windows\System\IwDBEKv.exe
  2⤵
  PID:7312
- C:\Windows\System\jUaBTKl.exe
  C:\Windows\System\jUaBTKl.exe
  2⤵
  PID:7408
- C:\Windows\System\cnfYgII.exe
  C:\Windows\System\cnfYgII.exe
  2⤵
  PID:7500
- C:\Windows\System\LgeynKr.exe
  C:\Windows\System\LgeynKr.exe
  2⤵
  PID:7564
- C:\Windows\System\mfrwgUO.exe
  C:\Windows\System\mfrwgUO.exe
  2⤵
  PID:7292
- C:\Windows\System\FPMaPpk.exe
  C:\Windows\System\FPMaPpk.exe
  2⤵
  PID:7684
- C:\Windows\System\gkhXWPY.exe
  C:\Windows\System\gkhXWPY.exe
  2⤵
  PID:7748
- C:\Windows\System\JPgUTVk.exe
  C:\Windows\System\JPgUTVk.exe
  2⤵
  PID:7856
- C:\Windows\System\tsVSSVO.exe
  C:\Windows\System\tsVSSVO.exe
  2⤵
  PID:7892
- C:\Windows\System\hUZvuNV.exe
  C:\Windows\System\hUZvuNV.exe
  2⤵
  PID:7948
- C:\Windows\System\hDGvsYD.exe
  C:\Windows\System\hDGvsYD.exe
  2⤵
  PID:8068
- C:\Windows\System\ZlGAfBZ.exe
  C:\Windows\System\ZlGAfBZ.exe
  2⤵
  PID:8140
- C:\Windows\System\jvhLCcm.exe
  C:\Windows\System\jvhLCcm.exe
  2⤵
  PID:4068
- C:\Windows\System\YTEJEIv.exe
  C:\Windows\System\YTEJEIv.exe
  2⤵
  PID:7404
- C:\Windows\System\YJOmHlT.exe
  C:\Windows\System\YJOmHlT.exe
  2⤵
  PID:7596
- C:\Windows\System\wwNRztc.exe
  C:\Windows\System\wwNRztc.exe
  2⤵
  PID:7772
- C:\Windows\System\NIOoHay.exe
  C:\Windows\System\NIOoHay.exe
  2⤵
  PID:7628
- C:\Windows\System\mVGPlQu.exe
  C:\Windows\System\mVGPlQu.exe
  2⤵
  PID:7780
- C:\Windows\System\LUNHxug.exe
  C:\Windows\System\LUNHxug.exe
  2⤵
  PID:7940
- C:\Windows\System\lxorbrL.exe
  C:\Windows\System\lxorbrL.exe
  2⤵
  PID:8188
- C:\Windows\System\jkQnPOF.exe
  C:\Windows\System\jkQnPOF.exe
  2⤵
  PID:7360
- C:\Windows\System\zZyQNDT.exe
  C:\Windows\System\zZyQNDT.exe
  2⤵
  PID:864
- C:\Windows\System\KodMmLY.exe
  C:\Windows\System\KodMmLY.exe
  2⤵
  PID:8036
- C:\Windows\System\qMKSJWN.exe
  C:\Windows\System\qMKSJWN.exe
  2⤵
  PID:7720
- C:\Windows\System\vjYkXOz.exe
  C:\Windows\System\vjYkXOz.exe
  2⤵
  PID:8064
- C:\Windows\System\WNdidOD.exe
  C:\Windows\System\WNdidOD.exe
  2⤵
  PID:7652
- C:\Windows\System\JBWUwrX.exe
  C:\Windows\System\JBWUwrX.exe
  2⤵
  PID:7624
- C:\Windows\System\DvZBNMk.exe
  C:\Windows\System\DvZBNMk.exe
  2⤵
  PID:7556
- C:\Windows\System\igSwQNk.exe
  C:\Windows\System\igSwQNk.exe
  2⤵
  PID:7212
- C:\Windows\System\ApEZnul.exe
  C:\Windows\System\ApEZnul.exe
  2⤵
  PID:8212
- C:\Windows\System\CESwozQ.exe
  C:\Windows\System\CESwozQ.exe
  2⤵
  PID:8240
- C:\Windows\System\Kjxvrtk.exe
  C:\Windows\System\Kjxvrtk.exe
  2⤵
  PID:8268
- C:\Windows\System\qcylOyr.exe
  C:\Windows\System\qcylOyr.exe
  2⤵
  PID:8296
- C:\Windows\System\DUTgbUs.exe
  C:\Windows\System\DUTgbUs.exe
  2⤵
  PID:8324
- C:\Windows\System\qIavGFL.exe
  C:\Windows\System\qIavGFL.exe
  2⤵
  PID:8352
- C:\Windows\System\vEWbpLW.exe
  C:\Windows\System\vEWbpLW.exe
  2⤵
  PID:8380
- C:\Windows\System\RHHjFAi.exe
  C:\Windows\System\RHHjFAi.exe
  2⤵
  PID:8408
- C:\Windows\System\MIEoPyf.exe
  C:\Windows\System\MIEoPyf.exe
  2⤵
  PID:8436
- C:\Windows\System\gHrlhmh.exe
  C:\Windows\System\gHrlhmh.exe
  2⤵
  PID:8464
- C:\Windows\System\fZOLiCl.exe
  C:\Windows\System\fZOLiCl.exe
  2⤵
  PID:8492
- C:\Windows\System\mcSiEkY.exe
  C:\Windows\System\mcSiEkY.exe
  2⤵
  PID:8524
- C:\Windows\System\cJjjVnb.exe
  C:\Windows\System\cJjjVnb.exe
  2⤵
  PID:8552
- C:\Windows\System\cUGWeyP.exe
  C:\Windows\System\cUGWeyP.exe
  2⤵
  PID:8580
- C:\Windows\System\MVhewqg.exe
  C:\Windows\System\MVhewqg.exe
  2⤵
  PID:8608
- C:\Windows\System\OUhaCGn.exe
  C:\Windows\System\OUhaCGn.exe
  2⤵
  PID:8636
- C:\Windows\System\RNzICQg.exe
  C:\Windows\System\RNzICQg.exe
  2⤵
  PID:8664
- C:\Windows\System\Nojgzkp.exe
  C:\Windows\System\Nojgzkp.exe
  2⤵
  PID:8692
- C:\Windows\System\jRUZynZ.exe
  C:\Windows\System\jRUZynZ.exe
  2⤵
  PID:8720
- C:\Windows\System\tOIpjpQ.exe
  C:\Windows\System\tOIpjpQ.exe
  2⤵
  PID:8748
- C:\Windows\System\XBcvrcZ.exe
  C:\Windows\System\XBcvrcZ.exe
  2⤵
  PID:8776
- C:\Windows\System\AoVrXle.exe
  C:\Windows\System\AoVrXle.exe
  2⤵
  PID:8804
- C:\Windows\System\DIJJLLF.exe
  C:\Windows\System\DIJJLLF.exe
  2⤵
  PID:8832
- C:\Windows\System\vxBJVPv.exe
  C:\Windows\System\vxBJVPv.exe
  2⤵
  PID:8860
- C:\Windows\System\RTCJpwx.exe
  C:\Windows\System\RTCJpwx.exe
  2⤵
  PID:8888
- C:\Windows\System\eIODZGf.exe
  C:\Windows\System\eIODZGf.exe
  2⤵
  PID:8916
- C:\Windows\System\AWKfNdi.exe
  C:\Windows\System\AWKfNdi.exe
  2⤵
  PID:8944
- C:\Windows\System\pQgUbJq.exe
  C:\Windows\System\pQgUbJq.exe
  2⤵
  PID:8972
- C:\Windows\System\hYLYFYz.exe
  C:\Windows\System\hYLYFYz.exe
  2⤵
  PID:9012
- C:\Windows\System\TZqgTUA.exe
  C:\Windows\System\TZqgTUA.exe
  2⤵
  PID:9028
- C:\Windows\System\ujXZuVV.exe
  C:\Windows\System\ujXZuVV.exe
  2⤵
  PID:9056
- C:\Windows\System\zOhMjSO.exe
  C:\Windows\System\zOhMjSO.exe
  2⤵
  PID:9084
- C:\Windows\System\WuQTMBm.exe
  C:\Windows\System\WuQTMBm.exe
  2⤵
  PID:9112
- C:\Windows\System\kyQadEJ.exe
  C:\Windows\System\kyQadEJ.exe
  2⤵
  PID:9144
- C:\Windows\System\FfevzwO.exe
  C:\Windows\System\FfevzwO.exe
  2⤵
  PID:9172
- C:\Windows\System\jkWvDaB.exe
  C:\Windows\System\jkWvDaB.exe
  2⤵
  PID:9200
- C:\Windows\System\oyVweLh.exe
  C:\Windows\System\oyVweLh.exe
  2⤵
  PID:8224
- C:\Windows\System\HvTlRrm.exe
  C:\Windows\System\HvTlRrm.exe
  2⤵
  PID:8288
- C:\Windows\System\gItOljV.exe
  C:\Windows\System\gItOljV.exe
  2⤵
  PID:8348
- C:\Windows\System\pBAuXZW.exe
  C:\Windows\System\pBAuXZW.exe
  2⤵
  PID:8420
- C:\Windows\System\sRvLZdX.exe
  C:\Windows\System\sRvLZdX.exe
  2⤵
  PID:8484
- C:\Windows\System\uwQjRmf.exe
  C:\Windows\System\uwQjRmf.exe
  2⤵
  PID:8548
- C:\Windows\System\RHIYnBf.exe
  C:\Windows\System\RHIYnBf.exe
  2⤵
  PID:8620
- C:\Windows\System\svMYthL.exe
  C:\Windows\System\svMYthL.exe
  2⤵
  PID:8684
- C:\Windows\System\fEdGlVl.exe
  C:\Windows\System\fEdGlVl.exe
  2⤵
  PID:564
- C:\Windows\System\AoetZmH.exe
  C:\Windows\System\AoetZmH.exe
  2⤵
  PID:8800
- C:\Windows\System\RiIEDLA.exe
  C:\Windows\System\RiIEDLA.exe
  2⤵
  PID:8844
- C:\Windows\System\deBOXyj.exe
  C:\Windows\System\deBOXyj.exe
  2⤵
  PID:8928
- C:\Windows\System\vhkvHYc.exe
  C:\Windows\System\vhkvHYc.exe
  2⤵
  PID:3032
- C:\Windows\System\NGOaiEN.exe
  C:\Windows\System\NGOaiEN.exe
  2⤵
  PID:2900
- C:\Windows\System\QEVbbkZ.exe
  C:\Windows\System\QEVbbkZ.exe
  2⤵
  PID:4432
- C:\Windows\System\ZAuMERp.exe
  C:\Windows\System\ZAuMERp.exe
  2⤵
  PID:3404
- C:\Windows\System\slhiCcf.exe
  C:\Windows\System\slhiCcf.exe
  2⤵
  PID:8996
- C:\Windows\System\jkJUTKK.exe
  C:\Windows\System\jkJUTKK.exe
  2⤵
  PID:9072
- C:\Windows\System\ryPnKkB.exe
  C:\Windows\System\ryPnKkB.exe
  2⤵
  PID:9124
- C:\Windows\System\KecMSaw.exe
  C:\Windows\System\KecMSaw.exe
  2⤵
  PID:9192
- C:\Windows\System\VpEpToR.exe
  C:\Windows\System\VpEpToR.exe
  2⤵
  PID:8260
- C:\Windows\System\JntEcWc.exe
  C:\Windows\System\JntEcWc.exe
  2⤵
  PID:8404
- C:\Windows\System\JBotIJO.exe
  C:\Windows\System\JBotIJO.exe
  2⤵
  PID:8576
- C:\Windows\System\vyfTvPo.exe
  C:\Windows\System\vyfTvPo.exe
  2⤵
  PID:8716
- C:\Windows\System\HFsIFNT.exe
  C:\Windows\System\HFsIFNT.exe
  2⤵
  PID:8824
- C:\Windows\System\eWOESoU.exe
  C:\Windows\System\eWOESoU.exe
  2⤵
  PID:8968
- C:\Windows\System\wiUioLR.exe
  C:\Windows\System\wiUioLR.exe
  2⤵
  PID:4752
- C:\Windows\System\yuBxkMc.exe
  C:\Windows\System\yuBxkMc.exe
  2⤵
  PID:9020
- C:\Windows\System\CMBrEWJ.exe
  C:\Windows\System\CMBrEWJ.exe
  2⤵
  PID:9168
- C:\Windows\System\uccKKEB.exe
  C:\Windows\System\uccKKEB.exe
  2⤵
  PID:8400
- C:\Windows\System\tdDBvQk.exe
  C:\Windows\System\tdDBvQk.exe
  2⤵
  PID:2668
- C:\Windows\System\CplYrhm.exe
  C:\Windows\System\CplYrhm.exe
  2⤵
  PID:1656
- C:\Windows\System\UbEskSw.exe
  C:\Windows\System\UbEskSw.exe
  2⤵
  PID:8208
- C:\Windows\System\pFLXvlD.exe
  C:\Windows\System\pFLXvlD.exe
  2⤵
  PID:5024
- C:\Windows\System\AUzswuf.exe
  C:\Windows\System\AUzswuf.exe
  2⤵
  PID:8796
- C:\Windows\System\OUctmhS.exe
  C:\Windows\System\OUctmhS.exe
  2⤵
  PID:9236
- C:\Windows\System\YMbHvOz.exe
  C:\Windows\System\YMbHvOz.exe
  2⤵
  PID:9264
- C:\Windows\System\cpysToa.exe
  C:\Windows\System\cpysToa.exe
  2⤵
  PID:9292
- C:\Windows\System\BUXfWuW.exe
  C:\Windows\System\BUXfWuW.exe
  2⤵
  PID:9320
- C:\Windows\System\LHXtjMf.exe
  C:\Windows\System\LHXtjMf.exe
  2⤵
  PID:9348
- C:\Windows\System\znAxLjs.exe
  C:\Windows\System\znAxLjs.exe
  2⤵
  PID:9376
- C:\Windows\System\NiVaFnD.exe
  C:\Windows\System\NiVaFnD.exe
  2⤵
  PID:9404
- C:\Windows\System\iZEOEcV.exe
  C:\Windows\System\iZEOEcV.exe
  2⤵
  PID:9432
- C:\Windows\System\LQcaABU.exe
  C:\Windows\System\LQcaABU.exe
  2⤵
  PID:9460
- C:\Windows\System\rnPTQIf.exe
  C:\Windows\System\rnPTQIf.exe
  2⤵
  PID:9488
- C:\Windows\System\SNiVTgz.exe
  C:\Windows\System\SNiVTgz.exe
  2⤵
  PID:9516
- C:\Windows\System\cKvEIce.exe
  C:\Windows\System\cKvEIce.exe
  2⤵
  PID:9544
- C:\Windows\System\izMnRef.exe
  C:\Windows\System\izMnRef.exe
  2⤵
  PID:9572
- C:\Windows\System\iZJPteJ.exe
  C:\Windows\System\iZJPteJ.exe
  2⤵
  PID:9600
- C:\Windows\System\wouIgJn.exe
  C:\Windows\System\wouIgJn.exe
  2⤵
  PID:9628
- C:\Windows\System\pimVkdj.exe
  C:\Windows\System\pimVkdj.exe
  2⤵
  PID:9656
- C:\Windows\System\ViFNXKQ.exe
  C:\Windows\System\ViFNXKQ.exe
  2⤵
  PID:9684
- C:\Windows\System\QgHkpIr.exe
  C:\Windows\System\QgHkpIr.exe
  2⤵
  PID:9712
- C:\Windows\System\bBurCtl.exe
  C:\Windows\System\bBurCtl.exe
  2⤵
  PID:9740
- C:\Windows\System\BpEDvZi.exe
  C:\Windows\System\BpEDvZi.exe
  2⤵
  PID:9768
- C:\Windows\System\EWZvfqp.exe
  C:\Windows\System\EWZvfqp.exe
  2⤵
  PID:9796
- C:\Windows\System\gavdEzg.exe
  C:\Windows\System\gavdEzg.exe
  2⤵
  PID:9824
- C:\Windows\System\BntiYfC.exe
  C:\Windows\System\BntiYfC.exe
  2⤵
  PID:9856
- C:\Windows\System\pFfxMvo.exe
  C:\Windows\System\pFfxMvo.exe
  2⤵
  PID:9884
- C:\Windows\System\HNOukTR.exe
  C:\Windows\System\HNOukTR.exe
  2⤵
  PID:9912
- C:\Windows\System\zRWtCtE.exe
  C:\Windows\System\zRWtCtE.exe
  2⤵
  PID:9940
- C:\Windows\System\wuYkUGZ.exe
  C:\Windows\System\wuYkUGZ.exe
  2⤵
  PID:9972
- C:\Windows\System\ShPvwKG.exe
  C:\Windows\System\ShPvwKG.exe
  2⤵
  PID:10000
- C:\Windows\System\fnNcxbk.exe
  C:\Windows\System\fnNcxbk.exe
  2⤵
  PID:10028
- C:\Windows\System\yyMRgqE.exe
  C:\Windows\System\yyMRgqE.exe
  2⤵
  PID:10056
- C:\Windows\System\xzOWtTU.exe
  C:\Windows\System\xzOWtTU.exe
  2⤵
  PID:10084
- C:\Windows\System\JZcowIh.exe
  C:\Windows\System\JZcowIh.exe
  2⤵
  PID:10112
- C:\Windows\System\cghvzdc.exe
  C:\Windows\System\cghvzdc.exe
  2⤵
  PID:10148
- C:\Windows\System\tiikvjX.exe
  C:\Windows\System\tiikvjX.exe
  2⤵
  PID:10196
- C:\Windows\System\jNYReLt.exe
  C:\Windows\System\jNYReLt.exe
  2⤵
  PID:9260
- C:\Windows\System\bNudXKf.exe
  C:\Windows\System\bNudXKf.exe
  2⤵
  PID:9332
- C:\Windows\System\YyeTntM.exe
  C:\Windows\System\YyeTntM.exe
  2⤵
  PID:9512
- C:\Windows\System\kcewetw.exe
  C:\Windows\System\kcewetw.exe
  2⤵
  PID:9564
- C:\Windows\System\qUYXFeP.exe
  C:\Windows\System\qUYXFeP.exe
  2⤵
  PID:9596
- C:\Windows\System\QovzNUq.exe
  C:\Windows\System\QovzNUq.exe
  2⤵
  PID:9696
- C:\Windows\System\eSCcRjM.exe
  C:\Windows\System\eSCcRjM.exe
  2⤵
  PID:9780
- C:\Windows\System\rWxmBdq.exe
  C:\Windows\System\rWxmBdq.exe
  2⤵
  PID:9852
- C:\Windows\System\Gfvoftv.exe
  C:\Windows\System\Gfvoftv.exe
  2⤵
  PID:9936
- C:\Windows\System\KmHJbcS.exe
  C:\Windows\System\KmHJbcS.exe
  2⤵
  PID:9996
- C:\Windows\System\ziFrsgy.exe
  C:\Windows\System\ziFrsgy.exe
  2⤵
  PID:10068
- C:\Windows\System\vhILZDj.exe
  C:\Windows\System\vhILZDj.exe
  2⤵
  PID:10144
- C:\Windows\System\NzvGYbV.exe
  C:\Windows\System\NzvGYbV.exe
  2⤵
  PID:9256
- C:\Windows\System\dgKEbEC.exe
  C:\Windows\System\dgKEbEC.exe
  2⤵
  PID:9456
- C:\Windows\System\uOscXpW.exe
  C:\Windows\System\uOscXpW.exe
  2⤵
  PID:9676
- C:\Windows\System\xEZqtyk.exe
  C:\Windows\System\xEZqtyk.exe
  2⤵
  PID:9848
- C:\Windows\System\MWxHLhs.exe
  C:\Windows\System\MWxHLhs.exe
  2⤵
  PID:9992
- C:\Windows\System\poklyNQ.exe
  C:\Windows\System\poklyNQ.exe
  2⤵
  PID:10192
- C:\Windows\System\QstHCBl.exe
  C:\Windows\System\QstHCBl.exe
  2⤵
  PID:9584
- C:\Windows\System\MhEcTnl.exe
  C:\Windows\System\MhEcTnl.exe
  2⤵
  PID:9968
- C:\Windows\System\NudcRpR.exe
  C:\Windows\System\NudcRpR.exe
  2⤵
  PID:9792
- C:\Windows\System\dfRlkNp.exe
  C:\Windows\System\dfRlkNp.exe
  2⤵
  PID:10244
- C:\Windows\System\DigAann.exe
  C:\Windows\System\DigAann.exe
  2⤵
  PID:10272
- C:\Windows\System\dyccVOw.exe
  C:\Windows\System\dyccVOw.exe
  2⤵
  PID:10300
- C:\Windows\System\OdnFTDR.exe
  C:\Windows\System\OdnFTDR.exe
  2⤵
  PID:10328
- C:\Windows\System\mFzGDIY.exe
  C:\Windows\System\mFzGDIY.exe
  2⤵
  PID:10368
- C:\Windows\System\XFSbTRZ.exe
  C:\Windows\System\XFSbTRZ.exe
  2⤵
  PID:10384
- C:\Windows\System\JjWfCTu.exe
  C:\Windows\System\JjWfCTu.exe
  2⤵
  PID:10412
- C:\Windows\System\ZEzILJM.exe
  C:\Windows\System\ZEzILJM.exe
  2⤵
  PID:10440
- C:\Windows\System\tNdPtMr.exe
  C:\Windows\System\tNdPtMr.exe
  2⤵
  PID:10468
- C:\Windows\System\LJuFZcy.exe
  C:\Windows\System\LJuFZcy.exe
  2⤵
  PID:10496
- C:\Windows\System\ijYDPuj.exe
  C:\Windows\System\ijYDPuj.exe
  2⤵
  PID:10524
- C:\Windows\System\zhWxDyI.exe
  C:\Windows\System\zhWxDyI.exe
  2⤵
  PID:10552
- C:\Windows\System\iuaklrU.exe
  C:\Windows\System\iuaklrU.exe
  2⤵
  PID:10580
- C:\Windows\System\DROLBhS.exe
  C:\Windows\System\DROLBhS.exe
  2⤵
  PID:10608
- C:\Windows\System\KaJGTmI.exe
  C:\Windows\System\KaJGTmI.exe
  2⤵
  PID:10636
- C:\Windows\System\DkGuDZQ.exe
  C:\Windows\System\DkGuDZQ.exe
  2⤵
  PID:10664
- C:\Windows\System\DNXzBYI.exe
  C:\Windows\System\DNXzBYI.exe
  2⤵
  PID:10696
- C:\Windows\System\RxXIzLr.exe
  C:\Windows\System\RxXIzLr.exe
  2⤵
  PID:10724
- C:\Windows\System\jMmJWWP.exe
  C:\Windows\System\jMmJWWP.exe
  2⤵
  PID:10752
- C:\Windows\System\DwhsRXE.exe
  C:\Windows\System\DwhsRXE.exe
  2⤵
  PID:10780
- C:\Windows\System\KXskVXE.exe
  C:\Windows\System\KXskVXE.exe
  2⤵
  PID:10808
- C:\Windows\System\hDCMkgc.exe
  C:\Windows\System\hDCMkgc.exe
  2⤵
  PID:10836
- C:\Windows\System\QWDpVbk.exe
  C:\Windows\System\QWDpVbk.exe
  2⤵
  PID:10864
- C:\Windows\System\gmlORPY.exe
  C:\Windows\System\gmlORPY.exe
  2⤵
  PID:10892
- C:\Windows\System\WMkApjz.exe
  C:\Windows\System\WMkApjz.exe
  2⤵
  PID:10920
- C:\Windows\System\poukOVv.exe
  C:\Windows\System\poukOVv.exe
  2⤵
  PID:10948
- C:\Windows\System\xEjPoYn.exe
  C:\Windows\System\xEjPoYn.exe
  2⤵
  PID:10968
- C:\Windows\System\oWXUkbJ.exe
  C:\Windows\System\oWXUkbJ.exe
  2⤵
  PID:10988
- C:\Windows\System\AsZXyJt.exe
  C:\Windows\System\AsZXyJt.exe
  2⤵
  PID:11024
- C:\Windows\System\PXnjKcI.exe
  C:\Windows\System\PXnjKcI.exe
  2⤵
  PID:11064
- C:\Windows\System\vVPgFlM.exe
  C:\Windows\System\vVPgFlM.exe
  2⤵
  PID:11092
- C:\Windows\System\YNLMwbf.exe
  C:\Windows\System\YNLMwbf.exe
  2⤵
  PID:11120
- C:\Windows\System\AckHjAZ.exe
  C:\Windows\System\AckHjAZ.exe
  2⤵
  PID:11152
- C:\Windows\System\MZMSfnn.exe
  C:\Windows\System\MZMSfnn.exe
  2⤵
  PID:11180
- C:\Windows\System\FefOSya.exe
  C:\Windows\System\FefOSya.exe
  2⤵
  PID:11208
- C:\Windows\System\skSkVXt.exe
  C:\Windows\System\skSkVXt.exe
  2⤵
  PID:11240
- C:\Windows\System\MjPPapn.exe
  C:\Windows\System\MjPPapn.exe
  2⤵
  PID:10124
- C:\Windows\System\qIOtfpM.exe
  C:\Windows\System\qIOtfpM.exe
  2⤵
  PID:10296
- C:\Windows\System\DqwZbJe.exe
  C:\Windows\System\DqwZbJe.exe
  2⤵
  PID:9844
- C:\Windows\System\ATfLBcH.exe
  C:\Windows\System\ATfLBcH.exe
  2⤵
  PID:10424
- C:\Windows\System\hrwgWbc.exe
  C:\Windows\System\hrwgWbc.exe
  2⤵
  PID:10488
- C:\Windows\System\nQTWloU.exe
  C:\Windows\System\nQTWloU.exe
  2⤵
  PID:10548
- C:\Windows\System\vmmiMGv.exe
  C:\Windows\System\vmmiMGv.exe
  2⤵
  PID:10632
- C:\Windows\System\UroBRgR.exe
  C:\Windows\System\UroBRgR.exe
  2⤵
  PID:10684
- C:\Windows\System\mLXtyPn.exe
  C:\Windows\System\mLXtyPn.exe
  2⤵
  PID:10748
- C:\Windows\System\bAPSWXR.exe
  C:\Windows\System\bAPSWXR.exe
  2⤵
  PID:10824
- C:\Windows\System\cdkXBsJ.exe
  C:\Windows\System\cdkXBsJ.exe
  2⤵
  PID:10884
- C:\Windows\System\ZbZKdWs.exe
  C:\Windows\System\ZbZKdWs.exe
  2⤵
  PID:10944
- C:\Windows\System\OAbvJkT.exe
  C:\Windows\System\OAbvJkT.exe
  2⤵
  PID:10996
- C:\Windows\System\HAsTlvW.exe
  C:\Windows\System\HAsTlvW.exe
  2⤵
  PID:11104
- C:\Windows\System\KnOFzfc.exe
  C:\Windows\System\KnOFzfc.exe
  2⤵
  PID:11172
- C:\Windows\System\eWYMeWy.exe
  C:\Windows\System\eWYMeWy.exe
  2⤵
  PID:11228
- C:\Windows\System\RAzDDJY.exe
  C:\Windows\System\RAzDDJY.exe
  2⤵
  PID:10292
- C:\Windows\System\HkbuMFa.exe
  C:\Windows\System\HkbuMFa.exe
  2⤵
  PID:10452
- C:\Windows\System\pjoOBNZ.exe
  C:\Windows\System\pjoOBNZ.exe
  2⤵
  PID:10600
- C:\Windows\System\hdwMhiQ.exe
  C:\Windows\System\hdwMhiQ.exe
  2⤵
  PID:10744
- C:\Windows\System\qXaMCHC.exe
  C:\Windows\System\qXaMCHC.exe
  2⤵
  PID:10916
- C:\Windows\System\IaFVVLq.exe
  C:\Windows\System\IaFVVLq.exe
  2⤵
  PID:4000
- C:\Windows\System\jKoHiOc.exe
  C:\Windows\System\jKoHiOc.exe
  2⤵
  PID:11140
- C:\Windows\System\rCDLUOG.exe
  C:\Windows\System\rCDLUOG.exe
  2⤵
  PID:10404
- C:\Windows\System\zWullWa.exe
  C:\Windows\System\zWullWa.exe
  2⤵
  PID:10736
- C:\Windows\System\yoRvCgW.exe
  C:\Windows\System\yoRvCgW.exe
  2⤵
  PID:11088
- C:\Windows\System\QzAOGJm.exe
  C:\Windows\System\QzAOGJm.exe
  2⤵
  PID:10544
- C:\Windows\System\WlDIawA.exe
  C:\Windows\System\WlDIawA.exe
  2⤵
  PID:10284
- C:\Windows\System\GodymCo.exe
  C:\Windows\System\GodymCo.exe
  2⤵
  PID:11272
- C:\Windows\System\ynwJagl.exe
  C:\Windows\System\ynwJagl.exe
  2⤵
  PID:11300
- C:\Windows\System\iTqCisJ.exe
  C:\Windows\System\iTqCisJ.exe
  2⤵
  PID:11328
- C:\Windows\System\RjjWtmI.exe
  C:\Windows\System\RjjWtmI.exe
  2⤵
  PID:11356
- C:\Windows\System\hwupqGZ.exe
  C:\Windows\System\hwupqGZ.exe
  2⤵
  PID:11384
- C:\Windows\System\KRrjzFZ.exe
  C:\Windows\System\KRrjzFZ.exe
  2⤵
  PID:11412
- C:\Windows\System\yEkLenX.exe
  C:\Windows\System\yEkLenX.exe
  2⤵
  PID:11444
- C:\Windows\System\LjChyrG.exe
  C:\Windows\System\LjChyrG.exe
  2⤵
  PID:11472
- C:\Windows\System\RQvwvZZ.exe
  C:\Windows\System\RQvwvZZ.exe
  2⤵
  PID:11500
- C:\Windows\System\EwILSjM.exe
  C:\Windows\System\EwILSjM.exe
  2⤵
  PID:11528
- C:\Windows\System\JIYaiQU.exe
  C:\Windows\System\JIYaiQU.exe
  2⤵
  PID:11556
- C:\Windows\System\piCAcCO.exe
  C:\Windows\System\piCAcCO.exe
  2⤵
  PID:11584
- C:\Windows\System\ATBVUSK.exe
  C:\Windows\System\ATBVUSK.exe
  2⤵
  PID:11612
- C:\Windows\System\wzYGcjW.exe
  C:\Windows\System\wzYGcjW.exe
  2⤵
  PID:11640
- C:\Windows\System\UKSkFFP.exe
  C:\Windows\System\UKSkFFP.exe
  2⤵
  PID:11668
- C:\Windows\System\nJaetoN.exe
  C:\Windows\System\nJaetoN.exe
  2⤵
  PID:11696
- C:\Windows\System\HTPjHsb.exe
  C:\Windows\System\HTPjHsb.exe
  2⤵
  PID:11724
- C:\Windows\System\RzHhQxV.exe
  C:\Windows\System\RzHhQxV.exe
  2⤵
  PID:11752
- C:\Windows\System\kkYEvhM.exe
  C:\Windows\System\kkYEvhM.exe
  2⤵
  PID:11780
- C:\Windows\System\fzRFxGb.exe
  C:\Windows\System\fzRFxGb.exe
  2⤵
  PID:11808
- C:\Windows\System\KWoETXS.exe
  C:\Windows\System\KWoETXS.exe
  2⤵
  PID:11848
- C:\Windows\System\hPfSBXN.exe
  C:\Windows\System\hPfSBXN.exe
  2⤵
  PID:11864
- C:\Windows\System\ZMZZKDu.exe
  C:\Windows\System\ZMZZKDu.exe
  2⤵
  PID:11904
- C:\Windows\System\LPAESSp.exe
  C:\Windows\System\LPAESSp.exe
  2⤵
  PID:11928
- C:\Windows\System\kMiExkK.exe
  C:\Windows\System\kMiExkK.exe
  2⤵
  PID:11972
- C:\Windows\System\WbXgbDU.exe
  C:\Windows\System\WbXgbDU.exe
  2⤵
  PID:11988
- C:\Windows\System\IsabvWD.exe
  C:\Windows\System\IsabvWD.exe
  2⤵
  PID:12024
- C:\Windows\System\pNRAwYl.exe
  C:\Windows\System\pNRAwYl.exe
  2⤵
  PID:12056
- C:\Windows\System\pKNrvLa.exe
  C:\Windows\System\pKNrvLa.exe
  2⤵
  PID:12084
- C:\Windows\System\tbRPxAc.exe
  C:\Windows\System\tbRPxAc.exe
  2⤵
  PID:12100
- C:\Windows\System\lNIJvSa.exe
  C:\Windows\System\lNIJvSa.exe
  2⤵
  PID:12116
- C:\Windows\System\GxgrIhC.exe
  C:\Windows\System\GxgrIhC.exe
  2⤵
  PID:12144
- C:\Windows\System\rcNbIxB.exe
  C:\Windows\System\rcNbIxB.exe
  2⤵
  PID:12160
- C:\Windows\System\TnegHKA.exe
  C:\Windows\System\TnegHKA.exe
  2⤵
  PID:12212
- C:\Windows\System\MTegHot.exe
  C:\Windows\System\MTegHot.exe
  2⤵
  PID:12252
- C:\Windows\System\HHsvAzK.exe
  C:\Windows\System\HHsvAzK.exe
  2⤵
  PID:12268
- C:\Windows\System\nglXHFk.exe
  C:\Windows\System\nglXHFk.exe
  2⤵
  PID:11284
- C:\Windows\System\eFlzZxg.exe
  C:\Windows\System\eFlzZxg.exe
  2⤵
  PID:11372
- C:\Windows\System\HkJmLPW.exe
  C:\Windows\System\HkJmLPW.exe
  2⤵
  PID:11408
- C:\Windows\System\VBLMMKv.exe
  C:\Windows\System\VBLMMKv.exe
  2⤵
  PID:11468
- C:\Windows\System\pucGxmV.exe
  C:\Windows\System\pucGxmV.exe
  2⤵
  PID:11552
- C:\Windows\System\SpdXcGU.exe
  C:\Windows\System\SpdXcGU.exe
  2⤵
  PID:11604
- C:\Windows\System\bOmHFyY.exe
  C:\Windows\System\bOmHFyY.exe
  2⤵
  PID:11664
- C:\Windows\System\gadfFIA.exe
  C:\Windows\System\gadfFIA.exe
  2⤵
  PID:11736
- C:\Windows\System\vLfWhmr.exe
  C:\Windows\System\vLfWhmr.exe
  2⤵
  PID:11800
- C:\Windows\System\SlKtHWD.exe
  C:\Windows\System\SlKtHWD.exe
  2⤵
  PID:11880
- C:\Windows\System\BoBpyNV.exe
  C:\Windows\System\BoBpyNV.exe
  2⤵
  PID:11968
- C:\Windows\System\WpcQJsi.exe
  C:\Windows\System\WpcQJsi.exe
  2⤵
  PID:12000
- C:\Windows\System\pEDirQX.exe
  C:\Windows\System\pEDirQX.exe
  2⤵
  PID:12036
- C:\Windows\System\MHiVDCA.exe
  C:\Windows\System\MHiVDCA.exe
  2⤵
  PID:12112
- C:\Windows\System\KuUrkLP.exe
  C:\Windows\System\KuUrkLP.exe
  2⤵
  PID:12156
- C:\Windows\System\KfCiOaF.exe
  C:\Windows\System\KfCiOaF.exe
  2⤵
  PID:12260
- C:\Windows\System\CtalGIe.exe
  C:\Windows\System\CtalGIe.exe
  2⤵
  PID:11380
- C:\Windows\System\MgnKoic.exe
  C:\Windows\System\MgnKoic.exe
  2⤵
  PID:11516
- C:\Windows\System\WqtbTbe.exe
  C:\Windows\System\WqtbTbe.exe
  2⤵
  PID:1912
- C:\Windows\System\WCoSplU.exe
  C:\Windows\System\WCoSplU.exe
  2⤵
  PID:11572
- C:\Windows\System\Trfpeqk.exe
  C:\Windows\System\Trfpeqk.exe
  2⤵
  PID:11716
- C:\Windows\System\SMntxsV.exe
  C:\Windows\System\SMntxsV.exe
  2⤵
  PID:11856
- C:\Windows\System\TnqhPiY.exe
  C:\Windows\System\TnqhPiY.exe
  2⤵
  PID:12012
- C:\Windows\System\RIBGnrG.exe
  C:\Windows\System\RIBGnrG.exe
  2⤵
  PID:12172
- C:\Windows\System\qfjtiMR.exe
  C:\Windows\System\qfjtiMR.exe
  2⤵
  PID:5632
- C:\Windows\System\agojgQF.exe
  C:\Windows\System\agojgQF.exe
  2⤵
  PID:5372
- C:\Windows\System\pKVereJ.exe
  C:\Windows\System\pKVereJ.exe
  2⤵
  PID:5344
- C:\Windows\System\oHDAUci.exe
  C:\Windows\System\oHDAUci.exe
  2⤵
  PID:11540
- C:\Windows\System\unbFuKB.exe
  C:\Windows\System\unbFuKB.exe
  2⤵
  PID:2268
- C:\Windows\System\SJpwPlV.exe
  C:\Windows\System\SJpwPlV.exe
  2⤵
  PID:11652
- C:\Windows\System\cfLIKHu.exe
  C:\Windows\System\cfLIKHu.exe
  2⤵
  PID:11832
- C:\Windows\System\gHnWMQV.exe
  C:\Windows\System\gHnWMQV.exe
  2⤵
  PID:3480
- C:\Windows\System\RDozJVT.exe
  C:\Windows\System\RDozJVT.exe
  2⤵
  PID:6052
- C:\Windows\System\LbKOaHi.exe
  C:\Windows\System\LbKOaHi.exe
  2⤵
  PID:5436
- C:\Windows\System\rqbmjTv.exe
  C:\Windows\System\rqbmjTv.exe
  2⤵
  PID:12292
- C:\Windows\System\eRzCymQ.exe
  C:\Windows\System\eRzCymQ.exe
  2⤵
  PID:12320
- C:\Windows\System\NHBjbul.exe
  C:\Windows\System\NHBjbul.exe
  2⤵
  PID:12348
- C:\Windows\System\gYHvcdI.exe
  C:\Windows\System\gYHvcdI.exe
  2⤵
  PID:12376
- C:\Windows\System\uxvxVCh.exe
  C:\Windows\System\uxvxVCh.exe
  2⤵
  PID:12404
- C:\Windows\System\kjHNDJu.exe
  C:\Windows\System\kjHNDJu.exe
  2⤵
  PID:12432
- C:\Windows\System\Unpivxp.exe
  C:\Windows\System\Unpivxp.exe
  2⤵
  PID:12460
- C:\Windows\System\CAEVpiS.exe
  C:\Windows\System\CAEVpiS.exe
  2⤵
  PID:12488
- C:\Windows\System\CPRJAmE.exe
  C:\Windows\System\CPRJAmE.exe
  2⤵
  PID:12516
- C:\Windows\System\ldBDmgb.exe
  C:\Windows\System\ldBDmgb.exe
  2⤵
  PID:12544
- C:\Windows\System\fCUonDr.exe
  C:\Windows\System\fCUonDr.exe
  2⤵
  PID:12572
- C:\Windows\System\mXQrzui.exe
  C:\Windows\System\mXQrzui.exe
  2⤵
  PID:12600
- C:\Windows\System\TDcDgxp.exe
  C:\Windows\System\TDcDgxp.exe
  2⤵
  PID:12628
- C:\Windows\System\vAJkqDp.exe
  C:\Windows\System\vAJkqDp.exe
  2⤵
  PID:12656
- C:\Windows\System\AECFcEw.exe
  C:\Windows\System\AECFcEw.exe
  2⤵
  PID:12688
- C:\Windows\System\fJjbfbn.exe
  C:\Windows\System\fJjbfbn.exe
  2⤵
  PID:12712
- C:\Windows\System\LAEbdWO.exe
  C:\Windows\System\LAEbdWO.exe
  2⤵
  PID:12740
- C:\Windows\System\LUIiauo.exe
  C:\Windows\System\LUIiauo.exe
  2⤵
  PID:12768
- C:\Windows\System\VlBLOsr.exe
  C:\Windows\System\VlBLOsr.exe
  2⤵
  PID:12796
- C:\Windows\System\WzxLqfV.exe
  C:\Windows\System\WzxLqfV.exe
  2⤵
  PID:12824
- C:\Windows\System\IDYGyRP.exe
  C:\Windows\System\IDYGyRP.exe
  2⤵
  PID:12852
- C:\Windows\System\JtbhFMG.exe
  C:\Windows\System\JtbhFMG.exe
  2⤵
  PID:12880
- C:\Windows\System\zrozFCj.exe
  C:\Windows\System\zrozFCj.exe
  2⤵
  PID:12908
- C:\Windows\System\gvtbEQh.exe
  C:\Windows\System\gvtbEQh.exe
  2⤵
  PID:12936
- C:\Windows\System\TylsjTf.exe
  C:\Windows\System\TylsjTf.exe
  2⤵
  PID:12964
- C:\Windows\System\pZvdbXd.exe
  C:\Windows\System\pZvdbXd.exe
  2⤵
  PID:12992
- C:\Windows\System\NpLpPFn.exe
  C:\Windows\System\NpLpPFn.exe
  2⤵
  PID:13020
- C:\Windows\System\rFwopBf.exe
  C:\Windows\System\rFwopBf.exe
  2⤵
  PID:13048
- C:\Windows\System\efUGDAs.exe
  C:\Windows\System\efUGDAs.exe
  2⤵
  PID:13076
- C:\Windows\System\KLSsJzX.exe
  C:\Windows\System\KLSsJzX.exe
  2⤵
  PID:13104
- C:\Windows\System\AcnrAKC.exe
  C:\Windows\System\AcnrAKC.exe
  2⤵
  PID:13140
- C:\Windows\System\fdUVqhB.exe
  C:\Windows\System\fdUVqhB.exe
  2⤵
  PID:13168
- C:\Windows\System\InaKlsF.exe
  C:\Windows\System\InaKlsF.exe
  2⤵
  PID:13196
- C:\Windows\System\zmhxvZI.exe
  C:\Windows\System\zmhxvZI.exe
  2⤵
  PID:13224
- C:\Windows\System\daeLRYp.exe
  C:\Windows\System\daeLRYp.exe
  2⤵
  PID:13252
- C:\Windows\System\wEUmxMq.exe
  C:\Windows\System\wEUmxMq.exe
  2⤵
  PID:13284
- C:\Windows\System\tUkNycO.exe
  C:\Windows\System\tUkNycO.exe
  2⤵
  PID:11764
- C:\Windows\System\cGGDjDB.exe
  C:\Windows\System\cGGDjDB.exe
  2⤵
  PID:12344
- C:\Windows\System\CnxbbqY.exe
  C:\Windows\System\CnxbbqY.exe
  2⤵
  PID:4132
- C:\Windows\System\gesAtty.exe
  C:\Windows\System\gesAtty.exe
  2⤵
  PID:12416
- C:\Windows\System\BfUwsSc.exe
  C:\Windows\System\BfUwsSc.exe
  2⤵
  PID:12480
- C:\Windows\System\cLqucGw.exe
  C:\Windows\System\cLqucGw.exe
  2⤵
  PID:12540
- C:\Windows\System\bekLmyR.exe
  C:\Windows\System\bekLmyR.exe
  2⤵
  PID:12616
- C:\Windows\System\UXRQTgA.exe
  C:\Windows\System\UXRQTgA.exe
  2⤵
  PID:12676
- C:\Windows\System\TFCGRMz.exe
  C:\Windows\System\TFCGRMz.exe
  2⤵
  PID:12736
- C:\Windows\System\OUZeEVC.exe
  C:\Windows\System\OUZeEVC.exe
  2⤵
  PID:12808
- C:\Windows\System\aIrstMk.exe
  C:\Windows\System\aIrstMk.exe
  2⤵
  PID:12876
- C:\Windows\System\jvgIhWG.exe
  C:\Windows\System\jvgIhWG.exe
  2⤵
  PID:12928
- C:\Windows\System\CADkbqa.exe
  C:\Windows\System\CADkbqa.exe
  2⤵
  PID:12984
- C:\Windows\System\NkYPCKD.exe
  C:\Windows\System\NkYPCKD.exe
  2⤵
  PID:13044
- C:\Windows\System\LgezSxb.exe
  C:\Windows\System\LgezSxb.exe
  2⤵
  PID:13100
- C:\Windows\System\baHPBQO.exe
  C:\Windows\System\baHPBQO.exe
  2⤵
  PID:13164
- C:\Windows\System\sXFZUPr.exe
  C:\Windows\System\sXFZUPr.exe
  2⤵
  PID:13216
- C:\Windows\System\jPZwfrS.exe
  C:\Windows\System\jPZwfrS.exe
  2⤵
  PID:13296
- C:\Windows\System\NPbnolY.exe
  C:\Windows\System\NPbnolY.exe
  2⤵
  PID:12400
- C:\Windows\System\wdIJlZg.exe
  C:\Windows\System\wdIJlZg.exe
  2⤵
  PID:12528
- C:\Windows\System\GawcSIt.exe
  C:\Windows\System\GawcSIt.exe
  2⤵
  PID:12672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kceycyeq.v1k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System\BsVAapK.exe

Filesize
2.9MB

MD5
ca203dc19b0af91be2c47c0c8a753a2a

SHA1
fd45bba4850bbca37513b4bec1fc5a951a57e351

SHA256
39030ea2f67c8aa686b0d9d1fc239b664daf69e790a6e6185b60fa73fbcd376c

SHA512
6fc02598c6c8fdfffd6cff9b13b7d0c71032412b15c669749402df88598519de5d53b9fc006ea2141645291c206598e36d7db2d840a3879e433e438eb177222f

Download Submit
C:\Windows\System\DKpmqjc.exe

Filesize
2.9MB

MD5
5b267fda96a9843f39232f67ea93e877

SHA1
77b8976954a545cdecee1137d75bb275139a7efb

SHA256
0a2072abc92bd11e225f625dccf75499c072d066ac66ef2d489d0a9108fd2f3c

SHA512
21f42c570b6818c603e5fb7a150c72ffeb83f400d2591ebca1f41323890bdc8a017fbe9e8e086c09a2922a4494ec90e6334629cd192e54f4887ca40e1801c768

Download Submit
C:\Windows\System\JanujiU.exe

Filesize
2.9MB

MD5
76ea8d15f4e3e13c479b5c58d877eac0

SHA1
31764d7fe1b0f15c39e4247ac17c1912a4554b8b

SHA256
0b6ac331cb2b6da94226add18c6998c05c8c3fab2f13f6c50e974eaa71fa418f

SHA512
490bb2214c83f9ed4869372be645fc9f11a8869f446b841f309b72762d17f528753382ea52f165f9fe1f6d7c82dcfab1e1334d0cfaadc5b9b104f008db39485f

Download Submit
C:\Windows\System\JwRIrDA.exe

Filesize
2.9MB

MD5
b84209cefb072bdf64f3f6af35e2dae1

SHA1
2326deede583ff167b85b758b079f30d35030174

SHA256
655b0cfecd12dbeb83f1144dd67b8649127a4d52a2cd234b7de10d3d8e2c6303

SHA512
1314919509ceb3dcad963ef80969cf05ace9f8e7e6c47264bbcaa42b5dbbe625925fc3d01c47411ba5c0ba1e5036ea01bf7317a45f0319a2af3fa2a351cde7f6

Download Submit
C:\Windows\System\JwXudxX.exe

Filesize
2.9MB

MD5
27311d4cc7beeadcc6b1daa7500ce703

SHA1
75bdf60dc934aa5120f4d152e4f22596f058448e

SHA256
d51551f39d91e6fb370cf855ee8c4627f7b41fe0e59d6653f717f0bcab2309be

SHA512
220036a68419483763a2462fed77d7fd066592858897fffc6d23e450de1152aee657e0ae0664c7a21250e67f30db86d74fde8452ea6461439e507446a1e53d70

Download Submit
C:\Windows\System\KAgrTVC.exe

Filesize
2.9MB

MD5
e97f73ac73553a2e3cbe1d6ab097e623

SHA1
47185f585917af81681fa7e5d527e90778f7eaeb

SHA256
c00da4dc5289d6a1d6d4f0a983ed379b6d6cbe688f08dd1e2ebde373d70f6a6e

SHA512
275c951923299c50aa4ba879987b432167b77dd3bafe20dabcc4e6d41ac9b65cae4f8ddaa1bff087019e69fbaae87fcab84bbafde24ead32d4f7c467c1b94839

Download Submit
C:\Windows\System\LuJqTrf.exe

Filesize
2.9MB

MD5
74ad42e7bf9a8af6015ed287d6da49c5

SHA1
edf784f57d4847aa3146f22d17616b919721b61b

SHA256
e3a3eb9eae8af153b02b32b52cdd2f011386a35cf6a4ef5af812b708a5b39410

SHA512
9b86ab53fc2c25eb36ed02b1e1eeea32742d91df2b3ea7259b8230b2fe4702f4bc757fb5a8a2027bb09691534542c60ba9f365f22becab1093184a5886a5e4cf

Download Submit
C:\Windows\System\MCjVxBO.exe

Filesize
2.9MB

MD5
b901785487d1c15b242f3e3103993535

SHA1
039dc6b1e7da483365bd2561727839e07bb83a1a

SHA256
7940466a2a2bf5a9e61c2679952b664eb4d5d5eee43fe4e87e96b43bba71adff

SHA512
0852ea0f296a9035bbdd6321dcbd5ad74b9d232a75b1d8d34d1604c396e761bf045251f29f7dace7e743e94b3059d7079b91cb625312049bd6642e96e99d3cd2

Download Submit
C:\Windows\System\NrPFzAM.exe

Filesize
2.9MB

MD5
1d49ca0f97b7d84e5d9920e102c0f8bb

SHA1
e8fa9ffb2e58883a5887c985c007335733daff98

SHA256
03fd82c9bf19f86e3e8f59bb1b2d7ef7cd07b1d344ba180892aaffa9e46fd78d

SHA512
0f8d48b778ec3c7350ebac1da8b0f9c7ece06ad8de03dc7399b4d35aab58a97ac8cea17998dd9e140deaa9c258c83f47ed762ed07a3aa75a0d47f5565fe6575d

Download Submit
C:\Windows\System\OOngFsZ.exe

Filesize
2.9MB

MD5
ad85e8f357db24284723a3ac6e4b31d4

SHA1
c9482776c037c43a631e32d83ca6517ac31a0f64

SHA256
c4187ee986f1ca73b1648367e3c9d13b0dc825191d0606d5d7aa03d875b2007c

SHA512
9b01f871e328ab6eaa1d881915ec44e1223a6686b244d51b6fe86873537667235491105106cdb394e0876fdde3618e72c40373faae071e2cd88ea41cd04e9cad

Download Submit
C:\Windows\System\RkGfnep.exe

Filesize
2.9MB

MD5
ca4951997c0235a0ef2138556b53022d

SHA1
c8c9e491d4cb83722277f3b03650f5b57383cb65

SHA256
6e3f681adfced282be0aaf69ab016ef99e213b401651d59cd5a34d2e88415e72

SHA512
f72b9de4e7da6d838250ea27eefa21cb40b1f1cb6cf9c3db77dda8a700cb884e6bc0d8a60480f237d66b597e52b4c435520d7d3af1638e7b7ce4c21d473942fe

Download Submit
C:\Windows\System\UwVyLYq.exe

Filesize
2.9MB

MD5
55e6141d2425a5177ba8e3ddc33cbb06

SHA1
0c371221ef5bb394f5d5758446320b09c2d6a6ce

SHA256
4eb12ad30d0becf8c039db18cee3b8941962115e7da0209d78a27d0f4ee8ad3d

SHA512
a8c21d5363fbc3103be916f76966d73f533d350aacbc9d4f1c9d128e523d2ba3543f46cf4b3681def5a7a17deeb8e1131e38a9115c023a959cc8b1048ef1b468

Download Submit
C:\Windows\System\WnmGYbx.exe

Filesize
2.9MB

MD5
d1ff40d41a88b48618d447a4451e6645

SHA1
2655b332c4a80963367088661f1593abb4f368d5

SHA256
f3f9eb4ef89c15bc80a83aa1e3e903bf4b29274da241cfd8917f2e6fbecc1ff6

SHA512
6c376fe8d90c83a7ef66b9607756ebf55193ad07dac2d1ad314d0260da4d1fca15b1f01a3aab62bb875402ab9bff8ee16330b4bb0a94152f459c715a49ce94ba

Download Submit
C:\Windows\System\XFErhRC.exe

Filesize
2.9MB

MD5
3c9131b2a2097c06d8971ea60475fa3c

SHA1
a1f503460e73daf1298ca857df2c7672db275629

SHA256
29565ebbdb9cd92da1b17d7653d92bcb08d3b2311ed3fb4bb07c4e8d5af4f39e

SHA512
d86b291a2294d1855d624d4b5b34c72150438a5de025e963a5917af46254427a147dae6ba310cffb6eae5011f9e85f4f72fe2bcb50160a2716545a55e9104f01

Download Submit
C:\Windows\System\YDPqbXN.exe

Filesize
2.9MB

MD5
2a8ebbb60d0f05a8bf1129f683af330c

SHA1
1b84a467db5eb35f6270b8a084175133db30483d

SHA256
f669740a8504c0fc9576952955af77258b60e36a42287d26f07c62e33d0cc45c

SHA512
672cee2382a82aa8374c3f4827f392a0b88445cc0c312ea02957e96bf8ed45b2e68cfebf1963573428b081ef952c101ee4afa063a85a1a6a0d3c7efa277b06a0

Download Submit
C:\Windows\System\YnMJatz.exe

Filesize
2.9MB

MD5
0a8155d95fb2203c1ba96e8187ef14bc

SHA1
5c58d2a8e8a623a2b20e49d92be540f7aba4c252

SHA256
32fedf1a9849f17299c3fe91cd9910de066b4fcb19cdcd17d25a18c96daccbb3

SHA512
803e3dbb4346d39298253aa24a7479de258e8afffc7c8f72730ab6be7fe992e8f211053049ea205d756924a51275b04350e07910cbf223925186d6ffe81ea4da

Download Submit
C:\Windows\System\YnMJatz.exe

Filesize
1.1MB

MD5
153b8ae141907f468179073fca5869c3

SHA1
3112e61d0879026aeeb160ddac250777b2be012f

SHA256
34fe9f400a6e97af045befd3271d7b8978c50144a79249607bb5a255fa9f1858

SHA512
e7fa23204cfd27c43b1a4aeeacb5a5d77548b127049c3fd133d4b3f2f752681339bfc43cc119763bd7720b9c1380318f49ebd4ce780c0ff41e0adf54802ee494

Download Submit
C:\Windows\System\ZLWTEEy.exe

Filesize
2.9MB

MD5
799163dc40a8aad5f162b584959af48c

SHA1
be909541870acae9d4a91a0a9dfe3997cb5eb113

SHA256
bff6ca6539494d61b56595f1dd9f1e24a973dc0fb7c42963dc4bcdc25f91187b

SHA512
34eba1323750c9f32acffed2439c120ac44f5d8bd31e88c41cf4293e0f0e853589be46dbfa1abb106509e23a4100becdf86d5f29ffc9260189a183ba2f609355

Download Submit
C:\Windows\System\ZLWTEEy.exe

Filesize
2.7MB

MD5
abb21eec4c46fd51cdd2765be5a8b793

SHA1
0075a720f158f7df3c23ec67fc472395beaa92a4

SHA256
5b4ba5e0b9ca8827d5a1c8c374923b126673d7849d6ff5f31dbe426509804695

SHA512
3b0a50c2e57376233bde69b9b261e6c1dc51289b312294f5bc02f20b1a8224517a00722913d61dabe8a3cbba2f8ffa45f6d3079c63a6a6ee7a163234c1017fb2

Download Submit
C:\Windows\System\bRAeLdb.exe

Filesize
2.9MB

MD5
3a795907d2101293b85208d6841c517d

SHA1
3c0de0c99e0b8cebcec9600aa4cfe91a8c9e9afe

SHA256
c77db2785dcdab02f71a0bc73ad3959d47df93b787153873dde5684965a8e887

SHA512
6be822bff4367be30f9e5bd3009ee31daea92381515308ef7a70b7528834b09310d0bc5b807258451948030372ae41f926f5dae3efcdee63e57df359b1376fec

Download Submit
C:\Windows\System\btrkWfW.exe

Filesize
2.9MB

MD5
88a97dc0f27db8b79863705c609477be

SHA1
f1a541941a598f704f0e5256818dc83911493d41

SHA256
ace2ab28498a1257bfd3ced4712c12884e2d8cedda1e97572ecb27f771684dc8

SHA512
36ab50a48891bebb7785ca3815fa305ccc3e402a2deebd984a121e737a01eef2161ea31a6f55249f08d47e2e2b79fc97d072fa5c91d4e36b0f797c0def1c9ea4

Download Submit
C:\Windows\System\btrkWfW.exe

Filesize
1.8MB

MD5
ad3c14defd4a06542edcc54a3f3b8372

SHA1
ae48b58af10c08c03f1f87c2b161a3629b2b112f

SHA256
00ea2ddb66f71ef98727562bd09b724e4d6beb8bb2ccf9444670649c0bf84093

SHA512
7091d98e3925bc6bffa3f489f99bbd11938ece0c3aa7c39dd4ded12cb18261bfc3405cf809a52af9af3fb6aa9d5408b1a77f59c8ebb9aaf3445ed07ce97f8425

Download Submit
C:\Windows\System\gDbmSgm.exe

Filesize
2.9MB

MD5
35b59dc8a7dfc9ccdc5135b7a8af0ba4

SHA1
e54ba6589a0d7aa944bb8beca442e6f6bc8589c7

SHA256
350a007c9adb35eecefc34e988c3e36134ed5e7a1f7c0ed4e00e868a89c96fb3

SHA512
4fe8a584eefeb02646ca70bd77560ae276e9f5361628574f4c3bd35dc08e360d53253259cdc9e75ed38dcc785dbfc3cd944c6b04c64b2a4cdfaccf9715c0fb11

Download Submit
C:\Windows\System\jGUrraU.exe

Filesize
2.9MB

MD5
e499b5955482172dd7baefa474d637eb

SHA1
8502d4cd127626041f80dc403e837efb3a52fde0

SHA256
67a0900430b66d742bc424840494fa9df4402a626bce72680938cb0f260e1597

SHA512
a5aca75883fe4125ea2122406a2eee1acb802a43cc192d499f0a6cd3d8edb60d2552b7feb8b031ff0974cb2ad613aa78d2b21cbe65725c3d68d9e1992db0d72f

Download Submit
C:\Windows\System\kNcvfli.exe

Filesize
8B

MD5
cf50e241303d497858ee01855fb582c8

SHA1
071c6ca1d65e04749f98c6a703cbc804ec84ade3

SHA256
501a1602089109b7d1620eb45678928ef48594bd3e9d379e4d9cd5c0f3bdf610

SHA512
9acf492462174dc95aadbf576467af6a3992f55fe198a880427aa6ca9bf21c04fc7a421b1986a9d47e9b0a48e3c4b3d86850c8700c25e99a738c34f1ba7766bb

Download Submit
C:\Windows\System\lgBxcZe.exe

Filesize
2.0MB

MD5
2370932cbcab1ad97fddb1cfb81e1fa5

SHA1
e0a385fb14fc33d37e8a0be9f6e97169c0e025eb

SHA256
94dc91012f73cd572b09aeeb65f5a39ce70708e9a3b17b54f69b9a3459d4f3f6

SHA512
d7b120fbf140f6cf9c06473bfddd72e483d459048561ea523eeaaa131d93a23f16c41423f946643c1b3094e8f1766a0b56df74c267648676ce5e8f151d7408a0

Download Submit
C:\Windows\System\lgBxcZe.exe

Filesize
2.9MB

MD5
e0cfe82b4bf269320a0a74ca9f0679c3

SHA1
c5445b80d13df9107aa9f5305ffd22084ce4d360

SHA256
9b6aeec4079d4b9e89d6599c378c1b5eb7178b6ec0c95f3e64405e76527007cd

SHA512
51f854b3c436a9b903b0e1a426b20be8b3b7ccf0bbce35c3e0d70edd1b0aaf857fac2b92c4ba9fbadad3ca317f23ca5a67880ec07f2b407dd6167d08be583aeb

Download Submit
C:\Windows\System\lkbcaxn.exe

Filesize
2.9MB

MD5
a8d2ff795c0cb24f1bc83bd59f4c79c0

SHA1
a769f133885fb463bf79c6d9c7a55a76304f684e

SHA256
16b65289001d82ff6d35958b171d773980b4cae58c0a4c1adc809f8a51c58d27

SHA512
29360c2baa02eb1694cb73212a83b930a57bc07cf51fa3a9d839fe8a0694538b7d55480707c0908de7bbf432f52e2bb2072dba8b11e098653f52613b8a9ff062

Download Submit
C:\Windows\System\nBvBeNM.exe

Filesize
2.9MB

MD5
34cb9bc631c06cd7f351ab393f9ece87

SHA1
5041e3dd71a677c6908a51b3a72cac97936a767a

SHA256
8a1475e0d3457356e17b0ec5230f6ce21f47bab4c2c5157879a8708314371994

SHA512
db2b247c52ba1f26b71184473d3a862b4764c607a14a28507db08443bab3cbfcb83fefed729a1cf7237b42d8c0133b3f6c00a1759edfb31600b785f45a0743e0

Download Submit
C:\Windows\System\nbCNCvu.exe

Filesize
2.9MB

MD5
1e0d1075bc06363649950359d9930784

SHA1
a64f927b42502e042fd796edfc8efe775ef508a9

SHA256
cf6e9055dba3d0d488893889af212755960c6abe0d778a0b7f588adc1813758f

SHA512
ff28310bd019e4ee1e2cf061fa37fbcd20a6c0b56bd20254a38b095668651c6fa4e98decf0e0e83922b82ea200ff4b903cfe17ddd6741257620fffabbca02e7a

Download Submit
C:\Windows\System\nmidpHU.exe

Filesize
2.9MB

MD5
ed646c0c2ead30634d62fb26415646f1

SHA1
87f26dd7310b103e445a5a1bbc555e3a5c4cd1bd

SHA256
39c16e2d6f861aad8e9dd90ad91bccd51e097f118bd9ce24bce741d4b42063ef

SHA512
d69a8073c811623bf6f85f61498ce3683ac7a07bcd38123b1c0151cf7f609ce2ebb2636f4bcb6f3558f0eba5fa5b3e774d79ea2a1004a02b1ef7ec66635759fc

Download Submit
C:\Windows\System\qpVPIyN.exe

Filesize
2.9MB

MD5
ee1005f269f06f359dd4d9e585dd23c2

SHA1
fbb217f1d2d0d31a629064f91895b814ce53c03e

SHA256
a4d11ae912ef49565a5e3a4d8ebf2894412bf6617645a748530227c15b3b172e

SHA512
331be43c666067fa2a24d858e8f9204be8a7003e6c7a95a17e1bdb218f7e9519a09fc3ca812cc1014a0e2e734c8f64e32cc7f8c2c47509beb8ffdcf7bd96e912

Download Submit
C:\Windows\System\rEictAv.exe

Filesize
2.9MB

MD5
90d6db870eed78eb02792d60894b004c

SHA1
a7c1e0336362d459d868330a9ea8dfbdf4810f5e

SHA256
47523a56e283533b0b1bd88df08b903a8b1c25df60f4bceebe3a1ee64e2d8241

SHA512
054808e2ebe2bb35bc3d237d8310407d56a732bb283b0196b2755a34859a78b4359780fee532abecb17d8708b54a70464a851e45d620cf51d6a6ccc7e39d4949

Download Submit
C:\Windows\System\rEictAv.exe

Filesize
2.1MB

MD5
7e77a83bac5b64127c3968dcf9d11952

SHA1
d67ce3f5d446d8450b88a9634b35c169f7286e71

SHA256
8781a039cffa0eadbf16aedbde0d02988e6cce7523b7bb09676ee8fcdd69b7d7

SHA512
742292871371c96c134ff219aefb6f193c19078c10b47280f77fae938bfcd02248c85f4fcc75a43b679f1ba7e981a37f2d5a084c0174b1ed4d2540cd9ce4e3f8

Download Submit
C:\Windows\System\shUaqQU.exe

Filesize
2.9MB

MD5
be499fee3e550a075a91b5b067ad8a71

SHA1
31237cd74a263c9d4ac6cd5d96c680b8ca622dc2

SHA256
17d26c57632bd7be614bd43001bb2003db4983b1899d694279050bcbcda954e6

SHA512
ba61d4a4cb3a3ab819c867d5a325549ebbc86cd0ec3342262c101df26f8ec0c61900c4d6dbc22d7569f1b4eb25391943bfe617b42e56777bb441d2d400439dee

Download Submit
C:\Windows\System\xjZbkjR.exe

Filesize
2.9MB

MD5
e65674f3f207f1d9d13346129f321a1f

SHA1
ed34e59023d52df9d1954bcf3f27c32fc4ee2d39

SHA256
cab020e0e8e8ecfd619596ff00c29cf1ace5726ed78b78b4c593880292632a46

SHA512
899e1e0c24cfca0fd20f7aec2280919a603f02f1567a44c1d43ce901fc0642bf91fa019ae1c7c0cae1be3e4d17d16f2882d61715dfeefe7af579903e2f43a6df

Download Submit
C:\Windows\System\xjZbkjR.exe

Filesize
1.2MB

MD5
7f8e0a6822531fc1039d8a6bce159083

SHA1
47f95f1a7a9eaabad4c50ffd816906e278c8681b

SHA256
7a9b71aff99bdc53b469fe135d78fffcb8e850e481cd5dafb394f3135a4b110a

SHA512
3e01ce51d419b5de20cca0c3752b0e65c3202aa31ad07946000247de428decb271df4d7e3c87c55d789b045bebf11c9d1f77094a55f7186c779e72c45cd12ea4

Download Submit
C:\Windows\System\yzPHYKC.exe

Filesize
2.9MB

MD5
28e44d108b2b3a40b781cc761db7e77e

SHA1
629db2b05a4e701367e6af87f5bf3d3b3b63457a

SHA256
c0c84975d4fb174f425fcd0e941c57f800f41d58677334cf65d03db213d43ac0

SHA512
62223834ea8aece5c7aa3908b9c06c0b93734e7b31191d2c47524ec0871bfce90ea1515046d7ba5bfedfd76a9c28d405adaabfddc92e9b0a575a4b3120dacb06

Download Submit
C:\Windows\System\zIOdVxg.exe

Filesize
2.9MB

MD5
2382044023ded323575b749583df2680

SHA1
492bf8a6b14d608a13ce6094c551311182e03214

SHA256
23c834e107affcad457feb680bf5376bb91f968f97628e4024d24e69ebe00af5

SHA512
0706ffff8893a2935cfde2fe0ac98d6dad151fd4930e543440ca743bc13d96e44acc3821aa3ecdbb1568b764d1fc55f348f36d880477fe57b64d5dcef0f699d1

Download Submit
memory/556-99-0x00007FF660F10000-0x00007FF661306000-memory.dmp

Filesize
4.0MB

Download
memory/556-2319-0x00007FF660F10000-0x00007FF661306000-memory.dmp

Filesize
4.0MB

Download
memory/1048-2329-0x00007FF7B13B0000-0x00007FF7B17A6000-memory.dmp

Filesize
4.0MB

Download
memory/1048-140-0x00007FF7B13B0000-0x00007FF7B17A6000-memory.dmp

Filesize
4.0MB

Download
memory/1172-105-0x00007FF65D1B0000-0x00007FF65D5A6000-memory.dmp

Filesize
4.0MB

Download
memory/1172-2320-0x00007FF65D1B0000-0x00007FF65D5A6000-memory.dmp

Filesize
4.0MB

Download
memory/1476-2330-0x00007FF669F30000-0x00007FF66A326000-memory.dmp

Filesize
4.0MB

Download
memory/1476-147-0x00007FF669F30000-0x00007FF66A326000-memory.dmp

Filesize
4.0MB

Download
memory/1596-2317-0x00007FF6C2C90000-0x00007FF6C3086000-memory.dmp

Filesize
4.0MB

Download
memory/1596-93-0x00007FF6C2C90000-0x00007FF6C3086000-memory.dmp

Filesize
4.0MB

Download
memory/1812-119-0x00007FF6DE910000-0x00007FF6DED06000-memory.dmp

Filesize
4.0MB

Download
memory/1812-2326-0x00007FF6DE910000-0x00007FF6DED06000-memory.dmp

Filesize
4.0MB

Download
memory/2032-2335-0x00007FF74F9B0000-0x00007FF74FDA6000-memory.dmp

Filesize
4.0MB

Download
memory/2032-162-0x00007FF74F9B0000-0x00007FF74FDA6000-memory.dmp

Filesize
4.0MB

Download
memory/2124-4-0x00007FFD6E663000-0x00007FFD6E665000-memory.dmp

Filesize
8KB

Download
memory/2124-11-0x0000025F38F00000-0x0000025F38F22000-memory.dmp

Filesize
136KB

Download
memory/2124-165-0x0000025F39BE0000-0x0000025F3A386000-memory.dmp

Filesize
7.6MB

Download
memory/2124-32-0x00007FFD6E660000-0x00007FFD6F121000-memory.dmp

Filesize
10.8MB

Download
memory/2124-1849-0x00007FFD6E660000-0x00007FFD6F121000-memory.dmp

Filesize
10.8MB

Download
memory/2124-71-0x00007FFD6E660000-0x00007FFD6F121000-memory.dmp

Filesize
10.8MB

Download
memory/2208-1540-0x00007FF7228B0000-0x00007FF722CA6000-memory.dmp

Filesize
4.0MB

Download
memory/2208-1-0x000001EE944E0000-0x000001EE944F0000-memory.dmp

Filesize
64KB

Download
memory/2208-0-0x00007FF7228B0000-0x00007FF722CA6000-memory.dmp

Filesize
4.0MB

Download
memory/2256-2321-0x00007FF75A500000-0x00007FF75A8F6000-memory.dmp

Filesize
4.0MB

Download
memory/2256-121-0x00007FF75A500000-0x00007FF75A8F6000-memory.dmp

Filesize
4.0MB

Download
memory/2304-51-0x00007FF6BF6E0000-0x00007FF6BFAD6000-memory.dmp

Filesize
4.0MB

Download
memory/2304-2316-0x00007FF6BF6E0000-0x00007FF6BFAD6000-memory.dmp

Filesize
4.0MB

Download
memory/2572-2325-0x00007FF7F1150000-0x00007FF7F1546000-memory.dmp

Filesize
4.0MB

Download
memory/2572-115-0x00007FF7F1150000-0x00007FF7F1546000-memory.dmp

Filesize
4.0MB

Download
memory/2952-158-0x00007FF76E5B0000-0x00007FF76E9A6000-memory.dmp

Filesize
4.0MB

Download
memory/2952-2334-0x00007FF76E5B0000-0x00007FF76E9A6000-memory.dmp

Filesize
4.0MB

Download
memory/3620-2327-0x00007FF7C5CA0000-0x00007FF7C6096000-memory.dmp

Filesize
4.0MB

Download
memory/3620-142-0x00007FF7C5CA0000-0x00007FF7C6096000-memory.dmp

Filesize
4.0MB

Download
memory/3656-2315-0x00007FF7BCDC0000-0x00007FF7BD1B6000-memory.dmp

Filesize
4.0MB

Download
memory/3656-86-0x00007FF7BCDC0000-0x00007FF7BD1B6000-memory.dmp

Filesize
4.0MB

Download
memory/3720-2313-0x00007FF749B30000-0x00007FF749F26000-memory.dmp

Filesize
4.0MB

Download
memory/3720-46-0x00007FF749B30000-0x00007FF749F26000-memory.dmp

Filesize
4.0MB

Download
memory/3840-2312-0x00007FF608890000-0x00007FF608C86000-memory.dmp

Filesize
4.0MB

Download
memory/3840-79-0x00007FF608890000-0x00007FF608C86000-memory.dmp

Filesize
4.0MB

Download
memory/4092-1860-0x00007FF60AF50000-0x00007FF60B346000-memory.dmp

Filesize
4.0MB

Download
memory/4092-2318-0x00007FF60AF50000-0x00007FF60B346000-memory.dmp

Filesize
4.0MB

Download
memory/4092-58-0x00007FF60AF50000-0x00007FF60B346000-memory.dmp

Filesize
4.0MB

Download
memory/4116-2323-0x00007FF69E050000-0x00007FF69E446000-memory.dmp

Filesize
4.0MB

Download
memory/4116-127-0x00007FF69E050000-0x00007FF69E446000-memory.dmp

Filesize
4.0MB

Download
memory/4120-2322-0x00007FF657B70000-0x00007FF657F66000-memory.dmp

Filesize
4.0MB

Download
memory/4120-110-0x00007FF657B70000-0x00007FF657F66000-memory.dmp

Filesize
4.0MB

Download
memory/4152-139-0x00007FF6D4DB0000-0x00007FF6D51A6000-memory.dmp

Filesize
4.0MB

Download
memory/4152-2328-0x00007FF6D4DB0000-0x00007FF6D51A6000-memory.dmp

Filesize
4.0MB

Download
memory/4284-154-0x00007FF6A6B50000-0x00007FF6A6F46000-memory.dmp

Filesize
4.0MB

Download
memory/4284-2331-0x00007FF6A6B50000-0x00007FF6A6F46000-memory.dmp

Filesize
4.0MB

Download
memory/4660-2314-0x00007FF7BC6F0000-0x00007FF7BCAE6000-memory.dmp

Filesize
4.0MB

Download
memory/4660-42-0x00007FF7BC6F0000-0x00007FF7BCAE6000-memory.dmp

Filesize
4.0MB

Download
memory/4868-2333-0x00007FF739B00000-0x00007FF739EF6000-memory.dmp

Filesize
4.0MB

Download
memory/4868-152-0x00007FF739B00000-0x00007FF739EF6000-memory.dmp

Filesize
4.0MB

Download
memory/4968-2324-0x00007FF79FEF0000-0x00007FF7A02E6000-memory.dmp

Filesize
4.0MB

Download
memory/4968-130-0x00007FF79FEF0000-0x00007FF7A02E6000-memory.dmp

Filesize
4.0MB

Download
memory/5060-2332-0x00007FF64A630000-0x00007FF64AA26000-memory.dmp

Filesize
4.0MB

Download
memory/5060-155-0x00007FF64A630000-0x00007FF64AA26000-memory.dmp

Filesize
4.0MB

Download